@dudousxd/nestjs-durable-dashboard 0.55.1 → 0.57.0

package/dist/server/index.js

@@ -1,10 +1,11 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
-// src/server/dashboard.service.ts
-import { RunGateway, STATE_STORE_CANONICAL, TERMINAL_RUN_STATUSES, WorkflowEngine, collectMetrics, parseWebhookToken } from "@dudousxd/nestjs-durable-core";
-import { Inject, Injectable, Optional } from "@nestjs/common";
-import { Observable } from "rxjs";
+// src/server/console-authorize.ts
+import "reflect-metadata";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { Catch, HttpException, Inject, Injectable, Logger, UseFilters, UseGuards, applyDecorators } from "@nestjs/common";
+import { HttpAdapterHost } from "@nestjs/core";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -31,6 +32,315 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
+var CONSOLE_GATE = Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-durable-dashboard";
+var MODULE = "DurableDashboardModule";
+var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
+var allow = /* @__PURE__ */ __name(() => ({
+  allowed: true
+}), "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
+  }
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function isLazyModule(value) {
+  return typeof value === "object" && value !== null && isAuthorizerClass(value.default);
+}
+__name(isLazyModule, "isLazyModule");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (typeof result !== "object" || result === null) return forbidden();
+  const shape = result;
+  if (typeof shape.redirectTo === "string" && shape.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: shape.redirectTo
+    };
+  }
+  if (shape.allowed === true) return allow();
+  return shape.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+async function policyDecider(check, moduleRef) {
+  let pkg;
+  try {
+    pkg = await import("@nestjs/authorization");
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs @nestjs/authorization installed, with AuthorizationModule.forRoot() imported in the app; or pass a function, a class, or a gate name.`);
+  }
+  const { AuthorizationService, AUTHORIZATION_MODULE_OPTIONS, defaultGetUser } = pkg;
+  try {
+    moduleRef.get(AuthorizationService, {
+      strict: false
+    });
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app.`);
+  }
+  let getUser = defaultGetUser;
+  try {
+    const options = moduleRef.get(AUTHORIZATION_MODULE_OPTIONS, {
+      strict: false
+    });
+    if (typeof options?.getUser === "function") getUser = options.getUser;
+  } catch {
+  }
+  return async (context) => {
+    const authorization = moduleRef.get(AuthorizationService, {
+      strict: false
+    });
+    const user = await getUser(context);
+    const can = authorization.can;
+    if (await can.call(authorization, check.policy, check.ability, hasUser(user) ? user : null)) {
+      return allow();
+    }
+    return hasUser(user) ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+function gateDecider(name, moduleRef) {
+  try {
+    moduleRef.get(CONSOLE_GATE, {
+      strict: false
+    });
+  } catch {
+    throw new Error(`\`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }`);
+  }
+  return async (context) => {
+    const gate = moduleRef.get(CONSOLE_GATE, {
+      strict: false
+    });
+    return normalizeConsoleResult(await gate.allows(name, context));
+  };
+}
+__name(gateDecider, "gateDecider");
+function classDecider(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  const instanceOf = /* @__PURE__ */ __name((Class) => {
+    const cached = instances.get(Class);
+    if (cached) return cached;
+    const pending = (async () => {
+      try {
+        const registered = moduleRef.get(Class, {
+          strict: false
+        });
+        if (registered) return registered;
+      } catch {
+      }
+      return moduleRef.create(Class);
+    })();
+    pending.catch(() => instances.delete(Class));
+    instances.set(Class, pending);
+    return pending;
+  }, "instanceOf");
+  return (Class) => async (context) => normalizeConsoleResult(await (await instanceOf(Class)).authorize(context));
+}
+__name(classDecider, "classDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const logger = options.logger ?? new Logger(MODULE);
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) logger.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    const production = isProduction();
+    return async () => production ? forbidden() : allow();
+  }
+  let decide;
+  if (typeof authorize === "string") {
+    decide = gateDecider(authorize, moduleRef);
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    decide = classDecider(moduleRef)(authorize);
+  } else if (typeof authorize === "function") {
+    const fromClass = classDecider(moduleRef);
+    let lazy;
+    const fn = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazy) return lazy(context);
+      const result = await fn(context);
+      if (!isLazyModule(result)) return normalizeConsoleResult(result);
+      lazy = fromClass(result.default);
+      return lazy(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return await decide(context);
