@dudousxd/nestjs-durable-dashboard 0.53.0 → 0.55.0

package/dist/server/index.cjs

@@ -24,21 +24,15 @@ var index_exports = {};
 __export(index_exports, {
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
-  DASHBOARD_GATE: () => DASHBOARD_GATE,
-  DURABLE_DASHBOARD_TOKEN_ENV: () => DURABLE_DASHBOARD_TOKEN_ENV,
+  DASHBOARD_PROTECTION_CHECK: () => DASHBOARD_PROTECTION_CHECK,
   DashboardService: () => DashboardService,
   DurableApiController: () => DurableApiController,
+  DurableApiControllerBase: () => DurableApiControllerBase,
   DurableApiModule: () => DurableApiModule,
-  DurableApiSessionGuard: () => DurableApiSessionGuard,
-  DurableAuthController: () => DurableAuthController,
-  DurableDashboardGateGuard: () => DurableDashboardGateGuard,
   DurableDashboardModule: () => DurableDashboardModule,
   DurableUiController: () => DurableUiController,
-  DurableUiSessionGuard: () => DurableUiSessionGuard,
-  dashboardGateProvider: () => dashboardGateProvider,
-  readDashboardToken: () => readDashboardToken,
-  reportDashboardGate: () => reportDashboardGate,
-  resolveDashboardGate: () => resolveDashboardGate
+  DurableUiControllerBase: () => DurableUiControllerBase,
+  UNPROTECTED_CONSOLE_IN_PRODUCTION: () => UNPROTECTED_CONSOLE_IN_PRODUCTION
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -215,6 +209,51 @@ var DashboardService = class {
     return this.gateway.cancel(runId, opts);
   }
   /**
+  * Publish a settled run's lifecycle event again, to its subscribers that have not started (or to
+  * `subscriber` alone). Undefined when the gateway cannot republish (a tenant proxy).
+  */
+  async republishLifecycle(runId, subscriber) {
+    return this.gateway.republishLifecycle?.({
+      runId,
+      ...subscriber !== void 0 ? {
+        subscriber
+      } : {}
+    });
+  }
+  /**
+  * Who starts whom through lifecycle events, for `workflow`, plus `triggerCounts` when this process
+  * counts the engine's events (the control plane) and the workflow has subscribers. Undefined when
+  * the gateway cannot answer.
+  */
+  async workflowLifecycle(workflow) {
+    const links = await this.gateway.workflowLifecycle?.(workflow);
+    if (!links) return links;
+    const counts = this.triggerCountsOf(links);
+    return counts ? {
+      ...links,
+      triggerCounts: counts
+    } : links;
+  }
+  /**
+  * How many runs each subscriber of `links.workflow` was started for and how many times starting it
+  * failed, counted by this process's metrics since it started. Undefined without metrics (a tenant)
+  * or without subscribers.
+  */
+  triggerCountsOf(links) {
+    const snapshot = this.metricsCollector?.snapshot();
+    if (!snapshot || links.startsOnSettle.length === 0) return void 0;
+    const triggered = snapshot.triggeredBySubscriber[links.workflow] ?? {};
+    const failed = snapshot.triggerFailedBySubscriber[links.workflow] ?? {};
+    const counts = {};
+    for (const { workflow } of links.startsOnSettle) {
+      counts[workflow] = {
+        triggered: triggered[workflow] ?? 0,
+        failed: failed[workflow] ?? 0
+      };
+    }
+    return counts;
+  }
+  /**
   * Apply `retry` or `cancel` to every run matching a filter (status / tag / workflow / namespace /
   * origin) — e.g. "retry every `dead` run tagged `type:mel`". The filter is the same one the run
   * list uses, so a bulk action can never reach wider than the list it was launched from — but note
@@ -392,87 +431,6 @@ __name(runValueAxisFor, "runValueAxisFor");
 
 // src/server/not-modified.ts
 var import_common2 = require("@nestjs/common");
-
-// src/server/auth/response.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord, "isRecord");
-function isRawCookieResponse(value) {
-  return isRecord(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
-}
-__name(isRawCookieResponse, "isRawCookieResponse");
-function resolveCookieResponse(response) {
-  if (isRawCookieResponse(response)) return response;
-  if (isRecord(response) && isRawCookieResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveCookieResponse, "resolveCookieResponse");
-function existingSetCookies(response) {
-  const current = response.getHeader("set-cookie");
-  if (Array.isArray(current)) return current;
-  if (typeof current === "string") return [
-    current
-  ];
-  return [];
-}
-__name(existingSetCookies, "existingSetCookies");
-function appendSetCookie(response, cookie) {
-  const raw = resolveCookieResponse(response);
-  if (!raw) return;
-  raw.setHeader("set-cookie", [
-    ...existingSetCookies(raw),
-    cookie
-  ]);
-}
-__name(appendSetCookie, "appendSetCookie");
-function isRawRedirectResponse(value) {
-  return isRecord(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
-}
-__name(isRawRedirectResponse, "isRawRedirectResponse");
-function resolveRedirectResponse(response) {
-  if (isRawRedirectResponse(response)) return response;
-  if (isRecord(response) && isRawRedirectResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveRedirectResponse, "resolveRedirectResponse");
-function redirectRaw(response, location, status = 302) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("location", location);
-  raw.end();
-}
-__name(redirectRaw, "redirectRaw");
-function responseAlreadyWritten(response) {
-  const raw = resolveRedirectResponse(response);
-  return raw?.headersSent === true;
-}
-__name(responseAlreadyWritten, "responseAlreadyWritten");
-function writeHtmlRaw(response, html, status = 200) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("content-type", "text/html; charset=utf-8");
-  raw.setHeader("cache-control", "no-store, must-revalidate");
-  raw.end(html);
-}
-__name(writeHtmlRaw, "writeHtmlRaw");
-function setRawHeader(response, name, value) {
-  resolveCookieResponse(response)?.setHeader(name, value);
-}
-__name(setRawHeader, "setRawHeader");
-function writeNotModifiedRaw(response, etag) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = 304;
-  raw.setHeader("etag", etag);
-  raw.setHeader("cache-control", "private, no-cache");
-  raw.end();
-}
-__name(writeNotModifiedRaw, "writeNotModifiedRaw");
-
-// src/server/not-modified.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -487,6 +445,31 @@ function _ts_decorate2(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate2, "_ts_decorate");
+function isRawResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return typeof candidate.setHeader === "function" && typeof candidate.end === "function";
+}
+__name(isRawResponse, "isRawResponse");
+function rawResponse(response) {
+  if (isRawResponse(response)) return response;
+  const raw = response?.raw;
+  return isRawResponse(raw) ? raw : null;
+}
+__name(rawResponse, "rawResponse");
+function setRawHeader(response, name, value) {
+  rawResponse(response)?.setHeader(name, value);
+}
+__name(setRawHeader, "setRawHeader");
+function writeNotModifiedRaw(response, etag) {
+  const raw = rawResponse(response);
+  if (!raw) return;
+  raw.statusCode = 304;
+  raw.setHeader("etag", etag);
+  raw.setHeader("cache-control", "private, no-cache");
+  raw.end();
+}
+__name(writeNotModifiedRaw, "writeNotModifiedRaw");
 var NotModifiedException = class extends import_common2.HttpException {
   static {
     __name(this, "NotModifiedException");
@@ -802,10 +785,10 @@ var RunQueryAdapter = class {
     }
     unsupported(clause, "equals, notEquals, gt, gte, lt, lte, in");
   }
-  applyOffsetPagination(qb, page2, size) {
+  applyOffsetPagination(qb, page, size) {
     this.draft(qb).narrow({
       limit: size,
-      offset: (page2 - 1) * size
+      offset: (page - 1) * size
     });
   }
   /**
@@ -1149,9 +1132,9 @@ function _ts_param2(paramIndex, decorator) {
 }
 __name(_ts_param2, "_ts_param");
 var FAN_INLINE_MAX = 50;
-var DurableApiController = class {
+var DurableApiControllerBase = class {
   static {
-    __name(this, "DurableApiController");
+    __name(this, "DurableApiControllerBase");
   }
   dashboard;
   runner;
@@ -1243,6 +1226,15 @@ var DurableApiController = class {
   triggerSchedule(id) {
     return this.dashboard.triggerSchedule(id).catch(notFound);
   }
+  /**
+  * Who starts whom through lifecycle events, for one workflow: the workflows that start when it
+  * settles, and the ones whose settling starts it. What the console's workflow page lists.
