@dudousxd/nestjs-durable-dashboard 0.55.1 → 0.57.0

package/dist/server/index.cjs

@@ -1,8 +1,10 @@
 const __importMetaUrl = require('url').pathToFileURL(__filename).href;
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
@@ -17,14 +19,31 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/server/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CONSOLE_AUTHORIZE_DECIDE: () => CONSOLE_AUTHORIZE_DECIDE,
+  CONSOLE_AUTHORIZE_MISSING_WARNING: () => CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE: () => CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA: () => CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA: () => CONSOLE_PUBLIC_METADATA,
+  ConsoleAccessDenied: () => ConsoleAccessDenied,
+  ConsoleAuthorizeFilter: () => ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard: () => ConsoleAuthorizeGuard,
+  ConsolePage: () => ConsolePage,
+  ConsolePublic: () => ConsolePublic,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
-  DASHBOARD_PROTECTION_CHECK: () => DASHBOARD_PROTECTION_CHECK,
   DashboardService: () => DashboardService,
   DurableApiController: () => DurableApiController,
   DurableApiControllerBase: () => DurableApiControllerBase,
@@ -32,14 +51,18 @@ __export(index_exports, {
   DurableDashboardModule: () => DurableDashboardModule,
   DurableUiController: () => DurableUiController,
   DurableUiControllerBase: () => DurableUiControllerBase,
-  UNPROTECTED_CONSOLE_IN_PRODUCTION: () => UNPROTECTED_CONSOLE_IN_PRODUCTION
+  UseConsoleAuthorize: () => UseConsoleAuthorize,
+  authorizeByToken: () => authorizeByToken,
+  normalizeConsoleResult: () => normalizeConsoleResult,
+  resolveConsoleAuthorize: () => resolveConsoleAuthorize
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/server/dashboard.service.ts
-var import_nestjs_durable_core = require("@dudousxd/nestjs-durable-core");
+// src/server/console-authorize.ts
+var import_reflect_metadata = require("reflect-metadata");
+var import_node_crypto = require("crypto");
 var import_common = require("@nestjs/common");
-var import_rxjs = require("rxjs");
+var import_core = require("@nestjs/core");
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -66,6 +89,315 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var CONSOLE_GATE = Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-durable-dashboard";
+var MODULE = "DurableDashboardModule";
+var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
+var allow = /* @__PURE__ */ __name(() => ({
+  allowed: true
+}), "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
+  }
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function isLazyModule(value) {
+  return typeof value === "object" && value !== null && isAuthorizerClass(value.default);
+}
+__name(isLazyModule, "isLazyModule");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (typeof result !== "object" || result === null) return forbidden();
+  const shape = result;
+  if (typeof shape.redirectTo === "string" && shape.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: shape.redirectTo
+    };
+  }
+  if (shape.allowed === true) return allow();
+  return shape.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+async function policyDecider(check, moduleRef) {
+  let pkg;
+  try {
+    pkg = await import("@nestjs/authorization");
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs @nestjs/authorization installed, with AuthorizationModule.forRoot() imported in the app; or pass a function, a class, or a gate name.`);
+  }
+  const { AuthorizationService, AUTHORIZATION_MODULE_OPTIONS, defaultGetUser } = pkg;
+  try {
+    moduleRef.get(AuthorizationService, {
+      strict: false
+    });
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app.`);
+  }
+  let getUser = defaultGetUser;
+  try {
+    const options = moduleRef.get(AUTHORIZATION_MODULE_OPTIONS, {
+      strict: false
+    });
+    if (typeof options?.getUser === "function") getUser = options.getUser;
+  } catch {
+  }
+  return async (context) => {
+    const authorization = moduleRef.get(AuthorizationService, {
+      strict: false
+    });
+    const user = await getUser(context);
+    const can = authorization.can;
+    if (await can.call(authorization, check.policy, check.ability, hasUser(user) ? user : null)) {
+      return allow();
+    }
+    return hasUser(user) ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+function gateDecider(name, moduleRef) {
+  try {
+    moduleRef.get(CONSOLE_GATE, {
+      strict: false
+    });
+  } catch {
+    throw new Error(`\`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }`);
+  }
+  return async (context) => {
+    const gate = moduleRef.get(CONSOLE_GATE, {
+      strict: false
+    });
+    return normalizeConsoleResult(await gate.allows(name, context));
+  };
+}
+__name(gateDecider, "gateDecider");
+function classDecider(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  const instanceOf = /* @__PURE__ */ __name((Class) => {
+    const cached = instances.get(Class);
+    if (cached) return cached;
+    const pending = (async () => {
+      try {
+        const registered = moduleRef.get(Class, {
+          strict: false
+        });
+        if (registered) return registered;
+      } catch {
+      }
+      return moduleRef.create(Class);
+    })();
+    pending.catch(() => instances.delete(Class));
+    instances.set(Class, pending);
+    return pending;
+  }, "instanceOf");
+  return (Class) => async (context) => normalizeConsoleResult(await (await instanceOf(Class)).authorize(context));
+}
+__name(classDecider, "classDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const logger = options.logger ?? new import_common.Logger(MODULE);
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) logger.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    const production = isProduction();
+    return async () => production ? forbidden() : allow();
+  }
+  let decide;
+  if (typeof authorize === "string") {
+    decide = gateDecider(authorize, moduleRef);