+    } catch (error) {
+      logger.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+var sha256 = /* @__PURE__ */ __name((value) => createHash("sha256").update(value).digest(), "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  return (context) => {
+    const header = context.switchToHttp().getRequest()?.headers?.authorization;
+    const match = typeof header === "string" ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+    if (match?.[1] && timingSafeEqual(sha256(match[1]), expected)) return true;
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+var CONSOLE_AUTHORIZE_DECIDE = Symbol(`${PACKAGE}:console-authorize`);
+var CONSOLE_PAGE_METADATA = `${PACKAGE}:console-page`;
+var ConsolePage = /* @__PURE__ */ __name(() => (target) => {
+  Reflect.defineMetadata(CONSOLE_PAGE_METADATA, true, target);
+}, "ConsolePage");
+var ConsoleAccessDenied = class extends HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page) {
+    const unauthenticated2 = decision.reason === "unauthenticated";
+    super(unauthenticated2 ? {
+      error: "unauthenticated",
+      ...decision.redirectTo ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    } : {
+      error: "forbidden"
+    }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page;
+  }
+};
+var CONSOLE_PUBLIC_METADATA = `${PACKAGE}:console-public`;
+var ConsolePublic = /* @__PURE__ */ __name(() => (_target, _key, descriptor) => {
+  Reflect.defineMetadata(CONSOLE_PUBLIC_METADATA, true, descriptor.value);
+}, "ConsolePublic");
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  decide;
+  constructor(decide) {
+    this.decide = decide;
+  }
+  async canActivate(context) {
+    if (Reflect.getMetadata(CONSOLE_PUBLIC_METADATA, context.getHandler()) === true) return true;
+    const decision = await this.decide(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
+  }
+};
+ConsoleAuthorizeGuard = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(CONSOLE_AUTHORIZE_DECIDE)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ConsoleDecide === "undefined" ? Object : ConsoleDecide
+  ])
+], ConsoleAuthorizeGuard);
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  if (Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) !== true) return false;
+  const request = context.switchToHttp().getRequest();
+  const accept = request?.headers?.accept;
+  return request?.method === "GET" && typeof accept === "string" && accept.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var consolePage = /* @__PURE__ */ __name((title, message) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`, "consolePage");
+var DENIED_PAGE = consolePage("Access denied", "You do not have access to this console.");
+var SIGN_IN_PAGE = consolePage("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const response = host.switchToHttp().getResponse();
+    const { decision, page } = exception;
+    if (page && decision.redirectTo) {
+      adapter.redirect(response, 302, decision.redirectTo);
+      return;
+    }
+    if (page) {
+      const forbiddenPage = decision.reason === "forbidden";
+      adapter.setHeader(response, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(response, forbiddenPage ? DENIED_PAGE : SIGN_IN_PAGE, forbiddenPage ? 403 : 401);
+      return;
+    }
+    adapter.reply(response, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate([
+  Catch(ConsoleAccessDenied),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+var UseConsoleAuthorize = /* @__PURE__ */ __name(() => applyDecorators(UseGuards(ConsoleAuthorizeGuard), UseFilters(ConsoleAuthorizeFilter)), "UseConsoleAuthorize");
+
+// src/server/dashboard.service.ts
+import { RunGateway, STATE_STORE_CANONICAL, TERMINAL_RUN_STATUSES, WorkflowEngine, collectMetrics, parseWebhookToken } from "@dudousxd/nestjs-durable-core";
+import { Inject as Inject2, Injectable as Injectable2, NotImplementedException, Optional } from "@nestjs/common";
+import { Observable } from "rxjs";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 var DashboardService = class {
   static {
     __name(this, "DashboardService");
@@ -55,7 +365,7 @@ var DashboardService = class {
   */
   controlPlane() {
     if (!this.store || !this.engine) {
-      throw new Error("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
+      throw new NotImplementedException("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
     }
     return {
       store: this.store,
@@ -304,13 +614,13 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate([
-  Injectable(),
-  _ts_param(1, Optional()),
-  _ts_param(1, Inject(STATE_STORE_CANONICAL)),
-  _ts_param(2, Optional()),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+DashboardService = _ts_decorate2([
+  Injectable2(),
+  _ts_param2(1, Optional()),
+  _ts_param2(1, Inject2(STATE_STORE_CANONICAL)),
+  _ts_param2(2, Optional()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof RunGateway === "undefined" ? Object : RunGateway,
     typeof StateStore === "undefined" ? Object : StateStore,
     typeof WorkflowEngine === "undefined" ? Object : WorkflowEngine
@@ -319,7 +629,7 @@ DashboardService = _ts_decorate([
 
