@adonis-agora/telescope 0.4.0 → 0.5.0

package/dist/src/ui/auth.d.ts

@@ -0,0 +1,112 @@
+import { type DashboardSession, type DashboardSessionUser } from './session_cookie.js';
+/**
+ * Framework-light `dashboardAuth` mechanism for the telescope dashboard — config resolution, the
+ * open-redirect guard, the login decision, session verification, and the composed session-guard
+ * decision. NO AdonisJS types leak in (mirroring `guard.ts`/`http.ts`), so every branch is
+ * unit-testable against a plain object with no HTTP server. The Adonis glue in `dashboard_auth.ts`
+ * adapts an `HttpContext` to these functions and owns the cookie read/write via AdonisJS's native
+ * cookie API.
+ *
+ * When configured it gates BOTH the dashboard SPA shell (a full-page navigation redirected `302`
+ * to a server-rendered login page) and the JSON API (a plain `401`) behind a signed session cookie.
+ * When left unconfigured the dashboard behaves exactly as before (no login/logout routes, no
+ * session guard).
+ */
+/** Host hook validating submitted credentials from the built-in login page. */
+export type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
+/**
+ * Author-facing `dashboardAuth` option on `config/telescope_ui.ts`. Gates the dashboard behind a
+ * signed session cookie via the built-in server-rendered login page (`GET <path>/login`) — the
+ * bundled dashboard SPA stays untouched.
+ *
+ * `login` is just a function that may be `async` and close over `app.container`/services (import
+ * them at the top of `config/telescope_ui.ts`), so there is nothing extra to build for the async
+ * case.
+ */
+export interface DashboardAuthOptions {
+    /** REQUIRED HMAC-SHA256 signing key. Missing/empty => boot error (fail closed). */
+    secret: string;
+    /** Cookie TTL as a duration string (`'8h'`, `'30m'`, `'7d'`). Default `'8h'`. */
+    ttl?: string;
+    /** Validates submitted username/password; return the session user, or `null` to deny. Thrown
+     *  errors are treated as a denial (logged once, never surfaced to the client). May be async. */
+    login: LoginHook;
+}
+/** Resolved, validated `dashboardAuth` config shared by the guard, the login handler, and the page. */
+export interface ResolvedDashboardAuth {
+    secret: string;
+    ttlMs: number;
+    login: LoginHook;
+}
+/** Cookie name carrying the signed dashboard session. */
+export declare const SESSION_COOKIE_NAME = "telescope_dashboard_session";
+/**
+ * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
+ * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
+ * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ */
+export declare function resolveDashboardAuth(options: DashboardAuthOptions | undefined): ResolvedDashboardAuth | null;
+/**
+ * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
+ * root-relative path (`/telescope/foo`), never a protocol-relative (`//evil.com`) or absolute
+ * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
+ * else, including a missing/non-string value.
+ */
+export declare function sanitizeReturnTo(candidate: unknown, fallback: string): string;
+/**
+ * The framework-light outcome of a login attempt, mapped to HTTP by the provider:
+ * - `ok`       → set `cookieValue` as the session cookie, reply `200 { redirectTo }`.
+ * - `bad-request` → `400` (body missing string `username`/`password`).
+ * - `unauthorized` → uniform `401 { error }` for EVERY credential failure (unknown user, wrong
+ *   password, or a throwing hook) — no user-enumeration. `hookError` is set only when the hook
+ *   threw, so the provider can warn-log it once without changing the client-visible response.
+ */
+export type LoginOutcome = {
+    kind: 'ok';
+    cookieValue: string;
+    redirectTo: string;
+} | {
+    kind: 'bad-request';
+    message: string;
+} | {
+    kind: 'unauthorized';
+    message: string;
+    hookError?: unknown;
+};
+/**
+ * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
+ * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
+ * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
+ * password is required.
+ */
+export declare function performLogin(auth: ResolvedDashboardAuth, body: unknown, basePath: string, now?: number): Promise<LoginOutcome>;
+/**
+ * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
+ * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
+ */
+export declare function readSession(auth: ResolvedDashboardAuth, cookieValue: string | undefined, now?: number): DashboardSession | null;
+/**
+ * The framework-light outcome of the composed session guard, mapped to HTTP by the Adonis glue:
+ * - `allow`        → let the request through (valid session, or `dashboardAuth` unconfigured).
+ * - `redirect`     → a `page` navigation with no valid session: `302` to the login page carrying
+ *   `returnTo` (the original, server-supplied request URL).
+ * - `unauthorized` → an `api` request with no valid session: a plain `401`.
+ */
+export type DashboardAuthDecision = {
+    kind: 'allow';
+} | {
+    kind: 'redirect';
+    returnTo: string;
+} | {
+    kind: 'unauthorized';
+};
+/**
+ * Decide the session guard for a dashboard resource with NO HTTP types. Runs AFTER the existing
+ * `authorize` hook (they compose — both must pass). When `auth` is `null` (`dashboardAuth`
+ * unconfigured) it always allows, so behavior is byte-for-byte unchanged. Otherwise a valid session
+ * allows; a `page` request without one redirects (carrying `requestUrl` as `returnTo`) and an `api`
+ * request without one is unauthorized.
+ */
+export declare function decideDashboardAuth(auth: ResolvedDashboardAuth | null, cookieValue: string | undefined, mode: 'page' | 'api', requestUrl: string, now?: number): DashboardAuthDecision;
+export type { DashboardSession, DashboardSessionUser } from './session_cookie.js';
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/ui/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/ui/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,oBAAoB,GAAG,IAAI,CAAC;AAExE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;oGACgG;IAChG,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,uGAAuG;AACvG,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAoBjE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GACxC,qBAAqB,GAAG,IAAI,CAgB9B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM7E;AAaD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAqBnE;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,CAAC,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,qBAAqB,GAAG,IAAI,EAClC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,MAAM,GACX,qBAAqB,CAMvB;AAED,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/src/ui/auth.js

