@adonis-agora/durable 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/src/dashboard/console_authorize.js

@@ -0,0 +1,101 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+function isAuthorizerClass(value) {
+    return (typeof value === 'function' &&
+        typeof value.prototype?.authorize === 'function');
+}
+function lazyModuleClass(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const candidate = value.default;
+    return isAuthorizerClass(candidate) ? candidate : undefined;
+}
+/**
+ * Collapse an `authorize` result into a {@link ConsoleDecision}. Only `true` or an object with
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial with a redirect target;
+ * anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value — is a `403`.
+ */
+export function normalizeConsoleDecision(result) {
+    if (result === true)
+        return { allowed: true };
+    if (typeof result !== 'object' || result === null)
+        return { allowed: false, reason: 'forbidden' };
+    const record = result;
+    if (record.allowed === true)
+        return { allowed: true };
+    if (typeof record.redirectTo === 'string' && record.redirectTo !== '') {
+        return { allowed: false, reason: 'unauthenticated', redirectTo: record.redirectTo };
+    }
+    return {
+        allowed: false,
+        reason: record.reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden',
+    };
+}
+async function runAuthorizer(Authorizer, ctx) {
+    const instance = await ctx.containerResolver.make(Authorizer);
+    return instance.authorize(ctx);
+}
+/**
+ * Turn any {@link ConsoleAuthorize} form into a per-request gate:
+ *
+ * - a class is instantiated through the request's container resolver (so `@inject()` works) and its
+ *   `authorize(ctx)` is called;
+ * - a function is called with `ctx`; when it resolves to a module whose `default` is an authorizer
+ *   class it was a lazy import — the class is remembered (the import runs once) and used from then on;
+ * - a thrown error is a `403`, never an allow.
+ */
+export function resolveConsoleAuthorize(authorize) {
+    let Authorizer = isAuthorizerClass(authorize)
+        ? authorize
+        : undefined;
+    if (Authorizer === undefined && typeof authorize !== 'function') {
+        throw new TypeError('[console] `authorize` must be a function, an authorizer class, or a lazy import of one.');
+    }
+    const fn = authorize;
+    return async (ctx) => {
+        try {
+            if (Authorizer !== undefined) {
+                return normalizeConsoleDecision(await runAuthorizer(Authorizer, ctx));
+            }
+            const result = await fn(ctx);
+            const lazy = lazyModuleClass(result);
+            if (lazy !== undefined) {
+                Authorizer = lazy;
+                return normalizeConsoleDecision(await runAuthorizer(lazy, ctx));
+            }
+            return normalizeConsoleDecision(result);
+        }
+        catch (error) {
+            return { allowed: false, reason: 'forbidden', error };
+        }
+    };
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest();
+}
+/**
+ * An `authorize` for machine access (scripts, a Prometheus scrape): allows a request whose
+ * `Authorization` header is `Bearer <token>`, and answers `{ allowed: false, reason: 'unauthenticated' }`
+ * (`401`) otherwise. Only the header is read.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ * ```
+ *
+ * Throws at config time when `token` is empty or undefined.
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error('authorizeByToken: `token` must be a non-empty string');
+    }
+    // Compare digests: equal length always, so the check leaks neither a match nor the token length.
+    const expected = digest(token);
+    return (ctx) => {
+        const header = ctx.request.header('authorization');
+        const match = typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+        if (match?.[1] && timingSafeEqual(digest(match[1]), expected))
+            return { allowed: true };
+        return { allowed: false, reason: 'unauthenticated' };
+    };
+}
+//# sourceMappingURL=console_authorize.js.map

package/dist/src/dashboard/console_authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_authorize.js","sourceRoot":"","sources":["../../../src/dashboard/console_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiD1D,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,UAAU;QAC3B,OAAQ,KAAiD,CAAC,SAAS,EAAE,SAAS,KAAK,UAAU,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC3D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAuE,CAAC;IACvF,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACtF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;KAC9E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkC,EAClC,GAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,IAAI,UAAU,GAAuC,iBAAiB,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAA0C,CAAC;IAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAQD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAgB,EAA0B,EAAE;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,6 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
-import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
+import { type ConsoleAuthorize, type ConsoleAuthorizeGate, type ConsoleAuthorizeResult, type ConsoleDecision } from './console_authorize.js';
 /**
  * The function form of {@link DurableDashboardConfig.accessDenied}: render (or answer) a refused
  * page navigation yourself. Receives the refusal ({@link AccessDeniedInfo}) and the AdonisJS
@@ -15,41 +15,28 @@ export type AccessDeniedOption = GenericAccessDeniedOption<HttpContext>;
  * A structured answer from an {@link AuthorizeHook}: whether the request may proceed and, when it may
  * not, why. The `reason` picks the status: `'unauthenticated'` (nobody is signed in) → `401`,
  * `'forbidden'` (signed in, not allowed) → `403`. No reason → `403` (fail closed).
