@dudousxd/nestjs-durable-dashboard 0.53.0 → 0.55.0

package/dist/server/index.js

@@ -174,6 +174,51 @@ var DashboardService = class {
     return this.gateway.cancel(runId, opts);
   }
   /**
+  * Publish a settled run's lifecycle event again, to its subscribers that have not started (or to
+  * `subscriber` alone). Undefined when the gateway cannot republish (a tenant proxy).
+  */
+  async republishLifecycle(runId, subscriber) {
+    return this.gateway.republishLifecycle?.({
+      runId,
+      ...subscriber !== void 0 ? {
+        subscriber
+      } : {}
+    });
+  }
+  /**
+  * Who starts whom through lifecycle events, for `workflow`, plus `triggerCounts` when this process
+  * counts the engine's events (the control plane) and the workflow has subscribers. Undefined when
+  * the gateway cannot answer.
+  */
+  async workflowLifecycle(workflow) {
+    const links = await this.gateway.workflowLifecycle?.(workflow);
+    if (!links) return links;
+    const counts = this.triggerCountsOf(links);
+    return counts ? {
+      ...links,
+      triggerCounts: counts
+    } : links;
+  }
+  /**
+  * How many runs each subscriber of `links.workflow` was started for and how many times starting it
+  * failed, counted by this process's metrics since it started. Undefined without metrics (a tenant)
+  * or without subscribers.
+  */
+  triggerCountsOf(links) {
+    const snapshot = this.metricsCollector?.snapshot();
+    if (!snapshot || links.startsOnSettle.length === 0) return void 0;
+    const triggered = snapshot.triggeredBySubscriber[links.workflow] ?? {};
+    const failed = snapshot.triggerFailedBySubscriber[links.workflow] ?? {};
+    const counts = {};
+    for (const { workflow } of links.startsOnSettle) {
+      counts[workflow] = {
+        triggered: triggered[workflow] ?? 0,
+        failed: failed[workflow] ?? 0
+      };
+    }
+    return counts;
+  }
+  /**
   * Apply `retry` or `cancel` to every run matching a filter (status / tag / workflow / namespace /
   * origin) — e.g. "retry every `dead` run tagged `type:mel`". The filter is the same one the run
   * list uses, so a bulk action can never reach wider than the list it was launched from — but note
@@ -274,7 +319,7 @@ DashboardService = _ts_decorate([
 
 // src/server/durable-api.controller.ts
 import { ApplyFilter, ApplyFilterInterceptor, FilterRunner } from "@dudousxd/nestjs-filter";
-import { Body, Controller, Get, Header, Headers, NotFoundException, Param, Post, Query, Res, Sse, UseFilters, UseInterceptors } from "@nestjs/common";
+import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException, Param, Post, Query, Res, Sse, UseFilters, UseInterceptors } from "@nestjs/common";
 
 // src/server/durable-run.ts
 var DurableRun = class {
@@ -351,87 +396,6 @@ __name(runValueAxisFor, "runValueAxisFor");
 
 // src/server/not-modified.ts
 import { Catch, HttpException } from "@nestjs/common";
-
-// src/server/auth/response.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord, "isRecord");
-function isRawCookieResponse(value) {
-  return isRecord(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
-}
-__name(isRawCookieResponse, "isRawCookieResponse");
-function resolveCookieResponse(response) {
-  if (isRawCookieResponse(response)) return response;
-  if (isRecord(response) && isRawCookieResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveCookieResponse, "resolveCookieResponse");
-function existingSetCookies(response) {
-  const current = response.getHeader("set-cookie");
-  if (Array.isArray(current)) return current;
-  if (typeof current === "string") return [
-    current
-  ];
-  return [];
-}
-__name(existingSetCookies, "existingSetCookies");
-function appendSetCookie(response, cookie) {
-  const raw = resolveCookieResponse(response);
-  if (!raw) return;
-  raw.setHeader("set-cookie", [
-    ...existingSetCookies(raw),
-    cookie
-  ]);
-}
-__name(appendSetCookie, "appendSetCookie");
-function isRawRedirectResponse(value) {
-  return isRecord(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
-}
-__name(isRawRedirectResponse, "isRawRedirectResponse");
-function resolveRedirectResponse(response) {
-  if (isRawRedirectResponse(response)) return response;
-  if (isRecord(response) && isRawRedirectResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveRedirectResponse, "resolveRedirectResponse");
-function redirectRaw(response, location, status = 302) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("location", location);
-  raw.end();
-}
-__name(redirectRaw, "redirectRaw");
-function responseAlreadyWritten(response) {
-  const raw = resolveRedirectResponse(response);
-  return raw?.headersSent === true;
-}
-__name(responseAlreadyWritten, "responseAlreadyWritten");
-function writeHtmlRaw(response, html, status = 200) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("content-type", "text/html; charset=utf-8");
-  raw.setHeader("cache-control", "no-store, must-revalidate");
-  raw.end(html);
-}
-__name(writeHtmlRaw, "writeHtmlRaw");
-function setRawHeader(response, name, value) {
-  resolveCookieResponse(response)?.setHeader(name, value);
-}
-__name(setRawHeader, "setRawHeader");
-function writeNotModifiedRaw(response, etag) {
-  const raw = resolveRedirectResponse(response);
-  if (!raw) return;
-  raw.statusCode = 304;
-  raw.setHeader("etag", etag);
-  raw.setHeader("cache-control", "private, no-cache");
-  raw.end();
-}
-__name(writeNotModifiedRaw, "writeNotModifiedRaw");
-
-// src/server/not-modified.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -446,6 +410,31 @@ function _ts_decorate2(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate2, "_ts_decorate");
+function isRawResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return typeof candidate.setHeader === "function" && typeof candidate.end === "function";
+}
+__name(isRawResponse, "isRawResponse");
+function rawResponse(response) {
+  if (isRawResponse(response)) return response;
+  const raw = response?.raw;
+  return isRawResponse(raw) ? raw : null;
+}
+__name(rawResponse, "rawResponse");
+function setRawHeader(response, name, value) {
+  rawResponse(response)?.setHeader(name, value);
+}
+__name(setRawHeader, "setRawHeader");
+function writeNotModifiedRaw(response, etag) {
+  const raw = rawResponse(response);
+  if (!raw) return;
+  raw.statusCode = 304;
+  raw.setHeader("etag", etag);
+  raw.setHeader("cache-control", "private, no-cache");
+  raw.end();
+}
+__name(writeNotModifiedRaw, "writeNotModifiedRaw");
 var NotModifiedException = class extends HttpException {
   static {
     __name(this, "NotModifiedException");
@@ -761,10 +750,10 @@ var RunQueryAdapter = class {
     }
     unsupported(clause, "equals, notEquals, gt, gte, lt, lte, in");
   }
-  applyOffsetPagination(qb, page2, size) {
+  applyOffsetPagination(qb, page, size) {
     this.draft(qb).narrow({
       limit: size,
-      offset: (page2 - 1) * size
+      offset: (page - 1) * size
     });
   }
   /**
@@ -1108,9 +1097,9 @@ function _ts_param2(paramIndex, decorator) {
 }
 __name(_ts_param2, "_ts_param");
 var FAN_INLINE_MAX = 50;
-var DurableApiController = class {
+var DurableApiControllerBase = class {
   static {
-    __name(this, "DurableApiController");
+    __name(this, "DurableApiControllerBase");
   }
   dashboard;
   runner;
@@ -1202,6 +1191,15 @@ var DurableApiController = class {
   triggerSchedule(id) {
     return this.dashboard.triggerSchedule(id).catch(notFound);
   }
+  /**
+  * Who starts whom through lifecycle events, for one workflow: the workflows that start when it
+  * settles, and the ones whose settling starts it. What the console's workflow page lists.