+  */
+  async workflowLifecycle(name) {
+    const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
+    if (!links) throw new import_common5.NotImplementedException("workflow lifecycle links need the control plane");
+    return links;
+  }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
   topology() {
     return this.dashboard.topology();
@@ -1272,7 +1264,7 @@ var DurableApiController = class {
   }
   /** One page of a summarized fan's members, in seq order. Versioned like {@link run}. */
   async fanMembers(id, group, offset, limit, failed, ifNoneMatch, response) {
-    const page2 = await this.dashboard.getFanMembers(id, group, {
+    const page = await this.dashboard.getFanMembers(id, group, {
       offset: offset === void 0 ? void 0 : Number(offset),
       limit: limit === void 0 ? void 0 : Number(limit),
       failedOnly: failed === "true",
@@ -1280,8 +1272,8 @@ var DurableApiController = class {
         ifNoneMatch
       }
     });
-    if (!page2) throw new import_common5.NotFoundException(`fan ${group} of run ${id} not found`);
-    const { etag, notModified, ...body } = page2;
+    if (!page) throw new import_common5.NotFoundException(`fan ${group} of run ${id} not found`);
+    const { etag, notModified, ...body } = page;
     if (etag) {
       if (notModified) throw new NotModifiedException(etag);
       setEtag(response, etag);
@@ -1318,6 +1310,28 @@ var DurableApiController = class {
     if (!result) throw new import_common5.NotFoundException(`run ${id} not found`);
     return result;
   }
+  /**
+  * Publish a settled run's lifecycle event again, to the subscribers that have not started from it
+  * (or only `subscriber`). Same gate as retry/cancel.
+  */
+  async republishLifecycle(id, body) {
+    let result;
+    try {
+      result = await this.dashboard.republishLifecycle(id, body?.subscriber || void 0);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (/^run .* not found$/.test(message)) throw new import_common5.NotFoundException(message);
+      if (/^run .* has not settled/.test(message)) throw new import_common5.BadRequestException(message);
+      if (error?.code === "bad-request") {
+        throw new import_common5.BadRequestException(message);
+      }
+      return notSupportedByServer(error);
+    }
+    if (!result) {
+      throw new import_common5.NotImplementedException("republishing lifecycle events needs the control plane");
+    }
+    return result;
+  }
   async continue(id) {
     const result = await this.dashboard.continue(id);
     if (!result) throw new import_common5.NotFoundException(`run ${id} is not paused at a breakpoint`);
@@ -1357,7 +1371,7 @@ _ts_decorate5([
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "runs", null);
+], DurableApiControllerBase.prototype, "runs", null);
 _ts_decorate5([
   (0, import_common5.Get)("runs/facets"),
   _ts_param2(0, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
@@ -1366,7 +1380,7 @@ _ts_decorate5([
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "facets", null);
+], DurableApiControllerBase.prototype, "facets", null);
 _ts_decorate5([
   (0, import_common5.Get)("runs/values"),
   _ts_param2(0, (0, import_common5.Query)()),
@@ -1375,20 +1389,20 @@ _ts_decorate5([
     typeof Record === "undefined" ? Object : Record
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "values", null);
+], DurableApiControllerBase.prototype, "values", null);
 _ts_decorate5([
   (0, import_common5.Get)("metrics"),
   (0, import_common5.Header)("Content-Type", "text/plain; version=0.0.4"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "metrics", null);
+], DurableApiControllerBase.prototype, "metrics", null);
 _ts_decorate5([
   (0, import_common5.Get)("workers"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "workers", null);
+], DurableApiControllerBase.prototype, "workers", null);
 _ts_decorate5([
   (0, import_common5.Get)("schedules"),
   _ts_param2(0, (0, import_common5.Query)("namespace")),
@@ -1405,7 +1419,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "schedules", null);
+], DurableApiControllerBase.prototype, "schedules", null);
 _ts_decorate5([
   (0, import_common5.Post)("schedules/:id/pause"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1414,7 +1428,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "pauseSchedule", null);
+], DurableApiControllerBase.prototype, "pauseSchedule", null);
 _ts_decorate5([
   (0, import_common5.Post)("schedules/:id/resume"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1423,7 +1437,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "resumeSchedule", null);
+], DurableApiControllerBase.prototype, "resumeSchedule", null);
 _ts_decorate5([
   (0, import_common5.Post)("schedules/:id/trigger"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1432,13 +1446,22 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "triggerSchedule", null);
+], DurableApiControllerBase.prototype, "triggerSchedule", null);
+_ts_decorate5([
+  (0, import_common5.Get)("workflows/:name/lifecycle"),
+  _ts_param2(0, (0, import_common5.Param)("name")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableApiControllerBase.prototype, "workflowLifecycle", null);
 _ts_decorate5([
   (0, import_common5.Get)("topology"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "topology", null);
+], DurableApiControllerBase.prototype, "topology", null);
 _ts_decorate5([
   (0, import_common5.Get)("runs/:id"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1455,7 +1478,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "run", null);
+], DurableApiControllerBase.prototype, "run", null);
 _ts_decorate5([
   (0, import_common5.Get)("runs/:id/fans/:group"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1478,7 +1501,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "fanMembers", null);
+], DurableApiControllerBase.prototype, "fanMembers", null);
 _ts_decorate5([
   (0, import_common5.Sse)("runs/:id/stream"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1487,7 +1510,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "stream", null);
+], DurableApiControllerBase.prototype, "stream", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/retry"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1496,7 +1519,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "retry", null);
+], DurableApiControllerBase.prototype, "retry", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/retry-with-input"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1507,7 +1530,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "retryWithInput", null);
+], DurableApiControllerBase.prototype, "retryWithInput", null);
 _ts_decorate5([
   (0, import_common5.Post)("bulk/:action"),
   _ts_param2(0, (0, import_common5.Param)("action")),
@@ -1520,7 +1543,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "bulk", null);
+], DurableApiControllerBase.prototype, "bulk", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/cancel"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1531,7 +1554,18 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "cancel", null);
+], DurableApiControllerBase.prototype, "cancel", null);
+_ts_decorate5([
+  (0, import_common5.Post)("runs/:id/republish-lifecycle"),
+  _ts_param2(0, (0, import_common5.Param)("id")),
+  _ts_param2(1, (0, import_common5.Body)()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    String,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableApiControllerBase.prototype, "republishLifecycle", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/continue"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1540,7 +1574,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "continue", null);
+], DurableApiControllerBase.prototype, "continue", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/redispatch"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1549,7 +1583,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "redispatch", null);
+], DurableApiControllerBase.prototype, "redispatch", null);
 _ts_decorate5([
   (0, import_common5.Post)("webhooks/:token"),
   _ts_param2(0, (0, import_common5.Param)("token")),
@@ -1560,7 +1594,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "webhook", null);
+], DurableApiControllerBase.prototype, "webhook", null);
 _ts_decorate5([
