@dudousxd/nestjs-agent-dashboard 0.17.0 → 0.19.0

package/dist/server/index.js

@@ -2,401 +2,13 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/server/agent-api.controller.ts
-import { Body, Controller, Get, HttpCode, Inject as Inject3, Optional as Optional3, Param, Post, Query, Req, Sse, UseGuards } from "@nestjs/common";
-
-// src/server/auth/dashboard-auth.guard.ts
-import { Inject, Injectable, Optional, UnauthorizedException } from "@nestjs/common";
-
-// src/server/tokens.ts
-var AGENT_GOVERNANCE_QUERIES = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:governance-queries");
-var AGENT_ACTOR_DIRECTORY = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-directory");
-var AGENT_PRICING_STORE = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:pricing-store");
-var AGENT_APPROVAL_PORT = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:approval-port");
-var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
-var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
-var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
-var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
-var DASHBOARD_AUTH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:dashboard-auth");
-
-// src/server/auth/cookie-header.ts
-function parseCookieHeader(header) {
-  const cookies = {};
-  if (typeof header !== "string" || header === "") return cookies;
-  for (const segment of header.split(";")) {
-    const eq = segment.indexOf("=");
-    if (eq <= 0) continue;
-    const name = segment.slice(0, eq).trim();
-    if (name === "") continue;
-    let rawValue = segment.slice(eq + 1).trim();
-    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
-      rawValue = rawValue.slice(1, -1);
-    }
-    if (name in cookies) continue;
-    try {
-      cookies[name] = decodeURIComponent(rawValue);
-    } catch {
-      cookies[name] = rawValue;
-    }
-  }
-  return cookies;
-}
-__name(parseCookieHeader, "parseCookieHeader");
-function serializeSetCookie(name, value, options) {
-  const parts = [
-    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
-  ];
-  parts.push(`Path=${options.path}`);
-  parts.push("HttpOnly");
-  parts.push("SameSite=Lax");
-  if (options.secure) parts.push("Secure");
-  if (options.clear) {
-    parts.push("Max-Age=0");
-    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-  } else {
-    parts.push(`Max-Age=${options.maxAgeSeconds}`);
-  }
-  return parts.join("; ");
-}
-__name(serializeSetCookie, "serializeSetCookie");
-
-// src/server/auth/http-request.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord, "isRecord");
-function readHeaders(request) {
-  if (!isRecord(request)) return {};
-  const headers = request.headers;
-  return isRecord(headers) ? headers : {};
-}
-__name(readHeaders, "readHeaders");
-function headerToString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
-    return value.join(",");
-  }
-  return void 0;
-}
-__name(headerToString, "headerToString");
-function readCookieHeader(request) {
-  return headerToString(readHeaders(request).cookie);
-}
-__name(readCookieHeader, "readCookieHeader");
-function isHttpsRequest(request) {
-  if (isRecord(request) && request.protocol === "https") return true;
-  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
-  if (forwarded === void 0) return false;
-  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
-}
-__name(isHttpsRequest, "isHttpsRequest");
-function readOriginalUrl(request) {
-  if (!isRecord(request)) return "/";
-  const originalUrl = request.originalUrl;
-  if (typeof originalUrl === "string" && originalUrl !== "") return originalUrl;
-  const url = request.url;
-  return typeof url === "string" && url !== "" ? url : "/";
-}
-__name(readOriginalUrl, "readOriginalUrl");
-function attachSession(request, session) {
-  if (!isRecord(request)) return;
-  const target = request;
-  target.dashboardSession = session;
-}
-__name(attachSession, "attachSession");
-
-// src/server/auth/response.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-__name(isRecord2, "isRecord");
-function isHeaderCapableResponse(value) {
-  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
-}
-__name(isHeaderCapableResponse, "isHeaderCapableResponse");
-function resolveHeaderCapableResponse(response) {
-  if (isHeaderCapableResponse(response)) return response;
-  if (isRecord2(response) && isHeaderCapableResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveHeaderCapableResponse, "resolveHeaderCapableResponse");
-function existingSetCookies(response) {
-  const current = response.getHeader("set-cookie");
-  if (Array.isArray(current)) return current;
-  if (typeof current === "string") return [
-    current
-  ];
-  return [];
-}
-__name(existingSetCookies, "existingSetCookies");
-function appendSetCookie(response, cookie) {
-  const raw = resolveHeaderCapableResponse(response);
-  if (!raw) return;
-  raw.setHeader("set-cookie", [
-    ...existingSetCookies(raw),
-    cookie
-  ]);
-}
-__name(appendSetCookie, "appendSetCookie");
-function isRawNodeResponse(value) {
-  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
-}
-__name(isRawNodeResponse, "isRawNodeResponse");
-function resolveRawResponse(response) {
-  if (isRawNodeResponse(response)) return response;
-  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
-  return null;
-}
-__name(resolveRawResponse, "resolveRawResponse");
-function responseAlreadyWritten(response) {
-  const raw = resolveRawResponse(response);
-  return raw?.headersSent === true;
-}
-__name(responseAlreadyWritten, "responseAlreadyWritten");
-function sendHtml(response, status, html) {
-  const raw = resolveRawResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("content-type", "text/html; charset=utf-8");
-  raw.setHeader("cache-control", "no-store, must-revalidate");
-  raw.end(html);
-}
-__name(sendHtml, "sendHtml");
-function sendRedirect(response, status, location) {
-  const raw = resolveRawResponse(response);
-  if (!raw) return;
-  raw.statusCode = status;
-  raw.setHeader("location", location);
-  raw.end();
-}
-__name(sendRedirect, "sendRedirect");
-
-// src/server/auth/session-cookie.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var EXP_GRACE_MS = 3e4;
-function base64urlEncode(value) {
-  return Buffer.from(value, "utf8").toString("base64url");
-}
-__name(base64urlEncode, "base64urlEncode");
-function base64urlDecode(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-__name(base64urlDecode, "base64urlDecode");
-function hmac(secret, payload) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-__name(hmac, "hmac");
-function signSessionCookie(user, options) {
-  const issuedAt = options.now ?? Date.now();
-  const session = {
-    sub: user.id,
-    ...user.name !== void 0 ? {
-      name: user.name
-    } : {},
-    roles: user.roles ?? [],
-    iat: issuedAt,
-    exp: issuedAt + options.ttlMs
-  };
-  const encodedPayload = base64urlEncode(JSON.stringify(session));
-  const signature = hmac(options.secret, encodedPayload);
-  return `${encodedPayload}.${signature}`;
-}
-__name(signSessionCookie, "signSessionCookie");
-function isSessionPayload(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const record = {
-    ...value
-  };
-  if (typeof record.sub !== "string") return false;
