@adonis-agora/telescope 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @adonis-agora/telescope
 
+## 0.26.0
+
+### Minor Changes
+
+- [#228](https://github.com/DavideCarvalho/adonis-agora-telescope/pull/228) [`0398e27`](https://github.com/DavideCarvalho/adonis-agora-telescope/commit/0398e27eea73153ff5fd6e2406de21568fb06b87) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard gate: a custom `authorize` hook returning a bare `false` is now a `403`, not a guessed `401`.
+  
+  The guard used to turn a bare `false` (or `{ allowed: false }` with no `reason`) into `401 — Sign in required` whenever the request carried no `Authorization` header / `?token`. That heuristic was built for the built-in `credentials: { token, basic }` gate, but it also fired for custom hooks that authenticate via a session cookie (e.g. `@adonis-agora/authz`'s `authorizeByRoles`), so a signed-in user without the right role was told to sign in instead of getting `403`.
+  
+  Telescope now follows the same dashboard-gate contract as every `@adonis-agora` console:
+  
+  - `true` / `{ allowed: true }` → proceed.
+  - `{ allowed: false, reason: 'unauthenticated' }` → `401`; `reason: 'forbidden'` → `403`.
+  - bare `false` / `{ allowed: false }` without a `reason` → `403` (fail closed); a throwing hook → `403`.
+  - a redirect (or body) the hook already wrote still wins; pages get the access-denied HTML, the API gets JSON.
+  
+  The built-in gate (no custom `authorize`, or `authorize: defaultAuthorize(...)`, in both `telescope_ui` and `telescope_mcp` configs) keeps its behavior: `401` + `WWW-Authenticate` when no credential was presented, `403` when one was presented but rejected. The exported `defaultAuthorize()` still returns a plain `boolean`.
+  
+  **Migration:** if your custom hook relied on the `401` for anonymous visitors, return `{ allowed: false, reason: 'unauthenticated' }` for that case.
+
 ## 0.25.0
 
 ### Minor Changes

package/dist/src/ai/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export type { ResolvedTelescopeAiConfig, TelescopeAiConfig, } from './define_config.js';
 export { DEFAULT_MAX_TOKENS, DEFAULT_MODEL, defineConfig, resolveConfig, } from './define_config.js';
 export type { Diagnosis, DiagnosisConfidence, ExceptionEntryContent } from './diagnoser.js';

package/dist/src/ai/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // — config —
 export { DEFAULT_MAX_TOKENS, DEFAULT_MODEL, defineConfig, resolveConfig, } from './define_config.js';
 // — diagnosis model + parsing —

package/dist/src/alerts/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export type { AlertChannel, ChannelFetch, ConsoleSink } from './alert_channel.js';
 export { consoleChannel, customChannel, slackChannel, webhookChannel, } from './alert_channel.js';
 export type { AlertDiagnosis, AlertGeoLocation, AlertMetric, AlertPayload, AlertRule, ExceptionAlertContext, GeoLookup, ResolvedAlerts, } from './alert_rule.js';

package/dist/src/alerts/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // — channels —
 export { consoleChannel, customChannel, slackChannel, webhookChannel, } from './alert_channel.js';
 // — alerter (exception source → tracker → channels) —

package/dist/src/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export { configure } from '../configure.js';
 export type { DiagnoserLike, DiagnosisCoordinatorOptions, DiagnosisSummary, } from './ai/diagnosis_coordinator.js';
 export { DiagnosisCoordinator, formatDiagnosisMarkdown, } from './ai/diagnosis_coordinator.js';

package/dist/src/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // Re-export the configure hook from the package root so `node ace configure` finds it
 export { configure } from '../configure.js';
 // — AI diagnosis coordinator (wires the MCP tool + the alerter; SDK-free) —

