@dudousxd/nestjs-agent-dashboard 0.13.1 → 0.14.1

package/dist/server/index.d.cts

@@ -1,4 +1,4 @@
-import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ToolStatRow, ThreadActivityRow, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
+import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ApprovalWhere, GovernanceRunDetail, GovernanceThreadDetailQuery, GovernanceThreadDetail, ThreadActivityRow, ToolStatRow, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
 export { ActorDirectory } from '@dudousxd/nestjs-agent-core';
 import { Observable } from 'rxjs';
 import { DynamicModule, Type, CanActivate, Provider, InjectionToken, OptionalFactoryDependency, StreamableFile } from '@nestjs/common';
@@ -10,6 +10,18 @@ interface WithActorLabel {
 type ActorSpendRowWithLabel = ActorSpendRow & WithActorLabel;
 type ThreadSpendRowWithLabel = ThreadSpendRow & WithActorLabel;
 type ThreadActivityRowWithLabel = ThreadActivityRow & WithActorLabel;
+/**
+ * `GET <api>/runs/:runId` — a run drill-down with the owning thread's `actorLabel` resolved, the
+ * same way {@link threadsPage} labels its rows. The run row itself stays unlabeled, matching every
+ * other run surface in this console.
+ */
+type RunDetailWithLabel = Omit<GovernanceRunDetail, 'thread'> & {
+    thread: GovernanceRunDetail['thread'] & WithActorLabel;
+};
+/** `GET <api>/threads/:threadId` — a thread drill-down, actor-labeled like {@link threadsPage}. */
+type ThreadDetailWithLabel = Omit<GovernanceThreadDetail, 'thread'> & {
+    thread: ThreadActivityRowWithLabel;
+};
 /** The spend/usage overview the SPA renders on its headline section (`GET <api>/spend`). */
 interface SpendOverview {
     byModel: ModelSpendRow[];
@@ -65,8 +77,22 @@ declare class DashboardService {
     toolCallsPage(query: GovernancePageQuery<ToolCallWhere>): Promise<GovernancePage<ToolCallActivityRow>>;
     /** Paged, filterable runs for the Reliability recent-runs table. */
     runsPage(query: GovernancePageQuery<RunWhere>): Promise<GovernancePage<RecentRunRow>>;
-    /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
+    /**
+     * Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox.
+     * Capped and totalless — kept because the SPA still calls `GET approvals`; new callers want
+     * {@link approvalsPage}, which reports how much of the backlog the cap hid.
+     */
     pendingApprovals(limit: number): Promise<PendingApprovalRow[]>;
+    /** Paged, filterable approvals inbox with a total — the backlog-safe read of the HITL queue. */
+    approvalsPage(query: GovernancePageQuery<ApprovalWhere>): Promise<GovernancePage<PendingApprovalRow>>;
+    /**
+     * One run with its thread and its tool calls. 404s on an unknown id rather than returning an empty
+     * detail: "this run does not exist" and "this run did nothing" are different answers, and a console
+     * that conflates them sends an operator looking for a bug that isn't there.
+     */
+    runDetail(runId: string): Promise<RunDetailWithLabel>;
+    /** One thread with its usage rollup, runs and messages. 404s on an unknown id, like {@link runDetail}. */
+    threadDetail(query: GovernanceThreadDetailQuery): Promise<ThreadDetailWithLabel>;
     /** Per-tool call/failure/rejection/latency rollup for a day range, for the Tools section. */
     toolStats(range: GovernanceRange): Promise<ToolStatRow[]>;
     /**
@@ -136,6 +162,14 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     runsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<RecentRunRow>>;
+    /**
+     * One run drill-down: the run, its owning thread's headline (actor-labeled) and its tool calls, in
+     * ONE round trip. 404s on an unknown run id.
+     *
+     * Declared AFTER `runs-page` so the literal route wins over this parameterised one regardless of
+     * how the router orders same-prefix paths.
+     */
+    runDetail(runId: string): Promise<RunDetailWithLabel>;
     /** Most recent tool calls (default 50, max 200) for the activity feed. */
     toolCalls(limit?: string): Promise<ToolCallActivityRow[]>;
     /**
@@ -144,8 +178,22 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     toolCallsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ToolCallActivityRow>>;
-    /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
+    /**
+     * Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox.
+     *
+     * Capped with NO total, so a backlog past `limit` is invisible from the response alone. Kept
+     * because the SPA still calls it; anything new should call `approvals-page` instead.
+     */
     approvals(limit?: string): Promise<PendingApprovalRow[]>;
+    /**
+     * Paged, filterable approvals inbox, oldest first. `page` (default 1), `limit` (default 25, max
+     * 200), and `where[toolName]`/`where[threadId]`/`where[actorRef]`/`where[agentName]`/
+     * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+     *
+     * Unlike `GET approvals` this reports `total`, so the console can say "showing N of M" instead of
+     * silently hiding pending decisions behind a row cap.
+     */
+    approvalsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<PendingApprovalRow>>;
     /**
      * Decide a pending HITL tool call. Body `{ approved: boolean; reason?: string }`. 501s (via
      * `DashboardService.decideApproval`) when no `AGENT_APPROVAL_PORT` is bound. `executedByRef`
@@ -170,6 +218,16 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     threadsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ThreadActivityRowWithLabel>>;
+    /**
+     * One thread drill-down: the thread (actor-labeled), its lifetime token/cost rollup, its newest
+     * runs and its newest messages, in ONE round trip. `messages` (default 50, max 200) and `runs`
+     * (default 25, max 200) cap the two lists; `runTotal` and `thread.messageCount` report the true
+     * sizes so the console can say what the caps hid. 404s on an unknown thread id.
+     *
+     * A soft-deleted thread is still returned, flagged `deleted: true` — an audit needs the thread it
+     * just lost, and the alternative is a drill-down that 404s on exactly the interesting case.
+     */
+    threadDetail(threadId: string, messages?: string, runs?: string): Promise<ThreadDetailWithLabel>;
     /**
      * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
      * no `AGENT_PRICING_STORE` is bound.
@@ -636,4 +694,4 @@ declare const DASHBOARD_APPROVAL_ACTOR_REF: unique symbol;
  */
 declare const DASHBOARD_AUTH: unique symbol;
 