@@ -0,0 +1,130 @@
+import { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+/** Cookie name carrying the signed dashboard session. */
+export const SESSION_COOKIE_NAME = 'telescope_dashboard_session';
+const DEFAULT_TTL = '8h';
+const DEFAULT_TTL_MS = 8 * 60 * 60 * 1000;
+const DURATION_UNITS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+};
+/** Parse a `'<number><s|m|h|d>'` duration to ms; falls back to the 8h default on a bad value. */
+function durationToMs(ttl) {
+    const match = /^(\d+)([smhd])$/.exec(ttl.trim());
+    if (!match)
+        return DEFAULT_TTL_MS;
+    const unit = DURATION_UNITS[match[2] ?? ''];
+    if (unit === undefined)
+        return DEFAULT_TTL_MS;
+    return Number(match[1]) * unit;
+}
+/**
+ * Validate + resolve the `dashboardAuth` option. Returns `null` when unconfigured (today's
+ * unauthenticated behavior, unchanged). Throws at boot (fail closed) when configured but missing a
+ * secret or a `login` hook — the host learns immediately rather than shipping an un-mintable gate.
+ */
+export function resolveDashboardAuth(options) {
+    if (options === undefined)
+        return null;
+    if (typeof options.secret !== 'string' || options.secret === '') {
+        throw new Error('telescope_ui: dashboardAuth.secret is required and must be a non-empty string ' +
+            '(HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.');
+    }
+    if (typeof options.login !== 'function') {
+        throw new Error('telescope_ui: dashboardAuth.login is required (a login hook).');
+    }
+    return {
+        secret: options.secret,
+        ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
+        login: options.login,
+    };
+}
+/**
+ * Guard a client-supplied redirect target against an open redirect: it must be a same-origin,
+ * root-relative path (`/telescope/foo`), never a protocol-relative (`//evil.com`) or absolute
+ * (`https://evil.com`) URL. Falls back to `fallback` (the dashboard's own `basePath`) for anything
+ * else, including a missing/non-string value.
+ */
+export function sanitizeReturnTo(candidate, fallback) {
+    if (typeof candidate !== 'string')
+        return fallback;
+    if (!candidate.startsWith('/'))
+        return fallback;
+    if (candidate.startsWith('//'))
+        return fallback;
+    if (candidate.includes('://'))
+        return fallback;
+    return candidate;
+}
+function isString(value) {
+    return typeof value === 'string';
+}
+const UNAUTHORIZED_MESSAGE = 'Invalid username or password.';
+/**
+ * Run the host's `login` hook defensively: a throw is treated as a denial (uniform failure) so a
+ * buggy hook never 500s the endpoint into a stack-trace leak. The thrown error is surfaced on the
+ * outcome (`hookError`) so the provider can warn-log it once, but it never reaches the client.
+ */
+async function runLoginHook(auth, username, password) {
+    try {
+        return { user: (await auth.login(username, password)) ?? null };
+    }
+    catch (error) {
+        return { user: null, error };
+    }
+}
+/**
+ * Decide a login attempt end-to-end (validate body → run hook → mint cookie) with no HTTP types.
+ * On success returns the signed cookie value to set plus the sanitized `redirectTo`; the password
+ * is forwarded to the hook AS-IS (empty string when blank), so the hook alone decides whether a
+ * password is required.
+ */
+export async function performLogin(auth, body, basePath, now) {
+    const parsed = (body ?? {});
+    if (!isString(parsed.username) || !isString(parsed.password)) {
+        return { kind: 'bad-request', message: 'Body must include string `username` and `password`.' };
+    }
+    const { user, error } = await runLoginHook(auth, parsed.username, parsed.password);
+    if (!user) {
+        return error !== undefined
+            ? { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE, hookError: error }
+            : { kind: 'unauthorized', message: UNAUTHORIZED_MESSAGE };
+    }
+    const cookieValue = signSessionCookie(user, {
+        secret: auth.secret,
+        ttlMs: auth.ttlMs,
+        ...(now !== undefined ? { now } : {}),
+    });
+    return { kind: 'ok', cookieValue, redirectTo: sanitizeReturnTo(parsed.returnTo, basePath) };
+}
+/**
+ * Read + verify a session cookie value, returning the session or `null` when absent, tampered, or
+ * expired. Thin wrapper over {@link verifySessionCookie} so the provider never touches crypto.
+ */
+export function readSession(auth, cookieValue, now) {
+    if (cookieValue === undefined || cookieValue === '')
+        return null;
+    return verifySessionCookie(cookieValue, {
+        secret: auth.secret,
+        ...(now !== undefined ? { now } : {}),
+    });
+}
+/**
+ * Decide the session guard for a dashboard resource with NO HTTP types. Runs AFTER the existing
+ * `authorize` hook (they compose — both must pass). When `auth` is `null` (`dashboardAuth`
+ * unconfigured) it always allows, so behavior is byte-for-byte unchanged. Otherwise a valid session
+ * allows; a `page` request without one redirects (carrying `requestUrl` as `returnTo`) and an `api`
+ * request without one is unauthorized.
+ */
+export function decideDashboardAuth(auth, cookieValue, mode, requestUrl, now) {
+    if (auth === null)
+        return { kind: 'allow' };
+    const session = readSession(auth, cookieValue, now);
+    if (session !== null)
+        return { kind: 'allow' };
+    if (mode === 'page')
+        return { kind: 'redirect', returnTo: requestUrl };
+    return { kind: 'unauthorized' };
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/ui/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/ui/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAgD7B,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAEjE,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAA2B;IAC7C,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,cAAc,CAAC;IAClC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAyC;IAEzC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB,EAAE,QAAgB;IACnE,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAeD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAE7D;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA2B,EAC3B,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAA2B,EAC3B,IAAa,EACb,QAAgB,EAChB,GAAY;IAEZ,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAc,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE;QAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA2B,EAC3B,WAA+B,EAC/B,GAAY;IAEZ,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,mBAAmB,CAAC,WAAW,EAAE;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkC,EAClC,WAA+B,EAC/B,IAAoB,EACpB,UAAkB,EAClB,GAAY;IAEZ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAClC,CAAC"}