+  */
+  async workflowLifecycle(name) {
+    const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
+    if (!links) throw new NotImplementedException("workflow lifecycle links need the control plane");
+    return links;
+  }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
   topology() {
     return this.dashboard.topology();
@@ -1231,7 +1229,7 @@ var DurableApiController = class {
   }
   /** One page of a summarized fan's members, in seq order. Versioned like {@link run}. */
   async fanMembers(id, group, offset, limit, failed, ifNoneMatch, response) {
-    const page2 = await this.dashboard.getFanMembers(id, group, {
+    const page = await this.dashboard.getFanMembers(id, group, {
       offset: offset === void 0 ? void 0 : Number(offset),
       limit: limit === void 0 ? void 0 : Number(limit),
       failedOnly: failed === "true",
@@ -1239,8 +1237,8 @@ var DurableApiController = class {
         ifNoneMatch
       }
     });
-    if (!page2) throw new NotFoundException(`fan ${group} of run ${id} not found`);
-    const { etag, notModified, ...body } = page2;
+    if (!page) throw new NotFoundException(`fan ${group} of run ${id} not found`);
+    const { etag, notModified, ...body } = page;
     if (etag) {
       if (notModified) throw new NotModifiedException(etag);
       setEtag(response, etag);
@@ -1277,6 +1275,28 @@ var DurableApiController = class {
     if (!result) throw new NotFoundException(`run ${id} not found`);
     return result;
   }
+  /**
+  * Publish a settled run's lifecycle event again, to the subscribers that have not started from it
+  * (or only `subscriber`). Same gate as retry/cancel.
+  */
+  async republishLifecycle(id, body) {
+    let result;
+    try {
+      result = await this.dashboard.republishLifecycle(id, body?.subscriber || void 0);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (/^run .* not found$/.test(message)) throw new NotFoundException(message);
+      if (/^run .* has not settled/.test(message)) throw new BadRequestException2(message);
+      if (error?.code === "bad-request") {
+        throw new BadRequestException2(message);
+      }
+      return notSupportedByServer(error);
+    }
+    if (!result) {
+      throw new NotImplementedException("republishing lifecycle events needs the control plane");
+    }
+    return result;
+  }
   async continue(id) {
     const result = await this.dashboard.continue(id);
     if (!result) throw new NotFoundException(`run ${id} is not paused at a breakpoint`);
@@ -1316,7 +1336,7 @@ _ts_decorate5([
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "runs", null);
+], DurableApiControllerBase.prototype, "runs", null);
 _ts_decorate5([
   Get("runs/facets"),
   _ts_param2(0, ApplyFilter(RunFilter)),
@@ -1325,7 +1345,7 @@ _ts_decorate5([
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "facets", null);
+], DurableApiControllerBase.prototype, "facets", null);
 _ts_decorate5([
   Get("runs/values"),
   _ts_param2(0, Query()),
@@ -1334,20 +1354,20 @@ _ts_decorate5([
     typeof Record === "undefined" ? Object : Record
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "values", null);
+], DurableApiControllerBase.prototype, "values", null);
 _ts_decorate5([
   Get("metrics"),
   Header("Content-Type", "text/plain; version=0.0.4"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "metrics", null);
+], DurableApiControllerBase.prototype, "metrics", null);
 _ts_decorate5([
   Get("workers"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "workers", null);
+], DurableApiControllerBase.prototype, "workers", null);
 _ts_decorate5([
   Get("schedules"),
   _ts_param2(0, Query("namespace")),
@@ -1364,7 +1384,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "schedules", null);
+], DurableApiControllerBase.prototype, "schedules", null);
 _ts_decorate5([
   Post("schedules/:id/pause"),
   _ts_param2(0, Param("id")),
@@ -1373,7 +1393,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "pauseSchedule", null);
+], DurableApiControllerBase.prototype, "pauseSchedule", null);
 _ts_decorate5([
   Post("schedules/:id/resume"),
   _ts_param2(0, Param("id")),
@@ -1382,7 +1402,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "resumeSchedule", null);
+], DurableApiControllerBase.prototype, "resumeSchedule", null);
 _ts_decorate5([
   Post("schedules/:id/trigger"),
   _ts_param2(0, Param("id")),
@@ -1391,13 +1411,22 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "triggerSchedule", null);
+], DurableApiControllerBase.prototype, "triggerSchedule", null);
+_ts_decorate5([
+  Get("workflows/:name/lifecycle"),
+  _ts_param2(0, Param("name")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableApiControllerBase.prototype, "workflowLifecycle", null);
 _ts_decorate5([
   Get("topology"),
   _ts_metadata4("design:type", Function),
   _ts_metadata4("design:paramtypes", []),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "topology", null);
+], DurableApiControllerBase.prototype, "topology", null);
 _ts_decorate5([
   Get("runs/:id"),
   _ts_param2(0, Param("id")),
@@ -1414,7 +1443,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "run", null);
+], DurableApiControllerBase.prototype, "run", null);
 _ts_decorate5([
   Get("runs/:id/fans/:group"),
   _ts_param2(0, Param("id")),
@@ -1437,7 +1466,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "fanMembers", null);
+], DurableApiControllerBase.prototype, "fanMembers", null);
 _ts_decorate5([
   Sse("runs/:id/stream"),
   _ts_param2(0, Param("id")),
@@ -1446,7 +1475,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "stream", null);
+], DurableApiControllerBase.prototype, "stream", null);
 _ts_decorate5([
   Post("runs/:id/retry"),
   _ts_param2(0, Param("id")),
@@ -1455,7 +1484,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "retry", null);
+], DurableApiControllerBase.prototype, "retry", null);
 _ts_decorate5([
   Post("runs/:id/retry-with-input"),
   _ts_param2(0, Param("id")),
@@ -1466,7 +1495,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "retryWithInput", null);
+], DurableApiControllerBase.prototype, "retryWithInput", null);
 _ts_decorate5([
   Post("bulk/:action"),
   _ts_param2(0, Param("action")),
@@ -1479,7 +1508,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "bulk", null);
+], DurableApiControllerBase.prototype, "bulk", null);
 _ts_decorate5([
   Post("runs/:id/cancel"),
   _ts_param2(0, Param("id")),
@@ -1490,7 +1519,18 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "cancel", null);
+], DurableApiControllerBase.prototype, "cancel", null);
+_ts_decorate5([
+  Post("runs/:id/republish-lifecycle"),
+  _ts_param2(0, Param("id")),
+  _ts_param2(1, Body()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    String,
+    Object
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], DurableApiControllerBase.prototype, "republishLifecycle", null);
 _ts_decorate5([
   Post("runs/:id/continue"),
   _ts_param2(0, Param("id")),
@@ -1499,7 +1539,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "continue", null);
+], DurableApiControllerBase.prototype, "continue", null);
 _ts_decorate5([
   Post("runs/:id/redispatch"),
   _ts_param2(0, Param("id")),
@@ -1508,7 +1548,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "redispatch", null);
+], DurableApiControllerBase.prototype, "redispatch", null);
 _ts_decorate5([
   Post("webhooks/:token"),
   _ts_param2(0, Param("token")),
@@ -1519,7 +1559,7 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", Promise)
-], DurableApiController.prototype, "webhook", null);
+], DurableApiControllerBase.prototype, "webhook", null);
 _ts_decorate5([
   Get("runs/:id/events/:key"),
   _ts_param2(0, Param("id")),
@@ -1530,7 +1570,7 @@ _ts_decorate5([
     String
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "event", null);
+], DurableApiControllerBase.prototype, "event", null);
 _ts_decorate5([
   Post("runs/:id/updates/:name"),
   _ts_param2(0, Param("id")),
@@ -1543,8 +1583,8 @@ _ts_decorate5([
     Object
   ]),
   _ts_metadata4("design:returntype", void 0)
-], DurableApiController.prototype, "update", null);