-  if (record.name !== void 0 && typeof record.name !== "string") return false;
-  if (!Array.isArray(record.roles)) return false;
-  if (!record.roles.every((role) => typeof role === "string")) return false;
-  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
-  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
-  return true;
-}
-__name(isSessionPayload, "isSessionPayload");
-function verifySessionCookie(value, options) {
-  try {
-    const dot = value.indexOf(".");
-    if (dot <= 0 || dot === value.length - 1) return null;
-    const encodedPayload = value.slice(0, dot);
-    const providedSignature = value.slice(dot + 1);
-    const expectedSignature = hmac(options.secret, encodedPayload);
-    const provided = Buffer.from(providedSignature, "base64url");
-    const expected = Buffer.from(expectedSignature, "base64url");
-    if (provided.length !== expected.length) return null;
-    if (!timingSafeEqual(provided, expected)) return null;
-    const decoded = JSON.parse(base64urlDecode(encodedPayload));
-    if (!isSessionPayload(decoded)) return null;
-    const now = options.now ?? Date.now();
-    if (now > decoded.exp + EXP_GRACE_MS) return null;
-    const session = {
-      sub: decoded.sub,
-      ...decoded.name !== void 0 ? {
-        name: decoded.name
-      } : {},
-      roles: decoded.roles,
-      iat: decoded.iat,
-      exp: decoded.exp
-    };
-    return session;
-  } catch {
-    return null;
-  }
-}
-__name(verifySessionCookie, "verifySessionCookie");
-
-// src/server/auth/session-cookie-io.ts
-var SESSION_COOKIE_NAME = "agent_dashboard_session";
-var COOKIE_PATH = "/";
-function issueSessionCookie(user, context) {
-  const value = signSessionCookie(user, {
-    secret: context.auth.secret,
-    ttlMs: context.auth.ttlMs,
-    ...context.now !== void 0 ? {
-      now: context.now
-    } : {}
-  });
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
-    path: COOKIE_PATH,
-    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
-    secure: isHttpsRequest(context.request)
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(issueSessionCookie, "issueSessionCookie");
-function clearSessionCookie(context) {
-  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
-    path: COOKIE_PATH,
-    maxAgeSeconds: 0,
-    secure: isHttpsRequest(context.request),
-    clear: true
-  });
-  appendSetCookie(context.response, cookie);
-}
-__name(clearSessionCookie, "clearSessionCookie");
-var inFlightRevalidations = /* @__PURE__ */ new Map();
-function revalidationKey(session) {
-  return `${session.sub}:${session.iat}`;
-}
-__name(revalidationKey, "revalidationKey");
-function getOrStartRevalidation(auth, session, user) {
-  const hook = auth.revalidate;
-  if (!hook) return Promise.resolve(true);
-  const key = revalidationKey(session);
-  const inFlight = inFlightRevalidations.get(key);
-  if (inFlight) return inFlight;
-  const outcome = (async () => {
-    try {
-      return await hook(user);
-    } catch {
-      return false;
-    }
-  })().finally(() => {
-    inFlightRevalidations.delete(key);
-  });
-  inFlightRevalidations.set(key, outcome);
-  return outcome;
-}
-__name(getOrStartRevalidation, "getOrStartRevalidation");
-async function maybeRenewSession(auth, session, request, response, now = Date.now()) {
-  if (now - session.iat <= auth.ttlMs / 2) return true;
-  const user = {
-    id: session.sub,
-    ...session.name !== void 0 ? {
-      name: session.name
-    } : {},
-    roles: session.roles
-  };
-  const allowed = await getOrStartRevalidation(auth, session, user);
-  if (!allowed) {
-    clearSessionCookie({
-      request,
-      response
-    });
-    return false;
-  }
-  issueSessionCookie(user, {
-    auth,
-    request,
-    response,
-    now
-  });
-  return true;
-}
-__name(maybeRenewSession, "maybeRenewSession");
-
-// src/server/auth/dashboard-auth.guard.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param, "_ts_param");
-var DashboardAuthGuard = class {
-  static {
-    __name(this, "DashboardAuthGuard");
-  }
-  auth;
-  constructor(auth) {
-    this.auth = auth;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = this.verifyRequestSession(request);
-    if (!session) throw new UnauthorizedException();
-    attachSession(request, session);
-    if (!await maybeRenewSession(this.auth, session, request, http.getResponse())) {
-      throw new UnauthorizedException();
-    }
-    return true;
-  }
-  verifyRequestSession(request) {
-    const auth = this.auth;
-    if (!auth) return null;
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return null;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    });
-  }
-};
-DashboardAuthGuard = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Optional()),
-  _ts_param(0, Inject(DASHBOARD_AUTH)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    Object
-  ])
-], DashboardAuthGuard);
+import { CanAnyone } from "@dudousxd/nestjs-agent-core";
+import { Body, Controller, Get, HttpCode, Inject as Inject2, Optional as Optional2, Param, Post, Query, Req, Sse } from "@nestjs/common";
 
 // src/server/dashboard.service.ts
 import { subscribe, unsubscribe } from "diagnostics_channel";
 import { channelName } from "@dudousxd/nestjs-diagnostics";
-import { Inject as Inject2, Injectable as Injectable2, NotFoundException, NotImplementedException, Optional as Optional2 } from "@nestjs/common";
+import { Inject, Injectable, NotFoundException, NotImplementedException, Optional } from "@nestjs/common";
 import { Observable as Observable2 } from "rxjs";
 
 // src/server/parse-approval-decision.ts
@@ -461,8 +73,18 @@ function isFiniteNonNegative(value) {
 }
 __name(isFiniteNonNegative, "isFiniteNonNegative");
 
+// src/server/tokens.ts
+var AGENT_GOVERNANCE_QUERIES = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:governance-queries");
+var AGENT_ACTOR_DIRECTORY = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-directory");
+var AGENT_PRICING_STORE = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:pricing-store");
+var AGENT_APPROVAL_PORT = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:approval-port");
+var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
+var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
+var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
+var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+
 // src/server/dashboard.service.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -475,19 +97,19 @@ function _ts_decorate2(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(metadataKey, metadataValue) {
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param, "_ts_param");
 var PRICING_STORE_UNBOUND_MESSAGE = "Pricing CRUD is unavailable: no AGENT_PRICING_STORE is bound. Bind a pricing store (e.g. MikroOrmPricingStore from @dudousxd/nestjs-agent-store-mikro-orm) to enable it.";
 var APPROVAL_PORT_UNBOUND_MESSAGE = "Approve/reject is unavailable: no AGENT_APPROVAL_PORT is bound. Import AgentModule from @dudousxd/nestjs-agent alongside this dashboard to enable it \u2014 the approvals inbox stays read-only until then.";
 var GENUI_STATS_UNSUPPORTED_MESSAGE = "Generative UI telemetry is unavailable: the bound AGENT_GOVERNANCE_QUERIES store does not implement genuiStats. Use a store adapter that records generative-UI calls (recordGenuiCalls) to enable it.";
