@adonis-agora/durable 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/src/dashboard/access_denied_page.d.ts

@@ -1,11 +1,11 @@
 /**
  * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
- * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * navigation — the SPA shell or its assets. Before this page
  * existed the guard answered every denial with the JSON it answers the API with
  * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
  * thing for a human staring at a browser tab.
  *
- * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * Deliberately a small, dependency-free, hand-authored HTML page — NOT part
  * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
  * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
  * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
@@ -26,9 +26,7 @@ export type AccessDeniedReason =
 /** Nobody is signed in (a `401`): offer the login page when one exists. */
 'unauthenticated'
 /** Somebody is signed in but `authorize` said no (a `403`). */
- | 'forbidden'
-/** `dashboardAuth` runs in Mode A only and there is no session — the host app must mint one. */
- | 'session-required';
+ | 'forbidden';
 /** What the provider knows about the refusal — handed to a custom renderer and to the default page. */
 export interface AccessDeniedInfo {
     /** The HTTP status the page is served with. */
@@ -36,7 +34,7 @@ export interface AccessDeniedInfo {
     reason: AccessDeniedReason;
     /** The console's mount path (`/durable`; `''` when mounted at the root). */
     basePath: string;
-    /** The built-in login page, present only when `dashboardAuth.login` is configured. */
+    /** The app's login page, when the console knows one (`accessDenied.loginHref`). */
     loginHref?: string;
     /** A developer-facing detail (e.g. a thrown hook's message). Providers set it OUTSIDE production only. */
     detail?: string;
@@ -58,7 +56,7 @@ export interface AccessDeniedPageOptions {
     homeHref?: string | false;
     /** Label of the "Back to app" button. */
     homeLabel?: string;
-    /** Where "Sign in" points. Default: the built-in login page when one exists; `false` hides it. */
+    /** Where "Sign in" points (your app's login page). Default: none; `false` hides it. */
     loginHref?: string | false;
     /** Label of the "Sign in" button. */
     loginLabel?: string;

package/dist/src/dashboard/access_denied_page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access_denied_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB;AAC5B,2EAA2E;AACzE,iBAAiB;AACnB,+DAA+D;GAC7D,WAAW;AACb,gGAAgG;GAC9F,kBAAkB,CAAC;AAEvB,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,GAAG,GAAG,OAAO,IAAI,CAChD,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,GAAG,KAEL,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,CAAC,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEpG,kGAAkG;AAClG,eAAO,MAAM,OAAO;aAClB,KAAK,EAAE,SAAS;aAChB,MAAM,EAAE,SAAS;aACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAmBX,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAyBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAqLR;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAC/C,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,OAAO,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}
+{"version":3,"file":"access_denied_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB;AAC5B,2EAA2E;AACzE,iBAAiB;AACnB,+DAA+D;GAC7D,WAAW,CAAC;AAEhB,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,GAAG,GAAG,OAAO,IAAI,CAChD,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,GAAG,KAEL,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,CAAC,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEpG,kGAAkG;AAClG,eAAO,MAAM,OAAO;aAClB,KAAK,EAAE,SAAS;aAChB,MAAM,EAAE,SAAS;aACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAcX,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAyBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAqLR;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAC/C,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,OAAO,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}

package/dist/src/dashboard/access_denied_page.js

@@ -1,11 +1,11 @@
 /**
  * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
- * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * navigation — the SPA shell or its assets. Before this page
  * existed the guard answered every denial with the JSON it answers the API with
  * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
  * thing for a human staring at a browser tab.
  *
- * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * Deliberately a small, dependency-free, hand-authored HTML page — NOT part
  * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
  * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
  * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
@@ -36,10 +36,6 @@ const DEFAULT_COPY = {
         title: 'Access denied',
         message: 'Your account is not allowed to open this console. If that looks wrong, ask an administrator to grant you access.',
     },
-    'session-required': {
-        title: 'Open this console from your app',
-        message: 'This console only accepts a session minted by your application. Go back to the app and open the console from there.',
-    },
 };
 /** Escape the five characters that matter inside HTML text and double-quoted attributes. */
 export function escapeHtml(value) {

package/dist/src/dashboard/access_denied_page.js.map

@@ -1 +1 @@
-{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAoEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,iCAAiC;QACxC,OAAO,EACL,qHAAqH;KACxH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,uBAAuB;CAC5B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/dashboard/audit.d.ts