-DurableApiController = _ts_decorate5([
+], DurableApiControllerBase.prototype, "update", null);
+DurableApiControllerBase = _ts_decorate5([
   Controller(),
   UseInterceptors(ApplyFilterInterceptor),
   UseFilters(NotModifiedFilter),
@@ -1553,7 +1593,7 @@ DurableApiController = _ts_decorate5([
     typeof DashboardService === "undefined" ? Object : DashboardService,
     typeof FilterRunner === "undefined" ? Object : FilterRunner
   ])
-], DurableApiController);
+], DurableApiControllerBase);
 function notFound(error) {
   if (error instanceof Error && error.name === "ScheduleNotFoundError") {
     throw new NotFoundException(error.message);
@@ -1561,498 +1601,59 @@ function notFound(error) {
   throw error;
 }
 __name(notFound, "notFound");
-
-// src/server/durable-auth.controller.ts
-import { BadRequestException as BadRequestException2, Body as Body2, Controller as Controller3, Get as Get3, Header as Header3, HttpCode, Inject as Inject4, Logger as Logger2, NotFoundException as NotFoundException3, Optional as Optional3, Post as Post2, Req, Res as Res2, UnauthorizedException } from "@nestjs/common";
-
-// src/server/auth/dashboard-auth-config.ts
-var DASHBOARD_AUTH = Symbol("DASHBOARD_AUTH");
-var DEFAULT_TTL = "8h";
-var DEFAULT_TTL_MS = 8 * 60 * 60 * 1e3;
-var DURATION_UNITS = {
-  s: 1e3,
-  m: 60 * 1e3,
-  h: 60 * 60 * 1e3,
-  d: 24 * 60 * 60 * 1e3
-};
-function durationToMs(ttl) {
-  const match = /^(\d+)([smhd])$/.exec(ttl.trim());
-  if (!match) return DEFAULT_TTL_MS;
-  const unit = DURATION_UNITS[match[2] ?? ""];
-  if (unit === void 0) return DEFAULT_TTL_MS;
-  return Number(match[1]) * unit;
-}
-__name(durationToMs, "durationToMs");
-function resolveDashboardAuth(options) {
-  if (options === void 0) return null;
-  if (typeof options.secret !== "string" || options.secret === "") {
-    throw new Error("DurableDashboardModule: dashboardAuth.secret is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
-  }
-  const modes = [];
-  if (options.session !== void 0) {
-    if (typeof options.session !== "function") {
-      throw new Error("DurableDashboardModule: dashboardAuth.session must be a function.");
-    }
-    modes.push("session");
-  }
-  if (options.login !== void 0) {
-    if (typeof options.login !== "function") {
-      throw new Error("DurableDashboardModule: dashboardAuth.login must be a function.");
-    }
-    modes.push("login");
-  }
-  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.revalidate must be a function.");
+function notSupportedByServer(error) {
+  if (error?.code === "unsupported-request") {
+    throw new NotImplementedException(error instanceof Error ? error.message : String(error));
   }
-  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
-    throw new Error("DurableDashboardModule: dashboardAuth.unauthenticatedPage must be a function.");
-  }
-  if (modes.length === 0) {
-    throw new Error("DurableDashboardModule: dashboardAuth needs at least one of `session` or `login` (otherwise the cookie can never be minted). Failing closed.");
-  }
-  return {
-    secret: options.secret,
-    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    modes,
-    ...options.session !== void 0 ? {
-      session: options.session
-    } : {},
-    ...options.login !== void 0 ? {
-      login: options.login
-    } : {},
-    ...options.revalidate !== void 0 ? {
-      revalidate: options.revalidate
-    } : {},
-    ...options.unauthenticatedPage !== void 0 ? {
-      unauthenticatedPage: options.unauthenticatedPage
-    } : {}
-  };
-}
-__name(resolveDashboardAuth, "resolveDashboardAuth");
-
-// src/server/auth/login-page.ts
-function page(content, title = "Durable") {
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex, nofollow" />
-<title>${title}</title>
-<style>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    background: #09090b;
-    color: #e4e4e7;
-    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    padding: 16px;
-  }
-  .card {
-    width: 100%;
-    max-width: 384px;
-    border: 1px solid #27272a;
-    background: #18181b;
-    border-radius: 8px;
-    padding: 32px;
-    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
-  }
-  .brand {
-    margin: 0 0 24px;
-    text-align: center;
-    font-size: 18px;
-    font-weight: 600;
-    color: #34d399;
-  }
-  h1 {
-    margin: 0 0 12px;
-    font-size: 16px;
-    font-weight: 600;
-    color: #f4f4f5;
-  }
-  p { margin: 0 0 16px; color: #a1a1aa; }
-  form { display: flex; flex-direction: column; gap: 16px; }
-  label { display: flex; flex-direction: column; gap: 6px; }
-  .field-label {
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    color: #71717a;
-  }
-  input {
-    border-radius: 4px;
-    border: 1px solid #3f3f46;
-    background: #09090b;
-    color: #f4f4f5;
-    padding: 8px 12px;
-    font: inherit;
-    outline: none;
-  }
-  input:focus { border-color: rgb(52 211 153 / 0.6); }
-  #error {
-    display: none;
-    margin: 0;
-    font-size: 12px;
-    color: #fb7185;
-  }
-  button, .button {
-    margin-top: 8px;
-    border-radius: 4px;
-    border: 1px solid rgb(52 211 153 / 0.4);
-    background: rgb(52 211 153 / 0.1);
-    color: #6ee7b7;
-    padding: 8px 12px;
-    font: inherit;
-    font-size: 12px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    cursor: pointer;
-    display: inline-block;
-    text-align: center;
-    text-decoration: none;
-    box-sizing: border-box;
-  }
-  button:hover:not(:disabled), .button:hover { background: rgb(52 211 153 / 0.2); }
-  button:disabled { opacity: 0.6; cursor: default; }
-</style>
-</head>
-<body>
-  <div class="card">
-    ${content}
-  </div>
-</body>
-</html>`;
+  throw error;
 }
-__name(page, "page");
-function renderLoginPage(basePath) {
-  const loginAction = `${basePath}/login`;
-  const defaultReturnTo = basePath;
-  return page(`<p class="brand">Durable</p>
-    <form id="login-form" autocomplete="on">
-      <label>
-        <span class="field-label">Username</span>
-        <input id="username" name="username" type="text" autocomplete="username" required autofocus />
-      </label>
-      <label>
-        <span class="field-label">Password</span>
-        <input id="password" name="password" type="password" autocomplete="current-password" />
-      </label>
-      <p id="error" role="alert">Invalid username or password.</p>
-      <button id="submit" type="submit">Sign in</button>
-    </form>
-<script>
-(function () {
-  var LOGIN_ACTION = ${JSON.stringify(loginAction)};
-  var DEFAULT_RETURN_TO = ${JSON.stringify(defaultReturnTo)};
-  var params = new URLSearchParams(window.location.search);
-  var errorBox = document.getElementById('error');
-  if (params.get('error')) errorBox.style.display = 'block';
-
-  function sameOriginReturnTo(value) {
-    if (typeof value !== 'string' || value === '') return DEFAULT_RETURN_TO;
-    if (value.charAt(0) !== '/' || value.charAt(1) === '/' || value.indexOf('://') !== -1) {
-      return DEFAULT_RETURN_TO;
-    }
-    return value;
+__name(notSupportedByServer, "notSupportedByServer");
+var DurableApiController = class extends DurableApiControllerBase {
+  static {
+    __name(this, "DurableApiController");
   }
+};
+DurableApiController = _ts_decorate5([
+  Controller()
+], DurableApiController);
 
-  var form = document.getElementById('login-form');
-  var submitButton = document.getElementById('submit');
-  form.addEventListener('submit', function (event) {
-    event.preventDefault();
-    submitButton.disabled = true;
-    errorBox.style.display = 'none';
-    var returnTo = sameOriginReturnTo(params.get('returnTo'));
-    fetch(LOGIN_ACTION, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      credentials: 'same-origin',
-      body: JSON.stringify({
-        username: document.getElementById('username').value,
-        password: document.getElementById('password').value,
-        returnTo: returnTo,
-      }),
-    })
-      .then(function (response) {
-        if (!response.ok) throw new Error('unauthorized');
-        return response.json();