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    decide = classDecider(moduleRef)(authorize);
+  } else if (typeof authorize === "function") {
+    const fromClass = classDecider(moduleRef);
+    let lazy;
+    const fn = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazy) return lazy(context);
+      const result = await fn(context);
+      if (!isLazyModule(result)) return normalizeConsoleResult(result);
+      lazy = fromClass(result.default);
+      return lazy(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return await decide(context);
+    } catch (error) {
+      logger.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+var sha256 = /* @__PURE__ */ __name((value) => (0, import_node_crypto.createHash)("sha256").update(value).digest(), "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  return (context) => {
+    const header = context.switchToHttp().getRequest()?.headers?.authorization;
+    const match = typeof header === "string" ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+    if (match?.[1] && (0, import_node_crypto.timingSafeEqual)(sha256(match[1]), expected)) return true;
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+var CONSOLE_AUTHORIZE_DECIDE = Symbol(`${PACKAGE}:console-authorize`);
+var CONSOLE_PAGE_METADATA = `${PACKAGE}:console-page`;
+var ConsolePage = /* @__PURE__ */ __name(() => (target) => {
+  Reflect.defineMetadata(CONSOLE_PAGE_METADATA, true, target);
+}, "ConsolePage");
+var ConsoleAccessDenied = class extends import_common.HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page) {
+    const unauthenticated2 = decision.reason === "unauthenticated";
+    super(unauthenticated2 ? {
+      error: "unauthenticated",
+      ...decision.redirectTo ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    } : {
+      error: "forbidden"
+    }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page;
+  }
+};
+var CONSOLE_PUBLIC_METADATA = `${PACKAGE}:console-public`;
+var ConsolePublic = /* @__PURE__ */ __name(() => (_target, _key, descriptor) => {
+  Reflect.defineMetadata(CONSOLE_PUBLIC_METADATA, true, descriptor.value);
+}, "ConsolePublic");
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  decide;
+  constructor(decide) {
+    this.decide = decide;
+  }
+  async canActivate(context) {
+    if (Reflect.getMetadata(CONSOLE_PUBLIC_METADATA, context.getHandler()) === true) return true;
+    const decision = await this.decide(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
+  }
+};
+ConsoleAuthorizeGuard = _ts_decorate([
+  (0, import_common.Injectable)(),
+  _ts_param(0, (0, import_common.Inject)(CONSOLE_AUTHORIZE_DECIDE)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ConsoleDecide === "undefined" ? Object : ConsoleDecide
+  ])
+], ConsoleAuthorizeGuard);
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  if (Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) !== true) return false;
+  const request = context.switchToHttp().getRequest();
+  const accept = request?.headers?.accept;
+  return request?.method === "GET" && typeof accept === "string" && accept.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var consolePage = /* @__PURE__ */ __name((title, message) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`, "consolePage");
+var DENIED_PAGE = consolePage("Access denied", "You do not have access to this console.");
+var SIGN_IN_PAGE = consolePage("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const response = host.switchToHttp().getResponse();
+    const { decision, page } = exception;
+    if (page && decision.redirectTo) {
+      adapter.redirect(response, 302, decision.redirectTo);
+      return;
+    }
+    if (page) {
+      const forbiddenPage = decision.reason === "forbidden";
+      adapter.setHeader(response, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(response, forbiddenPage ? DENIED_PAGE : SIGN_IN_PAGE, forbiddenPage ? 403 : 401);
+      return;
+    }
+    adapter.reply(response, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate([
+  (0, import_common.Catch)(ConsoleAccessDenied),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof import_core.HttpAdapterHost === "undefined" ? Object : import_core.HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+var UseConsoleAuthorize = /* @__PURE__ */ __name(() => (0, import_common.applyDecorators)((0, import_common.UseGuards)(ConsoleAuthorizeGuard), (0, import_common.UseFilters)(ConsoleAuthorizeFilter)), "UseConsoleAuthorize");
+
+// src/server/dashboard.service.ts
+var import_nestjs_durable_core = require("@dudousxd/nestjs-durable-core");
+var import_common2 = require("@nestjs/common");
+var import_rxjs = require("rxjs");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var DashboardService = class {
   static {
     __name(this, "DashboardService");
@@ -90,7 +422,7 @@ var DashboardService = class {
   */
   controlPlane() {
     if (!this.store || !this.engine) {
-      throw new Error("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
+      throw new import_common2.NotImplementedException("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
     }
     return {
       store: this.store,
@@ -339,13 +671,13 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(1, (0, import_common.Optional)()),
-  _ts_param(1, (0, import_common.Inject)(import_nestjs_durable_core.STATE_STORE_CANONICAL)),
-  _ts_param(2, (0, import_common.Optional)()),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+DashboardService = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_param2(1, (0, import_common2.Optional)()),
+  _ts_param2(1, (0, import_common2.Inject)(import_nestjs_durable_core.STATE_STORE_CANONICAL)),
+  _ts_param2(2, (0, import_common2.Optional)()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof import_nestjs_durable_core.RunGateway === "undefined" ? Object : import_nestjs_durable_core.RunGateway,
     typeof StateStore === "undefined" ? Object : StateStore,
     typeof import_nestjs_durable_core.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core.WorkflowEngine