@@ -0,0 +1,14 @@
+import type { DashboardAuditEntry } from './define_config.js';
+/** Where an audit line goes when the host configured no `audit` sink. */
+export interface AuditLogger {
+    info(message: string): void;
+}
+/**
+ * Hand one console audit entry to the host's `audit` sink, or log the default
+ * `[durable_dashboard] audit actor=… METHOD path` line. Shared by the console routes, the developer
+ * tools and the ace commands, so every operator action lands in the same place. Never throws.
+ */
+export declare function recordConsoleAudit(sink: ((entry: DashboardAuditEntry) => void) | null | undefined, logger: () => Promise<AuditLogger>, entry: DashboardAuditEntry): void;
+/** The actor an ace command records: `cli:<os user>`, or `cli` when the user cannot be read. */
+export declare function cliActor(): string;
+//# sourceMappingURL=audit.d.ts.map

package/dist/src/dashboard/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/dashboard/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/D,MAAM,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,EAClC,KAAK,EAAE,mBAAmB,GACzB,IAAI,CAgBN;AAED,gGAAgG;AAChG,wBAAgB,QAAQ,IAAI,MAAM,CAOjC"}

package/dist/src/dashboard/audit.js

@@ -0,0 +1,36 @@
+import { userInfo } from 'node:os';
+/**
+ * Hand one console audit entry to the host's `audit` sink, or log the default
+ * `[durable_dashboard] audit actor=… METHOD path` line. Shared by the console routes, the developer
+ * tools and the ace commands, so every operator action lands in the same place. Never throws.
+ */
+export function recordConsoleAudit(sink, logger, entry) {
+    try {
+        if (sink) {
+            // Typed `void`, but an async hook is assignable to it: catch its rejection too.
+            const pending = sink(entry);
+            if (pending instanceof Promise)
+                pending.catch(() => undefined);
+            return;
+        }
+        void logger()
+            .then((log) => {
+            log.info(`[durable_dashboard] audit actor=${entry.actor} ${entry.method} ${entry.path}`);
+        })
+            .catch(() => undefined);
+    }
+    catch {
+        /* auditing must never break the action */
+    }
+}
+/** The actor an ace command records: `cli:<os user>`, or `cli` when the user cannot be read. */
+export function cliActor() {
+    try {
+        const name = userInfo().username;
+        return name ? `cli:${name}` : 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/src/dashboard/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/dashboard/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQnC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA+D,EAC/D,MAAkC,EAClC,KAA0B;IAE1B,IAAI,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,gFAAgF;YAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAY,CAAC;YACvC,IAAI,OAAO,YAAY,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE;aACV,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,GAAG,CAAC,IAAI,CAAC,mCAAmC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACjC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/dashboard/console_authorize.d.ts

