@adonis-agora/payments 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @adonis-agora/payments
 
+## 0.5.0
+
+### Minor Changes
+
+- [#18](https://github.com/DavideCarvalho/adonis-agora-payments/pull/18) [`7513756`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/7513756cc6e85cf2b7763737da27bb7599d03878) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: a refused page navigation now gets a real page instead of `{"error":"forbidden"}`.
+  
+  Opening the console without permission used to answer the browser with the same JSON the API
+  gets. It now serves a built-in access-denied page in the console's own visual language — the
+  status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
+  is configured, a "Sign in" button. The Mode-A-only "Open this console from your application."
+  notice uses the same page. API requests are unchanged (the SPA still relies on their JSON), and
+  an `authorize` hook that redirects still wins.
+  
+  The page carries no inline `<script>`, so a nonce'd `script-src` CSP cannot break it; its inline
+  `<style>` takes `@adonisjs/shield`'s request nonce when one exists.
+  
+  New `accessDenied` option on `config/payments_dashboard.ts` to customise it — an object
+  (`brand`, `title`, `message`, `homeHref`, `loginHref`, `accent`, labels) to tweak the built-in
+  page, or a function `(info, ctx) => html | void` to render it yourself or redirect.
+  
+  Also: the built-in `dashboardAuth` login page no longer dies under a nonce'd CSP. It is now a real
+  HTML form that works without JavaScript — a form submit is answered with a redirect (to the page
+  the operator came from, or back to the form with the error shown) while the page's own `fetch`
+  keeps getting JSON — and its inline script/style carry `@adonisjs/shield`'s request nonce.
+  `renderLoginPage` takes an optional `{ nonce, error, returnTo }`.
+
 ## 0.4.1
 
 ### Patch Changes

package/dist/providers/dashboard_provider.d.ts

@@ -79,10 +79,12 @@ export default class PaymentsDashboardProvider {
      * Run the guards for a dashboard resource. Composes the `authorize` hook (bearer token/custom)
      * with the optional `dashboardAuth` session guard — BOTH must pass:
      *
-     * 1. `authorize` fails -> `403`.
+     * 1. `authorize` fails -> `403`: the built-in (or host-customised) access-denied PAGE for a
+     *    `page` request, `{ error: 'forbidden' }` JSON for an `api` request.
      * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or a `401` notice (Mode A only);
-     *    for an `api` request, `401 { error: 'unauthorized', auth: { modes } }`.
+     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
+     *    from your app" page (Mode A only); for an `api` request,
+     *    `401 { error: 'unauthorized', auth: { modes } }`.
      *
      * Returns `allowed: false` (and has already written the response) when the request must
      * short-circuit. On success it also carries WHO passed the gate: the session's user, which
@@ -91,6 +93,13 @@ export default class PaymentsDashboardProvider {
      * one would be worse than an honest "unattributed".
      */
     private enforce;
+    /**
+     * Answer a refused PAGE navigation with HTML instead of the API's JSON: the built-in page, the
+     * host's tweaked version of it, or whatever the host's `accessDenied` renderer produced. Stands
+     * down when the request is already answered — an `authorize` hook (or the renderer) that wrote a
+     * redirect keeps it; the provider never overwrites a `location` header.
+     */
+    private denyPage;
     private readSessionCookie;
     private writeSessionCookie;
 }

package/dist/providers/dashboard_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAiElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAChC,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,oGAAoG;IACpG,OAAO,CAAC,iBAAiB,CAAS;IAE5B,IAAI,kBAaT;IAED,OAAO,CAAC,cAAc;IA2FtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY,CAAwC;YAE9C,OAAO;IAqCrB;iGAC6F;YAC/E,eAAe;YAef,gBAAgB;IAa9B,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAwDzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;YAwDZ,aAAa;IAQ3B;;;;;;;;;;;;;;OAcG;YACW,OAAO;IA+CrB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,kBAAkB;CAU3B"}
+{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAsElF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAChC,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,oGAAoG;IACpG,OAAO,CAAC,iBAAiB,CAAS;IAE5B,IAAI,kBAaT;IAED,OAAO,CAAC,cAAc;IA2FtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY,CAAwC;YAE9C,OAAO;IAqCrB;iGAC6F;YAC/E,eAAe;YAef,gBAAgB;IAa9B,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAwDzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;YAoFZ,aAAa;IAQ3B;;;;;;;;;;;;;;;;OAgBG;YACW,OAAO;IA2CrB;;;;;OAKG;YACW,QAAQ;IAuBtB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,kBAAkB;CAU3B"}

