@dudousxd/nestjs-agent-dashboard 0.17.0 → 0.19.0

package/dist/server/index.cjs

@@ -29,430 +29,39 @@ __export(index_exports, {
   AGENT_PRICING_STORE: () => AGENT_PRICING_STORE,
   AgentApiController: () => AgentApiController,
   AgentApiModule: () => AgentApiModule,
-  AgentDashboardAuthController: () => AgentDashboardAuthController,
   AgentDashboardModule: () => AgentDashboardModule,
   AgentUiController: () => AgentUiController,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF: () => DASHBOARD_APPROVAL_ACTOR_REF,
-  DASHBOARD_AUTH: () => DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
   DashboardService: () => DashboardService,
   agentDashboardMountPaths: () => agentDashboardMountPaths,
-  parsePriceInput: () => parsePriceInput,
-  resolveDashboardAuth: () => resolveDashboardAuth
+  parsePriceInput: () => parsePriceInput
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/server/agent-api.controller.ts
-var import_common6 = require("@nestjs/common");
-
-// src/server/auth/dashboard-auth.guard.ts
-var import_common = require("@nestjs/common");
-
-// src/server/tokens.ts
-var AGENT_GOVERNANCE_QUERIES = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:governance-queries");
-var AGENT_ACTOR_DIRECTORY = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-directory");
-var AGENT_PRICING_STORE = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:pricing-store");
-var AGENT_APPROVAL_PORT = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:approval-port");
-var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
-var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
-var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
-var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
-var DASHBOARD_AUTH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:dashboard-auth");
-
-// src/server/auth/cookie-header.ts
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (typeof header !== "string" || header === "") return cookies;
-  for (const segment of header.split(";")) {
-    const eq = segment.indexOf("=");
-    if (eq <= 0) continue;
-    const name = segment.slice(0, eq).trim();
-    if (name === "") continue;
-    let rawValue = segment.slice(eq + 1).trim();
-    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
-      rawValue = rawValue.slice(1, -1);
-    }
-    if (name in cookies) continue;
-    try {
-      cookies[name] = decodeURIComponent(rawValue);
-    } catch {
-      cookies[name] = rawValue;
-    }
-  }
-  return cookies;
-}
-__name(parseCookieHeader, "parseCookieHeader");
-function serializeSetCookie(name, value, options) {
-  const parts = [
-    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
-  ];
-  parts.push(`Path=${options.path}`);
-  parts.push("HttpOnly");
-  parts.push("SameSite=Lax");
-  if (options.secure) parts.push("Secure");
-  if (options.clear) {
-    parts.push("Max-Age=0");
-    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  } else {
-    parts.push(`Max-Age=${options.maxAgeSeconds}`);
-  }
-  return parts.join("; ");
-}
-__name(serializeSetCookie, "serializeSetCookie");
-
-// src/server/auth/http-request.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord, "isRecord");
-function readHeaders(request) {
-  if (!isRecord(request)) return {};
-  const headers = request.headers;
-  return isRecord(headers) ? headers : {};
-}
-__name(readHeaders, "readHeaders");
-function headerToString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
-    return value.join(",");
-  }
-  return void 0;
-}
-__name(headerToString, "headerToString");
-function readCookieHeader(request) {
-  return headerToString(readHeaders(request).cookie);
-}
-__name(readCookieHeader, "readCookieHeader");
-function isHttpsRequest(request) {
-  if (isRecord(request) && request.protocol === "https") return true;
-  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
-  if (forwarded === void 0) return false;
-  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
-}
-__name(isHttpsRequest, "isHttpsRequest");
-function readOriginalUrl(request) {
-  if (!isRecord(request)) return "/";
-  const originalUrl = request.originalUrl;
-  if (typeof originalUrl === "string" && originalUrl !== "") return originalUrl;
-  const url = request.url;
-  return typeof url === "string" && url !== "" ? url : "/";
-}
-__name(readOriginalUrl, "readOriginalUrl");
-function attachSession(request, session) {
-  if (!isRecord(request)) return;
-  const target = request;
-  target.dashboardSession = session;
-}
-__name(attachSession, "attachSession");
-
-// src/server/auth/response.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord2, "isRecord");
-function isHeaderCapableResponse(value) {
-  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
-}
-__name(isHeaderCapableResponse, "isHeaderCapableResponse");
-function resolveHeaderCapableResponse(response) {
-  if (isHeaderCapableResponse(response)) return response;
-  if (isRecord2(response) && isHeaderCapableResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveHeaderCapableResponse, "resolveHeaderCapableResponse");
-function existingSetCookies(response) {
-  const current = response.getHeader("set-cookie");
-  if (Array.isArray(current)) return current;
-  if (typeof current === "string") return [
-    current
-  ];
-  return [];
-}
-__name(existingSetCookies, "existingSetCookies");
-function appendSetCookie(response, cookie) {
-  const raw = resolveHeaderCapableResponse(response);
-  if (!raw) return;
-  raw.setHeader("set-cookie", [
-    ...existingSetCookies(raw),
-    cookie
-  ]);
-}
-__name(appendSetCookie, "appendSetCookie");
-function isRawNodeResponse(value) {
-  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
-}
-__name(isRawNodeResponse, "isRawNodeResponse");
-function resolveRawResponse(response) {
-  if (isRawNodeResponse(response)) return response;
-  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveRawResponse, "resolveRawResponse");
-function responseAlreadyWritten(response) {
-  const raw = resolveRawResponse(response);
-  return raw?.headersSent === true;
-}
-__name(responseAlreadyWritten, "responseAlreadyWritten");
-function sendHtml(response, status, html) {
-  const raw = resolveRawResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("content-type", "text/html; charset=utf-8");
-  raw.setHeader("cache-control", "no-store, must-revalidate");
-  raw.end(html);
-}
-__name(sendHtml, "sendHtml");
-function sendRedirect(response, status, location) {
-  const raw = resolveRawResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("location", location);
-  raw.end();
-}
-__name(sendRedirect, "sendRedirect");
-
-// src/server/auth/session-cookie.ts
-var import_node_crypto = require("crypto");
-var EXP_GRACE_MS = 3e4;
-function base64urlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-__name(base64urlEncode, "base64urlEncode");
-function base64urlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-__name(base64urlDecode, "base64urlDecode");
-function hmac(secret, payload) {
-  return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("base64url");
-}
-__name(hmac, "hmac");
-function signSessionCookie(user, options) {
-  const issuedAt = options.now ?? Date.now();
-  const session = {
-    sub: user.id,
-    ...user.name !== void 0 ? {
-      name: user.name
-    } : {},
-    roles: user.roles ?? [],
-    iat: issuedAt,
-    exp: issuedAt + options.ttlMs
-  };
-  const encodedPayload = base64urlEncode(JSON.stringify(session));
-  const signature = hmac(options.secret, encodedPayload);
-  return `${encodedPayload}.${signature}`;
-}
-__name(signSessionCookie, "signSessionCookie");
-function isSessionPayload(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = {
-    ...value
-  };
-  if (typeof record.sub !== "string") return false;