-export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, type AgentDashboardAsyncOptions, AgentDashboardAuthController, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, type AuthMode, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_AUTH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type LiveAgentEvent, type LoginHook, type ReliabilityOverview, type ResolvedDashboardAuth, type RevalidateHook, type SessionHook, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadSpendRowWithLabel, type UnauthenticatedPageContext, type UnauthenticatedPageHook, type WithActorLabel, agentDashboardMountPaths, parsePriceInput, resolveDashboardAuth };
+export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, type AgentDashboardAsyncOptions, AgentDashboardAuthController, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, type AuthMode, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_AUTH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type LiveAgentEvent, type LoginHook, type ReliabilityOverview, type ResolvedDashboardAuth, type RevalidateHook, type RunDetailWithLabel, type SessionHook, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadDetailWithLabel, type ThreadSpendRowWithLabel, type UnauthenticatedPageContext, type UnauthenticatedPageHook, type WithActorLabel, agentDashboardMountPaths, parsePriceInput, resolveDashboardAuth };

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ToolStatRow, ThreadActivityRow, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
+import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ApprovalWhere, GovernanceRunDetail, GovernanceThreadDetailQuery, GovernanceThreadDetail, ThreadActivityRow, ToolStatRow, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
 export { ActorDirectory } from '@dudousxd/nestjs-agent-core';
 import { Observable } from 'rxjs';
 import { DynamicModule, Type, CanActivate, Provider, InjectionToken, OptionalFactoryDependency, StreamableFile } from '@nestjs/common';
@@ -10,6 +10,18 @@ interface WithActorLabel {
 type ActorSpendRowWithLabel = ActorSpendRow & WithActorLabel;
 type ThreadSpendRowWithLabel = ThreadSpendRow & WithActorLabel;
 type ThreadActivityRowWithLabel = ThreadActivityRow & WithActorLabel;
+/**
+ * `GET <api>/runs/:runId` — a run drill-down with the owning thread's `actorLabel` resolved, the
+ * same way {@link threadsPage} labels its rows. The run row itself stays unlabeled, matching every
+ * other run surface in this console.
+ */
+type RunDetailWithLabel = Omit<GovernanceRunDetail, 'thread'> & {
+    thread: GovernanceRunDetail['thread'] & WithActorLabel;
+};
+/** `GET <api>/threads/:threadId` — a thread drill-down, actor-labeled like {@link threadsPage}. */
+type ThreadDetailWithLabel = Omit<GovernanceThreadDetail, 'thread'> & {
+    thread: ThreadActivityRowWithLabel;
+};
 /** The spend/usage overview the SPA renders on its headline section (`GET <api>/spend`). */
 interface SpendOverview {
     byModel: ModelSpendRow[];
@@ -65,8 +77,22 @@ declare class DashboardService {
     toolCallsPage(query: GovernancePageQuery<ToolCallWhere>): Promise<GovernancePage<ToolCallActivityRow>>;
     /** Paged, filterable runs for the Reliability recent-runs table. */
     runsPage(query: GovernancePageQuery<RunWhere>): Promise<GovernancePage<RecentRunRow>>;
-    /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
+    /**
+     * Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox.
+     * Capped and totalless — kept because the SPA still calls `GET approvals`; new callers want
+     * {@link approvalsPage}, which reports how much of the backlog the cap hid.
+     */
     pendingApprovals(limit: number): Promise<PendingApprovalRow[]>;
+    /** Paged, filterable approvals inbox with a total — the backlog-safe read of the HITL queue. */
+    approvalsPage(query: GovernancePageQuery<ApprovalWhere>): Promise<GovernancePage<PendingApprovalRow>>;
+    /**