package/dist/src/ui/dashboard_auth.d.ts

@@ -0,0 +1,34 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import { type ResolvedDashboardAuth } from './auth.js';
+/**
+ * The AdonisJS glue for the built-in `dashboardAuth` session — the ONLY place that touches an
+ * `HttpContext`, so the decision logic in `auth.ts`/`session_cookie.ts` stays framework-light and
+ * unit-testable. Reads and writes the signed session via AdonisJS's NATIVE `plainCookie` API (the
+ * value carries its own HMAC signature, so `encode: false` skips Adonis's redundant cookie signing).
+ *
+ * The provider composes {@link enforceDashboardAuth} AFTER its existing `authorize` guard: both must
+ * pass. When `dashboardAuth` is unconfigured the provider simply never calls this, so behavior is
+ * byte-for-byte unchanged.
+ */
+/** Read the raw (unencoded) session cookie value, or `undefined` when absent/blank. */
+export declare function readSessionCookie(ctx: HttpContext): string | undefined;
+/**
+ * Write the signed session as an unsigned (`plainCookie`, `encode: false`) cookie — the value
+ * carries its own HMAC signature, so AdonisJS's cookie signing would be redundant double-wrapping.
+ * `HttpOnly` + `SameSite=Lax` (blocks cross-site POSTs carrying the cookie — CSRF coverage) +
+ * `Secure` on https. `Path=/` so it reaches both the SPA and the API mounts regardless of prefix.
+ */
+export declare function writeSessionCookie(ctx: HttpContext, auth: ResolvedDashboardAuth, value: string): void;
+/** Clear the session cookie (logout). `Path=/` mirrors {@link writeSessionCookie}. */
+export declare function clearSessionCookie(ctx: HttpContext): void;
+/**
+ * The session half of the composed dashboard guard, run AFTER the `authorize` hook has passed.
+ * Reads the session cookie, and on no valid session either redirects a `page` navigation `302` to
+ * the login page (carrying a `returnTo`) or answers an `api` request with a plain `401`. Returns
+ * `true` to allow the request through (valid session), `false` when it has already written the
+ * response and the route must short-circuit.
+ *
+ * Callers only invoke this when `dashboardAuth` is configured, so `auth` is always non-null here.
+ */
+export declare function enforceDashboardAuth(ctx: HttpContext, auth: ResolvedDashboardAuth, mode: 'page' | 'api', basePath: string): Promise<boolean>;
+//# sourceMappingURL=dashboard_auth.d.ts.map

package/dist/src/ui/dashboard_auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard_auth.d.ts","sourceRoot":"","sources":["../../../src/ui/dashboard_auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,KAAK,qBAAqB,EAA4C,MAAM,WAAW,CAAC;AAEjG;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,GACZ,IAAI,CASN;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/src/ui/dashboard_auth.js

@@ -0,0 +1,57 @@
+import { SESSION_COOKIE_NAME, decideDashboardAuth } from './auth.js';
+/**
+ * The AdonisJS glue for the built-in `dashboardAuth` session — the ONLY place that touches an
+ * `HttpContext`, so the decision logic in `auth.ts`/`session_cookie.ts` stays framework-light and
+ * unit-testable. Reads and writes the signed session via AdonisJS's NATIVE `plainCookie` API (the
