@dudousxd/nestjs-durable-dashboard 0.37.0 → 0.38.0

package/dist/server/index.d.cts

@@ -18,11 +18,48 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` per
- * session, so a DB round-trip here is cheap. Return `false` to revoke (the cookie is cleared and
- * the request denied). Distinct from `session`: that hook reads the host's auth off a fresh
- * request, which a console XHR does not carry — this one receives the already-minted session.
+ * session, so a DB round-trip here is cheap — this holds even under concurrent traffic: N parallel
+ * requests carrying the same past-half-life cookie share ONE call (see `revalidateOnce` in
+ * `session-cookie-io.ts`), not N. Return `false` to revoke (the cookie is cleared and the request
+ * denied). Distinct from `session`: that hook reads the host's auth off a fresh request, which a
+ * console XHR does not carry — this one receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
+/** What `unauthenticatedPage` receives. An object (not positional args) so fields can be added later. */
+interface UnauthenticatedPageContext {
+    /**
+     * The platform-native request — Express' `Request`, Fastify's `FastifyRequest`. Typed `unknown`
+     * for the same reason `SessionHook`'s is: this package refuses to depend on either platform.
+     * Cast it to whatever your app actually runs on.
+     */
+    request: unknown;
+    /**
+     * The platform-native response. The hook OWNS it: it must write AND end it (`res.render(...)`,
+     * `res.status(401).send(...)`, an Inertia render, ...). If the hook returns without writing, the
+     * library falls back to its own built-in page rather than leaving the request hanging.
+     */
+    response: unknown;
+    /** Where this console is mounted (e.g. `/durable`) — useful for a "back to the console" link. */
+    basePath: string;
+}
+/**
+ * Host-owned page for an unauthenticated full-page navigation to the console.
+ *
+ * The built-in page cannot know who hosts the console, so it can only say "open this console from
+ * your application" in the abstract — it can't name the launcher, link to it, or look like the rest
+ * of the host's product. This hook hands the whole response to the host instead: render through
+ * your own template engine, your own Inertia page, whatever. The page is served AT the console's
+ * own URL, so `/durable` stays `/durable`.
+ *
+ * Deliberately NOT a replacement for Mode B's built-in login form. A host that wants its own login
+ * UI uses Mode A plus this hook, and posts to `<basePath>/session` from its own page — the mint
+ * endpoint is the supported primitive for that.
+ *
+ * Fail-closed by construction: it only ever runs on a request that has ALREADY been denied. A hook
+ * that throws, or that returns without writing, falls back to the built-in page — it cannot let
+ * anyone in.
+ */
+type UnauthenticatedPageHook = (context: UnauthenticatedPageContext) => void | Promise<void>;
 type AuthMode = 'session' | 'login';
 /**
  * Author-facing `dashboardAuth` option on `DurableDashboardModule.forRoot`/`forRootAsync`. Gates
@@ -50,6 +87,9 @@ interface DashboardAuthOptions {
     /** Re-checks a live session on sliding renewal; see `RevalidateHook`. Not a mode — it cannot
      *  mint a session, only revoke one already minted by `session`/`login`. */
     revalidate?: RevalidateHook;
+    /** Renders the host's own page for an unauthenticated navigation, in place of the built-in
+     *  "open this console from your application" card; see `UnauthenticatedPageHook`. */
+    unauthenticatedPage?: UnauthenticatedPageHook;
 }
 /** Resolved, validated `dashboardAuth` config shared by the guards, auth controller, and login page. */
 interface ResolvedDashboardAuth {
@@ -59,6 +99,7 @@ interface ResolvedDashboardAuth {
     session?: SessionHook;
     login?: LoginHook;
     revalidate?: RevalidateHook;
+    unauthenticatedPage?: UnauthenticatedPageHook;
 }
 
 /**
@@ -418,6 +459,13 @@ declare class DurableApiSessionGuard implements CanActivate {
     private readonly auth;
     constructor(auth: ResolvedDashboardAuth | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+     * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+     * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+     * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+     */
+    private unauthorized;
 }
 