@@ -521,16 +143,20 @@ var DashboardService = class {
   }
   /** Spend/usage overview for a day range: by-model + by-actor spend and the daily trend, in parallel. */
   async spend(range) {
-    const [byModel, byActorRaw, trend] = await Promise.all([
+    const [byModel, byActorRaw, trend, byFeature] = await Promise.all([
       this.queries.spendByModel(range),
       this.queries.spendByActor(range),
-      this.queries.usageTrend(range)
+      this.queries.usageTrend(range),
+      this.queries.spendByFeature?.(range)
     ]);
     const byActor = await this.withActorLabels(byActorRaw);
     return {
       byModel,
       byActor,
-      trend
+      trend,
+      ...byFeature !== void 0 ? {
+        byFeature
+      } : {}
     };
   }
   /** Top threads by cost for a day range (default 10, highest cost first). */
@@ -752,17 +378,17 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate2([
-  Injectable2(),
-  _ts_param2(0, Inject2(AGENT_GOVERNANCE_QUERIES)),
-  _ts_param2(1, Optional2()),
-  _ts_param2(1, Inject2(AGENT_ACTOR_DIRECTORY)),
-  _ts_param2(2, Optional2()),
-  _ts_param2(2, Inject2(AGENT_PRICING_STORE)),
-  _ts_param2(3, Optional2()),
-  _ts_param2(3, Inject2(AGENT_APPROVAL_PORT)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+DashboardService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(AGENT_GOVERNANCE_QUERIES)),
+  _ts_param(1, Optional()),
+  _ts_param(1, Inject(AGENT_ACTOR_DIRECTORY)),
+  _ts_param(2, Optional()),
+  _ts_param(2, Inject(AGENT_PRICING_STORE)),
+  _ts_param(3, Optional()),
+  _ts_param(3, Inject(AGENT_APPROVAL_PORT)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
     typeof AgentGovernanceQueries === "undefined" ? Object : AgentGovernanceQueries,
     typeof ActorDirectory === "undefined" ? Object : ActorDirectory,
     typeof AgentPricingStore === "undefined" ? Object : AgentPricingStore,
@@ -930,7 +556,7 @@ function parseApprovalWhere(raw) {
 __name(parseApprovalWhere, "parseApprovalWhere");
 
 // src/server/agent-api.controller.ts
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -943,19 +569,19 @@ function _ts_decorate3(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(metadataKey, metadataValue) {
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param2, "_ts_param");
 var DAY_MS = 864e5;
 var ISO_DAY2 = /^\d{4}-\d{2}-\d{2}$/;
 function utcDay(daysAgo) {
@@ -1173,620 +799,222 @@ var AgentApiController = class {
     return this.dashboard.streamEvents();
   }
 };
-_ts_decorate3([
+_ts_decorate2([
   Get("spend"),
-  _ts_param3(0, Query("from")),
-  _ts_param3(1, Query("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("from")),
+  _ts_param2(1, Query("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "spend", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("top-threads"),
-  _ts_param3(0, Query("from")),
-  _ts_param3(1, Query("to")),
-  _ts_param3(2, Query("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("from")),
+  _ts_param2(1, Query("to")),
+  _ts_param2(2, Query("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "topThreads", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("reliability"),
-  _ts_param3(0, Query("from")),
-  _ts_param3(1, Query("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("from")),
+  _ts_param2(1, Query("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "reliability", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("runs"),
-  _ts_param3(0, Query("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runs", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("runs-page"),
-  _ts_param3(0, Query("page")),
-  _ts_param3(1, Query("limit")),
-  _ts_param3(2, Query("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runsPage", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("runs/:runId"),
-  _ts_param3(0, Param("runId")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Param("runId")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runDetail", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("tool-calls"),
-  _ts_param3(0, Query("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCalls", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("tool-calls-page"),
-  _ts_param3(0, Query("page")),
-  _ts_param3(1, Query("limit")),
-  _ts_param3(2, Query("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCallsPage", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("approvals"),
-  _ts_param3(0, Query("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvals", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("approvals-page"),
-  _ts_param3(0, Query("page")),
-  _ts_param3(1, Query("limit")),
-  _ts_param3(2, Query("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvalsPage", null);
-_ts_decorate3([
+_ts_decorate2([
   Post("approvals/:toolCallId"),
   HttpCode(204),
-  _ts_param3(0, Param("toolCallId")),
-  _ts_param3(1, Body()),
-  _ts_param3(2, Req()),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Param("toolCallId")),
+  _ts_param2(1, Body()),
+  _ts_param2(2, Req()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     Object,
     Object
   ]),
-  _ts_metadata3("design:returntype", Promise)
+  _ts_metadata2("design:returntype", Promise)
 ], AgentApiController.prototype, "decideApproval", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("tools"),
-  _ts_param3(0, Query("from")),
-  _ts_param3(1, Query("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("from")),
+  _ts_param2(1, Query("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "tools", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("genui"),
-  _ts_param3(0, Query("from")),
-  _ts_param3(1, Query("to")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("from")),
+  _ts_param2(1, Query("to")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "genui", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("threads"),
-  _ts_param3(0, Query("limit")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("limit")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threads", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("threads-page"),
-  _ts_param3(0, Query("page")),
-  _ts_param3(1, Query("limit")),
-  _ts_param3(2, Query("where")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadsPage", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("threads/:threadId"),
-  _ts_param3(0, Param("threadId")),
-  _ts_param3(1, Query("messages")),
-  _ts_param3(2, Query("runs")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Param("threadId")),
+  _ts_param2(1, Query("messages")),
+  _ts_param2(2, Query("runs")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadDetail", null);
-_ts_decorate3([
+_ts_decorate2([
   Get("pricing"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "listPrices", null);
-_ts_decorate3([
+_ts_decorate2([
   Post("pricing"),
-  _ts_param3(0, Body()),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     Object
   ]),
-  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "upsertPrice", null);
-_ts_decorate3([
+_ts_decorate2([
   Sse("stream"),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
-  _ts_metadata3("design:returntype", typeof Observable === "undefined" ? Object : Observable)