 // src/server/durable-api.controller.ts
 import { ApplyFilter, ApplyFilterInterceptor, FilterRunner } from "@dudousxd/nestjs-filter";
-import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException, Param, Post, Query, Res, Sse, UseFilters, UseInterceptors } from "@nestjs/common";
+import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException as NotImplementedException2, Param, Post, Query, Res, Sse, UseFilters as UseFilters2, UseInterceptors } from "@nestjs/common";
 
 // src/server/durable-run.ts
 var DurableRun = class {
@@ -395,8 +705,8 @@ function runValueAxisFor(field) {
 __name(runValueAxisFor, "runValueAxisFor");
 
 // src/server/not-modified.ts
-import { Catch, HttpException } from "@nestjs/common";
-function _ts_decorate2(decorators, target, key, desc) {
+import { Catch as Catch2, HttpException as HttpException2 } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -409,7 +719,7 @@ function _ts_decorate2(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
+__name(_ts_decorate3, "_ts_decorate");
 function isRawResponse(value) {
   if (typeof value !== "object" || value === null) return false;
   const candidate = value;
@@ -435,7 +745,7 @@ function writeNotModifiedRaw(response, etag) {
   raw.end();
 }
 __name(writeNotModifiedRaw, "writeNotModifiedRaw");
-var NotModifiedException = class extends HttpException {
+var NotModifiedException = class extends HttpException2 {
   static {
     __name(this, "NotModifiedException");
   }
@@ -452,8 +762,8 @@ var NotModifiedFilter = class {
     writeNotModifiedRaw(host.switchToHttp().getResponse(), exception.etag);
   }
 };
-NotModifiedFilter = _ts_decorate2([
-  Catch(NotModifiedException)
+NotModifiedFilter = _ts_decorate3([
+  Catch2(NotModifiedException)
 ], NotModifiedFilter);
 function setEtag(response, etag) {
   setRawHeader(response, "etag", etag);
@@ -470,7 +780,7 @@ __name(toRunListRow, "toRunListRow");
 
 // src/server/run.filter.ts
 import { BaseFilter, FilterFor, Filterable } from "@dudousxd/nestjs-filter";
-import { Injectable as Injectable3 } from "@nestjs/common";
+import { Injectable as Injectable4 } from "@nestjs/common";
 
 // src/server/attr-filter.ts
 var SCALAR_OPS = /* @__PURE__ */ new Set([
@@ -521,7 +831,7 @@ __name(parseAttrFilters, "parseAttrFilters");
 
 // src/server/run-query.adapter.ts
 import { RUN_VALUE_FACET_LIMIT, RunGateway as RunGateway2 } from "@dudousxd/nestjs-durable-core";
-import { BadRequestException, Injectable as Injectable2 } from "@nestjs/common";
+import { BadRequestException, Injectable as Injectable3 } from "@nestjs/common";
 
 // src/server/run-query-draft.ts
 var RunQueryDraft2 = class {
@@ -551,7 +861,7 @@ var RunQueryDraft2 = class {
 };
 
 // src/server/run-query.adapter.ts
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -564,13 +874,13 @@ function _ts_decorate3(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(metadataKey, metadataValue) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata2, "_ts_metadata");
+__name(_ts_metadata3, "_ts_metadata");
 var RUN_QUERY_ADAPTER = Symbol("DURABLE_RUN_QUERY_ADAPTER");
 var FIXED_ORDER = {
   field: "createdAt",
@@ -844,16 +1154,16 @@ var RunQueryAdapter = class {
     }
   }
 };
-RunQueryAdapter = _ts_decorate3([
-  Injectable2(),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+RunQueryAdapter = _ts_decorate4([
+  Injectable3(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof RunGateway2 === "undefined" ? Object : RunGateway2
   ])
 ], RunQueryAdapter);
 
