@adonis-agora/telescope 0.10.0 → 0.12.0

package/dist/src/ui/access_denied_page.js

@@ -0,0 +1,266 @@
+/**
+ * The built-in "access denied" page a BROWSER sees when the dashboard guard refuses a page
+ * navigation — the SPA shell, its assets, or (Mode A only) a session-less visit. Before this page
+ * existed the guard answered every denial with the JSON it answers the API with
+ * (`{ "error": "forbidden" }`), which is the right thing for the SPA's `fetch` calls and the wrong
+ * thing for a human staring at a browser tab.
+ *
+ * Deliberately a small, dependency-free, hand-authored HTML page (like `login_page.ts`) — NOT part
+ * of the bundled SPA, so a denial never needs the SPA to load first. It carries NO `<script>` at all,
+ * so a host running a nonce'd `script-src` CSP (the `@adonisjs/shield` default) cannot break it; the
+ * one inline `<style>` takes the request's CSP nonce when the provider hands one over.
+ *
+ * Every string the host can supply ({@link AccessDeniedPageOptions}) is HTML-escaped on the way in.
+ * They are developer-controlled config values, not user input — but escaping them costs nothing and
+ * removes the one class of bug a "just interpolate it" template would invite.
+ *
+ * The visual language (Aviary neutrals, the console's own accent, mono eyebrow over a sans body)
+ * mirrors the telescope SPA so the refusal reads as part of the same product, not a server default.
+ *
+ * Ported from `@adonis-agora/payments` (also in `@adonis-agora/durable`, `@adonis-agora/media`, `@adonis-agora/agent` and
+ * `@adonis-agora/telescope` with only {@link CONSOLE} changed, so the Agora consoles share ONE
+ * refusal story rather than each inventing its own.
+ */
+/** This console's identity — the ONLY thing that differs between the Agora ports of this file. */
+export const CONSOLE = {
+    brand: 'Telescope',
+    accent: '#e879f9',
+    packageName: '@adonis-agora/telescope',
+};
+const DEFAULT_COPY = {
+    unauthenticated: {
+        title: 'Sign in required',
+        message: 'You need to be signed in to open this console.',
+    },
+    forbidden: {
+        title: 'Access denied',
+        message: 'Your account is not allowed to open this console. If that looks wrong, ask an administrator to grant you access.',
+    },
+    'session-required': {
+        title: 'Open this console from your app',
+        message: 'This console only accepts a session minted by your application. Go back to the app and open the console from there.',
+    },
+};
+/** Escape the five characters that matter inside HTML text and double-quoted attributes. */
+export function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+/**
+ * Accept only a same-origin, root-relative path for a button `href` — the same open-redirect rule
+ * `sanitizeReturnTo` applies to `returnTo`. A host-supplied absolute URL is still a developer's
+ * choice, so it is allowed; what is refused is anything that could smuggle a `javascript:` scheme.
+ */
+function safeHref(candidate) {
+    const trimmed = candidate.trim();
+    if (trimmed === '')
+        return null;
+    if (/^(https?:)?\/\//i.test(trimmed))
+        return trimmed;
+    if (trimmed.startsWith('/'))
+        return trimmed;
+    return null;
+}
+/** Only a plausible CSS colour token reaches the stylesheet; anything else falls back to the accent. */
+function safeColor(candidate) {
+    return /^[#a-zA-Z0-9(),.%\s-]+$/.test(candidate) ? candidate : CONSOLE.accent;
+}
+const LOCK_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>';
+const KEY_ICON = '<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="7.5" cy="15.5" r="4.5"/><path d="m21 2-9.6 9.6"/><path d="m15.5 7.5 3 3L22 7l-3-3"/></svg>';
+/**
+ * Render the built-in page. Pure: same `info` + `options` in, same HTML out — so it is trivially
+ * snapshot/regex testable and safe to call from anywhere (the provider, a test, a host that wants
+ * to embed the default page inside its own layout).
+ */
+export function renderAccessDeniedPage(info, options = {}) {
+    const copy = DEFAULT_COPY[info.reason];
+    const brand = escapeHtml(options.brand ?? CONSOLE.brand);
+    const title = escapeHtml(options.title ?? copy.title);
+    const message = escapeHtml(options.message ?? copy.message);
+    const accent = safeColor(options.accent ?? CONSOLE.accent);
+    const nonceAttr = info.nonce !== undefined ? ` nonce="${escapeHtml(info.nonce)}"` : '';
+    const loginHref = options.loginHref === false
+        ? null
+        : (safeHref(options.loginHref ?? info.loginHref ?? '') ?? null);
+    const homeHref = options.homeHref === false ? null : safeHref(options.homeHref ?? '/');
+    const buttons = [];
+    if (loginHref !== null && info.reason !== 'forbidden') {
+        buttons.push(`<a class="btn primary" href="${escapeHtml(loginHref)}">${KEY_ICON}${escapeHtml(options.loginLabel ?? 'Sign in')}</a>`);
+    }
+    if (homeHref !== null) {