+     * One run with its thread and its tool calls. 404s on an unknown id rather than returning an empty
+     * detail: "this run does not exist" and "this run did nothing" are different answers, and a console
+     * that conflates them sends an operator looking for a bug that isn't there.
+     */
+    runDetail(runId: string): Promise<RunDetailWithLabel>;
+    /** One thread with its usage rollup, runs and messages. 404s on an unknown id, like {@link runDetail}. */
+    threadDetail(query: GovernanceThreadDetailQuery): Promise<ThreadDetailWithLabel>;
     /** Per-tool call/failure/rejection/latency rollup for a day range, for the Tools section. */
     toolStats(range: GovernanceRange): Promise<ToolStatRow[]>;
     /**
@@ -136,6 +162,14 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     runsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<RecentRunRow>>;
+    /**
+     * One run drill-down: the run, its owning thread's headline (actor-labeled) and its tool calls, in
+     * ONE round trip. 404s on an unknown run id.
+     *
+     * Declared AFTER `runs-page` so the literal route wins over this parameterised one regardless of
+     * how the router orders same-prefix paths.
+     */
+    runDetail(runId: string): Promise<RunDetailWithLabel>;
     /** Most recent tool calls (default 50, max 200) for the activity feed. */
     toolCalls(limit?: string): Promise<ToolCallActivityRow[]>;
     /**
@@ -144,8 +178,22 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     toolCallsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ToolCallActivityRow>>;
-    /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
+    /**
+     * Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox.
+     *
+     * Capped with NO total, so a backlog past `limit` is invisible from the response alone. Kept
+     * because the SPA still calls it; anything new should call `approvals-page` instead.
+     */
     approvals(limit?: string): Promise<PendingApprovalRow[]>;
+    /**
+     * Paged, filterable approvals inbox, oldest first. `page` (default 1), `limit` (default 25, max
+     * 200), and `where[toolName]`/`where[threadId]`/`where[actorRef]`/`where[agentName]`/
+     * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+     *
+     * Unlike `GET approvals` this reports `total`, so the console can say "showing N of M" instead of
+     * silently hiding pending decisions behind a row cap.
+     */
+    approvalsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<PendingApprovalRow>>;
     /**
      * Decide a pending HITL tool call. Body `{ approved: boolean; reason?: string }`. 501s (via
      * `DashboardService.decideApproval`) when no `AGENT_APPROVAL_PORT` is bound. `executedByRef`
@@ -170,6 +218,16 @@ declare class AgentApiController {
      * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
      */
     threadsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ThreadActivityRowWithLabel>>;
+    /**
+     * One thread drill-down: the thread (actor-labeled), its lifetime token/cost rollup, its newest
+     * runs and its newest messages, in ONE round trip. `messages` (default 50, max 200) and `runs`
+     * (default 25, max 200) cap the two lists; `runTotal` and `thread.messageCount` report the true
+     * sizes so the console can say what the caps hid. 404s on an unknown thread id.
+     *
+     * A soft-deleted thread is still returned, flagged `deleted: true` — an audit needs the thread it
+     * just lost, and the alternative is a drill-down that 404s on exactly the interesting case.
+     */
+    threadDetail(threadId: string, messages?: string, runs?: string): Promise<ThreadDetailWithLabel>;
     /**
      * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
      * no `AGENT_PRICING_STORE` is bound.
@@ -636,4 +694,4 @@ declare const DASHBOARD_APPROVAL_ACTOR_REF: unique symbol;
  */
 declare const DASHBOARD_AUTH: unique symbol;
 