+ * value carries its own HMAC signature, so `encode: false` skips Adonis's redundant cookie signing).
+ *
+ * The provider composes {@link enforceDashboardAuth} AFTER its existing `authorize` guard: both must
+ * pass. When `dashboardAuth` is unconfigured the provider simply never calls this, so behavior is
+ * byte-for-byte unchanged.
+ */
+/** Read the raw (unencoded) session cookie value, or `undefined` when absent/blank. */
+export function readSessionCookie(ctx) {
+    const value = ctx.request.plainCookie(SESSION_COOKIE_NAME, undefined, false);
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/**
+ * Write the signed session as an unsigned (`plainCookie`, `encode: false`) cookie — the value
+ * carries its own HMAC signature, so AdonisJS's cookie signing would be redundant double-wrapping.
+ * `HttpOnly` + `SameSite=Lax` (blocks cross-site POSTs carrying the cookie — CSRF coverage) +
+ * `Secure` on https. `Path=/` so it reaches both the SPA and the API mounts regardless of prefix.
+ */
+export function writeSessionCookie(ctx, auth, value) {
+    ctx.response.plainCookie(SESSION_COOKIE_NAME, value, {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: ctx.request.secure(),
+        path: '/',
+        maxAge: Math.floor(auth.ttlMs / 1000),
+        encode: false,
+    });
+}
+/** Clear the session cookie (logout). `Path=/` mirrors {@link writeSessionCookie}. */
+export function clearSessionCookie(ctx) {
+    ctx.response.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
+}
+/**
+ * The session half of the composed dashboard guard, run AFTER the `authorize` hook has passed.
+ * Reads the session cookie, and on no valid session either redirects a `page` navigation `302` to
+ * the login page (carrying a `returnTo`) or answers an `api` request with a plain `401`. Returns
+ * `true` to allow the request through (valid session), `false` when it has already written the
+ * response and the route must short-circuit.
+ *
+ * Callers only invoke this when `dashboardAuth` is configured, so `auth` is always non-null here.
+ */
+export async function enforceDashboardAuth(ctx, auth, mode, basePath) {
+    const decision = decideDashboardAuth(auth, readSessionCookie(ctx), mode, ctx.request.url(true));
+    if (decision.kind === 'allow')
+        return true;
+    if (decision.kind === 'redirect') {
+        ctx.response.redirect().withQs('returnTo', decision.returnTo).toPath(`${basePath}/login`);
+        return false;
+    }
+    ctx.response.status(401).json({ error: 'unauthorized' });
+    return false;
+}
+//# sourceMappingURL=dashboard_auth.js.map

package/dist/src/ui/dashboard_auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard_auth.js","sourceRoot":"","sources":["../../../src/ui/dashboard_auth.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEjG;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAgB,EAChB,IAA2B,EAC3B,KAAa;IAEb,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,KAAK,EAAE;QACnD,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE;QAC5B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,GAAgB;IACjD,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAgB,EAChB,IAA2B,EAC3B,IAAoB,EACpB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/ui/define_config.d.ts