-  if (record.name !== void 0 && typeof record.name !== "string") return false;
-  if (!Array.isArray(record.roles)) return false;
-  if (!record.roles.every((role) => typeof role === "string")) return false;
-  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
-  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
-  return true;
-}
-__name(isSessionPayload, "isSessionPayload");
-function verifySessionCookie(value, options) {
-  try {
-    const dot = value.indexOf(".");
-    if (dot <= 0 || dot === value.length - 1) return null;
-    const encodedPayload = value.slice(0, dot);
-    const providedSignature = value.slice(dot + 1);
-    const expectedSignature = hmac(options.secret, encodedPayload);
-    const provided = Buffer.from(providedSignature, "base64url");
-    const expected = Buffer.from(expectedSignature, "base64url");
-    if (provided.length !== expected.length) return null;
-    if (!(0, import_node_crypto.timingSafeEqual)(provided, expected)) return null;
-    const decoded = JSON.parse(base64urlDecode(encodedPayload));
-    if (!isSessionPayload(decoded)) return null;
-    const now = options.now ?? Date.now();
-    if (now > decoded.exp + EXP_GRACE_MS) return null;
-    const session = {
-      sub: decoded.sub,
-      ...decoded.name !== void 0 ? {
-        name: decoded.name
-      } : {},
-      roles: decoded.roles,
-      iat: decoded.iat,
-      exp: decoded.exp
-    };
-    return session;
-  } catch {
-    return null;
-  }
-}
-__name(verifySessionCookie, "verifySessionCookie");
-
-// src/server/auth/session-cookie-io.ts
-var SESSION_COOKIE_NAME = "agent_dashboard_session";
-var COOKIE_PATH = "/";
-function issueSessionCookie(user, context) {
-  const value = signSessionCookie(user, {
-    secret: context.auth.secret,
-    ttlMs: context.auth.ttlMs,
-    ...context.now !== void 0 ? {
-      now: context.now
-    } : {}
-  });
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
-    path: COOKIE_PATH,
-    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
-    secure: isHttpsRequest(context.request)
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(issueSessionCookie, "issueSessionCookie");
-function clearSessionCookie(context) {
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
-    path: COOKIE_PATH,
-    maxAgeSeconds: 0,
-    secure: isHttpsRequest(context.request),
-    clear: true
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(clearSessionCookie, "clearSessionCookie");
-var inFlightRevalidations = /* @__PURE__ */ new Map();
-function revalidationKey(session) {
-  return `${session.sub}:${session.iat}`;
-}
-__name(revalidationKey, "revalidationKey");
-function getOrStartRevalidation(auth, session, user) {
-  const hook = auth.revalidate;
-  if (!hook) return Promise.resolve(true);
-  const key = revalidationKey(session);
-  const inFlight = inFlightRevalidations.get(key);
-  if (inFlight) return inFlight;
-  const outcome = (async () => {
-    try {
-      return await hook(user);
-    } catch {
-      return false;
-    }
-  })().finally(() => {
-    inFlightRevalidations.delete(key);
-  });
-  inFlightRevalidations.set(key, outcome);
-  return outcome;
-}
-__name(getOrStartRevalidation, "getOrStartRevalidation");
-async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
-  if (now - session.iat <= auth.ttlMs / 2) return true;
-  const user = {
-    id: session.sub,
-    ...session.name !== void 0 ? {
-      name: session.name
-    } : {},
-    roles: session.roles
-  };
-  const allowed = await getOrStartRevalidation(auth, session, user);
-  if (!allowed) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    return false;
-  }
-  issueSessionCookie(user, {
-    auth,
-    request,
-    response,
-    now
-  });
-  return true;
-}
-__name(maybeRenewSession, "maybeRenewSession");
-
-// src/server/auth/dashboard-auth.guard.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param, "_ts_param");
-var DashboardAuthGuard = class {
-  static {
-    __name(this, "DashboardAuthGuard");
-  }
-  auth;
-  constructor(auth) {
-    this.auth = auth;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = this.verifyRequestSession(request);
-    if (!session) throw new import_common.UnauthorizedException();
-    attachSession(request, session);
-    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
-      throw new import_common.UnauthorizedException();
-    }
-    return true;
-  }
-  verifyRequestSession(request) {
-    const auth = this.auth;
-    if (!auth) return null;
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return null;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    });
-  }
-};
-DashboardAuthGuard = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Optional)()),
-  _ts_param(0, (0, import_common.Inject)(DASHBOARD_AUTH)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    Object
-  ])
-], DashboardAuthGuard);
+var import_nestjs_agent_core = require("@dudousxd/nestjs-agent-core");
+var import_common5 = require("@nestjs/common");
 
 // src/server/dashboard.service.ts
 var import_node_diagnostics_channel = require("diagnostics_channel");
 var import_nestjs_diagnostics = require("@dudousxd/nestjs-diagnostics");
-var import_common4 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 var import_rxjs = require("rxjs");
 
 // src/server/parse-approval-decision.ts
-var import_common2 = require("@nestjs/common");
+var import_common = require("@nestjs/common");
 function parseApprovalDecision(body) {
   if (typeof body !== "object" || body === null) {
-    throw new import_common2.BadRequestException("Expected a JSON object body.");
+    throw new import_common.BadRequestException("Expected a JSON object body.");
   }
   const { approved, reason } = body;
   if (typeof approved !== "boolean") {
-    throw new import_common2.BadRequestException('"approved" must be a boolean.');
+    throw new import_common.BadRequestException('"approved" must be a boolean.');
   }
   if (reason !== void 0 && typeof reason !== "string") {
-    throw new import_common2.BadRequestException('"reason" must be a string when present.');
+    throw new import_common.BadRequestException('"reason" must be a string when present.');
   }
   return {
     approved,
@@ -464,26 +73,26 @@ function parseApprovalDecision(body) {
 __name(parseApprovalDecision, "parseApprovalDecision");
 
 // src/server/parse-price-input.ts
-var import_common3 = require("@nestjs/common");
+var import_common2 = require("@nestjs/common");
 function parsePriceInput(body) {
   if (typeof body !== "object" || body === null) {
-    throw new import_common3.BadRequestException("Expected a JSON object body.");
+    throw new import_common2.BadRequestException("Expected a JSON object body.");
   }
   const { modelId, inputPricePer1m, outputPricePer1m, cacheWritePricePer1m, cacheReadPricePer1m } = body;
   if (typeof modelId !== "string" || modelId.trim().length === 0) {
-    throw new import_common3.BadRequestException('"modelId" must be a non-empty string.');
+    throw new import_common2.BadRequestException('"modelId" must be a non-empty string.');
   }
   if (!isFiniteNonNegative(inputPricePer1m)) {
-    throw new import_common3.BadRequestException('"inputPricePer1m" must be a non-negative number.');
+    throw new import_common2.BadRequestException('"inputPricePer1m" must be a non-negative number.');
   }
   if (!isFiniteNonNegative(outputPricePer1m)) {
-    throw new import_common3.BadRequestException('"outputPricePer1m" must be a non-negative number.');
+    throw new import_common2.BadRequestException('"outputPricePer1m" must be a non-negative number.');
   }
   if (cacheWritePricePer1m !== void 0 && !isFiniteNonNegative(cacheWritePricePer1m)) {