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Observable === "undefined" ? Object : Observable)
 ], AgentApiController.prototype, "stream", null);
-AgentApiController = _ts_decorate3([
+AgentApiController = _ts_decorate2([
+  CanAnyone(),
   Controller(),
-  UseGuards(DashboardAuthGuard),
-  _ts_param3(1, Inject3(DASHBOARD_APPROVAL_ACTOR_REF)),
-  _ts_param3(2, Optional3()),
-  _ts_param3(2, Inject3(AGENT_ACTOR_RESOLVER)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param2(1, Inject2(DASHBOARD_APPROVAL_ACTOR_REF)),
+  _ts_param2(2, Optional2()),
+  _ts_param2(2, Inject2(AGENT_ACTOR_RESOLVER)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     Object,
     typeof ActorResolver === "undefined" ? Object : ActorResolver
   ])
 ], AgentApiController);
 
-// src/server/agent-dashboard-auth.controller.ts
-import { Body as Body2, Controller as Controller2, Get as Get2, Header, HttpCode as HttpCode2, Inject as Inject4, Logger, NotFoundException as NotFoundException2, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
-
-// src/server/auth/login-page.ts
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-__name(escapeHtml, "escapeHtml");
-function pageShell(content, title) {
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<meta name="robots" content="noindex, nofollow" />
-<title>${title}</title>
-<style>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    background: #09090b;
-    color: #e4e4e7;
-    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    padding: 16px;
-  }
-  .card {
-    width: 100%;
-    max-width: 384px;
-    border: 1px solid #27272a;
-    background: #18181b;
-    border-radius: 8px;
-    padding: 32px;
-    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
-  }
-  .brand {
-    margin: 0 0 24px;
-    text-align: center;
-    font-size: 18px;
-    font-weight: 600;
-    color: #34d399;
-  }
-  h1 {
-    margin: 0 0 12px;
-    font-size: 16px;
-    font-weight: 600;
-    color: #f4f4f5;
-  }
-  p { margin: 0 0 16px; color: #a1a1aa; }
-  form { display: flex; flex-direction: column; gap: 16px; }
-  label { display: flex; flex-direction: column; gap: 6px; }
-  .field-label {
-    font-size: 11px;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    color: #71717a;
-  }
-  input {
-    border-radius: 4px;
-    border: 1px solid #3f3f46;
-    background: #09090b;
-    color: #f4f4f5;
-    padding: 8px 12px;
-    font: inherit;
-    outline: none;
-  }
-  input:focus { border-color: rgb(52 211 153 / 0.6); }
-  .error { margin: 0; font-size: 12px; color: #fb7185; }
-  button {
-    margin-top: 8px;
-    border-radius: 4px;
-    border: 1px solid rgb(52 211 153 / 0.4);
-    background: rgb(52 211 153 / 0.1);
-    color: #6ee7b7;
-    padding: 8px 12px;
-    font: inherit;
-    font-size: 12px;
-    font-weight: 500;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-    cursor: pointer;
-  }
-  button:hover { background: rgb(52 211 153 / 0.2); }
-</style>
-</head>
-<body>
-  <div class="card">
-    ${content}
-  </div>
-</body>
-</html>`;
-}
-__name(pageShell, "pageShell");
-function renderLoginPage(options) {
-  const action = escapeHtml(options.actionUrl);
-  const returnTo = escapeHtml(options.returnTo);
-  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
-  return pageShell(`<p class="brand">AI Gateway</p>
-    <form method="post" action="${action}">
-      <input type="hidden" name="returnTo" value="${returnTo}" />
-      <label>
-        <span class="field-label">Username</span>
-        <input type="text" name="username" autocomplete="username" autofocus />
-      </label>
-      <label>
-        <span class="field-label">Password</span>
-        <input type="password" name="password" autocomplete="current-password" />
-      </label>
-      ${errorBanner}
-      <button type="submit">Sign in</button>
-    </form>`, "Sign in \u2014 AI Gateway");
-}
-__name(renderLoginPage, "renderLoginPage");
-function renderSessionRequiredPage() {
-  return pageShell(`<p class="brand">AI Gateway</p>
-    <h1>Open this console from your application</h1>
-    <p>Your session is minted by the host app. Use its console launcher to sign in, then reload.</p>`, "Sign in \u2014 AI Gateway");
-}
-__name(renderSessionRequiredPage, "renderSessionRequiredPage");
-
-// src/server/auth/sanitize-return-to.ts
-function sanitizeReturnTo(basePath, returnTo) {
-  if (typeof returnTo !== "string" || returnTo === "") return basePath;
-  if (!returnTo.startsWith("/") || returnTo.startsWith("//")) return basePath;
-  if (returnTo !== basePath && !returnTo.startsWith(`${basePath}/`) && !returnTo.startsWith(`${basePath}?`)) {
-    return basePath;
-  }
-  return returnTo;
-}
-__name(sanitizeReturnTo, "sanitizeReturnTo");
-
-// src/server/agent-dashboard-auth.controller.ts
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata4(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-__name(isNonEmptyString, "isNonEmptyString");
-function isString(value) {
-  return typeof value === "string";
-}
-__name(isString, "isString");
-var AgentDashboardAuthController = class _AgentDashboardAuthController {
-  static {
-    __name(this, "AgentDashboardAuthController");
-  }
-  auth;
-  basePath;
-  logger = new Logger(_AgentDashboardAuthController.name);
-  /** Warn once PER HOOK KIND (not per request) so a broken hook can't be used to flood the logs. */
-  warnedHooks = /* @__PURE__ */ new Set();
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  loginPage(req, res, returnToQuery, error) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException2();
-    const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
-    if (this.currentSession(req)) {
-      res.status(302);
-      res.setHeader("Location", returnTo);
-      return "";
-    }
-    return renderLoginPage({
-      actionUrl: `${this.basePath}/auth/login`,
-      returnTo,
-      error: error !== void 0
-    });
-  }
-  async login(body, req, res) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("login")) throw new NotFoundException2();
-    const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
-    const username = body?.username;
-    const password = body?.password;
-    if (!isNonEmptyString(username) || password !== void 0 && !isString(password)) {
-      this.redirectToLoginError(res, returnTo);
-      return "";
-    }
-    const user = await this.runHook("login", () => auth.login?.(username.trim(), isString(password) ? password : "") ?? null);
-    if (!user) {
-      this.redirectToLoginError(res, returnTo);
-      return "";
-    }
-    issueSessionCookie(user, {
-      auth,
-      request: req,
-      response: res
-    });
-    res.status(302);
-    res.setHeader("Location", returnTo);
-    return "";
-  }
-  logout(req, res) {
-    clearSessionCookie({
-      request: req,
-      response: res
-    });
-    res.status(302);
-    res.setHeader("Location", this.auth && !this.auth.modes.includes("login") ? `${this.basePath}/auth/session-required` : `${this.basePath}/auth/login`);
-    return "";
-  }
-  // Mode A: the host frontend (carrying its own auth) POSTs here; the host hook validates the raw
-  // request and returns the session user, or `null` to deny. No credential reaches this library.