-      })
-      .then(function (data) {
-        window.location.href = data.redirectTo || DEFAULT_RETURN_TO;
-      })
-      .catch(function () {
-        errorBox.style.display = 'block';
-        submitButton.disabled = false;
-      });
-  });
-})();
-</script>`, "Sign in \u2014 Durable");
-}
-__name(renderLoginPage, "renderLoginPage");
-function renderSessionRequiredPage(basePath) {
-  return page(`<h1>Open this console from your application</h1>
-     <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>
-     <a class="button" href="${basePath}">Retry</a>`);
-}
-__name(renderSessionRequiredPage, "renderSessionRequiredPage");
-
-// src/server/auth/request.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord2, "isRecord");
-function readHeaders(request) {
-  if (!isRecord2(request)) return {};
-  const headers = request.headers;
-  return isRecord2(headers) ? headers : {};
-}
-__name(readHeaders, "readHeaders");
-function headerToString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
-    return value.join(",");
-  }
-  return void 0;
-}
-__name(headerToString, "headerToString");
-function readCookieHeader(request) {
-  return headerToString(readHeaders(request).cookie);
-}
-__name(readCookieHeader, "readCookieHeader");
-function isHttpsRequest(request) {
-  if (isRecord2(request) && request.protocol === "https") return true;
-  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
-  if (forwarded === void 0) return false;
-  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
-}
-__name(isHttpsRequest, "isHttpsRequest");
-function originalRequestUrl(request) {
-  if (!isRecord2(request)) return "/";
-  if (typeof request.originalUrl === "string" && request.originalUrl !== "") {
-    return request.originalUrl;
-  }
-  if (typeof request.url === "string" && request.url !== "") return request.url;
-  return "/";
-}
-__name(originalRequestUrl, "originalRequestUrl");
-function sanitizeReturnTo(candidate, fallback) {
-  if (typeof candidate !== "string") return fallback;
-  if (!candidate.startsWith("/")) return fallback;
-  if (candidate.startsWith("//")) return fallback;
-  if (candidate.includes("://")) return fallback;
-  return candidate;
-}
-__name(sanitizeReturnTo, "sanitizeReturnTo");
+// src/server/durable-dashboard.module.ts
+import "reflect-metadata";
+import { ApplyFilterInterceptor as ApplyFilterInterceptor2, FilterRunner as FilterRunner2 } from "@dudousxd/nestjs-filter";
+import { Logger, Module } from "@nestjs/common";
+import { ModuleRef, RouterModule } from "@nestjs/core";
 
-// src/server/auth/cookie-header.ts
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (typeof header !== "string" || header === "") return cookies;
-  for (const segment of header.split(";")) {
-    const eq = segment.indexOf("=");
-    if (eq <= 0) continue;
-    const name = segment.slice(0, eq).trim();
-    if (name === "") continue;
-    let rawValue = segment.slice(eq + 1).trim();
-    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
-      rawValue = rawValue.slice(1, -1);
-    }
-    if (name in cookies) continue;
-    try {
-      cookies[name] = decodeURIComponent(rawValue);
-    } catch {
-      cookies[name] = rawValue;
+// src/server/controller-decorators.ts
+import "reflect-metadata";
+var CAN_ANYONE_METADATA = "authorization:can-anyone";
+function markOpenToAuthorization(controller) {
+  Reflect.defineMetadata(CAN_ANYONE_METADATA, true, controller);
+}
+__name(markOpenToAuthorization, "markOpenToAuthorization");
+function controllerFor(base, decorators) {
+  if (decorators === void 0 || decorators.length === 0) return base;
+  const derived = class extends base {
+    static {
+      __name(this, "derived");
     }
-  }
-  return cookies;
-}
-__name(parseCookieHeader, "parseCookieHeader");
-function serializeSetCookie(name, value, options) {
-  const parts = [
-    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
-  ];
-  parts.push(`Path=${options.path}`);
-  parts.push("HttpOnly");
-  parts.push("SameSite=Lax");
-  if (options.secure) parts.push("Secure");
-  if (options.clear) {
-    parts.push("Max-Age=0");
-    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  } else {
-    parts.push(`Max-Age=${options.maxAgeSeconds}`);
-  }
-  return parts.join("; ");
-}
-__name(serializeSetCookie, "serializeSetCookie");
-
-// src/server/auth/session-cookie.ts
-import { createHmac, timingSafeEqual } from "node:crypto";
-var EXP_GRACE_MS = 3e4;
-function base64urlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-__name(base64urlEncode, "base64urlEncode");
-function base64urlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-__name(base64urlDecode, "base64urlDecode");
-function hmac(secret, payload) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-__name(hmac, "hmac");
-function signSessionCookie(user, options) {
-  const issuedAt = options.now ?? Date.now();
-  const session = {
-    sub: user.id,
-    ...user.name !== void 0 ? {
-      name: user.name
-    } : {},
-    roles: user.roles ?? [],
-    iat: issuedAt,
-    exp: issuedAt + options.ttlMs
-  };
-  const encodedPayload = base64urlEncode(JSON.stringify(session));
-  const signature = hmac(options.secret, encodedPayload);
-  return `${encodedPayload}.${signature}`;
-}
-__name(signSessionCookie, "signSessionCookie");
-function isSessionPayload(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = {
-    ...value
   };
-  if (typeof record.sub !== "string") return false;
-  if (record.name !== void 0 && typeof record.name !== "string") return false;
-  if (!Array.isArray(record.roles)) return false;
-  if (!record.roles.every((role) => typeof role === "string")) return false;
-  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
-  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
-  return true;
-}
-__name(isSessionPayload, "isSessionPayload");
-function verifySessionCookie(value, options) {
-  try {
-    const dot = value.indexOf(".");
-    if (dot <= 0 || dot === value.length - 1) return null;
-    const encodedPayload = value.slice(0, dot);
-    const providedSignature = value.slice(dot + 1);
-    const expectedSignature = hmac(options.secret, encodedPayload);
-    const provided = Buffer.from(providedSignature, "base64url");
-    const expected = Buffer.from(expectedSignature, "base64url");
-    if (provided.length !== expected.length) return null;
-    if (!timingSafeEqual(provided, expected)) return null;
-    const decoded = JSON.parse(base64urlDecode(encodedPayload));
-    if (!isSessionPayload(decoded)) return null;
-    const now = options.now ?? Date.now();
-    if (now > decoded.exp + EXP_GRACE_MS) return null;
-    const session = {
-      sub: decoded.sub,
-      ...decoded.name !== void 0 ? {
-        name: decoded.name
-      } : {},
-      roles: decoded.roles,
-      iat: decoded.iat,
-      exp: decoded.exp
-    };
-    return session;
-  } catch {
-    return null;
-  }
-}
-__name(verifySessionCookie, "verifySessionCookie");
-
-// src/server/auth/session-cookie-io.ts
-var SESSION_COOKIE_NAME = "durable_dashboard_session";
-var COOKIE_PATH = "/";
-function issueSessionCookie(user, context) {
-  const value = signSessionCookie(user, {
-    secret: context.auth.secret,
-    ttlMs: context.auth.ttlMs,
-    ...context.now !== void 0 ? {
-      now: context.now
-    } : {}
-  });
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
-    path: COOKIE_PATH,
-    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
-    secure: isHttpsRequest(context.request)
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(issueSessionCookie, "issueSessionCookie");
-function clearSessionCookie(context) {
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
-    path: COOKIE_PATH,
-    maxAgeSeconds: 0,
-    secure: isHttpsRequest(context.request),
-    clear: true
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(clearSessionCookie, "clearSessionCookie");
-function readSessionFromRequest(auth, request) {
-  const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-  if (cookieValue === void 0) return null;