   (0, import_common5.Get)("runs/:id/events/:key"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1571,7 +1605,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "event", null);
+], DurableApiControllerBase.prototype, "event", null);
 _ts_decorate5([
   (0, import_common5.Post)("runs/:id/updates/:name"),
   _ts_param2(0, (0, import_common5.Param)("id")),
@@ -1584,8 +1618,8 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "update", null);
-DurableApiController = _ts_decorate5([
+], DurableApiControllerBase.prototype, "update", null);
+DurableApiControllerBase = _ts_decorate5([
   (0, import_common5.Controller)(),
   (0, import_common5.UseInterceptors)(import_nestjs_filter2.ApplyFilterInterceptor),
   (0, import_common5.UseFilters)(NotModifiedFilter),
@@ -1594,7 +1628,7 @@ DurableApiController = _ts_decorate5([
     typeof DashboardService === "undefined" ? Object : DashboardService,
     typeof import_nestjs_filter2.FilterRunner === "undefined" ? Object : import_nestjs_filter2.FilterRunner
   ])
-], DurableApiController);
+], DurableApiControllerBase);
 function notFound(error) {
   if (error instanceof Error && error.name === "ScheduleNotFoundError") {
     throw new import_common5.NotFoundException(error.message);
@@ -1602,497 +1636,58 @@ function notFound(error) {
   throw error;
 }
 __name(notFound, "notFound");
-
-// src/server/durable-auth.controller.ts
-var import_common9 = require("@nestjs/common");
-
-// src/server/auth/dashboard-auth-config.ts
-var DASHBOARD_AUTH = Symbol("DASHBOARD_AUTH");
-var DEFAULT_TTL = "8h";
-var DEFAULT_TTL_MS = 8 * 60 * 60 * 1e3;
-var DURATION_UNITS = {
-  s: 1e3,
-  m: 60 * 1e3,
-  h: 60 * 60 * 1e3,
-  d: 24 * 60 * 60 * 1e3
-};
-function durationToMs(ttl) {
-  const match = /^(\d+)([smhd])$/.exec(ttl.trim());
-  if (!match) return DEFAULT_TTL_MS;
-  const unit = DURATION_UNITS[match[2] ?? ""];
-  if (unit === void 0) return DEFAULT_TTL_MS;
-  return Number(match[1]) * unit;
-}
-__name(durationToMs, "durationToMs");
-function resolveDashboardAuth(options) {
-  if (options === void 0) return null;
-  if (typeof options.secret !== "string" || options.secret === "") {
-    throw new Error("DurableDashboardModule: dashboardAuth.secret is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
-  }
-  const modes = [];
-  if (options.session !== void 0) {
-    if (typeof options.session !== "function") {
-      throw new Error("DurableDashboardModule: dashboardAuth.session must be a function.");
-    }
-    modes.push("session");
-  }
-  if (options.login !== void 0) {
-    if (typeof options.login !== "function") {
-      throw new Error("DurableDashboardModule: dashboardAuth.login must be a function.");
-    }
-    modes.push("login");
-  }
-  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.revalidate must be a function.");
+function notSupportedByServer(error) {
+  if (error?.code === "unsupported-request") {
+    throw new import_common5.NotImplementedException(error instanceof Error ? error.message : String(error));
   }
-  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.unauthenticatedPage must be a function.");
-  }
-  if (modes.length === 0) {
-    throw new Error("DurableDashboardModule: dashboardAuth needs at least one of `session` or `login` (otherwise the cookie can never be minted). Failing closed.");
-  }
-  return {
-    secret: options.secret,
-    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    modes,
-    ...options.session !== void 0 ? {
-      session: options.session
-    } : {},
-    ...options.login !== void 0 ? {
-      login: options.login
-    } : {},
-    ...options.revalidate !== void 0 ? {
-      revalidate: options.revalidate
-    } : {},
-    ...options.unauthenticatedPage !== void 0 ? {
-      unauthenticatedPage: options.unauthenticatedPage
-    } : {}
-  };
-}
-__name(resolveDashboardAuth, "resolveDashboardAuth");
-
-// src/server/auth/login-page.ts
-function page(content, title = "Durable") {
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex, nofollow" />
-<title>${title}</title>
-<style>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    background: #09090b;
-    color: #e4e4e7;
-    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    padding: 16px;
-  }
-  .card {
-    width: 100%;
-    max-width: 384px;
-    border: 1px solid #27272a;
-    background: #18181b;
-    border-radius: 8px;
-    padding: 32px;
-    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
-  }
-  .brand {
-    margin: 0 0 24px;
-    text-align: center;
-    font-size: 18px;
-    font-weight: 600;
-    color: #34d399;
-  }
-  h1 {
-    margin: 0 0 12px;
-    font-size: 16px;
-    font-weight: 600;
-    color: #f4f4f5;
-  }
-  p { margin: 0 0 16px; color: #a1a1aa; }
-  form { display: flex; flex-direction: column; gap: 16px; }
-  label { display: flex; flex-direction: column; gap: 6px; }
-  .field-label {
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    color: #71717a;
-  }
-  input {
-    border-radius: 4px;
-    border: 1px solid #3f3f46;
-    background: #09090b;
-    color: #f4f4f5;
-    padding: 8px 12px;
-    font: inherit;
-    outline: none;
-  }
-  input:focus { border-color: rgb(52 211 153 / 0.6); }
-  #error {
-    display: none;
-    margin: 0;
-    font-size: 12px;
-    color: #fb7185;
-  }
-  button, .button {
-    margin-top: 8px;
-    border-radius: 4px;
-    border: 1px solid rgb(52 211 153 / 0.4);
-    background: rgb(52 211 153 / 0.1);
-    color: #6ee7b7;
-    padding: 8px 12px;
-    font: inherit;
-    font-size: 12px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    cursor: pointer;
-    display: inline-block;
-    text-align: center;
-    text-decoration: none;
-    box-sizing: border-box;
-  }
-  button:hover:not(:disabled), .button:hover { background: rgb(52 211 153 / 0.2); }
-  button:disabled { opacity: 0.6; cursor: default; }
-</style>
-</head>
-<body>
-  <div class="card">
-    ${content}
-  </div>
-</body>
-</html>`;
+  throw error;
 }
-__name(page, "page");
-function renderLoginPage(basePath) {
-  const loginAction = `${basePath}/login`;
-  const defaultReturnTo = basePath;
-  return page(`<p class="brand">Durable</p>
-    <form id="login-form" autocomplete="on">
-      <label>
-        <span class="field-label">Username</span>
-        <input id="username" name="username" type="text" autocomplete="username" required autofocus />
-      </label>
-      <label>
-        <span class="field-label">Password</span>
-        <input id="password" name="password" type="password" autocomplete="current-password" />
-      </label>
-      <p id="error" role="alert">Invalid username or password.</p>
-      <button id="submit" type="submit">Sign in</button>
-    </form>
-<script>
-(function () {
-  var LOGIN_ACTION = ${JSON.stringify(loginAction)};
-  var DEFAULT_RETURN_TO = ${JSON.stringify(defaultReturnTo)};
-  var params = new URLSearchParams(window.location.search);
-  var errorBox = document.getElementById('error');
-  if (params.get('error')) errorBox.style.display = 'block';
-
-  function sameOriginReturnTo(value) {
-    if (typeof value !== 'string' || value === '') return DEFAULT_RETURN_TO;
-    if (value.charAt(0) !== '/' || value.charAt(1) === '/' || value.indexOf('://') !== -1) {
-      return DEFAULT_RETURN_TO;
-    }
-    return value;
+__name(notSupportedByServer, "notSupportedByServer");
+var DurableApiController = class extends DurableApiControllerBase {
+  static {
+    __name(this, "DurableApiController");
   }
+};
+DurableApiController = _ts_decorate5([
+  (0, import_common5.Controller)()
+], DurableApiController);
 
-  var form = document.getElementById('login-form');
-  var submitButton = document.getElementById('submit');
-  form.addEventListener('submit', function (event) {
-    event.preventDefault();
-    submitButton.disabled = true;
-    errorBox.style.display = 'none';
-    var returnTo = sameOriginReturnTo(params.get('returnTo'));
-    fetch(LOGIN_ACTION, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      credentials: 'same-origin',
-      body: JSON.stringify({
-        username: document.getElementById('username').value,
-        password: document.getElementById('password').value,
-        returnTo: returnTo,
-      }),
-    })
-      .then(function (response) {
-        if (!response.ok) throw new Error('unauthorized');
-        return response.json();
-      })
-      .then(function (data) {
-        window.location.href = data.redirectTo || DEFAULT_RETURN_TO;
-      })