-    throw new import_common3.BadRequestException('"cacheWritePricePer1m" must be a non-negative number when present.');
+    throw new import_common2.BadRequestException('"cacheWritePricePer1m" must be a non-negative number when present.');
   }
   if (cacheReadPricePer1m !== void 0 && !isFiniteNonNegative(cacheReadPricePer1m)) {
-    throw new import_common3.BadRequestException('"cacheReadPricePer1m" must be a non-negative number when present.');
+    throw new import_common2.BadRequestException('"cacheReadPricePer1m" must be a non-negative number when present.');
   }
   return {
     modelId,
@@ -503,8 +112,18 @@ function isFiniteNonNegative(value) {
 }
 __name(isFiniteNonNegative, "isFiniteNonNegative");
 
+// src/server/tokens.ts
+var AGENT_GOVERNANCE_QUERIES = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:governance-queries");
+var AGENT_ACTOR_DIRECTORY = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-directory");
+var AGENT_PRICING_STORE = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:pricing-store");
+var AGENT_APPROVAL_PORT = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:approval-port");
+var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
+var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
+var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
+var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+
 // src/server/dashboard.service.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -517,19 +136,19 @@ function _ts_decorate2(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(metadataKey, metadataValue) {
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param, "_ts_param");
 var PRICING_STORE_UNBOUND_MESSAGE = "Pricing CRUD is unavailable: no AGENT_PRICING_STORE is bound. Bind a pricing store (e.g. MikroOrmPricingStore from @dudousxd/nestjs-agent-store-mikro-orm) to enable it.";
 var APPROVAL_PORT_UNBOUND_MESSAGE = "Approve/reject is unavailable: no AGENT_APPROVAL_PORT is bound. Import AgentModule from @dudousxd/nestjs-agent alongside this dashboard to enable it \u2014 the approvals inbox stays read-only until then.";
 var GENUI_STATS_UNSUPPORTED_MESSAGE = "Generative UI telemetry is unavailable: the bound AGENT_GOVERNANCE_QUERIES store does not implement genuiStats. Use a store adapter that records generative-UI calls (recordGenuiCalls) to enable it.";
@@ -563,16 +182,20 @@ var DashboardService = class {
   }
   /** Spend/usage overview for a day range: by-model + by-actor spend and the daily trend, in parallel. */
   async spend(range) {
-    const [byModel, byActorRaw, trend] = await Promise.all([
+    const [byModel, byActorRaw, trend, byFeature] = await Promise.all([
       this.queries.spendByModel(range),
       this.queries.spendByActor(range),
-      this.queries.usageTrend(range)
+      this.queries.usageTrend(range),
+      this.queries.spendByFeature?.(range)
     ]);
     const byActor = await this.withActorLabels(byActorRaw);
     return {
       byModel,
       byActor,
-      trend
+      trend,
+      ...byFeature !== void 0 ? {
+        byFeature
+      } : {}
     };
   }
   /** Top threads by cost for a day range (default 10, highest cost first). */
@@ -631,7 +254,7 @@ var DashboardService = class {
   async runDetail(runId) {
     const detail = await this.queries.runDetail(runId);
     if (detail === null) {
-      throw new import_common4.NotFoundException(`No run "${runId}".`);
+      throw new import_common3.NotFoundException(`No run "${runId}".`);
     }
     const [thread] = await this.withActorLabels([
       detail.thread
@@ -648,7 +271,7 @@ var DashboardService = class {
   async threadDetail(query) {
     const detail = await this.queries.threadDetail(query);
     if (detail === null) {
-      throw new import_common4.NotFoundException(`No thread "${query.threadId}".`);
+      throw new import_common3.NotFoundException(`No thread "${query.threadId}".`);
     }
     const [thread] = await this.withActorLabels([
       detail.thread
@@ -673,7 +296,7 @@ var DashboardService = class {
   */
   async genuiStats(range) {
     if (this.queries.genuiStats === void 0) {
-      throw new import_common4.NotImplementedException(GENUI_STATS_UNSUPPORTED_MESSAGE);
+      throw new import_common3.NotImplementedException(GENUI_STATS_UNSUPPORTED_MESSAGE);
     }
     return this.queries.genuiStats(range);
   }
@@ -687,7 +310,7 @@ var DashboardService = class {
   */
   async decideApproval(toolCallId, body, executedByRef) {
     if (this.approvalPort === void 0) {
-      throw new import_common4.NotImplementedException(APPROVAL_PORT_UNBOUND_MESSAGE);
+      throw new import_common3.NotImplementedException(APPROVAL_PORT_UNBOUND_MESSAGE);
     }
     const decision = parseApprovalDecision(body);
     const opts = executedByRef !== void 0 ? {
@@ -748,7 +371,7 @@ var DashboardService = class {
   /** Current price row per model, for the pricing tab. 501s when no `AGENT_PRICING_STORE` is bound. */
   async listPrices() {
     if (this.pricingStore === void 0) {
-      throw new import_common4.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
+      throw new import_common3.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
     }
     return this.pricingStore.listCurrentPrices();
   }
@@ -759,7 +382,7 @@ var DashboardService = class {
   */
   async upsertPrice(body) {
     if (this.pricingStore === void 0) {
-      throw new import_common4.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
+      throw new import_common3.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
     }
     await this.pricingStore.upsertModelPrice(parsePriceInput(body));
   }
@@ -794,17 +417,17 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate2([
-  (0, import_common4.Injectable)(),
-  _ts_param2(0, (0, import_common4.Inject)(AGENT_GOVERNANCE_QUERIES)),
-  _ts_param2(1, (0, import_common4.Optional)()),
-  _ts_param2(1, (0, import_common4.Inject)(AGENT_ACTOR_DIRECTORY)),
-  _ts_param2(2, (0, import_common4.Optional)()),
-  _ts_param2(2, (0, import_common4.Inject)(AGENT_PRICING_STORE)),
-  _ts_param2(3, (0, import_common4.Optional)()),
-  _ts_param2(3, (0, import_common4.Inject)(AGENT_APPROVAL_PORT)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+DashboardService = _ts_decorate([
+  (0, import_common3.Injectable)(),
+  _ts_param(0, (0, import_common3.Inject)(AGENT_GOVERNANCE_QUERIES)),
+  _ts_param(1, (0, import_common3.Optional)()),
+  _ts_param(1, (0, import_common3.Inject)(AGENT_ACTOR_DIRECTORY)),
+  _ts_param(2, (0, import_common3.Optional)()),
+  _ts_param(2, (0, import_common3.Inject)(AGENT_PRICING_STORE)),
+  _ts_param(3, (0, import_common3.Optional)()),
+  _ts_param(3, (0, import_common3.Inject)(AGENT_APPROVAL_PORT)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
     typeof AgentGovernanceQueries === "undefined" ? Object : AgentGovernanceQueries,
     typeof ActorDirectory === "undefined" ? Object : ActorDirectory,
     typeof AgentPricingStore === "undefined" ? Object : AgentPricingStore,
@@ -813,7 +436,7 @@ DashboardService = _ts_decorate2([
 ], DashboardService);
 
 // src/server/parse-page-query.ts
-var import_common5 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 var ISO_DAY = /^\d{4}-\d{2}-\d{2}$/;
 function parsePageNumber(value) {
   const parsed = value === void 0 ? Number.NaN : Number.parseInt(value, 10);
@@ -824,7 +447,7 @@ __name(parsePageNumber, "parsePageNumber");
 function assertKnownFields(raw, allowed) {
   for (const field of Object.keys(raw)) {
     if (!allowed.includes(field)) {
-      throw new import_common5.BadRequestException(`Unknown where field "${field}".`);
+      throw new import_common4.BadRequestException(`Unknown where field "${field}".`);
     }
   }
 }
@@ -833,7 +456,7 @@ function assertDayFields(raw, dayFields) {
   for (const field of dayFields) {
     const value = raw[field];
