@dudousxd/nestjs-durable-dashboard 0.56.0 → 0.58.0

package/dist/server/index.js

@@ -5,7 +5,7 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 import "reflect-metadata";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { Catch, HttpException, Inject, Injectable, Logger, UseFilters, UseGuards, applyDecorators } from "@nestjs/common";
-import { HttpAdapterHost } from "@nestjs/core";
+import { HttpAdapterHost, ModuleRef } from "@nestjs/core";
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -36,9 +36,12 @@ var CONSOLE_GATE = Symbol.for("@dudousxd/aviary:console-gate");
 var PACKAGE = "@dudousxd/nestjs-durable-dashboard";
 var MODULE = "DurableDashboardModule";
 var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
-var allow = /* @__PURE__ */ __name(() => ({
+var allow = /* @__PURE__ */ __name((caller) => caller !== void 0 && caller !== "" ? {
+  allowed: true,
+  caller
+} : {
   allowed: true
-}), "allow");
+}, "allow");
 var forbidden = /* @__PURE__ */ __name(() => ({
   allowed: false,
   reason: "forbidden"
@@ -78,7 +81,9 @@ function normalizeConsoleResult(result) {
       redirectTo: shape.redirectTo
     };
   }
-  if (shape.allowed === true) return allow();
+  if (shape.allowed === true) {
+    return allow(typeof shape.caller === "string" ? shape.caller : void 0);
+  }
   return shape.reason === "unauthenticated" ? unauthenticated() : forbidden();
 }
 __name(normalizeConsoleResult, "normalizeConsoleResult");
@@ -161,11 +166,11 @@ function classDecider(moduleRef) {
 }
 __name(classDecider, "classDecider");
 async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
-  const logger = options.logger ?? new Logger(MODULE);
+  const logger3 = options.logger ?? new Logger(MODULE);
   if (authorize === void 0) {
-    if (options.warnIfMissing !== false) logger.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    if (options.warnIfMissing !== false) logger3.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
     const production = isProduction();
-    return async () => production ? forbidden() : allow();
+    return async () => production ? forbidden() : allow("dev-open");
   }
   let decide;
   if (typeof authorize === "string") {
@@ -192,7 +197,7 @@ async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
     try {
       return await decide(context);
     } catch (error) {
-      logger.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      logger3.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
       return forbidden();
     }
   };
@@ -205,10 +210,16 @@ function authorizeByToken(options) {
     throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
   }
   const expected = sha256(token);
+  const caller = `token:${expected.toString("hex").slice(0, 12)}`;
   return (context) => {
     const header = context.switchToHttp().getRequest()?.headers?.authorization;
     const match = typeof header === "string" ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
-    if (match?.[1] && timingSafeEqual(sha256(match[1]), expected)) return true;
+    if (match?.[1] && timingSafeEqual(sha256(match[1]), expected)) {
+      return {
+        allowed: true,
+        caller
+      };
+    }
     return {
       allowed: false,
       reason: "unauthenticated"
@@ -216,6 +227,48 @@ function authorizeByToken(options) {
   };
 }
 __name(authorizeByToken, "authorizeByToken");
+function anyAuthorize(...forms) {
+  if (forms.length === 0) throw new Error("anyAuthorize: pass at least one authorize form.");
+  let AnyConsoleAuthorizer = class AnyConsoleAuthorizer {
+    static {
+      __name(this, "AnyConsoleAuthorizer");
+    }
+    moduleRef;
+    #decides;
+    constructor(moduleRef) {
+      this.moduleRef = moduleRef;
+    }
+    async authorize(context) {
+      this.#decides ??= Promise.all(forms.map((form) => resolveConsoleAuthorize(form, this.moduleRef, {
+        warnIfMissing: false
+      })));
+      this.#decides.catch(() => {
+        this.#decides = void 0;
+      });
+      let unauthenticated2;
+      for (const decide of await this.#decides) {
+        const decision = await decide(context);
+        if (decision.allowed) return decision;
+        if (decision.reason === "unauthenticated") unauthenticated2 ??= decision;
+      }
+      if (unauthenticated2 === void 0) return {
+        allowed: false,
+        reason: "forbidden"
+      };
+      return "redirectTo" in unauthenticated2 && unauthenticated2.redirectTo !== void 0 ? {
+        redirectTo: unauthenticated2.redirectTo
+      } : {
+        allowed: false,
+        reason: "unauthenticated"
+      };
+    }
+  };
+  Reflect.defineMetadata("design:paramtypes", [
+    ModuleRef
+  ], AnyConsoleAuthorizer);
+  return AnyConsoleAuthorizer;
+}
+__name(anyAuthorize, "anyAuthorize");
 var CONSOLE_AUTHORIZE_DECIDE = Symbol(`${PACKAGE}:console-authorize`);
 var CONSOLE_PAGE_METADATA = `${PACKAGE}:console-page`;
 var ConsolePage = /* @__PURE__ */ __name(() => (target) => {
@@ -227,7 +280,7 @@ var ConsoleAccessDenied = class extends HttpException {
   }
   decision;
   page;
-  constructor(decision, page) {
+  constructor(decision, page2) {
     const unauthenticated2 = decision.reason === "unauthenticated";
     super(unauthenticated2 ? {
       error: "unauthenticated",
@@ -236,9 +289,13 @@ var ConsoleAccessDenied = class extends HttpException {
       } : {}
     } : {
       error: "forbidden"
-    }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page;
+    }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page2;
   }
 };
+var CONSOLE_PUBLIC_METADATA = `${PACKAGE}:console-public`;
+var ConsolePublic = /* @__PURE__ */ __name(() => (_target, _key, descriptor) => {
+  Reflect.defineMetadata(CONSOLE_PUBLIC_METADATA, true, descriptor.value);
+}, "ConsolePublic");
 var ConsoleAuthorizeGuard = class {
   static {
     __name(this, "ConsoleAuthorizeGuard");
@@ -248,6 +305,7 @@ var ConsoleAuthorizeGuard = class {
     this.decide = decide;
   }
   async canActivate(context) {
+    if (Reflect.getMetadata(CONSOLE_PUBLIC_METADATA, context.getHandler()) === true) return true;
     const decision = await this.decide(context);
     if (decision.allowed) return true;
     throw new ConsoleAccessDenied(decision, isPageNavigation(context));
@@ -283,12 +341,12 @@ var ConsoleAuthorizeFilter = class {
   catch(exception, host) {
     const adapter = this.adapterHost.httpAdapter;
     const response = host.switchToHttp().getResponse();
-    const { decision, page } = exception;
-    if (page && decision.redirectTo) {
+    const { decision, page: page2 } = exception;
+    if (page2 && decision.redirectTo) {
       adapter.redirect(response, 302, decision.redirectTo);
       return;
     }
-    if (page) {
+    if (page2) {
       const forbiddenPage = decision.reason === "forbidden";
       adapter.setHeader(response, "Content-Type", "text/html; charset=utf-8");
       adapter.reply(response, forbiddenPage ? DENIED_PAGE : SIGN_IN_PAGE, forbiddenPage ? 403 : 401);
@@ -308,7 +366,7 @@ var UseConsoleAuthorize = /* @__PURE__ */ __name(() => applyDecorators(UseGuards
 
 // src/server/dashboard.service.ts
 import { RunGateway, STATE_STORE_CANONICAL, TERMINAL_RUN_STATUSES, WorkflowEngine, collectMetrics, parseWebhookToken } from "@dudousxd/nestjs-durable-core";
-import { Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
+import { Inject as Inject2, Injectable as Injectable2, NotImplementedException, Optional } from "@nestjs/common";
 import { Observable } from "rxjs";
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -360,7 +418,7 @@ var DashboardService = class {
   */
   controlPlane() {
     if (!this.store || !this.engine) {
-      throw new Error("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
+      throw new NotImplementedException("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
     }
     return {
       store: this.store,
@@ -460,31 +518,31 @@ var DashboardService = class {
   async workerHealth() {
     return this.gateway.workerHealth();
   }
-  getRunDetail(runId, options) {
-    return this.gateway.getRunDetail(runId, options);
+  getRunDetail(runId2, options) {
+    return this.gateway.getRunDetail(runId2, options);
   }
   /** A page of one fan's members, or null when the run is unknown or the gateway can't page fans. */
-  async getFanMembers(runId, group, query) {
-    return await this.gateway.getFanMembers?.(runId, group, query) ?? null;
+  async getFanMembers(runId2, group, query) {
+    return await this.gateway.getFanMembers?.(runId2, group, query) ?? null;
   }
   /** Fix-and-replay a dead/failed run with a corrected input — a fresh linked run. Returns its id. */
-  retryWithInput(runId, input) {
-    return this.gateway.retryWithInput(runId, input);
+  retryWithInput(runId2, input) {
+    return this.gateway.retryWithInput(runId2, input);
   }
   /** Re-run a failed/incomplete run; completed steps replay from their checkpoints. */
-  retry(runId) {
-    return this.gateway.retry(runId);
+  retry(runId2) {
+    return this.gateway.retry(runId2);
   }
-  cancel(runId, opts) {
-    return this.gateway.cancel(runId, opts);
+  cancel(runId2, opts) {
+    return this.gateway.cancel(runId2, opts);
   }
   /**
   * Publish a settled run's lifecycle event again, to its subscribers that have not started (or to
   * `subscriber` alone). Undefined when the gateway cannot republish (a tenant proxy).
   */
-  async republishLifecycle(runId, subscriber) {
+  async republishLifecycle(runId2, subscriber) {
     return this.gateway.republishLifecycle?.({
-      runId,
+      runId: runId2,
       ...subscriber !== void 0 ? {
         subscriber
       } : {}
@@ -552,12 +610,12 @@ var DashboardService = class {
     };
   }
   /** Resume a run paused at a `ctx.breakpoint` (the "continue" button). */
-  continue(runId) {
-    return this.gateway.continue(runId);
+  continue(runId2) {
+    return this.gateway.continue(runId2);
   }
   /** Re-dispatch a run's stuck `pending` remote steps — recovery for a lost step dispatch. */
-  redispatch(runId) {
-    return this.gateway.redispatchPending(runId);
+  redispatch(runId2) {
+    return this.gateway.redispatchPending(runId2);
   }
   /**
   * Deliver a `ctx.webhook()` callback: turn an inbound POST (token + body) into the signal the
@@ -586,13 +644,39 @@ var DashboardService = class {
       status: fresh?.status ?? run.status
     };
   }
+  /**
+  * What this deployment can serve: `controlPlane` (signals, run events, updates, metrics) and
+  * `schedules` (persisted schedules). Both are false on a store-less tenant.
+  */
+  capabilities() {
+    const controlPlane = this.store !== void 0 && this.engine !== void 0;
+    return {
+      controlPlane,
+      schedules: controlPlane && this.engine?.schedules?.supported === true
+    };
+  }
+  /** Whether `runId` names a run the caller may see (tenancy applies). */
+  async runExists(runId2) {
+    if (this.gateway.getRun) return await this.gateway.getRun(runId2) !== null;
+    return await this.gateway.getRunDetail(runId2, {
+      summarizeFansOver: 0
+    }) !== null;
+  }
+  /**
+  * Deliver `payload` to the run waiting on `token` (`engine.signal`). Null when no run the caller
+  * may see waits on it yet: the engine then buffers the payload for the run that waits next.
+  * Control-plane-only.
+  */
+  signal(token, payload) {
+    return this.controlPlane().engine.signal(token, payload);
+  }
   /** Side-effect-free read of a value a run published via `ctx.setEvent` (a live query). Control-plane-only. */
-  async getEvent(runId, key) {
-    return this.controlPlane().engine.getEvent(runId, key);
+  async getEvent(runId2, key) {
+    return this.controlPlane().engine.getEvent(runId2, key);
   }
   /** Deliver a validated `ctx.onUpdate` to a run; the validator may reject it (see UpdateResult). Control-plane-only. */
-  async update(runId, name, arg) {
-    return this.controlPlane().engine.update(runId, name, arg);
+  async update(runId2, name, arg) {
+    return this.controlPlane().engine.update(runId2, name, arg);
   }
   /**
   * Live stream of a run's lifecycle events for SSE. Backed by `gateway.subscribe`, which — on the
@@ -600,9 +684,9 @@ var DashboardService = class {
   * executing on a worker pod), and on a tenant round-trips over the transport. Either way the
   * gateway already filters to `runId`; the dashboard just wires the events through.
   */
-  streamRun(runId) {
+  streamRun(runId2) {
     return new Observable((subscriber) => {
-      const off = this.gateway.subscribe(runId, (event) => subscriber.next({
+      const off = this.gateway.subscribe(runId2, (event) => subscriber.next({
         data: event
       }));
       return () => off();
@@ -624,7 +708,7 @@ DashboardService = _ts_decorate2([
 
 // src/server/durable-api.controller.ts
 import { ApplyFilter, ApplyFilterInterceptor, FilterRunner } from "@dudousxd/nestjs-filter";
-import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException, Param, Post, Query, Res, Sse, UseFilters as UseFilters2, UseInterceptors } from "@nestjs/common";
+import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException as NotImplementedException2, Param, Post, Query, Res, Sse, UseFilters as UseFilters2, UseInterceptors } from "@nestjs/common";
 
 // src/server/durable-run.ts
 var DurableRun = class {
@@ -850,7 +934,7 @@ var RunQueryDraft2 = class {
   /** The predicates minus the page window and the axes a facet count reports on — what
   *  `runFacets`/`runValueFacets` are taken over. */
   facetQuery() {
-    const { status, statuses, origin, origins, limit, offset, ...facetQuery } = this.query;
+    const { status, statuses, origin, origins, limit: limit2, offset, ...facetQuery } = this.query;
     return facetQuery;
   }
 };
@@ -1055,10 +1139,10 @@ var RunQueryAdapter = class {
     }
     unsupported(clause, "equals, notEquals, gt, gte, lt, lte, in");
   }
-  applyOffsetPagination(qb, page, size) {
+  applyOffsetPagination(qb, page2, size) {
     this.draft(qb).narrow({
       limit: size,
-      offset: (page - 1) * size
+      offset: (page2 - 1) * size
     });
   }
   /**
@@ -1285,9 +1369,9 @@ var RunFilter = class extends BaseFilter {
     }
   }
   applyLimit(value) {
-    const limit = bound(value);
-    if (limit !== void 0) this.$query.narrow({
-      limit
+    const limit2 = bound(value);
+    if (limit2 !== void 0) this.$query.narrow({
+      limit: limit2
     });
   }
   applyOffset(value) {
@@ -1469,7 +1553,7 @@ var DurableApiControllerBase = class {
   * The persisted schedules (`engine.schedules`), soonest-due first, optionally narrowed by
   * `namespace`/`workflow`/`tag`/`paused`. Empty on a tenant or a store without schedules.
   */
-  schedules(namespace, workflow, tag, paused, limit) {
+  schedules(namespace, workflow, tag, paused, limit2) {
     return this.dashboard.listSchedules({
       ...namespace ? {
         namespace
@@ -1483,7 +1567,7 @@ var DurableApiControllerBase = class {
       ...paused === "true" || paused === "false" ? {
         paused: paused === "true"
       } : {},
-      limit: Math.min(Number(limit) || 200, 1e3)
+      limit: Math.min(Number(limit2) || 200, 1e3)
     });
   }
   pauseSchedule(id) {
@@ -1502,7 +1586,7 @@ var DurableApiControllerBase = class {
   */
   async workflowLifecycle(name) {
     const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
-    if (!links) throw new NotImplementedException("workflow lifecycle links need the control plane");
+    if (!links) throw new NotImplementedException2("workflow lifecycle links need the control plane");
     return links;
   }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
@@ -1533,17 +1617,17 @@ var DurableApiControllerBase = class {
     return body;
   }
   /** One page of a summarized fan's members, in seq order. Versioned like {@link run}. */
-  async fanMembers(id, group, offset, limit, failed, ifNoneMatch, response) {
-    const page = await this.dashboard.getFanMembers(id, group, {
+  async fanMembers(id, group, offset, limit2, failed, ifNoneMatch, response) {
+    const page2 = await this.dashboard.getFanMembers(id, group, {
       offset: offset === void 0 ? void 0 : Number(offset),
-      limit: limit === void 0 ? void 0 : Number(limit),
+      limit: limit2 === void 0 ? void 0 : Number(limit2),
       failedOnly: failed === "true",
       ...ifNoneMatch && {
         ifNoneMatch
       }
     });
-    if (!page) throw new NotFoundException(`fan ${group} of run ${id} not found`);
-    const { etag, notModified, ...body } = page;
+    if (!page2) throw new NotFoundException(`fan ${group} of run ${id} not found`);
+    const { etag, notModified, ...body } = page2;
     if (etag) {
       if (notModified) throw new NotModifiedException(etag);
       setEtag(response, etag);
@@ -1568,7 +1652,7 @@ var DurableApiControllerBase = class {
   * exactly the set the operator was looking at rather than a wider one.
   */
   bulk(action, draft, compensate) {
-    const { limit, offset, ...filter } = draft.query;
+    const { limit: limit2, offset, ...filter } = draft.query;
     return this.dashboard.bulk(action === "cancel" ? "cancel" : "retry", filter, {
       compensate: compensate === "true"
     });
@@ -1598,7 +1682,7 @@ var DurableApiControllerBase = class {
       return notSupportedByServer(error);
     }
     if (!result) {
-      throw new NotImplementedException("republishing lifecycle events needs the control plane");
+      throw new NotImplementedException2("republishing lifecycle events needs the control plane");
     }
     return result;
   }
@@ -1615,9 +1699,9 @@ var DurableApiControllerBase = class {
   }
   /**
   * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-  * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-  * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-  * verification in your own middleware.
+  * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+  * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+  * and/or front it with signature verification in your own middleware.
   */
   async webhook(token, body) {
     const result = await this.dashboard.deliverWebhook(token, body);
@@ -1855,6 +1939,7 @@ _ts_decorate6([
   _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "redispatch", null);
 _ts_decorate6([
+  ConsolePublic(),
   Post("webhooks/:token"),
   _ts_param3(0, Param("token")),
   _ts_param3(1, Body()),
@@ -1908,7 +1993,7 @@ function notFound(error) {
 __name(notFound, "notFound");
 function notSupportedByServer(error) {
   if (error?.code === "unsupported-request") {
-    throw new NotImplementedException(error instanceof Error ? error.message : String(error));
+    throw new NotImplementedException2(error instanceof Error ? error.message : String(error));
   }
   throw error;
 }
@@ -1926,7 +2011,194 @@ DurableApiController = _ts_decorate6([
 import "reflect-metadata";
 import { ApplyFilterInterceptor as ApplyFilterInterceptor2, FilterRunner as FilterRunner2 } from "@dudousxd/nestjs-filter";
 import { Module } from "@nestjs/common";
-import { ModuleRef, RouterModule } from "@nestjs/core";
+import { ModuleRef as ModuleRef2, RouterModule } from "@nestjs/core";
+
+// src/server/console-switcher.ts
+import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject3, Injectable as Injectable5, Logger as Logger2, createParamDecorator } from "@nestjs/common";
+
+// src/server/tokens.ts
+import { RunGateway as RunGateway3 } from "@dudousxd/nestjs-durable-core";
+var DASHBOARD_DEV_TOOLS = Symbol("DASHBOARD_DEV_TOOLS");
+var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
+var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
+
+// src/server/console-switcher.ts
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var AVIARY_CONSOLES_SLOT = Symbol.for("@dudousxd/aviary:consoles");
+var ID = /^[a-z][a-z0-9-]*$/;
+var ICONS = /* @__PURE__ */ new Set([
+  "workflow",
+  "telescope",
+  "media",
+  "payments",
+  "agent",
+  "identity",
+  "generic"
+]);
+var CONSOLE_PROBE_TIMEOUT_MS = 300;
+function isSameOriginPath(path) {
+  return typeof path === "string" && path.startsWith("/") && !path.startsWith("//");
+}
+__name(isSameOriginPath, "isSameOriginPath");
+function readAviaryConsoles() {
+  const value = globalThis[AVIARY_CONSOLES_SLOT];
+  if (value?.version !== 1 || !Array.isArray(value.entries)) return void 0;
+  return value;
+}
+__name(readAviaryConsoles, "readAviaryConsoles");
+function registerAviaryConsole(entry, logger3) {
+  if (!ID.test(entry.id)) throw new Error(`console id ${JSON.stringify(entry.id)} is invalid`);
+  if (!isSameOriginPath(entry.path)) {
+    throw new Error(`console path ${JSON.stringify(entry.path)} must start with a single "/"`);
+  }
+  const holder = globalThis;
+  if (holder[AVIARY_CONSOLES_SLOT] === void 0) {
+    const fresh = {
+      version: 1,
+      entries: []
+    };
+    holder[AVIARY_CONSOLES_SLOT] = fresh;
+  }
+  const registry = readAviaryConsoles();
+  if (registry === void 0) return void 0;
+  if (registry.entries.some((existing) => existing.id === entry.id)) {
+    logger3?.warn(`console id "${entry.id}" is already registered`);
+    return void 0;
+  }
+  registry.entries.push(entry);
+  return () => {
+    const index = registry.entries.indexOf(entry);
+    if (index !== -1) registry.entries.splice(index, 1);
+  };
+}
+__name(registerAviaryConsole, "registerAviaryConsole");
+function consoleSwitcherConfig(selfId, endpoint) {
+  const registry = readAviaryConsoles();
+  if (!registry?.entries.some((entry) => entry.id === selfId)) return void 0;
+  const others = registry.entries.filter((entry) => entry.id !== selfId).length;
+  return others > 0 ? {
+    endpoint,
+    others
+  } : void 0;
+}
+__name(consoleSwitcherConfig, "consoleSwitcherConfig");
+async function allows(entry, context, ms) {
+  let timer;
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2(false), ms);
+  });
+  try {
+    return await Promise.race([
+      Promise.resolve().then(() => entry.authorize(context)).then((decision) => decision?.allowed === true, () => false),
+      timeout
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+__name(allows, "allows");
+async function listVisibleConsoles(registry, selfId, context, timeoutMs = CONSOLE_PROBE_TIMEOUT_MS) {
+  const others = (registry?.entries ?? []).filter((entry) => entry.id !== selfId && isSameOriginPath(entry.path)).sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
+  const verdicts = await Promise.all(others.map((entry) => allows(entry, context, timeoutMs)));
+  return {
+    version: 1,
+    current: selfId,
+    consoles: others.filter((_, index) => verdicts[index]).map((entry) => ({
+      id: entry.id,
+      title: entry.title,
+      icon: ICONS.has(entry.icon) ? entry.icon : "generic",
+      href: entry.path
+    }))
+  };
+}
+__name(listVisibleConsoles, "listVisibleConsoles");
+var DURABLE_CONSOLE_ID = "durable";
+var logger = new Logger2("DurableDashboardModule");
+var DurableConsoleRegistration = class {
+  static {
+    __name(this, "DurableConsoleRegistration");
+  }
+  basePath;
+  decide;
+  #unregister;
+  constructor(basePath, decide) {
+    this.basePath = basePath;
+    this.decide = decide;
+  }
+  onModuleInit() {
+    this.#unregister = registerAviaryConsole({
+      id: DURABLE_CONSOLE_ID,
+      title: "Workflows",
+      icon: "workflow",
+      order: 10,
+      path: this.basePath,
+      authorize: /* @__PURE__ */ __name((context) => this.decide(context), "authorize")
+    }, logger);
+  }
+  onModuleDestroy() {
+    this.#unregister?.();
+    this.#unregister = void 0;
+  }
+};
+DurableConsoleRegistration = _ts_decorate7([
+  Injectable5(),
+  _ts_param4(0, Inject3(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, Inject3(CONSOLE_AUTHORIZE_DECIDE)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    String,
+    typeof ConsoleDecide === "undefined" ? Object : ConsoleDecide
+  ])
+], DurableConsoleRegistration);
+var CurrentExecutionContext = createParamDecorator((_data, context) => ({
+  context
+}));
+var DurableConsolesController = class {
+  static {
+    __name(this, "DurableConsolesController");
+  }
+  consoles(current) {
+    return listVisibleConsoles(readAviaryConsoles(), DURABLE_CONSOLE_ID, current.context);
+  }
+};
+_ts_decorate7([
+  Get2("consoles"),
+  Header2("Cache-Control", "private, no-store"),
+  _ts_param4(0, CurrentExecutionContext()),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof CurrentContext === "undefined" ? Object : CurrentContext
+  ]),
+  _ts_metadata6("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], DurableConsolesController.prototype, "consoles", null);
+DurableConsolesController = _ts_decorate7([
+  Controller2()
+], DurableConsolesController);
 
 // src/server/controller-decorators.ts
 import "reflect-metadata";
@@ -1954,12 +2226,785 @@ function controllerFor(base, decorators) {
 }
 __name(controllerFor, "controllerFor");
 
+// src/server/dev-tools.ts
+import { HttpException as HttpException3, Inject as Inject4, Injectable as Injectable6, Logger as Logger3, NotFoundException as NotFoundException2 } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var DEV_TOOLS_SLOT = Symbol.for("@dudousxd/aviary:dev-tools");
+function devToolsSlot() {
+  const holder = globalThis;
+  const existing = holder[DEV_TOOLS_SLOT];
+  if (existing !== void 0) return existing;
+  const libs = [];
+  const slot = {
+    version: 1,
+    libs,
+    register(lib) {
+      if (libs.some((entry) => entry.lib === lib.lib)) {
+        throw new Error(`dev tools: the lib "${lib.lib}" is already registered`);
+      }
+      libs.push(lib);
+      return () => {
+        const index = libs.indexOf(lib);
+        if (index !== -1) libs.splice(index, 1);
+      };
+    }
+  };
+  holder[DEV_TOOLS_SLOT] = slot;
+  return slot;
+}
+__name(devToolsSlot, "devToolsSlot");
+var DEFAULT_LIMIT = 20;
+var MAX_LIMIT = 100;
+var MAX_RUN_IDS = 100;
+var ERROR_SUMMARY_CHARS = 300;
+var RUN_STATUSES = [
+  "pending",
+  "running",
+  "suspended",
+  "completed",
+  "failed",
+  "cancelling",
+  "cancelled",
+  "dead",
+  "blocked"
+];
+var COUNT_FIELDS = [
+  "status",
+  "workflow",
+  "origin",
+  "namespace",
+  "tag",
+  "attributeKey",
+  "attributeValue"
+];
+var limit = {
+  type: "integer",
+  description: `Rows per page (default ${DEFAULT_LIMIT}, max ${MAX_LIMIT}).`,
+  minimum: 1,
+  maximum: MAX_LIMIT
+};
+var cursor = {
+  type: "string",
+  description: "Pass the `next` of the previous page."
+};
+var runId = {
+  type: "string",
+  description: "Run id."
+};
+var runIds = {
+  type: "array",
+  items: {
+    type: "string"
+  },
+  description: `Several run ids (1 to ${MAX_RUN_IDS}), instead of \`id\`.`
+};
+var scheduleKey = {
+  type: "string",
+  description: "Schedule id."
+};
+var runFilters = {
+  workflow: {
+    type: "string",
+    description: "Workflow name."
+  },
+  tag: {
+    type: "string",
+    description: "A tag the run carries."
+  },
+  namespace: {
+    type: "string",
+    description: "Worker pool (namespace)."
+  },
+  attr: {
+    type: "array",
+    items: {
+      type: "string"
+    },
+    description: "Search-attribute predicates `key:op:value` (ops: eq, ne, gt, gte, lt, lte, in with `|`), ANDed."
+  }
+};
+var str = /* @__PURE__ */ __name((value) => typeof value === "string" && value !== "" ? value : void 0, "str");
+function limitOf(input) {
+  const value = input.limit;
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? Math.min(value, MAX_LIMIT) : DEFAULT_LIMIT;
+}
+__name(limitOf, "limitOf");
+function offsetOf(input) {
+  const value = str(input.cursor);
+  if (value === void 0) return 0;
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`"cursor" must be the \`next\` of a previous page, got "${value}"`);
+  }
+  return Number(value);
+}
+__name(offsetOf, "offsetOf");
+function required(input, key) {
+  const value = str(input[key]);
+  if (value === void 0) throw new Error(`"${key}" is required`);
+  return value;
+}
+__name(required, "required");
+function page(rows, offset, size) {
+  return {
+    items: rows.slice(0, size),
+    next: rows.length > size ? String(offset + size) : null
+  };
+}
+__name(page, "page");
+function runPredicates(input) {
+  const query = {};
+  const workflow = str(input.workflow);
+  if (workflow !== void 0) query.workflow = workflow;
+  const tag = str(input.tag);
+  if (tag !== void 0) query.tag = tag;
+  const namespace = str(input.namespace);
+  if (namespace !== void 0) query.namespace = namespace;
+  const attr = Array.isArray(input.attr) ? input.attr.filter((entry) => typeof entry === "string" && entry !== "") : [];
+  if (attr.length > 0) {
+    const attributes = parseAttrFilters(attr);
+    if (attributes === void 0 || attributes.length !== attr.length) {
+      throw new Error(`"attr" entries must read \`key:op:value\`, got ${JSON.stringify(attr)}`);
+    }
+    query.attributes = attributes;
+  }
+  return query;
+}
+__name(runPredicates, "runPredicates");
+function statusOf(input) {
+  const status = str(input.status);
+  if (status === void 0) return void 0;
+  if (!RUN_STATUSES.includes(status)) {
+    throw new Error(`"status" must be one of ${RUN_STATUSES.join(", ")}, got "${status}"`);
+  }
+  return status;
+}
+__name(statusOf, "statusOf");
+function listRow(run) {
+  const row = {
+    ...toRunListRow(run)
+  };
+  const message = run.error?.message;
+  if (typeof message === "string" && message !== "") {
+    const line = message.split("\n", 1)[0] ?? "";
+    row.error = line.length > ERROR_SUMMARY_CHARS ? `${line.slice(0, ERROR_SUMMARY_CHARS)}\u2026` : line;
+  }
+  return row;
+}
+__name(listRow, "listRow");
+async function call(what, run) {
+  try {
+    return await run();
+  } catch (error) {
+    if (error instanceof NotFoundException2 || error instanceof Error && error.name === "ScheduleNotFoundError") {
+      throw new Error(`${what()} not found`);
+    }
+    if (error instanceof HttpException3) throw new Error(error.message);
+    throw error;
+  }
+}
+__name(call, "call");
+function found(value, what) {
+  if (value === null || value === void 0) throw new Error(`${what} not found`);
+  return value;
+}
+__name(found, "found");
+function idsOf(input) {
+  const one = str(input.id);
+  const many = Array.isArray(input.ids) ? input.ids.filter((id) => typeof id === "string" && id !== "") : void 0;
+  if (one !== void 0 && many !== void 0) throw new Error('pass "id" or "ids", not both');
+  if (one !== void 0) return {
+    ids: [
+      one
+    ],
+    many: false
+  };
+  if (many === void 0 || many.length === 0) throw new Error('"id" or "ids" is required');
+  if (many.length > MAX_RUN_IDS) {
+    throw new Error(`"ids" lists ${many.length} runs; at most ${MAX_RUN_IDS} per call`);
+  }
+  return {
+    ids: many,
+    many: true
+  };
+}
+__name(idsOf, "idsOf");
+async function each(input, act) {
+  const { ids, many } = idsOf(input);
+  if (!many) return act(ids[0]);
+  const applied = [];
+  for (const [index, id] of ids.entries()) {
+    try {
+      applied.push(await act(id));
+    } catch (error) {
+      return {
+        applied,
+        failed: {
+          id,
+          error: error instanceof Error ? error.message : String(error)
+        },
+        skipped: ids.slice(index + 1)
+      };
+    }
+  }
+  return {
+    applied
+  };
+}
+__name(each, "each");
+function starvedGroups(groups) {
+  return groups.filter((group) => group.depth > 0 && group.liveWorkers.length === 0).sort((a, b) => b.depth - a.depth).map(({ group, depth, kind }) => ({
+    group,
+    depth,
+    ...kind ? {
+      kind
+    } : {}
+  }));
+}
+__name(starvedGroups, "starvedGroups");
+function durableDevTools(service) {
+  const controlPlane = /* @__PURE__ */ __name(() => service.capabilities().controlPlane, "controlPlane");
+  const schedules = /* @__PURE__ */ __name(() => service.capabilities().schedules, "schedules");
+  return [
+    {
+      name: "durable_list_runs",
+      kind: "read",
+      description: "Workflow runs, newest first: id, workflow, status, what a suspended run waits on, times, tags and a one-line error summary (no input or output). Filters: status, workflow, tag, namespace, origin, attr. Returns { items, next }; pass next as cursor.",
+      input: {
+        type: "object",
+        properties: {
+          status: {
+            type: "string",
+            enum: RUN_STATUSES,
+            description: "Run status."
+          },
+          ...runFilters,
+          origin: {
+            type: "string",
+            description: "The package the run came from."
+          },
+          cursor,
+          limit
+        }
+      },
+      async run(input) {
+        const size = limitOf(input);
+        const offset = offsetOf(input);
+        const status = statusOf(input);
+        const origin = str(input.origin);
+        const query = {
+          ...runPredicates(input),
+          ...status !== void 0 ? {
+            status
+          } : {},
+          ...origin !== void 0 ? {
+            origin
+          } : {},
+          offset,
+          limit: size + 1
+        };
+        const runs = await call(() => "runs", () => service.listRuns(query));
+        return page(runs.map(listRow), offset, size);
+      }
+    },
+    {
+      name: "durable_get_run",
+      kind: "read",
+      description: 'One run: its input, output, error, step timeline, children, fans (summarized over 50 members unless full) and lifecycle links. `field` returns that one field only (e.g. "steps"). An error when no run has that id.',
+      input: {
+        type: "object",
+        properties: {
+          id: runId,
+          full: {
+            type: "boolean",
+            description: "Every fan member inline (default false)."
+          },
+          field: {
+            type: "string",
+            description: "Return only this top-level field."
+          }
+        },
+        required: [
+          "id"
+        ]
+      },
+      async run(input) {
+        const id = required(input, "id");
+        const detail = found(await call(() => `run ${id}`, () => service.getRunDetail(id, input.full === true ? void 0 : {
+          summarizeFansOver: 50
+        })), `run ${id}`);
+        const { etag: _etag, notModified: _notModified, ...body } = detail;
+        const field = str(input.field);
+        if (field === void 0) return body;
+        if (!Object.hasOwn(body, field)) {
+          throw new Error(`run ${id} has no field "${field}"; fields: ${Object.keys(body).join(", ")}`);
+        }
+        return {
+          id,
+          [field]: body[field]
+        };
+      }
+    },
+    {
+      name: "durable_list_fan_members",
+      kind: "read",
+      description: "One fan's members (the steps or children of a fan-out group), in order. Filters: failed (only failed members). Returns { items, total, next }; pass next as cursor. An error when the run or the fan does not exist.",
+      input: {
+        type: "object",
+        properties: {
+          id: runId,
+          group: {
+            type: "string",
+            description: "The fan group, as the run detail names it."
+          },
+          failed: {
+            type: "boolean",
+            description: "Only failed members."
+          },
+          cursor,
+          limit
+        },
+        required: [
+          "id",
+          "group"
+        ]
+      },
+      async run(input) {
+        const id = required(input, "id");
+        const group = required(input, "group");
+        const size = limitOf(input);
+        const offset = offsetOf(input);
+        const fan = found(await call(() => `fan ${group} of run ${id}`, () => service.getFanMembers(id, group, {
+          offset,
+          limit: size,
+          failedOnly: input.failed === true
+        })), `fan ${group} of run ${id}`);
+        const end = offset + fan.items.length;
+        return {
+          items: fan.items,
+          total: fan.total,
+          next: fan.items.length > 0 && end < fan.total ? String(end) : null
+        };
+      }
+    },
+    {
+      name: "durable_count_runs_by",
+      kind: "read",
+      description: "How many runs have each value of one field (status, workflow, origin, namespace, tag, attributeKey, or attributeValue with key), most frequent first. Filters: workflow, tag, namespace, attr. Returns { items: [{ value, count }], next }; pass next as cursor. Empty when the store cannot count that field.",
+      input: {
+        type: "object",
+        properties: {
+          field: {
+            type: "string",
+            enum: COUNT_FIELDS,
+            description: "The field to count by."
+          },
+          key: {
+            type: "string",
+            description: "The search attribute, for attributeValue."
+          },
+          ...runFilters,
+          cursor,
+          limit
+        },
+        required: [
+          "field"
+        ]
+      },
+      async run(input) {
+        const field = required(input, "field");
+        if (!COUNT_FIELDS.includes(field)) {
+          throw new Error(`"field" must be one of ${COUNT_FIELDS.join(", ")}, got "${field}"`);
+        }
+        const size = limitOf(input);
+        const offset = offsetOf(input);
+        const predicates = runPredicates(input);
+        if (field === "status" || field === "origin") {
+          const rows2 = await call(() => "runs", () => service.runFacets(predicates));
+          const counts = /* @__PURE__ */ new Map();
+          for (const row of rows2) {
+            const value = field === "status" ? row.status : row.origin;
+            counts.set(value, (counts.get(value) ?? 0) + row.count);
+          }
+          const items = [
+            ...counts
+          ].map(([value, count]) => ({
+            value,
+            count
+          })).sort((a, b) => b.count - a.count || String(a.value).localeCompare(String(b.value)));
+          return page(items.slice(offset), offset, size);
+        }
+        const axis = field === "attributeValue" ? {
+          field,
+          key: required(input, "key")
+        } : {
+          field
+        };
+        const rows = await call(() => "runs", () => service.runValueFacets(axis, predicates, {
+          offset,
+          limit: size + 1
+        }));
+        return page(rows, offset, size);
+      }
+    },
+    {
+      name: "durable_get_health",
+      kind: "read",
+      description: "The fleet at a glance: run counts by status (pending backlog, dead, blocked: a run no compatible worker can take), queues with backlog and no live worker (starved), live worker count, and this deployment's role (control plane or tenant).",
+      input: {
+        type: "object",
+        properties: {}
+      },
+      async run() {
+        const [facets, groups] = await Promise.all([
+          call(() => "runs", () => service.runFacets({})),
+          call(() => "workers", () => service.workerHealth())
+        ]);
+        const runs = {};
+        for (const row of facets) runs[row.status] = (runs[row.status] ?? 0) + row.count;
+        const workers = /* @__PURE__ */ new Set();
+        for (const group of groups) {
+          for (const worker of group.liveWorkers) workers.add(worker.instanceId);
+        }
+        const starved = starvedGroups(groups);
+        return {
+          topology: service.topology(),
+          runs,
+          backlog: runs.pending ?? 0,
+          dead: runs.dead ?? 0,
+          blocked: runs.blocked ?? 0,
+          queues: groups.length,
+          liveWorkers: workers.size,
+          starved,
+          healthy: starved.length === 0 && (runs.blocked ?? 0) === 0
+        };
+      }
+    },
+    {
+      name: "durable_list_workers",
+      kind: "read",
+      description: "Worker groups (queues): group, kind (workflow or step), queue depth and the live workers with their heartbeats. A group with depth > 0 and no live worker is starved. Returns { items, next: null }.",
+      input: {
+        type: "object",
+        properties: {}
+      },
+      async run() {
+        const groups = await call(() => "workers", () => service.workerHealth());
+        return {
+          items: groups,
+          next: null
+        };
+      }
+    },
+    {
+      name: "durable_list_schedules",
+      kind: "read",
+      description: "Persisted schedules, soonest due first: id, workflow, cadence (cron, every or rrule), paused, nextFireAt, lastFireAt, lastRunId, fires, lastError. Filters: workflow, tag, namespace, paused. Returns { items, next }; pass next as cursor.",
+      input: {
+        type: "object",
+        properties: {
+          workflow: {
+            type: "string",
+            description: "Workflow name."
+          },
+          tag: {
+            type: "string",
+            description: "A tag the schedule carries."
+          },
+          namespace: {
+            type: "string",
+            description: "Worker pool (namespace)."
+          },
+          paused: {
+            type: "boolean",
+            description: "Only paused (true) or active (false)."
+          },
+          cursor,
+          limit
+        }
+      },
+      available: schedules,
+      async run(input) {
+        const size = limitOf(input);
+        const offset = offsetOf(input);
+        const workflow = str(input.workflow);
+        const tag = str(input.tag);
+        const namespace = str(input.namespace);
+        const rows = await call(() => "schedules", () => service.listSchedules({
+          ...workflow !== void 0 ? {
+            workflow
+          } : {},
+          ...tag !== void 0 ? {
+            tag
+          } : {},
+          ...namespace !== void 0 ? {
+            namespace
+          } : {},
+          ...typeof input.paused === "boolean" ? {
+            paused: input.paused
+          } : {},
+          offset,
+          limit: size + 1
+        }));
+        return page(rows, offset, size);
+      }
+    },
+    {
+      name: "durable_get_run_event",
+      kind: "read",
+      description: "The latest value a run published for `key` with ctx.setEvent (a live query, no side effect). Returns { id, key, value }; value is null when the run never published that key. An error when no run has that id.",
+      input: {
+        type: "object",
+        properties: {
+          id: runId,
+          key: {
+            type: "string",
+            description: "Event key."
+          }
+        },
+        required: [
+          "id",
+          "key"
+        ]
+      },
+      available: controlPlane,
+      async run(input) {
+        const id = required(input, "id");
+        const key = required(input, "key");
+        if (!await call(() => `run ${id}`, () => service.runExists(id))) {
+          throw new Error(`run ${id} not found`);
+        }
+        const value = await call(() => `run ${id}`, () => service.getEvent(id, key));
+        return {
+          id,
+          key,
+          value: value ?? null
+        };
+      }
+    },
+    {
+      name: "durable_retry_run",
+      kind: "action",
+      description: `Re-runs a failed, dead or cancelled run; completed steps replay from their checkpoints. Returns { runId, status }. With ids (at most ${MAX_RUN_IDS}), runs them in order and stops at the first that fails: { applied, failed: { id, error }, skipped }. An error when no run has that id.`,
+      input: {
+        type: "object",
+        properties: {
+          id: runId,
+          ids: runIds
+        }
+      },
+      async run(input) {
+        return each(input, async (id) => found(await call(() => `run ${id}`, () => service.retry(id)), `run ${id}`));
+      }
+    },
+    {
+      name: "durable_cancel_run",
+      kind: "action",
+      destructive: true,
+      description: `Cancels a run that has not finished (with compensate: true, its completed steps' compensations run first). Returns { runId, status }. With ids (at most ${MAX_RUN_IDS}), cancels them in order and stops at the first that fails: { applied, failed: { id, error }, skipped }. An error when no run has that id.`,
+      input: {
+        type: "object",
+        properties: {
+          id: runId,
+          ids: runIds,
+          compensate: {
+            type: "boolean",
+            description: "Run compensations (default false)."
+          }
+        }
+      },
+      async run(input) {
+        const compensate = input.compensate === true;
+        return each(input, async (id) => found(await call(() => `run ${id}`, () => service.cancel(id, {
+          compensate
+        })), `run ${id}`));
+      }
+    },
+    {
+      name: "durable_continue_run",
+      kind: "action",
+      description: "Resumes a run paused at a ctx.breakpoint. Returns { runId, status }. An error when no run has that id, or when it is not paused at a breakpoint.",
+      input: {
+        type: "object",
+        properties: {
+          id: runId
+        },
+        required: [
+          "id"
+        ]
+      },
+      async run(input) {
+        const id = required(input, "id");
+        const what = /* @__PURE__ */ __name(() => `run ${id}`, "what");
+        const result = await call(what, () => service.continue(id));
+        if (result) return result;
+        if (!await call(what, () => service.runExists(id))) throw new Error(`run ${id} not found`);
+        throw new Error(`run ${id} is not paused at a breakpoint`);
+      }
+    },
+    {
+      name: "durable_signal_run",
+      kind: "action",
+      description: "Sends a signal: delivers payload (JSON text; omitted is null) to the run waiting on token (ctx.waitForSignal or a ctx.webhook token). Returns { delivered: true, runId, status }, or { delivered: false } when no run you can see waits on the token yet: the engine then buffers the payload for the next run that waits on it.",
+      input: {
+        type: "object",
+        properties: {
+          token: {
+            type: "string",
+            description: "The signal token the run waits on."
+          },
+          payload: {
+            type: "string",
+            description: "The payload, as JSON text."
+          }
+        },
+        required: [
+          "token"
+        ]
+      },
+      available: controlPlane,
+      async run(input) {
+        const token = required(input, "token");
+        let payload = null;
+        if (typeof input.payload === "string" && input.payload.trim() !== "") {
+          try {
+            payload = JSON.parse(input.payload);
+          } catch {
+            throw new Error('"payload" must be JSON text (quote a plain string: "\\"ok\\"")');
+          }
+        }
+        const result = await call(() => `token ${token}`, () => service.signal(token, payload));
+        return result ? {
+          delivered: true,
+          runId: result.runId,
+          status: result.status
+        } : {
+          delivered: false
+        };
+      }
+    },
+    {
+      name: "durable_trigger_schedule",
+      kind: "action",
+      description: "Starts one run of a schedule now, outside its cadence (it does not count as a fire). Returns { runId, status }. An error when no schedule has that id.",
+      input: {
+        type: "object",
+        properties: {
+          key: scheduleKey
+        },
+        required: [
+          "key"
+        ]
+      },
+      available: schedules,
+      async run(input) {
+        const key = required(input, "key");
+        return call(() => `schedule ${key}`, () => service.triggerSchedule(key));
+      }
+    },
+    {
+      name: "durable_pause_schedule",
+      kind: "action",
+      description: "Pauses a schedule (paused: true, the default) or resumes it from its next window (paused: false). Returns the schedule. An error when no schedule has that id.",
+      input: {
+        type: "object",
+        properties: {
+          key: scheduleKey,
+          paused: {
+            type: "boolean",
+            description: "false resumes it (default true)."
+          }
+        },
+        required: [
+          "key"
+        ]
+      },
+      available: schedules,
+      async run(input) {
+        const key = required(input, "key");
+        return call(() => `schedule ${key}`, () => input.paused === false ? service.resumeSchedule(key) : service.pauseSchedule(key));
+      }
+    }
+  ];
+}
+__name(durableDevTools, "durableDevTools");
+var logger2 = new Logger3("DurableDashboardModule");
+var DurableDevToolsRegistration = class {
+  static {
+    __name(this, "DurableDevToolsRegistration");
+  }
+  enabled;
+  service;
+  decide;
+  #unregister;
+  constructor(enabled, service, decide) {
+    this.enabled = enabled;
+    this.service = service;
+    this.decide = decide;
+  }
+  onModuleInit() {
+    if (!this.enabled) return;
+    const slot = devToolsSlot();
+    if (slot.version !== 1 || typeof slot.register !== "function") return;
+    try {
+      this.#unregister = slot.register({
+        lib: "durable",
+        title: "Durable workflows",
+        authorize: /* @__PURE__ */ __name((context) => this.decide(context), "authorize"),
+        tools: durableDevTools(this.service)
+      });
+    } catch (error) {
+      logger2.warn(`durable dev tools not registered: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  onModuleDestroy() {
+    this.#unregister?.();
+    this.#unregister = void 0;
+  }
+};
+DurableDevToolsRegistration = _ts_decorate8([
+  Injectable6(),
+  _ts_param5(0, Inject4(DASHBOARD_DEV_TOOLS)),
+  _ts_param5(1, Inject4(DashboardService)),
+  _ts_param5(2, Inject4(CONSOLE_AUTHORIZE_DECIDE)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    Boolean,
+    typeof DashboardService === "undefined" ? Object : DashboardService,
+    typeof ConsoleDecide === "undefined" ? Object : ConsoleDecide
+  ])
+], DurableDevToolsRegistration);
+
 // src/server/durable-ui.controller.ts
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header as Header2, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, StreamableFile } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
+import { Controller as Controller3, Get as Get3, Header as Header3, Inject as Inject5, NotFoundException as NotFoundException3, Param as Param2, StreamableFile } from "@nestjs/common";
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1972,21 +3017,20 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata8(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
-var DASHBOARD_BASE_PATH = Symbol("DASHBOARD_BASE_PATH");
-var DASHBOARD_API_PATH = Symbol("DASHBOARD_API_PATH");
+__name(_ts_param6, "_ts_param");
+var DURABLE_DASHBOARD_CONFIG_ID = "durable-dashboard-config";
 var BUILD_BASE = "/durable";
 function spaDir() {
   return fileURLToPath(new URL("../spa", import.meta.url));
@@ -2017,19 +3061,33 @@ var DurableUiControllerBase = class {
   index() {
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
-      throw new NotFoundException2("Dashboard is not built. Run the package build.");
+      throw new NotFoundException3("Dashboard is not built. Run the package build.");
     }
     const html = readFileSync(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
-    const inject = `<script>window.__DURABLE_BASE__='${this.basePath}';window.__DURABLE_API__='${this.apiBasePath}';</script>`;
+    const inject = `<script>window.__DURABLE_BASE__='${this.basePath}';window.__DURABLE_API__='${this.apiBasePath}';</script>${this.configBlock()}`;
     return html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html;
   }
+  /**
+  * The page's JSON config block (`durable-dashboard-config`, CSP-safe: data, not script). It
+  * carries `switcher` only when another Aviary console is registered.
+  */
+  configBlock() {
+    const switcher = consoleSwitcherConfig(DURABLE_CONSOLE_ID, `${this.apiBasePath}/consoles`);
+    const json = JSON.stringify({
+      apiBase: this.apiBasePath,
+      ...switcher !== void 0 ? {
+        switcher
+      } : {}
+    }).replaceAll("<", "\\u003c");
+    return `<script type="application/json" id="${DURABLE_DASHBOARD_CONFIG_ID}">${json}</script>`;
+  }
   asset(file) {
     const safe = basename(file);
-    if (safe !== file) throw new NotFoundException2();
+    if (safe !== file) throw new NotFoundException3();
     const root = resolve(this.dir, "assets");
     const assetPath = resolve(root, safe);
     if (!assetPath.startsWith(root + sep) || !existsSync(assetPath)) {
-      throw new NotFoundException2();
+      throw new NotFoundException3();
     }
     const type = CONTENT_TYPES[extname(safe)] ?? "application/octet-stream";
     return new StreamableFile(readFileSync(assetPath), {
@@ -2037,31 +3095,31 @@ var DurableUiControllerBase = class {
     });
   }
 };
-_ts_decorate7([
-  Get2(),
-  Header2("Content-Type", "text/html; charset=utf-8"),
-  Header2("Cache-Control", "no-store, must-revalidate"),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", String)
+_ts_decorate9([
+  Get3(),
+  Header3("Content-Type", "text/html; charset=utf-8"),
+  Header3("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", []),
+  _ts_metadata8("design:returntype", String)
 ], DurableUiControllerBase.prototype, "index", null);
-_ts_decorate7([
-  Get2("assets/:file"),
-  Header2("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param4(0, Param2("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+_ts_decorate9([
+  Get3("assets/:file"),
+  Header3("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param6(0, Param2("file")),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata8("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], DurableUiControllerBase.prototype, "asset", null);
-DurableUiControllerBase = _ts_decorate7([
-  Controller2(),
+DurableUiControllerBase = _ts_decorate9([
+  Controller3(),
   ConsolePage(),
-  _ts_param4(0, Inject3(DASHBOARD_BASE_PATH)),
-  _ts_param4(1, Inject3(DASHBOARD_API_PATH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_param6(0, Inject5(DASHBOARD_BASE_PATH)),
+  _ts_param6(1, Inject5(DASHBOARD_API_PATH)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
     String,
     String
   ])
@@ -2071,12 +3129,12 @@ var DurableUiController = class extends DurableUiControllerBase {
     __name(this, "DurableUiController");
   }
 };
-DurableUiController = _ts_decorate7([
-  Controller2()
+DurableUiController = _ts_decorate9([
+  Controller3()
 ], DurableUiController);
 
 // src/server/durable-dashboard.module.ts
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2089,9 +3147,10 @@ function _ts_decorate8(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
+__name(_ts_decorate10, "_ts_decorate");
 markOpenToAuthorization(DurableApiController);
 markOpenToAuthorization(DurableUiController);
+markOpenToAuthorization(DurableConsolesController);
 function assertNothingToDecorate(options) {
   if (options.decorators === void 0) return;
   throw new Error([
@@ -2125,10 +3184,16 @@ var DurableApiModule = class _DurableApiModule {
         ...options.imports ?? []
       ],
       controllers: routes ? [
-        consoleController(DurableApiController, options.decorators)
+        consoleController(DurableApiController, options.decorators),
+        consoleController(DurableConsolesController, options.decorators)
       ] : [],
       providers: [
         DashboardService,
+        {
+          provide: DASHBOARD_DEV_TOOLS,
+          useValue: options.devTools ?? routes
+        },
+        DurableDevToolsRegistration,
         // Resolved at boot: a gate name without nestjs-authz, or a policy without
         // @nestjs/authorization, fails here rather than on the first request.
         {
@@ -2136,7 +3201,7 @@ var DurableApiModule = class _DurableApiModule {
           // Also with `routes: false`: `@UseConsoleAuthorize()` still applies the production 403.
           useFactory: /* @__PURE__ */ __name((moduleRef) => resolveConsoleAuthorize(options.authorize, moduleRef), "useFactory"),
           inject: [
-            ModuleRef
+            ModuleRef2
           ]
         },
         // `@dudousxd/nestjs-filter` is wired PRIVATELY here rather than through
@@ -2160,7 +3225,7 @@ var DurableApiModule = class _DurableApiModule {
             validation: "off"
           }, null), "useFactory"),
           inject: [
-            ModuleRef
+            ModuleRef2
           ]
         },
         ApplyFilterInterceptor2,
@@ -2186,7 +3251,7 @@ var DurableApiModule = class _DurableApiModule {
     };
   }
 };
-DurableApiModule = _ts_decorate8([
+DurableApiModule = _ts_decorate10([
   Module({})
 ], DurableApiModule);
 var DurableDashboardModule = class _DurableDashboardModule {
@@ -2215,6 +3280,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
         ...options.authorize !== void 0 ? {
           authorize: options.authorize
         } : {},
+        ...options.devTools !== void 0 ? {
+          devTools: options.devTools
+        } : {},
         routes: false
       });
       return {
@@ -2251,6 +3319,9 @@ var DurableDashboardModule = class _DurableDashboardModule {
           } : {},
           ...options.authorize !== void 0 ? {
             authorize: options.authorize
+          } : {},
+          ...options.devTools !== void 0 ? {
+            devTools: options.devTools
           } : {}
         }),
         RouterModule.register([
@@ -2267,7 +3338,11 @@ var DurableDashboardModule = class _DurableDashboardModule {
       controllers: [
         consoleController(DurableUiController, options.decorators)
       ],
-      providers: pathProviders,
+      // The console switcher lists this console only where it serves its own page.
+      providers: [
+        ...pathProviders,
+        DurableConsoleRegistration
+      ],
       // Re-export the API module so its DashboardService reaches importers (e.g. flip's own controllers).
       exports: [
         DurableApiModule
@@ -2275,30 +3350,45 @@ var DurableDashboardModule = class _DurableDashboardModule {
     };
   }
 };
-DurableDashboardModule = _ts_decorate8([
+DurableDashboardModule = _ts_decorate10([
   Module({})
 ], DurableDashboardModule);
 export {
+  AVIARY_CONSOLES_SLOT,
   CONSOLE_AUTHORIZE_DECIDE,
   CONSOLE_AUTHORIZE_MISSING_WARNING,
   CONSOLE_GATE,
   CONSOLE_PAGE_METADATA,
+  CONSOLE_PROBE_TIMEOUT_MS,
+  CONSOLE_PUBLIC_METADATA,
   ConsoleAccessDenied,
   ConsoleAuthorizeFilter,
   ConsoleAuthorizeGuard,
   ConsolePage,
+  ConsolePublic,
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
+  DEV_TOOLS_SLOT,
+  DURABLE_CONSOLE_ID,
+  DURABLE_DASHBOARD_CONFIG_ID,
   DashboardService,
   DurableApiController,
   DurableApiControllerBase,
   DurableApiModule,
+  DurableConsoleRegistration,
+  DurableConsolesController,
   DurableDashboardModule,
+  DurableDevToolsRegistration,
   DurableUiController,
   DurableUiControllerBase,
+  MAX_RUN_IDS,
   UseConsoleAuthorize,
+  anyAuthorize,
   authorizeByToken,
+  durableDevTools,
+  listVisibleConsoles,
   normalizeConsoleResult,
+  registerAviaryConsole,
   resolveConsoleAuthorize
 };
 //# sourceMappingURL=index.js.map