+        buttons.push(`<a class="btn${buttons.length === 0 ? ' primary' : ''}" href="${escapeHtml(homeHref)}">${escapeHtml(options.homeLabel ?? 'Back to app')}</a>`);
+    }
+    if (loginHref !== null && info.reason === 'forbidden') {
+        // A forbidden user might simply be the wrong user: offer a way to switch accounts, second.
+        buttons.push(`<a class="btn" href="${escapeHtml(loginHref)}">${escapeHtml(options.loginLabel ?? 'Sign in as someone else')}</a>`);
+    }
+    const detail = info.detail !== undefined && info.detail !== ''
+        ? `\n    <p class="detail">${escapeHtml(info.detail)}</p>`
+        : '';
+    const actions = buttons.length > 0 ? `\n    <div class="actions">${buttons.join('')}</div>` : '';
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>${title} — ${brand}</title>
+<style${nonceAttr}>
+  :root {
+    color-scheme: dark;
+    --bg: #09090b;
+    --panel: #0c0c0f;
+    --panel-2: #101017;
+    --line: #1c1c22;
+    --text: #e7e7ea;
+    --muted: #76767f;
+    --bad: #f87171;
+    --accent: ${accent};
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 24px;
+    background:
+      radial-gradient(900px 480px at 50% -10%, color-mix(in srgb, var(--accent) 9%, transparent), transparent 70%),
+      var(--bg);
+    color: var(--text);
+    font: 15px/1.6 "Space Grotesk", ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  .card {
+    position: relative;
+    overflow: hidden;
+    width: 100%;
+    max-width: 440px;
+    padding: 36px 32px 28px;
+    background: var(--panel);
+    border: 1px solid var(--line);
+    border-radius: 12px;
+    box-shadow: 0 30px 60px -24px rgb(0 0 0 / 0.7);
+  }
+  .card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 2px;
+    background: linear-gradient(90deg, var(--accent), transparent 80%);
+  }
+  .eyebrow {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: 0 0 22px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--muted);
+  }
+  .eyebrow .brand { color: var(--accent); }
+  .eyebrow .status {
+    margin-left: auto;
+    padding: 4px 7px;
+    border: 1px solid var(--line);
+    border-radius: 4px;
+    color: var(--bad);
+    letter-spacing: 0.08em;
+  }
+  .icon {
+    display: grid;
+    place-items: center;
+    width: 40px;
+    height: 40px;
+    margin-bottom: 18px;
+    border-radius: 10px;
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+    color: var(--accent);
+  }
+  h1 {
+    margin: 0 0 8px;
+    font-size: 22px;
+    font-weight: 600;
+    letter-spacing: -0.01em;
+  }
+  p { margin: 0; color: var(--muted); }
+  .detail {
+    margin-top: 14px;
+    padding: 10px 12px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    font: 12px/1.5 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: var(--text);
+    overflow-wrap: anywhere;
+  }
+  .actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin-top: 26px;
+  }
+  .btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 9px 14px;
+    border: 1px solid var(--line);
+    border-radius: 6px;
+    background: var(--panel-2);
+    color: var(--text);
+    font-size: 13px;
+    font-weight: 500;
+    text-decoration: none;
+  }
+  .btn:hover { border-color: color-mix(in srgb, var(--accent) 50%, var(--line)); }
+  .btn.primary {
+    background: color-mix(in srgb, var(--accent) 14%, transparent);
+    border-color: color-mix(in srgb, var(--accent) 45%, transparent);
+    color: var(--accent);
+  }
+  .btn.primary:hover { background: color-mix(in srgb, var(--accent) 22%, transparent); }
+  .foot {
+    margin-top: 26px;
+    font: 11px/1 "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+    letter-spacing: 0.04em;
+    color: var(--muted);
+    opacity: 0.7;
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <p class="eyebrow"><span class="brand">${brand}</span><span>console</span><span class="status">${info.status}</span></p>
+    <div class="icon" aria-hidden="true">${info.reason === 'forbidden' ? LOCK_ICON : KEY_ICON}</div>
+    <h1>${title}</h1>
+    <p>${message}</p>${detail}${actions}
+    <p class="foot">${escapeHtml(CONSOLE.packageName)}</p>
+  </main>
+</body>
+</html>`;
+}
+/**
+ * Resolve WHAT to serve for a refusal, honouring the host's `accessDenied` option in either form.
+ * Returns the HTML to send, or `null` when a custom renderer already answered the request itself
+ * (`answered()` reports whether it did — the provider wires that to "a `location` header or a body
+ * is already set"). Framework-light: knows nothing about the HTTP context beyond passing it through.
+ */
+export async function resolveAccessDeniedPage(info, option, ctx, answered) {
+    if (typeof option === 'function') {
+        const rendered = await option(info, ctx);
+        if (typeof rendered === 'string')
+            return rendered;
+        if (answered())
+            return null;
+        return renderAccessDeniedPage(info);
+    }
+    return renderAccessDeniedPage(info, option ?? {});
+}
+//# sourceMappingURL=access_denied_page.js.map