-  return verifySessionCookie(cookieValue, {
-    secret: auth.secret
+  Object.defineProperty(derived, "name", {
+    value: base.name
   });
-}
-__name(readSessionFromRequest, "readSessionFromRequest");
-var inFlightRevalidations = /* @__PURE__ */ new Map();
-function revalidateOnce(auth, user) {
-  const revalidate = auth.revalidate;
-  if (!revalidate) return Promise.resolve(true);
-  const key = `${auth.secret}:${user.id}`;
-  const inFlight = inFlightRevalidations.get(key);
-  if (inFlight) return inFlight;
-  const call = Promise.resolve().then(() => revalidate(user)).catch(() => false).finally(() => {
-    inFlightRevalidations.delete(key);
-  });
-  inFlightRevalidations.set(key, call);
-  return call;
-}
-__name(revalidateOnce, "revalidateOnce");
-async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
-  if (now - session.iat <= auth.ttlMs / 2) return true;
-  const user = {
-    id: session.sub,
-    ...session.name !== void 0 ? {
-      name: session.name
-    } : {},
-    roles: session.roles
-  };
-  const allowed = await revalidateOnce(auth, user);
-  if (!allowed) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    return false;
+  markOpenToAuthorization(derived);
+  let decorated = derived;
+  for (const decorator of decorators) {
+    decorated = decorator(decorated) ?? decorated;
   }
-  issueSessionCookie(user, {
-    auth,
-    request,
-    response,
-    now
-  });
-  return true;
+  return decorated;
 }
-__name(maybeRenewSession, "maybeRenewSession");
+__name(controllerFor, "controllerFor");
 
 // src/server/durable-ui.controller.ts
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, StreamableFile, UseFilters as UseFilters2 } from "@nestjs/common";
-
-// src/server/auth/login-redirect.exception.ts
-import { Catch as Catch2, HttpException as HttpException2, HttpStatus } from "@nestjs/common";
+import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject2, NotFoundException as NotFoundException2, Param as Param2, StreamableFile } from "@nestjs/common";
 function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -2067,46 +1668,6 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate6, "_ts_decorate");
-var DashboardLoginRedirectException = class extends HttpException2 {
-  static {
-    __name(this, "DashboardLoginRedirectException");
-  }
-  location;
-  constructor(location) {
-    super({
-      location
-    }, HttpStatus.FOUND), this.location = location;
-  }
-};
-var DashboardLoginRedirectFilter = class {
-  static {
-    __name(this, "DashboardLoginRedirectFilter");
-  }
-  catch(exception, host) {
-    const response = host.switchToHttp().getResponse();
-    redirectRaw(response, exception.location);
-  }
-};
-DashboardLoginRedirectFilter = _ts_decorate6([
-  Catch2(DashboardLoginRedirectException)
-], DashboardLoginRedirectFilter);
-
-// src/server/auth/session-required.exception.ts
-import { Catch as Catch3, HttpException as HttpException3, HttpStatus as HttpStatus2, Inject as Inject2, Logger, Optional as Optional2 } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
 function _ts_metadata5(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
@@ -2119,91 +1680,6 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
-var DashboardSessionRequiredException = class extends HttpException3 {
-  static {
-    __name(this, "DashboardSessionRequiredException");
-  }
-  basePath;
-  constructor(basePath) {
-    super({
-      basePath
-    }, HttpStatus2.UNAUTHORIZED), this.basePath = basePath;
-  }
-};
-var DashboardSessionRequiredFilter = class _DashboardSessionRequiredFilter {
-  static {
-    __name(this, "DashboardSessionRequiredFilter");
-  }
-  auth;
-  logger = new Logger(_DashboardSessionRequiredFilter.name);
-  warned = false;
-  constructor(auth = null) {
-    this.auth = auth;
-  }
-  async catch(exception, host) {
-    const http = host.switchToHttp();
-    const response = http.getResponse();
-    const hook = this.auth?.unauthenticatedPage;
-    if (hook) {
-      try {
-        await hook({
-          request: http.getRequest(),
-          response,
-          basePath: exception.basePath
-        });
-        if (responseAlreadyWritten(response)) return;
-        this.warnOnce("dashboardAuth.unauthenticatedPage returned without writing a response; falling back to the built-in page. The hook must write AND end the response it is given.");
-      } catch (error) {
-        this.warnOnce(`dashboardAuth.unauthenticatedPage threw; falling back to the built-in page. ${String(error)}`);
-        if (responseAlreadyWritten(response)) return;
-      }
-    }
-    writeHtmlRaw(response, renderSessionRequiredPage(exception.basePath), HttpStatus2.UNAUTHORIZED);
-  }
-  /** Once per process, not once per request: a broken hook fires on every denied navigation. */
-  warnOnce(message) {
-    if (this.warned) return;
-    this.warned = true;
-    this.logger.warn(message);
-  }
-};
-DashboardSessionRequiredFilter = _ts_decorate7([
-  Catch3(DashboardSessionRequiredException),
-  _ts_param3(0, Optional2()),
-  _ts_param3(0, Inject2(DASHBOARD_AUTH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    Object
-  ])
-], DashboardSessionRequiredFilter);
-
-// src/server/durable-ui.controller.ts
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
 var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
 var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
 var BUILD_BASE = "/durable";
@@ -2220,9 +1696,9 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2",
   ".ico": "image/x-icon"
 };
-var DurableUiController = class {
+var DurableUiControllerBase = class {
   static {
-    __name(this, "DurableUiController");
+    __name(this, "DurableUiControllerBase");
   }
   basePath;
   apiBasePath;
@@ -2256,223 +1732,45 @@ var DurableUiController = class {
     });
   }
 };
-_ts_decorate8([
+_ts_decorate6([
   Get2(),
   Header2("Content-Type", "text/html; charset=utf-8"),
   Header2("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", String)
-], DurableUiController.prototype, "index", null);
-_ts_decorate8([
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", String)
+], DurableUiControllerBase.prototype, "index", null);
+_ts_decorate6([
   Get2("assets/:file"),
   Header2("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param4(0, Param2("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param3(0, Param2("file")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
-], DurableUiController.prototype, "asset", null);
-DurableUiController = _ts_decorate8([
-  UseFilters2(DashboardLoginRedirectFilter, DashboardSessionRequiredFilter),
+  _ts_metadata5("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+], DurableUiControllerBase.prototype, "asset", null);
+DurableUiControllerBase = _ts_decorate6([
   Controller2(),
-  _ts_param4(0, Inject3(DASHBOARD_BASE_PATH)),
-  _ts_param4(1, Inject3(DASHBOARD_API_PATH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param3(0, Inject2(DASHBOARD_BASE_PATH)),
+  _ts_param3(1, Inject2(DASHBOARD_API_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ])
-], DurableUiController);
-
-// src/server/durable-auth.controller.ts
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata7(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-function isString(value) {
-  return typeof value === "string";
-}
-__name(isString, "isString");
-var DurableAuthController = class _DurableAuthController {
+], DurableUiControllerBase);
+var DurableUiController = class extends DurableUiControllerBase {
   static {
-    __name(this, "DurableAuthController");
-  }
-  auth;
-  basePath;
-  logger = new Logger2(_DurableAuthController.name);
-  /** Warn once per hook kind so a throwing hook doesn't spam logs on every failed attempt. */
-  warnedHooks = /* @__PURE__ */ new Set();
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  // The login page reads `returnTo`/`error` from `location.search` client-side (see
-  // `login-page.ts`), so this response never varies per request and needs no templating beyond
-  // the developer-controlled `basePath`.