package/dist/providers/dashboard_provider.js

@@ -2,8 +2,9 @@ import { readFile } from 'node:fs/promises';
 import { basename, resolve as resolvePath } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { WebhookProcessor } from '../src/billing/webhook_processor.js';
+import { resolveAccessDeniedPage, } from '../src/dashboard/access_denied_page.js';
 import { createRefundAction, createReplayAction } from '../src/dashboard/actions.js';
-import { performLogin, performSession, readSession, SESSION_COOKIE_NAME, } from '../src/dashboard/auth.js';
+import { performLogin, performSession, readSession, SESSION_COOKIE_NAME, sanitizeReturnTo, } from '../src/dashboard/auth.js';
 import { resolveConfig, } from '../src/dashboard/define_config.js';
 import { auditEvents, customers, disputes, health, overview, paymentDetail, payments, providers, refundPayment, resolveDispute, retryWebhookEvent, subscriptions, webhookEvents, } from '../src/dashboard/handlers.js';
 import { renderLoginPage } from '../src/dashboard/login_page.js';
@@ -305,20 +306,45 @@ export default class PaymentsDashboardProvider {
                 .get(loginPath, async (ctx) => {
                 ctx.response.header('content-type', 'text/html; charset=utf-8');
                 ctx.response.header('cache-control', 'no-store, must-revalidate');
-                return ctx.response.send(renderLoginPage(config.path));
+                const qs = ctx.request.qs();
+                const nonce = cspNonce(ctx);
+                return ctx.response.send(renderLoginPage(config.path, {
+                    ...(nonce !== undefined ? { nonce } : {}),
+                    error: qs.error !== undefined,
+                    returnTo: qs.returnTo,
+                }));
             })
                 .as('payments_dashboard.login.page');
+            // Two callers: the page's own `fetch` (JSON in, JSON out — `{ redirectTo }` / `{ error }`)
+            // and, with JavaScript off or its inline script dropped by a CSP, the same page as a classic
+            // form post (form-encoded in, a redirect out: to `returnTo` on success, back to the login
+            // page with `?error` on failure). Same hook, same cookie, same uniform failure either way.
             router
                 .post(loginPath, async (ctx) => {
-                const outcome = await performLogin(auth, ctx.request.body(), config.path);
+                const body = ctx.request.body();
+                const outcome = await performLogin(auth, body, config.path);
+                const form = isFormPost(ctx);
+                const backToLogin = () => ctx.response
+                    .redirect()
+                    .withQs({
+                    error: '1',
+                    returnTo: sanitizeReturnTo(body?.returnTo, config.path || '/'),
+                })
+                    .toPath(loginPath);
                 if (outcome.kind === 'bad-request') {
+                    if (form)
+                        return backToLogin();
                     return ctx.response.status(400).json({ error: outcome.message });
                 }
                 if (outcome.kind === 'unauthorized') {
                     await this.warnHookThrow(outcome.hookError);
+                    if (form)
+                        return backToLogin();
                     return ctx.response.status(401).json({ error: outcome.message });
                 }
                 this.writeSessionCookie(ctx, auth, outcome.cookieValue);
+                if (form)
+                    return ctx.response.redirect().toPath(outcome.redirectTo);
                 return ctx.response.status(200).json({ redirectTo: outcome.redirectTo });
             })
                 .as('payments_dashboard.login.submit');
@@ -355,10 +381,12 @@ export default class PaymentsDashboardProvider {
      * Run the guards for a dashboard resource. Composes the `authorize` hook (bearer token/custom)
      * with the optional `dashboardAuth` session guard — BOTH must pass:
      *
-     * 1. `authorize` fails -> `403`.
+     * 1. `authorize` fails -> `403`: the built-in (or host-customised) access-denied PAGE for a
+     *    `page` request, `{ error: 'forbidden' }` JSON for an `api` request.
      * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or a `401` notice (Mode A only);
-     *    for an `api` request, `401 { error: 'unauthorized', auth: { modes } }`.
+     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
+     *    from your app" page (Mode A only); for an `api` request,
+     *    `401 { error: 'unauthorized', auth: { modes } }`.
      *
      * Returns `allowed: false` (and has already written the response) when the request must
      * short-circuit. On success it also carries WHO passed the gate: the session's user, which
@@ -369,7 +397,10 @@ export default class PaymentsDashboardProvider {
     async enforce(config, ctx, mode) {
         const allowed = await config.authorize(ctx);
         if (!allowed) {
-            if (!ctx.response.getHeader('location')) {
+            if (mode === 'page') {
+                await this.denyPage(ctx, config, { status: 403, reason: 'forbidden' });
+            }
+            else if (!ctx.response.getHeader('location')) {
                 ctx.response.status(403).json({ error: 'forbidden' });
             }
             return { allowed: false };
@@ -394,16 +425,38 @@ export default class PaymentsDashboardProvider {
             }
             // Mode A only: there's no login page to send the browser to — this deployment expects the
             // host app to mint a session via `POST <path>/session` before ever navigating here.
-            ctx.response
-                .status(401)
-                .header('content-type', 'text/html; charset=utf-8')
-                .header('cache-control', 'no-store, must-revalidate')
-                .send('<!doctype html><html><body style="font-family:ui-monospace,monospace;background:#09090b;color:#e7e7ea;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p>Open this console from your application.</p></body></html>');
+            await this.denyPage(ctx, config, { status: 401, reason: 'session-required' });
             return { allowed: false };
         }
         ctx.response.status(401).json({ error: 'unauthorized', auth: { modes: auth.modes } });
         return { allowed: false };
     }
+    /**
+     * Answer a refused PAGE navigation with HTML instead of the API's JSON: the built-in page, the
+     * host's tweaked version of it, or whatever the host's `accessDenied` renderer produced. Stands
+     * down when the request is already answered — an `authorize` hook (or the renderer) that wrote a
+     * redirect keeps it; the provider never overwrites a `location` header.
+     */
+    async denyPage(ctx, config, denial) {
+        const answered = () => responseAnswered(ctx);
+        if (answered())
+            return;
+        const nonce = cspNonce(ctx);
+        const info = {
+            ...denial,
+            basePath: config.path,
+            ...(config.dashboardAuth?.login ? { loginHref: `${config.path}/login` } : {}),
+            ...(nonce !== undefined ? { nonce } : {}),
+        };
+        const html = await resolveAccessDeniedPage(info, config.accessDenied, ctx, answered);
+        if (html === null)
+            return;
+        ctx.response
+            .status(info.status)
+            .header('content-type', 'text/html; charset=utf-8')
+            .header('cache-control', 'no-store, must-revalidate')
+            .send(html);
+    }
     readSessionCookie(ctx) {
         const value = ctx.request.plainCookie(SESSION_COOKIE_NAME, undefined, false);
         return typeof value === 'string' && value !== '' ? value : undefined;
@@ -419,6 +472,36 @@ export default class PaymentsDashboardProvider {
         });
     }
 }
+/**
+ * Whether something already answered this request: a redirect (`location` header — the signal the
+ * `authorize` contract has always honoured) or a body queued on the response. The body check reads
+ * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
+ * (which has neither) still works.
+ */
+function responseAnswered(ctx) {
+    if (ctx.response.getHeader('location'))
+        return true;
+    const response = ctx.response;
+    return response.hasLazyBody === true || response.headersSent === true;
+}
+/**
+ * The request's CSP nonce when the host runs `@adonisjs/shield` with `@nonce` in its policy (shield
+ * exposes it as `response.nonce`). Read structurally: this package neither depends on shield nor
+ * cares which middleware minted the nonce — only that the page's inline `<style>` carries it.
+ */
+function cspNonce(ctx) {
+    const nonce = ctx.response.nonce;
+    return typeof nonce === 'string' && nonce !== '' ? nonce : undefined;
+}
+/**
+ * Whether a login `POST` came from a classic HTML form submit (form-encoded — JavaScript off, or
+ * the page's inline script dropped by a CSP) rather than the page's own JSON `fetch`. Decides
+ * whether the reply is a redirect (a browser navigating) or JSON (a script awaiting it).
+ */
+function isFormPost(ctx) {
+    const type = ctx.request.header('content-type') ?? '';
+    return type.includes('application/x-www-form-urlencoded') || type.includes('multipart/form-data');
+}
 /** Adapt an AdonisJS `HttpContext` to the framework-light {@link ApiRequest}. */
 function toApiRequest(ctx) {
     return {