@@ -0,0 +1,98 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * What a console `authorize` returns. The same shape every `@adonis-agora` console accepts:
+ *
+ * - `true` / `{ allowed: true }` → the request proceeds;
+ * - `false` / `{ allowed: false }` / `{ allowed: false, reason: 'forbidden' }` → `403`;
+ * - `{ allowed: false, reason: 'unauthenticated' }` → `401`;
+ * - `{ redirectTo: '/login' }` → `302` to that path for a page navigation, `401` JSON for an API call.
+ */
+export type ConsoleAuthorizeResult = boolean | {
+    allowed: true;
+    /**
+     * With tenancy on: the tenants (organizations) this viewer may see in the console, or `'*'`
+     * for every tenant plus runs with no tenant. Omit for the viewer's own active tenant.
+     */
+    tenants?: '*' | string[];
+} | {
+    allowed: false;
+    reason?: 'unauthenticated' | 'forbidden';
+} | {
+    redirectTo: string;
+};
+/** A class form, for an authorizer in its own file (`@inject()` works). */
+export interface ConsoleAuthorizer {
+    authorize(ctx: HttpContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+}
+export type ConsoleAuthorizerClass = new (...args: any[]) => ConsoleAuthorizer;
+/**
+ * The console `authorize` option, in three forms: an inline function, an authorizer class, or a
+ * lazy import of a module whose default export is an authorizer class.
+ */
+export type ConsoleAuthorize = ((ctx: HttpContext) => ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>) | ConsoleAuthorizerClass | (() => Promise<{
+    default: ConsoleAuthorizerClass;
+}>);
+/** A normalized console decision. A denial always carries a reason (`401` vs `403`). */
+export type ConsoleDecision = {
+    allowed: true;
+    tenants?: '*' | string[];
+} | {
+    allowed: false;
+    reason: 'unauthenticated' | 'forbidden';
+    /** Set when `authorize` asked for a redirect: page navigations go there (`302`). */
+    redirectTo?: string;
+    /** Set when `authorize` threw: the denial is a `403`, the error is for logging only. */
+    error?: unknown;
+};
+/** A resolved `authorize`: one call per request, never throws. */
+export type ConsoleAuthorizeGate = (ctx: HttpContext) => Promise<ConsoleDecision>;
+/**
+ * Collapse an `authorize` result into a {@link ConsoleDecision}. Only `true` or an object with
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial with a redirect target;
+ * anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value — is a `403`.
+ */
+export declare function normalizeConsoleDecision(result: unknown): ConsoleDecision;
+/**
+ * Turn any {@link ConsoleAuthorize} form into a per-request gate:
+ *
+ * - a class is instantiated through the request's container resolver (so `@inject()` works) and its
+ *   `authorize(ctx)` is called;
+ * - a function is called with `ctx`; when it resolves to a module whose `default` is an authorizer
+ *   class it was a lazy import — the class is remembered (the import runs once) and used from then on;
+ * - a thrown error is a `403`, never an allow.
+ */
+export declare function resolveConsoleAuthorize(authorize: unknown): ConsoleAuthorizeGate;
+/** Options for {@link authorizeByToken}. */
+export interface AuthorizeByTokenOptions {
+    /** The shared secret callers send as `Authorization: Bearer <token>`. */
+    token: string | undefined;
+}
+/**
+ * An `authorize` for machine access (scripts, a Prometheus scrape): allows a request whose
+ * `Authorization` header is `Bearer <token>`, and answers `{ allowed: false, reason: 'unauthenticated' }`
+ * (`401`) otherwise. Only the header is read.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ * ```
+ *
+ * Throws at config time when `token` is empty or undefined.
+ */
+export declare function authorizeByToken(options: AuthorizeByTokenOptions): (ctx: HttpContext) => ConsoleAuthorizeResult;
+/**
+ * An `authorize` that allows a request when ANY of `authorizers` allows it, tried in order — e.g. a
+ * machine token for MCP clients OR a signed-in admin for the browser:
+ *
+ * ```ts
+ * authorize: anyAuthorize(
+ *   authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ *   (ctx) => ctx.auth.user?.isAdmin === true,
+ * ),
+ * ```
+ *
+ * When none allows: `401` if any of them said "unauthenticated" (redirecting when one asked to),
+ * `403` otherwise. A throwing authorizer counts as a `403` (its error is logged like a throwing
+ * `authorize`) and the next one is still tried.
+ */
+export declare function anyAuthorize(...authorizers: ConsoleAuthorize[]): (ctx: HttpContext) => Promise<ConsoleAuthorizeResult>;
+//# sourceMappingURL=console_authorize.d.ts.map