 // src/server/run.filter.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -866,13 +1176,13 @@ function _ts_decorate4(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(metadataKey, metadataValue) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata3, "_ts_metadata");
+__name(_ts_metadata4, "_ts_metadata");
 function list(value) {
   return (Array.isArray(value) ? value : [
     value
@@ -992,76 +1302,76 @@ var RunFilter = class extends BaseFilter {
     });
   }
 };
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("status"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyStatus", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("workflow"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyWorkflow", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("namespace"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyNamespace", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("tag"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyTag", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("origin"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyOrigin", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("unattributed"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyUnattributed", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("attr"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyAttributes", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("limit"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyLimit", null);
-_ts_decorate4([
+_ts_decorate5([
   FilterFor("offset"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", void 0)
+  _ts_metadata4("design:returntype", void 0)
 ], RunFilter.prototype, "applyOffset", null);
-RunFilter = _ts_decorate4([
-  Injectable3(),
+RunFilter = _ts_decorate5([
+  Injectable4(),
   Filterable({
     entity: DurableRun,
     adapter: RUN_QUERY_ADAPTER,
@@ -1070,7 +1380,7 @@ RunFilter = _ts_decorate4([
 ], RunFilter);
 
 // src/server/durable-api.controller.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1083,19 +1393,19 @@ function _ts_decorate5(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(metadataKey, metadataValue) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var FAN_INLINE_MAX = 50;
 var DurableApiControllerBase = class {
   static {
@@ -1197,7 +1507,7 @@ var DurableApiControllerBase = class {
   */
   async workflowLifecycle(name) {
     const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
-    if (!links) throw new NotImplementedException("workflow lifecycle links need the control plane");
+    if (!links) throw new NotImplementedException2("workflow lifecycle links need the control plane");
     return links;
   }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
@@ -1293,7 +1603,7 @@ var DurableApiControllerBase = class {
       return notSupportedByServer(error);
     }
     if (!result) {
-      throw new NotImplementedException("republishing lifecycle events needs the control plane");
+      throw new NotImplementedException2("republishing lifecycle events needs the control plane");
     }
     return result;
   }
@@ -1310,9 +1620,9 @@ var DurableApiControllerBase = class {
   }
   /**
   * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-  * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-  * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-  * verification in your own middleware.
+  * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+  * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+  * and/or front it with signature verification in your own middleware.
   */
   async webhook(token, body) {
     const result = await this.dashboard.deliverWebhook(token, body);
@@ -1328,135 +1638,135 @@ var DurableApiControllerBase = class {
     return this.dashboard.update(id, name, body);
   }
 };
-_ts_decorate5([
+_ts_decorate6([
   Get("runs"),
-  _ts_param2(0, ApplyFilter(RunFilter)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, ApplyFilter(RunFilter)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "runs", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("runs/facets"),
-  _ts_param2(0, ApplyFilter(RunFilter)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, ApplyFilter(RunFilter)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "facets", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("runs/values"),
-  _ts_param2(0, Query()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Query()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "values", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("metrics"),
   Header("Content-Type", "text/plain; version=0.0.4"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "metrics", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("workers"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "workers", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("schedules"),
-  _ts_param2(0, Query("namespace")),
-  _ts_param2(1, Query("workflow")),
-  _ts_param2(2, Query("tag")),
-  _ts_param2(3, Query("paused")),
-  _ts_param2(4, Query("limit")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Query("namespace")),
+  _ts_param3(1, Query("workflow")),
+  _ts_param3(2, Query("tag")),
+  _ts_param3(3, Query("paused")),
+  _ts_param3(4, Query("limit")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "schedules", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("schedules/:id/pause"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "pauseSchedule", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("schedules/:id/resume"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "resumeSchedule", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("schedules/:id/trigger"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "triggerSchedule", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("workflows/:name/lifecycle"),