package/dist/src/ui/access_denied_page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access_denied_page.js","sourceRoot":"","sources":["../../../src/ui/access_denied_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAoEH,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,yBAAyB;CAC9B,CAAC;AAEX,MAAM,YAAY,GAAmE;IACnF,eAAe,EAAE;QACf,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,gDAAgD;KAC1D;IACD,SAAS,EAAE;QACT,KAAK,EAAE,eAAe;QACtB,OAAO,EACL,kHAAkH;KACrH;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,iCAAiC;QACxC,OAAO,EACL,qHAAqH;KACxH;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,MAAM,SAAS,GACb,gPAAgP,CAAC;AACnP,MAAM,QAAQ,GACZ,0PAA0P,CAAC;AAE7P;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAO,GAA4B,EAAE;IAErC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvF,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,KAAK;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAC/I,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtD,2FAA2F;QAC3F,OAAO,CAAC,IAAI,CACV,wBAAwB,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,MAAM,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAC7C,CAAC,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjG,OAAO;;;;;;SAMA,KAAK,MAAM,KAAK;QACjB,SAAS;;;;;;;;;;gBAUD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAsHuB,KAAK,mDAAmD,IAAI,CAAC,MAAM;2CACrE,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;UACnF,KAAK;SACN,OAAO,OAAO,MAAM,GAAG,OAAO;sBACjB,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;;;QAG7C,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAsB,EACtB,MAAkD,EAClD,GAAQ,EACR,QAAuB;IAEvB,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,QAAQ,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/ui/define_config.d.ts