-      .catch(function () {
-        errorBox.style.display = 'block';
-        submitButton.disabled = false;
-      });
-  });
-})();
-</script>`, "Sign in \u2014 Durable");
-}
-__name(renderLoginPage, "renderLoginPage");
-function renderSessionRequiredPage(basePath) {
-  return page(`<h1>Open this console from your application</h1>
-     <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>
-     <a class="button" href="${basePath}">Retry</a>`);
-}
-__name(renderSessionRequiredPage, "renderSessionRequiredPage");
-
-// src/server/auth/request.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord2, "isRecord");
-function readHeaders(request) {
-  if (!isRecord2(request)) return {};
-  const headers = request.headers;
-  return isRecord2(headers) ? headers : {};
-}
-__name(readHeaders, "readHeaders");
-function headerToString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
-    return value.join(",");
-  }
-  return void 0;
-}
-__name(headerToString, "headerToString");
-function readCookieHeader(request) {
-  return headerToString(readHeaders(request).cookie);
-}
-__name(readCookieHeader, "readCookieHeader");
-function isHttpsRequest(request) {
-  if (isRecord2(request) && request.protocol === "https") return true;
-  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
-  if (forwarded === void 0) return false;
-  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
-}
-__name(isHttpsRequest, "isHttpsRequest");
-function originalRequestUrl(request) {
-  if (!isRecord2(request)) return "/";
-  if (typeof request.originalUrl === "string" && request.originalUrl !== "") {
-    return request.originalUrl;
-  }
-  if (typeof request.url === "string" && request.url !== "") return request.url;
-  return "/";
-}
-__name(originalRequestUrl, "originalRequestUrl");
-function sanitizeReturnTo(candidate, fallback) {
-  if (typeof candidate !== "string") return fallback;
-  if (!candidate.startsWith("/")) return fallback;
-  if (candidate.startsWith("//")) return fallback;
-  if (candidate.includes("://")) return fallback;
-  return candidate;
-}
-__name(sanitizeReturnTo, "sanitizeReturnTo");
+// src/server/durable-dashboard.module.ts
+var import_reflect_metadata2 = require("reflect-metadata");
+var import_nestjs_filter3 = require("@dudousxd/nestjs-filter");
+var import_common7 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
 
-// src/server/auth/cookie-header.ts
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (typeof header !== "string" || header === "") return cookies;
-  for (const segment of header.split(";")) {
-    const eq = segment.indexOf("=");
-    if (eq <= 0) continue;
-    const name = segment.slice(0, eq).trim();
-    if (name === "") continue;
-    let rawValue = segment.slice(eq + 1).trim();
-    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
-      rawValue = rawValue.slice(1, -1);
-    }
-    if (name in cookies) continue;
-    try {
-      cookies[name] = decodeURIComponent(rawValue);
-    } catch {
-      cookies[name] = rawValue;
+// src/server/controller-decorators.ts
+var import_reflect_metadata = require("reflect-metadata");
+var CAN_ANYONE_METADATA = "authorization:can-anyone";
+function markOpenToAuthorization(controller) {
+  Reflect.defineMetadata(CAN_ANYONE_METADATA, true, controller);
+}
+__name(markOpenToAuthorization, "markOpenToAuthorization");
+function controllerFor(base, decorators) {
+  if (decorators === void 0 || decorators.length === 0) return base;
+  const derived = class extends base {
+    static {
+      __name(this, "derived");
     }
-  }
-  return cookies;
-}
-__name(parseCookieHeader, "parseCookieHeader");
-function serializeSetCookie(name, value, options) {
-  const parts = [
-    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
-  ];
-  parts.push(`Path=${options.path}`);
-  parts.push("HttpOnly");
-  parts.push("SameSite=Lax");
-  if (options.secure) parts.push("Secure");
-  if (options.clear) {
-    parts.push("Max-Age=0");
-    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  } else {
-    parts.push(`Max-Age=${options.maxAgeSeconds}`);
-  }
-  return parts.join("; ");
-}
-__name(serializeSetCookie, "serializeSetCookie");
-
-// src/server/auth/session-cookie.ts
-var import_node_crypto = require("crypto");
-var EXP_GRACE_MS = 3e4;
-function base64urlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-__name(base64urlEncode, "base64urlEncode");
-function base64urlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-__name(base64urlDecode, "base64urlDecode");
-function hmac(secret, payload) {
-  return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("base64url");
-}
-__name(hmac, "hmac");
-function signSessionCookie(user, options) {
-  const issuedAt = options.now ?? Date.now();
-  const session = {
-    sub: user.id,
-    ...user.name !== void 0 ? {
-      name: user.name
-    } : {},
-    roles: user.roles ?? [],
-    iat: issuedAt,
-    exp: issuedAt + options.ttlMs
-  };
-  const encodedPayload = base64urlEncode(JSON.stringify(session));
-  const signature = hmac(options.secret, encodedPayload);
-  return `${encodedPayload}.${signature}`;
-}
-__name(signSessionCookie, "signSessionCookie");
-function isSessionPayload(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = {
-    ...value
   };
-  if (typeof record.sub !== "string") return false;
-  if (record.name !== void 0 && typeof record.name !== "string") return false;
-  if (!Array.isArray(record.roles)) return false;
-  if (!record.roles.every((role) => typeof role === "string")) return false;
-  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
-  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
-  return true;
-}
-__name(isSessionPayload, "isSessionPayload");
-function verifySessionCookie(value, options) {
-  try {
-    const dot = value.indexOf(".");
-    if (dot <= 0 || dot === value.length - 1) return null;
-    const encodedPayload = value.slice(0, dot);
-    const providedSignature = value.slice(dot + 1);
-    const expectedSignature = hmac(options.secret, encodedPayload);
-    const provided = Buffer.from(providedSignature, "base64url");
-    const expected = Buffer.from(expectedSignature, "base64url");
-    if (provided.length !== expected.length) return null;
-    if (!(0, import_node_crypto.timingSafeEqual)(provided, expected)) return null;
-    const decoded = JSON.parse(base64urlDecode(encodedPayload));
-    if (!isSessionPayload(decoded)) return null;
-    const now = options.now ?? Date.now();
-    if (now > decoded.exp + EXP_GRACE_MS) return null;
-    const session = {
-      sub: decoded.sub,
-      ...decoded.name !== void 0 ? {
-        name: decoded.name
-      } : {},
-      roles: decoded.roles,
-      iat: decoded.iat,
-      exp: decoded.exp
-    };
-    return session;
-  } catch {
-    return null;
-  }
-}
-__name(verifySessionCookie, "verifySessionCookie");
-
-// src/server/auth/session-cookie-io.ts
-var SESSION_COOKIE_NAME = "durable_dashboard_session";
-var COOKIE_PATH = "/";
-function issueSessionCookie(user, context) {
-  const value = signSessionCookie(user, {
-    secret: context.auth.secret,
-    ttlMs: context.auth.ttlMs,
-    ...context.now !== void 0 ? {
-      now: context.now
-    } : {}
-  });
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
-    path: COOKIE_PATH,
-    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
-    secure: isHttpsRequest(context.request)
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(issueSessionCookie, "issueSessionCookie");
-function clearSessionCookie(context) {
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
-    path: COOKIE_PATH,
-    maxAgeSeconds: 0,
-    secure: isHttpsRequest(context.request),
-    clear: true
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(clearSessionCookie, "clearSessionCookie");
-function readSessionFromRequest(auth, request) {
-  const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-  if (cookieValue === void 0) return null;
-  return verifySessionCookie(cookieValue, {
-    secret: auth.secret
+  Object.defineProperty(derived, "name", {
+    value: base.name
   });
-}
-__name(readSessionFromRequest, "readSessionFromRequest");
-var inFlightRevalidations = /* @__PURE__ */ new Map();
-function revalidateOnce(auth, user) {
-  const revalidate = auth.revalidate;
-  if (!revalidate) return Promise.resolve(true);
-  const key = `${auth.secret}:${user.id}`;