-  async session(request, response) {
-    const auth = this.requireAuth();
-    if (!auth.modes.includes("session")) throw new NotFoundException2();
-    const user = await this.runHook("session", () => auth.session?.(request) ?? null);
-    if (!user) throw new UnauthorizedException2();
-    issueSessionCookie(user, {
-      auth,
-      request,
-      response
-    });
-  }
-  // Mode-A-only landing: the host mints the session, so there is nothing to submit here. Serves
-  // as the redirect target `DashboardAuthPageGuard` bounces to instead of `/auth/login`, which
-  // 404s under Mode A (see `loginPage` above).
-  //
-  // Non-passthrough `@Res()` (unlike its sibling routes) because `dashboardAuth.unauthenticatedPage`
-  // hands the response to the HOST, which writes and ends it itself — there is no return value for
-  // Nest to send, and letting Nest also send one would double-write. The `Content-Type` /
-  // `Cache-Control` this route used to carry as decorators move into `sendHtml` for the built-in
-  // path; the host owns its own headers on the hook path.
-  async sessionRequiredPage(req, res) {
-    const auth = this.requireAuth();
-    if (auth.modes.includes("login")) throw new NotFoundException2();
-    const hook = auth.unauthenticatedPage;
-    if (hook) {
-      try {
-        await hook({
-          request: req,
-          response: res,
-          basePath: this.basePath
-        });
-        if (responseAlreadyWritten(res)) return;
-        this.warnHookOnce("unauthenticatedPage", "dashboardAuth.unauthenticatedPage returned without writing a response; falling back to the built-in page. The hook must write AND end the response it is given.");
-      } catch (error) {
-        this.warnHookOnce("unauthenticatedPage", `dashboardAuth.unauthenticatedPage threw; falling back to the built-in page. ${String(error)}`);
-        if (responseAlreadyWritten(res)) return;
-      }
-    }
-    sendHtml(res, 200, renderSessionRequiredPage());
-  }
-  /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
-  redirectToLoginError(res, returnTo) {
-    res.status(303);
-    res.setHeader("Location", `${this.basePath}/auth/login?error=1&returnTo=${encodeURIComponent(returnTo)}`);
-  }
-  currentSession(req) {
-    const auth = this.auth;
-    if (!auth) return false;
-    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return false;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    }) !== null;
-  }
-  /**
-  * Run a host hook (`login` or `session`) defensively: a throw (sync or async) is treated as a
-  * denial (`null`) and warn-logged ONCE PER KIND, so a buggy/unreachable hook never 500s the
-  * endpoint into a stack-trace leak nor floods the logs on repeated bad attempts.
-  */
-  async runHook(kind, run) {
-    try {
-      return await run() ?? null;
-    } catch (error) {
-      this.warnHookOnce(kind, `AgentDashboardModule dashboardAuth ${kind} hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
-      return null;
-    }
-  }
-  /**
-  * Warn once per hook kind for the life of the process, not once per request: a broken hook fires
-  * on every denied navigation and would otherwise flood the logs.