@@ -354,7 +686,7 @@ DashboardService = _ts_decorate([
 
 // src/server/durable-api.controller.ts
 var import_nestjs_filter2 = require("@dudousxd/nestjs-filter");
-var import_common5 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 
 // src/server/durable-run.ts
 var DurableRun = class {
@@ -430,8 +762,8 @@ function runValueAxisFor(field) {
 __name(runValueAxisFor, "runValueAxisFor");
 
 // src/server/not-modified.ts
-var import_common2 = require("@nestjs/common");
-function _ts_decorate2(decorators, target, key, desc) {
+var import_common3 = require("@nestjs/common");
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -444,7 +776,7 @@ function _ts_decorate2(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
+__name(_ts_decorate3, "_ts_decorate");
 function isRawResponse(value) {
   if (typeof value !== "object" || value === null) return false;
   const candidate = value;
@@ -470,7 +802,7 @@ function writeNotModifiedRaw(response, etag) {
   raw.end();
 }
 __name(writeNotModifiedRaw, "writeNotModifiedRaw");
-var NotModifiedException = class extends import_common2.HttpException {
+var NotModifiedException = class extends import_common3.HttpException {
   static {
     __name(this, "NotModifiedException");
   }
@@ -487,8 +819,8 @@ var NotModifiedFilter = class {
     writeNotModifiedRaw(host.switchToHttp().getResponse(), exception.etag);
   }
 };
-NotModifiedFilter = _ts_decorate2([
-  (0, import_common2.Catch)(NotModifiedException)
+NotModifiedFilter = _ts_decorate3([
+  (0, import_common3.Catch)(NotModifiedException)
 ], NotModifiedFilter);
 function setEtag(response, etag) {
   setRawHeader(response, "etag", etag);
@@ -505,7 +837,7 @@ __name(toRunListRow, "toRunListRow");
 
 // src/server/run.filter.ts
 var import_nestjs_filter = require("@dudousxd/nestjs-filter");
-var import_common4 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 
 // src/server/attr-filter.ts
 var SCALAR_OPS = /* @__PURE__ */ new Set([
@@ -556,7 +888,7 @@ __name(parseAttrFilters, "parseAttrFilters");
 
 // src/server/run-query.adapter.ts
 var import_nestjs_durable_core2 = require("@dudousxd/nestjs-durable-core");
-var import_common3 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 
 // src/server/run-query-draft.ts
 var RunQueryDraft2 = class {
@@ -586,7 +918,7 @@ var RunQueryDraft2 = class {
 };
 
 // src/server/run-query.adapter.ts
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -599,13 +931,13 @@ function _ts_decorate3(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(metadataKey, metadataValue) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata2, "_ts_metadata");
+__name(_ts_metadata3, "_ts_metadata");
 var RUN_QUERY_ADAPTER = Symbol("DURABLE_RUN_QUERY_ADAPTER");
 var FIXED_ORDER = {
   field: "createdAt",
@@ -627,7 +959,7 @@ function operands(clause) {
 }
 __name(operands, "operands");
 function unsupported(clause, supported) {
-  throw new import_common3.BadRequestException(`The durable run list cannot filter \`${clause.field}\` with \`${clause.operator}\`. Supported here: ${supported}.`);
+  throw new import_common4.BadRequestException(`The durable run list cannot filter \`${clause.field}\` with \`${clause.operator}\`. Supported here: ${supported}.`);
 }
 __name(unsupported, "unsupported");
 var RunQueryAdapter = class {
@@ -665,7 +997,7 @@ var RunQueryAdapter = class {
     const draft = this.draft(qb);
     for (const clause of filters) {
       if (clause.AND || clause.OR) {
-        throw new import_common3.BadRequestException("The durable run list cannot filter with nested AND/OR groups: its predicates are a flat conjunction.");
+        throw new import_common4.BadRequestException("The durable run list cannot filter with nested AND/OR groups: its predicates are a flat conjunction.");
       }
       this.applyClause(draft, clause);
     }
@@ -756,7 +1088,7 @@ var RunQueryAdapter = class {
   applyAttributeClause(draft, clause) {
     const key = clause.field.slice(ATTRIBUTE_FIELD.length + 1);
     if (!key) {
-      throw new import_common3.BadRequestException("Filtering search attributes needs a key: `attr.<key>`, e.g. `attr.tier`.");
+      throw new import_common4.BadRequestException("Filtering search attributes needs a key: `attr.<key>`, e.g. `attr.tier`.");
     }
     const scalarOps = {
       equals: "eq",
@@ -800,7 +1132,7 @@ var RunQueryAdapter = class {
   applySort(_qb, sorts) {
     for (const sort of sorts) {
       if (sort.field !== FIXED_ORDER.field || sort.direction !== FIXED_ORDER.direction) {
-        throw new import_common3.BadRequestException(`The durable run list is always ordered \`${FIXED_ORDER.field} ${FIXED_ORDER.direction}\` and cannot be sorted by \`${sort.field} ${sort.direction}\`.`);
+        throw new import_common4.BadRequestException(`The durable run list is always ordered \`${FIXED_ORDER.field} ${FIXED_ORDER.direction}\` and cannot be sorted by \`${sort.field} ${sort.direction}\`.`);
       }
     }
   }
@@ -841,14 +1173,14 @@ var RunQueryAdapter = class {
   async groupByCount(qb, field, entity, opts) {
     this.assertDurableRun(entity);
     if (typeof field !== "string") {
-      throw new import_common3.BadRequestException("The durable run list has no computed fields to group by \u2014 group by one of its own fields.");
+      throw new import_common4.BadRequestException("The durable run list has no computed fields to group by \u2014 group by one of its own fields.");
     }
     if (opts?.bucket !== void 0) {
-      throw new import_common3.BadRequestException("The durable run list cannot bucket a group-by-count: none of its filterable fields is numeric.");
+      throw new import_common4.BadRequestException("The durable run list cannot bucket a group-by-count: none of its filterable fields is numeric.");
     }
     const axis = runValueAxisFor(field);
     if (!axis) {
-      throw new import_common3.BadRequestException(`The durable run list cannot enumerate values of \`${field}\`.`);