-  loginPage() {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException3();
-    return renderLoginPage(this.basePath);
-  }
-  // Called by the login page's own fetch (JSON, not a classic form POST — see `login-page.ts` for
-  // why: it keeps the login page working with no host-configured body parser beyond the
-  // JSON one Nest wires in by default on both Express and Fastify). Uniform `401` on any failure
-  // (unknown user, wrong password, throwing hook) — no user-enumeration.
-  async login(body, request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException3();
-    if (!isString(body?.username) || !isString(body?.password)) {
-      throw new BadRequestException2("Body must include string `username` and `password`.");
-    }
-    const { username, password } = body;
-    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
-    if (!user) throw new UnauthorizedException({
-      message: "Invalid username or password."
-    });
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-    return {
-      redirectTo: sanitizeReturnTo(body.returnTo, this.basePath)
-    };
-  }
-  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
-  // request and returns the session user, or `null` to deny. This is the SSO path — the host's own
-  // guard decides, and no credential ever reaches this library.
-  async session(request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("session")) throw new NotFoundException3();
-    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
-    if (!user) throw new UnauthorizedException();
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-  }
-  // Plain `GET` (not `POST`): logging out only ever destroys the CALLER's own session, so it's
-  // safe/idempotent from the caller's perspective — a simple `<a href>` (no JS, no CSRF token)
-  // works. Non-passthrough `@Res()`: this handler owns the response outright (clears the cookie,
-  // then redirects), so Nest must not also try to send a return value afterwards.
-  logout(request, response) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    redirectRaw(response, this.auth?.modes.includes("login") ? `${this.basePath}/login` : this.basePath);
-  }
-  requireAuth() {
-    if (!this.auth) throw new NotFoundException3();
-    return this.auth;
-  }
-  /**
-  * Run a host hook (`login` or `session`) defensively: a throw is treated as a denial (uniform
-  * failure) and warn-logged once PER KIND, so a buggy hook never 500s the endpoint into a
-  * stack-trace leak nor floods the logs on repeated bad attempts.
-  */
-  async runHook(kind, run) {
-    try {
-      return await run() ?? null;
-    } catch (error) {
-      if (!this.warnedHooks.has(kind)) {
-        this.warnedHooks.add(kind);
-        this.logger.warn(`dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
-      }
-      return null;
-    }
+    __name(this, "DurableUiController");
   }
 };
-_ts_decorate9([
-  Get3("login"),
-  Header3("Content-Type", "text/html; charset=utf-8"),
-  Header3("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", []),
-  _ts_metadata7("design:returntype", String)
-], DurableAuthController.prototype, "loginPage", null);
-_ts_decorate9([
-  Post2("login"),
-  HttpCode(200),
-  _ts_param5(0, Body2()),
-  _ts_param5(1, Req()),
-  _ts_param5(2, Res2({
-    passthrough: true
-  })),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    typeof LoginBody === "undefined" ? Object : LoginBody,
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", Promise)
-], DurableAuthController.prototype, "login", null);
-_ts_decorate9([
-  Post2("session"),
-  HttpCode(204),
-  _ts_param5(0, Req()),
-  _ts_param5(1, Res2({
-    passthrough: true
-  })),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", Promise)
-], DurableAuthController.prototype, "session", null);
-_ts_decorate9([
-  Get3("logout"),
-  _ts_param5(0, Req()),
-  _ts_param5(1, Res2()),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata7("design:returntype", void 0)
-], DurableAuthController.prototype, "logout", null);
-DurableAuthController = _ts_decorate9([
-  Controller3(),
-  _ts_param5(0, Optional3()),
-  _ts_param5(0, Inject4(DASHBOARD_AUTH)),
-  _ts_param5(1, Inject4(DASHBOARD_BASE_PATH)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    Object,
-    String
-  ])
-], DurableAuthController);
+DurableUiController = _ts_decorate6([
+  Controller2()
+], DurableUiController);
 
-// src/server/durable-dashboard-gate.guard.ts
-import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { ForbiddenException, Inject as Inject5, Injectable as Injectable4, Logger as Logger3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-function _ts_decorate10(decorators, target, key, desc) {
+// src/server/durable-dashboard.module.ts
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2485,342 +1783,59 @@ function _ts_decorate10(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata8(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param6, "_ts_param");
-var DURABLE_DASHBOARD_TOKEN_ENV = "DURABLE_DASHBOARD_TOKEN";
-var DASHBOARD_GATE = Symbol("DASHBOARD_GATE");
-var LOG_CONTEXT = "DurableDashboard";
-var HOW_TO_CONFIGURE = [
-  "Configure one of: `guards: [YourAuthGuard]`, `dashboardAuth: { secret, session | login }`",
-  "(or `useDashboardAuth` in forRootAsync), a bearer token via the `token` option or the",
-  `${DURABLE_DASHBOARD_TOKEN_ENV} env var, or \`allowUnauthenticated: true\` when the console is`,
-  "already protected outside this module (a global guard, a reverse proxy, a private network)."
+__name(_ts_decorate7, "_ts_decorate");
+markOpenToAuthorization(DurableApiController);
+markOpenToAuthorization(DurableUiController);
+var DASHBOARD_PROTECTION_CHECK = Symbol("DASHBOARD_PROTECTION_CHECK");
+var UNPROTECTED_CONSOLE_IN_PRODUCTION = [
+  "DurableDashboardModule: NODE_ENV=production and the durable console is mounted with no",
+  "protection, so the app refuses to boot. Protect it one of two ways:",
+  "(1) decorators on the mounted console: DurableDashboardModule.forRoot({ decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')] });",
+  "(2) mount it yourself: DurableDashboardModule.forRoot({ routes: false }) plus @Controller('durable') @UseGuards(AuthenticationGuard) @Can(ConsolePolicy, 'view') class ConsoleUi extends DurableUiControllerBase {} (and the same over DurableApiControllerBase at 'durable/api')."