package/dist/providers/dashboard_provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.js","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,cAAc,EAEd,WAAW,EACX,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,aAAa,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAGL,WAAW,EACX,SAAS,EAGT,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;GASG;AACH,IAAI,MAA0B,CAAC;AAC/B,SAAS,YAAY;IACnB,MAAM,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IACtB,GAAG;IAAzB,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,oGAAoG;IAC5F,iBAAiB,GAAG,KAAK,CAAC;IAElC,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAA0B,oBAAoB,EAAE,EAAE,CAAC,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAE5B,wFAAwF;QACxF,2FAA2F;QAC3F,gFAAgF;QAChF,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,MAAyB,EAAE,MAAuC;QACvF,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,MAAM,CAAC;QAErC,6FAA6F;QAC7F,4FAA4F;QAC5F,wBAAwB;QACxB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,CACX,OAA2D,EAC3D,YAAY,GAAG,KAAK,EACpB,EAAE;YACF,OAAO,KAAK,EAAE,GAAgB,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO;gBAC3B,IAAI,KAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,GAAG,eAAe,EAAE,CAAC;gBAC5B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,sFAAsF;oBACtF,qFAAqF;oBACrF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;qBAC5E,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAS;wBACjB,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,kFAAkF;wBAClF,gFAAgF;wBAChF,0EAA0E;wBAC1E,8EAA8E;wBAC9E,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5D,iFAAiF;wBACjF,sDAAsD;wBACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC;oBACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,GAAG,CAAC,QAAQ;yBAChB,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,0FAA0F;QAC1F,6FAA6F;QAC7F,6CAA6C;QAC7C,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,sBAAsB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aAC1D,EAAE,CAAC,kCAAkC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;QACjF,yFAAyF;QACzF,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aACpD,EAAE,CAAC,kCAAkC,CAAC,CAAC;QAC1C,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aACrD,EAAE,CAAC,mCAAmC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QAEvF,gGAAgG;QAChG,2FAA2F;QAC3F,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,6BAA6B,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;aACxE,EAAE,CAAC,oCAAoC,CAAC,CAAC;QAC5C,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,uCAAuC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;aACtF,EAAE,CAAC,yCAAyC,CAAC,CAAC;QACjD,4FAA4F;QAC5F,qFAAqF;QACrF,mEAAmE;QACnE,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,8BAA8B,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;aACpE,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACK,YAAY,CAAwC;IAEpD,KAAK,CAAC,OAAO,CAAC,KAAmB;QACvC,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhD,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,4FAA4F;QAC5F,uFAAuF;QACvF,sFAAsF;QACtF,uCAAuC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACrC,KAAK;YACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,OAAO,GAA8B;YACzC,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClE,aAAa,EAAE,kBAAkB,CAAC;gBAChC,KAAK;gBACL,sFAAsF;gBACtF,oFAAoF;gBACpF,+EAA+E;gBAC/E,uFAAuF;gBACvF,kDAAkD;gBAClD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAqB,CAAC;aAC7D,CAAC;SACH,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;iGAC6F;IACrF,KAAK,CAAC,eAAe,CAC3B,cAA2C;QAE3C,MAAM,QAAQ,GAAmC,EAAE,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACvD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;YACF,IAAI,GAAG,CAAC,eAAe;gBAAE,OAAO,6BAA6B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACjE,iBAAiB,CACvB,MAAyB,EACzB,MAAuC,EACvC,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEzD,MAAM;aACH,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO;YAC/D,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,QAAQ;qBAChB,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;YACN,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;iBAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;iBACpD,IAAI,CACH,eAAe,CACb,IAAI,EACJ,MAAM,CAAC,IAAI,EACX,OAAO,EACP,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACpE,CACF,CAAC;QACN,CAAC,CAAC;aACD,EAAE,CAAC,0BAA0B,CAAC,CAAC;QAElC,MAAM;aACH,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,eAAe,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YAC7D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO;YAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;iBAC5C,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;iBAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;;;OAUG;IACK,kBAAkB,CACxB,MAAyB,EACzB,MAAuC,EACvC,IAA2B;QAE3B,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,IAAI,QAAQ,CAAC;QACzC,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC;QAC7C,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM;iBACH,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;gBAClE,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC;iBACD,EAAE,CAAC,+BAA+B,CAAC,CAAC;YAEvC,MAAM;iBACH,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC;iBACD,EAAE,CAAC,iCAAiC,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM;iBACH,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC;iBACD,EAAE,CAAC,iCAAiC,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM;aACH,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC,CAAC;aACD,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAkB;QAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC9D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,+DAA+D,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,OAAO,CACnB,MAAuC,EACvC,GAAgB,EAChB,IAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,uFAAuF;QACvF,6EAA6E;QAC7E,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;gBACpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,0FAA0F;YAC1F,oFAAoF;YACpF,GAAG,CAAC,QAAQ;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;iBAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;iBACpD,IAAI,CACH,mPAAmP,CACpP,CAAC;YACJ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEO,iBAAiB,CAAC,GAAgB;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAEO,kBAAkB,CAAC,GAAgB,EAAE,IAA2B,EAAE,KAAa;QACrF,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE;YACnD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACrC,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;CACF;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,GAAgB;IACpC,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAA4C;QACxD,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAmD;QACxE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"dashboard_provider.js","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAEL,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,cAAc,EAEd,WAAW,EACX,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,aAAa,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAGL,WAAW,EACX,SAAS,EAGT,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,GAEtB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;GASG;AACH,IAAI,MAA0B,CAAC;AAC/B,SAAS,YAAY;IACnB,MAAM,KAAK,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IACtB,GAAG;IAAzB,YAAsB,GAAuB;mBAAvB,GAAG;IAAuB,CAAC;IAEjD,oGAAoG;IAC5F,iBAAiB,GAAG,KAAK,CAAC;IAElC,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAA0B,oBAAoB,EAAE,EAAE,CAAC,CACvE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAE5B,wFAAwF;QACxF,2FAA2F;QAC3F,gFAAgF;QAChF,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,MAAyB,EAAE,MAAuC;QACvF,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,MAAM,CAAC;QAErC,6FAA6F;QAC7F,4FAA4F;QAC5F,wBAAwB;QACxB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhD,MAAM,IAAI,GAAG,CACX,OAA2D,EAC3D,YAAY,GAAG,KAAK,EACpB,EAAE;YACF,OAAO,KAAK,EAAE,GAAgB,EAAE,EAAE;gBAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO;gBAC3B,IAAI,KAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,GAAG,eAAe,EAAE,CAAC;gBAC5B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,sFAAsF;oBACtF,qFAAqF;oBACrF,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;qBAC5E,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAS;wBACjB,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,kFAAkF;wBAClF,gFAAgF;wBAChF,0EAA0E;wBAC1E,8EAA8E;wBAC9E,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5D,iFAAiF;wBACjF,sDAAsD;wBACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC;oBACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,GAAG,CAAC,QAAQ;yBAChB,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,0FAA0F;QAC1F,6FAA6F;QAC7F,6CAA6C;QAC7C,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,sBAAsB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aAC1D,EAAE,CAAC,kCAAkC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;QACjF,yFAAyF;QACzF,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACpF,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aACpD,EAAE,CAAC,kCAAkC,CAAC,CAAC;QAC1C,MAAM;aACH,GAAG,CAAC,GAAG,OAAO,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;aACrD,EAAE,CAAC,mCAAmC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QAEvF,gGAAgG;QAChG,2FAA2F;QAC3F,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,6BAA6B,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;aACxE,EAAE,CAAC,oCAAoC,CAAC,CAAC;QAC5C,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,uCAAuC,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;aACtF,EAAE,CAAC,yCAAyC,CAAC,CAAC;QACjD,4FAA4F;QAC5F,qFAAqF;QACrF,mEAAmE;QACnE,MAAM;aACH,IAAI,CAAC,GAAG,OAAO,8BAA8B,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;aACpE,EAAE,CAAC,qCAAqC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACK,YAAY,CAAwC;IAEpD,KAAK,CAAC,OAAO,CAAC,KAAmB;QACvC,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhD,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,4FAA4F;QAC5F,uFAAuF;QACvF,sFAAsF;QACtF,uCAAuC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACrC,KAAK;YACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,OAAO,GAA8B;YACzC,MAAM,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClE,aAAa,EAAE,kBAAkB,CAAC;gBAChC,KAAK;gBACL,sFAAsF;gBACtF,oFAAoF;gBACpF,+EAA+E;gBAC/E,uFAAuF;gBACvF,kDAAkD;gBAClD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAqB,CAAC;aAC7D,CAAC;SACH,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;iGAC6F;IACrF,KAAK,CAAC,eAAe,CAC3B,cAA2C;QAE3C,MAAM,QAAQ,GAAmC,EAAE,CAAC;QACpD,IAAI,cAAc,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACvD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;YACF,IAAI,GAAG,CAAC,eAAe;gBAAE,OAAO,6BAA6B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,yEAAyE;IACjE,iBAAiB,CACvB,MAAyB,EACzB,MAAuC,EACvC,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAEzD,MAAM;aACH,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO;YAC/D,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,QAAQ;qBAChB,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;YACN,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;iBAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;iBACpD,IAAI,CACH,eAAe,CACb,IAAI,EACJ,MAAM,CAAC,IAAI,EACX,OAAO,EACP,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACpE,CACF,CAAC;QACN,CAAC,CAAC;aACD,EAAE,CAAC,0BAA0B,CAAC,CAAC;QAElC,MAAM;aACH,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,eAAe,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE;YAC7D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO;YAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ;iBAChB,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC;iBAC5C,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;iBAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;;;OAUG;IACK,kBAAkB,CACxB,MAAyB,EACzB,MAAuC,EACvC,IAA2B;QAE3B,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,IAAI,QAAQ,CAAC;QACzC,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC;QAC7C,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM;iBACH,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;gBAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CACtB,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC3B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS;oBAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC;iBACD,EAAE,CAAC,+BAA+B,CAAC,CAAC;YAEvC,2FAA2F;YAC3F,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM;iBACH,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,WAAW,GAAG,GAAG,EAAE,CACvB,GAAG,CAAC,QAAQ;qBACT,QAAQ,EAAE;qBACV,MAAM,CAAC;oBACN,KAAK,EAAE,GAAG;oBACV,QAAQ,EAAE,gBAAgB,CACvB,IAAsC,EAAE,QAAQ,EACjD,MAAM,CAAC,IAAI,IAAI,GAAG,CACnB;iBACF,CAAC;qBACD,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACnC,IAAI,IAAI;wBAAE,OAAO,WAAW,EAAE,CAAC;oBAC/B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC5C,IAAI,IAAI;wBAAE,OAAO,WAAW,EAAE,CAAC;oBAC/B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxD,IAAI,IAAI;oBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACpE,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC;iBACD,EAAE,CAAC,iCAAiC,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM;iBACH,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC;iBACD,EAAE,CAAC,iCAAiC,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM;aACH,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC,CAAC;aACD,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,SAAkB;QAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAC9D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,+DAA+D,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,OAAO,CACnB,MAAuC,EACvC,GAAgB,EAChB,IAAoB;QAEpB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,uFAAuF;QACvF,6EAA6E;QAC7E,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;gBACpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,0FAA0F;YAC1F,oFAAoF;YACpF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CACpB,GAAgB,EAChB,MAAuC,EACvC,MAAmD;QAEnD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE;YAAE,OAAO;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAqB;YAC7B,GAAG,MAAM;YACT,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAC1B,GAAG,CAAC,QAAQ;aACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aACnB,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;aAClD,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAEO,iBAAiB,CAAC,GAAgB;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAEO,kBAAkB,CAAC,GAAgB,EAAE,IAA2B,EAAE,KAAa;QACrF,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE;YACnD,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACrC,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAuE,CAAC;IAC7F,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAgB;IAChC,MAAM,KAAK,GAAI,GAAG,CAAC,QAA2C,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;AACpG,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,GAAgB;IACpC,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAA4C;QACxD,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAmD;QACxE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;KACzB,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/access_denied_page.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
+ * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * existed the guard answered every denial with the JSON it answers the API with
+ * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
+ * thing for a human staring at a browser tab.
+ *
+ * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
+ * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
+ * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
+ *
+ * Every string the host can supply ({@link AccessDeniedPageOptions}) is HTML-escaped on the way in.
+ * They are developer-controlled config values, not user input — but escaping them costs nothing and
+ * removes the one class of bug a "just interpolate it" template would invite.
+ *
+ * The visual language (Aviary neutrals, the console's own accent, mono eyebrow over a sans body)
+ * mirrors the payments SPA so the refusal reads as part of the same product, not a server default.
+ *
+ * Ported to `@adonis-agora/durable`, `@adonis-agora/media`, `@adonis-agora/agent` and
+ * `@adonis-agora/telescope` with only {@link CONSOLE} changed, so the Agora consoles share ONE
+ * refusal story rather than each inventing its own.
+ */
+/** Why the guard refused. Drives the default title/message and which buttons make sense. */
+export type AccessDeniedReason = 
+/** Nobody is signed in (a `401`): offer the login page when one exists. */
+'unauthenticated'
+/** Somebody is signed in but `authorize` said no (a `403`). */
+ | 'forbidden'
+/** `dashboardAuth` runs in Mode A only and there is no session — the host app must mint one. */
+ | 'session-required';
+/** What the provider knows about the refusal — handed to a custom renderer and to the default page. */
+export interface AccessDeniedInfo {
+    /** The HTTP status the page is served with. */
+    status: 401 | 403;
+    reason: AccessDeniedReason;
+    /** The console's mount path (`/payments`; `''` when mounted at the root). */
+    basePath: string;
+    /** The built-in login page, present only when `dashboardAuth.login` is configured. */
+    loginHref?: string;
+    /** A developer-facing detail (e.g. a thrown hook's message). Providers set it OUTSIDE production only. */
+    detail?: string;
+    /** The request's CSP nonce, applied to the inline `<style>` so a nonce'd `style-src` keeps the page styled. */
+    nonce?: string;
+}
+/**
+ * Knobs for the built-in page — the `accessDenied` config option in its OBJECT form. Every field is
+ * optional; omit the option entirely for the defaults.
+ */
+export interface AccessDeniedPageOptions {
+    /** Console name in the eyebrow and `<title>`. Default: the console's own name (`Payments`). */
+    brand?: string;
+    /** Heading. Default depends on {@link AccessDeniedInfo.reason}. */
+    title?: string;
+    /** The sentence under the heading. Default depends on the reason. */
+    message?: string;
+    /** Where "Back to app" points. Default `/`; `false` hides the button. */
+    homeHref?: string | false;
+    /** Label of the "Back to app" button. */
+    homeLabel?: string;
+    /** Where "Sign in" points. Default: the built-in login page when one exists; `false` hides it. */
+    loginHref?: string | false;
+    /** Label of the "Sign in" button. */
+    loginLabel?: string;
+    /** Accent colour (any CSS colour). Default: the console's own accent. */
+    accent?: string;
+}
+/**
+ * The `accessDenied` config option in its FUNCTION form: render the page yourself. Return an HTML
+ * string and the provider serves it (with the refusal's status, `text/html`, `no-store`). Return
+ * nothing after answering the request yourself — a redirect to your own login page, most commonly —
+ * and the provider stands down. Return nothing WITHOUT answering and the default page is served, so
+ * the hook is safe to use for side effects (logging) alone.
+ *
+ * `Ctx` is the host framework's HTTP context — the provider passes AdonisJS's `HttpContext` through
+ * untouched; it is generic here so this module stays framework-light and unit-testable.
+ */
+export type AccessDeniedRenderer<Ctx = unknown> = (info: AccessDeniedInfo, ctx: Ctx) => string | undefined | null | void | Promise<string | undefined | null | void>;
+/** The `accessDenied` config option: tweak the built-in page, or replace it. */
+export type AccessDeniedOption<Ctx = unknown> = AccessDeniedPageOptions | AccessDeniedRenderer<Ctx>;
+/** This console's identity — the ONLY thing that differs between the Agora ports of this file. */
+export declare const CONSOLE: {
+    readonly brand: 'Payments';
+    readonly accent: '#22d3ee';
+    readonly packageName: '@adonis-agora/payments';
+};
+/** Escape the five characters that matter inside HTML text and double-quoted attributes. */
+export declare function escapeHtml(value: string): string;
+/**
+ * Render the built-in page. Pure: same `info` + `options` in, same HTML out — so it is trivially
+ * snapshot/regex testable and safe to call from anywhere (the provider, a test, a host that wants
+ * to embed the default page inside its own layout).
+ */
+export declare function renderAccessDeniedPage(info: AccessDeniedInfo, options?: AccessDeniedPageOptions): string;
+/**
+ * Resolve WHAT to serve for a refusal, honouring the host's `accessDenied` option in either form.
+ * Returns the HTML to send, or `null` when a custom renderer already answered the request itself
+ * (`answered()` reports whether it did — the provider wires that to "a `location` header or a body
+ * is already set"). Framework-light: knows nothing about the HTTP context beyond passing it through.
+ */
+export declare function resolveAccessDeniedPage<Ctx>(info: AccessDeniedInfo, option: AccessDeniedOption<Ctx> | null | undefined, ctx: Ctx, answered: () => boolean): Promise<string | null>;
+//# sourceMappingURL=access_denied_page.d.ts.map