+      throw new import_common4.BadRequestException(`The durable run list cannot enumerate values of \`${field}\`.`);
     }
     const rows = await this.gateway.runValueFacets(axis, this.draft(qb).facetQuery(), {
       limit: opts?.limit ?? import_nestjs_durable_core2.RUN_VALUE_FACET_LIMIT,
@@ -879,16 +1211,16 @@ var RunQueryAdapter = class {
     }
   }
 };
-RunQueryAdapter = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+RunQueryAdapter = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof import_nestjs_durable_core2.RunGateway === "undefined" ? Object : import_nestjs_durable_core2.RunGateway
   ])
 ], RunQueryAdapter);
 
 // src/server/run.filter.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -901,13 +1233,13 @@ function _ts_decorate4(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(metadataKey, metadataValue) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata3, "_ts_metadata");
+__name(_ts_metadata4, "_ts_metadata");
 function list(value) {
   return (Array.isArray(value) ? value : [
     value
@@ -1027,76 +1359,76 @@ var RunFilter = class extends import_nestjs_filter.BaseFilter {
     });
   }
 };
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("status"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyStatus", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("workflow"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyWorkflow", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("namespace"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyNamespace", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("tag"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyTag", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("origin"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyOrigin", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("unattributed"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyUnattributed", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("attr"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyAttributes", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("limit"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyLimit", null);
-_ts_decorate4([
+_ts_decorate5([
   (0, import_nestjs_filter.FilterFor)("offset"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyOffset", null);
-RunFilter = _ts_decorate4([
-  (0, import_common4.Injectable)(),
+RunFilter = _ts_decorate5([
+  (0, import_common5.Injectable)(),
   (0, import_nestjs_filter.Filterable)({
     entity: DurableRun,
     adapter: RUN_QUERY_ADAPTER,
@@ -1105,7 +1437,7 @@ RunFilter = _ts_decorate4([
 ], RunFilter);
 
 // src/server/durable-api.controller.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1118,19 +1450,19 @@ function _ts_decorate5(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(metadataKey, metadataValue) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var FAN_INLINE_MAX = 50;
 var DurableApiControllerBase = class {
   static {
@@ -1232,7 +1564,7 @@ var DurableApiControllerBase = class {
   */
   async workflowLifecycle(name) {
     const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
-    if (!links) throw new import_common5.NotImplementedException("workflow lifecycle links need the control plane");
+    if (!links) throw new import_common6.NotImplementedException("workflow lifecycle links need the control plane");
     return links;
   }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
@@ -1254,7 +1586,7 @@ var DurableApiControllerBase = class {
         ifNoneMatch
       }
     });
-    if (!detail) throw new import_common5.NotFoundException(`run ${id} not found`);
+    if (!detail) throw new import_common6.NotFoundException(`run ${id} not found`);
     const { etag, notModified, ...body } = detail;
     if (etag) {
       if (notModified) throw new NotModifiedException(etag);
@@ -1272,7 +1604,7 @@ var DurableApiControllerBase = class {
         ifNoneMatch
       }
     });
-    if (!page) throw new import_common5.NotFoundException(`fan ${group} of run ${id} not found`);
+    if (!page) throw new import_common6.NotFoundException(`fan ${group} of run ${id} not found`);
     const { etag, notModified, ...body } = page;
     if (etag) {
       if (notModified) throw new NotModifiedException(etag);
@@ -1307,7 +1639,7 @@ var DurableApiControllerBase = class {
     const result = await this.dashboard.cancel(id, {
       compensate: compensate === "true"
     });
-    if (!result) throw new import_common5.NotFoundException(`run ${id} not found`);
+    if (!result) throw new import_common6.NotFoundException(`run ${id} not found`);
     return result;
   }
   /**
@@ -1320,38 +1652,38 @@ var DurableApiControllerBase = class {
       result = await this.dashboard.republishLifecycle(id, body?.subscriber || void 0);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (/^run .* not found$/.test(message)) throw new import_common5.NotFoundException(message);
-      if (/^run .* has not settled/.test(message)) throw new import_common5.BadRequestException(message);
+      if (/^run .* not found$/.test(message)) throw new import_common6.NotFoundException(message);
+      if (/^run .* has not settled/.test(message)) throw new import_common6.BadRequestException(message);
       if (error?.code === "bad-request") {
-        throw new import_common5.BadRequestException(message);
+        throw new import_common6.BadRequestException(message);
       }
       return notSupportedByServer(error);
     }
     if (!result) {
-      throw new import_common5.NotImplementedException("republishing lifecycle events needs the control plane");
+      throw new import_common6.NotImplementedException("republishing lifecycle events needs the control plane");
     }
     return result;
   }
   async continue(id) {
     const result = await this.dashboard.continue(id);
-    if (!result) throw new import_common5.NotFoundException(`run ${id} is not paused at a breakpoint`);
+    if (!result) throw new import_common6.NotFoundException(`run ${id} is not paused at a breakpoint`);