- *
- * This is the shared Agora dashboard-gate contract — the same shape every `@adonis-agora` console
- * accepts, so one hook (e.g. `@adonis-agora/authz`'s `authorizeByRoles`) can gate them all.
  */
 export interface AuthorizeDecision {
     allowed: boolean;
     reason?: 'unauthenticated' | 'forbidden';
 }
-/** What an {@link AuthorizeHook} may return: a bare boolean or an {@link AuthorizeDecision}. */
-export type AuthorizeResult = boolean | AuthorizeDecision;
 /**
- * Authorization guard for the dashboard. Runs before every dashboard route (API + HTML). May be
- * async (e.g. an auth lookup). Return:
- *
- * - `true` or `{ allowed: true }` → the request proceeds;
- * - `{ allowed: false, reason: 'unauthenticated' }` → `401` (the access-denied page with the
- *   "sign in" story for a page navigation, `{ error: 'unauthorized' }` for an API request);
- * - `{ allowed: false, reason: 'forbidden' }`, `{ allowed: false }` or `false` → `403` (the
- *   access-denied page, or `{ error: 'forbidden' }`).
- *
- * A hook that THROWS is a denial (`403`), never a pass. A hook that answers the request itself — a
- * redirect to the host's login page, most commonly — keeps its answer: the provider writes nothing
- * over it.
- *
- * It receives the AdonisJS {@link HttpContext}, so it can read the session,
- * a bearer token, an IP allow-list, etc.
+ * What an {@link AuthorizeHook} may return: the shared {@link ConsoleAuthorizeResult} (a boolean,
+ * a decision, or `{ redirectTo }`) or an {@link AuthorizeDecision}.
+ */
+export type AuthorizeResult = ConsoleAuthorizeResult | AuthorizeDecision;
+/**
+ * The function form of `authorize`. It receives the AdonisJS {@link HttpContext}, so it can read the
+ * session, a bearer token, an IP allow-list, etc. May be async.
  */
 export type AuthorizeHook = (ctx: HttpContext) => AuthorizeResult | Promise<AuthorizeResult>;
 /**
  * Collapse an {@link AuthorizeResult} into a decision. Only `true` or an object with
- * `allowed === true` allows: anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a
- * missing value — denies. (A decision OBJECT is truthy, so a `!result` check would wave
- * `{ allowed: false }` through; this is why the guard never tests the raw value.)
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial carrying the redirect
+ * target; anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value —
+ * denies with `403`.
  */
-export declare function normalizeAuthorizeResult(result: unknown): AuthorizeDecision;
+export declare function normalizeAuthorizeResult(result: unknown): ConsoleDecision;
 /** Shape of `config/durable_dashboard.ts`. */
 export interface DurableDashboardConfig {
     /**
@@ -64,39 +51,17 @@ export interface DurableDashboardConfig {
      */
     path?: string;
     /**
-     * Per-request authorization guard — see {@link AuthorizeHook} for what it may return
-     * (`boolean` or an {@link AuthorizeDecision}; `reason: 'unauthenticated'` → `401`, otherwise a
-     * denial is `403`). Defaults to {@link defaultAuthorize}, which FAILS CLOSED in
-     * EVERY environment: it requires a bearer token matching `DURABLE_DASHBOARD_TOKEN` (denying
-     * everything when that env var is unset) — unless {@link dashboardAuth} is configured (the
-     * session guard is then the gate) or {@link allowUnauthenticated} explicitly opts out.