@@ -1,5 +1,17 @@
+import type { AccessDeniedOption as GenericAccessDeniedOption, AccessDeniedRenderer as GenericAccessDeniedRenderer } from './access_denied_page.js';
 import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
 import type { UiHttpContext } from './http.js';
+/**
+ * The function form of {@link TelescopeUiConfig.accessDenied}: render (or answer) a refused page
+ * navigation yourself. Receives the refusal ({@link AccessDeniedInfo}) and the (framework-light)
+ * HTTP context — the real AdonisJS `HttpContext` at runtime, cast down like the `authorize` hook's.
+ * Return an HTML string to have it served; answer the request yourself (a redirect, most commonly)
+ * and return nothing to make the guard stand down; return nothing WITHOUT answering and the
+ * built-in page is served.
+ */
+export type AccessDeniedRenderer = GenericAccessDeniedRenderer<UiHttpContext>;
+/** `accessDenied` in either form — an options object for the built-in page, or a renderer. */
+export type AccessDeniedOption = GenericAccessDeniedOption<UiHttpContext>;
 /**
  * The decision hook gating the dashboard + JSON API. Return `true` to allow the
  * request through, `false` to reject it (the guard answers 401/403). It receives
@@ -65,6 +77,19 @@ export interface TelescopeUiConfig {
      * guard). Missing `secret`/`login` fails closed at boot.
      */
     dashboardAuth?: DashboardAuthOptions;
+    /**
+     * What a BROWSER sees when the guard refuses a page navigation — the `@adonis-agora/telescope-ui`
+     * SPA shell or its assets. API requests are unaffected: they keep getting the JSON the SPA relies
+     * on (`401`/`403 { error }`).
+     *
+     * Omit it for the built-in page — a dark card in the console's own visual language, with the
+     * status, a sentence explaining the refusal, a "Back to app" link and, when `dashboardAuth` is
+     * configured, a "Sign in" button. Pass an object to tweak that page (`brand`, `title`, `message`,
+     * `homeHref`, `loginHref`, `accent`, …), or a function to render/answer it yourself — see
+     * {@link AccessDeniedRenderer}. Either way, an `authorize` hook that already wrote a redirect
+     * still wins: the guard never overwrites a `location` header.
+     */
+    accessDenied?: AccessDeniedOption;
     /**
      * Request REPLAY: re-issue a captured `request` entry against the LOCAL server
      * from the dashboard. DISABLED BY DEFAULT — replaying re-runs a real request
@@ -114,6 +139,8 @@ export interface ResolvedTelescopeUiConfig {
     credentials: UiCredentials;
     /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
     dashboardAuth: ResolvedDashboardAuth | null;
+    /** The host's `accessDenied` option as given, or `null` for the built-in page with defaults. */
+    accessDenied: AccessDeniedOption | null;
     /** Resolved request-replay settings (disabled by default). */
     replay: {
         enabled: boolean;

package/dist/src/ui/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAGrC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAGxC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,qEAAqE;IACrE,YAAY,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IACtC,kEAAkE;IAClE,YAAY,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAS1E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CAyBvF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAErC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAGlC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAGxC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,qEAAqE;IACrE,YAAY,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IACtC,kEAAkE;IAClE,YAAY,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAS1E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CA0BvF"}

package/dist/src/ui/define_config.js

@@ -103,6 +103,7 @@ export function resolveConfig(config = {}) {
         // Validate + resolve now so a misconfigured secret/login fails closed at boot, not on the first
         // login attempt. `null` when `dashboardAuth` is omitted (behavior unchanged).
         dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
+        accessDenied: config.accessDenied ?? null,
         replay: {
             // Safe default: replay is OFF unless the host explicitly enables it.
             enabled: config.replay?.enabled ?? false,

package/dist/src/ui/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAiInB;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAsB,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,gGAAgG;QAChG,8EAA8E;QAC9E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;QACD,YAAY,EAAE;YACZ,qEAAqE;YACrE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,IAAI,KAAK;SACrD;QACD,YAAY,EAAE;YACZ,iFAAiF;YACjF,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,KAAK;SAC/C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AA8JnB;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAsB,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,gGAAgG;QAChG,8EAA8E;QAC9E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;QACD,YAAY,EAAE;YACZ,qEAAqE;YACrE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,IAAI,KAAK;SACrD;QACD,YAAY,EAAE;YACZ,iFAAiF;YACjF,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,KAAK;SAC/C;KACF,CAAC;AACJ,CAAC"}