-  const inFlight = inFlightRevalidations.get(key);
-  if (inFlight) return inFlight;
-  const call = Promise.resolve().then(() => revalidate(user)).catch(() => false).finally(() => {
-    inFlightRevalidations.delete(key);
-  });
-  inFlightRevalidations.set(key, call);
-  return call;
-}
-__name(revalidateOnce, "revalidateOnce");
-async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
-  if (now - session.iat <= auth.ttlMs / 2) return true;
-  const user = {
-    id: session.sub,
-    ...session.name !== void 0 ? {
-      name: session.name
-    } : {},
-    roles: session.roles
-  };
-  const allowed = await revalidateOnce(auth, user);
-  if (!allowed) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    return false;
+  markOpenToAuthorization(derived);
+  let decorated = derived;
+  for (const decorator of decorators) {
+    decorated = decorator(decorated) ?? decorated;
   }
-  issueSessionCookie(user, {
-    auth,
-    request,
-    response,
-    now
-  });
-  return true;
+  return decorated;
 }
-__name(maybeRenewSession, "maybeRenewSession");
+__name(controllerFor, "controllerFor");
 
 // src/server/durable-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common8 = require("@nestjs/common");
-
-// src/server/auth/login-redirect.exception.ts
 var import_common6 = require("@nestjs/common");
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2108,46 +1703,6 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate6, "_ts_decorate");
-var DashboardLoginRedirectException = class extends import_common6.HttpException {
-  static {
-    __name(this, "DashboardLoginRedirectException");
-  }
-  location;
-  constructor(location) {
-    super({
-      location
-    }, import_common6.HttpStatus.FOUND), this.location = location;
-  }
-};
-var DashboardLoginRedirectFilter = class {
-  static {
-    __name(this, "DashboardLoginRedirectFilter");
-  }
-  catch(exception, host) {
-    const response = host.switchToHttp().getResponse();
-    redirectRaw(response, exception.location);
-  }
-};
-DashboardLoginRedirectFilter = _ts_decorate6([
-  (0, import_common6.Catch)(DashboardLoginRedirectException)
-], DashboardLoginRedirectFilter);
-
-// src/server/auth/session-required.exception.ts
-var import_common7 = require("@nestjs/common");
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
 function _ts_metadata5(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
@@ -2160,91 +1715,6 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
-var DashboardSessionRequiredException = class extends import_common7.HttpException {
-  static {
-    __name(this, "DashboardSessionRequiredException");
-  }
-  basePath;
-  constructor(basePath) {
-    super({
-      basePath
-    }, import_common7.HttpStatus.UNAUTHORIZED), this.basePath = basePath;
-  }
-};
-var DashboardSessionRequiredFilter = class _DashboardSessionRequiredFilter {
-  static {
-    __name(this, "DashboardSessionRequiredFilter");
-  }
-  auth;
-  logger = new import_common7.Logger(_DashboardSessionRequiredFilter.name);
-  warned = false;
-  constructor(auth = null) {
-    this.auth = auth;
-  }
-  async catch(exception, host) {
-    const http = host.switchToHttp();
-    const response = http.getResponse();
-    const hook = this.auth?.unauthenticatedPage;
-    if (hook) {
-      try {
-        await hook({
-          request: http.getRequest(),
-          response,
-          basePath: exception.basePath
-        });
-        if (responseAlreadyWritten(response)) return;
-        this.warnOnce("dashboardAuth.unauthenticatedPage returned without writing a response; falling back to the built-in page. The hook must write AND end the response it is given.");
-      } catch (error) {
-        this.warnOnce(`dashboardAuth.unauthenticatedPage threw; falling back to the built-in page. ${String(error)}`);
-        if (responseAlreadyWritten(response)) return;
-      }
-    }
-    writeHtmlRaw(response, renderSessionRequiredPage(exception.basePath), import_common7.HttpStatus.UNAUTHORIZED);
-  }
-  /** Once per process, not once per request: a broken hook fires on every denied navigation. */
-  warnOnce(message) {
-    if (this.warned) return;
-    this.warned = true;
-    this.logger.warn(message);
-  }
-};
-DashboardSessionRequiredFilter = _ts_decorate7([
-  (0, import_common7.Catch)(DashboardSessionRequiredException),
-  _ts_param3(0, (0, import_common7.Optional)()),
-  _ts_param3(0, (0, import_common7.Inject)(DASHBOARD_AUTH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    Object
-  ])
-], DashboardSessionRequiredFilter);
-
-// src/server/durable-ui.controller.ts
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
 var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
 var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
 var BUILD_BASE = "/durable";
@@ -2261,9 +1731,9 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2",
   ".ico": "image/x-icon"
 };
-var DurableUiController = class {
+var DurableUiControllerBase = class {
   static {
-    __name(this, "DurableUiController");
+    __name(this, "DurableUiControllerBase");
   }
   basePath;
   apiBasePath;
@@ -2277,7 +1747,7 @@ var DurableUiController = class {
   index() {
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common8.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common6.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__DURABLE_BASE__='${this.basePath}';window.__DURABLE_API__='${this.apiBasePath}';</script>`;
@@ -2285,235 +1755,57 @@ var DurableUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common8.NotFoundException();
+    if (safe !== file) throw new import_common6.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common8.NotFoundException();
+      throw new import_common6.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common8.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate8([
-  (0, import_common8.Get)(),
-  (0, import_common8.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common8.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", String)
-], DurableUiController.prototype, "index", null);
-_ts_decorate8([
-  (0, import_common8.Get)("assets/:file"),
-  (0, import_common8.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param4(0, (0, import_common8.Param)("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)(),
+  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", String)
+], DurableUiControllerBase.prototype, "index", null);
+_ts_decorate6([
+  (0, import_common6.Get)("assets/:file"),
+  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param3(0, (0, import_common6.Param)("file")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof import_common8.StreamableFile === "undefined" ? Object : import_common8.StreamableFile)
-], DurableUiController.prototype, "asset", null);
-DurableUiController = _ts_decorate8([
-  (0, import_common8.UseFilters)(DashboardLoginRedirectFilter, DashboardSessionRequiredFilter),
-  (0, import_common8.Controller)(),
-  _ts_param4(0, (0, import_common8.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param4(1, (0, import_common8.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_metadata5("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
+], DurableUiControllerBase.prototype, "asset", null);
+DurableUiControllerBase = _ts_decorate6([
+  (0, import_common6.Controller)(),
+  _ts_param3(0, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ])
-], DurableUiController);
-
-// src/server/durable-auth.controller.ts
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata7(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-function isString(value) {
-  return typeof value === "string";
-}
-__name(isString, "isString");
-var DurableAuthController = class _DurableAuthController {
+], DurableUiControllerBase);
+var DurableUiController = class extends DurableUiControllerBase {
   static {
-    __name(this, "DurableAuthController");
-  }
-  auth;
-  basePath;
-  logger = new import_common9.Logger(_DurableAuthController.name);
-  /** Warn once per hook kind so a throwing hook doesn't spam logs on every failed attempt. */
-  warnedHooks = /* @__PURE__ */ new Set();
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  // The login page reads `returnTo`/`error` from `location.search` client-side (see
-  // `login-page.ts`), so this response never varies per request and needs no templating beyond
-  // the developer-controlled `basePath`.