package/dist/src/mcp/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGlB,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAEhC,+DAA+D;AAC/D,eAAO,MAAM,cAAc,YACzB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,YAAY,EACZ,oBAAoB,CACZ,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,qFAAqF;IACrF,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAE3E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,kBAAuB,GAAG,0BAA0B,CAUzF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGlB,KAAK,aAAa,EAEnB,MAAM,wBAAwB,CAAC;AAEhC,+DAA+D;AAC/D,eAAO,MAAM,cAAc,YACzB,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,YAAY,EACZ,oBAAoB,CACZ,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,qFAAqF;IACrF,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,4BAA4B;IAC5B,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAE3E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,kBAAuB,GAAG,0BAA0B,CAUzF"}

package/dist/src/mcp/define_config.js

@@ -1,4 +1,4 @@
-import { defaultAuthorize, normalizePath, } from '../ui/define_config.js';
+import { defaultAuthorize, normalizePath, withCredentialStatus, } from '../ui/define_config.js';
 /** The tools the MCP server can expose, in catalogue order. */
 export const MCP_TOOL_NAMES = [
     'list_entries',
@@ -27,7 +27,7 @@ export function resolveConfig(config = {}) {
     return {
         enabled: config.enabled ?? true,
         path: normalizePath(config.path ?? '/telescope/mcp'),
-        authorize: config.authorize ?? defaultAuthorize(credentials),
+        authorize: withCredentialStatus(config.authorize ?? defaultAuthorize(credentials)),
         credentials,
         tools: new Set(tools),
     };

package/dist/src/mcp/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,YAAY;IACZ,oBAAoB;CACZ,CAAC;AA8CX;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAuB,EAAE;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,KAAK,EAAE,IAAI,GAAG,CAAc,KAAK,CAAC;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/mcp/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,EAEb,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,YAAY;IACZ,oBAAoB;CACZ,CAAC;AA8CX;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAuB,EAAE;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC;QACpD,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClF,WAAW;QACX,KAAK,EAAE,IAAI,GAAG,CAAc,KAAK,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/src/mcp/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export type { McpToolName, ResolvedTelescopeMcpConfig, TelescopeMcpConfig, } from './define_config.js';
 export { defineConfig, MCP_TOOL_NAMES, resolveConfig } from './define_config.js';
 export type { DiagnoseExceptionHook, JsonRpcRequest, McpToolSpec, TelescopeMcpServerOptions, } from './server.js';

package/dist/src/mcp/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // — config —
 export { defineConfig, MCP_TOOL_NAMES, resolveConfig } from './define_config.js';
 // — server (plain, testable JSON-RPC surface) —

package/dist/src/profiling/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export { aggregateCpuProfile } from './aggregate-profile.js';
 export type { CpuProfilerOptions, CpuProfilerResult, InspectorSessionLike, SessionFactory, } from './cpu-profiler.js';
 export { CpuProfiler, defaultSessionFactory } from './cpu-profiler.js';

package/dist/src/profiling/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 export { aggregateCpuProfile } from './aggregate-profile.js';
 export { CpuProfiler, defaultSessionFactory } from './cpu-profiler.js';
 export { defineConfig, resolveConfig } from './define_config.js';