-  */
-  warnHookOnce(kind, message) {
-    if (this.warnedHooks.has(kind)) return;
-    this.warnedHooks.add(kind);
-    this.logger.warn(message);
-  }
-  requireAuth() {
-    if (!this.auth) throw new NotFoundException2();
-    return this.auth;
-  }
-};
-_ts_decorate4([
-  Get2("login"),
-  Header("Content-Type", "text/html; charset=utf-8"),
-  Header("Cache-Control", "no-store"),
-  _ts_param4(0, Req2()),
-  _ts_param4(1, Res({
-    passthrough: true
-  })),
-  _ts_param4(2, Query2("returnTo")),
-  _ts_param4(3, Query2("error")),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse,
-    String,
-    String
-  ]),
-  _ts_metadata4("design:returntype", String)
-], AgentDashboardAuthController.prototype, "loginPage", null);
-_ts_decorate4([
-  Post2("login"),
-  _ts_param4(0, Body2()),
-  _ts_param4(1, Req2()),
-  _ts_param4(2, Res({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof LoginFormBody === "undefined" ? Object : LoginFormBody,
-    Object,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "login", null);
-_ts_decorate4([
-  Post2("logout"),
-  _ts_param4(0, Req2()),
-  _ts_param4(1, Res({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
-  ]),
-  _ts_metadata4("design:returntype", String)
-], AgentDashboardAuthController.prototype, "logout", null);
-_ts_decorate4([
-  Post2("session"),
-  HttpCode2(204),
-  _ts_param4(0, Req2()),
-  _ts_param4(1, Res({
-    passthrough: true
-  })),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "session", null);
-_ts_decorate4([
-  Get2("session-required"),
-  _ts_param4(0, Req2()),
-  _ts_param4(1, Res()),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
-    Object
-  ]),
-  _ts_metadata4("design:returntype", Promise)
-], AgentDashboardAuthController.prototype, "sessionRequiredPage", null);
-AgentDashboardAuthController = _ts_decorate4([
-  Controller2("auth"),
-  _ts_param4(0, Optional4()),
-  _ts_param4(0, Inject4(DASHBOARD_AUTH)),
-  _ts_param4(1, Inject4(DASHBOARD_BASE_PATH)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    Object,
-    String
-  ])
-], AgentDashboardAuthController);
-
 // src/server/normalize-path.ts
 function normalizeDashboardPath(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -1813,6 +1041,7 @@ function agentDashboardMountPaths(options) {
 __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 
 // src/server/agent-dashboard.module.ts
+import { withControllerDecorators } from "@dudousxd/nestjs-agent-core";
 import "reflect-metadata";
 import { Module } from "@nestjs/common";
 import { RouterModule } from "@nestjs/core";
@@ -1821,145 +1050,9 @@ import { RouterModule } from "@nestjs/core";
 import { existsSync, readFileSync } from "fs";
 import { basename, extname, join, resolve, sep } from "path";
 import { fileURLToPath } from "url";
-import { Controller as Controller3, Get as Get3, Header as Header2, Inject as Inject6, NotFoundException as NotFoundException3, Param as Param2, Req as Req3, Res as Res2, StreamableFile, UseFilters, UseGuards as UseGuards2 } from "@nestjs/common";
-
-// src/server/auth/dashboard-auth-page.guard.ts
-import { Inject as Inject5, Injectable as Injectable4, Optional as Optional5 } from "@nestjs/common";
-
-// src/server/auth/dashboard-auth-redirect.ts
-import { Catch, Injectable as Injectable3 } from "@nestjs/common";
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-var DashboardAuthRedirect = class extends Error {
-  static {
-    __name(this, "DashboardAuthRedirect");
-  }
-  redirectTo;
-  constructor(redirectTo) {
-    super(`Redirect to ${redirectTo}`), this.redirectTo = redirectTo;
-    this.name = "DashboardAuthRedirect";
-  }
-};
-var DashboardAuthRedirectFilter = class {
-  static {
-    __name(this, "DashboardAuthRedirectFilter");
-  }
-  catch(exception, host) {
-    const response = host.switchToHttp().getResponse();
-    sendRedirect(response, 302, exception.redirectTo);
-  }
-};
-DashboardAuthRedirectFilter = _ts_decorate5([
-  Injectable3(),
-  Catch(DashboardAuthRedirect)
-], DashboardAuthRedirectFilter);
-
-// src/server/auth/dashboard-auth-page.guard.ts
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
-    r = Reflect.decorate(decorators, target, key, desc);
-  } else {
-    for (var i = decorators.length - 1; i >= 0; i--) {
-      if (d = decorators[i]) {
-        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      }
-    }
-  }
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(metadataKey, metadataValue) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
-    return Reflect.metadata(metadataKey, metadataValue);
-  }
-}
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-var DashboardAuthPageGuard = class {
-  static {
-    __name(this, "DashboardAuthPageGuard");
-  }
-  auth;
-  basePath;
-  constructor(auth, basePath) {
-    this.auth = auth;
-    this.basePath = basePath;
-  }
-  async canActivate(context) {
-    if (!this.auth) return true;
-    const auth = this.auth;
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const session = this.verifyRequestSession(request);
-    if (!session) this.deny(auth, request);
-    attachSession(request, session);
-    if (!await maybeRenewSession(auth, session, request, http.getResponse())) {
-      this.deny(auth, request);
-    }
-    return true;
-  }
-  /**
-  * No valid session: bounce the browser navigation onward. Under Mode B (`login` configured)
-  * that's the built-in login screen, carrying `returnTo` back to the page that was requested.
-  * Under Mode-A-only there is no login screen to redirect to — the host mints the session
-  * itself — so this instead serves the instruction page rather than redirecting into a 404.
-  * Pulled out of `canActivate` so both the "no session at all" and the "revalidate revoked a
-  * renewable session" paths reuse the exact same mode-aware deny logic.
-  *
-  * Takes `auth` explicitly rather than reading `this.auth`: `canActivate`'s `!this.auth` early
-  * return narrows the field within that method only — TS doesn't carry it across a method call —
-  * so the caller passes the already-narrowed value instead of this method re-deriving (or
-  * asserting away) the nullability.