 /** DI token carrying the UI mount base (e.g. `/durable`). */
@@ -446,4 +494,4 @@ declare class DurableUiController {
     asset(file: string): StreamableFile;
 }
 
-export { DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type DashboardSessionUser, DurableApiController, DurableApiModule, DurableApiSessionGuard, DurableAuthController, type DurableDashboardAsyncOptions, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiSessionGuard };
+export { DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type DashboardSessionUser, DurableApiController, DurableApiModule, DurableApiSessionGuard, DurableAuthController, type DurableDashboardAsyncOptions, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiSessionGuard, type UnauthenticatedPageContext, type UnauthenticatedPageHook };

package/dist/server/index.d.ts

@@ -18,11 +18,48 @@ type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> |
 type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
 /**
  * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` per
- * session, so a DB round-trip here is cheap. Return `false` to revoke (the cookie is cleared and
- * the request denied). Distinct from `session`: that hook reads the host's auth off a fresh
- * request, which a console XHR does not carry — this one receives the already-minted session.
+ * session, so a DB round-trip here is cheap — this holds even under concurrent traffic: N parallel
+ * requests carrying the same past-half-life cookie share ONE call (see `revalidateOnce` in
+ * `session-cookie-io.ts`), not N. Return `false` to revoke (the cookie is cleared and the request
+ * denied). Distinct from `session`: that hook reads the host's auth off a fresh request, which a
+ * console XHR does not carry — this one receives the already-minted session.
  */
 type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
+/** What `unauthenticatedPage` receives. An object (not positional args) so fields can be added later. */
+interface UnauthenticatedPageContext {
+    /**
+     * The platform-native request — Express' `Request`, Fastify's `FastifyRequest`. Typed `unknown`
+     * for the same reason `SessionHook`'s is: this package refuses to depend on either platform.
+     * Cast it to whatever your app actually runs on.
+     */
+    request: unknown;
+    /**
+     * The platform-native response. The hook OWNS it: it must write AND end it (`res.render(...)`,
+     * `res.status(401).send(...)`, an Inertia render, ...). If the hook returns without writing, the
+     * library falls back to its own built-in page rather than leaving the request hanging.
+     */
+    response: unknown;
+    /** Where this console is mounted (e.g. `/durable`) — useful for a "back to the console" link. */
+    basePath: string;
+}
+/**
+ * Host-owned page for an unauthenticated full-page navigation to the console.
+ *
+ * The built-in page cannot know who hosts the console, so it can only say "open this console from
+ * your application" in the abstract — it can't name the launcher, link to it, or look like the rest
+ * of the host's product. This hook hands the whole response to the host instead: render through
+ * your own template engine, your own Inertia page, whatever. The page is served AT the console's
+ * own URL, so `/durable` stays `/durable`.
+ *
+ * Deliberately NOT a replacement for Mode B's built-in login form. A host that wants its own login
+ * UI uses Mode A plus this hook, and posts to `<basePath>/session` from its own page — the mint
+ * endpoint is the supported primitive for that.
+ *
+ * Fail-closed by construction: it only ever runs on a request that has ALREADY been denied. A hook
+ * that throws, or that returns without writing, falls back to the built-in page — it cannot let
+ * anyone in.
+ */
+type UnauthenticatedPageHook = (context: UnauthenticatedPageContext) => void | Promise<void>;
 type AuthMode = 'session' | 'login';
 /**
  * Author-facing `dashboardAuth` option on `DurableDashboardModule.forRoot`/`forRootAsync`. Gates
@@ -50,6 +87,9 @@ interface DashboardAuthOptions {
     /** Re-checks a live session on sliding renewal; see `RevalidateHook`. Not a mode — it cannot
      *  mint a session, only revoke one already minted by `session`/`login`. */
     revalidate?: RevalidateHook;
+    /** Renders the host's own page for an unauthenticated navigation, in place of the built-in
+     *  "open this console from your application" card; see `UnauthenticatedPageHook`. */
+    unauthenticatedPage?: UnauthenticatedPageHook;
 }
 /** Resolved, validated `dashboardAuth` config shared by the guards, auth controller, and login page. */
 interface ResolvedDashboardAuth {
@@ -59,6 +99,7 @@ interface ResolvedDashboardAuth {
     session?: SessionHook;
     login?: LoginHook;
     revalidate?: RevalidateHook;
+    unauthenticatedPage?: UnauthenticatedPageHook;
 }
 
