@adonis-agora/durable 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/src/dashboard/access_denied_page.js

@@ -1,11 +1,11 @@
 /**
  * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
- * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * navigation — the SPA shell or its assets. Before this page
  * existed the guard answered every denial with the JSON it answers the API with
  * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
  * thing for a human staring at a browser tab.
  *
- * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * Deliberately a small, dependency-free, hand-authored HTML page — NOT part
  * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
  * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
  * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
@@ -36,10 +36,6 @@ const DEFAULT_COPY = {
         title: 'Access denied',
         message: 'Your account is not allowed to open this console. If that looks wrong, ask an administrator to grant you access.',
     },
-    'session-required': {
-        title: 'Open this console from your app',
-        message: 'This console only accepts a session minted by your application. Go back to the app and open the console from there.',
-    },
 };
 /** Escape the five characters that matter inside HTML text and double-quoted attributes. */
 export function escapeHtml(value) {

package/dist/src/dashboard/access_denied_page.js.map

@@ -1 +1 @@
-{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAoEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,iCAAiC;QACxC,OAAO,EACL,qHAAqH;KACxH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/dashboard/console_authorize.d.ts

@@ -0,0 +1,76 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * What a console `authorize` returns. The same shape every `@adonis-agora` console accepts:
+ *
+ * - `true` / `{ allowed: true }` → the request proceeds;
+ * - `false` / `{ allowed: false }` / `{ allowed: false, reason: 'forbidden' }` → `403`;
+ * - `{ allowed: false, reason: 'unauthenticated' }` → `401`;
+ * - `{ redirectTo: '/login' }` → `302` to that path for a page navigation, `401` JSON for an API call.
+ */
+export type ConsoleAuthorizeResult = boolean | {
+    allowed: true;
+} | {
+    allowed: false;
+    reason?: 'unauthenticated' | 'forbidden';
+} | {
+    redirectTo: string;
+};
+/** A class form, for an authorizer in its own file (`@inject()` works). */
+export interface ConsoleAuthorizer {
+    authorize(ctx: HttpContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+}
+export type ConsoleAuthorizerClass = new (...args: any[]) => ConsoleAuthorizer;
+/**
+ * The console `authorize` option, in three forms: an inline function, an authorizer class, or a
+ * lazy import of a module whose default export is an authorizer class.
+ */
+export type ConsoleAuthorize = ((ctx: HttpContext) => ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>) | ConsoleAuthorizerClass | (() => Promise<{
+    default: ConsoleAuthorizerClass;
+}>);
+/** A normalized console decision. A denial always carries a reason (`401` vs `403`). */
+export type ConsoleDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: 'unauthenticated' | 'forbidden';
+    /** Set when `authorize` asked for a redirect: page navigations go there (`302`). */
+    redirectTo?: string;
+    /** Set when `authorize` threw: the denial is a `403`, the error is for logging only. */
+    error?: unknown;
+};
+/** A resolved `authorize`: one call per request, never throws. */
+export type ConsoleAuthorizeGate = (ctx: HttpContext) => Promise<ConsoleDecision>;
+/**
+ * Collapse an `authorize` result into a {@link ConsoleDecision}. Only `true` or an object with
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial with a redirect target;
+ * anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value — is a `403`.
+ */
+export declare function normalizeConsoleDecision(result: unknown): ConsoleDecision;
+/**
+ * Turn any {@link ConsoleAuthorize} form into a per-request gate:
+ *
+ * - a class is instantiated through the request's container resolver (so `@inject()` works) and its
+ *   `authorize(ctx)` is called;
+ * - a function is called with `ctx`; when it resolves to a module whose `default` is an authorizer
+ *   class it was a lazy import — the class is remembered (the import runs once) and used from then on;
+ * - a thrown error is a `403`, never an allow.
+ */
+export declare function resolveConsoleAuthorize(authorize: unknown): ConsoleAuthorizeGate;
+/** Options for {@link authorizeByToken}. */
+export interface AuthorizeByTokenOptions {
+    /** The shared secret callers send as `Authorization: Bearer <token>`. */
+    token: string | undefined;
+}
+/**
+ * An `authorize` for machine access (scripts, a Prometheus scrape): allows a request whose
+ * `Authorization` header is `Bearer <token>`, and answers `{ allowed: false, reason: 'unauthenticated' }`
+ * (`401`) otherwise. Only the header is read.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ * ```
+ *
+ * Throws at config time when `token` is empty or undefined.
+ */
+export declare function authorizeByToken(options: AuthorizeByTokenOptions): (ctx: HttpContext) => ConsoleAuthorizeResult;
+//# sourceMappingURL=console_authorize.d.ts.map