-export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, type AgentDashboardAsyncOptions, AgentDashboardAuthController, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, type AuthMode, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_AUTH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type LiveAgentEvent, type LoginHook, type ReliabilityOverview, type ResolvedDashboardAuth, type RevalidateHook, type SessionHook, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadSpendRowWithLabel, type UnauthenticatedPageContext, type UnauthenticatedPageHook, type WithActorLabel, agentDashboardMountPaths, parsePriceInput, resolveDashboardAuth };
+export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, type AgentDashboardAsyncOptions, AgentDashboardAuthController, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, type AuthMode, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_AUTH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type LiveAgentEvent, type LoginHook, type ReliabilityOverview, type ResolvedDashboardAuth, type RevalidateHook, type RunDetailWithLabel, type SessionHook, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadDetailWithLabel, type ThreadSpendRowWithLabel, type UnauthenticatedPageContext, type UnauthenticatedPageHook, type WithActorLabel, agentDashboardMountPaths, parsePriceInput, resolveDashboardAuth };

package/dist/server/index.js

@@ -387,7 +387,7 @@ DashboardAuthGuard = _ts_decorate([
 // src/server/dashboard.service.ts
 import { subscribe, unsubscribe } from "node:diagnostics_channel";
 import { channelName } from "@dudousxd/nestjs-diagnostics";
-import { Inject as Inject2, Injectable as Injectable2, NotImplementedException, Optional as Optional2 } from "@nestjs/common";
+import { Inject as Inject2, Injectable as Injectable2, NotFoundException, NotImplementedException, Optional as Optional2 } from "@nestjs/common";
 import { Observable as Observable2 } from "rxjs";
 
 // src/server/parse-approval-decision.ts
@@ -548,10 +548,56 @@ var DashboardService = class {
   runsPage(query) {
     return this.queries.runsPage(query);
   }
-  /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
+  /**
+  * Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox.
+  * Capped and totalless — kept because the SPA still calls `GET approvals`; new callers want
+  * {@link approvalsPage}, which reports how much of the backlog the cap hid.
+  */
   pendingApprovals(limit) {
     return this.queries.pendingApprovals(limit);
   }
+  /** Paged, filterable approvals inbox with a total — the backlog-safe read of the HITL queue. */
+  approvalsPage(query) {
+    return this.queries.approvalsPage(query);
+  }
+  /**
+  * One run with its thread and its tool calls. 404s on an unknown id rather than returning an empty
+  * detail: "this run does not exist" and "this run did nothing" are different answers, and a console
+  * that conflates them sends an operator looking for a bug that isn't there.
+  */
+  async runDetail(runId) {
+    const detail = await this.queries.runDetail(runId);
+    if (detail === null) {
+      throw new NotFoundException(`No run "${runId}".`);
+    }
+    const [thread] = await this.withActorLabels([
+      detail.thread
+    ]);
+    return {
+      ...detail,
+      thread: thread ?? {
+        ...detail.thread,
+        actorLabel: null
+      }
+    };
+  }
+  /** One thread with its usage rollup, runs and messages. 404s on an unknown id, like {@link runDetail}. */
+  async threadDetail(query) {
+    const detail = await this.queries.threadDetail(query);
+    if (detail === null) {
+      throw new NotFoundException(`No thread "${query.threadId}".`);
+    }
+    const [thread] = await this.withActorLabels([
+      detail.thread
+    ]);
+    return {
+      ...detail,
+      thread: thread ?? {
+        ...detail.thread,
+        actorLabel: null
+      }
+    };
+  }
   /** Per-tool call/failure/rejection/latency rollup for a day range, for the Tools section. */
   toolStats(range) {
     return this.queries.toolStats(range);
@@ -785,6 +831,7 @@ var RUN_WHERE_FIELDS = [
   "agentName",
   "status",
   "errorCode",
+  "threadId",
   "fromDay",
   "toDay"
 ];
@@ -802,6 +849,9 @@ function parseRunWhere(raw) {
     ...raw.errorCode !== void 0 ? {
       errorCode: raw.errorCode
     } : {},
+    ...raw.threadId !== void 0 ? {
+      threadId: raw.threadId
+    } : {},
     ...raw.fromDay !== void 0 ? {
       fromDay: raw.fromDay
     } : {},
@@ -811,6 +861,40 @@ function parseRunWhere(raw) {
   };
 }
 __name(parseRunWhere, "parseRunWhere");
+var APPROVAL_WHERE_FIELDS = [
+  "toolName",
+  "threadId",
+  "actorRef",
+  "agentName",
+  "fromDay",
+  "toDay"
+];
+function parseApprovalWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, APPROVAL_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.toolName !== void 0 ? {
+      toolName: raw.toolName
+    } : {},
+    ...raw.threadId !== void 0 ? {
+      threadId: raw.threadId
+    } : {},
+    ...raw.actorRef !== void 0 ? {
+      actorRef: raw.actorRef
+    } : {},
+    ...raw.agentName !== void 0 ? {
+      agentName: raw.agentName
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseApprovalWhere, "parseApprovalWhere");
 