package/dist/src/ui/define_config.d.ts

@@ -14,28 +14,25 @@ export type AccessDeniedRenderer = GenericAccessDeniedRenderer<UiHttpContext>;
 export type AccessDeniedOption = GenericAccessDeniedOption<UiHttpContext>;
 /**
  * The enriched form of an {@link AuthorizeHook}'s return value: a plain `allowed` plus an OPTIONAL
- * `reason` telling the guard exactly which denial this is, instead of it having to guess.
+ * `reason` telling the guard exactly which denial this is.
  *
- * Return this instead of a bare `boolean` when your hook authenticates some way the guard cannot see
- * by inspecting the request itself — most commonly a session cookie (e.g.
- * `@adonis-agora/authz`'s `authorizeByRoles`, which reads `ctx.auth`). Without a `reason` the guard
- * falls back to its request-shape heuristic (see {@link AuthorizeHook}), which only recognizes the
- * built-in `credentials.token`/`credentials.basic` gate — a session-authenticated-but-wrong-role
- * request would otherwise come back `401` ("please authenticate") when it should be `403`
- * ("you're signed in, but not allowed").
+ * This is the dashboard-gate contract shared (copied verbatim) by every `@adonis-agora` console —
+ * telescope, durable, media, payments, agent, authz:
+ * - `true` / `{ allowed: true }` → proceed.
+ * - `{ allowed: false, reason: 'unauthenticated' }` → `401` (nobody is signed in).
+ * - `{ allowed: false, reason: 'forbidden' }` → `403` (signed in, but not authorized).
+ * - a bare `false`, or `{ allowed: false }` with no `reason` → `403` (fail closed).
+ * - the hook throws → `403`.
  *
- * `reason` reuses the same vocabulary as {@link AccessDeniedInfo.reason}, so a hook and a custom
- * `accessDenied` renderer speak the same two words:
- * - `'unauthenticated'` → the guard answers `401` (nobody is signed in).
- * - `'forbidden'` → the guard answers `403` (signed in, but not authorized).
+ * So a hook that wants the "please sign in" `401` (e.g. `@adonis-agora/authz`'s `authorizeByRoles`
+ * for an anonymous visitor) must say so with `reason: 'unauthenticated'`. `reason` reuses the same
+ * vocabulary as {@link AccessDeniedInfo.reason}, so a hook and a custom `accessDenied` renderer
+ * speak the same two words.
  */
 export interface AuthorizeDecision {
     /** Whether the request may proceed. */
     allowed: boolean;
-    /**
-     * Why `allowed` is `false`. Omit it to fall back to the guard's request-shape heuristic (the same
-     * one a bare `false` return gets) — useful when the hook itself doesn't know which case applies.
-     */
+    /** Why `allowed` is `false`. Omitted on a denial → `403` (fail closed). */
     reason?: 'unauthenticated' | 'forbidden';
 }
 /** What an {@link AuthorizeHook} may return: either form, sync or async. */
@@ -46,13 +43,16 @@ export type AuthorizeResult = boolean | AuthorizeDecision;
  * context, so a host can inspect headers, a session, an injected user — whatever
  * its own auth exposes. Sync or async.
  *
- * A bare `false` denial is translated to `401`/`403` by a heuristic: `401` when the request presents
- * no `Authorization` header and no `?token`, `403` otherwise. That heuristic was built for this
- * library's OWN `credentials: { token, basic }` gate, where "no credential in the request" and "not
- * authenticated" are the same fact. A host authenticating some other way — a session cookie, most
- * commonly — can return an {@link AuthorizeDecision} (`{ allowed, reason }`) instead of a bare
- * boolean to tell the guard precisely which denial this is, bypassing the heuristic entirely. See
- * {@link AuthorizeDecision} and the "Delegate to your app's auth" doc section.
+ * A bare `false` from a custom hook is a `403`. To answer `401` ("please authenticate") return an
+ * {@link AuthorizeDecision} with `reason: 'unauthenticated'`; see that type for the full contract
+ * and the "Delegate to your app's auth" doc section. A hook may also answer the request itself
+ * (e.g. `ctx.response.redirect('/login')`) and return `false`: the guard then writes nothing.
+ *
+ * Only the BUILT-IN gate ({@link defaultAuthorize}, used when no custom `authorize` is configured)
+ * distinguishes `401` from `403` by request shape — `401` when the request presented no
+ * `Authorization` header and no `?token`, `403` when a credential was presented but rejected — since
+ * for its `credentials: { token, basic }` "no credential in the request" and "not authenticated" are
+ * the same fact.
  */
 export type AuthorizeHook = (ctx: UiHttpContext) => AuthorizeResult | Promise<AuthorizeResult>;
 /**
@@ -223,8 +223,22 @@ export declare function normalizePath(path: string): string;
  * - if `basic` credentials are set and the request presents them → allow;
  * - otherwise allow only when NOT in production (so a dev dashboard "just works"
  *   while a production deploy is denied unless explicitly gated).
+ *
+ * Returns a plain `boolean` on purpose, so composing it (`if (await defaultAuthorize(c)(ctx))`) is
+ * safe. The `401`-vs-`403` split for this gate is added by `resolveConfig` (see
+ * {@link withCredentialStatus}) — also when the host passes `authorize: defaultAuthorize(...)`
+ * explicitly.
  */
 export declare function defaultAuthorize(credentials: UiCredentials): AuthorizeHook;
+/**
+ * Give a {@link defaultAuthorize} hook its request-shape denial reason: `'unauthenticated'` (→ `401`,
+ * with `WWW-Authenticate` so a browser prompts) when no credential was presented, `'forbidden'`
+ * (→ `403`) when one was presented but rejected. Any other (custom) hook is returned untouched — its
+ * bare `false` is a `403`, per the {@link AuthorizeDecision} contract.
+ *
+ * @internal Used by the UI and MCP `resolveConfig`.
+ */
+export declare function withCredentialStatus(authorize: AuthorizeHook): AuthorizeHook;
 /** Apply defaults to a (possibly partial) config. */
 export declare function resolveConfig(config?: TelescopeUiConfig): ResolvedTelescopeUiConfig;
 //# sourceMappingURL=define_config.d.ts.map