package/dist/src/dashboard/console_authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_authorize.d.ts","sourceRoot":"","sources":["../../../src/dashboard/console_authorize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP;IACE,OAAO,EAAE,IAAI,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC;CAC1B,GACD;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAA;CAAE,GAC5D;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvF;AAGD,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,iBAAiB,CAAC;AAE/E;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAChF,sBAAsB,GACtB,CAAC,MAAM,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAAC,CAAC;AAEzD,wFAAwF;AACxF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,GAAG,MAAM,EAAE,CAAA;CAAE,GAC3C;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAAC;IACxC,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEN,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAelF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CA0BzE;AAUD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,GAAG,oBAAoB,CA2BhF;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,CAAC,GAAG,EAAE,WAAW,KAAK,sBAAsB,CAa9C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,GAAG,WAAW,EAAE,gBAAgB,EAAE,GACjC,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAiCvD"}

package/dist/src/dashboard/console_authorize.js

@@ -0,0 +1,163 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+function isAuthorizerClass(value) {
+    return (typeof value === 'function' &&
+        typeof value.prototype?.authorize === 'function');
+}
+function lazyModuleClass(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const candidate = value.default;
+    return isAuthorizerClass(candidate) ? candidate : undefined;
+}
+/**
+ * Collapse an `authorize` result into a {@link ConsoleDecision}. Only `true` or an object with
+ * `allowed === true` allows; `{ redirectTo }` is an unauthenticated denial with a redirect target;
+ * anything else — `false`, `{ allowed: false }`, a truthy non-boolean, a missing value — is a `403`.
+ */
+export function normalizeConsoleDecision(result) {
+    if (result === true)
+        return { allowed: true };
+    if (typeof result !== 'object' || result === null)
+        return { allowed: false, reason: 'forbidden' };
+    const record = result;
+    if (record.allowed === true) {
+        if (record.tenants === '*')
+            return { allowed: true, tenants: '*' };
+        if (Array.isArray(record.tenants)) {
+            return {
+                allowed: true,
+                tenants: record.tenants.filter((t) => typeof t === 'string' && t !== ''),
+            };
+        }
+        return { allowed: true };
+    }
+    if (typeof record.redirectTo === 'string' && record.redirectTo !== '') {
+        return { allowed: false, reason: 'unauthenticated', redirectTo: record.redirectTo };
+    }
+    return {
+        allowed: false,
+        reason: record.reason === 'unauthenticated' ? 'unauthenticated' : 'forbidden',
+    };
+}
+async function runAuthorizer(Authorizer, ctx) {
+    const instance = await ctx.containerResolver.make(Authorizer);
+    return instance.authorize(ctx);
+}
+/**
+ * Turn any {@link ConsoleAuthorize} form into a per-request gate:
+ *
+ * - a class is instantiated through the request's container resolver (so `@inject()` works) and its
+ *   `authorize(ctx)` is called;
+ * - a function is called with `ctx`; when it resolves to a module whose `default` is an authorizer
+ *   class it was a lazy import — the class is remembered (the import runs once) and used from then on;
+ * - a thrown error is a `403`, never an allow.
+ */
+export function resolveConsoleAuthorize(authorize) {
+    let Authorizer = isAuthorizerClass(authorize)
+        ? authorize
+        : undefined;
+    if (Authorizer === undefined && typeof authorize !== 'function') {
+        throw new TypeError('[console] `authorize` must be a function, an authorizer class, or a lazy import of one.');