package/dist/src/ui/guard.d.ts

@@ -1,3 +1,4 @@
+import { type AccessDeniedOption } from './access_denied_page.js';
 import type { AuthorizeHook } from './define_config.js';
 import type { UiHttpContext } from './http.js';
 /** The outcome of an authorization check. */
@@ -37,4 +38,32 @@ export declare function runGuard(ctx: UiHttpContext, authorize: AuthorizeHook):
  * separate hook.
  */
 export declare function enforceGuard(ctx: UiHttpContext, authorize: AuthorizeHook): Promise<boolean>;
+/** What {@link enforcePageGuard} needs to serve (or delegate) the access-denied page. */
+export interface PageGuardOptions {
+    /** The console's mount (`/telescope`) — reported to a custom renderer as `basePath`. */
+    basePath: string;
+    /** The built-in login page (`<path>/login`), present only when `dashboardAuth` is configured. */
+    loginHref?: string;
+    /** The host's `telescope_ui.accessDenied` option — tweak the built-in page, or render it. */
+    accessDenied?: AccessDeniedOption<UiHttpContext> | null;
+    /** The request's CSP nonce, applied to the page's inline `<style>`. */
+    nonce?: string;
+    /**
+     * Send the `WWW-Authenticate: Basic …` challenge on a `401`. Default `true` (what the JSON guard
+     * always did). Browsers answer that header with a native username/password prompt, which only
+     * makes sense when the built-in `basic` credentials are configured — for a host gating on its own
+     * `authorize` hook the prompt is noise over the page, so the SPA provider passes `false` then.
+     */
+    challenge?: boolean;
+}
+/**
+ * {@link enforceGuard} for a PAGE navigation — the `@adonis-agora/telescope-ui` SPA shell and its
+ * assets. Same decision ({@link runGuard}), same statuses, same "a redirect the hook wrote wins"
+ * rule; what differs is the body: a browser gets the built-in access-denied page (or the host's
+ * `accessDenied` customisation of it) instead of the `{ error }` JSON the API answers with. The
+ * `WWW-Authenticate` challenge still rides on a `401` unless `challenge: false`, so the built-in
+ * `basic` credentials keep prompting natively in a browser — the page is what shows if the prompt
+ * is dismissed.
+ */
+export declare function enforcePageGuard(ctx: UiHttpContext, authorize: AuthorizeHook, options: PageGuardOptions): Promise<boolean>;
 //# sourceMappingURL=guard.d.ts.map

package/dist/src/ui/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAejG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjG"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAejG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjG;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,kBAAkB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACxD,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/src/ui/guard.js

@@ -1,3 +1,4 @@
+import { resolveAccessDeniedPage, } from './access_denied_page.js';
 /**
  * Run the configured {@link AuthorizeHook} against a request and translate the
  * decision into a {@link GuardResult}. Framework-light: takes the same minimal
@@ -53,4 +54,52 @@ export async function enforceGuard(ctx, authorize) {
     ctx.response.send({ error: result.message ?? 'Forbidden' });
     return false;
 }
+/**
+ * {@link enforceGuard} for a PAGE navigation — the `@adonis-agora/telescope-ui` SPA shell and its
+ * assets. Same decision ({@link runGuard}), same statuses, same "a redirect the hook wrote wins"
+ * rule; what differs is the body: a browser gets the built-in access-denied page (or the host's
+ * `accessDenied` customisation of it) instead of the `{ error }` JSON the API answers with. The
+ * `WWW-Authenticate` challenge still rides on a `401` unless `challenge: false`, so the built-in
+ * `basic` credentials keep prompting natively in a browser — the page is what shows if the prompt
+ * is dismissed.
+ */
+export async function enforcePageGuard(ctx, authorize, options) {
+    const result = await runGuard(ctx, authorize);
+    if (result.allowed)
+        return true;
+    const answered = () => responseAnswered(ctx);
+    if (answered())
+        return false;
+    const status = result.status === 401 ? 401 : 403;
+    const info = {
+        status,
+        reason: status === 401 ? 'unauthenticated' : 'forbidden',
+        basePath: options.basePath,
+        ...(options.loginHref !== undefined ? { loginHref: options.loginHref } : {}),
+        ...(options.nonce !== undefined ? { nonce: options.nonce } : {}),
+    };
+    const html = await resolveAccessDeniedPage(info, options.accessDenied, ctx, answered);
+    if (html === null)
+        return false;
+    ctx.response.status(status);
+    if (status === 401 && options.challenge !== false) {
+        ctx.response.header('WWW-Authenticate', 'Basic realm="Telescope", Bearer');
+    }
+    ctx.response.header('content-type', 'text/html; charset=utf-8');
+    ctx.response.header('cache-control', 'no-store, must-revalidate');
+    ctx.response.send(html);
+    return false;
+}
+/**
+ * Whether something already answered this request: a redirect (`location` header — the signal the
+ * `authorize` contract has always honoured) or a body already queued. The body check reads
+ * AdonisJS's `response.hasLazyBody` (and {@link RecordingResponse}'s `sent`) structurally, so the
+ * framework-light context stays framework-light.
+ */
+function responseAnswered(ctx) {
+    if (ctx.response.getHeader('location'))
+        return true;
+    const response = ctx.response;
+    return response.hasLazyBody === true || response.headersSent === true || response.sent === true;
+}
 //# sourceMappingURL=guard.js.map