package/dist/src/ui/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAErC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAGlC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAGxC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,qEAAqE;IACrE,YAAY,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IACtC,kEAAkE;IAClE,YAAY,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAS1E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CA2BvF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,IAAI,yBAAyB,EAC/C,oBAAoB,IAAI,2BAA2B,EACpD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;CAC1C;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAErC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAGlC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAGxC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,gGAAgG;IAChG,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,qEAAqE;IACrE,YAAY,EAAE;QAAE,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IACtC,kEAAkE;IAClE,YAAY,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACpC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAoDD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAW1E;AAYD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,aAAa,GAAG,aAAa,CAQ5E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CA2BvF"}

package/dist/src/ui/define_config.js

@@ -72,6 +72,8 @@ function matchesBasic(ctx, basic) {
     const password = decoded.slice(sep + 1);
     return safeEqual(username, basic.username) && safeEqual(password, basic.password);
 }
+/** Hooks minted by {@link defaultAuthorize}, so {@link withCredentialStatus} can recognize them. */
+const defaultHooks = new WeakSet();
 /**
  * The default access policy used when no custom `authorize` is configured:
  *
@@ -79,9 +81,14 @@ function matchesBasic(ctx, basic) {
  * - if `basic` credentials are set and the request presents them → allow;
  * - otherwise allow only when NOT in production (so a dev dashboard "just works"
  *   while a production deploy is denied unless explicitly gated).
+ *
+ * Returns a plain `boolean` on purpose, so composing it (`if (await defaultAuthorize(c)(ctx))`) is
+ * safe. The `401`-vs-`403` split for this gate is added by `resolveConfig` (see
+ * {@link withCredentialStatus}) — also when the host passes `authorize: defaultAuthorize(...)`
+ * explicitly.
  */
 export function defaultAuthorize(credentials) {
-    return (ctx) => {
+    const hook = (ctx) => {
         if (credentials.token !== undefined) {
             const presented = readToken(ctx);
             if (presented !== undefined && safeEqual(presented, credentials.token))
@@ -91,6 +98,34 @@ export function defaultAuthorize(credentials) {
             return true;
         return !isProduction();
     };
+    defaultHooks.add(hook);
+    return hook;
+}
+/**
+ * Whether the request presented ANY credential the built-in gate understands: an `Authorization`
+ * header (Bearer or Basic) or a `?token`.
+ */
+function presentedCredential(ctx) {
+    return (ctx.request.header('authorization') !== undefined || typeof ctx.request.qs().token === 'string');
+}
+/**
+ * Give a {@link defaultAuthorize} hook its request-shape denial reason: `'unauthenticated'` (→ `401`,
+ * with `WWW-Authenticate` so a browser prompts) when no credential was presented, `'forbidden'`
+ * (→ `403`) when one was presented but rejected. Any other (custom) hook is returned untouched — its
+ * bare `false` is a `403`, per the {@link AuthorizeDecision} contract.
+ *
+ * @internal Used by the UI and MCP `resolveConfig`.
+ */
+export function withCredentialStatus(authorize) {
+    if (!defaultHooks.has(authorize))
+        return authorize;
+    return async (ctx) => {
+        const result = await authorize(ctx);
+        const allowed = typeof result === 'boolean' ? result : result.allowed;
+        if (allowed)
+            return true;
+        return { allowed: false, reason: presentedCredential(ctx) ? 'forbidden' : 'unauthenticated' };
+    };
 }
 /** Apply defaults to a (possibly partial) config. */
 export function resolveConfig(config = {}) {
@@ -99,7 +134,7 @@ export function resolveConfig(config = {}) {
         enabled: config.enabled ?? true,
         path: normalizePath(config.path ?? '/telescope'),
         recordOwnRequests: config.recordOwnRequests ?? false,
-        authorize: config.authorize ?? defaultAuthorize(credentials),
+        authorize: withCredentialStatus(config.authorize ?? defaultAuthorize(credentials)),
         credentials,
         // Validate + resolve now so a misconfigured secret/login fails closed at boot, not on the first
         // login attempt. `null` when `dashboardAuth` is omitted (behavior unchanged).