+    }
+    const fn = authorize;
+    return async (ctx) => {
+        try {
+            if (Authorizer !== undefined) {
+                return normalizeConsoleDecision(await runAuthorizer(Authorizer, ctx));
+            }
+            const result = await fn(ctx);
+            const lazy = lazyModuleClass(result);
+            if (lazy !== undefined) {
+                Authorizer = lazy;
+                return normalizeConsoleDecision(await runAuthorizer(lazy, ctx));
+            }
+            return normalizeConsoleDecision(result);
+        }
+        catch (error) {
+            return { allowed: false, reason: 'forbidden', error };
+        }
+    };
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest();
+}
+/**
+ * An `authorize` for machine access (scripts, a Prometheus scrape): allows a request whose
+ * `Authorization` header is `Bearer <token>`, and answers `{ allowed: false, reason: 'unauthenticated' }`
+ * (`401`) otherwise. Only the header is read.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ * ```
+ *
+ * Throws at config time when `token` is empty or undefined.
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error('authorizeByToken: `token` must be a non-empty string');
+    }
+    // Compare digests: equal length always, so the check leaks neither a match nor the token length.
+    const expected = digest(token);
+    return (ctx) => {
+        const header = ctx.request.header('authorization');
+        const match = typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+        if (match?.[1] && timingSafeEqual(digest(match[1]), expected))
+            return { allowed: true };
+        return { allowed: false, reason: 'unauthenticated' };
+    };
+}
+/**
+ * An `authorize` that allows a request when ANY of `authorizers` allows it, tried in order — e.g. a
+ * machine token for MCP clients OR a signed-in admin for the browser:
+ *
+ * ```ts
+ * authorize: anyAuthorize(
+ *   authorizeByToken({ token: env.get('CONSOLE_TOKEN') }),
+ *   (ctx) => ctx.auth.user?.isAdmin === true,
+ * ),
+ * ```
+ *
+ * When none allows: `401` if any of them said "unauthenticated" (redirecting when one asked to),
+ * `403` otherwise. A throwing authorizer counts as a `403` (its error is logged like a throwing
+ * `authorize`) and the next one is still tried.
+ */
+export function anyAuthorize(...authorizers) {
+    if (authorizers.length === 0) {
+        throw new Error('anyAuthorize: pass at least one authorize');
+    }
+    const resolved = authorizers.map((authorize) => resolveConsoleAuthorize(authorize));
+    return async (ctx) => {
+        let unauthenticated = false;
+        let redirectTo;
+        let error;
+        let threw = false;
+        for (const authorize of resolved) {
+            const decision = await authorize(ctx);
+            if (decision.allowed) {
+                return decision.tenants !== undefined
+                    ? { allowed: true, tenants: decision.tenants }
+                    : { allowed: true };
+            }
+            if (decision.error !== undefined && !threw) {
+                threw = true;
+                error = decision.error;
+            }
+            if (decision.reason !== 'unauthenticated')
+                continue;
+            if (decision.redirectTo !== undefined && redirectTo === undefined) {
+                redirectTo = decision.redirectTo;
+            }
+            unauthenticated = true;
+        }
+        if (redirectTo !== undefined)
+            return { redirectTo };
+        if (unauthenticated)
+            return { allowed: false, reason: 'unauthenticated' };
+        // Rethrow an inner authorizer's error so the console still logs it (a throw is a 403).
+        if (threw)
+            throw error;
+        return { allowed: false, reason: 'forbidden' };
+    };
+}
+//# sourceMappingURL=console_authorize.js.map