 // src/server/agent-api.controller.ts
 function _ts_decorate3(decorators, target, key, desc) {
@@ -896,6 +980,16 @@ var AgentApiController = class {
       } : {}
     });
   }
+  /**
+  * One run drill-down: the run, its owning thread's headline (actor-labeled) and its tool calls, in
+  * ONE round trip. 404s on an unknown run id.
+  *
+  * Declared AFTER `runs-page` so the literal route wins over this parameterised one regardless of
+  * how the router orders same-prefix paths.
+  */
+  runDetail(runId) {
+    return this.dashboard.runDetail(runId);
+  }
   /** Most recent tool calls (default 50, max 200) for the activity feed. */
   toolCalls(limit) {
     return this.dashboard.recentToolCalls(parseLimit(limit, 50));
@@ -915,11 +1009,34 @@ var AgentApiController = class {
       } : {}
     });
   }
-  /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
+  /**
+  * Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox.
+  *
+  * Capped with NO total, so a backlog past `limit` is invisible from the response alone. Kept
+  * because the SPA still calls it; anything new should call `approvals-page` instead.
+  */
   approvals(limit) {
     return this.dashboard.pendingApprovals(parseLimit(limit, 50));
   }
   /**
+  * Paged, filterable approvals inbox, oldest first. `page` (default 1), `limit` (default 25, max
+  * 200), and `where[toolName]`/`where[threadId]`/`where[actorRef]`/`where[agentName]`/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  *
+  * Unlike `GET approvals` this reports `total`, so the console can say "showing N of M" instead of
+  * silently hiding pending decisions behind a row cap.
+  */
+  approvalsPage(page, limit, where) {
+    const parsedWhere = parseApprovalWhere(where);
+    return this.dashboard.approvalsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
+  /**
   * Decide a pending HITL tool call. Body `{ approved: boolean; reason?: string }`. 501s (via
   * `DashboardService.decideApproval`) when no `AGENT_APPROVAL_PORT` is bound. `executedByRef`
   * comes from {@link deciderRef} run against the live request.
@@ -971,6 +1088,22 @@ var AgentApiController = class {
     });
   }
   /**
+  * One thread drill-down: the thread (actor-labeled), its lifetime token/cost rollup, its newest
+  * runs and its newest messages, in ONE round trip. `messages` (default 50, max 200) and `runs`
+  * (default 25, max 200) cap the two lists; `runTotal` and `thread.messageCount` report the true
+  * sizes so the console can say what the caps hid. 404s on an unknown thread id.
+  *
+  * A soft-deleted thread is still returned, flagged `deleted: true` — an audit needs the thread it
+  * just lost, and the alternative is a drill-down that 404s on exactly the interesting case.
+  */
+  threadDetail(threadId, messages, runs) {
+    return this.dashboard.threadDetail({
+      threadId,
+      messageLimit: parseLimit(messages, 50),
+      runLimit: parseLimit(runs, 25)
+    });
+  }
+  /**
   * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
   * no `AGENT_PRICING_STORE` is bound.
   */
@@ -1047,6 +1180,15 @@ _ts_decorate3([
   ]),
   _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runsPage", null);
+_ts_decorate3([
+  Get("runs/:runId"),
+  _ts_param3(0, Param("runId")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "runDetail", null);
 _ts_decorate3([
   Get("tool-calls"),
   _ts_param3(0, Query("limit")),
@@ -1078,6 +1220,19 @@ _ts_decorate3([
   ]),
   _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvals", null);
+_ts_decorate3([
+  Get("approvals-page"),
+  _ts_param3(0, Query("page")),
+  _ts_param3(1, Query("limit")),
+  _ts_param3(2, Query("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "approvalsPage", null);
 _ts_decorate3([
   Post("approvals/:toolCallId"),
   HttpCode(204),
@@ -1125,6 +1280,19 @@ _ts_decorate3([
   ]),
   _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadsPage", null);
+_ts_decorate3([
+  Get("threads/:threadId"),
+  _ts_param3(0, Param("threadId")),
+  _ts_param3(1, Query("messages")),
+  _ts_param3(2, Query("runs")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String,
+    String,
+    String
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "threadDetail", null);
 _ts_decorate3([
   Get("pricing"),
   _ts_metadata3("design:type", Function),
@@ -1161,7 +1329,7 @@ AgentApiController = _ts_decorate3([
 ], AgentApiController);
 