package/dist/src/ui/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAgNnB;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAsB,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;QACpD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,gGAAgG;QAChG,8EAA8E;QAC9E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;QACD,YAAY,EAAE;YACZ,qEAAqE;YACrE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,IAAI,KAAK;SACrD;QACD,YAAY,EAAE;YACZ,iFAAiF;YACjF,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,KAAK;SAC/C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAgNnB;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,oGAAoG;AACpG,MAAM,YAAY,GAAG,IAAI,OAAO,EAAiB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,MAAM,IAAI,GAAkB,CAAC,GAAG,EAAE,EAAE;QAClC,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,OAAO,CACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAwB;IAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAChG,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,MAAM,GAAsB,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;QACpD,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAClF,WAAW;QACX,gGAAgG;QAChG,8EAA8E;QAC9E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;QACD,YAAY,EAAE;YACZ,qEAAqE;YACrE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,IAAI,KAAK;SACrD;QACD,YAAY,EAAE;YACZ,iFAAiF;YACjF,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,IAAI,KAAK;SAC/C;KACF,CAAC;AACJ,CAAC"}

package/dist/src/ui/guard.d.ts

@@ -15,22 +15,17 @@ export interface GuardResult {
  * decision into a {@link GuardResult}. Framework-light: takes the same minimal
  * HTTP context the handlers do, so it is unit-testable without a server.
  *
- * The hook may return a bare `boolean` OR an {@link AuthorizeDecision}
- * (`{ allowed, reason? }`) — see that type for the full rationale. A denial's status is decided,
- * in order:
- * 1. An explicit `reason` on an {@link AuthorizeDecision} wins outright: `'unauthenticated'` → `401`,
- *    `'forbidden'` → `403`. This is the escape hatch for a hook that authenticates some way the guard
- *    cannot see by inspecting the request (a session cookie, most commonly — e.g.
- *    `@adonis-agora/authz`'s `authorizeByRoles`).
- * 2. Otherwise (a bare `false`, or `{ allowed: false }` with no `reason`) the REQUEST-SHAPE heuristic
- *    this guard has always used runs: **401** when the request presented NO credential at all (an
- *    `Authorization` header is absent and no `?token`) — prompts the host/browser to authenticate;
- *    **403** when a credential WAS presented but rejected (wrong token/password). Built for this
- *    library's own `credentials: { token, basic }` gate, where "no credential in the request" and
- *    "not authenticated" are the same fact — a hook authenticating another way should prefer (1).
+ * The hook may return a bare `boolean` OR an {@link AuthorizeDecision} (`{ allowed, reason? }`).
+ * The mapping is the dashboard-gate contract shared by every `@adonis-agora` console:
+ * - `true` / `{ allowed: true }` → allowed.
+ * - `reason: 'unauthenticated'` → `401`.
+ * - `reason: 'forbidden'` → `403`.
+ * - a bare `false`, or `{ allowed: false }` with no `reason` → `403` (fail closed).
+ * - the hook throws → `403` (fail closed — never leaks the dashboard).
  *
- * Any error thrown by a custom `authorize` hook fails closed (403) rather than
- * leaking the dashboard.
+ * No request-shape guessing happens here. The built-in credentials gate gets its `401` (no
+ * credential presented) vs `403` (credential rejected) split by `resolveConfig` wrapping
+ * `defaultAuthorize` into a hook that returns the matching `reason`.
  */
 export declare function runGuard(ctx: UiHttpContext, authorize: AuthorizeHook): Promise<GuardResult>;