@@ -1,3 +1,4 @@
+import { type DashboardAuthOptions, type ResolvedDashboardAuth } from './auth.js';
 import type { UiHttpContext } from './http.js';
 /**
  * The decision hook gating the dashboard + JSON API. Return `true` to allow the
@@ -52,6 +53,18 @@ export interface TelescopeUiConfig {
      * is supplied). Lets you gate a production dashboard without writing a hook.
      */
     credentials?: UiCredentials;
+    /**
+     * Optional built-in login screen. When set, the provider mounts a server-rendered
+     * `GET <path>/login` page plus `POST <path>/login` / `GET <path>/logout`, and stamps a session
+     * guard on the dashboard: an unauthenticated page navigation is redirected (`302`) to the login
+     * page and an unauthenticated API request gets `401`. The signed session cookie is minted only by
+     * the host's {@link DashboardAuthOptions.login} hook.
+     *
+     * This is ADDITIVE and composes WITH {@link authorize} (both must pass) — it does not replace it.
+     * Omit it entirely to keep today's behavior byte-for-byte (no login/logout routes, no session
+     * guard). Missing `secret`/`login` fails closed at boot.
+     */
+    dashboardAuth?: DashboardAuthOptions;
     /**
      * Request REPLAY: re-issue a captured `request` entry against the LOCAL server
      * from the dashboard. DISABLED BY DEFAULT — replaying re-runs a real request
@@ -81,6 +94,8 @@ export interface ResolvedTelescopeUiConfig {
     path: string;
     authorize: AuthorizeHook;
     credentials: UiCredentials;
+    /** Resolved built-in login config, or `null` when `dashboardAuth` is unconfigured. */
+    dashboardAuth: ResolvedDashboardAuth | null;
     /** Resolved request-replay settings (disabled by default). */
     replay: {
         enabled: boolean;

package/dist/src/ui/define_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAG5B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAS1E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CAcvF"}
+{"version":3,"file":"define_config.d.ts","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAE3B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAGrC;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,aAAa,CAAC;IAC3B,sFAAsF;IACtF,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,MAAM,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAEzE;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAiDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,aAAa,GAAG,aAAa,CAS1E;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,MAAM,GAAE,iBAAsB,GAAG,yBAAyB,CAiBvF"}

package/dist/src/ui/define_config.js

@@ -1,3 +1,4 @@
+import { resolveDashboardAuth, } from './auth.js';
 /**
  * Identity helper giving `config/telescope_ui.ts` full type-checking. Mirrors the
  * AdonisJS `defineConfig` convention.
@@ -99,6 +100,9 @@ export function resolveConfig(config = {}) {
         path: normalizePath(config.path ?? '/telescope'),
         authorize: config.authorize ?? defaultAuthorize(credentials),
         credentials,
+        // Validate + resolve now so a misconfigured secret/login fails closed at boot, not on the first
+        // login attempt. `null` when `dashboardAuth` is omitted (behavior unchanged).
+        dashboardAuth: resolveDashboardAuth(config.dashboardAuth),
         replay: {
             // Safe default: replay is OFF unless the host explicitly enables it.
             enabled: config.replay?.enabled ?? false,

package/dist/src/ui/define_config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AA2FA;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,SAA4B,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/ui/define_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oBAAoB,GACrB,MAAM,WAAW,CAAC;AA2GnB;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAkB,EAAE,KAA6C;IACrF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAA0B;IACzD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzF,OAAO,CAAC,YAAY,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,SAA4B,EAAE;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;QAC/B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;QAChD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,gGAAgG;QAChG,8EAA8E;QAC9E,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC;QACzD,MAAM,EAAE;YACN,qEAAqE;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;YACxC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F;KACF,CAAC;AACJ,CAAC"}