-  _ts_param2(0, Param("name")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("name")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "workflowLifecycle", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("topology"),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", []),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "topology", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("runs/:id"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Query("full")),
-  _ts_param2(2, Headers("if-none-match")),
-  _ts_param2(3, Res({
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Query("full")),
+  _ts_param3(2, Headers("if-none-match")),
+  _ts_param3(3, Res({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "run", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("runs/:id/fans/:group"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Param("group")),
-  _ts_param2(2, Query("offset")),
-  _ts_param2(3, Query("limit")),
-  _ts_param2(4, Query("failed")),
-  _ts_param2(5, Headers("if-none-match")),
-  _ts_param2(6, Res({
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Param("group")),
+  _ts_param3(2, Query("offset")),
+  _ts_param3(3, Query("limit")),
+  _ts_param3(4, Query("failed")),
+  _ts_param3(5, Headers("if-none-match")),
+  _ts_param3(6, Res({
     passthrough: true
   })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     String,
@@ -1465,131 +1775,132 @@ _ts_decorate5([
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "fanMembers", null);
-_ts_decorate5([
+_ts_decorate6([
   Sse("runs/:id/stream"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "stream", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/retry"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "retry", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/retry-with-input"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Body()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "retryWithInput", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("bulk/:action"),
-  _ts_param2(0, Param("action")),
-  _ts_param2(1, ApplyFilter(RunFilter)),
-  _ts_param2(2, Query("compensate")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("action")),
+  _ts_param3(1, ApplyFilter(RunFilter)),
+  _ts_param3(2, Query("compensate")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     typeof RunQueryDraft === "undefined" ? Object : RunQueryDraft,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "bulk", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/cancel"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Query("compensate")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Query("compensate")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "cancel", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/republish-lifecycle"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Body()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "republishLifecycle", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/continue"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "continue", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/redispatch"),
-  _ts_param2(0, Param("id")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "redispatch", null);
-_ts_decorate5([
+_ts_decorate6([
+  ConsolePublic(),
   Post("webhooks/:token"),
-  _ts_param2(0, Param("token")),
-  _ts_param2(1, Body()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("token")),
+  _ts_param3(1, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", Promise)
+  _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "webhook", null);
-_ts_decorate5([
+_ts_decorate6([
   Get("runs/:id/events/:key"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Param("key")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Param("key")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "event", null);
-_ts_decorate5([
+_ts_decorate6([
   Post("runs/:id/updates/:name"),
-  _ts_param2(0, Param("id")),
-  _ts_param2(1, Param("name")),
-  _ts_param2(2, Body()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  _ts_param3(0, Param("id")),
+  _ts_param3(1, Param("name")),
+  _ts_param3(2, Body()),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
     String,
     Object
   ]),
-  _ts_metadata4("design:returntype", void 0)
+  _ts_metadata5("design:returntype", void 0)
 ], DurableApiControllerBase.prototype, "update", null);
-DurableApiControllerBase = _ts_decorate5([
+DurableApiControllerBase = _ts_decorate6([
   Controller(),
   UseInterceptors(ApplyFilterInterceptor),
-  UseFilters(NotModifiedFilter),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+  UseFilters2(NotModifiedFilter),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     typeof FilterRunner === "undefined" ? Object : FilterRunner
   ])
@@ -1603,7 +1914,7 @@ function notFound(error) {
 __name(notFound, "notFound");
 function notSupportedByServer(error) {
   if (error?.code === "unsupported-request") {
-    throw new NotImplementedException(error instanceof Error ? error.message : String(error));
+    throw new NotImplementedException2(error instanceof Error ? error.message : String(error));
   }
   throw error;
 }
@@ -1613,14 +1924,14 @@ var DurableApiController = class extends DurableApiControllerBase {
     __name(this, "DurableApiController");
   }
 };
-DurableApiController = _ts_decorate5([
+DurableApiController = _ts_decorate6([
   Controller()
 ], DurableApiController);
 
 // src/server/durable-dashboard.module.ts
 import "reflect-metadata";
 import { ApplyFilterInterceptor as ApplyFilterInterceptor2, FilterRunner as FilterRunner2 } from "@dudousxd/nestjs-filter";
-import { Logger, Module } from "@nestjs/common";
+import { Module } from "@nestjs/common";
 import { ModuleRef, RouterModule } from "@nestjs/core";
 