package/dist/src/dashboard/console_authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_authorize.d.ts","sourceRoot":"","sources":["../../../src/dashboard/console_authorize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAA;CAAE,GAC5D;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvF;AAGD,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,iBAAiB,CAAC;AAE/E;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAChF,sBAAsB,GACtB,CAAC,MAAM,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzD,wFAAwF;AACxF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAAC;IACxC,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEN,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAelF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAYzE;AAUD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,GAAG,oBAAoB,CA2BhF;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,CAa9C"}

package/dist/src/dashboard/console_authorize.js

@@ -0,0 +1,101 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+function isAuthorizerClass(value) {
+    return (typeof value === 'function' &&
+        typeof value.prototype?.authorize === 'function');
+}
+function lazyModuleClass(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const candidate = value.default;
+    return isAuthorizerClass(candidate) ? candidate : undefined;
+}
+/**
+ * Collapse an `authorize` result into a {@link ConsoleDecision}. Only `true` or an object with
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial with a redirect target;
+ * anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value — is a `403`.
+ */
+export function normalizeConsoleDecision(result) {
+    if (result === true)
+        return { allowed: true };
+    if (typeof result !== 'object' || result === null)
+        return { allowed: false, reason: 'forbidden' };
+    const record = result;
+    if (record.allowed === true)
+        return { allowed: true };
+    if (typeof record.redirectTo === 'string' && record.redirectTo !== '') {
+        return { allowed: false, reason: 'unauthenticated', redirectTo: record.redirectTo };
+    }
+    return {
+        allowed: false,
+        reason: record.reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden',
+    };
+}
+async function runAuthorizer(Authorizer, ctx) {
+    const instance = await ctx.containerResolver.make(Authorizer);
+    return instance.authorize(ctx);
+}
+/**
+ * Turn any {@link ConsoleAuthorize} form into a per-request gate:
+ *
+ * - a class is instantiated through the request's container resolver (so `@inject()` works) and its
+ *   `authorize(ctx)` is called;
+ * - a function is called with `ctx`; when it resolves to a module whose `default` is an authorizer
+ *   class it was a lazy import — the class is remembered (the import runs once) and used from then on;
+ * - a thrown error is a `403`, never an allow.
+ */
+export function resolveConsoleAuthorize(authorize) {
+    let Authorizer = isAuthorizerClass(authorize)
+        ? authorize
+        : undefined;
+    if (Authorizer === undefined && typeof authorize !== 'function') {
+        throw new TypeError('[console] `authorize` must be a function, an authorizer class, or a lazy import of one.');
+    }
+    const fn = authorize;
+    return async (ctx) => {
+        try {
+            if (Authorizer !== undefined) {
+                return normalizeConsoleDecision(await runAuthorizer(Authorizer, ctx));
+            }
+            const result = await fn(ctx);
+            const lazy = lazyModuleClass(result);
+            if (lazy !== undefined) {
+                Authorizer = lazy;
+                return normalizeConsoleDecision(await runAuthorizer(lazy, ctx));
+            }
+            return normalizeConsoleDecision(result);
+        }
+        catch (error) {
+            return { allowed: false, reason: 'forbidden', error };
+        }
+    };
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest();
+}
+/**
+ * An `authorize` for machine access (scripts, a Prometheus scrape): allows a request whose
+ * `Authorization` header is `Bearer <token>`, and answers `{ allowed: false, reason: 'unauthenticated' }`
+ * (`401`) otherwise. Only the header is read.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ * ```
+ *
+ * Throws at config time when `token` is empty or undefined.
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error('authorizeByToken: `token` must be a non-empty string');
+    }
+    // Compare digests: equal length always, so the check leaks neither a match nor the token length.
+    const expected = digest(token);
+    return (ctx) => {
+        const header = ctx.request.header('authorization');
+        const match = typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+        if (match?.[1] && timingSafeEqual(digest(match[1]), expected))
+            return { allowed: true };
+        return { allowed: false, reason: 'unauthenticated' };
+    };
+}
+//# sourceMappingURL=console_authorize.js.map