 /**

package/dist/src/ui/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAmB,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAqBjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjG;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,kBAAkB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACxD,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAmB,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAcjG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjG;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,kBAAkB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACxD,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/src/ui/guard.js

@@ -4,22 +4,17 @@ import { resolveAccessDeniedPage, } from './access_denied_page.js';
  * decision into a {@link GuardResult}. Framework-light: takes the same minimal
  * HTTP context the handlers do, so it is unit-testable without a server.
  *
- * The hook may return a bare `boolean` OR an {@link AuthorizeDecision}
- * (`{ allowed, reason? }`) — see that type for the full rationale. A denial's status is decided,
- * in order:
- * 1. An explicit `reason` on an {@link AuthorizeDecision} wins outright: `'unauthenticated'` → `401`,
- *    `'forbidden'` → `403`. This is the escape hatch for a hook that authenticates some way the guard
- *    cannot see by inspecting the request (a session cookie, most commonly — e.g.
- *    `@adonis-agora/authz`'s `authorizeByRoles`).
- * 2. Otherwise (a bare `false`, or `{ allowed: false }` with no `reason`) the REQUEST-SHAPE heuristic
- *    this guard has always used runs: **401** when the request presented NO credential at all (an
- *    `Authorization` header is absent and no `?token`) — prompts the host/browser to authenticate;
- *    **403** when a credential WAS presented but rejected (wrong token/password). Built for this
- *    library's own `credentials: { token, basic }` gate, where "no credential in the request" and
- *    "not authenticated" are the same fact — a hook authenticating another way should prefer (1).
+ * The hook may return a bare `boolean` OR an {@link AuthorizeDecision} (`{ allowed, reason? }`).
+ * The mapping is the dashboard-gate contract shared by every `@adonis-agora` console:
+ * - `true` / `{ allowed: true }` → allowed.
+ * - `reason: 'unauthenticated'` → `401`.
+ * - `reason: 'forbidden'` → `403`.
+ * - a bare `false`, or `{ allowed: false }` with no `reason` → `403` (fail closed).
+ * - the hook throws → `403` (fail closed — never leaks the dashboard).
  *
- * Any error thrown by a custom `authorize` hook fails closed (403) rather than
- * leaking the dashboard.
+ * No request-shape guessing happens here. The built-in credentials gate gets its `401` (no
+ * credential presented) vs `403` (credential rejected) split by `resolveConfig` wrapping
+ * `defaultAuthorize` into a hook that returns the matching `reason`.
  */
 export async function runGuard(ctx, authorize) {
     let result;
@@ -35,12 +30,7 @@ export async function runGuard(ctx, authorize) {
     const reason = typeof result === 'boolean' ? undefined : result.reason;
     if (reason === 'unauthenticated')
         return { allowed: false, status: 401, message: 'Unauthorized' };
-    if (reason === 'forbidden')
-        return { allowed: false, status: 403, message: 'Forbidden' };
-    const presentedCredential = ctx.request.header('authorization') !== undefined || typeof ctx.request.qs().token === 'string';
-    return presentedCredential
-        ? { allowed: false, status: 403, message: 'Forbidden' }
-        : { allowed: false, status: 401, message: 'Unauthorized' };
+    return { allowed: false, status: 403, message: 'Forbidden' };
 }
 /**
  * Guard `ctx` and, on denial, write the status + message onto the response and