     if (value !== void 0 && !ISO_DAY.test(value)) {
-      throw new import_common5.BadRequestException(`"where[${field}]" must be YYYY-MM-DD.`);
+      throw new import_common4.BadRequestException(`"where[${field}]" must be YYYY-MM-DD.`);
     }
   }
 }
@@ -972,7 +595,7 @@ function parseApprovalWhere(raw) {
 __name(parseApprovalWhere, "parseApprovalWhere");
 
 // src/server/agent-api.controller.ts
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -985,19 +608,19 @@ function _ts_decorate3(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(metadataKey, metadataValue) {
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param2, "_ts_param");
 var DAY_MS = 864e5;
 var ISO_DAY2 = /^\d{4}-\d{2}-\d{2}$/;
 function utcDay(daysAgo) {
@@ -1215,620 +838,222 @@ var AgentApiController = class {
     return this.dashboard.streamEvents();
   }
 };
-_ts_decorate3([
-  (0, import_common6.Get)("spend"),
-  _ts_param3(0, (0, import_common6.Query)("from")),
-  _ts_param3(1, (0, import_common6.Query)("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("spend"),
+  _ts_param2(0, (0, import_common5.Query)("from")),
+  _ts_param2(1, (0, import_common5.Query)("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "spend", null);
-_ts_decorate3([
-  (0, import_common6.Get)("top-threads"),
-  _ts_param3(0, (0, import_common6.Query)("from")),
-  _ts_param3(1, (0, import_common6.Query)("to")),
-  _ts_param3(2, (0, import_common6.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("top-threads"),
+  _ts_param2(0, (0, import_common5.Query)("from")),
+  _ts_param2(1, (0, import_common5.Query)("to")),
+  _ts_param2(2, (0, import_common5.Query)("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "topThreads", null);
-_ts_decorate3([
-  (0, import_common6.Get)("reliability"),
-  _ts_param3(0, (0, import_common6.Query)("from")),
-  _ts_param3(1, (0, import_common6.Query)("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("reliability"),
+  _ts_param2(0, (0, import_common5.Query)("from")),
+  _ts_param2(1, (0, import_common5.Query)("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "reliability", null);
-_ts_decorate3([
-  (0, import_common6.Get)("runs"),
-  _ts_param3(0, (0, import_common6.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("runs"),
+  _ts_param2(0, (0, import_common5.Query)("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runs", null);
-_ts_decorate3([
-  (0, import_common6.Get)("runs-page"),
-  _ts_param3(0, (0, import_common6.Query)("page")),
-  _ts_param3(1, (0, import_common6.Query)("limit")),
-  _ts_param3(2, (0, import_common6.Query)("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("runs-page"),
+  _ts_param2(0, (0, import_common5.Query)("page")),
+  _ts_param2(1, (0, import_common5.Query)("limit")),
+  _ts_param2(2, (0, import_common5.Query)("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runsPage", null);
-_ts_decorate3([
-  (0, import_common6.Get)("runs/:runId"),
-  _ts_param3(0, (0, import_common6.Param)("runId")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("runs/:runId"),
+  _ts_param2(0, (0, import_common5.Param)("runId")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runDetail", null);
-_ts_decorate3([
-  (0, import_common6.Get)("tool-calls"),
-  _ts_param3(0, (0, import_common6.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("tool-calls"),
+  _ts_param2(0, (0, import_common5.Query)("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCalls", null);
-_ts_decorate3([
-  (0, import_common6.Get)("tool-calls-page"),
-  _ts_param3(0, (0, import_common6.Query)("page")),
-  _ts_param3(1, (0, import_common6.Query)("limit")),
-  _ts_param3(2, (0, import_common6.Query)("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("tool-calls-page"),
+  _ts_param2(0, (0, import_common5.Query)("page")),
+  _ts_param2(1, (0, import_common5.Query)("limit")),
+  _ts_param2(2, (0, import_common5.Query)("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCallsPage", null);
-_ts_decorate3([
-  (0, import_common6.Get)("approvals"),
-  _ts_param3(0, (0, import_common6.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("approvals"),
+  _ts_param2(0, (0, import_common5.Query)("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvals", null);
-_ts_decorate3([
-  (0, import_common6.Get)("approvals-page"),
-  _ts_param3(0, (0, import_common6.Query)("page")),
-  _ts_param3(1, (0, import_common6.Query)("limit")),
-  _ts_param3(2, (0, import_common6.Query)("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("approvals-page"),
+  _ts_param2(0, (0, import_common5.Query)("page")),
+  _ts_param2(1, (0, import_common5.Query)("limit")),
+  _ts_param2(2, (0, import_common5.Query)("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvalsPage", null);
-_ts_decorate3([
-  (0, import_common6.Post)("approvals/:toolCallId"),
-  (0, import_common6.HttpCode)(204),
-  _ts_param3(0, (0, import_common6.Param)("toolCallId")),
-  _ts_param3(1, (0, import_common6.Body)()),
-  _ts_param3(2, (0, import_common6.Req)()),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Post)("approvals/:toolCallId"),
+  (0, import_common5.HttpCode)(204),
+  _ts_param2(0, (0, import_common5.Param)("toolCallId")),
+  _ts_param2(1, (0, import_common5.Body)()),
+  _ts_param2(2, (0, import_common5.Req)()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     Object,
     Object
   ]),
-  _ts_metadata3("design:returntype", Promise)
+  _ts_metadata2("design:returntype", Promise)
 ], AgentApiController.prototype, "decideApproval", null);
-_ts_decorate3([
-  (0, import_common6.Get)("tools"),
-  _ts_param3(0, (0, import_common6.Query)("from")),
-  _ts_param3(1, (0, import_common6.Query)("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("tools"),
+  _ts_param2(0, (0, import_common5.Query)("from")),
+  _ts_param2(1, (0, import_common5.Query)("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "tools", null);
-_ts_decorate3([
-  (0, import_common6.Get)("genui"),
-  _ts_param3(0, (0, import_common6.Query)("from")),
-  _ts_param3(1, (0, import_common6.Query)("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("genui"),
+  _ts_param2(0, (0, import_common5.Query)("from")),
+  _ts_param2(1, (0, import_common5.Query)("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "genui", null);
-_ts_decorate3([
-  (0, import_common6.Get)("threads"),
-  _ts_param3(0, (0, import_common6.Query)("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("threads"),
+  _ts_param2(0, (0, import_common5.Query)("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threads", null);
-_ts_decorate3([
-  (0, import_common6.Get)("threads-page"),
-  _ts_param3(0, (0, import_common6.Query)("page")),
-  _ts_param3(1, (0, import_common6.Query)("limit")),
-  _ts_param3(2, (0, import_common6.Query)("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("threads-page"),
+  _ts_param2(0, (0, import_common5.Query)("page")),
+  _ts_param2(1, (0, import_common5.Query)("limit")),
+  _ts_param2(2, (0, import_common5.Query)("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadsPage", null);
-_ts_decorate3([
-  (0, import_common6.Get)("threads/:threadId"),
-  _ts_param3(0, (0, import_common6.Param)("threadId")),
-  _ts_param3(1, (0, import_common6.Query)("messages")),
-  _ts_param3(2, (0, import_common6.Query)("runs")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Get)("threads/:threadId"),
+  _ts_param2(0, (0, import_common5.Param)("threadId")),
+  _ts_param2(1, (0, import_common5.Query)("messages")),
+  _ts_param2(2, (0, import_common5.Query)("runs")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadDetail", null);
-_ts_decorate3([
-  (0, import_common6.Get)("pricing"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+_ts_decorate2([