package/dist/src/dashboard/console_authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_authorize.js","sourceRoot":"","sources":["../../../src/dashboard/console_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiD1D,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,UAAU;QAC3B,OAAQ,KAAiD,CAAC,SAAS,EAAE,SAAS,KAAK,UAAU,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC3D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAuE,CAAC;IACvF,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACtF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;KAC9E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkC,EAClC,GAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,IAAI,UAAU,GAAuC,iBAAiB,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAA0C,CAAC;IAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAQD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAgB,EAA0B,EAAE;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,6 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http';
 import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
-import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
+import { type ConsoleAuthorize, type ConsoleAuthorizeGate, type ConsoleAuthorizeResult, type ConsoleDecision } from './console_authorize.js';
 /**
  * The function form of {@link DurableDashboardConfig.accessDenied}: render (or answer) a refused
  * page navigation yourself. Receives the refusal ({@link AccessDeniedInfo}) and the AdonisJS
@@ -15,41 +15,28 @@ export type AccessDeniedOption = GenericAccessDeniedOption<HttpContext>;
  * A structured answer from an {@link AuthorizeHook}: whether the request may proceed and, when it may
  * not, why. The `reason` picks the status: `'unauthenticated'` (nobody is signed in) → `401`,
  * `'forbidden'` (signed in, not allowed) → `403`. No reason → `403` (fail closed).
- *
- * This is the shared Agora dashboard-gate contract — the same shape every `@adonis-agora` console
- * accepts, so one hook (e.g. `@adonis-agora/authz`'s `authorizeByRoles`) can gate them all.
  */
 export interface AuthorizeDecision {
     allowed: boolean;
     reason?: 'unauthenticated' | 'forbidden';
 }
-/** What an {@link AuthorizeHook} may return: a bare boolean or an {@link AuthorizeDecision}. */
-export type AuthorizeResult = boolean | AuthorizeDecision;
 /**
- * Authorization guard for the dashboard. Runs before every dashboard route (API + HTML). May be
- * async (e.g. an auth lookup). Return:
- *
- * - `true` or `{ allowed: true }` → the request proceeds;
- * - `{ allowed: false, reason: 'unauthenticated' }` → `401` (the access-denied page with the
- *   "sign in" story for a page navigation, `{ error: 'unauthorized' }` for an API request);
- * - `{ allowed: false, reason: 'forbidden' }`, `{ allowed: false }` or `false` → `403` (the
- *   access-denied page, or `{ error: 'forbidden' }`).
- *
- * A hook that THROWS is a denial (`403`), never a pass. A hook that answers the request itself — a
- * redirect to the host's login page, most commonly — keeps its answer: the provider writes nothing
- * over it.
- *
- * It receives the AdonisJS {@link HttpContext}, so it can read the session,
- * a bearer token, an IP allow-list, etc.
+ * What an {@link AuthorizeHook} may return: the shared {@link ConsoleAuthorizeResult} (a boolean,
+ * a decision, or `{ redirectTo }`) or an {@link AuthorizeDecision}.
+ */
+export type AuthorizeResult = ConsoleAuthorizeResult | AuthorizeDecision;
+/**
+ * The function form of `authorize`. It receives the AdonisJS {@link HttpContext}, so it can read the
+ * session, a bearer token, an IP allow-list, etc. May be async.
  */
 export type AuthorizeHook = (ctx: HttpContext) => AuthorizeResult | Promise<AuthorizeResult>;
 /**
  * Collapse an {@link AuthorizeResult} into a decision. Only `true` or an object with
- * `allowed === true` allows: anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a
- * missing value — denies. (A decision OBJECT is truthy, so a `!result` check would wave
- * `{ allowed: false }` through; this is why the guard never tests the raw value.)
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial carrying the redirect
+ * target; anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value —
+ * denies with `403`.
  */
-export declare function normalizeAuthorizeResult(result: unknown): AuthorizeDecision;
+export declare function normalizeAuthorizeResult(result: unknown): ConsoleDecision;
 /** Shape of `config/durable_dashboard.ts`. */
 export interface DurableDashboardConfig {
     /**
@@ -64,39 +51,17 @@ export interface DurableDashboardConfig {
      */
     path?: string;
     /**
-     * Per-request authorization guard — see {@link AuthorizeHook} for what it may return
-     * (`boolean` or an {@link AuthorizeDecision}; `reason: 'unauthenticated'` → `401`, otherwise a
-     * denial is `403`). Defaults to {@link defaultAuthorize}, which FAILS CLOSED in
-     * EVERY environment: it requires a bearer token matching `DURABLE_DASHBOARD_TOKEN` (denying
-     * everything when that env var is unset) — unless {@link dashboardAuth} is configured (the
-     * session guard is then the gate) or {@link allowUnauthenticated} explicitly opts out.
-     *
-     * (Before 0.37 the default was open outside `NODE_ENV=production` — which left every dev/staging
-     * deployment, and any box where NODE_ENV was unset or spelled differently, with an unauthenticated
-     * console whose destructive endpoints a malicious web page could drive via cross-site POSTs.)
-     */
-    authorize?: AuthorizeHook;
-    /**
-     * Explicitly serve the dashboard WITHOUT any authentication. This is the loaded footgun the old
-     * "open outside production" default was — now it at least has to be spelled out in config, so a
-     * deploy can grep for it. Only for local development / networks you fully trust. Ignored when
-     * `authorize` or `dashboardAuth` is configured.
-     */
-    allowUnauthenticated?: boolean;
-    /**
-     * Optional built-in login screen. When set, the provider mounts a
-     * server-rendered `GET <path>/login` page plus `POST <path>/login` /