     return result;
   }
   /** Re-dispatch a run's stuck `pending` remote steps — recovery for a lost step dispatch. */
   async redispatch(id) {
     const result = await this.dashboard.redispatch(id);
-    if (!result) throw new import_common5.NotFoundException(`run ${id} not found`);
+    if (!result) throw new import_common6.NotFoundException(`run ${id} not found`);
     return result;
   }
   /**
   * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-  * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-  * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-  * verification in your own middleware.
+  * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+  * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+  * and/or front it with signature verification in your own middleware.
   */
   async webhook(token, body) {
     const result = await this.dashboard.deliverWebhook(token, body);
-    if (!result) throw new import_common5.NotFoundException(`no live run is waiting for webhook ${token}`);
+    if (!result) throw new import_common6.NotFoundException(`no live run is waiting for webhook ${token}`);
     return result;
   }
   /** Live query: the latest value a run published for `key` via `ctx.setEvent` (no side effect). */
@@ -1363,135 +1695,135 @@ var DurableApiControllerBase = class {
     return this.dashboard.update(id, name, body);
   }
 };
-_ts_decorate5([
-  (0, import_common5.Get)("runs"),
-  _ts_param2(0, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("runs"),
+  _ts_param3(0, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "runs", null);
-_ts_decorate5([
-  (0, import_common5.Get)("runs/facets"),
-  _ts_param2(0, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("runs/facets"),
+  _ts_param3(0, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "facets", null);
-_ts_decorate5([
-  (0, import_common5.Get)("runs/values"),
-  _ts_param2(0, (0, import_common5.Query)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("runs/values"),
+  _ts_param3(0, (0, import_common6.Query)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "values", null);
-_ts_decorate5([
-  (0, import_common5.Get)("metrics"),
-  (0, import_common5.Header)("Content-Type", "text/plain; version=0.0.4"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+_ts_decorate6([
+  (0, import_common6.Get)("metrics"),
+  (0, import_common6.Header)("Content-Type", "text/plain; version=0.0.4"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "metrics", null);
-_ts_decorate5([
-  (0, import_common5.Get)("workers"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+_ts_decorate6([
+  (0, import_common6.Get)("workers"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "workers", null);
-_ts_decorate5([
-  (0, import_common5.Get)("schedules"),
-  _ts_param2(0, (0, import_common5.Query)("namespace")),
-  _ts_param2(1, (0, import_common5.Query)("workflow")),
-  _ts_param2(2, (0, import_common5.Query)("tag")),
-  _ts_param2(3, (0, import_common5.Query)("paused")),
-  _ts_param2(4, (0, import_common5.Query)("limit")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("schedules"),
+  _ts_param3(0, (0, import_common6.Query)("namespace")),
+  _ts_param3(1, (0, import_common6.Query)("workflow")),
+  _ts_param3(2, (0, import_common6.Query)("tag")),
+  _ts_param3(3, (0, import_common6.Query)("paused")),
+  _ts_param3(4, (0, import_common6.Query)("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "schedules", null);
-_ts_decorate5([
-  (0, import_common5.Post)("schedules/:id/pause"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("schedules/:id/pause"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "pauseSchedule", null);
-_ts_decorate5([
-  (0, import_common5.Post)("schedules/:id/resume"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("schedules/:id/resume"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "resumeSchedule", null);
-_ts_decorate5([
-  (0, import_common5.Post)("schedules/:id/trigger"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("schedules/:id/trigger"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "triggerSchedule", null);
-_ts_decorate5([
-  (0, import_common5.Get)("workflows/:name/lifecycle"),
-  _ts_param2(0, (0, import_common5.Param)("name")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("workflows/:name/lifecycle"),
+  _ts_param3(0, (0, import_common6.Param)("name")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "workflowLifecycle", null);
-_ts_decorate5([
-  (0, import_common5.Get)("topology"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+_ts_decorate6([
+  (0, import_common6.Get)("topology"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "topology", null);
-_ts_decorate5([
-  (0, import_common5.Get)("runs/:id"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Query)("full")),
-  _ts_param2(2, (0, import_common5.Headers)("if-none-match")),
-  _ts_param2(3, (0, import_common5.Res)({
+_ts_decorate6([
+  (0, import_common6.Get)("runs/:id"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Query)("full")),
+  _ts_param3(2, (0, import_common6.Headers)("if-none-match")),
+  _ts_param3(3, (0, import_common6.Res)({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "run", null);
-_ts_decorate5([
-  (0, import_common5.Get)("runs/:id/fans/:group"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Param)("group")),
-  _ts_param2(2, (0, import_common5.Query)("offset")),
-  _ts_param2(3, (0, import_common5.Query)("limit")),
-  _ts_param2(4, (0, import_common5.Query)("failed")),
-  _ts_param2(5, (0, import_common5.Headers)("if-none-match")),
-  _ts_param2(6, (0, import_common5.Res)({
+_ts_decorate6([
+  (0, import_common6.Get)("runs/:id/fans/:group"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Param)("group")),
+  _ts_param3(2, (0, import_common6.Query)("offset")),
+  _ts_param3(3, (0, import_common6.Query)("limit")),
+  _ts_param3(4, (0, import_common6.Query)("failed")),
+  _ts_param3(5, (0, import_common6.Headers)("if-none-match")),