+  (0, import_common5.Get)("pricing"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "listPrices", null);
-_ts_decorate3([
-  (0, import_common6.Post)("pricing"),
-  _ts_param3(0, (0, import_common6.Body)()),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate2([
+  (0, import_common5.Post)("pricing"),
+  _ts_param2(0, (0, import_common5.Body)()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "upsertPrice", null);
-_ts_decorate3([
-  (0, import_common6.Sse)("stream"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Observable === "undefined" ? Object : Observable)
+_ts_decorate2([
+  (0, import_common5.Sse)("stream"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Observable === "undefined" ? Object : Observable)
 ], AgentApiController.prototype, "stream", null);
-AgentApiController = _ts_decorate3([
-  (0, import_common6.Controller)(),
-  (0, import_common6.UseGuards)(DashboardAuthGuard),
-  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_APPROVAL_ACTOR_REF)),
-  _ts_param3(2, (0, import_common6.Optional)()),
-  _ts_param3(2, (0, import_common6.Inject)(AGENT_ACTOR_RESOLVER)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+AgentApiController = _ts_decorate2([
+  (0, import_nestjs_agent_core.CanAnyone)(),
+  (0, import_common5.Controller)(),
+  _ts_param2(1, (0, import_common5.Inject)(DASHBOARD_APPROVAL_ACTOR_REF)),
+  _ts_param2(2, (0, import_common5.Optional)()),
+  _ts_param2(2, (0, import_common5.Inject)(AGENT_ACTOR_RESOLVER)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     Object,
     typeof ActorResolver === "undefined" ? Object : ActorResolver
   ])
 ], AgentApiController);
 
-// src/server/agent-dashboard-auth.controller.ts
-var import_common7 = require("@nestjs/common");
-
-// src/server/auth/login-page.ts
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-__name(escapeHtml, "escapeHtml");
-function pageShell(content, title) {
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex, nofollow" />
-<title>${title}</title>
-<style>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    background: #09090b;
-    color: #e4e4e7;
-    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    padding: 16px;
-  }
-  .card {
-    width: 100%;
-    max-width: 384px;
-    border: 1px solid #27272a;
-    background: #18181b;
-    border-radius: 8px;
-    padding: 32px;
-    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
-  }
-  .brand {
-    margin: 0 0 24px;
-    text-align: center;
-    font-size: 18px;
-    font-weight: 600;
-    color: #34d399;
-  }
-  h1 {
-    margin: 0 0 12px;
-    font-size: 16px;
-    font-weight: 600;
-    color: #f4f4f5;
-  }
-  p { margin: 0 0 16px; color: #a1a1aa; }
-  form { display: flex; flex-direction: column; gap: 16px; }
-  label { display: flex; flex-direction: column; gap: 6px; }
-  .field-label {
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    color: #71717a;
-  }
-  input {
-    border-radius: 4px;
-    border: 1px solid #3f3f46;
-    background: #09090b;
-    color: #f4f4f5;
-    padding: 8px 12px;
-    font: inherit;
-    outline: none;
-  }
-  input:focus { border-color: rgb(52 211 153 / 0.6); }
-  .error { margin: 0; font-size: 12px; color: #fb7185; }
-  button {
-    margin-top: 8px;
-    border-radius: 4px;
-    border: 1px solid rgb(52 211 153 / 0.4);
-    background: rgb(52 211 153 / 0.1);
-    color: #6ee7b7;
-    padding: 8px 12px;
-    font: inherit;
-    font-size: 12px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    cursor: pointer;
-  }
-  button:hover { background: rgb(52 211 153 / 0.2); }
-</style>
-</head>
-<body>
-  <div class="card">
-    ${content}
-  </div>
-</body>
-</html>`;
-}
-__name(pageShell, "pageShell");
-function renderLoginPage(options) {
-  const action = escapeHtml(options.actionUrl);
-  const returnTo = escapeHtml(options.returnTo);
-  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
-  return pageShell(`<p class="brand">AI Gateway</p>
-    <form method="post" action="${action}">
-      <input type="hidden" name="returnTo" value="${returnTo}" />
-      <label>
-        <span class="field-label">Username</span>
-        <input type="text" name="username" autocomplete="username" autofocus />
-      </label>
-      <label>
-        <span class="field-label">Password</span>
-        <input type="password" name="password" autocomplete="current-password" />
-      </label>
-      ${errorBanner}
-      <button type="submit">Sign in</button>
-    </form>`, "Sign in \u2014 AI Gateway");
-}
-__name(renderLoginPage, "renderLoginPage");
-function renderSessionRequiredPage() {
-  return pageShell(`<p class="brand">AI Gateway</p>
-    <h1>Open this console from your application</h1>
-    <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>`, "Sign in \u2014 AI Gateway");
-}
-__name(renderSessionRequiredPage, "renderSessionRequiredPage");
-
-// src/server/auth/sanitize-return-to.ts
-function sanitizeReturnTo(basePath, returnTo) {
-  if (typeof returnTo !== "string" || returnTo === "") return basePath;
-  if (!returnTo.startsWith("/") || returnTo.startsWith("//")) return basePath;
-  if (returnTo !== basePath && !returnTo.startsWith(`${basePath}/`) && !returnTo.startsWith(`${basePath}?`)) {
-    return basePath;
-  }
-  return returnTo;
-}
-__name(sanitizeReturnTo, "sanitizeReturnTo");
-
-// src/server/agent-dashboard-auth.controller.ts
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata4(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-__name(isNonEmptyString, "isNonEmptyString");
-function isString(value) {
-  return typeof value === "string";
-}
-__name(isString, "isString");
-var AgentDashboardAuthController = class _AgentDashboardAuthController {
-  static {
-    __name(this, "AgentDashboardAuthController");
-  }
-  auth;
-  basePath;
-  logger = new import_common7.Logger(_AgentDashboardAuthController.name);
-  /** Warn once PER HOOK KIND (not per request) so a broken hook can't be used to flood the logs. */
-  warnedHooks = /* @__PURE__ */ new Set();
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  loginPage(req, res, returnToQuery, error) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new import_common7.NotFoundException();
-    const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
-    if (this.currentSession(req)) {
-      res.status(302);
-      res.setHeader("Location", returnTo);
-      return "";
-    }
-    return renderLoginPage({
-      actionUrl: `${this.basePath}/auth/login`,
-      returnTo,
-      error: error !== void 0
-    });
-  }
-  async login(body, req, res) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new import_common7.NotFoundException();
-    const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
-    const username = body?.username;
-    const password = body?.password;
-    if (!isNonEmptyString(username) || password !== void 0 && !isString(password)) {
-      this.redirectToLoginError(res, returnTo);
-      return "";
-    }
-    const user = await this.runHook("login", () => auth.login?.(username.trim(), isString(password) ? password : "") ?? null);
-    if (!user) {
-      this.redirectToLoginError(res, returnTo);
-      return "";
-    }
-    issueSessionCookie(user, {
-      auth,
-      request: req,
-      response: res
-    });
-    res.status(302);
-    res.setHeader("Location", returnTo);
-    return "";
-  }
-  logout(req, res) {
-    clearSessionCookie({
-      request: req,
-      response: res
-    });
-    res.status(302);
-    res.setHeader("Location", this.auth && !this.auth.modes.includes("login") ? `${this.basePath}/auth/session-required` : `${this.basePath}/auth/login`);
-    return "";
-  }
-  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
-  // request and returns the session user, or `null` to deny. No credential reaches this library.