-     * `GET <path>/logout`, and stamps a session guard on the dashboard: an
-     * unauthenticated page navigation is redirected (`302`) to the login page and
-     * an unauthenticated API request gets `401`. The signed session cookie is
-     * minted only by the host's {@link DashboardAuthOptions.login} hook.
+     * Who may reach the console. Runs before every dashboard route (API + HTML). Takes the shared
+     * {@link ConsoleAuthorize} contract — an inline function, an authorizer class (resolved through the
+     * container, so `@inject()` works), or a lazy import of one (`() => import('#policies/console_access')`).
+     * It returns a boolean, `{ allowed, reason? }` (`reason: 'unauthenticated'` → `401`, any other
+     * denial `403`) or `{ redirectTo }` (`302` for a page, `401` for an API call). A throw is a `403`.
      *
-     * This is ADDITIVE and composes WITH {@link authorize} (both must pass) — it
-     * does not replace it. Omit it entirely to keep today's behavior byte-for-byte
-     * (no login/logout routes, no session guard). Missing `secret`/`login` fails
-     * closed at boot.
+     * Omitted, the console is open when the app is not in production and answers `403` to every
+     * request in production (a warning is logged once at boot). For machine access use
+     * `authorizeByToken({ token })`.
      */
-    dashboardAuth?: DashboardAuthOptions;
+    authorize?: ConsoleAuthorize | AuthorizeHook;
     /**
      * Audit sink for MUTATING console actions (retry, cancel, bulk, fix-and-replay, signal, update,
      * task completion, schedule control): called once per attempt with who did what, before the
@@ -117,13 +82,12 @@ export interface DurableDashboardConfig {
     };
     /**
      * What a BROWSER sees when the guard refuses a page navigation (the SPA shell, its assets, or —
-     * Mode A only — a session-less visit). API requests are unaffected:
+     * nothing else). API requests are unaffected:
      * they keep getting the JSON the SPA relies on (`403 { error: 'forbidden' }` /
-     * `401 { error: 'unauthorized', auth }`).
+     * `401 { error: 'unauthenticated' }`).
      *
      * Omit it for the built-in page — a dark card in the console's own visual language, with the
-     * status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
-     * exists, a "Sign in" button. Pass an object to tweak that page (`brand`, `title`, `message`,
+     * status, a sentence explaining the refusal and a "Back to app" link. Pass an object to tweak that page (`brand`, `title`, `message`,
      * `homeHref`, `loginHref`, `accent`, …), or a function to render/answer it yourself — see
      * {@link AccessDeniedRenderer}. Either way, an `authorize` hook that already wrote a redirect
      * still wins: the provider never overwrites a `location` header.
@@ -134,9 +98,10 @@ export interface DurableDashboardConfig {
 export interface ResolvedDurableDashboardConfig {
     enabled: boolean;
     path: string;
-    authorize: AuthorizeHook;
-    /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
-    dashboardAuth: ResolvedDashboardAuth | null;
+    /** The resolved `authorize` gate (or the default): one call per request, never throws. */
+    authorize: ConsoleAuthorizeGate;
+    /** Whether the host set `authorize` (`false` means the dev-open / production-deny default). */
+    authorizeConfigured: boolean;
     /** The host's `accessDenied` option as given, or `null` for the built-in page with defaults. */
     accessDenied: AccessDeniedOption | null;
     /** The host's audit sink, or `null` for the default logger line. */
@@ -150,29 +115,27 @@ export interface ResolvedDurableDashboardConfig {
 /** One audited mutating console action — who (actor), what (method + path), when. */
 export interface DashboardAuditEntry {
     at: Date;
-    /** The session user's name/id, `'token'` for a bearer-token caller, else `'anonymous'`. */
+    /**
+     * The signed-in user (`ctx.auth.user`'s `email`, `name` or `id`), `'bearer'` for a caller with an
+     * `Authorization` header and no user, else `'anonymous'`.
+     */
     actor: string;
     method: string;
-    /** The request path (no query string — a `?token=` must never reach an audit log). */
+    /** The request path (no query string). */
     path: string;
 }
-/**
- * Whether the process is running in production. Mirrors how AdonisJS reads the
- * environment without taking a hard dependency on its env service. No longer an
- * AUTH decision input (the guard fails closed everywhere) — used only for
- * cookie hardening defaults.
- */
-export declare function isProduction(): boolean;
-/**
- * The default guard: FAIL CLOSED in every environment — require a bearer token equal to
- * `DURABLE_DASHBOARD_TOKEN`, denying everything when that env var is unset. There is no
- * NODE_ENV branch anymore: "not production" is exactly the set of deployments (dev boxes,
- * staging, misspelled envs) that used to ship an open console. Opt out explicitly with
- * `allowUnauthenticated: true`, or configure `dashboardAuth`/your own `authorize`.
- */
-export declare function defaultAuthorize(ctx: HttpContext): boolean;
+/** The warning logged once at boot when `authorize` is omitted. */
+export declare const NO_AUTHORIZE_WARNING = "[@adonis-agora/durable] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/durable_dashboard.ts.";
+/** Options for {@link resolveConfig}. */
+export interface ResolveConfigOptions {
+    /**
+     * Whether the app runs in production (`app.inProduction`). Only `false` opens a console without
+     * `authorize`; anything else denies it.
+     */
+    inProduction?: boolean;
+}
 /** Apply defaults to a partial config, producing a fully-resolved one. */
-export declare function resolveConfig(config?: DurableDashboardConfig): ResolvedDurableDashboardConfig;
+export declare function resolveConfig(config?: DurableDashboardConfig, options?: ResolveConfigOptions): ResolvedDurableDashboardConfig;
 /** Identity helper giving `config/durable_dashboard.ts` full type-checking. */
 export declare function defineConfig(config?: DurableDashboardConfig): DurableDashboardConfig;
 //# sourceMappingURL=define_config.d.ts.map