+  _ts_param3(6, (0, import_common6.Res)({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
@@ -1500,145 +1832,146 @@ _ts_decorate5([
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "fanMembers", null);
-_ts_decorate5([
-  (0, import_common5.Sse)("runs/:id/stream"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Sse)("runs/:id/stream"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "stream", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/retry"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/retry"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "retry", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/retry-with-input"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Body)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/retry-with-input"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "retryWithInput", null);
-_ts_decorate5([
-  (0, import_common5.Post)("bulk/:action"),
-  _ts_param2(0, (0, import_common5.Param)("action")),
-  _ts_param2(1, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
-  _ts_param2(2, (0, import_common5.Query)("compensate")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("bulk/:action"),
+  _ts_param3(0, (0, import_common6.Param)("action")),
+  _ts_param3(1, (0, import_nestjs_filter2.ApplyFilter)(RunFilter)),
+  _ts_param3(2, (0, import_common6.Query)("compensate")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "bulk", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/cancel"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Query)("compensate")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/cancel"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Query)("compensate")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "cancel", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/republish-lifecycle"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Body)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/republish-lifecycle"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "republishLifecycle", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/continue"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/continue"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "continue", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/redispatch"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/redispatch"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "redispatch", null);
-_ts_decorate5([
-  (0, import_common5.Post)("webhooks/:token"),
-  _ts_param2(0, (0, import_common5.Param)("token")),
-  _ts_param2(1, (0, import_common5.Body)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  ConsolePublic(),
+  (0, import_common6.Post)("webhooks/:token"),
+  _ts_param3(0, (0, import_common6.Param)("token")),
+  _ts_param3(1, (0, import_common6.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "webhook", null);
-_ts_decorate5([
-  (0, import_common5.Get)("runs/:id/events/:key"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Param)("key")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("runs/:id/events/:key"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Param)("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "event", null);
-_ts_decorate5([
-  (0, import_common5.Post)("runs/:id/updates/:name"),
-  _ts_param2(0, (0, import_common5.Param)("id")),
-  _ts_param2(1, (0, import_common5.Param)("name")),
-  _ts_param2(2, (0, import_common5.Body)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Post)("runs/:id/updates/:name"),
+  _ts_param3(0, (0, import_common6.Param)("id")),
+  _ts_param3(1, (0, import_common6.Param)("name")),
+  _ts_param3(2, (0, import_common6.Body)()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "update", null);
-DurableApiControllerBase = _ts_decorate5([
-  (0, import_common5.Controller)(),
-  (0, import_common5.UseInterceptors)(import_nestjs_filter2.ApplyFilterInterceptor),
-  (0, import_common5.UseFilters)(NotModifiedFilter),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+DurableApiControllerBase = _ts_decorate6([
+  (0, import_common6.Controller)(),
+  (0, import_common6.UseInterceptors)(import_nestjs_filter2.ApplyFilterInterceptor),
+  (0, import_common6.UseFilters)(NotModifiedFilter),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     typeof import_nestjs_filter2.FilterRunner === "undefined" ? Object : import_nestjs_filter2.FilterRunner
   ])
 ], DurableApiControllerBase);
 function notFound(error) {
   if (error instanceof Error && error.name === "ScheduleNotFoundError") {
-    throw new import_common5.NotFoundException(error.message);
+    throw new import_common6.NotFoundException(error.message);
   }
   throw error;
 }
 __name(notFound, "notFound");
 function notSupportedByServer(error) {
   if (error?.code === "unsupported-request") {
-    throw new import_common5.NotImplementedException(error instanceof Error ? error.message : String(error));
+    throw new import_common6.NotImplementedException(error instanceof Error ? error.message : String(error));
   }
   throw error;
 }
@@ -1648,18 +1981,18 @@ var DurableApiController = class extends DurableApiControllerBase {
     __name(this, "DurableApiController");
   }
 };
-DurableApiController = _ts_decorate5([
-  (0, import_common5.Controller)()
+DurableApiController = _ts_decorate6([
+  (0, import_common6.Controller)()
 ], DurableApiController);
 
 // src/server/durable-dashboard.module.ts
-var import_reflect_metadata2 = require("reflect-metadata");
+var import_reflect_metadata3 = require("reflect-metadata");
 var import_nestjs_filter3 = require("@dudousxd/nestjs-filter");
-var import_common7 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
+var import_common8 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
 
 // src/server/controller-decorators.ts
-var import_reflect_metadata = require("reflect-metadata");
+var import_reflect_metadata2 = require("reflect-metadata");
 var CAN_ANYONE_METADATA = "authorization:can-anyone";