package/dist/src/ui/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,SAAwB;IACzE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,mBAAmB,GACvB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC;IAElG,OAAO,mBAAmB;QACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QACvD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,SAAwB;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;IACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,SAAwB;IACzE,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,mBAAmB,GACvB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC;IAElG,OAAO,mBAAmB;QACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QACvD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,SAAwB;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;IACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,SAAwB,EACxB,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,MAAM,IAAI,GAAqB;QAC7B,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEhC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAIpB,CAAC;IACF,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AAClG,CAAC"}

package/dist/src/ui/index.d.ts

@@ -1,16 +1,18 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.10.0";
+export declare const VERSION = "0.12.0";
+export type { AccessDeniedInfo, AccessDeniedPageOptions, AccessDeniedReason, } from './access_denied_page.js';
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 export type { EntrySummary, RetentionInfo, RetentionOptions, RetentionPruneOptions, RetentionSamplingRate, } from './api.js';
 export { buildQuery, TelescopeApi, toSummary } from './api.js';
 export type { DashboardAuthDecision, DashboardAuthOptions, LoginHook, LoginOutcome, ResolvedDashboardAuth, } from './auth.js';
 export { decideDashboardAuth, performLogin, readSession, resolveDashboardAuth, SESSION_COOKIE_NAME, sanitizeReturnTo, } from './auth.js';
 export { clearSessionCookie, enforceDashboardAuth, readSessionCookie, writeSessionCookie, } from './dashboard_auth.js';
-export type { AuthorizeHook, ReplayConfig, ResolvedTelescopeUiConfig, TelescopeUiConfig, UiCredentials, } from './define_config.js';
+export type { AccessDeniedOption, AccessDeniedRenderer, AuthorizeHook, ReplayConfig, ResolvedTelescopeUiConfig, TelescopeUiConfig, UiCredentials, } from './define_config.js';
 export { defaultAuthorize, defineConfig, normalizePath, resolveConfig } from './define_config.js';
 export type { PagedTableData, TablePagination } from './ext_table.js';
 export { fillLinkHref, tablePagination } from './ext_table.js';
-export type { GuardResult } from './guard.js';
-export { enforceGuard, runGuard } from './guard.js';
+export type { GuardResult, PageGuardOptions } from './guard.js';
+export { enforceGuard, enforcePageGuard, runGuard } from './guard.js';
 export type { SseSink, UiHttpContext, UiRequest, UiResponse } from './http.js';
 export { formatSseFrame, formatSseHeartbeat, makeRequest, RecordingResponse, RecordingSink, } from './http.js';
 export { renderLoginPage } from './login_page.js';

package/dist/src/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC,YAAY,EACV,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/E,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/E,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}