package/dist/src/dashboard/access_denied_page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access_denied_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB;AAC5B,2EAA2E;AACzE,iBAAiB;AACnB,+DAA+D;GAC7D,WAAW;AACb,gGAAgG;GAC9F,kBAAkB,CAAC;AAEvB,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,GAAG,GAAG,OAAO,IAAI,CAChD,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,GAAG,KAEL,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;AAElF,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,CAAC,GAAG,GAAG,OAAO,IAAI,uBAAuB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAEpG,kGAAkG;AAClG,eAAO,MAAM,OAAO;aAClB,KAAK,EAAE,UAAU;aACjB,MAAM,EAAE,SAAS;aACjB,WAAW,EAAE,wBAAwB;CAC7B,CAAC;AAmBX,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAyBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAqLR;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAC/C,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,OAAO,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB"}

package/dist/src/dashboard/access_denied_page.js

@@ -0,0 +1,266 @@
+/**
+ * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
+ * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * existed the guard answered every denial with the JSON it answers the API with
+ * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
+ * thing for a human staring at a browser tab.
+ *
+ * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
+ * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
+ * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
+ *
+ * Every string the host can supply ({@link AccessDeniedPageOptions}) is HTML-escaped on the way in.
+ * They are developer-controlled config values, not user input — but escaping them costs nothing and
+ * removes the one class of bug a "just interpolate it" template would invite.
+ *
+ * The visual language (Aviary neutrals, the console's own accent, mono eyebrow over a sans body)
+ * mirrors the payments SPA so the refusal reads as part of the same product, not a server default.
+ *
+ * Ported to `@adonis-agora/durable`, `@adonis-agora/media`, `@adonis-agora/agent` and
+ * `@adonis-agora/telescope` with only {@link CONSOLE} changed, so the Agora consoles share ONE
+ * refusal story rather than each inventing its own.
+ */
+/** This console's identity — the ONLY thing that differs between the Agora ports of this file. */
+export const CONSOLE = {
+    brand: 'Payments',
+    accent: '#22d3ee',
+    packageName: '@adonis-agora/payments',
+};
+const DEFAULT_COPY = {
+    unauthenticated: {
+        title: 'Sign in required',
+        message: 'You need to be signed in to open this console.',
+    },
+    forbidden: {
+        title: 'Access denied',
+        message: 'Your account is not allowed to open this console. If that looks wrong, ask an administrator to grant you access.',
+    },
+    'session-required': {
+        title: 'Open this console from your app',
+        message: 'This console only accepts a session minted by your application. Go back to the app and open the console from there.',
+    },
+};
+/** Escape the five characters that matter inside HTML text and double-quoted attributes. */
+export function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+/**
+ * Accept only a same-origin, root-relative path for a button `href` — the same open-redirect rule
+ * `sanitizeReturnTo` applies to `returnTo`. A host-supplied absolute URL is still a developer's
+ * choice, so it is allowed; what is refused is anything that could smuggle a `javascript:` scheme.
+ */
+function safeHref(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed === '')
+        return null;
+    if (/^(https?:)?\/\//i.test(trimmed))
+        return trimmed;
+    if (trimmed.startsWith('/'))
+        return trimmed;
+    return null;
+}
+/** Only a plausible CSS colour token reaches the stylesheet; anything else falls back to the accent. */
+function safeColor(candidate) {
+    return /^[#a-zA-Z0-9(),.%\s-]+$/.test(candidate) ? candidate : CONSOLE.accent;
+}
+const LOCK_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>';
+const KEY_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="7.5" cy="15.5" r="4.5"/><path d="m21 2-9.6 9.6"/><path d="m15.5 7.5 3 3L22 7l-3-3"/></svg>';
+/**
+ * Render the built-in page. Pure: same `info` + `options` in, same HTML out — so it is trivially
+ * snapshot/regex testable and safe to call from anywhere (the provider, a test, a host that wants
+ * to embed the default page inside its own layout).
+ */
+export function renderAccessDeniedPage(info, options = {}) {
+    const copy = DEFAULT_COPY[info.reason];
+    const brand = escapeHtml(options.brand ?? CONSOLE.brand);
+    const title = escapeHtml(options.title ?? copy.title);
+    const message = escapeHtml(options.message ?? copy.message);
+    const accent = safeColor(options.accent ?? CONSOLE.accent);
+    const nonceAttr = info.nonce !== undefined ? ` nonce="${escapeHtml(info.nonce)}"` : '';
+    const loginHref = options.loginHref === false
+        ? null
+        : (safeHref(options.loginHref ?? info.loginHref ?? '') ?? null);
+    const homeHref = options.homeHref === false ? null : safeHref(options.homeHref ?? '/');
+    const buttons = [];
+    if (loginHref !== null && info.reason !== 'forbidden') {
+        buttons.push(`<a class="btn primary" href="${escapeHtml(loginHref)}">${KEY_ICON}${escapeHtml(options.loginLabel ?? 'Sign in')}</a>`);
+    }
+    if (homeHref !== null) {
+        buttons.push(`<a class="btn${buttons.length === 0 ? ' primary' : ''}" href="${escapeHtml(homeHref)}">${escapeHtml(options.homeLabel ?? 'Back to app')}</a>`);
+    }
+    if (loginHref !== null && info.reason === 'forbidden') {
+        // A forbidden user might simply be the wrong user: offer a way to switch accounts, second.
+        buttons.push(`<a class="btn" href="${escapeHtml(loginHref)}">${escapeHtml(options.loginLabel ?? 'Sign in as someone else')}</a>`);
+    }
+    const detail = info.detail !== undefined && info.detail !== ''
+        ? `\n    <p class="detail">${escapeHtml(info.detail)}</p>`
+        : '';
+    const actions = buttons.length > 0 ? `\n    <div class="actions">${buttons.join('')}</div>` : '';
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>${title} — ${brand}</title>
+<style${nonceAttr}>
+  :root {
+    color-scheme: dark;
+    --bg: #09090b;
+    --panel: #0c0c0f;
+    --panel-2: #101017;
+    --line: #1c1c22;
+    --text: #e7e7ea;
+    --muted: #76767f;
+    --bad: #f87171;
+    --accent: ${accent};
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 24px;
+    background:
+      radial-gradient(900px 480px at 50% -10%, color-mix(in srgb, var(--accent) 9%, transparent), transparent 70%),
+      var(--bg);
+    color: var(--text);
+    font: 15px/1.6 "Space Grotesk", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  .card {
+    position: relative;
+    overflow: hidden;
+    width: 100%;
+    max-width: 440px;
+    padding: 36px 32px 28px;
+    background: var(--panel);
+    border: 1px solid var(--line);
+    border-radius: 12px;
+    box-shadow: 0 30px 60px -24px rgb(0 0 0 / 0.7);
+  }
+  .card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 2px;
+    background: linear-gradient(90deg, var(--accent), transparent 80%);
+  }
+  .eyebrow {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: 0 0 22px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--muted);
+  }
+  .eyebrow .brand { color: var(--accent); }
+  .eyebrow .status {
+    margin-left: auto;
+    padding: 4px 7px;
+    border: 1px solid var(--line);
+    border-radius: 4px;
+    color: var(--bad);
+    letter-spacing: 0.08em;
+  }
+  .icon {
+    display: grid;
+    place-items: center;
+    width: 40px;
+    height: 40px;
+    margin-bottom: 18px;
+    border-radius: 10px;
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+    color: var(--accent);
+  }
+  h1 {
+    margin: 0 0 8px;
+    font-size: 22px;
+    font-weight: 600;
+    letter-spacing: -0.01em;
+  }
+  p { margin: 0; color: var(--muted); }
+  .detail {
+    margin-top: 14px;
+    padding: 10px 12px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    font: 12px/1.5 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: var(--text);
+    overflow-wrap: anywhere;
+  }
+  .actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin-top: 26px;
+  }
+  .btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 9px 14px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    color: var(--text);
+    font-size: 13px;
+    font-weight: 500;
+    text-decoration: none;
+  }
+  .btn:hover { border-color: color-mix(in srgb, var(--accent) 50%, var(--line)); }
+  .btn.primary {
+    background: color-mix(in srgb, var(--accent) 14%, transparent);
+    border-color: color-mix(in srgb, var(--accent) 45%, transparent);
+    color: var(--accent);
+  }
+  .btn.primary:hover { background: color-mix(in srgb, var(--accent) 22%, transparent); }
+  .foot {
+    margin-top: 26px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.04em;
+    color: var(--muted);
+    opacity: 0.7;
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <p class="eyebrow"><span class="brand">${brand}</span><span>console</span><span class="status">${info.status}</span></p>
+    <div class="icon" aria-hidden="true">${info.reason === 'forbidden' ? LOCK_ICON : KEY_ICON}</div>
+    <h1>${title}</h1>
+    <p>${message}</p>${detail}${actions}
+    <p class="foot">${escapeHtml(CONSOLE.packageName)}</p>
+  </main>
+</body>
+</html>`;
+}
+/**
+ * Resolve WHAT to serve for a refusal, honouring the host's `accessDenied` option in either form.
+ * Returns the HTML to send, or `null` when a custom renderer already answered the request itself
+ * (`answered()` reports whether it did — the provider wires that to "a `location` header or a body
+ * is already set"). Framework-light: knows nothing about the HTTP context beyond passing it through.
+ */
+export async function resolveAccessDeniedPage(info, option, ctx, answered) {
+    if (typeof option === 'function') {
+        const rendered = await option(info, ctx);
+        if (typeof rendered === 'string')
+            return rendered;
+        if (answered())
+            return null;
+        return renderAccessDeniedPage(info);
+    }
+    return renderAccessDeniedPage(info, option ?? {});
+}
+//# sourceMappingURL=access_denied_page.js.map

package/dist/src/dashboard/access_denied_page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/dashboard/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAoEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,wBAAwB;CAC7B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,iCAAiC;QACxC,OAAO,EACL,qHAAqH;KACxH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/dashboard/define_config.d.ts