-     *
-     * (Before 0.37 the default was open outside `NODE_ENV=production` — which left every dev/staging
-     * deployment, and any box where NODE_ENV was unset or spelled differently, with an unauthenticated
-     * console whose destructive endpoints a malicious web page could drive via cross-site POSTs.)
-     */
-    authorize?: AuthorizeHook;
-    /**
-     * Explicitly serve the dashboard WITHOUT any authentication. This is the loaded footgun the old
-     * "open outside production" default was — now it at least has to be spelled out in config, so a
-     * deploy can grep for it. Only for local development / networks you fully trust. Ignored when
-     * `authorize` or `dashboardAuth` is configured.
-     */
-    allowUnauthenticated?: boolean;
-    /**
-     * Optional built-in login screen. When set, the provider mounts a
-     * server-rendered `GET <path>/login` page plus `POST <path>/login` /
-     * `GET <path>/logout`, and stamps a session guard on the dashboard: an
-     * unauthenticated page navigation is redirected (`302`) to the login page and
-     * an unauthenticated API request gets `401`. The signed session cookie is
-     * minted only by the host's {@link DashboardAuthOptions.login} hook.
+     * Who may reach the console. Runs before every dashboard route (API + HTML). Takes the shared
+     * {@link ConsoleAuthorize} contract — an inline function, an authorizer class (resolved through the
+     * container, so `@inject()` works), or a lazy import of one (`() => import('#policies/console_access')`).
+     * It returns a boolean, `{ allowed, reason? }` (`reason: 'unauthenticated'` → `401`, any other
+     * denial `403`) or `{ redirectTo }` (`302` for a page, `401` for an API call). A throw is a `403`.
      *
-     * This is ADDITIVE and composes WITH {@link authorize} (both must pass) — it
-     * does not replace it. Omit it entirely to keep today's behavior byte-for-byte
-     * (no login/logout routes, no session guard). Missing `secret`/`login` fails
-     * closed at boot.
+     * Omitted, the console is open when the app is not in production and answers `403` to every
+     * request in production (a warning is logged once at boot). For machine access use
+     * `authorizeByToken({ token })`.
      */
-    dashboardAuth?: DashboardAuthOptions;
+    authorize?: ConsoleAuthorize | AuthorizeHook;
     /**
      * Audit sink for MUTATING console actions (retry, cancel, bulk, fix-and-replay, signal, update,
      * task completion, schedule control): called once per attempt with who did what, before the
@@ -117,13 +82,12 @@ export interface DurableDashboardConfig {
     };
     /**
      * What a BROWSER sees when the guard refuses a page navigation (the SPA shell, its assets, or —
-     * Mode A only — a session-less visit). API requests are unaffected:
+     * nothing else). API requests are unaffected:
      * they keep getting the JSON the SPA relies on (`403 { error: 'forbidden' }` /
-     * `401 { error: 'unauthorized', auth }`).
+     * `401 { error: 'unauthenticated' }`).
      *
      * Omit it for the built-in page — a dark card in the console's own visual language, with the
-     * status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
-     * exists, a "Sign in" button. Pass an object to tweak that page (`brand`, `title`, `message`,
+     * status, a sentence explaining the refusal and a "Back to app" link. Pass an object to tweak that page (`brand`, `title`, `message`,
      * `homeHref`, `loginHref`, `accent`, …), or a function to render/answer it yourself — see
      * {@link AccessDeniedRenderer}. Either way, an `authorize` hook that already wrote a redirect
      * still wins: the provider never overwrites a `location` header.