-  loginPage() {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new import_common9.NotFoundException();
-    return renderLoginPage(this.basePath);
-  }
-  // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
-  // why: it keeps the login page working with no host-configured body parser beyond the
-  // JSON one Nest wires in by default on both Express and Fastify). Uniform `401` on any failure
-  // (unknown user, wrong password, throwing hook) — no user-enumeration.
-  async login(body, request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new import_common9.NotFoundException();
-    if (!isString(body?.username) || !isString(body?.password)) {
-      throw new import_common9.BadRequestException("Body must include string `username` and `password`.");
-    }
-    const { username, password } = body;
-    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
-    if (!user) throw new import_common9.UnauthorizedException({
-      message: "Invalid username or password."
-    });
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-    return {
-      redirectTo: sanitizeReturnTo(body.returnTo, this.basePath)
-    };
-  }
-  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
-  // request and returns the session user, or `null` to deny. This is the SSO path — the host's own
-  // guard decides, and no credential ever reaches this library.
-  async session(request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("session")) throw new import_common9.NotFoundException();
-    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
-    if (!user) throw new import_common9.UnauthorizedException();
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-  }
-  // Plain `GET` (not `POST`): logging out only ever destroys the CALLER's own session, so it's
-  // safe/idempotent from the caller's perspective — a simple `<a href>` (no JS, no CSRF token)
-  // works. Non-passthrough `@Res()`: this handler owns the response outright (clears the cookie,
-  // then redirects), so Nest must not also try to send a return value afterwards.
-  logout(request, response) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    redirectRaw(response, this.auth?.modes.includes("login") ? `${this.basePath}/login` : this.basePath);
-  }
-  requireAuth() {
-    if (!this.auth) throw new import_common9.NotFoundException();
-    return this.auth;
-  }
-  /**
-  * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
-  * failure) and warn-logged once PER KIND, so a buggy hook never 500s the endpoint into a
-  * stack-trace leak nor floods the logs on repeated bad attempts.
-  */
-  async runHook(kind, run) {
-    try {
-      return await run() ?? null;
-    } catch (error) {
-      if (!this.warnedHooks.has(kind)) {
-        this.warnedHooks.add(kind);
-        this.logger.warn(`dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
-      }
-      return null;
-    }
+    __name(this, "DurableUiController");
   }
 };
-_ts_decorate9([
-  (0, import_common9.Get)("login"),
-  (0, import_common9.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common9.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", []),
-  _ts_metadata7("design:returntype", String)
-], DurableAuthController.prototype, "loginPage", null);
-_ts_decorate9([
-  (0, import_common9.Post)("login"),
-  (0, import_common9.HttpCode)(200),
-  _ts_param5(0, (0, import_common9.Body)()),
-  _ts_param5(1, (0, import_common9.Req)()),
-  _ts_param5(2, (0, import_common9.Res)({
-    passthrough: true
-  })),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    typeof LoginBody === "undefined" ? Object : LoginBody,
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", Promise)
-], DurableAuthController.prototype, "login", null);
-_ts_decorate9([
-  (0, import_common9.Post)("session"),
-  (0, import_common9.HttpCode)(204),
-  _ts_param5(0, (0, import_common9.Req)()),
-  _ts_param5(1, (0, import_common9.Res)({
-    passthrough: true
-  })),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", Promise)
-], DurableAuthController.prototype, "session", null);
-_ts_decorate9([
-  (0, import_common9.Get)("logout"),
-  _ts_param5(0, (0, import_common9.Req)()),
-  _ts_param5(1, (0, import_common9.Res)()),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", void 0)
-], DurableAuthController.prototype, "logout", null);
-DurableAuthController = _ts_decorate9([
-  (0, import_common9.Controller)(),
-  _ts_param5(0, (0, import_common9.Optional)()),
-  _ts_param5(0, (0, import_common9.Inject)(DASHBOARD_AUTH)),
-  _ts_param5(1, (0, import_common9.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    String
-  ])
-], DurableAuthController);
+DurableUiController = _ts_decorate6([
+  (0, import_common6.Controller)()
+], DurableUiController);
 
-// src/server/durable-dashboard-gate.guard.ts
-var import_node_crypto2 = require("crypto");
-var import_common10 = require("@nestjs/common");
-function _ts_decorate10(decorators, target, key, desc) {
+// src/server/durable-dashboard.module.ts
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2526,342 +1818,59 @@ function _ts_decorate10(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata8(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param6, "_ts_param");
-var DURABLE_DASHBOARD_TOKEN_ENV = "DURABLE_DASHBOARD_TOKEN";
-var DASHBOARD_GATE = Symbol("DASHBOARD_GATE");
-var LOG_CONTEXT = "DurableDashboard";
-var HOW_TO_CONFIGURE = [
-  "Configure one of: `guards: [YourAuthGuard]`, `dashboardAuth: { secret, session | login }`",
-  "(or `useDashboardAuth` in forRootAsync), a bearer token via the `token` option or the",
-  `${DURABLE_DASHBOARD_TOKEN_ENV} env var, or \`allowUnauthenticated: true\` when the console is`,
-  "already protected outside this module (a global guard, a reverse proxy, a private network)."
+__name(_ts_decorate7, "_ts_decorate");
+markOpenToAuthorization(DurableApiController);
+markOpenToAuthorization(DurableUiController);
+var DASHBOARD_PROTECTION_CHECK = Symbol("DASHBOARD_PROTECTION_CHECK");
+var UNPROTECTED_CONSOLE_IN_PRODUCTION = [
+  "DurableDashboardModule: NODE_ENV=production and the durable console is mounted with no",
+  "protection, so the app refuses to boot. Protect it one of two ways:",
+  "(1) decorators on the mounted console: DurableDashboardModule.forRoot({ decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')] });",
+  "(2) mount it yourself: DurableDashboardModule.forRoot({ routes: false }) plus @Controller('durable') @UseGuards(AuthenticationGuard) @Can(ConsolePolicy, 'view') class ConsoleUi extends DurableUiControllerBase {} (and the same over DurableApiControllerBase at 'durable/api')."