package/dist/src/ui/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,SAAwB;IACzE,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACvE,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAClG,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEzF,MAAM,mBAAmB,GACvB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC;IAElG,OAAO,mBAAmB;QACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QACvD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,SAAwB;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;IACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,SAAwB,EACxB,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,MAAM,IAAI,GAAqB;QAC7B,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEhC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAIpB,CAAC;IACF,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AAClG,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/ui/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB,EAAE,SAAwB;IACzE,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACvE,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAClG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,SAAwB;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;IACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,SAAwB,EACxB,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,MAAM,IAAI,GAAqB;QAC7B,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW;QACxD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEhC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAChE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAIpB,CAAC;IACF,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AAClG,CAAC"}

package/dist/src/ui/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export type { AccessDeniedInfo, AccessDeniedPageOptions, AccessDeniedReason, } from './access_denied_page.js';
 export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 export type { EntrySummary, RetentionInfo, RetentionOptions, RetentionPruneOptions, RetentionSamplingRate, } from './api.js';

package/dist/src/ui/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // — the built-in "access denied" page (what a browser sees on a refused page navigation) —
 export { CONSOLE as ACCESS_DENIED_CONSOLE, escapeHtml, renderAccessDeniedPage, resolveAccessDeniedPage, } from './access_denied_page.js';
 // — JSON API —

package/dist/src/watchers/index.d.ts

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.25.0";
+export declare const VERSION = "0.26.0";
 export type { CacheEntryContent, CacheEventLike, CacheOperation } from './cache_watcher.js';
 export { buildCacheEntry, CACHE_EVENTS, CacheWatcher } from './cache_watcher.js';
 export { nextCronRunMs } from './cron_next_run.js';

package/dist/src/watchers/index.js

@@ -1,5 +1,5 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.25.0';
+export const VERSION = '0.26.0';
 // — cache watcher —
 export { buildCacheEntry, CACHE_EVENTS, CacheWatcher } from './cache_watcher.js';
 export { nextCronRunMs } from './cron_next_run.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/telescope",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Laravel Telescope-style headless observability for AdonisJS — records HTTP requests and every Agora diagnostics event as queryable entries, plus opt-in subpaths for per-technology watchers, a web dashboard, AI exception diagnosis, and alerting.",
   "license": "MIT",
   "repository": {

package/skills/telescope-access-mcp/SKILL.md

@@ -73,8 +73,12 @@ export default defineConfig({
 })
 ```
 
-Guard outcomes: denied with no credential → `401` (+ `WWW-Authenticate`); denied
-with a rejected credential → `403`; a throwing hook → `403` (fail-closed).
+Guard outcomes for a custom hook: a bare `false` (or `{ allowed: false }` with no
+`reason`) → `403` (fail-closed); `{ allowed: false, reason: 'unauthenticated' }` → `401`
+(+ `WWW-Authenticate`); `reason: 'forbidden'` → `403`; a throwing hook → `403`. Only
+the BUILT-IN credentials gate (no custom `authorize`, or `authorize: defaultAuthorize(...)`,
+in both `telescope_ui` and `telescope_mcp` configs) splits by request shape:
+no credential presented → `401`, rejected credential → `403`.
 
 Source: `docs/dashboard/auth.mdx` (Delegate to your app's auth, Guard behaviour).