 /**
@@ -418,6 +459,13 @@ declare class DurableApiSessionGuard implements CanActivate {
     private readonly auth;
     constructor(auth: ResolvedDashboardAuth | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+     * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+     * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+     * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+     */
+    private unauthorized;
 }
 
 /** DI token carrying the UI mount base (e.g. `/durable`). */
@@ -446,4 +494,4 @@ declare class DurableUiController {
     asset(file: string): StreamableFile;
 }
 
-export { DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type DashboardSessionUser, DurableApiController, DurableApiModule, DurableApiSessionGuard, DurableAuthController, type DurableDashboardAsyncOptions, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiSessionGuard };
+export { DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type DashboardSessionUser, DurableApiController, DurableApiModule, DurableApiSessionGuard, DurableAuthController, type DurableDashboardAsyncOptions, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiSessionGuard, type UnauthenticatedPageContext, type UnauthenticatedPageHook };

package/dist/server/index.js

@@ -518,7 +518,7 @@ DurableApiController = _ts_decorate2([
 ], DurableApiController);
 
 // src/server/durable-auth.controller.ts
-import { BadRequestException, Body as Body2, Controller as Controller3, Get as Get3, Header as Header3, HttpCode, Inject as Inject3, Logger, NotFoundException as NotFoundException3, Optional as Optional2, Post as Post2, Req, Res, UnauthorizedException } from "@nestjs/common";
+import { BadRequestException, Body as Body2, Controller as Controller3, Get as Get3, Header as Header3, HttpCode, Inject as Inject4, Logger as Logger2, NotFoundException as NotFoundException3, Optional as Optional3, Post as Post2, Req, Res, UnauthorizedException } from "@nestjs/common";
 
 // src/server/auth/dashboard-auth-config.ts
 var DASHBOARD_AUTH = Symbol("DASHBOARD_AUTH");
@@ -559,6 +559,9 @@ function resolveDashboardAuth(options) {
   if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
     throw new Error("DurableDashboardModule: dashboardAuth.revalidate must be a function.");
   }
+  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
+    throw new Error("DurableDashboardModule: dashboardAuth.unauthenticatedPage must be a function.");
+  }
   if (modes.length === 0) {
     throw new Error("DurableDashboardModule: dashboardAuth needs at least one of `session` or `login` (otherwise the cookie can never be minted). Failing closed.");
   }
@@ -574,6 +577,9 @@ function resolveDashboardAuth(options) {
     } : {},
     ...options.revalidate !== void 0 ? {
       revalidate: options.revalidate
+    } : {},
+    ...options.unauthenticatedPage !== void 0 ? {
+      unauthenticatedPage: options.unauthenticatedPage
     } : {}
   };
 }
@@ -850,6 +856,11 @@ function redirectRaw(response, location, status = 302) {
   raw.end();
 }
 __name(redirectRaw, "redirectRaw");
+function responseAlreadyWritten(response) {
+  const raw = resolveRedirectResponse(response);
+  return raw?.headersSent === true;
+}
+__name(responseAlreadyWritten, "responseAlreadyWritten");
 function writeHtmlRaw(response, html, status = 200) {
   const raw = resolveRedirectResponse(response);
   if (!raw) return;
@@ -1014,6 +1025,20 @@ function readSessionFromRequest(auth, request) {
   });
 }
 __name(readSessionFromRequest, "readSessionFromRequest");
+var inFlightRevalidations = /* @__PURE__ */ new Map();
+function revalidateOnce(auth, user) {
+  const revalidate = auth.revalidate;
+  if (!revalidate) return Promise.resolve(true);
+  const key = `${auth.secret}:${user.id}`;
+  const inFlight = inFlightRevalidations.get(key);
+  if (inFlight) return inFlight;
+  const call = Promise.resolve().then(() => revalidate(user)).catch(() => false).finally(() => {
+    inFlightRevalidations.delete(key);
+  });
+  inFlightRevalidations.set(key, call);
+  return call;
+}
+__name(revalidateOnce, "revalidateOnce");
 async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
   if (now - session.iat <= auth.ttlMs / 2) return true;
   const user = {
@@ -1023,20 +1048,13 @@ async function maybeRenewSession(auth, session, request, response, now = Date.no
     } : {},
     roles: session.roles
   };
-  if (auth.revalidate) {
-    let allowed;
-    try {
-      allowed = await auth.revalidate(user);
-    } catch {
-      allowed = false;
-    }
-    if (!allowed) {
-      clearSessionCookie({
-        request,
-        response
-      });
-      return false;
-    }
+  const allowed = await revalidateOnce(auth, user);
+  if (!allowed) {
+    clearSessionCookie({
+      request,
+      response
+    });
+    return false;
   }
   issueSessionCookie(user, {
     auth,
@@ -1052,7 +1070,7 @@ __name(maybeRenewSession, "maybeRenewSession");
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject2, NotFoundException as NotFoundException2, Param as Param2, StreamableFile, UseFilters } from "@nestjs/common";
+import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, StreamableFile, UseFilters } from "@nestjs/common";
 