 // src/server/controller-decorators.ts
@@ -1653,8 +1964,8 @@ __name(controllerFor, "controllerFor");
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject2, NotFoundException as NotFoundException2, Param as Param2, StreamableFile } from "@nestjs/common";
-function _ts_decorate6(decorators, target, key, desc) {
+import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, StreamableFile } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1667,19 +1978,19 @@ function _ts_decorate6(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(metadataKey, metadataValue) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param4, "_ts_param");
 var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
 var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
 var BUILD_BASE = "/durable";
@@ -1732,30 +2043,31 @@ var DurableUiControllerBase = class {
     });
   }
 };
-_ts_decorate6([
+_ts_decorate7([
   Get2(),
   Header2("Content-Type", "text/html; charset=utf-8"),
   Header2("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", String)
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", String)
 ], DurableUiControllerBase.prototype, "index", null);
-_ts_decorate6([
+_ts_decorate7([
   Get2("assets/:file"),
   Header2("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, Param2("file")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_param4(0, Param2("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata5("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata6("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], DurableUiControllerBase.prototype, "asset", null);
-DurableUiControllerBase = _ts_decorate6([
+DurableUiControllerBase = _ts_decorate7([
   Controller2(),
-  _ts_param3(0, Inject2(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, Inject2(DASHBOARD_API_PATH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  ConsolePage(),
+  _ts_param4(0, Inject3(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, Inject3(DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
@@ -1765,12 +2077,12 @@ var DurableUiController = class extends DurableUiControllerBase {
     __name(this, "DurableUiController");
   }
 };
-DurableUiController = _ts_decorate6([
+DurableUiController = _ts_decorate7([
   Controller2()
 ], DurableUiController);
 