 ].join(" ");
 function isProduction() {
   return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
 }
 __name(isProduction, "isProduction");
-function resolveDashboardGate(options, auth) {
-  if (options.hasGuards || auth !== null) return {
-    mode: "delegated"
-  };
-  const token = options.token ?? process.env[DURABLE_DASHBOARD_TOKEN_ENV];
-  if (typeof token === "string" && token !== "") return {
-    mode: "token",
-    token
-  };
-  if (options.allowUnauthenticated === true) return {
-    mode: "open"
-  };
+function protectionCheckProvider() {
   return {
-    mode: isProduction() ? "deny" : "unconfigured"
-  };
-}
-__name(resolveDashboardGate, "resolveDashboardGate");
-function reportDashboardGate(gate, options, logger = new Logger3(LOG_CONTEXT)) {
-  switch (gate.mode) {
-    case "open":
-      logger.warn("allowUnauthenticated: true. The durable console (including retry/cancel and other mutating endpoints) is served with NO authentication from this module. Only do this when a global guard or reverse proxy already protects it.");
-      return;
-    case "token":
-      if (options.allowUnauthenticated === true) {
-        logger.warn("allowUnauthenticated: true is ignored because a dashboard token is configured; requests must carry the token.");
-      }
-      return;
-    case "unconfigured":
-      logger.warn([
-        "The durable console is UNAUTHENTICATED: no guards, dashboardAuth, token or",
-        "allowUnauthenticated were configured. It is served open because NODE_ENV is not",
-        '"production", but it WILL deny every request when NODE_ENV=production.',
-        HOW_TO_CONFIGURE
-      ].join(" "));
-      return;
-    case "deny":
-      logger.error([
-        "The durable console has no authentication configured and NODE_ENV=production, so it",
-        "is failing closed: every console request (UI and API) is denied.",
-        HOW_TO_CONFIGURE
-      ].join(" "));
-      return;
-    case "delegated":
-      return;
-  }
-}
-__name(reportDashboardGate, "reportDashboardGate");
-function dashboardGateProvider(options) {
-  return {
-    provide: DASHBOARD_GATE,
-    inject: [
-      DASHBOARD_AUTH
-    ],
-    useFactory: /* @__PURE__ */ __name((auth) => {
-      const gate = resolveDashboardGate(options, auth);
-      reportDashboardGate(gate, options);
-      return gate;
+    provide: DASHBOARD_PROTECTION_CHECK,
+    useFactory: /* @__PURE__ */ __name(() => {
+      if (isProduction()) throw new Error(UNPROTECTED_CONSOLE_IN_PRODUCTION);
+      new Logger("DurableDashboard").warn("The durable console is mounted with no `decorators`, so it is served OPEN (retry/cancel included). That is refused when NODE_ENV=production: pass `decorators` (e.g. [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]) or mount it yourself with `routes: false`.");
+      return true;
     }, "useFactory")
   };
 }
-__name(dashboardGateProvider, "dashboardGateProvider");
-function isRecord3(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord3, "isRecord");
-function headerValue(request, name) {
-  const headers = request.headers;
-  if (!isRecord3(headers)) return void 0;
-  const value = headers[name];
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && typeof value[0] === "string") return value[0];
-  return void 0;
-}
-__name(headerValue, "headerValue");
-function readDashboardToken(request) {
-  if (!isRecord3(request)) return void 0;
-  const authorization = headerValue(request, "authorization");
-  if (authorization) {
-    const match = /^Bearer\s+(.+)$/i.exec(authorization);
-    if (match?.[1]) return match[1].trim();
-  }
-  const header = headerValue(request, "x-durable-token");
-  if (header) return header.trim();
-  const method = typeof request.method === "string" ? request.method.toUpperCase() : "";
-  if (method === "GET" || method === "HEAD") {
-    const query = request.query;
-    if (isRecord3(query)) {
-      const value = query.token;
-      if (typeof value === "string" && value !== "") return value;
-    }
-  }
-  return void 0;
-}
-__name(readDashboardToken, "readDashboardToken");
-function secretsMatch(provided, expected) {
-  const a = Buffer.from(provided);
-  const b = Buffer.from(expected);
-  if (a.length !== b.length) return false;
-  return timingSafeEqual2(a, b);
-}
-__name(secretsMatch, "secretsMatch");
-var DurableDashboardGateGuard = class {
-  static {
-    __name(this, "DurableDashboardGateGuard");
-  }
-  gate;
-  constructor(gate) {
-    this.gate = gate;
-  }
-  canActivate(context) {
-    switch (this.gate.mode) {
-      case "delegated":
-      case "open":
-      case "unconfigured":
-        return true;
-      case "deny":
-        throw new ForbiddenException([
-          "Durable dashboard authentication is not configured, and NODE_ENV=production denies",
-          "an unauthenticated console.",
-          HOW_TO_CONFIGURE
-        ].join(" "));
-      case "token": {
-        const provided = readDashboardToken(context.switchToHttp().getRequest());
-        if (provided !== void 0 && secretsMatch(provided, this.gate.token ?? "")) return true;
-        throw new UnauthorizedException2("A valid durable dashboard token is required (Authorization: Bearer <token>, x-durable-token, or ?token= on GET).");
-      }
-    }
-  }
-};
-DurableDashboardGateGuard = _ts_decorate10([
-  Injectable4(),
-  _ts_param6(0, Inject5(DASHBOARD_GATE)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
-    typeof DashboardGate === "undefined" ? Object : DashboardGate
-  ])
-], DurableDashboardGateGuard);
-
-// src/server/durable-dashboard.module.ts
-import "reflect-metadata";
-import { ApplyFilterInterceptor as ApplyFilterInterceptor2, FilterRunner as FilterRunner2 } from "@dudousxd/nestjs-filter";
-import { Module } from "@nestjs/common";
-import { ModuleRef, RouterModule } from "@nestjs/core";
-
-// src/server/durable-session.guard.ts
-import { Inject as Inject6, Injectable as Injectable5, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
-function _ts_decorate11(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata9(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata9, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param7, "_ts_param");
-var DurableUiSessionGuard = class {
-  static {
-    __name(this, "DurableUiSessionGuard");
-  }
-  auth;
-  basePath;
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = readSessionFromRequest(auth, request);
-    if (!session) {
-      this.denyUnauthenticated(auth, request);
-    }
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      this.denyUnauthenticated(auth, request);
-    }
-    return true;
-  }
-  /**
-  * A revoked session (the host's `revalidate` hook says no) is denied exactly like an absent
-  * one — by design, there is nothing left to distinguish "never had a session" from "had one,
-  * then lost it" once the cookie is cleared, so both get the same Mode-aware treatment.
-  *
-  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
-  * return narrows the field within that method only — TS doesn't carry it across a method call
-  * — so callers pass the already-narrowed value instead of this method re-deriving (or
-  * asserting away) the nullability.
-  */
-  denyUnauthenticated(auth, request) {
-    if (!auth.modes.includes("login")) throw new DashboardSessionRequiredException(this.basePath);
-    const returnTo = encodeURIComponent(originalRequestUrl(request));
-    throw new DashboardLoginRedirectException(`${this.basePath}/login?returnTo=${returnTo}`);
-  }
-};
-DurableUiSessionGuard = _ts_decorate11([
-  Injectable5(),
-  _ts_param7(0, Inject6(DASHBOARD_AUTH)),
-  _ts_param7(1, Inject6(DASHBOARD_BASE_PATH)),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
-    Object,
-    String
-  ])
-], DurableUiSessionGuard);
-var DurableApiSessionGuard = class {
-  static {
-    __name(this, "DurableApiSessionGuard");
-  }
-  auth;
-  constructor(auth) {
-    this.auth = auth;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = readSessionFromRequest(auth, request);
-    if (!session) throw this.unauthorized(auth);
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      throw this.unauthorized(auth);
-    }
-    return true;
-  }
-  /**
-  * A bare 401 body carrying `{ auth: { modes } }` — mirrors `@dudousxd/nestjs-telescope`'s
-  * dashboardAuth 401. The API is fetched (never navigated), so this is the ONLY way the console
-  * SPA (`durable-client.ts`) learns which auth surface to send the operator to on a mid-session
-  * 401; `DurableUiSessionGuard`'s redirect/session-required exceptions above don't reach it.
-  */
-  unauthorized(auth) {
-    return new UnauthorizedException3({
-      auth: {
-        modes: auth.modes
-      }
-    });
-  }
-};
-DurableApiSessionGuard = _ts_decorate11([
-  Injectable5(),
-  _ts_param7(0, Inject6(DASHBOARD_AUTH)),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
-    Object
-  ])
-], DurableApiSessionGuard);
-
-// src/server/durable-dashboard.module.ts
-function _ts_decorate12(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate12, "_ts_decorate");
-var GUARDS_METADATA = "__guards__";
+__name(protectionCheckProvider, "protectionCheckProvider");
+function assertNothingToDecorate(options) {
+  if (options.decorators === void 0) return;
+  throw new Error([
+    "DurableDashboardModule.forRoot({ routes: false }) mounts no controllers, so `decorators`",
+    "would protect nothing. Put your protection on the controllers you mount (extend",
+    "DurableUiControllerBase / DurableApiControllerBase and decorate them with @UseGuards /",
+    "@Can), and drop `decorators`."