-  async session(request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("session")) throw new import_common7.NotFoundException();
-    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
-    if (!user) throw new import_common7.UnauthorizedException();
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-  }
-  // Mode-A-only landing: the host mints the session, so there is nothing to submit here. Serves
-  // as the redirect target `DashboardAuthPageGuard` bounces to instead of `/auth/login`, which
-  // 404s under Mode A (see `loginPage` above).
-  //
-  // Non-passthrough `@Res()` (unlike its sibling routes) because `dashboardAuth.unauthenticatedPage`
-  // hands the response to the HOST, which writes and ends it itself — there is no return value for
-  // Nest to send, and letting Nest also send one would double-write. The `Content-Type` /
-  // `Cache-Control` this route used to carry as decorators move into `sendHtml` for the built-in
-  // path; the host owns its own headers on the hook path.
-  async sessionRequiredPage(req, res) {
-    const auth = this.requireAuth();
-    if (auth.modes.includes("login")) throw new import_common7.NotFoundException();
-    const hook = auth.unauthenticatedPage;
-    if (hook) {
-      try {
-        await hook({
-          request: req,
-          response: res,
-          basePath: this.basePath
-        });
-        if (responseAlreadyWritten(res)) return;
-        this.warnHookOnce("unauthenticatedPage", "dashboardAuth.unauthenticatedPage returned without writing a response; falling back to the built-in page. The hook must write AND end the response it is given.");
-      } catch (error) {
-        this.warnHookOnce("unauthenticatedPage", `dashboardAuth.unauthenticatedPage threw; falling back to the built-in page. ${String(error)}`);
-        if (responseAlreadyWritten(res)) return;
-      }
-    }
-    sendHtml(res, 200, renderSessionRequiredPage());
-  }
-  /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
-  redirectToLoginError(res, returnTo) {
-    res.status(303);
-    res.setHeader("Location", `${this.basePath}/auth/login?error=1&returnTo=${encodeURIComponent(returnTo)}`);
-  }
-  currentSession(req) {
-    const auth = this.auth;
-    if (!auth) return false;
-    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return false;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    }) !== null;
-  }
-  /**
-  * Run a host hook (`login` or `session`) defensively: a throw (sync or async) is treated as a
-  * denial (`null`) and warn-logged ONCE PER KIND, so a buggy/unreachable hook never 500s the
-  * endpoint into a stack-trace leak nor floods the logs on repeated bad attempts.
-  */
-  async runHook(kind, run) {
-    try {
-      return await run() ?? null;
-    } catch (error) {
-      this.warnHookOnce(kind, `AgentDashboardModule dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
-      return null;
-    }
-  }
-  /**
-  * Warn once per hook kind for the life of the process, not once per request: a broken hook fires
-  * on every denied navigation and would otherwise flood the logs.
-  */
-  warnHookOnce(kind, message) {
-    if (this.warnedHooks.has(kind)) return;
-    this.warnedHooks.add(kind);
-    this.logger.warn(message);
-  }
-  requireAuth() {
-    if (!this.auth) throw new import_common7.NotFoundException();
-    return this.auth;
-  }
-};
-_ts_decorate4([
-  (0, import_common7.Get)("login"),
-  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common7.Header)("Cache-Control", "no-store"),
-  _ts_param4(0, (0, import_common7.Req)()),
-  _ts_param4(1, (0, import_common7.Res)({
-    passthrough: true
-  })),
-  _ts_param4(2, (0, import_common7.Query)("returnTo")),
-  _ts_param4(3, (0, import_common7.Query)("error")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse,
-    String,
-    String
-  ]),
-  _ts_metadata4("design:returntype", String)
-], AgentDashboardAuthController.prototype, "loginPage", null);
-_ts_decorate4([
-  (0, import_common7.Post)("login"),
-  _ts_param4(0, (0, import_common7.Body)()),
-  _ts_param4(1, (0, import_common7.Req)()),
-  _ts_param4(2, (0, import_common7.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof LoginFormBody === "undefined" ? Object : LoginFormBody,
-    Object,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "login", null);
-_ts_decorate4([
-  (0, import_common7.Post)("logout"),
-  _ts_param4(0, (0, import_common7.Req)()),
-  _ts_param4(1, (0, import_common7.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
-  ]),
-  _ts_metadata4("design:returntype", String)
-], AgentDashboardAuthController.prototype, "logout", null);
-_ts_decorate4([
-  (0, import_common7.Post)("session"),
-  (0, import_common7.HttpCode)(204),
-  _ts_param4(0, (0, import_common7.Req)()),
-  _ts_param4(1, (0, import_common7.Res)({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "session", null);
-_ts_decorate4([
-  (0, import_common7.Get)("session-required"),
-  _ts_param4(0, (0, import_common7.Req)()),
-  _ts_param4(1, (0, import_common7.Res)()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "sessionRequiredPage", null);
-AgentDashboardAuthController = _ts_decorate4([
-  (0, import_common7.Controller)("auth"),
-  _ts_param4(0, (0, import_common7.Optional)()),
-  _ts_param4(0, (0, import_common7.Inject)(DASHBOARD_AUTH)),
-  _ts_param4(1, (0, import_common7.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    String
-  ])
-], AgentDashboardAuthController);
-
 // src/server/normalize-path.ts
 function normalizeDashboardPath(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -1855,153 +1080,18 @@ function agentDashboardMountPaths(options) {
 __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 
 // src/server/agent-dashboard.module.ts
-var import_reflect_metadata2 = require("reflect-metadata");
-var import_common11 = require("@nestjs/common");
+var import_nestjs_agent_core3 = require("@dudousxd/nestjs-agent-core");
+var import_reflect_metadata = require("reflect-metadata");
+var import_common7 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
 // src/server/agent-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common10 = require("@nestjs/common");
-
-// src/server/auth/dashboard-auth-page.guard.ts
-var import_common9 = require("@nestjs/common");
-
-// src/server/auth/dashboard-auth-redirect.ts
-var import_common8 = require("@nestjs/common");
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-var DashboardAuthRedirect = class extends Error {
-  static {
-    __name(this, "DashboardAuthRedirect");
-  }
-  redirectTo;
-  constructor(redirectTo) {
-    super(`Redirect to ${redirectTo}`), this.redirectTo = redirectTo;
-    this.name = "DashboardAuthRedirect";
-  }
-};
-var DashboardAuthRedirectFilter = class {
-  static {
-    __name(this, "DashboardAuthRedirectFilter");
-  }
-  catch(exception, host) {
-    const response = host.switchToHttp().getResponse();
-    sendRedirect(response, 302, exception.redirectTo);
-  }
-};
-DashboardAuthRedirectFilter = _ts_decorate5([
-  (0, import_common8.Injectable)(),
-  (0, import_common8.Catch)(DashboardAuthRedirect)
-], DashboardAuthRedirectFilter);
-
-// src/server/auth/dashboard-auth-page.guard.ts
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-var DashboardAuthPageGuard = class {
-  static {
-    __name(this, "DashboardAuthPageGuard");
-  }
-  auth;
-  basePath;
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = this.verifyRequestSession(request);
-    if (!session) this.deny(auth, request);
-    attachSession(request, session);
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      this.deny(auth, request);
-    }
-    return true;
-  }
-  /**
-  * No valid session: bounce the browser navigation onward. Under Mode B (`login` configured)
-  * that's the built-in login screen, carrying `returnTo` back to the page that was requested.