-  */
-  deny(auth, request) {
-    if (!auth.modes.includes("login")) {
-      throw new DashboardAuthRedirect(`${this.basePath}/auth/session-required`);
-    }
-    const returnTo = readOriginalUrl(request);
-    throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
-  }
-  verifyRequestSession(request) {
-    const auth = this.auth;
-    if (!auth) return null;
-    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
-    if (cookieValue === void 0) return null;
-    return verifySessionCookie(cookieValue, {
-      secret: auth.secret
-    });
-  }
-};
-DashboardAuthPageGuard = _ts_decorate6([
-  Injectable4(),
-  _ts_param5(0, Optional5()),
-  _ts_param5(0, Inject5(DASHBOARD_AUTH)),
-  _ts_param5(1, Inject5(DASHBOARD_BASE_PATH)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    Object,
-    String
-  ])
-], DashboardAuthPageGuard);
-
-// src/server/agent-ui.controller.ts
-function _ts_decorate7(decorators, target, key, desc) {
+import { CanAnyone as CanAnyone2 } from "@dudousxd/nestjs-agent-core";
+import { Controller as Controller2, Get as Get2, Header, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, Req as Req2, Res, StreamableFile } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1972,19 +1065,19 @@ function _ts_decorate7(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(metadataKey, metadataValue) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(metadataKey, metadataValue) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
     return Reflect.metadata(metadataKey, metadataValue);
   }
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return fileURLToPath(new URL("../spa", import.meta.url));
@@ -2020,7 +1113,7 @@ var AgentUiController = class {
     }
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
-      throw new NotFoundException3("Dashboard is not built. Run the package build.");
+      throw new NotFoundException2("Dashboard is not built. Run the package build.");
     }
     const html = readFileSync(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -2028,11 +1121,11 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = basename(file);
-    if (safe !== file) throw new NotFoundException3();
+    if (safe !== file) throw new NotFoundException2();
     const root = resolve(this.dir, "assets");
     const assetPath = resolve(root, safe);
     if (!assetPath.startsWith(root + sep) || !existsSync(assetPath)) {
-      throw new NotFoundException3();
+      throw new NotFoundException2();
     }
     const type = CONTENT_TYPES[extname(safe)] ?? "application/octet-stream";
     return new StreamableFile(readFileSync(assetPath), {
@@ -2040,143 +1133,45 @@ var AgentUiController = class {
     });
   }
 };
-_ts_decorate7([
-  Get3(),
-  Header2("Content-Type", "text/html; charset=utf-8"),
-  Header2("Cache-Control", "no-store, must-revalidate"),
-  _ts_param6(0, Req3()),
-  _ts_param6(1, Res2({
+_ts_decorate3([
+  Get2(),
+  Header("Content-Type", "text/html; charset=utf-8"),
+  Header("Cache-Control", "no-store, must-revalidate"),
+  _ts_param3(0, Req2()),
+  _ts_param3(1, Res({
     passthrough: true
   })),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata6("design:returntype", String)
+  _ts_metadata3("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate7([
-  Get3("assets/:file"),
-  Header2("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param6(0, Param2("file")),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+_ts_decorate3([
+  Get2("assets/:file"),
+  Header("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param3(0, Param2("file")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata6("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata3("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate7([
-  Controller3(),
-  UseGuards2(DashboardAuthPageGuard),
-  UseFilters(new DashboardAuthRedirectFilter()),
-  _ts_param6(0, Inject6(DASHBOARD_BASE_PATH)),
-  _ts_param6(1, Inject6(DASHBOARD_API_PATH)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+AgentUiController = _ts_decorate3([
+  CanAnyone2(),
+  Controller2(),
+  _ts_param3(0, Inject3(DASHBOARD_BASE_PATH)),
+  _ts_param3(1, Inject3(DASHBOARD_API_PATH)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
-// src/server/auth/dashboard-auth-config.ts
-var DEFAULT_TTL = "8h";
-function unitToMs(unit) {
-  switch (unit) {
-    case "ms":
-      return 1;
-    case "s":
-      return 1e3;
-    case "m":
-      return 6e4;
-    case "h":
-      return 36e5;
-    case "d":
-      return 864e5;
-    default:
-      return void 0;
-  }
-}
-__name(unitToMs, "unitToMs");
-function durationToMs(duration) {
-  const match = /^(\d+)(ms|s|m|h|d)$/.exec(duration.trim());
-  const amount = match?.[1];
-  const unit = match?.[2] !== void 0 ? unitToMs(match[2]) : void 0;
-  if (amount === void 0 || unit === void 0) {
-    throw new Error(`AgentDashboardModule dashboardAuth: invalid \`ttl\` duration: ${duration}`);
-  }
-  return Number(amount) * unit;
-}
-__name(durationToMs, "durationToMs");
-function resolveDashboardAuth(options) {
-  if (options === void 0) return null;
-  if (typeof options.secret !== "string" || options.secret === "") {
-    throw new Error("AgentDashboardModule dashboardAuth: `secret` is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
-  }
-  const modes = [];
-  if (options.session !== void 0) {
-    if (typeof options.session !== "function") {
-      throw new Error("AgentDashboardModule dashboardAuth: `session` must be a function.");
-    }
-    modes.push("session");
-  }
-  if (options.login !== void 0) {
-    if (typeof options.login !== "function") {
-      throw new Error("AgentDashboardModule dashboardAuth: `login` must be a function.");
-    }
-    modes.push("login");
-  }
-  if (options.revalidate !== void 0 && typeof options.revalidate !== "function") {
-    throw new Error("AgentDashboardModule dashboardAuth: `revalidate` must be a function.");
-  }
-  if (options.unauthenticatedPage !== void 0 && typeof options.unauthenticatedPage !== "function") {
-    throw new Error("AgentDashboardModule dashboardAuth: `unauthenticatedPage` must be a function.");
-  }
-  if (modes.length === 0) {
-    throw new Error("AgentDashboardModule dashboardAuth: at least one of `session` (the host mints the session from its own auth) or `login` (the built-in login screen) is required \u2014 otherwise the cookie can never be minted. Failing closed.");
-  }
-  return {
-    secret: options.secret,
-    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
-    modes,
-    ...options.session !== void 0 ? {
-      session: options.session
-    } : {},
-    ...options.login !== void 0 ? {
-      login: options.login
-    } : {},
-    ...options.revalidate !== void 0 ? {
-      revalidate: options.revalidate
-    } : {},
-    ...options.unauthenticatedPage !== void 0 ? {
-      unauthenticatedPage: options.unauthenticatedPage
-    } : {}
-  };
-}
-__name(resolveDashboardAuth, "resolveDashboardAuth");
-
-// src/server/guards.ts
-import "reflect-metadata";
-var GUARDS_METADATA = "__guards__";
-function isGuardClass(guard) {
-  return typeof guard === "function";
-}
-__name(isGuardClass, "isGuardClass");
-function baseGuards(controller) {
-  return Reflect.getOwnMetadata(GUARDS_METADATA, controller) ?? [];
-}
-__name(baseGuards, "baseGuards");
-function stampGuards(guards, entries) {
-  for (const [controller, base] of entries) {
-    Reflect.defineMetadata(GUARDS_METADATA, [
-      ...base,
-      ...guards ?? []
-    ], controller);
-  }
-}
-__name(stampGuards, "stampGuards");
-
 // src/server/agent-dashboard.module.ts
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -2189,37 +1184,33 @@ function _ts_decorate8(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-var API_BASE_GUARDS = baseGuards(AgentApiController);
-var UI_BASE_GUARDS = baseGuards(AgentUiController);
+__name(_ts_decorate4, "_ts_decorate");
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
+function assertProtected(options) {
+  if (process.env.NODE_ENV !== "production") return;
+  if (options.routes === false) return;
+  if ((options.decorators ?? []).length > 0) return;
+  throw new Error("AgentDashboardModule: the AI-gateway console would be served open in production. Say who reaches it, with `decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]`, or mount its routes yourself with `routes: false` and extend `AgentApiController` / `AgentUiController` under your own guards.");
+}
+__name(assertProtected, "assertProtected");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
-    stampGuards(options.guards, [
-      [
-        AgentApiController,
-        API_BASE_GUARDS
-      ]
-    ]);
     return {
       module: _AgentApiModule,
       imports: [
         ...options.imports ?? []
       ],
-      controllers: [
+      controllers: options.routes === false ? [] : withControllerDecorators([
         AgentApiController
-      ],
+      ], options.decorators),
       providers: [
         DashboardService,
-        DashboardAuthGuard,
-        options.dashboardAuth,
-        ...(options.guards ?? []).filter(isGuardClass),
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
         // injects this WITHOUT `@Optional()`.