 // src/server/durable-dashboard.module.ts
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1783,31 +2095,9 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
+__name(_ts_decorate8, "_ts_decorate");
 markOpenToAuthorization(DurableApiController);
 markOpenToAuthorization(DurableUiController);
-var DASHBOARD_PROTECTION_CHECK = Symbol("DASHBOARD_PROTECTION_CHECK");
-var UNPROTECTED_CONSOLE_IN_PRODUCTION = [
-  "DurableDashboardModule: NODE_ENV=production and the durable console is mounted with no",
-  "protection, so the app refuses to boot. Protect it one of two ways:",
-  "(1) decorators on the mounted console: DurableDashboardModule.forRoot({ decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')] });",
-  "(2) mount it yourself: DurableDashboardModule.forRoot({ routes: false }) plus @Controller('durable') @UseGuards(AuthenticationGuard) @Can(ConsolePolicy, 'view') class ConsoleUi extends DurableUiControllerBase {} (and the same over DurableApiControllerBase at 'durable/api')."
-].join(" ");
-function isProduction() {
-  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
-}
-__name(isProduction, "isProduction");
-function protectionCheckProvider() {
-  return {
-    provide: DASHBOARD_PROTECTION_CHECK,
-    useFactory: /* @__PURE__ */ __name(() => {
-      if (isProduction()) throw new Error(UNPROTECTED_CONSOLE_IN_PRODUCTION);
-      new Logger("DurableDashboard").warn("The durable console is mounted with no `decorators`, so it is served OPEN (retry/cancel included). That is refused when NODE_ENV=production: pass `decorators` (e.g. [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]) or mount it yourself with `routes: false`.");
-      return true;
-    }, "useFactory")
-  };
-}
-__name(protectionCheckProvider, "protectionCheckProvider");
 function assertNothingToDecorate(options) {
   if (options.decorators === void 0) return;
   throw new Error([
@@ -1818,6 +2108,13 @@ function assertNothingToDecorate(options) {
   ].join(" "));
 }
 __name(assertNothingToDecorate, "assertNothingToDecorate");
+function consoleController(base, decorators) {
+  return controllerFor(base, [
+    ...decorators ?? [],
+    UseConsoleAuthorize()
+  ]);
+}
+__name(consoleController, "consoleController");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
@@ -1834,10 +2131,20 @@ var DurableApiModule = class _DurableApiModule {
         ...options.imports ?? []
       ],
       controllers: routes ? [
-        controllerFor(DurableApiController, options.decorators)
+        consoleController(DurableApiController, options.decorators)
       ] : [],
       providers: [
         DashboardService,
+        // Resolved at boot: a gate name without nestjs-authz, or a policy without
+        // @nestjs/authorization, fails here rather than on the first request.
+        {
+          provide: CONSOLE_AUTHORIZE_DECIDE,
+          // Also with `routes: false`: `@UseConsoleAuthorize()` still applies the production 403.
+          useFactory: /* @__PURE__ */ __name((moduleRef) => resolveConsoleAuthorize(options.authorize, moduleRef), "useFactory"),
+          inject: [
+            ModuleRef
+          ]
+        },
         // `@dudousxd/nestjs-filter` is wired PRIVATELY here rather than through
         // `FilterModule.forRoot()`, which is a global registration. A library calling that would
         // fight the host app over one set of module options and register a second app-wide
@@ -1875,15 +2182,17 @@ var DurableApiModule = class _DurableApiModule {
       // is only exported then: exporting it from a mounted console would shadow a host's own
       // `FilterModule` runner in whatever module imports the dashboard.
       exports: routes ? [
-        DashboardService
+        DashboardService,
+        CONSOLE_AUTHORIZE_DECIDE
       ] : [
         DashboardService,
-        FilterRunner2
+        FilterRunner2,
+        CONSOLE_AUTHORIZE_DECIDE
       ]
     };
   }
 };
-DurableApiModule = _ts_decorate7([
+DurableApiModule = _ts_decorate8([
   Module({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
@@ -1909,6 +2218,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ...options.imports ? {
           imports: options.imports
         } : {},
+        ...options.authorize !== void 0 ? {
+          authorize: options.authorize
+        } : {},
         routes: false
       });
       return {
@@ -1920,7 +2232,8 @@ var DurableDashboardModule = class _DurableDashboardModule {
         controllers: [],
         providers: pathProviders,
         // What a host's subclasses of `DurableUiControllerBase` / `DurableApiControllerBase` inject:
-        // the SPA's paths, and the read/action service and the filter runner via the API module.
+        // the SPA's paths, the read/action service, the filter runner and the resolved `authorize`
+        // (for `@UseConsoleAuthorize()`) via the API module.
         exports: [
           DurableApiModule,
           DASHBOARD_BASE_PATH,
@@ -1928,7 +2241,6 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ]
       };
     }
-    const decorated = (options.decorators?.length ?? 0) > 0;
     return {
       module: _DurableDashboardModule,
       imports: [
@@ -1942,6 +2254,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
           } : {},
           ...options.decorators ? {
             decorators: options.decorators
+          } : {},
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
           } : {}
         }),
         RouterModule.register([
@@ -1956,14 +2271,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ])
       ],
       controllers: [
-        controllerFor(DurableUiController, options.decorators)
-      ],
-      providers: [
-        ...pathProviders,
-        ...decorated ? [] : [
-          protectionCheckProvider()
-        ]
+        consoleController(DurableUiController, options.decorators)
       ],
+      providers: pathProviders,
       // Re-export the API module so its DashboardService reaches importers (e.g. flip's own controllers).
       exports: [
         DurableApiModule
@@ -1971,13 +2281,22 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate7([
+DurableDashboardModule = _ts_decorate8([
   Module({})
 ], DurableDashboardModule);
 export {
+  CONSOLE_AUTHORIZE_DECIDE,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
+  ConsolePublic,
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
-  DASHBOARD_PROTECTION_CHECK,
   DashboardService,
   DurableApiController,
   DurableApiControllerBase,
@@ -1985,6 +2304,9 @@ export {
   DurableDashboardModule,
   DurableUiController,
   DurableUiControllerBase,
-  UNPROTECTED_CONSOLE_IN_PRODUCTION
+  UseConsoleAuthorize,
+  authorizeByToken,
+  normalizeConsoleResult,
+  resolveConsoleAuthorize
 };
 //# sourceMappingURL=index.js.map