-  * Under Mode-A-only there is no login screen to redirect to — the host mints the session
-  * itself — so this instead serves the instruction page rather than redirecting into a 404.
-  * Pulled out of `canActivate` so both the "no session at all" and the "revalidate revoked a
-  * renewable session" paths reuse the exact same mode-aware deny logic.
-  *
-  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
-  * return narrows the field within that method only — TS doesn't carry it across a method call —
-  * so the caller passes the already-narrowed value instead of this method re-deriving (or
-  * asserting away) the nullability.
-  */
-  deny(auth, request) {
-    if (!auth.modes.includes("login")) {
-      throw new DashboardAuthRedirect(`${this.basePath}/auth/session-required`);
-    }
-    const returnTo = readOriginalUrl(request);
-    throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
-  }
-  verifyRequestSession(request) {
-    const auth = this.auth;
-    if (!auth) return null;
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return null;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    });
-  }
-};
-DashboardAuthPageGuard = _ts_decorate6([
-  (0, import_common9.Injectable)(),
-  _ts_param5(0, (0, import_common9.Optional)()),
-  _ts_param5(0, (0, import_common9.Inject)(DASHBOARD_AUTH)),
-  _ts_param5(1, (0, import_common9.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    Object,
-    String
-  ])
-], DashboardAuthPageGuard);
-
-// src/server/agent-ui.controller.ts
-function _ts_decorate7(decorators, target, key, desc) {
+var import_nestjs_agent_core2 = require("@dudousxd/nestjs-agent-core");
+var import_common6 = require("@nestjs/common");
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2014,19 +1104,19 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", __importMetaUrl));
@@ -2062,7 +1152,7 @@ var AgentUiController = class {
     }
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common10.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common6.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -2070,155 +1160,57 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common10.NotFoundException();
+    if (safe !== file) throw new import_common6.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common10.NotFoundException();
+      throw new import_common6.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common10.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate7([
-  (0, import_common10.Get)(),
-  (0, import_common10.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common10.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_param6(0, (0, import_common10.Req)()),
-  _ts_param6(1, (0, import_common10.Res)({
+_ts_decorate3([
+  (0, import_common6.Get)(),
+  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param3(0, (0, import_common6.Req)()),
+  _ts_param3(1, (0, import_common6.Res)({
     passthrough: true
   })),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata6("design:returntype", String)
+  _ts_metadata3("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate7([
-  (0, import_common10.Get)("assets/:file"),
-  (0, import_common10.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param6(0, (0, import_common10.Param)("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("assets/:file"),
+  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param3(0, (0, import_common6.Param)("file")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof import_common10.StreamableFile === "undefined" ? Object : import_common10.StreamableFile)
+  _ts_metadata3("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate7([
-  (0, import_common10.Controller)(),
-  (0, import_common10.UseGuards)(DashboardAuthPageGuard),
-  (0, import_common10.UseFilters)(new DashboardAuthRedirectFilter()),
-  _ts_param6(0, (0, import_common10.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param6(1, (0, import_common10.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+AgentUiController = _ts_decorate3([
+  (0, import_nestjs_agent_core2.CanAnyone)(),
+  (0, import_common6.Controller)(),
+  _ts_param3(0, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
-// src/server/auth/dashboard-auth-config.ts
-var DEFAULT_TTL = "8h";
-function unitToMs(unit) {
-  switch (unit) {
-    case "ms":
-      return 1;
-    case "s":
-      return 1e3;
-    case "m":
-      return 6e4;
-    case "h":
-      return 36e5;
-    case "d":
-      return 864e5;
-    default:
-      return void 0;
-  }
-}
-__name(unitToMs, "unitToMs");
-function durationToMs(duration) {
-  const match = /^(\d+)(ms|s|m|h|d)$/.exec(duration.trim());
-  const amount = match?.[1];
-  const unit = match?.[2] !== void 0 ? unitToMs(match[2]) : void 0;
-  if (amount === void 0 || unit === void 0) {
-    throw new Error(`AgentDashboardModule dashboardAuth: invalid \`ttl\` duration: ${duration}`);
-  }
-  return Number(amount) * unit;
-}
-__name(durationToMs, "durationToMs");
-function resolveDashboardAuth(options) {
-  if (options === void 0) return null;
-  if (typeof options.secret !== "string" || options.secret === "") {
-    throw new Error("AgentDashboardModule dashboardAuth: `secret` is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
-  }
-  const modes = [];
-  if (options.session !== void 0) {
-    if (typeof options.session !== "function") {
-      throw new Error("AgentDashboardModule dashboardAuth: `session` must be a function.");
-    }
-    modes.push("session");
-  }
-  if (options.login !== void 0) {
-    if (typeof options.login !== "function") {
-      throw new Error("AgentDashboardModule dashboardAuth: `login` must be a function.");
-    }
-    modes.push("login");
-  }
-  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
-    throw new Error("AgentDashboardModule dashboardAuth: `revalidate` must be a function.");
-  }
-  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
-    throw new Error("AgentDashboardModule dashboardAuth: `unauthenticatedPage` must be a function.");
-  }
-  if (modes.length === 0) {
-    throw new Error("AgentDashboardModule dashboardAuth: at least one of `session` (the host mints the session from its own auth) or `login` (the built-in login screen) is required \u2014 otherwise the cookie can never be minted. Failing closed.");
-  }
-  return {
-    secret: options.secret,
-    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    modes,
-    ...options.session !== void 0 ? {
-      session: options.session
-    } : {},
-    ...options.login !== void 0 ? {
-      login: options.login
-    } : {},
-    ...options.revalidate !== void 0 ? {
-      revalidate: options.revalidate
-    } : {},
-    ...options.unauthenticatedPage !== void 0 ? {
-      unauthenticatedPage: options.unauthenticatedPage
-    } : {}
-  };
-}
-__name(resolveDashboardAuth, "resolveDashboardAuth");
-
-// src/server/guards.ts
-var import_reflect_metadata = require("reflect-metadata");
-var GUARDS_METADATA = "__guards__";
-function isGuardClass(guard) {
-  return typeof guard === "function";
-}
-__name(isGuardClass, "isGuardClass");
-function baseGuards(controller) {
-  return Reflect.getOwnMetadata(GUARDS_METADATA, controller) ?? [];
-}
-__name(baseGuards, "baseGuards");
-function stampGuards(guards, entries) {
-  for (const [controller, base] of entries) {
-    Reflect.defineMetadata(GUARDS_METADATA, [
-      ...base,
-      ...guards ?? []
-    ], controller);
-  }
-}
-__name(stampGuards, "stampGuards");
-
 // src/server/agent-dashboard.module.ts
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2231,37 +1223,33 @@ function _ts_decorate8(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-var API_BASE_GUARDS = baseGuards(AgentApiController);
-var UI_BASE_GUARDS = baseGuards(AgentUiController);
+__name(_ts_decorate4, "_ts_decorate");
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
+function assertProtected(options) {
+  if (process.env.NODE_ENV !== "production") return;
+  if (options.routes === false) return;
+  if ((options.decorators ?? []).length > 0) return;
+  throw new Error("AgentDashboardModule: the AI-gateway console would be served open in production. Say who reaches it, with `decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]`, or mount its routes yourself with `routes: false` and extend `AgentApiController` / `AgentUiController` under your own guards.");
+}
+__name(assertProtected, "assertProtected");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
-    stampGuards(options.guards, [
-      [
-        AgentApiController,
-        API_BASE_GUARDS
-      ]
-    ]);
     return {
       module: _AgentApiModule,
       imports: [
         ...options.imports ?? []
       ],
-      controllers: [
+      controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
         AgentApiController
-      ],
+      ], options.decorators),
       providers: [
         DashboardService,
-        DashboardAuthGuard,
-        options.dashboardAuth,
-        ...(options.guards ?? []).filter(isGuardClass),
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
         // injects this WITHOUT `@Optional()`.