package/dist/src/ui/index.js

@@ -1,5 +1,7 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.10.0';
+export const VERSION = '0.12.0';
+// — the built-in "access denied" page (what a browser sees on a refused page navigation) —
+export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 // — JSON API —
 export { buildQuery, TelescopeApi, toSummary } from './api.js';
 // — built-in `dashboardAuth` login screen (optional; opt-in via `config/telescope_ui.ts`) —
@@ -11,7 +13,7 @@ export { defaultAuthorize, defineConfig, normalizePath, resolveConfig } from './
 // — paged extension-dashboard tables —
 export { fillLinkHref, tablePagination } from './ext_table.js';
 // — auth guard —
-export { enforceGuard, runGuard } from './guard.js';
+export { enforceGuard, enforcePageGuard, runGuard } from './guard.js';
 // — HTTP shapes (framework-light) —
 export { formatSseFrame, formatSseHeartbeat, makeRequest, RecordingResponse, RecordingSink, } from './http.js';
 export { renderLoginPage } from './login_page.js';

package/dist/src/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAShC,eAAe;AACf,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQ/D,4FAA4F;AAC5F,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,qBAAqB;AACrB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAQ7B,aAAa;AACb,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElG,uCAAuC;AACvC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE/D,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpD,oCAAoC;AACpC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,uFAAuF;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAOhC,2FAA2F;AAC3F,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAQjC,eAAe;AACf,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQ/D,4FAA4F;AAC5F,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,qBAAqB;AACrB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAU7B,aAAa;AACb,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElG,uCAAuC;AACvC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE/D,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,oCAAoC;AACpC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,uFAAuF;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qBAAqB;AACrB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,+DAA+D;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}

package/dist/src/ui/login_page.d.ts

@@ -1,23 +1,36 @@
 /**
  * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
- * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
- * dashboard shell doesn't require rebuilding or extending the bundled Vite app.
+ * dependency-free, hand-authored HTML page — NOT part of the bundled Vite app — so gating the
+ * dashboard shell doesn't require rebuilding or extending the bundled SPA.
  *
- * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
- * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
- * controlled config value, not user input — and the page body is otherwise a static template.
- * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
- * to get wrong.
+ * It works WITHOUT JavaScript: the markup is a classic `<form method="post">` carrying `returnTo`
+ * in a hidden field, and the provider answers a form-encoded `POST` with a redirect (to `returnTo`
+ * on success, back here with `?error` on failure). The inline `<script>` is progressive
+ * enhancement only — it swaps the full-page round trip for a JSON `fetch` and shows the error in
+ * place — and it carries the request's CSP nonce when the provider hands one over, so a host
+ * running `@adonisjs/shield`'s `script-src 'self' @nonce` keeps the enhancement instead of a
+ * dead form. The `<style>` takes the same nonce.
+ *
+ * The only per-request values interpolated are `returnTo` (already passed through
+ * {@link sanitizeReturnTo}, so it is a root-relative path) and the `error` flag; both go through
+ * {@link escapeHtml} (and `JSON.stringify` inside the script) so nothing in the query string can
+ * break out of an attribute or the script. `basePath` is developer-controlled config.
  *
  * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
- * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
- * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
- * markup keeps its own `<script>`.
+ * they feel like one family.
  *
  * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
  * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
  * email-only host (gate on username, ignore password) works with the same page as a host with real
  * passwords.
  */
-export declare function renderLoginPage(basePath: string): string;
+export interface LoginPageOptions {
+    /** The request's CSP nonce, applied to the inline `<style>` and `<script>`. */
+    nonce?: string;
+    /** Render the "Invalid username or password." notice (the no-JS failure round trip). */
+    error?: boolean;
+    /** Where to send the operator after a successful sign-in. Sanitized here; default `basePath`. */
+    returnTo?: unknown;
+}
+export declare function renderLoginPage(basePath: string, options?: LoginPageOptions): string;
 //# sourceMappingURL=login_page.d.ts.map

package/dist/src/ui/login_page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/ui/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmJxD"}
+{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/ui/login_page.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkBD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CA2IxF"}