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAc3E;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;IACF;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,oEAAoE;IACpE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,GAAG,IAAI,CAAC;CACV;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,2FAA2F;IAC3F,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAuCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAO1D;AAOD,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,MAAM,GAAE,sBAA2B,GAAG,8BAA8B,CAuCjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EAGrB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAEzE;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAC7C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACP,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC;IACF;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,SAAS,EAAE,oBAAoB,CAAC;IAChC,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,oEAAoE;IACpE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,mEAAmE;IACnE,MAAM,EAAE;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/E,GAAG,IAAI,CAAC;CACV;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,yLACuJ,CAAC;AAKzL,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,MAAM,GAAE,sBAA2B,EACnC,OAAO,GAAE,oBAAyB,GACjC,8BAA8B,CAiBhC;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,MAAM,GAAE,sBAA2B,GAAG,sBAAsB,CAExF"}

package/dist/src/dashboard/define_config.js

@@ -1,129 +1,33 @@
-import { timingSafeEqual } from 'node:crypto';
-import { resolveDashboardAuth, } from './auth.js';
+import { normalizeConsoleDecision, resolveConsoleAuthorize, } from './console_authorize.js';
 /**
  * Collapse an {@link AuthorizeResult} into a decision. Only `true` or an object with
- * `allowed === true` allows: anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a
- * missing value — denies. (A decision OBJECT is truthy, so a `!result` check would wave
- * `{ allowed: false }` through; this is why the guard never tests the raw value.)
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial carrying the redirect
+ * target; anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value —
+ * denies with `403`.
  */
 export function normalizeAuthorizeResult(result) {
-    if (result === true)
-        return { allowed: true };
-    if (typeof result === 'object' &&
-        result !== null &&
-        result.allowed === true) {
-        return { allowed: true };
-    }
-    const reason = typeof result === 'object' && result !== null
-        ? result.reason
-        : undefined;
-    return { allowed: false, reason: reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden' };
+    return normalizeConsoleDecision(result);
 }
-/**
- * Whether the process is running in production. Mirrors how AdonisJS reads the
- * environment without taking a hard dependency on its env service. No longer an
- * AUTH decision input (the guard fails closed everywhere) — used only for
- * cookie hardening defaults.
- */
-export function isProduction() {
-    return (process.env.NODE_ENV ?? '').toLowerCase() === 'production';
-}
-/**
- * Extract a bearer token from an `Authorization: Bearer <token>` header, a
- * `token` query-string param, or an `x-durable-token` header — whichever is
- * present. Returns `undefined` when none is supplied.
- */
-function readToken(ctx) {
-    const header = ctx.request.header('authorization');
-    if (header) {
-        const match = /^Bearer\s+(.+)$/i.exec(header);
-        if (match?.[1])
-            return match[1].trim();
-    }
-    const xHeader = ctx.request.header('x-durable-token');
-    if (xHeader)
-        return xHeader.trim();
-    // The query-string channel exists ONLY because EventSource (the SSE live-tail) cannot set
-    // headers. Restricted to read methods: a `?token=` that authorized POSTs turned any leaked/logged
-    // URL (access logs, Referer, browser history) into a destructive-capable magic link.
-    const method = ctx.request.method().toUpperCase();
-    if (method === 'GET' || method === 'HEAD') {
-        const qs = ctx.request.qs().token;
-        if (typeof qs === 'string' && qs.length > 0)
-            return qs;