package/dist/src/dashboard/console_authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_authorize.js","sourceRoot":"","sources":["../../../src/dashboard/console_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAwD1D,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,OAAO,KAAK,KAAK,UAAU;QAC3B,OAAQ,KAAiD,CAAC,SAAS,EAAE,SAAS,KAAK,UAAU,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAI,KAA+B,CAAC,OAAO,CAAC;IAC3D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAKd,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;aACtF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACtF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;KAC9E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkC,EAClC,GAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,IAAI,UAAU,GAAuC,iBAAiB,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAA0C,CAAC;IAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,wBAAwB,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAQD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAgB,EAA0B,EAAE;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAG,WAA+B;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO,KAAK,EAAE,GAAgB,EAAmC,EAAE;QACjE,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,UAA8B,CAAC;QACnC,IAAI,KAAc,CAAC;QACnB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;oBAC9C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;YACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3C,KAAK,GAAG,IAAI,CAAC;gBACb,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YACzB,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB;gBAAE,SAAS;YACpD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAClE,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACnC,CAAC;YACD,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,eAAe;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1E,uFAAuF;QACvF,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/console_shell.d.ts

@@ -0,0 +1,45 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/** Who is signed in, as the sidebar footer shows it. */
+export interface ConsoleViewer {
+    /** Main line: a name or an email. */
+    label: string;
+    email?: string;
+    /** Small caps line under it (`admin`). */
+    role?: string;
+}
+/** How the footer signs out: a POST form (with the CSRF token) or a plain link. */
+export type ConsoleSignOut = {
+    action: string;
+    csrfToken?: string;
+} | {
+    href: string;
+};
+/** The `signOut` config option: a POST action path, `{ action }`, `{ href }`, or `false` for none. */
+export type SignOutOption = string | {
+    action: string;
+} | {
+    href: string;
+} | false;
+/** The `viewer` config hook: return the viewer, or `null`/`undefined` for no user row. */
+export type ViewerHook = (ctx: HttpContext) => ConsoleViewer | null | undefined | Promise<ConsoleViewer | null | undefined>;
+/**
+ * A viewer from any user-ish object: `fullName` / `name` / `email` for the label, `email`, and the
+ * first of `role` / `roles`. `undefined` when nothing usable is there.
+ */
+export declare function viewerFromUser(user: unknown): ConsoleViewer | undefined;
+/**
+ * The viewer for this request: the host's `viewer(ctx)` hook when configured (a throw or an empty
+ * answer means no user row), else a structural read of `ctx.auth?.user` — only when the request is
+ * already authenticated; it never triggers an authentication.
+ */
+export declare function resolveViewer(ctx: HttpContext, hook: ViewerHook | null | undefined): Promise<ConsoleViewer | undefined>;
+/** The request's CSRF token when `@adonisjs/shield` (or anything like it) put one on the request. */
+export declare function csrfTokenOf(ctx: HttpContext): string | undefined;
+/**
+ * The sign-out the footer offers: the host's `signOut` option when set (`false` = none), else the
+ * one an account console (authkit) announced on the `agora.consoles` registry, else none. Only
+ * same-origin paths are ever emitted. A POST action carries the request's CSRF token when there is
+ * one.
+ */
+export declare function resolveSignOut(ctx: HttpContext, configured: SignOutOption | null | undefined, registry: unknown): ConsoleSignOut | undefined;
+//# sourceMappingURL=console_shell.d.ts.map

package/dist/src/dashboard/console_shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_shell.d.ts","sourceRoot":"","sources":["../../../src/dashboard/console_shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAevD,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF,sGAAsG;AACtG,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC;AAEnF,0FAA0F;AAC1F,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,WAAW,KACb,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAyBlF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAQvE;AAaD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAepC;AAED,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAGhE;AAiBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,UAAU,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EAC5C,QAAQ,EAAE,OAAO,GAChB,cAAc,GAAG,SAAS,CAW5B"}