@@ -134,9 +98,10 @@ export interface DurableDashboardConfig {
 export interface ResolvedDurableDashboardConfig {
     enabled: boolean;
     path: string;
-    authorize: AuthorizeHook;
-    /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
-    dashboardAuth: ResolvedDashboardAuth | null;
+    /** The resolved `authorize` gate (or the default): one call per request, never throws. */
+    authorize: ConsoleAuthorizeGate;
+    /** Whether the host set `authorize` (`false` means the dev-open / production-deny default). */
+    authorizeConfigured: boolean;
     /** The host's `accessDenied` option as given, or `null` for the built-in page with defaults. */
     accessDenied: AccessDeniedOption | null;
     /** The host's audit sink, or `null` for the default logger line. */
@@ -150,29 +115,27 @@ export interface ResolvedDurableDashboardConfig {
 /** One audited mutating console action — who (actor), what (method + path), when. */
 export interface DashboardAuditEntry {
     at: Date;
-    /** The session user's name/id, `'token'` for a bearer-token caller, else `'anonymous'`. */
+    /**
+     * The signed-in user (`ctx.auth.user`'s `email`, `name` or `id`), `'bearer'` for a caller with an
+     * `Authorization` header and no user, else `'anonymous'`.
+     */
     actor: string;
     method: string;
-    /** The request path (no query string — a `?token=` must never reach an audit log). */
+    /** The request path (no query string). */
     path: string;
 }
-/**
- * Whether the process is running in production. Mirrors how AdonisJS reads the
- * environment without taking a hard dependency on its env service. No longer an
- * AUTH decision input (the guard fails closed everywhere) — used only for
- * cookie hardening defaults.
- */
-export declare function isProduction(): boolean;
-/**
- * The default guard: FAIL CLOSED in every environment — require a bearer token equal to
- * `DURABLE_DASHBOARD_TOKEN`, denying everything when that env var is unset. There is no
- * NODE_ENV branch anymore: "not production" is exactly the set of deployments (dev boxes,
- * staging, misspelled envs) that used to ship an open console. Opt out explicitly with
- * `allowUnauthenticated: true`, or configure `dashboardAuth`/your own `authorize`.
- */
-export declare function defaultAuthorize(ctx: HttpContext): boolean;
+/** The warning logged once at boot when `authorize` is omitted. */
+export declare const NO_AUTHORIZE_WARNING = "[@adonis-agora/durable] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/durable_dashboard.ts.";
+/** Options for {@link resolveConfig}. */
+export interface ResolveConfigOptions {
+    /**
+     * Whether the app runs in production (`app.inProduction`). Only `false` opens a console without
+     * `authorize`; anything else denies it.
+     */
+    inProduction?: boolean;
+}
 /** Apply defaults to a partial config, producing a fully-resolved one. */
-export declare function resolveConfig(config?: DurableDashboardConfig): ResolvedDurableDashboardConfig;
+export declare function resolveConfig(config?: DurableDashboardConfig, options?: ResolveConfigOptions): ResolvedDurableDashboardConfig;
 /** Identity helper giving `config/durable_dashboard.ts` full type-checking. */
 export declare function defineConfig(config?: DurableDashboardConfig): DurableDashboardConfig;
 //# sourceMappingURL=define_config.d.ts.map

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAc3E;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;IACF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,oEAAoE;IACpE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,GAAG,IAAI,CAAC;CACV;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,2FAA2F;IAC3F,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAuCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAO1D;AAOD,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,GAAE,sBAA2B,GAAG,8BAA8B,CAuCjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EAGrB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAEzE;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAC7C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;IACF;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,SAAS,EAAE,oBAAoB,CAAC;IAChC,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,oEAAoE;IACpE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,GAAG,IAAI,CAAC;CACV;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,yLACuJ,CAAC;AAKzL,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,MAAM,GAAE,sBAA2B,EACnC,OAAO,GAAE,oBAAyB,GACjC,8BAA8B,CAiBhC;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}

package/dist/src/dashboard/define_config.js

@@ -1,129 +1,33 @@
-import { timingSafeEqual } from 'node:crypto';
-import { resolveDashboardAuth, } from './auth.js';
+import { normalizeConsoleDecision, resolveConsoleAuthorize, } from './console_authorize.js';
 /**
  * Collapse an {@link AuthorizeResult} into a decision. Only `true` or an object with
- * `allowed === true` allows: anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a
- * missing value — denies. (A decision OBJECT is truthy, so a `!result` check would wave
- * `{ allowed: false }` through; this is why the guard never tests the raw value.)