 // src/server/auth/login-redirect.exception.ts
 import { Catch, HttpException, HttpStatus } from "@nestjs/common";
@@ -1088,7 +1106,7 @@ DashboardLoginRedirectFilter = _ts_decorate3([
 ], DashboardLoginRedirectFilter);
 
 // src/server/auth/session-required.exception.ts
-import { Catch as Catch2, HttpException as HttpException2, HttpStatus as HttpStatus2 } from "@nestjs/common";
+import { Catch as Catch2, HttpException as HttpException2, HttpStatus as HttpStatus2, Inject as Inject2, Logger, Optional as Optional2 } from "@nestjs/common";
 function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1096,6 +1114,16 @@ function _ts_decorate4(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
 var DashboardSessionRequiredException = class extends HttpException2 {
   static {
     __name(this, "DashboardSessionRequiredException");
@@ -1107,17 +1135,51 @@ var DashboardSessionRequiredException = class extends HttpException2 {
     }, HttpStatus2.UNAUTHORIZED), this.basePath = basePath;
   }
 };
-var DashboardSessionRequiredFilter = class {
+var DashboardSessionRequiredFilter = class _DashboardSessionRequiredFilter {
   static {
     __name(this, "DashboardSessionRequiredFilter");
   }
-  catch(exception, host) {
-    const response = host.switchToHttp().getResponse();
+  auth;
+  logger = new Logger(_DashboardSessionRequiredFilter.name);
+  warned = false;
+  constructor(auth = null) {
+    this.auth = auth;
+  }
+  async catch(exception, host) {
+    const http = host.switchToHttp();
+    const response = http.getResponse();
+    const hook = this.auth?.unauthenticatedPage;
+    if (hook) {
+      try {
+        await hook({
+          request: http.getRequest(),
+          response,
+          basePath: exception.basePath
+        });
+        if (responseAlreadyWritten(response)) return;
+        this.warnOnce("dashboardAuth.unauthenticatedPage returned without writing a response; falling back to the built-in page. The hook must write AND end the response it is given.");
+      } catch (error) {
+        this.warnOnce(`dashboardAuth.unauthenticatedPage threw; falling back to the built-in page. ${String(error)}`);
+        if (responseAlreadyWritten(response)) return;
+      }
+    }
     writeHtmlRaw(response, renderSessionRequiredPage(exception.basePath), HttpStatus2.UNAUTHORIZED);
   }
+  /** Once per process, not once per request: a broken hook fires on every denied navigation. */
+  warnOnce(message) {
+    if (this.warned) return;
+    this.warned = true;
+    this.logger.warn(message);
+  }
 };
 DashboardSessionRequiredFilter = _ts_decorate4([
-  Catch2(DashboardSessionRequiredException)
+  Catch2(DashboardSessionRequiredException),
+  _ts_param3(0, Optional2()),
+  _ts_param3(0, Inject2(DASHBOARD_AUTH)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    Object
+  ])
 ], DashboardSessionRequiredFilter);
 