package/dist/src/dashboard/console_shell.js

@@ -0,0 +1,125 @@
+import { isSameOriginPath } from './console_switcher.js';
+/** A same-origin path with no backslash or control character (what the SPA will follow). */
+function safePath(path) {
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control characters is the point
+    return isSameOriginPath(path) && !path.includes('\\') && !/[\u0000-\u001f\u007f]/.test(path);
+}
+function text(value) {
+    if (typeof value === 'string' && value.trim() !== '')
+        return value.trim();
+    return undefined;
+}
+/** The first role of a user, from `role`, `roles: string[]` or `roles: [{ name }]`. */
+function roleOf(user) {
+    const direct = text(user.role);
+    if (direct)
+        return direct;
+    const roles = user.roles;
+    if (Array.isArray(roles)) {
+        for (const role of roles) {
+            const name = text(role) ??
+                (typeof role === 'object' && role !== null
+                    ? text(role.name)
+                    : undefined);
+            if (name)
+                return name;
+        }
+    }
+    return undefined;
+}
+/**
+ * A viewer from any user-ish object: `fullName` / `name` / `email` for the label, `email`, and the
+ * first of `role` / `roles`. `undefined` when nothing usable is there.
+ */
+export function viewerFromUser(user) {
+    if (typeof user !== 'object' || user === null)
+        return undefined;
+    const u = user;
+    const email = text(u.email);
+    const label = text(u.fullName) ?? text(u.name) ?? email;
+    if (!label)
+        return undefined;
+    const role = roleOf(u);
+    return { label, ...(email ? { email } : {}), ...(role ? { role } : {}) };
+}
+/** Keep only the fields the SPA renders, as trimmed non-empty strings. */
+function cleanViewer(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const v = value;
+    const label = text(v.label);
+    if (!label)
+        return undefined;
+    const email = text(v.email);
+    const role = text(v.role);
+    return { label, ...(email ? { email } : {}), ...(role ? { role } : {}) };
+}
+/**
+ * The viewer for this request: the host's `viewer(ctx)` hook when configured (a throw or an empty
+ * answer means no user row), else a structural read of `ctx.auth?.user` — only when the request is
+ * already authenticated; it never triggers an authentication.
+ */
+export async function resolveViewer(ctx, hook) {
+    if (hook) {
+        try {
+            return cleanViewer(await hook(ctx));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    try {
+        const auth = ctx.auth;
+        return viewerFromUser(auth?.user);
+    }
+    catch {
+        // Some guards throw on `.user` before authentication; that just means "no viewer".
+        return undefined;
+    }
+}
+/** The request's CSRF token when `@adonisjs/shield` (or anything like it) put one on the request. */
+export function csrfTokenOf(ctx) {
+    const token = ctx.request.csrfToken;
+    return typeof token === 'string' && token !== '' ? token : undefined;
+}
+/** What a registry's `account.signOut` (announced by authkit) may look like. */
+function announcedSignOut(registry) {
+    if (typeof registry !== 'object' || registry === null)
+        return undefined;
+    const account = registry.account;
+    if (typeof account !== 'object' || account === null)
+        return undefined;
+    const signOut = account.signOut;
+    if (typeof signOut === 'string')
+        return signOut;
+    if (typeof signOut === 'object' && signOut !== null) {
+        const s = signOut;
+        if (typeof s.action === 'string')
+            return { action: s.action };
+        if (typeof s.href === 'string')
+            return { href: s.href };
+    }
+    return undefined;
+}
+/**
+ * The sign-out the footer offers: the host's `signOut` option when set (`false` = none), else the
+ * one an account console (authkit) announced on the `agora.consoles` registry, else none. Only
+ * same-origin paths are ever emitted. A POST action carries the request's CSRF token when there is
+ * one.
+ */
+export function resolveSignOut(ctx, configured, registry) {
+    if (configured === false)
+        return undefined;
+    const option = configured ?? announcedSignOut(registry);
+    if (option === undefined || option === false)
+        return undefined;
+    if (typeof option === 'object' && 'href' in option) {
+        return safePath(option.href) ? { href: option.href } : undefined;
+    }
+    const action = typeof option === 'string' ? option : option.action;
+    if (!safePath(action))
+        return undefined;
+    const csrfToken = csrfTokenOf(ctx);
+    return { action, ...(csrfToken ? { csrfToken } : {}) };
+}
+//# sourceMappingURL=console_shell.js.map

package/dist/src/dashboard/console_shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console_shell.js","sourceRoot":"","sources":["../../../src/dashboard/console_shell.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,4FAA4F;AAC5F,SAAS,QAAQ,CAAC,IAAa;IAC7B,qGAAqG;IACrG,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AA4BD,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAC,IAA6B;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,CAAC;gBACV,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBACxC,CAAC,CAAC,IAAI,CAAE,IAA2B,CAAC,IAAI,CAAC;oBACzC,CAAC,CAAC,SAAS,CAAC,CAAC;YACjB,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAgB,EAChB,IAAmC;IAEnC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,GAAgD,CAAC,IAAI,CAAC;QACpE,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,MAAM,KAAK,GAAI,GAAG,CAAC,OAA8C,CAAC,SAAS,CAAC;IAC5E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,QAAiB;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAI,QAAkC,CAAC,OAAO,CAAC;IAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,OAA+C,CAAC;QAC1D,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgB,EAChB,UAA4C,EAC5C,QAAiB;IAEjB,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC"}