package/dist/src/ui/index.d.ts

@@ -1,7 +1,13 @@
 /** Keep in sync with this package's `version` in package.json. */
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.5.0";
 export { defineConfig, resolveConfig, normalizePath, defaultAuthorize } from './define_config.js';
 export type { AuthorizeHook, ReplayConfig, ResolvedTelescopeUiConfig, TelescopeUiConfig, UiCredentials, } from './define_config.js';
+export { resolveDashboardAuth, performLogin, readSession, sanitizeReturnTo, decideDashboardAuth, SESSION_COOKIE_NAME, } from './auth.js';
+export type { DashboardAuthOptions, ResolvedDashboardAuth, LoginHook, LoginOutcome, DashboardAuthDecision, } from './auth.js';
+export { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+export type { DashboardSession, DashboardSessionUser, SignOptions, VerifyOptions, } from './session_cookie.js';
+export { renderLoginPage } from './login_page.js';
+export { readSessionCookie, writeSessionCookie, clearSessionCookie, enforceDashboardAuth, } from './dashboard_auth.js';
 export { RecordingResponse, RecordingSink, formatSseFrame, formatSseHeartbeat, makeRequest, } from './http.js';
 export type { SseSink, UiHttpContext, UiRequest, UiResponse } from './http.js';
 export { enforceGuard, runGuard } from './guard.js';

package/dist/src/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EACV,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClG,YAAY,EACV,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,SAAS,EACT,YAAY,EACZ,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/ui/index.js

@@ -1,7 +1,12 @@
 /** Keep in sync with this package's `version` in package.json. */
-export const VERSION = '0.4.0';
+export const VERSION = '0.5.0';
 // — config —
 export { defineConfig, resolveConfig, normalizePath, defaultAuthorize } from './define_config.js';
+// — built-in `dashboardAuth` login screen (optional; opt-in via `config/telescope_ui.ts`) —
+export { resolveDashboardAuth, performLogin, readSession, sanitizeReturnTo, decideDashboardAuth, SESSION_COOKIE_NAME, } from './auth.js';
+export { signSessionCookie, verifySessionCookie, } from './session_cookie.js';
+export { renderLoginPage } from './login_page.js';
+export { readSessionCookie, writeSessionCookie, clearSessionCookie, enforceDashboardAuth, } from './dashboard_auth.js';
 // — HTTP shapes (framework-light) —
 export { RecordingResponse, RecordingSink, formatSseFrame, formatSseHeartbeat, makeRequest, } from './http.js';
 // — auth guard —

package/dist/src/ui/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,aAAa;AACb,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AASlG,oCAAoC;AACpC,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,WAAW,CAAC;AAGnB,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGpD,eAAe;AACf,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG/D,qBAAqB;AACrB,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAG7B,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,aAAa;AACb,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AASlG,4FAA4F;AAC5F,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAQnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,oCAAoC;AACpC,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,WAAW,CAAC;AAGnB,iBAAiB;AACjB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGpD,eAAe;AACf,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG/D,qBAAqB;AACrB,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAG7B,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/src/ui/login_page.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The built-in `dashboardAuth` login page (`GET <basePath>/login`). Deliberately a small,
+ * dependency-free, hand-authored HTML page — NOT part of the bundled dashboard SPA — so gating the
+ * dashboard shell doesn't require rebuilding or extending the bundled Vite app.
+ *
+ * `returnTo` and any error state are read CLIENT-SIDE from `location.search` (never server-echoed
+ * into the HTML), so this function's only per-request-ish input is `basePath` — a developer-
+ * controlled config value, not user input — and the page body is otherwise a static template.
+ * This sidesteps HTML-escaping entirely: there is no reflected query-param interpolation surface
+ * to get wrong.
+ *
+ * The visual language (dark zinc card, mono type, emerald accent) mirrors the Agora consoles so
+ * they feel like one family. The submit flow POSTs JSON via `fetch` and follows the JSON
+ * `redirectTo` it gets back (rather than a classic form POST + server redirect), which is why the
+ * markup keeps its own `<script>`.
+ *
+ * The password input has NO `required` attribute and the value is forwarded AS-IS (empty string
+ * when blank): the host's `login` hook — not this page — decides whether a password matters, so an
+ * email-only host (gate on username, ignore password) works with the same page as a host with real
+ * passwords.
+ */
+export declare function renderLoginPage(basePath: string): string;
+//# sourceMappingURL=login_page.d.ts.map

package/dist/src/ui/login_page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login_page.d.ts","sourceRoot":"","sources":["../../../src/ui/login_page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmJxD"}