 // src/server/durable-ui.controller.ts
@@ -1128,16 +1190,16 @@ function _ts_decorate5(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata3(k, v) {
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param4, "_ts_param");
 var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
 var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
 var BUILD_BASE = "/durable";
@@ -1194,27 +1256,27 @@ _ts_decorate5([
   Get2(),
   Header2("Content-Type", "text/html; charset=utf-8"),
   Header2("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", String)
 ], DurableUiController.prototype, "index", null);
 _ts_decorate5([
   Get2("assets/:file"),
   Header2("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, Param2("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param4(0, Param2("file")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata4("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], DurableUiController.prototype, "asset", null);
 DurableUiController = _ts_decorate5([
   UseFilters(DashboardLoginRedirectFilter, DashboardSessionRequiredFilter),
   Controller2(),
-  _ts_param3(0, Inject2(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, Inject2(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param4(0, Inject3(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, Inject3(DASHBOARD_API_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ])
@@ -1228,16 +1290,16 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata4(k, v) {
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param5, "_ts_param");
 function isString(value) {
   return typeof value === "string";
 }
@@ -1248,7 +1310,7 @@ var DurableAuthController = class _DurableAuthController {
   }
   auth;
   basePath;
-  logger = new Logger(_DurableAuthController.name);
+  logger = new Logger2(_DurableAuthController.name);
   /** Warn once per hook kind so a throwing hook doesn't spam logs on every failed attempt. */
   warnedHooks = /* @__PURE__ */ new Set();
   constructor(auth, basePath) {
@@ -1260,7 +1322,7 @@ var DurableAuthController = class _DurableAuthController {
   // the developer-controlled `basePath`.
   loginPage() {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException3();
+    if (!auth.modes.includes("login")) throw new NotFoundException3();
     return renderLoginPage(this.basePath);
   }
   // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
@@ -1269,7 +1331,7 @@ var DurableAuthController = class _DurableAuthController {
   // (unknown user, wrong password, throwing hook) — no user-enumeration.
   async login(body, request, response) {
     const auth = this.requireAuth();
-    if (!auth.login) throw new NotFoundException3();
+    if (!auth.modes.includes("login")) throw new NotFoundException3();
     if (!isString(body?.username) || !isString(body?.password)) {
       throw new BadRequestException("Body must include string `username` and `password`.");
     }
@@ -1292,7 +1354,7 @@ var DurableAuthController = class _DurableAuthController {
   // guard decides, and no credential ever reaches this library.
   async session(request, response) {
     const auth = this.requireAuth();
-    if (!auth.session) throw new NotFoundException3();
+    if (!auth.modes.includes("session")) throw new NotFoundException3();
     const user = await this.runHook("session", () => auth.session?.(request) ?? null);
     if (!user) throw new UnauthorizedException();
     issueSessionCookie(user, {
@@ -1310,7 +1372,7 @@ var DurableAuthController = class _DurableAuthController {
       request,
       response
     });
-    redirectRaw(response, this.auth?.login ? `${this.basePath}/login` : this.basePath);
+    redirectRaw(response, this.auth?.modes.includes("login") ? `${this.basePath}/login` : this.basePath);
   }
   requireAuth() {
     if (!this.auth) throw new NotFoundException3();
@@ -1337,58 +1399,58 @@ _ts_decorate6([
   Get3("login"),
   Header3("Content-Type", "text/html; charset=utf-8"),
   Header3("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", String)
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", String)
 ], DurableAuthController.prototype, "loginPage", null);
 _ts_decorate6([
   Post2("login"),
   HttpCode(200),
-  _ts_param4(0, Body2()),
-  _ts_param4(1, Req()),
-  _ts_param4(2, Res({
+  _ts_param5(0, Body2()),
+  _ts_param5(1, Req()),
+  _ts_param5(2, Res({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof LoginBody === "undefined" ? Object : LoginBody,
     Object,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableAuthController.prototype, "login", null);
 _ts_decorate6([
   Post2("session"),
   HttpCode(204),
-  _ts_param4(0, Req()),
-  _ts_param4(1, Res({
+  _ts_param5(0, Req()),
+  _ts_param5(1, Res({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     Object,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableAuthController.prototype, "session", null);
 _ts_decorate6([
   Get3("logout"),
-  _ts_param4(0, Req()),
-  _ts_param4(1, Res()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param5(0, Req()),
+  _ts_param5(1, Res()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     Object,
     Object
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableAuthController.prototype, "logout", null);
 DurableAuthController = _ts_decorate6([
   Controller3(),
-  _ts_param4(0, Optional2()),
-  _ts_param4(0, Inject3(DASHBOARD_AUTH)),
-  _ts_param4(1, Inject3(DASHBOARD_BASE_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param5(0, Optional3()),
+  _ts_param5(0, Inject4(DASHBOARD_AUTH)),
+  _ts_param5(1, Inject4(DASHBOARD_BASE_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     Object,
     String
   ])
@@ -1400,7 +1462,7 @@ import { Module } from "@nestjs/common";
 import { RouterModule } from "@nestjs/core";
 