-    }
-    return undefined;
-}
-/**
- * Compare two secrets in constant time (guarding for equal byte-length first,
- * since {@link timingSafeEqual} throws on a length mismatch). Returns `false`
- * for any length difference, otherwise the timing-safe equality — so the token
- * check leaks neither a match nor the token's length via response time.
- */
-function secretsMatch(a, b) {
-    const bufA = Buffer.from(a);
-    const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length)
-        return false;
-    return timingSafeEqual(bufA, bufB);
-}
-/**
- * The default guard: FAIL CLOSED in every environment — require a bearer token equal to
- * `DURABLE_DASHBOARD_TOKEN`, denying everything when that env var is unset. There is no
- * NODE_ENV branch anymore: "not production" is exactly the set of deployments (dev boxes,
- * staging, misspelled envs) that used to ship an open console. Opt out explicitly with
- * `allowUnauthenticated: true`, or configure `dashboardAuth`/your own `authorize`.
- */
-export function defaultAuthorize(ctx) {
-    const expected = process.env.DURABLE_DASHBOARD_TOKEN;
-    if (!expected)
-        return false;
-    const provided = readToken(ctx);
-    if (provided === undefined)
-        return false;
-    // Constant-time compare to remove the timing side-channel from the token check.
-    return secretsMatch(provided, expected);
-}
-/** The explicit `allowUnauthenticated: true` guard — allow everything, by conscious opt-in only. */
-const allowAll = () => true;
-let warnedOpenDashboard = false;
+/** The warning logged once at boot when `authorize` is omitted. */
+export const NO_AUTHORIZE_WARNING = '[@adonis-agora/durable] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/durable_dashboard.ts.';
+const allowAll = async () => ({ allowed: true });
+const denyAll = async () => ({ allowed: false, reason: 'forbidden' });
 /** Apply defaults to a partial config, producing a fully-resolved one. */
-export function resolveConfig(config = {}) {
+export function resolveConfig(config = {}, options = {}) {
     const rawPath = config.path ?? '/durable';
     // Normalize: ensure a single leading slash and no trailing slash (root stays '/').
     const trimmed = `/${rawPath.replace(/^\/+/, '').replace(/\/+$/, '')}`;
-    // Default guard resolution, in order:
-    //  1. a host `authorize` hook wins;
-    //  2. `dashboardAuth` configured -> the session guard IS the gate (the default token guard would
-    //     otherwise 403 every login flow that never set DURABLE_DASHBOARD_TOKEN);
-    //  3. `allowUnauthenticated: true` -> consciously open (warned once at resolve time);
-    //  4. else the fail-closed token guard.
-    const hasDashboardAuth = config.dashboardAuth !== undefined;
+    const authorizeConfigured = config.authorize !== undefined;
     let authorize;
-    if (config.authorize) {
-        authorize = config.authorize;
-    }
-    else if (hasDashboardAuth) {
-        authorize = allowAll;
-    }
-    else if (config.allowUnauthenticated === true) {
-        if (!warnedOpenDashboard) {
-            warnedOpenDashboard = true;
-            console.warn('[durable_dashboard] allowUnauthenticated: true — the console (including destructive ' +
-                'endpoints) is served with NO authentication. Never ship this to a reachable network.');
-        }
-        authorize = allowAll;
-    }
-    else {
-        authorize = defaultAuthorize;
-    }
+    if (config.authorize !== undefined)
+        authorize = resolveConsoleAuthorize(config.authorize);
+    else
+        authorize = options.inProduction === false ? allowAll : denyAll;
     return {
         enabled: config.enabled ?? true,
         path: trimmed === '/' ? '' : trimmed,
         authorize,
-        // Validate + resolve now so a misconfigured secret/login fails closed at boot,
-        // not on the first login attempt. `null` when `dashboardAuth` is omitted.
-        dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
+        authorizeConfigured,
         accessDenied: config.accessDenied ?? null,
         audit: config.audit ?? null,
         redact: config.redact ?? null,