 ].join(" ");
 function isProduction() {
   return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
 }
 __name(isProduction, "isProduction");
-function resolveDashboardGate(options, auth) {
-  if (options.hasGuards || auth !== null) return {
-    mode: "delegated"
-  };
-  const token = options.token ?? process.env[DURABLE_DASHBOARD_TOKEN_ENV];
-  if (typeof token === "string" && token !== "") return {
-    mode: "token",
-    token
-  };
-  if (options.allowUnauthenticated === true) return {
-    mode: "open"
-  };
+function protectionCheckProvider() {
   return {
-    mode: isProduction() ? "deny" : "unconfigured"
-  };
-}
-__name(resolveDashboardGate, "resolveDashboardGate");
-function reportDashboardGate(gate, options, logger = new import_common10.Logger(LOG_CONTEXT)) {
-  switch (gate.mode) {
-    case "open":
-      logger.warn("allowUnauthenticated: true. The durable console (including retry/cancel and other mutating endpoints) is served with NO authentication from this module. Only do this when a global guard or reverse proxy already protects it.");
-      return;
-    case "token":
-      if (options.allowUnauthenticated === true) {
-        logger.warn("allowUnauthenticated: true is ignored because a dashboard token is configured; requests must carry the token.");
-      }
-      return;
-    case "unconfigured":
-      logger.warn([
-        "The durable console is UNAUTHENTICATED: no guards, dashboardAuth, token or",
-        "allowUnauthenticated were configured. It is served open because NODE_ENV is not",
-        '"production", but it WILL deny every request when NODE_ENV=production.',
-        HOW_TO_CONFIGURE
-      ].join(" "));
-      return;
-    case "deny":
-      logger.error([
-        "The durable console has no authentication configured and NODE_ENV=production, so it",
-        "is failing closed: every console request (UI and API) is denied.",
-        HOW_TO_CONFIGURE
-      ].join(" "));
-      return;
-    case "delegated":
-      return;
-  }
-}
-__name(reportDashboardGate, "reportDashboardGate");
-function dashboardGateProvider(options) {
-  return {
-    provide: DASHBOARD_GATE,
-    inject: [
-      DASHBOARD_AUTH
-    ],
-    useFactory: /* @__PURE__ */ __name((auth) => {
-      const gate = resolveDashboardGate(options, auth);
-      reportDashboardGate(gate, options);
-      return gate;
+    provide: DASHBOARD_PROTECTION_CHECK,
+    useFactory: /* @__PURE__ */ __name(() => {
+      if (isProduction()) throw new Error(UNPROTECTED_CONSOLE_IN_PRODUCTION);
+      new import_common7.Logger("DurableDashboard").warn("The durable console is mounted with no `decorators`, so it is served OPEN (retry/cancel included). That is refused when NODE_ENV=production: pass `decorators` (e.g. [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]) or mount it yourself with `routes: false`.");
+      return true;
     }, "useFactory")
   };
 }
-__name(dashboardGateProvider, "dashboardGateProvider");
-function isRecord3(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord3, "isRecord");
-function headerValue(request, name) {
-  const headers = request.headers;
-  if (!isRecord3(headers)) return void 0;
-  const value = headers[name];
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && typeof value[0] === "string") return value[0];
-  return void 0;
-}
-__name(headerValue, "headerValue");
-function readDashboardToken(request) {
-  if (!isRecord3(request)) return void 0;
-  const authorization = headerValue(request, "authorization");
-  if (authorization) {
-    const match = /^Bearer\s+(.+)$/i.exec(authorization);
-    if (match?.[1]) return match[1].trim();
-  }
-  const header = headerValue(request, "x-durable-token");
-  if (header) return header.trim();
-  const method = typeof request.method === "string" ? request.method.toUpperCase() : "";
-  if (method === "GET" || method === "HEAD") {
-    const query = request.query;
-    if (isRecord3(query)) {
-      const value = query.token;
-      if (typeof value === "string" && value !== "") return value;
-    }
-  }
-  return void 0;
-}
-__name(readDashboardToken, "readDashboardToken");
-function secretsMatch(provided, expected) {
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length) return false;
-  return (0, import_node_crypto2.timingSafeEqual)(a, b);
-}
-__name(secretsMatch, "secretsMatch");
-var DurableDashboardGateGuard = class {
-  static {
-    __name(this, "DurableDashboardGateGuard");
-  }
-  gate;
-  constructor(gate) {
-    this.gate = gate;
-  }
-  canActivate(context) {
-    switch (this.gate.mode) {
-      case "delegated":
-      case "open":
-      case "unconfigured":
-        return true;
-      case "deny":
-        throw new import_common10.ForbiddenException([
-          "Durable dashboard authentication is not configured, and NODE_ENV=production denies",
-          "an unauthenticated console.",
-          HOW_TO_CONFIGURE
-        ].join(" "));
-      case "token": {
-        const provided = readDashboardToken(context.switchToHttp().getRequest());
-        if (provided !== void 0 && secretsMatch(provided, this.gate.token ?? "")) return true;
-        throw new import_common10.UnauthorizedException("A valid durable dashboard token is required (Authorization: Bearer <token>, x-durable-token, or ?token= on GET).");
-      }
-    }
-  }
-};
-DurableDashboardGateGuard = _ts_decorate10([
-  (0, import_common10.Injectable)(),
-  _ts_param6(0, (0, import_common10.Inject)(DASHBOARD_GATE)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
-    typeof DashboardGate === "undefined" ? Object : DashboardGate
-  ])
-], DurableDashboardGateGuard);
-
-// src/server/durable-dashboard.module.ts
-var import_reflect_metadata = require("reflect-metadata");
-var import_nestjs_filter3 = require("@dudousxd/nestjs-filter");
-var import_common12 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
-
-// src/server/durable-session.guard.ts
-var import_common11 = require("@nestjs/common");
-function _ts_decorate11(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata9(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata9, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param7, "_ts_param");
-var DurableUiSessionGuard = class {
-  static {
-    __name(this, "DurableUiSessionGuard");
-  }
-  auth;
-  basePath;
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = readSessionFromRequest(auth, request);
-    if (!session) {
-      this.denyUnauthenticated(auth, request);
-    }
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      this.denyUnauthenticated(auth, request);
-    }
-    return true;
-  }
-  /**
-  * A revoked session (the host's `revalidate` hook says no) is denied exactly like an absent
-  * one — by design, there is nothing left to distinguish "never had a session" from "had one,
-  * then lost it" once the cookie is cleared, so both get the same Mode-aware treatment.
-  *
-  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
-  * return narrows the field within that method only — TS doesn't carry it across a method call
-  * — so callers pass the already-narrowed value instead of this method re-deriving (or
-  * asserting away) the nullability.
-  */
-  denyUnauthenticated(auth, request) {
-    if (!auth.modes.includes("login")) throw new DashboardSessionRequiredException(this.basePath);
-    const returnTo = encodeURIComponent(originalRequestUrl(request));
-    throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
-  }
-};
-DurableUiSessionGuard = _ts_decorate11([
-  (0, import_common11.Injectable)(),
-  _ts_param7(0, (0, import_common11.Inject)(DASHBOARD_AUTH)),
-  _ts_param7(1, (0, import_common11.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
-    Object,
-    String
-  ])
-], DurableUiSessionGuard);
-var DurableApiSessionGuard = class {
-  static {
-    __name(this, "DurableApiSessionGuard");
-  }
-  auth;
-  constructor(auth) {
-    this.auth = auth;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = readSessionFromRequest(auth, request);
-    if (!session) throw this.unauthorized(auth);
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      throw this.unauthorized(auth);
-    }
-    return true;
-  }
-  /**
-  * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
-  * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
-  * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
-  * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
-  */
-  unauthorized(auth) {
-    return new import_common11.UnauthorizedException({
-      auth: {
-        modes: auth.modes
-      }
-    });
-  }
-};
-DurableApiSessionGuard = _ts_decorate11([
-  (0, import_common11.Injectable)(),
-  _ts_param7(0, (0, import_common11.Inject)(DASHBOARD_AUTH)),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
-    Object
-  ])
-], DurableApiSessionGuard);
-
-// src/server/durable-dashboard.module.ts
-function _ts_decorate12(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate12, "_ts_decorate");
-var GUARDS_METADATA = "__guards__";
+__name(protectionCheckProvider, "protectionCheckProvider");
+function assertNothingToDecorate(options) {
+  if (options.decorators === void 0) return;
+  throw new Error([
+    "DurableDashboardModule.forRoot({ routes: false }) mounts no controllers, so `decorators`",
+    "would protect nothing. Put your protection on the controllers you mount (extend",
+    "DurableUiControllerBase / DurableApiControllerBase and decorate them with @UseGuards /",
+    "@Can), and drop `decorators`."