@@ -1,5 +1,16 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
 import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
+/**
+ * The function form of {@link PaymentsDashboardConfig.accessDenied}: render (or answer) a refused
+ * page navigation yourself. Receives the refusal ({@link AccessDeniedInfo}) and the AdonisJS
+ * {@link HttpContext}. Return an HTML string to have it served; answer the request yourself (a
+ * redirect, most commonly) and return nothing to make the provider stand down; return nothing
+ * WITHOUT answering and the built-in page is served.
+ */
+export type AccessDeniedRenderer = GenericAccessDeniedRenderer<HttpContext>;
+/** `accessDenied` in either form — an options object for the built-in page, or a renderer. */
+export type AccessDeniedOption = GenericAccessDeniedOption<HttpContext>;
 /**
  * Authorization guard for the dashboard. Runs before every dashboard route
  * (API + HTML). Return `true` to allow the request, `false` to deny it (the
@@ -53,6 +64,19 @@ export interface PaymentsDashboardConfig {
      * session guard. Missing `secret`/`login` fails closed at boot.
      */
     dashboardAuth?: DashboardAuthOptions;
+    /**
+     * What a BROWSER sees when the guard refuses a page navigation (the SPA shell, its assets, or —
+     * Mode A only — a session-less visit). API requests are unaffected: they keep getting the JSON
+     * the SPA relies on (`403 { error: 'forbidden' }` / `401 { error: 'unauthorized', auth }`).
+     *
+     * Omit it for the built-in page — a dark card in the console's own visual language, with the
+     * status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth.login`
+     * exists, a "Sign in" button. Pass an object to tweak that page (`brand`, `title`, `message`,
+     * `homeHref`, `loginHref`, `accent`, …), or a function to render/answer it yourself — see
+     * {@link AccessDeniedRenderer}. Either way, an `authorize` hook that already wrote a redirect
+     * still wins: the provider never overwrites a `location` header.
+     */
+    accessDenied?: AccessDeniedOption;
 }
 /** A fully-resolved config — every field present (defaults applied). */
 export interface ResolvedPaymentsDashboardConfig {
@@ -62,6 +86,8 @@ export interface ResolvedPaymentsDashboardConfig {
     authorize: AuthorizeHook;
     /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
     dashboardAuth: ResolvedDashboardAuth | null;
+    /** The host's `accessDenied` option as given, or `null` for the built-in page with defaults. */
+    accessDenied: AccessDeniedOption | null;
 }
 /**
  * The default guard: open outside production; in production it requires a

package/dist/src/dashboard/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED,wEAAwE;AACxE,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC7C;AAyCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAQ1D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,MAAM,GAAE,uBAA4B,GACnC,+BAA+B,CAajC;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,GAAE,uBAA4B,GAAG,uBAAuB,CAE1F"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC;AAyCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAQ1D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAC3B,MAAM,GAAE,uBAA4B,GACnC,+BAA+B,CAcjC;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,GAAE,uBAA4B,GAAG,uBAAuB,CAE1F"}

package/dist/src/dashboard/define_config.js

@@ -74,6 +74,7 @@ export function resolveConfig(config = {}) {
         // Validate + resolve now so a misconfigured secret/login fails closed at boot,
         // not on the first login attempt. `null` when `dashboardAuth` is omitted.
         dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
+        accessDenied: config.accessDenied ?? null,
     };
 }
 /** Identity helper giving `config/payments_dashboard.ts` full type-checking. */

package/dist/src/dashboard/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAoEnB;;;GAGG;AACH,SAAS,YAAY;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,MAAM,GAA4B,EAAE;IAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IAC3C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;QAC/C,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,MAAM,GAA4B,EAAE;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/dashboard/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AA+FnB;;;GAGG;AACH,SAAS,YAAY;IACnB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,gFAAgF;IAChF,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAC3B,MAAM,GAA4B,EAAE;IAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IAC3C,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;QAC/C,+EAA+E;QAC/E,0EAA0E;QAC1E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,MAAM,GAA4B,EAAE;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/dashboard/index.d.ts

@@ -1,10 +1,12 @@
 /** Keep in sync with this package's `version` in package.json. */
 export declare const VERSION = "0.2.0";
+export type { AccessDeniedInfo, AccessDeniedPageOptions, AccessDeniedReason, } from './access_denied_page.js';
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 export type { RefundAction, RefundCapableDriver, RefundOutcome, ReplayAction, ReplayableWebhookEvent, ReplayOutcome, } from './actions.js';
 export { createRefundAction, createReplayAction } from './actions.js';
 export type { AuthMode, DashboardAuthOptions, LoginHook, LoginOutcome, ResolvedDashboardAuth, SessionHook, SessionOutcome, } from './auth.js';
 export { performLogin, performSession, readSession, resolveDashboardAuth, SESSION_COOKIE_NAME, sanitizeReturnTo, } from './auth.js';
-export type { AuthorizeHook, PaymentsDashboardConfig, ResolvedPaymentsDashboardConfig, } from './define_config.js';
+export type { AccessDeniedOption, AccessDeniedRenderer, AuthorizeHook, PaymentsDashboardConfig, ResolvedPaymentsDashboardConfig, } from './define_config.js';
 export { defaultAuthorize, defineConfig, resolveConfig } from './define_config.js';
 export type { ApiRequest, ApiResponse, DashboardActions, Deps } from './handlers.js';
 export { AUDIT_ACTION_FILTERS, auditEvents, customers, DISPUTE_DEFAULT_DUE_WITHIN_HOURS, DISPUTE_RESOLUTION_STATUSES, DISPUTE_STATUSES, disputes, health, ok, overview, PAYMENT_STATUSES, PROVIDER_SCAN_CAP, paymentDetail, payments, providers, refundPayment, resolveDispute, retryWebhookEvent, SUBSCRIPTION_DEFAULT_STATUS, SUBSCRIPTION_STATUSES, subscriptions, WEBHOOK_EVENT_STATUSES, webhookEvents, } from './handlers.js';

package/dist/src/dashboard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EACV,QAAQ,EACR,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,EAAE,EACF,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EACV,QAAQ,EACR,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,EAAE,EACF,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/src/dashboard/index.js

@@ -1,5 +1,7 @@
 /** Keep in sync with this package's `version` in package.json. */
 export const VERSION = '0.2.0';
+// The built-in "access denied" page (what a browser sees on a refused page navigation).
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 // The two WRITE actions (refund + webhook retry), as framework-light ports.
 export { createRefundAction, createReplayAction } from './actions.js';
 // Built-in `dashboardAuth` login screen (optional; opt-in via `config/payments_dashboard.ts`).

package/dist/src/dashboard/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAU/B,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAUtE,+FAA+F;AAC/F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAMnB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,EAAE,EACF,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5E,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAO/B,wFAAwF;AACxF,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AASjC,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAUtE,+FAA+F;AAC/F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAQnB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,EAAE,EACF,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5E,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC"}

package/dist/src/dashboard/login_page.d.ts

@@ -3,21 +3,34 @@
  * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
  * dashboard shell doesn't require rebuilding or extending the bundled SPA.
  *
- * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
- * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
- * controlled config value, not user input — and the page body is otherwise a static template.
- * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
- * to get wrong.
+ * It works WITHOUT JavaScript: the markup is a classic `<form method="post">` carrying `returnTo`
+ * in a hidden field, and the provider answers a form-encoded `POST` with a redirect (to `returnTo`
+ * on success, back here with `?error` on failure). The inline `<script>` is progressive
+ * enhancement only — it swaps the full-page round trip for a JSON `fetch` and shows the error in
+ * place — and it carries the request's CSP nonce when the provider hands one over, so a host
+ * running `@adonisjs/shield`'s `script-src 'self' @nonce` keeps the enhancement instead of a
+ * dead form. The `<style>` takes the same nonce.
+ *
+ * The only per-request values interpolated are `returnTo` (already passed through
+ * {@link sanitizeReturnTo}, so it is a root-relative path) and the `error` flag; both go through
+ * {@link escapeHtml} (and `JSON.stringify` inside the script) so nothing in the query string can
+ * break out of an attribute or the script. `basePath` is developer-controlled config.
  *
  * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
- * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
- * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
- * markup keeps its own `<script>`.
+ * they feel like one family.
  *
  * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
  * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
  * email-only host (gate on username, ignore password) works with the same page as a host with real
  * passwords.
  */
-export declare function renderLoginPage(basePath: string): string;
+export interface LoginPageOptions {
+    /** The request's CSP nonce, applied to the inline `<style>` and `<script>`. */
+    nonce?: string;
+    /** Render the "Invalid username or password." notice (the no-JS failure round trip). */
+    error?: boolean;
+    /** Where to send the operator after a successful sign-in. Sanitized here; default `basePath`. */
+    returnTo?: unknown;
+}
+export declare function renderLoginPage(basePath: string, options?: LoginPageOptions): string;
 //# sourceMappingURL=login_page.d.ts.map