 function markOpenToAuthorization(controller) {
   Reflect.defineMetadata(CAN_ANYONE_METADATA, true, controller);
@@ -1688,8 +2021,8 @@ __name(controllerFor, "controllerFor");
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common6 = require("@nestjs/common");
-function _ts_decorate6(decorators, target, key, desc) {
+var import_common7 = require("@nestjs/common");
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1702,19 +2035,19 @@ function _ts_decorate6(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(metadataKey, metadataValue) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param4, "_ts_param");
 var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
 var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
 var BUILD_BASE = "/durable";
@@ -1747,7 +2080,7 @@ var DurableUiControllerBase = class {
   index() {
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common6.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common7.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__DURABLE_BASE__='${this.basePath}';window.__DURABLE_API__='${this.apiBasePath}';</script>`;
@@ -1755,42 +2088,43 @@ var DurableUiControllerBase = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common6.NotFoundException();
+    if (safe !== file) throw new import_common7.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common6.NotFoundException();
+      throw new import_common7.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common7.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate6([
-  (0, import_common6.Get)(),
-  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", String)
+_ts_decorate7([
+  (0, import_common7.Get)(),
+  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common7.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", String)
 ], DurableUiControllerBase.prototype, "index", null);
-_ts_decorate6([
-  (0, import_common6.Get)("assets/:file"),
-  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, (0, import_common6.Param)("file")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate7([
+  (0, import_common7.Get)("assets/:file"),
+  (0, import_common7.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param4(0, (0, import_common7.Param)("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata5("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
+  _ts_metadata6("design:returntype", typeof import_common7.StreamableFile === "undefined" ? Object : import_common7.StreamableFile)
 ], DurableUiControllerBase.prototype, "asset", null);
-DurableUiControllerBase = _ts_decorate6([
-  (0, import_common6.Controller)(),
-  _ts_param3(0, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+DurableUiControllerBase = _ts_decorate7([
+  (0, import_common7.Controller)(),
+  ConsolePage(),
+  _ts_param4(0, (0, import_common7.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, (0, import_common7.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
@@ -1800,12 +2134,12 @@ var DurableUiController = class extends DurableUiControllerBase {
     __name(this, "DurableUiController");
   }
 };
-DurableUiController = _ts_decorate6([
-  (0, import_common6.Controller)()
+DurableUiController = _ts_decorate7([
+  (0, import_common7.Controller)()
 ], DurableUiController);
 
 // src/server/durable-dashboard.module.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1818,31 +2152,9 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 markOpenToAuthorization(DurableApiController);
 markOpenToAuthorization(DurableUiController);
-var DASHBOARD_PROTECTION_CHECK = Symbol("DASHBOARD_PROTECTION_CHECK");
-var UNPROTECTED_CONSOLE_IN_PRODUCTION = [
-  "DurableDashboardModule: NODE_ENV=production and the durable console is mounted with no",
-  "protection, so the app refuses to boot. Protect it one of two ways:",
-  "(1) decorators on the mounted console: DurableDashboardModule.forRoot({ decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')] });",
-  "(2) mount it yourself: DurableDashboardModule.forRoot({ routes: false }) plus @Controller('durable') @UseGuards(AuthenticationGuard) @Can(ConsolePolicy, 'view') class ConsoleUi extends DurableUiControllerBase {} (and the same over DurableApiControllerBase at 'durable/api')."
-].join(" ");
-function isProduction() {
-  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
-}
-__name(isProduction, "isProduction");
-function protectionCheckProvider() {
-  return {
-    provide: DASHBOARD_PROTECTION_CHECK,
-    useFactory: /* @__PURE__ */ __name(() => {
-      if (isProduction()) throw new Error(UNPROTECTED_CONSOLE_IN_PRODUCTION);
-      new import_common7.Logger("DurableDashboard").warn("The durable console is mounted with no `decorators`, so it is served OPEN (retry/cancel included). That is refused when NODE_ENV=production: pass `decorators` (e.g. [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]) or mount it yourself with `routes: false`.");
-      return true;
-    }, "useFactory")
-  };
-}
-__name(protectionCheckProvider, "protectionCheckProvider");
 function assertNothingToDecorate(options) {
   if (options.decorators === void 0) return;
   throw new Error([
@@ -1853,6 +2165,13 @@ function assertNothingToDecorate(options) {
   ].join(" "));
 }
 __name(assertNothingToDecorate, "assertNothingToDecorate");
+function consoleController(base, decorators) {
+  return controllerFor(base, [
+    ...decorators ?? [],
+    UseConsoleAuthorize()
+  ]);
+}
+__name(consoleController, "consoleController");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
@@ -1869,10 +2188,20 @@ var DurableApiModule = class _DurableApiModule {
         ...options.imports ?? []
       ],
       controllers: routes ? [
-        controllerFor(DurableApiController, options.decorators)
+        consoleController(DurableApiController, options.decorators)
       ] : [],
       providers: [
         DashboardService,
+        // Resolved at boot: a gate name without nestjs-authz, or a policy without
+        // @nestjs/authorization, fails here rather than on the first request.
+        {
+          provide: CONSOLE_AUTHORIZE_DECIDE,
+          // Also with `routes: false`: `@UseConsoleAuthorize()` still applies the production 403.
+          useFactory: /* @__PURE__ */ __name((moduleRef) => resolveConsoleAuthorize(options.authorize, moduleRef), "useFactory"),
+          inject: [
+            import_core2.ModuleRef
+          ]
+        },
         // `@dudousxd/nestjs-filter` is wired PRIVATELY here rather than through
         // `FilterModule.forRoot()`, which is a global registration. A library calling that would
         // fight the host app over one set of module options and register a second app-wide
@@ -1894,7 +2223,7 @@ var DurableApiModule = class _DurableApiModule {
             validation: "off"
           }, null), "useFactory"),
           inject: [
-            import_core.ModuleRef
+            import_core2.ModuleRef
           ]
         },
         import_nestjs_filter3.ApplyFilterInterceptor,
@@ -1910,16 +2239,18 @@ var DurableApiModule = class _DurableApiModule {
       // is only exported then: exporting it from a mounted console would shadow a host's own
       // `FilterModule` runner in whatever module imports the dashboard.
       exports: routes ? [
-        DashboardService
+        DashboardService,
+        CONSOLE_AUTHORIZE_DECIDE
       ] : [
         DashboardService,
-        import_nestjs_filter3.FilterRunner
+        import_nestjs_filter3.FilterRunner,
+        CONSOLE_AUTHORIZE_DECIDE
       ]
     };
   }
 };
-DurableApiModule = _ts_decorate7([
-  (0, import_common7.Module)({})
+DurableApiModule = _ts_decorate8([
+  (0, import_common8.Module)({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
   static {
@@ -1944,6 +2275,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ...options.imports ? {
           imports: options.imports
         } : {},
+        ...options.authorize !== void 0 ? {
+          authorize: options.authorize
+        } : {},
         routes: false
       });
       return {
@@ -1955,7 +2289,8 @@ var DurableDashboardModule = class _DurableDashboardModule {
         controllers: [],
         providers: pathProviders,
         // What a host's subclasses of `DurableUiControllerBase` / `DurableApiControllerBase` inject:
-        // the SPA's paths, and the read/action service and the filter runner via the API module.
+        // the SPA's paths, the read/action service, the filter runner and the resolved `authorize`
+        // (for `@UseConsoleAuthorize()`) via the API module.
         exports: [
           DurableApiModule,
           DASHBOARD_BASE_PATH,
@@ -1963,7 +2298,6 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ]
       };
     }
-    const decorated = (options.decorators?.length ?? 0) > 0;
     return {
       module: _DurableDashboardModule,
       imports: [
@@ -1977,9 +2311,12 @@ var DurableDashboardModule = class _DurableDashboardModule {
           } : {},
           ...options.decorators ? {
             decorators: options.decorators
+          } : {},
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
           } : {}
         }),
-        import_core.RouterModule.register([
+        import_core2.RouterModule.register([
           {
             path: basePath,
             module: _DurableDashboardModule
@@ -1991,14 +2328,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ])
       ],
       controllers: [
-        controllerFor(DurableUiController, options.decorators)
-      ],
-      providers: [
-        ...pathProviders,
-        ...decorated ? [] : [
-          protectionCheckProvider()
-        ]
+        consoleController(DurableUiController, options.decorators)
       ],
+      providers: pathProviders,
       // Re-export the API module so its DashboardService reaches importers (e.g. flip's own controllers).
       exports: [
         DurableApiModule
@@ -2006,14 +2338,23 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate7([
-  (0, import_common7.Module)({})
+DurableDashboardModule = _ts_decorate8([
+  (0, import_common8.Module)({})
 ], DurableDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CONSOLE_AUTHORIZE_DECIDE,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
+  ConsolePublic,
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
-  DASHBOARD_PROTECTION_CHECK,
   DashboardService,
   DurableApiController,
   DurableApiControllerBase,
@@ -2021,6 +2362,9 @@ DurableDashboardModule = _ts_decorate7([
   DurableDashboardModule,
   DurableUiController,
   DurableUiControllerBase,
-  UNPROTECTED_CONSOLE_IN_PRODUCTION
+  UseConsoleAuthorize,
+  authorizeByToken,
+  normalizeConsoleResult,
+  resolveConsoleAuthorize
 });
 //# sourceMappingURL=index.cjs.map