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAiDnB;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAA4B,CAAC,OAAO,KAAK,IAAI,EAC9C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACpG,CAAC;AA+GD;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,0FAA0F;IAC1F,kGAAkG;IAClG,qFAAqF;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,oGAAoG;AACpG,MAAM,QAAQ,GAAkB,GAAG,EAAE,CAAC,IAAI,CAAC;AAE3C,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAM,GAA2B,EAAE;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,sCAAsC;IACtC,oCAAoC;IACpC,iGAAiG;IACjG,8EAA8E;IAC9E,sFAAsF;IACtF,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;IAC5D,IAAI,SAAwB,CAAC;IAC7B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,sFAAsF;gBACpF,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,gBAAgB,CAAC;IAC/B,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAKA,OAAO,EAKL,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAoChC;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AA4FD,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAC/B,sLAAsL,CAAC;AAEzL,MAAM,QAAQ,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACvE,MAAM,OAAO,GAAyB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAW5F,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,MAAM,GAA2B,EAAE,EACnC,OAAO,GAAyB,EAAE;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IAC3D,IAAI,SAA+B,CAAC;IACpC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;;QACrF,SAAS,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS;QACT,mBAAmB;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,MAAM,GAA2B,EAAE;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/dashboard/diagnostics-recorder.d.ts

@@ -33,7 +33,7 @@ export interface RecordedBlock {
  * - `controlPlaneDescriptor()` is the CP side the events were negotiated against.
  *
  * Bounded by an LRU-ish cap on the per-run map (oldest evicted) so a long-lived control plane never
- * grows this without bound. Store-role only: a `tenant` pod owns no engine to subscribe to, so its
+ * grows this without bound. Store-topology only: a `tenant` pod owns no engine to subscribe to, so its
  * panel shows `blocked` runs (reason from `run.error.message`) without the enriched delta.
  */
 export declare class BlockedDiagnosticsRecorder {

package/dist/src/dashboard/diagnostics-recorder.js

@@ -10,7 +10,7 @@
  * - `controlPlaneDescriptor()` is the CP side the events were negotiated against.
  *
  * Bounded by an LRU-ish cap on the per-run map (oldest evicted) so a long-lived control plane never
- * grows this without bound. Store-role only: a `tenant` pod owns no engine to subscribe to, so its
+ * grows this without bound. Store-topology only: a `tenant` pod owns no engine to subscribe to, so its
  * panel shows `blocked` runs (reason from `run.error.message`) without the enriched delta.
  */
 export class BlockedDiagnosticsRecorder {