package/dist/src/dashboard/login_page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmJxD"}
+{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkBD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA2IxF"}

package/dist/src/dashboard/login_page.js

@@ -1,27 +1,26 @@
+import { escapeHtml } from './access_denied_page.js';
+import { sanitizeReturnTo } from './auth.js';
 /**
- * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
- * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
- * dashboard shell doesn't require rebuilding or extending the bundled SPA.
- *
- * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
- * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
- * controlled config value, not user input — and the page body is otherwise a static template.
- * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
- * to get wrong.
- *
- * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
- * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
- * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
- * markup keeps its own `<script>`.
- *
- * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
- * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
- * email-only host (gate on username, ignore password) works with the same page as a host with real
- * passwords.
+ * JSON for embedding INSIDE an inline `<script>`: `JSON.stringify` alone leaves `</script>` (and
+ * `<!--`) untouched, and the HTML parser ends the script element on the first `</script>` it sees
+ * regardless of JavaScript string boundaries — so a `returnTo` of `/x</script><script>…` would run.
+ * Escaping the angle brackets (and `&`, plus the two line terminators JSON allows but JS doesn't)
+ * as `\uXXXX` keeps the value byte-identical once parsed and inert to the HTML parser.
  */
-export function renderLoginPage(basePath) {
+function jsonForScript(value) {
+    return JSON.stringify(value)
+        .replaceAll('<', '\\u003c')
+        .replaceAll('>', '\\u003e')
+        .replaceAll('&', '\\u0026')
+        .replaceAll('\u2028', '\\u2028')
+        .replaceAll('\u2029', '\\u2029');
+}
+export function renderLoginPage(basePath, options = {}) {
     const loginAction = `${basePath}/login`;
     const defaultReturnTo = basePath === '' ? '/' : basePath;
+    const returnTo = sanitizeReturnTo(options.returnTo, defaultReturnTo);
+    const nonceAttr = options.nonce !== undefined ? ` nonce="${escapeHtml(options.nonce)}"` : '';
+    const errorStyle = options.error ? ' style="display:block"' : '';
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -29,7 +28,7 @@ export function renderLoginPage(basePath) {
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <meta name="robots" content="noindex, nofollow" />
 <title>Sign in — Payments</title>
-<style>
+<style${nonceAttr}>
   :root { color-scheme: dark; }
   * { box-sizing: border-box; }
   body {
@@ -104,7 +103,8 @@ export function renderLoginPage(basePath) {
 <body>
   <div class="card">
     <p class="brand">Payments</p>
-    <form id="login-form" autocomplete="on">
+    <form id="login-form" method="post" action="${escapeHtml(loginAction)}" autocomplete="on">
+      <input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}" />
       <label>
         <span class="field-label">Username</span>
         <input id="username" name="username" type="text" autocomplete="username" required autofocus />
@@ -113,41 +113,29 @@ export function renderLoginPage(basePath) {
         <span class="field-label">Password</span>
         <input id="password" name="password" type="password" autocomplete="current-password" />
       </label>
-      <p id="error" role="alert">Invalid username or password.</p>
+      <p id="error" role="alert"${errorStyle}>Invalid username or password.</p>
       <button id="submit" type="submit">Sign in</button>
     </form>
   </div>
-<script>
+<script${nonceAttr}>
 (function () {
-  var LOGIN_ACTION = ${JSON.stringify(loginAction)};
-  var DEFAULT_RETURN_TO = ${JSON.stringify(defaultReturnTo)};
-  var params = new URLSearchParams(window.location.search);
+  var LOGIN_ACTION = ${jsonForScript(loginAction)};
+  var RETURN_TO = ${jsonForScript(returnTo)};
   var errorBox = document.getElementById('error');
-  if (params.get('error')) errorBox.style.display = 'block';
-
-  function sameOriginReturnTo(value) {
-    if (typeof value !== 'string' || value === '') return DEFAULT_RETURN_TO;
-    if (value.charAt(0) !== '/' || value.charAt(1) === '/' || value.indexOf('://') !== -1) {
-      return DEFAULT_RETURN_TO;
-    }
-    return value;
-  }
-
   var form = document.getElementById('login-form');
   var submitButton = document.getElementById('submit');
   form.addEventListener('submit', function (event) {
     event.preventDefault();
     submitButton.disabled = true;
     errorBox.style.display = 'none';
-    var returnTo = sameOriginReturnTo(params.get('returnTo'));
     fetch(LOGIN_ACTION, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
       credentials: 'same-origin',
       body: JSON.stringify({
         username: document.getElementById('username').value,
         password: document.getElementById('password').value,
-        returnTo: returnTo,
+        returnTo: RETURN_TO,
       }),
     })
       .then(function (response) {
@@ -155,7 +143,7 @@ export function renderLoginPage(basePath) {
         return response.json();
       })
       .then(function (data) {
-        window.location.href = data.redirectTo || DEFAULT_RETURN_TO;
+        window.location.href = data.redirectTo || RETURN_TO;
       })
       .catch(function () {
         errorBox.style.display = 'block';

package/dist/src/dashboard/login_page.js.map

@@ -1 +1 @@
-{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAiGc,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6CnD,CAAC;AACT,CAAC"}
+{"version":3,"file":"login_page.js","sourceRoot":"","sources":["../../../src/dashboard/login_page.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAqC7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;SAC/B,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAO,GAAqB,EAAE;IAC9E,MAAM,WAAW,GAAG,GAAG,QAAQ,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO;;;;;;;QAOD,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2EiC,UAAU,CAAC,WAAW,CAAC;oDACrB,UAAU,CAAC,QAAQ,CAAC;;;;;;;;;kCAStC,UAAU;;;;SAInC,SAAS;;uBAEK,aAAa,CAAC,WAAW,CAAC;oBAC7B,aAAa,CAAC,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCnC,CAAC;AACT,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/payments",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Billing library for AdonisJS — 18 payment gateways behind one driver contract, with a Cashier-style subscription billing layer: Billable mixin, Lucid stores, idempotent webhook processing and an optional Durable-backed dispatcher. Part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {