@dudousxd/nestjs-media-dashboard 0.16.2 → 0.18.0

package/dist/server/index.cjs

@@ -21,338 +21,46 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var index_exports = {};
 __export(index_exports, {
-  MEDIA_STORAGE_SHARED: () => MEDIA_STORAGE_SHARED,
+  CONSOLE_AUTHORIZE_DECIDE: () => CONSOLE_AUTHORIZE_DECIDE,
+  CONSOLE_AUTHORIZE_MISSING_WARNING: () => CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE: () => CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA: () => CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied: () => ConsoleAccessDenied,
+  ConsoleAuthorizeFilter: () => ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard: () => ConsoleAuthorizeGuard,
+  ConsolePage: () => ConsolePage,
+  MEDIA_MULTIPART: () => MEDIA_MULTIPART,
   MEDIA_STORE: () => MEDIA_STORE,
   MEDIA_UPLOAD_SESSIONS: () => MEDIA_UPLOAD_SESSIONS,
+  MediaConsoleActionsController: () => MediaConsoleActionsController,
   MediaConsoleApiModule: () => MediaConsoleApiModule,
+  MediaConsoleReadController: () => MediaConsoleReadController,
   MediaConsoleService: () => MediaConsoleService,
-  MediaDashboardModule: () => MediaDashboardModule
+  MediaDashboardModule: () => MediaDashboardModule,
+  MediaDashboardUiController: () => MediaDashboardUiController,
+  UseConsoleAuthorize: () => UseConsoleAuthorize,
+  authorizeByToken: () => authorizeByToken,
+  normalizeConsoleResult: () => normalizeConsoleResult,
+  resolveConsoleAuthorize: () => resolveConsoleAuthorize
 });
 module.exports = __toCommonJS(index_exports);
 
-// ../../node_modules/.pnpm/tsup@8.5.1_@swc+core@1.16.20_jiti@1.21.7_postcss@8.5.31_typescript@5.9.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js
+// ../../node_modules/.pnpm/tsup@8.5.1_@swc+core@1.16.21_jiti@1.21.7_postcss@8.5.32_typescript@5.9.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js
 var getImportMetaUrl = /* @__PURE__ */ __name(() => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href, "getImportMetaUrl");
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/server/media-dashboard.module.ts
-var import_common8 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
+var import_common7 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
 
-// src/server/auth/config.ts
-var DEFAULT_TTL_MS = 8 * 60 * 60 * 1e3;
-var DURATION_UNITS = {
-  s: 1e3,
-  m: 60 * 1e3,
-  h: 60 * 60 * 1e3,
-  d: 24 * 60 * 60 * 1e3
-};
-function durationToMs(ttl) {
-  if (ttl === void 0) return DEFAULT_TTL_MS;
-  const match = /^(\d+)([smhd])$/.exec(ttl.trim());
-  if (!match) return DEFAULT_TTL_MS;
-  const unit = DURATION_UNITS[match[2] ?? ""];
-  if (unit === void 0) return DEFAULT_TTL_MS;
-  return Number(match[1]) * unit;
-}
-__name(durationToMs, "durationToMs");
-function resolveConsoleAuth(options) {
-  if (!options) return null;
-  if (!options.secret) {
-    throw new Error("MediaDashboardModule: auth.secret is required when `auth` is configured.");
-  }
-  const modes = [];
-  if (options.session) modes.push("session");
-  if (options.login) modes.push("login");
-  if (modes.length === 0) {
-    throw new Error("MediaDashboardModule: auth needs a `login` and/or `session` hook.");
-  }
-  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
-    throw new Error("MediaDashboardModule: auth.unauthenticatedPage must be a function.");
-  }
-  return {
-    secret: options.secret,
-    ttlMs: durationToMs(options.ttl),
-    modes,
-    ...options.session ? {
-      session: options.session
-    } : {},
-    ...options.login ? {
-      login: options.login
-    } : {},
-    ...options.revalidate ? {
-      revalidate: options.revalidate
-    } : {},
-    ...options.unauthenticatedPage ? {
-      unauthenticatedPage: options.unauthenticatedPage
-    } : {}
-  };
-}
-__name(resolveConsoleAuth, "resolveConsoleAuth");
+// src/server/controller-decorators.ts
+var import_reflect_metadata2 = require("reflect-metadata");
 
-// src/server/guards.ts
+// src/server/console-authorize.ts
 var import_reflect_metadata = require("reflect-metadata");
-var GUARDS_METADATA = "__guards__";
-function isGuardClass(guard) {
-  return typeof guard === "function";
-}
-__name(isGuardClass, "isGuardClass");
-function baseGuards(controller) {
-  return Reflect.getOwnMetadata(GUARDS_METADATA, controller) ?? [];
-}
-__name(baseGuards, "baseGuards");
-function stampGuards(guards, entries) {
-  if (guards === void 0 || guards.length === 0) return;
-  for (const [controller, base] of entries) {
-    Reflect.defineMetadata(GUARDS_METADATA, [
-      ...base,
-      ...guards
-    ], controller);
-  }
-}
-__name(stampGuards, "stampGuards");
-
-// src/server/media-console-api.module.ts
-var import_common6 = require("@nestjs/common");
-
-// src/server/media-console-actions.controller.ts
-var import_common3 = require("@nestjs/common");
-
-// src/server/media-console.guard.ts
-var import_common = require("@nestjs/common");
-
-// src/server/auth/cookie-header.ts
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (typeof header !== "string" || header === "") return cookies;
-  for (const segment of header.split(";")) {
-    const eq = segment.indexOf("=");
-    if (eq <= 0) continue;
-    const name = segment.slice(0, eq).trim();
-    if (name === "") continue;
-    let rawValue = segment.slice(eq + 1).trim();
-    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
-      rawValue = rawValue.slice(1, -1);
-    }
-    if (name in cookies) continue;
-    try {
-      cookies[name] = decodeURIComponent(rawValue);
-    } catch {
-      cookies[name] = rawValue;
-    }
-  }
-  return cookies;
-}
-__name(parseCookieHeader, "parseCookieHeader");
-function serializeSetCookie(name, value, options) {
-  const parts = [
-    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
-  ];
-  parts.push(`Path=${options.path}`);
-  parts.push("HttpOnly");
-  parts.push("SameSite=Lax");
-  if (options.secure) parts.push("Secure");
-  if (options.clear) {
-    parts.push("Max-Age=0");
-    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  } else {
-    parts.push(`Max-Age=${options.maxAgeSeconds}`);
-  }
-  return parts.join("; ");
-}
-__name(serializeSetCookie, "serializeSetCookie");
-
-// src/server/auth/request.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord, "isRecord");
-function readHeaders(request) {
-  if (!isRecord(request)) return {};
-  const headers = request.headers;
-  return isRecord(headers) ? headers : {};
-}
-__name(readHeaders, "readHeaders");
-function headerToString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
-    return value.join(",");
-  }
-  return void 0;
-}
-__name(headerToString, "headerToString");
-function readCookieHeader(request) {
-  return headerToString(readHeaders(request).cookie);
-}
-__name(readCookieHeader, "readCookieHeader");
-function isHttpsRequest(request) {
-  if (isRecord(request) && request.protocol === "https") return true;
-  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
-  if (forwarded === void 0) return false;
-  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
-}
-__name(isHttpsRequest, "isHttpsRequest");
-function attachSession(request, session) {
-  if (!isRecord(request)) return;
-  request.consoleSession = session;
-}
-__name(attachSession, "attachSession");
-
-// src/server/auth/response.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord2, "isRecord");
-function isRawNodeResponse(value) {
-  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
-}
-__name(isRawNodeResponse, "isRawNodeResponse");
-function resolveRawResponse(response) {
-  if (isRawNodeResponse(response)) return response;
-  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveRawResponse, "resolveRawResponse");
-function existingSetCookies(response) {
-  const current = response.getHeader("set-cookie");
-  if (Array.isArray(current)) return current;
-  if (typeof current === "string") return [
-    current
-  ];
-  return [];
-}
-__name(existingSetCookies, "existingSetCookies");
-function appendSetCookie(response, cookie) {
-  const raw = resolveRawResponse(response);
-  if (!raw) return;
-  raw.setHeader("set-cookie", [
-    ...existingSetCookies(raw),
-    cookie
-  ]);
-}
-__name(appendSetCookie, "appendSetCookie");
-function resolveEndableResponse(response) {
-  const isEndable = /* @__PURE__ */ __name((value) => isRawNodeResponse(value) && typeof value.end === "function", "isEndable");
-  if (isEndable(response)) return response;
-  if (isRecord2(response) && isEndable(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveEndableResponse, "resolveEndableResponse");
-function responseAlreadyWritten(response) {
-  return resolveEndableResponse(response)?.headersSent === true;
-}
-__name(responseAlreadyWritten, "responseAlreadyWritten");
-function sendHtml(response, status, html) {
-  const raw = resolveEndableResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("content-type", "text/html; charset=utf-8");
-  raw.setHeader("cache-control", "no-store, must-revalidate");
-  raw.end(html);
-}
-__name(sendHtml, "sendHtml");
-
-// src/server/auth/session-cookie.ts
 var import_node_crypto = require("crypto");
-var EXP_GRACE_MS = 3e4;
-function base64urlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-__name(base64urlEncode, "base64urlEncode");
-function base64urlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-__name(base64urlDecode, "base64urlDecode");
-function hmac(secret, payload) {
-  return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("base64url");
-}
-__name(hmac, "hmac");
-function signSessionCookie(user, options) {
-  const issuedAt = options.now ?? Date.now();
-  const session = {
-    sub: user.id,
-    ...user.name !== void 0 ? {
-      name: user.name
-    } : {},
-    roles: user.roles ?? [],
-    iat: issuedAt,
-    exp: issuedAt + options.ttlMs
-  };
-  const encodedPayload = base64urlEncode(JSON.stringify(session));
-  return `${encodedPayload}.${hmac(options.secret, encodedPayload)}`;
-}
-__name(signSessionCookie, "signSessionCookie");
-function isSessionPayload(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = value;
-  if (typeof record.sub !== "string") return false;
-  if (record.name !== void 0 && typeof record.name !== "string") return false;
-  if (!Array.isArray(record.roles)) return false;
-  if (!record.roles.every((role) => typeof role === "string")) return false;
-  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
-  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
-  return true;
-}
-__name(isSessionPayload, "isSessionPayload");
-function verifySessionCookie(value, options) {
-  try {
-    const dot = value.indexOf(".");
-    if (dot <= 0 || dot === value.length - 1) return null;
-    const encodedPayload = value.slice(0, dot);
-    const provided = Buffer.from(value.slice(dot + 1), "base64url");
-    const expected = Buffer.from(hmac(options.secret, encodedPayload), "base64url");
-    if (provided.length !== expected.length) return null;
-    if (!(0, import_node_crypto.timingSafeEqual)(provided, expected)) return null;
-    const decoded = JSON.parse(base64urlDecode(encodedPayload));
-    if (!isSessionPayload(decoded)) return null;
-    const now = options.now ?? Date.now();
-    if (now > decoded.exp + EXP_GRACE_MS) return null;
-    return decoded;
-  } catch {
-    return null;
-  }
-}
-__name(verifySessionCookie, "verifySessionCookie");
-
-// src/server/auth/session-cookie-io.ts
-var SESSION_COOKIE_NAME = "media_console_session";
-function issueSessionCookie(user, context) {
-  const value = signSessionCookie(user, {
-    secret: context.auth.secret,
-    ttlMs: context.auth.ttlMs,
-    ...context.now !== void 0 ? {
-      now: context.now
-    } : {}
-  });
-  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, value, {
-    path: context.cookiePath,
-    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
-    secure: isHttpsRequest(context.request)
-  }));
-}
-__name(issueSessionCookie, "issueSessionCookie");
-function clearSessionCookie(context) {
-  appendSetCookie(context.response, serializeSetCookie(SESSION_COOKIE_NAME, "", {
-    path: context.cookiePath,
-    maxAgeSeconds: 0,
-    secure: isHttpsRequest(context.request),
-    clear: true
-  }));
-}
-__name(clearSessionCookie, "clearSessionCookie");
-
-// src/server/tokens.ts
-var MEDIA_STORE = /* @__PURE__ */ Symbol.for("nestjs-media:store");
-var MEDIA_UPLOAD_SESSIONS = /* @__PURE__ */ Symbol.for("nestjs-media:upload-sessions");
-var MEDIA_STORAGE_SHARED = /* @__PURE__ */ Symbol.for("nestjs-media:storage");
-var MEDIA_DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_BASE_PATH");
-var MEDIA_DASHBOARD_API_PATH = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_API_PATH");
-var MEDIA_DASHBOARD_ACTIONS = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_ACTIONS");
-var MEDIA_CONSOLE_AUTH = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_AUTH");
-var MEDIA_CONSOLE_COOKIE_PATH = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_COOKIE_PATH");
-var MEDIA_CONSOLE_OBJECT_INSIGHTS = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_OBJECT_INSIGHTS");
-var MEDIA_CONSOLE_OBJECT_URLS = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_OBJECT_URLS");
-
-// src/server/media-console.guard.ts
+var import_common = require("@nestjs/common");
+var import_core = require("@nestjs/core");
 function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -379,94 +87,339 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
-var MediaConsoleGuard = class {
-  static {
-    __name(this, "MediaConsoleGuard");
+var CONSOLE_GATE = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-media-dashboard";
+var MODULE = "MediaDashboardModule";
+var CONSOLE_AUTHORIZE_MISSING_WARNING = consoleAuthorizeMissingWarning(`${MODULE}.forRoot()`);
+function consoleAuthorizeMissingWarning(registration) {
+  return `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${registration}.`;
+}
+__name(consoleAuthorizeMissingWarning, "consoleAuthorizeMissingWarning");
+var allow = /* @__PURE__ */ __name(() => ({
+  allowed: true
+}), "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
   }
-  auth;
-  cookiePath;
-  constructor(auth, cookiePath) {
-    this.auth = auth;
-    this.cookiePath = cookiePath;
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function isLazyModule(value) {
+  return typeof value === "object" && value !== null && isAuthorizerClass(value.default);
+}
+__name(isLazyModule, "isLazyModule");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (typeof result !== "object" || result === null) return forbidden();
+  const shape = result;
+  if (typeof shape.redirectTo === "string" && shape.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: shape.redirectTo
+    };
   }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = this.verifyRequestSession(request);
-    if (!session) throw new import_common.UnauthorizedException();
-    attachSession(request, session);
-    if (!await this.maybeRenew(http.getResponse(), request, session)) {
-      throw new import_common.UnauthorizedException();
-    }
-    return true;
+  if (shape.allowed === true) return allow();
+  return shape.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+var importOptional = /* @__PURE__ */ __name((specifier) => import(
+  /* @vite-ignore */
+  specifier
+), "importOptional");
+async function policyDecider(check, moduleRef) {
+  let pkg;
+  try {
+    pkg = await importOptional("@nestjs/authorization");
+  } catch {
+    throw new Error("`authorize: { policy, ability }` needs @nestjs/authorization installed (npm i @nestjs/authorization); or pass a function, a class, or a gate name");
   }
-  verifyRequestSession(request) {
-    if (!this.auth) return null;
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return null;
-    return verifySessionCookie(cookieValue, {
-      secret: this.auth.secret
+  let service;
+  try {
+    service = moduleRef.get(pkg.AuthorizationService, {
+      strict: false
     });
+  } catch {
+    service = void 0;
   }
-  /**
-  * Sliding renewal + revalidation: when a valid cookie is past half its TTL, re-issue a fresh one
-  * so active users never get logged out mid-session — but first let the host's `revalidate` hook
-  * re-check the user, so a deactivated or demoted operator loses access instead of riding a
-  * self-renewing cookie. Returns `false` when the session was revoked (cookie already cleared).
-  */
-  async maybeRenew(response, request, session) {
-    if (!this.auth) return true;
-    const now = Date.now();
-    if (now - session.iat <= this.auth.ttlMs / 2) return true;
-    const user = {
-      id: session.sub,
-      ...session.name !== void 0 ? {
-        name: session.name
-      } : {},
-      roles: session.roles
-    };
-    if (this.auth.revalidate) {
-      let allowed;
+  if (!service) {
+    throw new Error("`authorize: { policy, ability }` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app");
+  }
+  const found = service;
+  const defaultGetUser = pkg.defaultGetUser;
+  let getUser = defaultGetUser;
+  try {
+    const options = moduleRef.get(pkg.AUTHORIZATION_MODULE_OPTIONS, {
+      strict: false
+    });
+    if (typeof options?.getUser === "function") getUser = options.getUser;
+  } catch {
+  }
+  const { policy, ability } = check;
+  return async (context) => {
+    const user = await getUser(context);
+    const signedIn = hasUser(user);
+    if (await found.can(policy, ability, signedIn ? user : null)) return allow();
+    return signedIn ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+function gateDecider(name, moduleRef) {
+  let gate;
+  try {
+    gate = moduleRef.get(CONSOLE_GATE, {
+      strict: false
+    });
+  } catch {
+    gate = void 0;
+  }
+  if (!gate) {
+    throw new Error(`\`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }`);
+  }
+  const found = gate;
+  return async (context) => normalizeConsoleResult(await found.allows(name, context));
+}
+__name(gateDecider, "gateDecider");
+function classDecider(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  const instanceOf = /* @__PURE__ */ __name((Class) => {
+    const cached = instances.get(Class);
+    if (cached) return cached;
+    const pending = (async () => {
       try {
-        allowed = await this.auth.revalidate(user);
-      } catch {
-        allowed = false;
-      }
-      if (!allowed) {
-        clearSessionCookie({
-          cookiePath: this.cookiePath ?? "/",
-          request,
-          response
+        const registered = moduleRef.get(Class, {
+          strict: false
         });
-        return false;
+        if (registered) return registered;
+      } catch {
       }
+      return moduleRef.create(Class);
+    })();
+    pending.catch(() => instances.delete(Class));
+    instances.set(Class, pending);
+    return pending;
+  }, "instanceOf");
+  return (Class) => async (context) => normalizeConsoleResult(await (await instanceOf(Class)).authorize(context));
+}
+__name(classDecider, "classDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const logger = options.logger ?? new import_common.Logger(MODULE);
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) {
+      logger.warn(options.registration ? consoleAuthorizeMissingWarning(options.registration) : CONSOLE_AUTHORIZE_MISSING_WARNING);
     }
-    issueSessionCookie(user, {
-      auth: this.auth,
-      cookiePath: this.cookiePath ?? "/",
-      request,
-      response,
-      now
-    });
-    return true;
+    const production = isProduction();
+    return async () => production ? forbidden() : allow();
+  }
+  let decide;
+  if (typeof authorize === "string") {
+    decide = gateDecider(authorize, moduleRef);
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    decide = classDecider(moduleRef)(authorize);
+  } else if (typeof authorize === "function") {
+    const fromClass = classDecider(moduleRef);
+    let lazy;
+    const fn = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazy) return lazy(context);
+      const result = await fn(context);
+      if (!isLazyModule(result)) return normalizeConsoleResult(result);
+      lazy = fromClass(result.default);
+      return lazy(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return await decide(context);
+    } catch (error) {
+      logger.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+var sha256 = /* @__PURE__ */ __name((value) => (0, import_node_crypto.createHash)("sha256").update(value).digest(), "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  return (context) => {
+    const header = context.switchToHttp().getRequest()?.headers?.authorization;
+    const match = typeof header === "string" ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+    if (match?.[1] && (0, import_node_crypto.timingSafeEqual)(sha256(match[1]), expected)) return true;
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+var CONSOLE_AUTHORIZE_DECIDE = /* @__PURE__ */ Symbol(`${PACKAGE}:console-authorize`);
+var CONSOLE_PAGE_METADATA = `${PACKAGE}:console-page`;
+var ConsolePage = /* @__PURE__ */ __name(() => (target) => {
+  Reflect.defineMetadata(CONSOLE_PAGE_METADATA, true, target);
+}, "ConsolePage");
+var ConsoleAccessDenied = class extends import_common.HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page2 = false) {
+    const isUnauthenticated = decision.reason === "unauthenticated";
+    super(isUnauthenticated ? {
+      error: "unauthenticated",
+      ...decision.redirectTo ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    } : {
+      error: "forbidden"
+    }, isUnauthenticated ? 401 : 403), this.decision = decision, this.page = page2;
+  }
+};
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  decide;
+  constructor(decide) {
+    this.decide = decide;
+  }
+  async canActivate(context) {
+    const decision = await this.decide(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
   }
 };
-MediaConsoleGuard = _ts_decorate([
+ConsoleAuthorizeGuard = _ts_decorate([
   (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Optional)()),
-  _ts_param(0, (0, import_common.Inject)(MEDIA_CONSOLE_AUTH)),
-  _ts_param(1, (0, import_common.Optional)()),
-  _ts_param(1, (0, import_common.Inject)(MEDIA_CONSOLE_COOKIE_PATH)),
+  _ts_param(0, (0, import_common.Inject)(CONSOLE_AUTHORIZE_DECIDE)),
   _ts_metadata("design:type", Function),
   _ts_metadata("design:paramtypes", [
-    Object,
-    Object
+    typeof ConsoleDecide === "undefined" ? Object : ConsoleDecide
   ])
-], MediaConsoleGuard);
+], ConsoleAuthorizeGuard);
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  if (Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) !== true) return false;
+  const request = context.switchToHttp().getRequest();
+  const accept = request?.headers?.accept;
+  return request?.method === "GET" && typeof accept === "string" && accept.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var page = /* @__PURE__ */ __name((title, message) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`, "page");
+var DENIED_PAGE = page("Access denied", "You do not have access to this console.");
+var SIGN_IN_PAGE = page("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const response = host.switchToHttp().getResponse();
+    const { decision, page: isPage } = exception;
+    if (isPage && decision.redirectTo) {
+      adapter.redirect(response, 302, decision.redirectTo);
+      return;
+    }
+    if (isPage) {
+      const unauthenticated2 = decision.reason === "unauthenticated";
+      adapter.setHeader(response, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(response, unauthenticated2 ? SIGN_IN_PAGE : DENIED_PAGE, unauthenticated2 ? 401 : 403);
+      return;
+    }
+    adapter.reply(response, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate([
+  (0, import_common.Catch)(ConsoleAccessDenied),
+  _ts_param(0, (0, import_common.Inject)(import_core.HttpAdapterHost)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof import_core.HttpAdapterHost === "undefined" ? Object : import_core.HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+var UseConsoleAuthorize = /* @__PURE__ */ __name(() => (0, import_common.applyDecorators)((0, import_common.UseGuards)(ConsoleAuthorizeGuard), (0, import_common.UseFilters)(ConsoleAuthorizeFilter)), "UseConsoleAuthorize");
+function consoleAuthorizeProvider(authorize, registration) {
+  return {
+    provide: CONSOLE_AUTHORIZE_DECIDE,
+    inject: [
+      import_core.ModuleRef
+    ],
+    useFactory: /* @__PURE__ */ __name((moduleRef) => resolveConsoleAuthorize(authorize, moduleRef, {
+      registration
+    }), "useFactory")
+  };
+}
+__name(consoleAuthorizeProvider, "consoleAuthorizeProvider");
+
+// src/server/controller-decorators.ts
+var CAN_ANYONE_METADATA = "authorization:can-anyone";
+function OpenToAuthorization() {
+  return (target) => {
+    Reflect.defineMetadata(CAN_ANYONE_METADATA, true, target);
+  };
+}
+__name(OpenToAuthorization, "OpenToAuthorization");
+function consoleController(controller, decorators) {
+  const Decorated = class extends controller {
+    static {
+      __name(this, "Decorated");
+    }
+  };
+  Object.defineProperty(Decorated, "name", {
+    value: controller.name
+  });
+  if (decorators && decorators.length > 0) Reflect.decorate(decorators, Decorated);
+  Reflect.decorate([
+    UseConsoleAuthorize()
+  ], Decorated);
+  return Decorated;
+}
+__name(consoleController, "consoleController");
+
+// src/server/media-console-api.module.ts
+var import_common5 = require("@nestjs/common");
+
+// src/server/media-console-actions.controller.ts
+var import_common3 = require("@nestjs/common");
 
 // src/server/media-console.service.ts
+var import_nestjs_media_core = require("@dudousxd/nestjs-media-core");
 var import_common2 = require("@nestjs/common");
+var import_storage = require("@nestjs/storage");
 
 // src/server/object-insights.ts
 var SAFE_LINK_SCHEMES = /* @__PURE__ */ new Set([
@@ -501,6 +454,16 @@ function objectProxyUrl(apiBasePath, route, disk, key) {
 }
 __name(objectProxyUrl, "objectProxyUrl");
 
+// src/server/tokens.ts
+var MEDIA_STORE = /* @__PURE__ */ Symbol.for("nestjs-media:store");
+var MEDIA_UPLOAD_SESSIONS = /* @__PURE__ */ Symbol.for("nestjs-media:upload-sessions");
+var MEDIA_MULTIPART = /* @__PURE__ */ Symbol.for("nestjs-media:multipart");
+var MEDIA_DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_BASE_PATH");
+var MEDIA_DASHBOARD_API_PATH = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_API_PATH");
+var MEDIA_DASHBOARD_ACTIONS = /* @__PURE__ */ Symbol("MEDIA_DASHBOARD_ACTIONS");
+var MEDIA_CONSOLE_OBJECT_INSIGHTS = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_OBJECT_INSIGHTS");
+var MEDIA_CONSOLE_OBJECT_URLS = /* @__PURE__ */ Symbol("MEDIA_CONSOLE_OBJECT_URLS");
+
 // src/server/media-console.service.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -530,46 +493,57 @@ function _ts_param2(paramIndex, decorator) {
 __name(_ts_param2, "_ts_param");
 var URL_TTL_SECONDS = 300;
 var DEFAULT_PAGE_LIMIT = 50;
-var MAX_UPLOAD_BYTES = 100 * 1024 * 1024;
-var DELETE_SWEEP_LIMIT = 1e3;
-var MAX_CROSS_DISK_BYTES = 100 * 1024 * 1024;
+var SWEEP_LIMIT = 1e3;
+var FOLDER_KEEP_FILE = ".keep";
 function lastSegment(prefix) {
   const trimmed = prefix.replace(/\/+$/, "");
   const slash = trimmed.lastIndexOf("/");
   return slash === -1 ? trimmed : trimmed.slice(slash + 1);
 }
 __name(lastSegment, "lastSegment");
-var RangeNotSatisfiableException = class extends import_common2.HttpException {
-  static {
-    __name(this, "RangeNotSatisfiableException");
+function clientFolder(prefix, what) {
+  const trimmed = prefix.trim().replace(/^\/+/, "");
+  let normalized;
+  try {
+    normalized = (0, import_nestjs_media_core.folderPrefix)(trimmed);
+  } catch (error) {
+    throw new import_common2.BadRequestException(`${what}: ${error.message}`);
   }
-  size;
-  constructor(size) {
-    super({
-      statusCode: import_common2.HttpStatus.REQUESTED_RANGE_NOT_SATISFIABLE,
-      message: `Requested range is not satisfiable for an object of ${size} bytes`,
-      error: "Range Not Satisfiable"
-    }, import_common2.HttpStatus.REQUESTED_RANGE_NOT_SATISFIABLE), this.size = size;
+  if (normalized === "") throw new import_common2.BadRequestException(`${what} is required`);
+  return normalized;
+}
+__name(clientFolder, "clientFolder");
+function isAddressable(key) {
+  try {
+    (0, import_nestjs_media_core.assertMediaKey)(key);
+    return true;
+  } catch {
+    return false;
   }
-};
-function resolveRange(range, size) {
-  if ("suffixLength" in range) {
-    if (!Number.isInteger(range.suffixLength) || range.suffixLength <= 0 || size === 0) return null;
-    return {
-      start: Math.max(0, size - range.suffixLength),
-      end: size - 1
-    };
+}
+__name(isAddressable, "isAddressable");
+var CORE_CLIENT_ERRORS = /* @__PURE__ */ new Set([
+  "InvalidMediaKeyError",
+  "InvalidListingCursorError"
+]);
+function toHttp(error) {
+  if (error instanceof import_common2.HttpException) return error;
+  if (error instanceof import_storage.StorageFileNotFoundError) return new import_common2.NotFoundException(error.message);
+  const status = error?.status;
+  if ((error instanceof import_storage.StorageError || CORE_CLIENT_ERRORS.has(error?.name ?? "")) && typeof status === "number") {
+    return new import_common2.HttpException(error.message, status);
+  }
+  return error;
+}
+__name(toHttp, "toHttp");
+async function http(run) {
+  try {
+    return await run();
+  } catch (error) {
+    throw toHttp(error);
   }
-  const { start } = range;
-  if (!Number.isInteger(start) || start < 0 || start >= size) return null;
-  const end = range.end === void 0 ? size - 1 : Math.min(range.end, size - 1);
-  if (!Number.isInteger(end) || end < start) return null;
-  return {
-    start,
-    end
-  };
 }
-__name(resolveRange, "resolveRange");
+__name(http, "http");
 function mapUpload(session) {
   const percent = session.size !== void 0 && session.size > 0 ? Math.min(100, Math.round(session.offset / session.size * 100)) : null;
   return {
@@ -613,108 +587,106 @@ var MediaConsoleService = class _MediaConsoleService {
   actionsEnabled;
   insightProviders;
   objectUrls;
-  constructor(storage, store, uploads, actionsEnabled, insightProviders = null, objectUrls = null) {
+  multipart;
+  constructor(storage, store, uploads, actionsEnabled, insightProviders = null, objectUrls = null, multipart = null) {
     this.storage = storage;
     this.store = store;
     this.uploads = uploads;
     this.actionsEnabled = actionsEnabled;
     this.insightProviders = insightProviders;
     this.objectUrls = objectUrls;
+    this.multipart = multipart;
   }
+  logger = new import_common2.Logger(_MediaConsoleService.name);
   /**
   * The URL to report for an object's bytes, under the host's {@link ObjectUrlStrategy}. `auto`
-  * prefers a presigned URL straight to the store; `proxy` routes through this server, for a host
-  * whose browser cannot reach the store at all.
+  * prefers the disk's public URL, then a signed one (S3 presigns; a local disk signs with
+  * `signedUrls`), and falls back to this server's own route for a disk that can do neither.
+  * `proxy` always routes through this server.
   */
-  objectUrl(driver, disk, key) {
-    if (this.objectUrls?.strategy === "proxy") {
-      return Promise.resolve(objectProxyUrl(this.objectUrls.apiBasePath, "raw", disk, key));
-    }
-    return driver.capabilities.presign ? driver.temporaryUrl(key, URL_TTL_SECONDS) : driver.url(key);
+  async objectUrl(disk, name, key) {
+    const proxy = /* @__PURE__ */ __name(() => objectProxyUrl(this.objectUrls?.apiBasePath ?? "", "raw", name, key), "proxy");
+    if (this.objectUrls?.strategy === "proxy") return proxy();
+    if ((0, import_nestjs_media_core.hasPublicUrl)(disk)) return disk.url(key);
+    if (await (0, import_nestjs_media_core.canPresign)(disk)) return disk.signedUrl(key, {
+      expiresIn: URL_TTL_SECONDS * 1e3
+    });
+    return proxy();
   }
-  logger = new import_common2.Logger(_MediaConsoleService.name);
   diskOrThrow(disk) {
-    if (!this.storage || !this.storage.diskNames().includes(disk)) {
+    if (!this.storage || !this.storage.names().includes(disk)) {
       throw new import_common2.NotFoundException(`Unknown disk: ${disk}`);
     }
     return this.storage.disk(disk);
   }
-  listDisks() {
+  async listDisks() {
     const storage = this.storage;
     if (!storage) return {
       disks: []
     };
-    const defaultDisk = storage.defaultDisk;
     return {
-      disks: storage.diskNames().map((name) => ({
+      disks: await Promise.all(storage.names().map(async (name) => ({
         name,
-        default: name === defaultDisk,
-        capabilities: storage.disk(name).capabilities
-      }))
+        default: name === storage.defaultDisk,
+        capabilities: await (0, import_nestjs_media_core.diskCapabilities)(storage.disk(name), (0, import_nestjs_media_core.multipartFor)(this.multipart ?? void 0, name))
+      })))
     };
   }
+  /**
+  * One folder level. `StorageDisk.list()` is flat; a disk whose multipart side-car lists with a
+  * delimiter (S3) asks the store for folders, any other disk folds its flat listing.
+  */
   async listObjects(disk, options) {
-    const driver = this.diskOrThrow(disk);
-    const result = await driver.list(options.prefix ?? "", {
-      delimiter: "/",
+    const store = this.diskOrThrow(disk);
+    const raw = (options.prefix ?? "").replace(/^\/+/, "");
+    let prefix;
+    try {
+      prefix = (0, import_nestjs_media_core.folderPrefix)(raw);
+    } catch (error) {
+      throw new import_common2.BadRequestException(error.message);
+    }
+    const level = await http(() => (0, import_nestjs_media_core.listFolderLevel)(store, prefix, {
+      limit: options.limit ?? DEFAULT_PAGE_LIMIT,
       ...options.cursor ? {
         cursor: options.cursor
-      } : {},
-      limit: options.limit ?? DEFAULT_PAGE_LIMIT
-    });
+      } : {}
+    }, (0, import_nestjs_media_core.multipartFor)(this.multipart ?? void 0, disk)));
     return {
-      // Drop phantom folders whose name is empty — a CommonPrefix of only slashes (`/`, `//`),
-      // produced by a stray key with a leading slash. The S3 driver normalizes such a prefix back to
-      // the root, so listing INTO one returns the root again (the phantom included) — a self-reference
-      // that infinite-loops the folder tree. Filtering it out removes the trap; those leading-slash
-      // keys are unreachable from the console anyway (the driver strips the leading slash).
-      folders: result.folders.map((prefix) => ({
-        name: lastSegment(prefix),
-        prefix
+      folders: level.folders.map((folder) => ({
+        name: lastSegment(folder),
+        prefix: folder
       })).filter((folder) => folder.name !== ""),
-      // Drop the zero-byte "folder marker" (a key ending in `/`, whose name is empty after the
-      // prefix) that `createFolder` writes — it's the folder itself, not a file inside it.
-      files: result.files.filter((entry) => entry.name !== "").map((entry) => ({
+      files: level.files.map((entry) => ({
+        entry,
+        name: entry.key.slice(prefix.length)
+      })).filter(({ name }) => name !== "" && name !== FOLDER_KEEP_FILE).map(({ entry, name }) => ({
         key: entry.key,
-        name: entry.name,
-        sizeBytes: entry.sizeBytes,
-        lastModified: entry.lastModified ? entry.lastModified.toISOString() : null
+        name,
+        sizeBytes: entry.size,
+        lastModified: entry.lastModified.toISOString()
       })),
-      ...result.cursor ? {
-        cursor: result.cursor
+      ...level.cursor ? {
+        cursor: level.cursor
       } : {}
     };
   }
   async objectDetail(disk, key) {
-    const driver = this.diskOrThrow(disk);
-    const stat = await driver.stat(key);
-    const url = await this.objectUrl(driver, disk, key);
-    return {
-      key,
-      size: stat.size,
-      ...stat.contentType ? {
-        contentType: stat.contentType
-      } : {},
-      ...stat.lastModified ? {
-        lastModified: stat.lastModified.toISOString()
-      } : {},
-      url
-    };
+    const store = this.diskOrThrow(disk);
+    return http(async () => {
+      const stat = await store.stat(key);
+      return {
+        key,
+        size: stat.size,
+        contentType: stat.contentType,
+        lastModified: stat.lastModified.toISOString(),
+        url: await this.objectUrl(store, disk, key)
+      };
+    });
   }
   /**
-  * What the HOST knows about this object, from every registered provider.
-  *
-  * Its own call rather than a field on `objectDetail`, for the same reason the RAG index-status
-  * endpoint is separate from its document listing: `objectDetail` is on the path of every preview
-  * and every navigation, and providers reach into host databases. Folding them in would put a host
-  * query on reads that only wanted a presigned URL.
-  *
-  * Failures are contained per provider. A provider that throws is logged and dropped, and the
-  * others still render — annotation must never be able to stop an admin opening a file, and one
-  * host lookup being down says nothing about the rest.
-  *
-  * Providers run concurrently: they are independent host lookups, and running them in series would
-  * make the panel as slow as their sum for no gain.
+  * What the HOST knows about this object, from every registered provider. Its own call rather
+  * than a field on `objectDetail`, so host lookups stay off the preview path. A provider that
+  * throws is logged and dropped; providers run concurrently.
   */
   async objectInsights(disk, key) {
     const providers = this.insightProviders ?? [];
@@ -740,177 +712,132 @@ var MediaConsoleService = class _MediaConsoleService {
     };
   }
   /**
-  * The object's raw byte stream plus the metadata the controller needs to serve it inline. Used by
-  * the console's same-origin preview proxy so text/PDF render in the browser instead of downloading
-  * (and so a CORS-locked bucket is still previewable).
-  *
-  * With `range`, only that slice — which is what makes previewing a multi-hundred-MB object (a
-  * SQLite database read a page at a time) possible at all. The range is resolved HERE, not in the
-  * driver, because it has to be checked against the object's size and the `stat` for that is
-  * already on this path: the suffix form is made absolute, an overrunning `end` is clamped to the
-  * last byte, and anything genuinely unsatisfiable becomes a {@link RangeNotSatisfiableException}
-  * (HTTP 416) instead of a surprise empty body.
-  *
-  * A driver that reports `ranged: false` REFUSES a range request rather than quietly returning the
-  * whole object: the caller asked for 64 KB out of 400 MB, and silently answering with all 400 MB
-  * — which the caller would then read as if it were the slice — is the exact failure the `ranged`
-  * capability exists to make impossible.
+  * Streams an object as the response through `@nestjs/storage`'s `serveFile()`: a single `Range`
+  * gets a 206 with `Content-Range` (how a SQLite/ZIP/Parquet preview reads a few KB out of a huge
+  * object), `If-None-Match` a 304, a range past the end a 416, a missing file a 404. `inline`
+  * applies only to types that can't run script in this origin; others download.
   */
-  async objectStream(disk, key, range) {
-    const driver = this.diskOrThrow(disk);
-    const stat = await driver.stat(key);
-    const contentType = stat.contentType ?? "application/octet-stream";
-    if (!range) {
-      return {
-        stream: await driver.stream(key),
-        contentType,
-        size: stat.size
-      };
-    }
-    if (!driver.capabilities.ranged) {
-      throw new import_common2.NotImplementedException(`Disk "${disk}" cannot serve byte ranges`);
-    }
-    const resolved = resolveRange(range, stat.size);
-    if (!resolved) throw new RangeNotSatisfiableException(stat.size);
-    return {
-      stream: await driver.stream(key, resolved),
-      contentType,
-      size: stat.size,
-      range: resolved
-    };
+  serveObject(disk, key, options) {
+    return http(() => (0, import_storage.serveFile)(this.diskOrThrow(disk), key, options));
   }
-  /** Writes an object from a byte stream (a browser upload). The caller supplies the full key
-  *  (prefix + filename); an unknown disk 404s via {@link diskOrThrow}. Actions-gated.
-  *
-  *  The request stream is buffered before the write: S3's PutObject needs a known Content-Length,
-  *  which a raw request stream doesn't carry, so passing the stream straight through fails. Bounded
-  *  at {@link MAX_UPLOAD_BYTES} so a runaway upload can't exhaust the pod's heap — larger files
-  *  belong on the resumable upload path, not this console convenience upload. */
-  async putObject(disk, key, body, contentType) {
-    const driver = this.diskOrThrow(disk);
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of body) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      total += buffer.length;
-      if (total > MAX_UPLOAD_BYTES) {
-        throw new import_common2.PayloadTooLargeException(`Upload exceeds the ${MAX_UPLOAD_BYTES / (1024 * 1024)} MB console limit.`);
-      }
-      chunks.push(buffer);
-    }
-    await driver.put(key, Buffer.concat(chunks), contentType ? {
-      contentType
-    } : void 0);
+  /**
+  * Writes an object from a byte stream (a browser upload), streamed onto the disk: S3Disk turns a
+  * body of unknown length into a multipart upload itself, so nothing is buffered here. With the
+  * request's `Content-Length`, a body that ends short fails and nothing is written.
+  */
+  async putObject(disk, key, body, contentType, contentLength) {
+    const store = this.diskOrThrow(disk);
+    await http(() => store.put(key, body, {
+      ...contentType ? {
+        contentType
+      } : {},
+      ...contentLength !== void 0 ? {
+        contentLength
+      } : {}
+    }));
   }
-  /** Creates a "folder" — a zero-byte marker object at `<prefix>/`, which S3-style listing surfaces
-  *  as a navigable folder. Normalizes to exactly one trailing slash; rejects an empty prefix. */
+  /**
+  * Creates a folder: a zero-byte `<prefix>/.keep` file (hidden from listings), since
+  * `@nestjs/storage` keys can't end with `/`. Listings show the folder because a key lives in it.
+  */
   async createFolder(disk, prefix) {
-    const normalized = prefix.replace(/^\/+/, "").replace(/\/+$/, "");
-    if (normalized === "") throw new import_common2.BadRequestException("Folder name is required");
-    await this.diskOrThrow(disk).put(`${normalized}/`, Buffer.alloc(0));
+    const folder = clientFolder(prefix, "Folder name");
+    await http(() => this.diskOrThrow(disk).put(`${folder}${FOLDER_KEEP_FILE}`, ""));
   }
   async deleteObject(disk, key) {
-    await this.diskOrThrow(disk).delete(key);
-  }
-  /** Recursively deletes a "folder": every object under `<prefix>/` (nested included) plus the
-  *  zero-byte marker itself. Passes an empty delimiter so the driver lists keys FLAT — the default
-  *  `/` delimiter would group nested keys into CommonPrefixes and the sweep would miss them, only
-  *  deleting direct children. Paginates until the disk reports no more. The marker's own key equals
-  *  the sweep prefix, which `list` filters out (Key === Prefix), so it's deleted explicitly at the
-  *  end. Actions-gated. */
+    await http(() => this.diskOrThrow(disk).delete(key));
+  }
+  /**
+  * Recursively deletes a folder: every file under `<prefix>/`, nested included (its `.keep`
+  * too), a batch of keys per `delete()`. A legacy `prefix/` marker object written by another tool
+  * can't be addressed through `@nestjs/storage`; it is skipped.
+  */
   async deleteFolder(disk, prefix) {
-    const driver = this.diskOrThrow(disk);
-    const normalized = prefix.replace(/^\/+/, "").replace(/\/+$/, "");
-    if (normalized === "") throw new import_common2.BadRequestException("Folder is required");
-    const sweepPrefix = `${normalized}/`;
-    let cursor;
-    do {
-      const result = await driver.list(sweepPrefix, {
-        delimiter: "",
-        limit: DELETE_SWEEP_LIMIT,
-        ...cursor ? {
-          cursor
-        } : {}
-      });
-      const keys = result.files.map((entry) => entry.key);
-      if (driver.deleteMany) await driver.deleteMany(keys);
-      else for (const key of keys) await driver.delete(key);
-      cursor = result.cursor;
-    } while (cursor);
-    await driver.delete(sweepPrefix);
+    const store = this.diskOrThrow(disk);
+    const folder = clientFolder(prefix, "Folder");
+    await http(async () => {
+      const keys = [];
+      for await (const entry of store.listAll({
+        prefix: folder,
+        limit: SWEEP_LIMIT
+      })) {
+        if (isAddressable(entry.key)) keys.push(entry.key);
+      }
+      for (let start = 0; start < keys.length; start += SWEEP_LIMIT) {
+        await store.delete(keys.slice(start, start + SWEEP_LIMIT));
+      }
+    });
   }
   async copyObject(fromDisk, from, toDisk, to) {
-    await this.transferKey("copy", fromDisk, from, toDisk, to);
+    await http(() => this.transferKey("copy", fromDisk, from, toDisk, to));
   }
   async moveObject(fromDisk, from, toDisk, to) {
-    await this.transferKey("move", fromDisk, from, toDisk, to);
+    await http(() => this.transferKey("move", fromDisk, from, toDisk, to));
   }
-  /** Copies or moves a single object, on the same disk or across disks. Same-disk uses the driver's
-  *  native `copy`/`move` (server-side, no bytes through the pod). Cross-disk has no driver primitive,
-  *  so the object is streamed through the pod (get→put, buffered), preserving its content type and
-  *  bounded at {@link MAX_CROSS_DISK_BYTES}; a `move` then deletes the source. */
+  /**
+  * Copies or moves one object. Same disk: the disk's own `copy`/`move` (server-side on S3, a
+  * rename on a local disk). Across disks: the source's body streams into the destination's
+  * `put()` (no size limit, nothing buffered), keeping its content type, cache control,
+  * disposition and metadata; a `move` then deletes the source.
+  */
   async transferKey(op, fromDisk, from, toDisk, to) {
-    const fromDriver = this.diskOrThrow(fromDisk);
+    const source = this.diskOrThrow(fromDisk);
     if (fromDisk === toDisk) {
-      if (op === "move") await fromDriver.move(from, to);
-      else await fromDriver.copy(from, to);
+      if (op === "move") await source.move(from, to);
+      else await source.copy(from, to);
       return;
     }
-    const toDriver = this.diskOrThrow(toDisk);
-    const stat = await fromDriver.stat(from);
-    if (stat.size > MAX_CROSS_DISK_BYTES) {
-      throw new import_common2.PayloadTooLargeException(`"${from}" is ${Math.round(stat.size / (1024 * 1024))} MB \u2014 over the ${MAX_CROSS_DISK_BYTES / (1024 * 1024)} MB limit for copying across disks from the console.`);
+    const target = this.diskOrThrow(toDisk);
+    const download = await source.get(from);
+    try {
+      await target.put(to, download.body, {
+        contentType: download.contentType,
+        contentLength: download.size,
+        ...download.cacheControl ? {
+          cacheControl: download.cacheControl
+        } : {},
+        ...download.contentDisposition ? {
+          contentDisposition: download.contentDisposition
+        } : {},
+        metadata: download.metadata
+      });
+    } finally {
+      download.body.destroy();
     }
-    const bytes = await fromDriver.get(from);
-    await toDriver.put(to, bytes, stat.contentType ? {
-      contentType: stat.contentType
-    } : void 0);
-    if (op === "move") await fromDriver.delete(from);
-  }
-  /** Moves a whole "folder" (every object under `<from>/`, nested included) to `<to>/`, on the same
-  *  disk or across disks, preserving each key's path relative to the source. */
+    if (op === "move") await source.delete(from);
+  }
+  /** Moves a whole folder (every file under `<from>/`, nested included) to `<to>/`. */
   async moveFolder(fromDisk, from, toDisk, to) {
-    await this.transferFolder("move", fromDisk, from, toDisk, to);
+    await http(() => this.transferFolder("move", fromDisk, from, toDisk, to));
   }
-  /** Copies a whole "folder" (every object under `<from>/`, nested included) to `<to>/`, same disk or
-  *  across disks, preserving each key's path relative to the source. */
+  /** Copies a whole folder (every file under `<from>/`, nested included) to `<to>/`. */
   async copyFolder(fromDisk, from, toDisk, to) {
-    await this.transferFolder("copy", fromDisk, from, toDisk, to);
+    await http(() => this.transferFolder("copy", fromDisk, from, toDisk, to));
   }
-  /** Shared engine for {@link moveFolder}/{@link copyFolder}. Same flat-listing sweep as
-  *  {@link deleteFolder}; each key is relocated via {@link transferKey} (so cross-disk transfers work
-  *  transparently). On the SAME disk, rejects a destination inside the source (which would recurse
-  *  forever); across disks that constraint doesn't apply. The destination folder marker is written,
-  *  and for a move the source marker is removed, so both listings stay consistent. Actions-gated. */
+  /**
+  * Shared engine for {@link moveFolder}/{@link copyFolder}: a flat sweep of the source, each key
+  * relocated via {@link transferKey}, keeping its path relative to the folder (an empty folder's
+  * `.keep` goes along). On the SAME disk, a destination inside the source is refused (it would
+  * recurse forever).
+  */
   async transferFolder(op, fromDisk, from, toDisk, to) {
-    const fromDriver = this.diskOrThrow(fromDisk);
-    const toDriver = this.diskOrThrow(toDisk);
-    const fromNormalized = from.replace(/^\/+/, "").replace(/\/+$/, "");
-    const toNormalized = to.replace(/^\/+/, "").replace(/\/+$/, "");
-    if (fromNormalized === "") throw new import_common2.BadRequestException("Source folder is required");
-    if (toNormalized === "") throw new import_common2.BadRequestException("Destination folder is required");
-    const fromPrefix = `${fromNormalized}/`;
-    const toPrefix = `${toNormalized}/`;
-    if (fromDisk === toDisk && (toPrefix === fromPrefix || toPrefix.startsWith(fromPrefix))) {
+    const source = this.diskOrThrow(fromDisk);
+    this.diskOrThrow(toDisk);
+    const fromPrefix = clientFolder(from, "Source folder");
+    const toPrefix = clientFolder(to, "Destination folder");
+    if (fromDisk === toDisk && toPrefix.startsWith(fromPrefix)) {
       throw new import_common2.BadRequestException(`Cannot ${op} a folder into itself`);
     }
-    let cursor;
-    do {
-      const result = await fromDriver.list(fromPrefix, {
-        delimiter: "",
-        limit: DELETE_SWEEP_LIMIT,
-        ...cursor ? {
-          cursor
-        } : {}
-      });
-      for (const entry of result.files) {
-        const destKey = `${toPrefix}${entry.key.slice(fromPrefix.length)}`;
-        await this.transferKey(op, fromDisk, entry.key, toDisk, destKey);
-      }
-      cursor = result.cursor;
-    } while (cursor);
-    await toDriver.put(toPrefix, Buffer.alloc(0));
-    if (op === "move") await fromDriver.delete(fromPrefix);
+    const keys = [];
+    for await (const entry of source.listAll({
+      prefix: fromPrefix,
+      limit: SWEEP_LIMIT
+    })) {
+      if (isAddressable(entry.key)) keys.push(entry.key);
+    }
+    for (const key of keys) {
+      await this.transferKey(op, fromDisk, key, toDisk, `${toPrefix}${key.slice(fromPrefix.length)}`);
+    }
   }
   async listUploads(filter) {
     if (!this.uploads || typeof this.uploads.list !== "function") return {
@@ -965,7 +892,7 @@ var MediaConsoleService = class _MediaConsoleService {
     if (!this.store || typeof this.store.list !== "function") return {
       records: []
     };
-    const page = await this.store.list({
+    const page2 = await this.store.list({
       ...filter.collection ? {
         collection: filter.collection
       } : {},
@@ -979,9 +906,9 @@ var MediaConsoleService = class _MediaConsoleService {
       } : {}
     });
     return {
-      records: page.records.map(mapRecord),
-      ...page.cursor ? {
-        cursor: page.cursor
+      records: page2.records.map(mapRecord),
+      ...page2.cursor ? {
+        cursor: page2.cursor
       } : {}
     };
   }
@@ -990,8 +917,8 @@ var MediaConsoleService = class _MediaConsoleService {
     const record = await this.store.find(id);
     if (!record) throw new import_common2.NotFoundException(`Unknown media record: ${id}`);
     const variants = await Promise.all(Object.entries(record.conversions).map(async ([name, conversion]) => {
-      const driver = this.storage?.diskNames().includes(conversion.disk) ? this.storage.disk(conversion.disk) : null;
-      const url = driver ? await this.objectUrl(driver, conversion.disk, conversion.path) : "";
+      const disk = this.storage?.names().includes(conversion.disk) ? this.storage.disk(conversion.disk) : null;
+      const url = disk ? await this.objectUrl(disk, conversion.disk, conversion.path).catch(() => "") : "";
       return {
         name,
         url,
@@ -1012,7 +939,7 @@ var MediaConsoleService = class _MediaConsoleService {
     return {
       hasStore: this.store !== null && typeof this.store.list === "function",
       hasUploads: this.uploads !== null && typeof this.uploads.list === "function",
-      disks: this.storage ? this.storage.diskNames().length : 0,
+      disks: this.storage ? this.storage.names().length : 0,
       actions: this.actionsEnabled === true
     };
   }
@@ -1020,7 +947,7 @@ var MediaConsoleService = class _MediaConsoleService {
 MediaConsoleService = _ts_decorate2([
   (0, import_common2.Injectable)(),
   _ts_param2(0, (0, import_common2.Optional)()),
-  _ts_param2(0, (0, import_common2.Inject)(MEDIA_STORAGE_SHARED)),
+  _ts_param2(0, (0, import_common2.Inject)(import_storage.Storage)),
   _ts_param2(1, (0, import_common2.Optional)()),
   _ts_param2(1, (0, import_common2.Inject)(MEDIA_STORE)),
   _ts_param2(2, (0, import_common2.Optional)()),
@@ -1031,6 +958,8 @@ MediaConsoleService = _ts_decorate2([
   _ts_param2(4, (0, import_common2.Inject)(MEDIA_CONSOLE_OBJECT_INSIGHTS)),
   _ts_param2(5, (0, import_common2.Optional)()),
   _ts_param2(5, (0, import_common2.Inject)(MEDIA_CONSOLE_OBJECT_URLS)),
+  _ts_param2(6, (0, import_common2.Optional)()),
+  _ts_param2(6, (0, import_common2.Inject)(MEDIA_MULTIPART)),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
     Object,
@@ -1038,6 +967,7 @@ MediaConsoleService = _ts_decorate2([
     Object,
     Object,
     Object,
+    Object,
     Object
   ])
 ], MediaConsoleService);
@@ -1095,10 +1025,12 @@ var MediaConsoleActionsController = class {
   /**
   * Uploads a file to `key` on the disk. The body is the raw bytes sent as `application/octet-stream`
   * so the host's JSON/urlencoded body parsers never consume the stream; the real MIME rides as the
-  * `type` query param and becomes the stored object's Content-Type. `@Req()` is the request stream.
+  * `type` query param and becomes the stored object's Content-Type. `@Req()` is the request stream,
+  * streamed onto the disk (no size cap, nothing buffered).
   */
   uploadObject(disk, key, request, type) {
-    return this.service.putObject(disk, key, request, type);
+    const declared = Number(request.headers?.["content-length"]);
+    return this.service.putObject(disk, key, request, type, Number.isSafeInteger(declared) && declared >= 0 ? declared : void 0);
   }
   createFolder(disk, body) {
     return this.service.createFolder(disk, body.prefix);
@@ -1184,7 +1116,7 @@ _ts_decorate3([
   _ts_metadata3("design:paramtypes", [
     String,
     String,
-    typeof Readable === "undefined" ? Object : Readable,
+    Object,
     String
   ]),
   _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
@@ -1234,7 +1166,7 @@ _ts_decorate3([
   _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleActionsController.prototype, "deleteLibraryRecord", null);
 MediaConsoleActionsController = _ts_decorate3([
-  (0, import_common3.UseGuards)(MediaConsoleGuard),
+  OpenToAuthorization(),
   (0, import_common3.Controller)(),
   _ts_param3(0, (0, import_common3.Inject)(MediaConsoleService)),
   _ts_metadata3("design:type", Function),
@@ -1243,229 +1175,19 @@ MediaConsoleActionsController = _ts_decorate3([
   ])
 ], MediaConsoleActionsController);
 
-// src/server/media-console-auth.controller.ts
-var import_common4 = require("@nestjs/common");
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata4(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-var MediaConsoleAuthController = class _MediaConsoleAuthController {
-  static {
-    __name(this, "MediaConsoleAuthController");
-  }
-  auth;
-  cookiePath;
-  logger = new import_common4.Logger(_MediaConsoleAuthController.name);
-  /** One warn per hook kind, so a flaky hook doesn't spam logs every request. */
-  warnedHooks = /* @__PURE__ */ new Set();
-  constructor(auth, cookiePath) {
-    this.auth = auth;
-    this.cookiePath = cookiePath;
-  }
-  me(request) {
-    if (!this.auth) return {
-      authRequired: false
-    };
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    const session = cookieValue !== void 0 ? verifySessionCookie(cookieValue, {
-      secret: this.auth.secret
-    }) : null;
-    if (!session) throw new import_common4.UnauthorizedException({
-      auth: {
-        modes: this.auth.modes
-      }
-    });
-    return {
-      user: {
-        id: session.sub,
-        ...session.name !== void 0 ? {
-          name: session.name
-        } : {},
-        roles: session.roles
-      }
-    };
-  }
-  async login(body, request, response) {
-    const auth = this.requireAuth();
-    if (!auth.login) throw new import_common4.NotFoundException();
-    if (typeof body?.username !== "string" || typeof body?.password !== "string") {
-      throw new import_common4.BadRequestException("Body must include string `username` and `password`.");
-    }
-    const username = body.username;
-    const password = body.password;
-    const user = await this.runHook("login", () => auth.login?.(username, password) ?? null);
-    if (!user) throw new import_common4.UnauthorizedException({
-      message: "Invalid credentials"
-    });
-    return this.mint(user, request, response);
-  }
-  async session(request, response) {
-    const auth = this.requireAuth();
-    if (!auth.session) throw new import_common4.NotFoundException();
-    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
-    if (!user) throw new import_common4.UnauthorizedException();
-    return this.mint(user, request, response);
-  }
-  logout(request, response) {
-    clearSessionCookie({
-      cookiePath: this.cookiePath ?? "/",
-      request,
-      response
-    });
-  }
-  requireAuth() {
-    if (!this.auth) throw new import_common4.NotFoundException();
-    return this.auth;
-  }
-  mint(user, request, response) {
-    const auth = this.requireAuth();
-    issueSessionCookie(user, {
-      auth,
-      cookiePath: this.cookiePath ?? "/",
-      request,
-      response
-    });
-    return {
-      user: {
-        id: user.id,
-        ...user.name !== void 0 ? {
-          name: user.name
-        } : {},
-        roles: user.roles ?? []
-      }
-    };
-  }
-  /** Run a host hook defensively: a throw is a denial (null), warn-logged once per kind. */
-  async runHook(kind, run) {
-    try {
-      return await run() ?? null;
-    } catch (error) {
-      if (!this.warnedHooks.has(kind)) {
-        this.warnedHooks.add(kind);
-        this.logger.warn(`Console auth ${kind} hook threw; treating as denial. ${String(error)}`);
-      }
-      return null;
-    }
-  }
-};
-_ts_decorate4([
-  (0, import_common4.Get)("me"),
-  _ts_param4(0, (0, import_common4.Req)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object
-  ]),
-  _ts_metadata4("design:returntype", typeof MeResponse === "undefined" ? Object : MeResponse)
-], MediaConsoleAuthController.prototype, "me", null);
-_ts_decorate4([
-  (0, import_common4.Post)("login"),
-  (0, import_common4.HttpCode)(200),
-  _ts_param4(0, (0, import_common4.Body)()),
-  _ts_param4(1, (0, import_common4.Req)()),
-  _ts_param4(2, (0, import_common4.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof LoginBody === "undefined" ? Object : LoginBody,
-    Object,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], MediaConsoleAuthController.prototype, "login", null);
-_ts_decorate4([
-  (0, import_common4.Post)("session"),
-  (0, import_common4.HttpCode)(200),
-  _ts_param4(0, (0, import_common4.Req)()),
-  _ts_param4(1, (0, import_common4.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], MediaConsoleAuthController.prototype, "session", null);
-_ts_decorate4([
-  (0, import_common4.Post)("logout"),
-  (0, import_common4.HttpCode)(204),
-  _ts_param4(0, (0, import_common4.Req)()),
-  _ts_param4(1, (0, import_common4.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", void 0)
-], MediaConsoleAuthController.prototype, "logout", null);
-MediaConsoleAuthController = _ts_decorate4([
-  (0, import_common4.Controller)(),
-  _ts_param4(0, (0, import_common4.Optional)()),
-  _ts_param4(0, (0, import_common4.Inject)(MEDIA_CONSOLE_AUTH)),
-  _ts_param4(1, (0, import_common4.Optional)()),
-  _ts_param4(1, (0, import_common4.Inject)(MEDIA_CONSOLE_COOKIE_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    Object
-  ])
-], MediaConsoleAuthController);
-
 // src/server/media-console-read.controller.ts
-var import_common5 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 
 // src/server/content-disposition.ts
 var FALLBACK_FILENAME = "download";
-var ATTR_CHAR = /^[A-Za-z0-9!#$&+\-.^_`|~]$/;
-function toExtValue(name) {
-  let encoded = "";
-  for (const byte of new TextEncoder().encode(name)) {
-    const char = String.fromCharCode(byte);
-    encoded += ATTR_CHAR.test(char) ? char : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
-  }
-  return encoded;
-}
-__name(toExtValue, "toExtValue");
 function downloadFilename(key) {
   const segment = key.split("/").pop() ?? "";
   return segment.trim() === "" ? FALLBACK_FILENAME : segment;
 }
 __name(downloadFilename, "downloadFilename");
-function attachmentDisposition(filename) {
-  const name = filename.trim() === "" ? FALLBACK_FILENAME : filename;
-  const ascii = name.replace(/[^\x20-\x7E]/g, "").replace(/["\\]/g, "").trim();
-  const quoted = ascii === "" ? FALLBACK_FILENAME : ascii;
-  return `attachment; filename="${quoted}"; filename*=UTF-8''${toExtValue(name)}`;
-}
-__name(attachmentDisposition, "attachmentDisposition");
 
 // src/server/media-console-read.controller.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1478,62 +1200,25 @@ function _ts_decorate5(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata5(metadataKey, metadataValue) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param5, "_ts_param");
+__name(_ts_param4, "_ts_param");
 function toLimit(value) {
   if (value === void 0) return void 0;
   const parsed = Number(value);
   return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : void 0;
 }
 __name(toLimit, "toLimit");
-var SINGLE_BYTE_RANGE = /^bytes=(\d*)-(\d*)$/;
-function parseRangeHeader(header) {
-  if (header === void 0) return null;
-  const match = SINGLE_BYTE_RANGE.exec(header.trim());
-  if (!match) return null;
-  const startText = match[1] ?? "";
-  const endText = match[2] ?? "";
-  if (startText === "" && endText === "") return null;
-  if (startText === "") return {
-    suffixLength: Number(endText)
-  };
-  const start = Number(startText);
-  return endText === "" ? {
-    start
-  } : {
-    start,
-    end: Number(endText)
-  };
-}
-__name(parseRangeHeader, "parseRangeHeader");
-function setHeader(response, name, value) {
-  if (typeof response.setHeader === "function") {
-    response.setHeader(name, value);
-    return;
-  }
-  if (typeof response.raw?.setHeader === "function") response.raw.setHeader(name, value);
-}
-__name(setHeader, "setHeader");
-function setStatus(response, code) {
-  if (typeof response.status === "function") {
-    response.status(code);
-    return;
-  }
-  if (response.raw) response.raw.statusCode = code;
-  else response.statusCode = code;
-}
-__name(setStatus, "setStatus");
 var MediaConsoleReadController = class {
   static {
     __name(this, "MediaConsoleReadController");
@@ -1568,63 +1253,29 @@ var MediaConsoleReadController = class {
     return this.service.objectInsights(disk, key);
   }
   /**
-  * Streams the object's bytes inline (Content-Disposition: inline) from the same origin, so the SPA
-  * can render text/PDF previews the browser would otherwise download, and read text past CORS.
+  * Streams the object's bytes from the same origin (`serveFile()`), so the SPA can render previews
+  * past CORS: `inline` for types that can't run script here (images, PDF, audio, video, plain
+  * text), `attachment` for the rest — the text previews read the body with `fetch`, which doesn't
+  * care. A single `Range` gets a 206, which is how SQLite/ZIP/Parquet previews read a few KB out
+  * of a multi-hundred-MB object.
   */
-  objectRaw(disk, key, rangeHeader, response) {
-    return this.streamObject(disk, key, rangeHeader, response, "inline");
-  }
-  /**
-  * The same bytes as `/raw`, but as a SAVE rather than a render: `Content-Disposition: attachment`
-  * with the object's own name on it.
-  *
-  * Its own route rather than a flag on `/raw` because `/raw` is load-bearing for every preview —
-  * they depend on `inline`, and a disposition that varied by query param would be one wrong link
-  * away from a PDF preview turning into a download.
-  *
-  * Same-origin and unconditional, deliberately: this is the console's own action, so it must work
-  * on a host whose browser cannot reach the object store at all (no route to S3, no CORS grant).
-  * That is exactly where `objectDetail`'s presigned `url` — a link to share, not a way to fetch —
-  * is useless. See the `objectUrls` option.
-  */
-  objectDownload(disk, key, rangeHeader, response) {
-    return this.streamObject(disk, key, rangeHeader, response, attachmentDisposition(downloadFilename(key ?? "")));
+  objectRaw(disk, key, req, res) {
+    return this.service.serveObject(disk, key, {
+      req,
+      res,
+      disposition: "inline"
+    });
   }
   /**
-  * Stream an object under the given `Content-Disposition`, honouring a single-range `Range` header
-  * — which is what lets a reader pull a few KB out of a multi-hundred-MB object (a SQLite page, a
-  * ZIP's central directory) instead of the whole file, and what lets a browser resume an
-  * interrupted download of one. With no `Range` the response is a plain 200 full body, which the
-  * PDF/text/spreadsheet previews depend on.
+  * The same bytes as `/raw`, but as a SAVE: `Content-Disposition: attachment` with the object's
+  * own name. Same-origin and unconditional, so it works where the browser can't reach the store.
   */
-  async streamObject(disk, key, rangeHeader, response, disposition) {
-    const requested = parseRangeHeader(rangeHeader);
-    setHeader(response, "Accept-Ranges", "bytes");
-    let result;
-    try {
-      result = await this.service.objectStream(disk, key, requested ?? void 0);
-    } catch (error) {
-      if (error instanceof RangeNotSatisfiableException) {
-        setHeader(response, "Content-Range", `bytes */${error.size}`);
-      }
-      throw error;
-    }
-    const { stream, contentType, size, range } = result;
-    if (!range) {
-      return new import_common5.StreamableFile(stream, {
-        type: contentType,
-        disposition,
-        ...Number.isFinite(size) ? {
-          length: size
-        } : {}
-      });
-    }
-    setStatus(response, 206);
-    setHeader(response, "Content-Range", `bytes ${range.start}-${range.end}/${size}`);
-    return new import_common5.StreamableFile(stream, {
-      type: contentType,
-      disposition,
-      length: range.end - range.start + 1
+  objectDownload(disk, key, req, res) {
+    return this.service.serveObject(disk, key, {
+      req,
+      res,
+      disposition: "attachment",
+      filename: downloadFilename(key ?? "")
     });
   }
   uploads(disk, prefix) {
@@ -1667,151 +1318,151 @@ var MediaConsoleReadController = class {
     return this.service.topology();
   }
 };
-_ts_decorate5([
-  (0, import_common5.Get)("disks"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", typeof DiskListResponse === "undefined" ? Object : DiskListResponse)
+_ts_decorate4([
+  (0, import_common4.Get)("disks"),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "disks", null);
-_ts_decorate5([
-  (0, import_common5.Get)("disks/:disk/objects"),
-  _ts_param5(0, (0, import_common5.Param)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("prefix")),
-  _ts_param5(2, (0, import_common5.Query)("cursor")),
-  _ts_param5(3, (0, import_common5.Query)("limit")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("disks/:disk/objects"),
+  _ts_param4(0, (0, import_common4.Param)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("prefix")),
+  _ts_param4(2, (0, import_common4.Query)("cursor")),
+  _ts_param4(3, (0, import_common4.Query)("limit")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objects", null);
-_ts_decorate5([
-  (0, import_common5.Get)("disks/:disk/object"),
-  _ts_param5(0, (0, import_common5.Param)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("key")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("disks/:disk/object"),
+  _ts_param4(0, (0, import_common4.Param)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("key")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "object", null);
-_ts_decorate5([
-  (0, import_common5.Get)("disks/:disk/object/insights"),
-  _ts_param5(0, (0, import_common5.Param)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("key")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("disks/:disk/object/insights"),
+  _ts_param4(0, (0, import_common4.Param)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("key")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objectInsights", null);
-_ts_decorate5([
-  (0, import_common5.Get)("disks/:disk/object/raw"),
-  _ts_param5(0, (0, import_common5.Param)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("key")),
-  _ts_param5(2, (0, import_common5.Headers)("range")),
-  _ts_param5(3, (0, import_common5.Res)({
+_ts_decorate4([
+  (0, import_common4.Get)("disks/:disk/object/raw"),
+  _ts_param4(0, (0, import_common4.Param)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("key")),
+  _ts_param4(2, (0, import_common4.Req)()),
+  _ts_param4(3, (0, import_common4.Res)({
     passthrough: true
   })),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String,
     Object,
-    typeof ConsoleHttpResponse === "undefined" ? Object : ConsoleHttpResponse
+    Object
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objectRaw", null);
-_ts_decorate5([
-  (0, import_common5.Get)("disks/:disk/object/download"),
-  _ts_param5(0, (0, import_common5.Param)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("key")),
-  _ts_param5(2, (0, import_common5.Headers)("range")),
-  _ts_param5(3, (0, import_common5.Res)({
+_ts_decorate4([
+  (0, import_common4.Get)("disks/:disk/object/download"),
+  _ts_param4(0, (0, import_common4.Param)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("key")),
+  _ts_param4(2, (0, import_common4.Req)()),
+  _ts_param4(3, (0, import_common4.Res)({
     passthrough: true
   })),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String,
     Object,
-    typeof ConsoleHttpResponse === "undefined" ? Object : ConsoleHttpResponse
+    Object
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "objectDownload", null);
-_ts_decorate5([
-  (0, import_common5.Get)("uploads"),
-  _ts_param5(0, (0, import_common5.Query)("disk")),
-  _ts_param5(1, (0, import_common5.Query)("prefix")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("uploads"),
+  _ts_param4(0, (0, import_common4.Query)("disk")),
+  _ts_param4(1, (0, import_common4.Query)("prefix")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "uploads", null);
-_ts_decorate5([
-  (0, import_common5.Get)("uploads/:id"),
-  _ts_param5(0, (0, import_common5.Param)("id")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("uploads/:id"),
+  _ts_param4(0, (0, import_common4.Param)("id")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "upload", null);
-_ts_decorate5([
-  (0, import_common5.Get)("library/collections"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+_ts_decorate4([
+  (0, import_common4.Get)("library/collections"),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "collections", null);
-_ts_decorate5([
-  (0, import_common5.Get)("library"),
-  _ts_param5(0, (0, import_common5.Query)("collection")),
-  _ts_param5(1, (0, import_common5.Query)("disk")),
-  _ts_param5(2, (0, import_common5.Query)("cursor")),
-  _ts_param5(3, (0, import_common5.Query)("limit")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("library"),
+  _ts_param4(0, (0, import_common4.Query)("collection")),
+  _ts_param4(1, (0, import_common4.Query)("disk")),
+  _ts_param4(2, (0, import_common4.Query)("cursor")),
+  _ts_param4(3, (0, import_common4.Query)("limit")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String,
     String,
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "library", null);
-_ts_decorate5([
-  (0, import_common5.Get)("library/:id"),
-  _ts_param5(0, (0, import_common5.Param)("id")),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common4.Get)("library/:id"),
+  _ts_param4(0, (0, import_common4.Param)("id")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata5("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata4("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], MediaConsoleReadController.prototype, "libraryRecord", null);
-_ts_decorate5([
-  (0, import_common5.Get)("topology"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", typeof Topology === "undefined" ? Object : Topology)
+_ts_decorate4([
+  (0, import_common4.Get)("topology"),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", []),
+  _ts_metadata4("design:returntype", typeof Topology === "undefined" ? Object : Topology)
 ], MediaConsoleReadController.prototype, "topology", null);
-MediaConsoleReadController = _ts_decorate5([
-  (0, import_common5.UseGuards)(MediaConsoleGuard),
-  (0, import_common5.Controller)(),
-  _ts_param5(0, (0, import_common5.Inject)(MediaConsoleService)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+MediaConsoleReadController = _ts_decorate4([
+  OpenToAuthorization(),
+  (0, import_common4.Controller)(),
+  _ts_param4(0, (0, import_common4.Inject)(MediaConsoleService)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof MediaConsoleService === "undefined" ? Object : MediaConsoleService
   ])
 ], MediaConsoleReadController);
 
 // src/server/media-console-api.module.ts
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1824,81 +1475,57 @@ function _ts_decorate6(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-var READ_BASE_GUARDS = baseGuards(MediaConsoleReadController);
-var ACTIONS_BASE_GUARDS = baseGuards(MediaConsoleActionsController);
+__name(_ts_decorate5, "_ts_decorate");
 var MediaConsoleApiModule = class _MediaConsoleApiModule {
   static {
     __name(this, "MediaConsoleApiModule");
   }
   static register(options) {
-    stampGuards(options.guards, [
-      [
-        MediaConsoleReadController,
-        READ_BASE_GUARDS
-      ],
-      [
-        MediaConsoleActionsController,
-        ACTIONS_BASE_GUARDS
-      ]
-    ]);
     return {
       module: _MediaConsoleApiModule,
       imports: options.imports ?? [],
-      controllers: [
-        MediaConsoleReadController,
-        MediaConsoleAuthController,
+      controllers: options.routes === false ? [] : [
+        consoleController(MediaConsoleReadController, options.decorators),
         ...options.actions ? [
-          MediaConsoleActionsController
+          consoleController(MediaConsoleActionsController, options.decorators)
         ] : []
       ],
       providers: [
         MediaConsoleService,
-        MediaConsoleGuard,
+        consoleAuthorizeProvider(options.authorize, options.moduleName ?? "MediaConsoleApiModule.register()"),
         {
           provide: MEDIA_DASHBOARD_ACTIONS,
           useValue: options.actions
         },
-        {
-          provide: MEDIA_CONSOLE_COOKIE_PATH,
-          useValue: options.cookiePath
-        },
         {
           provide: MEDIA_CONSOLE_OBJECT_URLS,
           useValue: options.objectUrls
         },
-        options.authProvider,
         options.insightsProvider ?? {
           provide: MEDIA_CONSOLE_OBJECT_INSIGHTS,
           useValue: []
-        },
-        // Class guards need a DI provider so Nest can instantiate them in THIS module's context
-        // (where `imports` above resolves their dependencies). An already-instantiated guard needs
-        // none — it's used as-is.
-        ...(options.guards ?? []).filter(isGuardClass)
+        }
       ],
-      // MEDIA_CONSOLE_AUTH is exported (not just provided) because MediaDashboardUiController —
-      // hosted in MediaDashboardModule, which imports THIS module — reads it to decide whether to
-      // hand an unauthenticated navigation to the host's `unauthenticatedPage`. Exporting keeps the
-      // single `authProvider` instance shared; re-providing the same factory in both modules would
-      // run a `forRootAsync` host's `useAuth` twice.
+      // For a host mounting the controllers itself (`routes: false`): its subclasses inject these, and
+      // `ConsoleAuthorizeGuard` injects the resolved `authorize` check.
       exports: [
         MediaConsoleService,
-        MEDIA_CONSOLE_AUTH
+        MEDIA_DASHBOARD_ACTIONS,
+        CONSOLE_AUTHORIZE_DECIDE
       ]
     };
   }
 };
-MediaConsoleApiModule = _ts_decorate6([
-  (0, import_common6.Module)({})
+MediaConsoleApiModule = _ts_decorate5([
+  (0, import_common5.Module)({})
 ], MediaConsoleApiModule);
 
 // src/server/media-dashboard-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common7 = require("@nestjs/common");
-function _ts_decorate7(decorators, target, key, desc) {
+var import_common6 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1911,19 +1538,19 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param5, "_ts_param");
 var BUILD_BASE = "/media";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", importMetaUrl));
@@ -1938,129 +1565,75 @@ var CONTENT_TYPES = {
   ".woff2": "font/woff2",
   ".ico": "image/x-icon"
 };
-var MediaDashboardUiController = class _MediaDashboardUiController {
+var MediaDashboardUiController = class {
   static {
     __name(this, "MediaDashboardUiController");
   }
   basePath;
   apiBasePath;
-  auth;
   dir = spaDir();
-  logger = new import_common7.Logger(_MediaDashboardUiController.name);
-  warned = false;
-  constructor(basePath, apiBasePath, auth = null) {
+  constructor(basePath, apiBasePath) {
     this.basePath = basePath;
     this.apiBasePath = apiBasePath;
-    this.auth = auth;
   }
   // index.html references hash-named bundles, so it MUST NOT be cached (stale bundle = "stuck
-  // loading after a deploy"). The hashed assets below are immutable. `sendHtml` sets both headers;
-  // they are no longer `@Header` decorators because this route is now non-passthrough (see below).
-  //
-  // Non-passthrough `@Res()` so a host's `auth.unauthenticatedPage` can OWN the response and serve
-  // its own page in place of the SPA. Without a hook this behaves exactly as before: the shell is
-  // served to everyone, and the SPA's own auth screen renders once its API calls come back 401.
-  async index(req, res) {
-    if (await this.serveUnauthenticatedPage(req, res)) return;
+  // loading after a deploy"). The hashed assets below are immutable.
+  index() {
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common7.NotFoundException("Console SPA is not built. Run the package build.");
+      throw new import_common6.NotFoundException("Console SPA is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__MEDIA_BASE__='${this.basePath}';window.__MEDIA_API__='${this.apiBasePath}';</script>`;
-    sendHtml(res, 200, html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html);
-  }
-  /**
-  * Hand the response to the host's `unauthenticatedPage` when this navigation has no valid session.
-  * Returns `true` when the host wrote a page (the caller must not also serve the SPA).
-  *
-  * Mode-A-only, deliberately: with `login` configured the SPA's own login form is the way in, so
-  * replacing the shell would lock a Mode B host out of its own console.
-  */
-  async serveUnauthenticatedPage(req, res) {
-    const auth = this.auth;
-    const hook = auth?.unauthenticatedPage;
-    if (!auth || !hook) return false;
-    if (auth.modes.includes("login")) return false;
-    if (this.hasValidSession(auth, req)) return false;
-    try {
-      await hook({
-        request: req,
-        response: res,
-        basePath: this.basePath
-      });
-      if (responseAlreadyWritten(res)) return true;
-      this.warnOnce("auth.unauthenticatedPage returned without writing a response; serving the console SPA instead. The hook must write AND end the response it is given.");
-    } catch (error) {
-      this.warnOnce(`auth.unauthenticatedPage threw; serving the console SPA instead. ${String(error)}`);
-      if (responseAlreadyWritten(res)) return true;
-    }
-    return false;
-  }
-  hasValidSession(auth, req) {
-    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return false;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    }) !== null;
-  }
-  /** Once per process, not once per request: a broken hook fires on every unauthenticated visit. */
-  warnOnce(message) {
-    if (this.warned) return;
-    this.warned = true;
-    this.logger.warn(message);
+    return html.includes("</head>") ? html.replace("</head>", `${inject}</head>`) : inject + html;
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common7.NotFoundException();
+    if (safe !== file) throw new import_common6.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common7.NotFoundException();
+      throw new import_common6.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common7.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate7([
-  (0, import_common7.Get)(),
-  _ts_param6(0, (0, import_common7.Req)()),
-  _ts_param6(1, (0, import_common7.Res)()),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata6("design:returntype", Promise)
+_ts_decorate6([
+  (0, import_common6.Get)(),
+  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", String)
 ], MediaDashboardUiController.prototype, "index", null);
-_ts_decorate7([
-  (0, import_common7.Get)("assets/:file"),
-  (0, import_common7.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param6(0, (0, import_common7.Param)("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+_ts_decorate6([
+  (0, import_common6.Get)("assets/:file"),
+  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param5(0, (0, import_common6.Param)("file")),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof import_common7.StreamableFile === "undefined" ? Object : import_common7.StreamableFile)
+  _ts_metadata5("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
 ], MediaDashboardUiController.prototype, "asset", null);
-MediaDashboardUiController = _ts_decorate7([
-  (0, import_common7.Controller)(),
-  _ts_param6(0, (0, import_common7.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
-  _ts_param6(1, (0, import_common7.Inject)(MEDIA_DASHBOARD_API_PATH)),
-  _ts_param6(2, (0, import_common7.Optional)()),
-  _ts_param6(2, (0, import_common7.Inject)(MEDIA_CONSOLE_AUTH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    String,
+MediaDashboardUiController = _ts_decorate6([
+  OpenToAuthorization(),
+  ConsolePage(),
+  (0, import_common6.Controller)(),
+  _ts_param5(0, (0, import_common6.Inject)(MEDIA_DASHBOARD_BASE_PATH)),
+  _ts_param5(1, (0, import_common6.Inject)(MEDIA_DASHBOARD_API_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     String,
-    Object
+    String
   ])
 ], MediaDashboardUiController);
 
 // src/server/media-dashboard.module.ts
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2073,7 +1646,7 @@ function _ts_decorate8(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
+__name(_ts_decorate7, "_ts_decorate");
 function normalize(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
 }
@@ -2083,39 +1656,25 @@ var MediaDashboardModule = class _MediaDashboardModule {
     __name(this, "MediaDashboardModule");
   }
   static forRoot(options = {}) {
-    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
-    return _MediaDashboardModule.build(options, apiBasePath, {
-      provide: MEDIA_CONSOLE_AUTH,
-      useValue: resolveConsoleAuth(options.auth)
-    }, {
+    return _MediaDashboardModule.build("MediaDashboardModule.forRoot()", options, {
       provide: MEDIA_CONSOLE_OBJECT_INSIGHTS,
       useValue: options.objectInsights ?? []
-    }, options.imports);
+    });
   }
-  static forRootAsync(options) {
-    const apiBasePath = normalize(options.apiBasePath ?? `${normalize(options.basePath ?? "/media")}/api`);
-    const authProvider = {
-      provide: MEDIA_CONSOLE_AUTH,
-      inject: options.inject ?? [],
-      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveConsoleAuth(await options.useAuth(...deps)), "useFactory")
-    };
-    const insightsProvider = {
+  static forRootAsync(options = {}) {
+    return _MediaDashboardModule.build("MediaDashboardModule.forRootAsync()", options, {
       provide: MEDIA_CONSOLE_OBJECT_INSIGHTS,
-      inject: options.injectObjectInsights ?? options.inject ?? [],
+      inject: options.inject ?? [],
       useFactory: /* @__PURE__ */ __name(async (...deps) => options.useObjectInsights === void 0 ? [] : await options.useObjectInsights(...deps), "useFactory")
-    };
-    return _MediaDashboardModule.build(options, apiBasePath, authProvider, insightsProvider, options.imports);
+    });
   }
-  /** Shared wiring: static routing + the API module, with `auth` supplied by the given provider. */
-  static build(options, apiBasePath, authProvider, insightsProvider, imports) {
+  /** Shared wiring: static routing + the API module, with the insights from the given provider. */
+  static build(name, options, insightsProvider) {
     const basePath = normalize(options.basePath ?? "/media");
+    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     const actions = options.actions === true;
-    stampGuards(options.guards, [
-      [
-        MediaDashboardUiController,
-        []
-      ]
-    ]);
+    const mount = options.routes !== false;
+    const imports = options.imports;
     return {
       module: _MediaDashboardModule,
       imports: [
@@ -2126,38 +1685,33 @@ var MediaDashboardModule = class _MediaDashboardModule {
             strategy: options.objectUrls ?? "auto",
             apiBasePath
           },
-          // `Path=/`, deliberately NOT scoped to `apiBasePath` (nor to `basePath`): the two mounts
-          // are independently configurable and can live at unrelated paths (e.g. a `/media` UI
-          // with a `/api/media/console` API). Scoped to the API base, the browser withheld the
-          // cookie on the full-page navigation to `basePath`, so the freshly minted session could
-          // not open the console it was minted for — the launcher landed on the unauthenticated
-          // page. Scoping to `basePath` instead would just move the failure to the API calls.
-          // The cookie is HttpOnly + signed + short-lived, so the broader scope is a reasonable
-          // trade for being correct in any mount configuration. Matches nestjs-durable-dashboard
-          // and nestjs-agent-dashboard; telescope can scope to its mount because its UI and API
-          // always share one root.
-          cookiePath: "/",
-          authProvider,
           insightsProvider,
           imports,
-          ...options.guards ? {
-            guards: options.guards
-          } : {}
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
+          } : {},
+          moduleName: name,
+          ...options.decorators ? {
+            decorators: options.decorators
+          } : {},
+          routes: mount
         }),
-        import_core.RouterModule.register([
-          {
-            path: basePath,
-            module: _MediaDashboardModule
-          },
-          {
-            path: apiBasePath,
-            module: MediaConsoleApiModule
-          }
-        ])
-      ],
-      controllers: [
-        MediaDashboardUiController
+        ...mount ? [
+          import_core2.RouterModule.register([
+            {
+              path: basePath,
+              module: _MediaDashboardModule
+            },
+            {
+              path: apiBasePath,
+              module: MediaConsoleApiModule
+            }
+          ])
+        ] : []
       ],
+      controllers: mount ? [
+        consoleController(MediaDashboardUiController, options.decorators)
+      ] : [],
       providers: [
         {
           provide: MEDIA_DASHBOARD_BASE_PATH,
@@ -2166,28 +1720,44 @@ var MediaDashboardModule = class _MediaDashboardModule {
         {
           provide: MEDIA_DASHBOARD_API_PATH,
           useValue: apiBasePath
-        },
-        // MediaDashboardUiController is hosted HERE, so its guards DI-instantiate from this
-        // module — class guards need a provider; an already-instantiated guard needs none.
-        ...(options.guards ?? []).filter(isGuardClass)
+        }
       ],
-      // Re-export the API module so its MediaConsoleService reaches importers if they want it.
+      // Re-export the API module so its MediaConsoleService reaches importers if they want it; the
+      // resolved paths too, so a host mounting the controllers itself (`routes: false`) can extend
+      // `MediaDashboardUiController` in a module of its own.
       exports: [
-        MediaConsoleApiModule
+        MediaConsoleApiModule,
+        MEDIA_DASHBOARD_BASE_PATH,
+        MEDIA_DASHBOARD_API_PATH
       ]
     };
   }
 };
-MediaDashboardModule = _ts_decorate8([
-  (0, import_common8.Module)({})
+MediaDashboardModule = _ts_decorate7([
+  (0, import_common7.Module)({})
 ], MediaDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  MEDIA_STORAGE_SHARED,
+  CONSOLE_AUTHORIZE_DECIDE,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
+  MEDIA_MULTIPART,
   MEDIA_STORE,
   MEDIA_UPLOAD_SESSIONS,
+  MediaConsoleActionsController,
   MediaConsoleApiModule,
+  MediaConsoleReadController,
   MediaConsoleService,
-  MediaDashboardModule
+  MediaDashboardModule,
+  MediaDashboardUiController,
+  UseConsoleAuthorize,
+  authorizeByToken,
+  normalizeConsoleResult,
+  resolveConsoleAuthorize
 });
 //# sourceMappingURL=index.cjs.map