 // src/server/durable-session.guard.ts
-import { Inject as Inject4, Injectable as Injectable2, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+import { Inject as Inject5, Injectable as Injectable2, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
 function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1408,16 +1470,16 @@ function _ts_decorate7(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata5(k, v) {
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param5, "_ts_param");
+__name(_ts_param6, "_ts_param");
 var DurableUiSessionGuard = class {
   static {
     __name(this, "DurableUiSessionGuard");
@@ -1453,17 +1515,17 @@ var DurableUiSessionGuard = class {
   * asserting away) the nullability.
   */
   denyUnauthenticated(auth, request) {
-    if (!auth.login) throw new DashboardSessionRequiredException(this.basePath);
+    if (!auth.modes.includes("login")) throw new DashboardSessionRequiredException(this.basePath);
     const returnTo = encodeURIComponent(originalRequestUrl(request));
     throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
   }
 };
 DurableUiSessionGuard = _ts_decorate7([
   Injectable2(),
-  _ts_param5(0, Inject4(DASHBOARD_AUTH)),
-  _ts_param5(1, Inject4(DASHBOARD_BASE_PATH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_param6(0, Inject5(DASHBOARD_AUTH)),
+  _ts_param6(1, Inject5(DASHBOARD_BASE_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     Object,
     String
   ])
@@ -1478,21 +1540,35 @@ var DurableApiSessionGuard = class {
   }
   async canActivate(context) {
     if (!this.auth) return true;
+    const auth = this.auth;
     const http = context.switchToHttp();
     const request = http.getRequest();
-    const session = readSessionFromRequest(this.auth, request);
-    if (!session) throw new UnauthorizedException2();
-    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
-      throw new UnauthorizedException2();
+    const session = readSessionFromRequest(auth, request);
+    if (!session) throw this.unauthorized(auth);
+    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
+      throw this.unauthorized(auth);
     }
     return true;
   }
+  /**
+  * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
+  * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
+  * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
+  * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
+  */
+  unauthorized(auth) {
+    return new UnauthorizedException2({
+      auth: {
+        modes: auth.modes
+      }
+    });
+  }
 };
 DurableApiSessionGuard = _ts_decorate7([
   Injectable2(),
-  _ts_param5(0, Inject4(DASHBOARD_AUTH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_param6(0, Inject5(DASHBOARD_AUTH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     Object
   ])
 ], DurableApiSessionGuard);