         {
@@ -2269,134 +1257,60 @@ var AgentApiModule = class _AgentApiModule {
           useValue: options.approvalActorRef
         }
       ],
-      // DASHBOARD_AUTH re-exported so AgentUiController/AgentDashboardAuthController (hosted
-      // directly by AgentDashboardModule, which imports this module) resolve the SAME instance
-      // instead of re-running a host's async factory a second time.
+      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`).
       exports: [
         DashboardService,
-        DASHBOARD_AUTH
+        DASHBOARD_APPROVAL_ACTOR_REF
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate8([
-  (0, import_common11.Module)({})
+AgentApiModule = _ts_decorate4([
+  (0, import_common7.Module)({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
   static {
     __name(this, "AgentDashboardModule");
   }
   static forRoot(options = {}) {
+    assertProtected(options);
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, [
-      [
-        AgentUiController,
-        UI_BASE_GUARDS
-      ]
-    ]);
-    const dashboardAuthProvider = {
-      provide: DASHBOARD_AUTH,
-      useValue: resolveDashboardAuth(options.dashboardAuth)
-    };
     return {
       module: _AgentDashboardModule,
       imports: [
         ...options.imports ?? [],
-        // Guards + host imports must reach the API controller's HOST module — enhancers resolve
-        // from their controller's own module, never from a parent (see AgentApiModule.register).
         // Spread-only-when-set: exactOptionalPropertyTypes rejects an explicit `undefined`.
         AgentApiModule.register({
           ...options.imports ? {
             imports: options.imports
           } : {},
-          ...options.guards ? {
-            guards: options.guards
+          ...options.decorators ? {
+            decorators: options.decorators
           } : {},
-          ...options.approvalActorRef ? {
-            approvalActorRef: options.approvalActorRef
-          } : {},
-          dashboardAuth: dashboardAuthProvider
-        }),
-        import_core.RouterModule.register([
-          {
-            path: basePath,
-            module: _AgentDashboardModule
-          },
-          {
-            path: apiBasePath,
-            module: AgentApiModule
-          }
-        ])
-      ],
-      controllers: [
-        AgentUiController,
-        AgentDashboardAuthController
-      ],
-      providers: [
-        {
-          provide: DASHBOARD_BASE_PATH,
-          useValue: basePath
-        },
-        {
-          provide: DASHBOARD_API_PATH,
-          useValue: apiBasePath
-        },
-        DashboardAuthPageGuard,
-        // AgentUiController is hosted HERE, so its guards DI-instantiate from this module.
-        ...(options.guards ?? []).filter(isGuardClass)
-      ],
-      // Re-export the API module so its DashboardService reaches importers (e.g. the host's own controllers).
-      exports: [
-        AgentApiModule
-      ]
-    };
-  }
-  static forRootAsync(options) {
-    const basePath = normalize(options.basePath ?? "/ai-gateway");
-    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, [
-      [
-        AgentUiController,
-        UI_BASE_GUARDS
-      ]
-    ]);
-    const dashboardAuthProvider = {
-      provide: DASHBOARD_AUTH,
-      inject: options.inject ?? [],
-      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
-    };
-    return {
-      module: _AgentDashboardModule,
-      imports: [
-        ...options.imports ?? [],
-        AgentApiModule.register({
-          ...options.imports ? {
-            imports: options.imports
-          } : {},
-          ...options.guards ? {
-            guards: options.guards
+          ...options.routes === false ? {
+            routes: false
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
-          } : {},
-          dashboardAuth: dashboardAuthProvider
+          } : {}
         }),
-        import_core.RouterModule.register([
-          {
-            path: basePath,
-            module: _AgentDashboardModule
-          },
-          {
-            path: apiBasePath,
-            module: AgentApiModule
-          }
-        ])
-      ],
-      controllers: [
-        AgentUiController,
-        AgentDashboardAuthController
+        ...options.routes === false ? [] : [
+          import_core.RouterModule.register([
+            {
+              path: basePath,
+              module: _AgentDashboardModule
+            },
+            {
+              path: apiBasePath,
+              module: AgentApiModule
+            }
+          ])
+        ]
       ],
+      controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
+        AgentUiController
+      ], options.decorators),
       providers: [
         {
           provide: DASHBOARD_BASE_PATH,
@@ -2405,18 +1319,20 @@ var AgentDashboardModule = class _AgentDashboardModule {
         {
           provide: DASHBOARD_API_PATH,
           useValue: apiBasePath
-        },
-        DashboardAuthPageGuard,
-        ...(options.guards ?? []).filter(isGuardClass)
+        }
       ],
+      // Re-export the API module so its DashboardService reaches importers (e.g. the host's own
+      // controllers), and the paths a self-mounted `AgentUiController` subclass injects.
       exports: [
-        AgentApiModule
+        AgentApiModule,
+        DASHBOARD_BASE_PATH,
+        DASHBOARD_API_PATH
       ]
     };
   }
 };
-AgentDashboardModule = _ts_decorate8([
-  (0, import_common11.Module)({})
+AgentDashboardModule = _ts_decorate4([
+  (0, import_common7.Module)({})
 ], AgentDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -2427,16 +1343,13 @@ AgentDashboardModule = _ts_decorate8([
   AGENT_PRICING_STORE,
   AgentApiController,
   AgentApiModule,
-  AgentDashboardAuthController,
   AgentDashboardModule,
   AgentUiController,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
-  DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH,
   DashboardService,
   agentDashboardMountPaths,
-  parsePriceInput,
-  resolveDashboardAuth
+  parsePriceInput
 });
 //# sourceMappingURL=index.cjs.map