         {
@@ -2227,17 +1218,15 @@ var AgentApiModule = class _AgentApiModule {
           useValue: options.approvalActorRef
         }
       ],
-      // DASHBOARD_AUTH re-exported so AgentUiController/AgentDashboardAuthController (hosted
-      // directly by AgentDashboardModule, which imports this module) resolve the SAME instance
-      // instead of re-running a host's async factory a second time.
+      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`).
       exports: [
         DashboardService,
-        DASHBOARD_AUTH
+        DASHBOARD_APPROVAL_ACTOR_REF
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate8([
+AgentApiModule = _ts_decorate4([
   Module({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
@@ -2245,116 +1234,44 @@ var AgentDashboardModule = class _AgentDashboardModule {
     __name(this, "AgentDashboardModule");
   }
   static forRoot(options = {}) {
+    assertProtected(options);
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, [
-      [
-        AgentUiController,
-        UI_BASE_GUARDS
-      ]
-    ]);
-    const dashboardAuthProvider = {
-      provide: DASHBOARD_AUTH,
-      useValue: resolveDashboardAuth(options.dashboardAuth)
-    };
     return {
       module: _AgentDashboardModule,
       imports: [
         ...options.imports ?? [],
-        // Guards + host imports must reach the API controller's HOST module — enhancers resolve
-        // from their controller's own module, never from a parent (see AgentApiModule.register).
         // Spread-only-when-set: exactOptionalPropertyTypes rejects an explicit `undefined`.
         AgentApiModule.register({
           ...options.imports ? {
             imports: options.imports
           } : {},
-          ...options.guards ? {
-            guards: options.guards
+          ...options.decorators ? {
+            decorators: options.decorators
           } : {},
-          ...options.approvalActorRef ? {
-            approvalActorRef: options.approvalActorRef
-          } : {},
-          dashboardAuth: dashboardAuthProvider
-        }),
-        RouterModule.register([
-          {
-            path: basePath,
-            module: _AgentDashboardModule
-          },
-          {
-            path: apiBasePath,
-            module: AgentApiModule
-          }
-        ])
-      ],
-      controllers: [
-        AgentUiController,
-        AgentDashboardAuthController
-      ],
-      providers: [
-        {
-          provide: DASHBOARD_BASE_PATH,
-          useValue: basePath
-        },
-        {
-          provide: DASHBOARD_API_PATH,
-          useValue: apiBasePath
-        },
-        DashboardAuthPageGuard,
-        // AgentUiController is hosted HERE, so its guards DI-instantiate from this module.
-        ...(options.guards ?? []).filter(isGuardClass)
-      ],
-      // Re-export the API module so its DashboardService reaches importers (e.g. the host's own controllers).
-      exports: [
-        AgentApiModule
-      ]
-    };
-  }
-  static forRootAsync(options) {
-    const basePath = normalize(options.basePath ?? "/ai-gateway");
-    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, [
-      [
-        AgentUiController,
-        UI_BASE_GUARDS
-      ]
-    ]);
-    const dashboardAuthProvider = {
-      provide: DASHBOARD_AUTH,
-      inject: options.inject ?? [],
-      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
-    };
-    return {
-      module: _AgentDashboardModule,
-      imports: [
-        ...options.imports ?? [],
-        AgentApiModule.register({
-          ...options.imports ? {
-            imports: options.imports
-          } : {},
-          ...options.guards ? {
-            guards: options.guards
+          ...options.routes === false ? {
+            routes: false
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
-          } : {},
-          dashboardAuth: dashboardAuthProvider
+          } : {}
         }),
-        RouterModule.register([
-          {
-            path: basePath,
-            module: _AgentDashboardModule
-          },
-          {
-            path: apiBasePath,
-            module: AgentApiModule
-          }
-        ])
-      ],
-      controllers: [
-        AgentUiController,
-        AgentDashboardAuthController
+        ...options.routes === false ? [] : [
+          RouterModule.register([
+            {
+              path: basePath,
+              module: _AgentDashboardModule
+            },
+            {
+              path: apiBasePath,
+              module: AgentApiModule
+            }
+          ])
+        ]
       ],
+      controllers: options.routes === false ? [] : withControllerDecorators([
+        AgentUiController
+      ], options.decorators),
       providers: [
         {
           provide: DASHBOARD_BASE_PATH,
@@ -2363,17 +1280,19 @@ var AgentDashboardModule = class _AgentDashboardModule {
         {
           provide: DASHBOARD_API_PATH,
           useValue: apiBasePath
-        },
-        DashboardAuthPageGuard,
-        ...(options.guards ?? []).filter(isGuardClass)
+        }
       ],
+      // Re-export the API module so its DashboardService reaches importers (e.g. the host's own
+      // controllers), and the paths a self-mounted `AgentUiController` subclass injects.
       exports: [
-        AgentApiModule
+        AgentApiModule,
+        DASHBOARD_BASE_PATH,
+        DASHBOARD_API_PATH
       ]
     };
   }
 };
-AgentDashboardModule = _ts_decorate8([
+AgentDashboardModule = _ts_decorate4([
   Module({})
 ], AgentDashboardModule);
 export {
@@ -2384,16 +1303,13 @@ export {
   AGENT_PRICING_STORE,
   AgentApiController,
   AgentApiModule,
-  AgentDashboardAuthController,
   AgentDashboardModule,
   AgentUiController,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
-  DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH,
   DashboardService,
   agentDashboardMountPaths,
-  parsePriceInput,
-  resolveDashboardAuth
+  parsePriceInput
 };
 //# sourceMappingURL=index.js.map