 // src/server/agent-dashboard-auth.controller.ts
-import { Body as Body2, Controller as Controller2, Get as Get2, Header, HttpCode as HttpCode2, Inject as Inject4, Logger, NotFoundException, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+import { Body as Body2, Controller as Controller2, Get as Get2, Header, HttpCode as HttpCode2, Inject as Inject4, Logger, NotFoundException as NotFoundException2, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
 
 // src/server/auth/login-page.ts
 function escapeHtml(value) {
@@ -1336,7 +1504,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   }
   loginPage(req, res, returnToQuery, error) {
     const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException();
+    if (!auth.modes.includes("login")) throw new NotFoundException2();
     const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
     if (this.currentSession(req)) {
       res.status(302);
@@ -1351,7 +1519,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   }
   async login(body, req, res) {
     const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException();
+    if (!auth.modes.includes("login")) throw new NotFoundException2();
     const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
     const username = body?.username;
     const password = body?.password;
@@ -1386,7 +1554,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   // request and returns the session user, or `null` to deny. No credential reaches this library.
   async session(request, response) {
     const auth = this.requireAuth();
-    if (!auth.modes.includes("session")) throw new NotFoundException();
+    if (!auth.modes.includes("session")) throw new NotFoundException2();
     const user = await this.runHook("session", () => auth.session?.(request) ?? null);
     if (!user) throw new UnauthorizedException2();
     issueSessionCookie(user, {
@@ -1406,7 +1574,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
   // path; the host owns its own headers on the hook path.
   async sessionRequiredPage(req, res) {
     const auth = this.requireAuth();
-    if (auth.modes.includes("login")) throw new NotFoundException();
+    if (auth.modes.includes("login")) throw new NotFoundException2();
     const hook = auth.unauthenticatedPage;
     if (hook) {
       try {
@@ -1461,7 +1629,7 @@ var AgentDashboardAuthController = class _AgentDashboardAuthController {
     this.logger.warn(message);
   }
   requireAuth() {
-    if (!this.auth) throw new NotFoundException();
+    if (!this.auth) throw new NotFoundException2();
     return this.auth;
   }
 };
@@ -1583,7 +1751,7 @@ import { RouterModule } from "@nestjs/core";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller3, Get as Get3, Header as Header2, Inject as Inject6, NotFoundException as NotFoundException2, Param as Param2, Req as Req3, Res as Res2, StreamableFile, UseFilters, UseGuards as UseGuards2 } from "@nestjs/common";
+import { Controller as Controller3, Get as Get3, Header as Header2, Inject as Inject6, NotFoundException as NotFoundException3, Param as Param2, Req as Req3, Res as Res2, StreamableFile, UseFilters, UseGuards as UseGuards2 } from "@nestjs/common";
 
 // src/server/auth/dashboard-auth-page.guard.ts
 import { Inject as Inject5, Injectable as Injectable4, Optional as Optional5 } from "@nestjs/common";
@@ -1757,7 +1925,7 @@ var AgentUiController = class {
     }
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
-      throw new NotFoundException2("Dashboard is not built. Run the package build.");
+      throw new NotFoundException3("Dashboard is not built. Run the package build.");
     }
     const html = readFileSync(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -1765,11 +1933,11 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = basename(file);
-    if (safe !== file) throw new NotFoundException2();
+    if (safe !== file) throw new NotFoundException3();
     const root = resolve(this.dir, "assets");
     const assetPath = resolve(root, safe);
     if (!assetPath.startsWith(root + sep) || !existsSync(assetPath)) {
-      throw new NotFoundException2();
+      throw new NotFoundException3();
     }
     const type = CONTENT_TYPES[extname(safe)] ?? "application/octet-stream";
     return new StreamableFile(readFileSync(assetPath), {