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial carrying the redirect
+ * target; anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value —
+ * denies with `403`.
  */
 export function normalizeAuthorizeResult(result) {
-    if (result === true)
-        return { allowed: true };
-    if (typeof result === 'object' &&
-        result !== null &&
-        result.allowed === true) {
-        return { allowed: true };
-    }
-    const reason = typeof result === 'object' && result !== null
-        ? result.reason
-        : undefined;
-    return { allowed: false, reason: reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden' };
+    return normalizeConsoleDecision(result);
 }
-/**
- * Whether the process is running in production. Mirrors how AdonisJS reads the
- * environment without taking a hard dependency on its env service. No longer an
- * AUTH decision input (the guard fails closed everywhere) — used only for
- * cookie hardening defaults.
- */
-export function isProduction() {
-    return (process.env.NODE_ENV ?? '').toLowerCase() === 'production';
-}
-/**
- * Extract a bearer token from an `Authorization: Bearer <token>` header, a
- * `token` query-string param, or an `x-durable-token` header — whichever is
- * present. Returns `undefined` when none is supplied.
- */
-function readToken(ctx) {
-    const header = ctx.request.header('authorization');
-    if (header) {
-        const match = /^Bearer\s+(.+)$/i.exec(header);
-        if (match?.[1])
-            return match[1].trim();
-    }
-    const xHeader = ctx.request.header('x-durable-token');
-    if (xHeader)
-        return xHeader.trim();
-    // The query-string channel exists ONLY because EventSource (the SSE live-tail) cannot set
-    // headers. Restricted to read methods: a `?token=` that authorized POSTs turned any leaked/logged
-    // URL (access logs, Referer, browser history) into a destructive-capable magic link.
-    const method = ctx.request.method().toUpperCase();
-    if (method === 'GET' || method === 'HEAD') {
-        const qs = ctx.request.qs().token;
-        if (typeof qs === 'string' && qs.length > 0)
-            return qs;
-    }
-    return undefined;
-}
-/**
- * Compare two secrets in constant time (guarding for equal byte-length first,
- * since {@link timingSafeEqual} throws on a length mismatch). Returns `false`
- * for any length difference, otherwise the timing-safe equality — so the token
- * check leaks neither a match nor the token's length via response time.
- */
-function secretsMatch(a, b) {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length)
-        return false;
-    return timingSafeEqual(bufA, bufB);
-}
-/**
- * The default guard: FAIL CLOSED in every environment — require a bearer token equal to
- * `DURABLE_DASHBOARD_TOKEN`, denying everything when that env var is unset. There is no
- * NODE_ENV branch anymore: "not production" is exactly the set of deployments (dev boxes,
- * staging, misspelled envs) that used to ship an open console. Opt out explicitly with
- * `allowUnauthenticated: true`, or configure `dashboardAuth`/your own `authorize`.
- */
-export function defaultAuthorize(ctx) {
-    const expected = process.env.DURABLE_DASHBOARD_TOKEN;
-    if (!expected)
-        return false;
-    const provided = readToken(ctx);
-    if (provided === undefined)
-        return false;
-    // Constant-time compare to remove the timing side-channel from the token check.
-    return secretsMatch(provided, expected);
-}
-/** The explicit `allowUnauthenticated: true` guard — allow everything, by conscious opt-in only. */
-const allowAll = () => true;
-let warnedOpenDashboard = false;
+/** The warning logged once at boot when `authorize` is omitted. */
+export const NO_AUTHORIZE_WARNING = '[@adonis-agora/durable] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/durable_dashboard.ts.';
+const allowAll = async () => ({ allowed: true });
+const denyAll = async () => ({ allowed: false, reason: 'forbidden' });
 /** Apply defaults to a partial config, producing a fully-resolved one. */
-export function resolveConfig(config = {}) {
+export function resolveConfig(config = {}, options = {}) {
     const rawPath = config.path ?? '/durable';
     // Normalize: ensure a single leading slash and no trailing slash (root stays '/').
     const trimmed = `/${rawPath.replace(/^\/+/, '').replace(/\/+$/, '')}`;
-    // Default guard resolution, in order:
-    //  1. a host `authorize` hook wins;
-    //  2. `dashboardAuth` configured -> the session guard IS the gate (the default token guard would
-    //     otherwise 403 every login flow that never set DURABLE_DASHBOARD_TOKEN);
-    //  3. `allowUnauthenticated: true` -> consciously open (warned once at resolve time);
-    //  4. else the fail-closed token guard.