+  ].join(" "));
+}
+__name(assertNothingToDecorate, "assertNothingToDecorate");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
 __name(normalize, "normalize");
-function stampGuards(hostGuards, builtIn, controller) {
-  const merged = [
-    ...builtIn.filter((guard) => guard !== void 0),
-    ...hostGuards ?? []
-  ];
-  Reflect.defineMetadata(GUARDS_METADATA, merged, controller);
-}
-__name(stampGuards, "stampGuards");
 var DurableApiModule = class _DurableApiModule {
   static {
     __name(this, "DurableApiModule");
   }
   static register(options) {
-    stampGuards(options.guards, [
-      options.authMayBeConfigured ? DurableApiSessionGuard : void 0,
-      options.stampGate ? DurableDashboardGateGuard : void 0
-    ], DurableApiController);
+    const routes = options.routes !== false;
     return {
       module: _DurableApiModule,
       imports: [
         ...options.imports ?? []
       ],
-      controllers: [
-        DurableApiController
-      ],
+      controllers: routes ? [
+        controllerFor(DurableApiController, options.decorators)
+      ] : [],
       providers: [
         DashboardService,
         // `@dudousxd/nestjs-filter` is wired PRIVATELY here rather than through
@@ -2894,82 +1903,81 @@ var DurableApiModule = class _DurableApiModule {
           provide: RUN_QUERY_ADAPTER,
           useExisting: RunQueryAdapter
         },
-        RunFilter,
-        options.authProvider,
-        DurableApiSessionGuard,
-        // Resolved ONCE here (this module is imported by the UI module, which reuses it via the
-        // export below), so the boot report is logged once per mount.
-        dashboardGateProvider(options.gate),
-        DurableDashboardGateGuard,
-        ...options.guards ?? []
+        RunFilter
       ],
-      exports: [
+      // Self-mounted (`routes: false`): the host's own subclass of `DurableApiControllerBase` is
+      // hosted in the HOST's module, so what its constructor injects must be exported. `FilterRunner`
+      // is only exported then: exporting it from a mounted console would shadow a host's own
+      // `FilterModule` runner in whatever module imports the dashboard.
+      exports: routes ? [
+        DashboardService
+      ] : [
         DashboardService,
-        DASHBOARD_GATE
+        import_nestjs_filter3.FilterRunner
       ]
     };
   }
 };
-DurableApiModule = _ts_decorate12([
-  (0, import_common12.Module)({})
+DurableApiModule = _ts_decorate7([
+  (0, import_common7.Module)({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
   static {
     __name(this, "DurableDashboardModule");
   }
   static forRoot(options = {}) {
-    const authProvider = {
-      provide: DASHBOARD_AUTH,
-      useValue: resolveDashboardAuth(options.dashboardAuth)
-    };
-    const authConfigured = options.dashboardAuth !== void 0;
-    return _DurableDashboardModule.build(options, authProvider, authConfigured, authConfigured);
-  }
-  static forRootAsync(options) {
-    const authProvider = {
-      provide: DASHBOARD_AUTH,
-      inject: options.inject ?? [],
-      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
-    };
-    return _DurableDashboardModule.build(options, authProvider, true, false);
-  }
-  /** Shared wiring: static routing + the API module, with `dashboardAuth` supplied by `authProvider`. */
-  static build(options, authProvider, authMayBeConfigured, authStaticallyConfigured) {
     const basePath = normalize(options.basePath ?? "/durable");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    const hasGuards = (options.guards?.length ?? 0) > 0;
-    const gate = {
-      hasGuards,
-      ...options.allowUnauthenticated !== void 0 ? {
-        allowUnauthenticated: options.allowUnauthenticated
-      } : {},
-      ...options.token !== void 0 ? {
-        token: options.token
-      } : {}
-    };
-    const stampGate = !hasGuards && !authStaticallyConfigured;
-    stampGuards(options.guards, [
-      authMayBeConfigured ? DurableUiSessionGuard : void 0,
-      stampGate ? DurableDashboardGateGuard : void 0
-    ], DurableUiController);
+    const pathProviders = [
+      {
+        provide: DASHBOARD_BASE_PATH,
+        useValue: basePath
+      },
+      {
+        provide: DASHBOARD_API_PATH,
+        useValue: apiBasePath
+      }
+    ];
+    if (options.routes === false) {
+      assertNothingToDecorate(options);
+      const api = DurableApiModule.register({
+        ...options.imports ? {
+          imports: options.imports
+        } : {},
+        routes: false
+      });
+      return {
+        module: _DurableDashboardModule,
+        imports: [
+          ...options.imports ?? [],
+          api
+        ],
+        controllers: [],
+        providers: pathProviders,
+        // What a host's subclasses of `DurableUiControllerBase` / `DurableApiControllerBase` inject:
+        // the SPA's paths, and the read/action service and the filter runner via the API module.
+        exports: [
+          DurableApiModule,
+          DASHBOARD_BASE_PATH,
+          DASHBOARD_API_PATH
+        ]
+      };
+    }
+    const decorated = (options.decorators?.length ?? 0) > 0;
     return {
       module: _DurableDashboardModule,
       imports: [
         ...options.imports ?? [],
-        // Guards + host imports must reach the API controller's HOST module — enhancers resolve
-        // from their controller's own module, never from a parent (see DurableApiModule.register).
+        // Host imports must reach the API controller's HOST module: enhancers resolve from their
+        // controller's own module, never from a parent (see DurableApiModule.register).
         // Spread-only-when-set: exactOptionalPropertyTypes rejects an explicit `undefined`.
         DurableApiModule.register({
           ...options.imports ? {
             imports: options.imports
           } : {},
-          ...options.guards ? {
-            guards: options.guards
-          } : {},
-          authProvider,
-          authMayBeConfigured,
-          gate,
-          stampGate
+          ...options.decorators ? {
+            decorators: options.decorators
+          } : {}
         }),
         import_core.RouterModule.register([
           {
@@ -2983,30 +1991,13 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ])
       ],
       controllers: [
-        DurableUiController,
-        // The auth controller (login page + logout) only exists when dashboardAuth might be
-        // configured — mounting it unconditionally would add a new `/login` route even for hosts
-        // that never set `dashboardAuth`, breaking "absent -> today's behavior byte-for-byte".
-        ...authMayBeConfigured ? [
-          DurableAuthController
-        ] : []
+        controllerFor(DurableUiController, options.decorators)
       ],
       providers: [
-        {
-          provide: DASHBOARD_BASE_PATH,
-          useValue: basePath
-        },
-        {
-          provide: DASHBOARD_API_PATH,
-          useValue: apiBasePath
-        },
-        authProvider,
-        DurableUiSessionGuard,
-        // `DASHBOARD_GATE` itself comes from the imported DurableApiModule (resolved once there).
-        DurableDashboardGateGuard,
-        // DurableUiController (and DurableAuthController, when present) are hosted HERE, so their
-        // guards DI-instantiate from this module.
-        ...options.guards ?? []
+        ...pathProviders,
+        ...decorated ? [] : [
+          protectionCheckProvider()
+        ]
       ],
       // Re-export the API module so its DashboardService reaches importers (e.g. flip's own controllers).
       exports: [
@@ -3015,27 +2006,21 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate12([
-  (0, import_common12.Module)({})
+DurableDashboardModule = _ts_decorate7([
+  (0, import_common7.Module)({})
 ], DurableDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
-  DASHBOARD_GATE,
-  DURABLE_DASHBOARD_TOKEN_ENV,
+  DASHBOARD_PROTECTION_CHECK,
   DashboardService,
   DurableApiController,
+  DurableApiControllerBase,
   DurableApiModule,
-  DurableApiSessionGuard,
-  DurableAuthController,
-  DurableDashboardGateGuard,
   DurableDashboardModule,
   DurableUiController,
-  DurableUiSessionGuard,
-  dashboardGateProvider,
-  readDashboardToken,
-  reportDashboardGate,
-  resolveDashboardGate
+  DurableUiControllerBase,
+  UNPROTECTED_CONSOLE_IN_PRODUCTION
 });
 //# sourceMappingURL=index.cjs.map