+  ].join(" "));
+}
+__name(assertNothingToDecorate, "assertNothingToDecorate");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
 __name(normalize, "normalize");
-function stampGuards(hostGuards, builtIn, controller) {
-  const merged = [
-    ...builtIn.filter((guard) => guard !== void 0),
-    ...hostGuards ?? []
-  ];
-  Reflect.defineMetadata(GUARDS_METADATA, merged, controller);
-}
-__name(stampGuards, "stampGuards");
 var DurableApiModule = class _DurableApiModule {
   static {
     __name(this, "DurableApiModule");
   }
   static register(options) {
-    stampGuards(options.guards, [
-      options.authMayBeConfigured ? DurableApiSessionGuard : void 0,
-      options.stampGate ? DurableDashboardGateGuard : void 0
-    ], DurableApiController);
+    const routes = options.routes !== false;
     return {
       module: _DurableApiModule,
       imports: [
         ...options.imports ?? []
       ],
-      controllers: [
-        DurableApiController
-      ],
+      controllers: routes ? [
+        controllerFor(DurableApiController, options.decorators)
+      ] : [],
       providers: [
         DashboardService,
         // `@dudousxd/nestjs-filter` is wired PRIVATELY here rather than through
@@ -2853,23 +1868,22 @@ var DurableApiModule = class _DurableApiModule {
           provide: RUN_QUERY_ADAPTER,
           useExisting: RunQueryAdapter
         },
-        RunFilter,
-        options.authProvider,
-        DurableApiSessionGuard,
-        // Resolved ONCE here (this module is imported by the UI module, which reuses it via the
-        // export below), so the boot report is logged once per mount.
-        dashboardGateProvider(options.gate),
-        DurableDashboardGateGuard,
-        ...options.guards ?? []
+        RunFilter
       ],
-      exports: [
+      // Self-mounted (`routes: false`): the host's own subclass of `DurableApiControllerBase` is
+      // hosted in the HOST's module, so what its constructor injects must be exported. `FilterRunner`
+      // is only exported then: exporting it from a mounted console would shadow a host's own
+      // `FilterModule` runner in whatever module imports the dashboard.
+      exports: routes ? [
+        DashboardService
+      ] : [
         DashboardService,
-        DASHBOARD_GATE
+        FilterRunner2
       ]
     };
   }
 };
-DurableApiModule = _ts_decorate12([
+DurableApiModule = _ts_decorate7([
   Module({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
@@ -2877,58 +1891,58 @@ var DurableDashboardModule = class _DurableDashboardModule {
     __name(this, "DurableDashboardModule");
   }
   static forRoot(options = {}) {
-    const authProvider = {
-      provide: DASHBOARD_AUTH,
-      useValue: resolveDashboardAuth(options.dashboardAuth)
-    };
-    const authConfigured = options.dashboardAuth !== void 0;
-    return _DurableDashboardModule.build(options, authProvider, authConfigured, authConfigured);
-  }
-  static forRootAsync(options) {
-    const authProvider = {
-      provide: DASHBOARD_AUTH,
-      inject: options.inject ?? [],
-      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
-    };
-    return _DurableDashboardModule.build(options, authProvider, true, false);
-  }
-  /** Shared wiring: static routing + the API module, with `dashboardAuth` supplied by `authProvider`. */
-  static build(options, authProvider, authMayBeConfigured, authStaticallyConfigured) {
     const basePath = normalize(options.basePath ?? "/durable");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    const hasGuards = (options.guards?.length ?? 0) > 0;
-    const gate = {
-      hasGuards,
-      ...options.allowUnauthenticated !== void 0 ? {
-        allowUnauthenticated: options.allowUnauthenticated
-      } : {},
-      ...options.token !== void 0 ? {
-        token: options.token
-      } : {}
-    };
-    const stampGate = !hasGuards && !authStaticallyConfigured;
-    stampGuards(options.guards, [
-      authMayBeConfigured ? DurableUiSessionGuard : void 0,
-      stampGate ? DurableDashboardGateGuard : void 0
-    ], DurableUiController);
+    const pathProviders = [
+      {
+        provide: DASHBOARD_BASE_PATH,
+        useValue: basePath
+      },
+      {
+        provide: DASHBOARD_API_PATH,
+        useValue: apiBasePath
+      }
+    ];
+    if (options.routes === false) {
+      assertNothingToDecorate(options);
+      const api = DurableApiModule.register({
+        ...options.imports ? {
+          imports: options.imports
+        } : {},
+        routes: false
+      });
+      return {
+        module: _DurableDashboardModule,
+        imports: [
+          ...options.imports ?? [],
+          api
+        ],
+        controllers: [],
+        providers: pathProviders,
+        // What a host's subclasses of `DurableUiControllerBase` / `DurableApiControllerBase` inject:
+        // the SPA's paths, and the read/action service and the filter runner via the API module.
+        exports: [
+          DurableApiModule,
+          DASHBOARD_BASE_PATH,
+          DASHBOARD_API_PATH
+        ]
+      };
+    }
+    const decorated = (options.decorators?.length ?? 0) > 0;
     return {
       module: _DurableDashboardModule,
       imports: [
         ...options.imports ?? [],
-        // Guards + host imports must reach the API controller's HOST module — enhancers resolve
-        // from their controller's own module, never from a parent (see DurableApiModule.register).
+        // Host imports must reach the API controller's HOST module: enhancers resolve from their
+        // controller's own module, never from a parent (see DurableApiModule.register).
         // Spread-only-when-set: exactOptionalPropertyTypes rejects an explicit `undefined`.
         DurableApiModule.register({
           ...options.imports ? {
             imports: options.imports
           } : {},
-          ...options.guards ? {
-            guards: options.guards
-          } : {},
-          authProvider,
-          authMayBeConfigured,
-          gate,
-          stampGate
+          ...options.decorators ? {
+            decorators: options.decorators
+          } : {}
         }),
         RouterModule.register([
           {
@@ -2942,30 +1956,13 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ])
       ],
       controllers: [
-        DurableUiController,
-        // The auth controller (login page + logout) only exists when dashboardAuth might be
-        // configured — mounting it unconditionally would add a new `/login` route even for hosts
-        // that never set `dashboardAuth`, breaking "absent -> today's behavior byte-for-byte".
-        ...authMayBeConfigured ? [
-          DurableAuthController
-        ] : []
+        controllerFor(DurableUiController, options.decorators)
       ],
       providers: [
-        {
-          provide: DASHBOARD_BASE_PATH,
-          useValue: basePath
-        },
-        {
-          provide: DASHBOARD_API_PATH,
-          useValue: apiBasePath
-        },
-        authProvider,
-        DurableUiSessionGuard,
-        // `DASHBOARD_GATE` itself comes from the imported DurableApiModule (resolved once there).
-        DurableDashboardGateGuard,
-        // DurableUiController (and DurableAuthController, when present) are hosted HERE, so their
-        // guards DI-instantiate from this module.
-        ...options.guards ?? []
+        ...pathProviders,
+        ...decorated ? [] : [
+          protectionCheckProvider()
+        ]
       ],
       // Re-export the API module so its DashboardService reaches importers (e.g. flip's own controllers).
       exports: [
@@ -2974,26 +1971,20 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate12([
+DurableDashboardModule = _ts_decorate7([
   Module({})
 ], DurableDashboardModule);
 export {
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
-  DASHBOARD_GATE,
-  DURABLE_DASHBOARD_TOKEN_ENV,
+  DASHBOARD_PROTECTION_CHECK,
   DashboardService,
   DurableApiController,
+  DurableApiControllerBase,
   DurableApiModule,
-  DurableApiSessionGuard,
-  DurableAuthController,
-  DurableDashboardGateGuard,
   DurableDashboardModule,
   DurableUiController,
-  DurableUiSessionGuard,
-  dashboardGateProvider,
-  readDashboardToken,
-  reportDashboardGate,
-  resolveDashboardGate
+  DurableUiControllerBase,
+  UNPROTECTED_CONSOLE_IN_PRODUCTION
 };
 //# sourceMappingURL=index.js.map