-    const hasDashboardAuth = config.dashboardAuth !== undefined;
+    const authorizeConfigured = config.authorize !== undefined;
     let authorize;
-    if (config.authorize) {
-        authorize = config.authorize;
-    }
-    else if (hasDashboardAuth) {
-        authorize = allowAll;
-    }
-    else if (config.allowUnauthenticated === true) {
-        if (!warnedOpenDashboard) {
-            warnedOpenDashboard = true;
-            console.warn('[durable_dashboard] allowUnauthenticated: true — the console (including destructive ' +
-                'endpoints) is served with NO authentication. Never ship this to a reachable network.');
-        }
-        authorize = allowAll;
-    }
-    else {
-        authorize = defaultAuthorize;
-    }
+    if (config.authorize !== undefined)
+        authorize = resolveConsoleAuthorize(config.authorize);
+    else
+        authorize = options.inProduction === false ? allowAll : denyAll;
     return {
         enabled: config.enabled ?? true,
         path: trimmed === '/' ? '' : trimmed,
         authorize,
-        // Validate + resolve now so a misconfigured secret/login fails closed at boot,
-        // not on the first login attempt. `null` when `dashboardAuth` is omitted.
-        dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
+        authorizeConfigured,
         accessDenied: config.accessDenied ?? null,
         audit: config.audit ?? null,
         redact: config.redact ?? null,

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAiDnB;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAA4B,CAAC,OAAO,KAAK,IAAI,EAC9C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACpG,CAAC;AA+GD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,0FAA0F;IAC1F,kGAAkG;IAClG,qFAAqF;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,oGAAoG;AACpG,MAAM,QAAQ,GAAkB,GAAG,EAAE,CAAC,IAAI,CAAC;AAE3C,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAM,GAA2B,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,sCAAsC;IACtC,oCAAoC;IACpC,iGAAiG;IACjG,8EAA8E;IAC9E,sFAAsF;IACtF,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;IAC5D,IAAI,SAAwB,CAAC;IAC7B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,sFAAsF;gBACpF,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAoChC;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AA4FD,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAC/B,sLAAsL,CAAC;AAEzL,MAAM,QAAQ,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACvE,MAAM,OAAO,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAW5F,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,MAAM,GAA2B,EAAE,EACnC,OAAO,GAAyB,EAAE;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IAC3D,IAAI,SAA+B,CAAC;IACpC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;;QACrF,SAAS,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,mBAAmB;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/dashboard/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/dashboard/handlers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,YAAY,EAIjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAOlC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD;;;;;OAKG;IACH,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpF,mFAAmF;IACnF,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD;;iFAE6E;IAC7E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF;uEACmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE;0EACsE;IACtE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,4GAA4G;IAC5G,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjF,qGAAqG;IACrG,aAAa,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,iBAAiB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD;mFAC+E;IAC/E,kBAAkB,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzF;0FACsF;IACtF,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtE,oEAAoE;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E;;;;;;;;OAQG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D;;;;OAIG;IACH,yBAAyB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtE;;;;OAIG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE;6CACyC;IACzC,SAAS,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;wGACoG;IACpG,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;;;OAKG;IACH,cAAc,CAAC,CACb,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,aAAa,EACpB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAED,oGAAoG;AACpG,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB;kFAC8E;IAC9E,OAAO,CAAC,EACJ;QACE,UAAU,IAAI,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,2BAA2B,CAAC,CAAC;KAC3F,GACD,SAAS,CAAC;IACd,kGAAkG;IAClG,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;CACH;AAUD,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C;qEACiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAiBD,mGAAmG;AACnG,eAAO,MAAM,EAAE,SAAU,OAAO,KAAG,WAAsC,CAAC;AAwI1E;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BhF;AAED,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAkC9E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BrF;AAeD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAUzF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA6B7F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAM5F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CASzF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMnF;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BjF;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAejF;AAED,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAcvF;AAED,+FAA+F;AAC/F,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAanF;AAED,wFAAwF;AACxF,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAItF;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBtF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAgClF;AAED;sGACsG;AACtG,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAW7D;AAED;;;;uGAIuG;AACvG,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAG9D;AAED;kGACkG;AAClG,wBAAgB,QAAQ,CACtB,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,QAAQ,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,CAEb;AAiGD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA2C7D;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAanF;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCtF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/dashboard/handlers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,WAAW,EACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,YAAY,EAIjB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAOlC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD;;;;;OAKG;IACH,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpF,mFAAmF;IACnF,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD;;iFAE6E;IAC7E,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjF;uEACmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE;0EACsE;IACtE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,4GAA4G;IAC5G,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACjF,qGAAqG;IACrG,aAAa,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,iBAAiB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,eAAe,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzD;mFAC+E;IAC/E,kBAAkB,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzF;0FACsF;IACtF,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtE,oEAAoE;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAC5E;;;;;;;;OAQG;IACH,iBAAiB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D;;;;OAIG;IACH,yBAAyB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtE;;;;OAIG;IACH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE;6CACyC;IACzC,SAAS,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;wGACoG;IACpG,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;;;OAKG;IACH,cAAc,CAAC,CACb,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,aAAa,EACpB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAED,oGAAoG;AACpG,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB;kFAC8E;IAC9E,OAAO,CAAC,EACJ;QACE,UAAU,IAAI,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,uBAAuB,GAAG,2BAA2B,CAAC,CAAC;KAC3F,GACD,SAAS,CAAC;IACd,kGAAkG;IAClG,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;CACH;AAUD,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C;qEACiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAiBD,mGAAmG;AACnG,eAAO,MAAM,EAAE,SAAU,OAAO,KAAG,WAAsC,CAAC;AAwI1E;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBjF;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA0BhF;AAED,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsC9E;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BrF;AAeD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMhF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAUzF;AAsBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA6B7F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAM5F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAQjF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CASzF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMnF;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CA+BjF;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAejF;AAED,yGAAyG;AACzG,wBAAsB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAcvF;AAED,+FAA+F;AAC/F,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAanF;AAED,wFAAwF;AACxF,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAItF;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAsBtF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAgClF;AAED;sGACsG;AACtG,wBAAsB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAW7D;AAED;;;;uGAIuG;AACvG,wBAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAG9D;AAED;kGACkG;AAClG,wBAAgB,QAAQ,CACtB,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,QAAQ,EAC/C,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,CAEb;AAiGD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA2C7D;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAanF;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAiCtF"}

package/dist/src/dashboard/handlers.js

@@ -250,9 +250,12 @@ export async function getRun(deps, req) {
     if (detail.etag && detail.notModified)
         return notModified(detail.etag);
     const checkpoint = (cp) => redacted(deps.redact?.checkpoint, summarizeCheckpoint(cp));
+    // What a suspended run is parked on (a signal, an update, a task, a child), as the list rows carry
+    // it, so the console offers the matching action from the run itself.
+    const waitingOf = detail.run.status === 'suspended' ? await waitingResolver(engine, [detail.run]) : undefined;
     return {
         ...ok({
-            run: redacted(deps.redact?.run, detailRun(detail.run)),
+            run: redacted(deps.redact?.run, detailRun(detail.run, waitingOf)),
             timeline: detail.timeline.map(checkpoint),
             children: detail.children,
             ...(detail.fans ? { fans: detail.fans.map((fan) => serializeFan(fan, checkpoint)) } : {}),
@@ -729,10 +732,10 @@ function summarizeRun(run, waitingOf) {
     };
 }
 /** Fuller run shape for the detail view. */
-function detailRun(run) {
+function detailRun(run, waitingOf) {
     return {
         // recoveryAttempts already comes through from summarizeRun.
-        ...summarizeRun(run),
+        ...summarizeRun(run, waitingOf),
         input: run.input,
         output: run.output,
         error: run.error,