@dudousxd/nestjs-agent-dashboard 0.18.0 → 0.19.1

package/dist/server/index.d.cts

@@ -1,7 +1,7 @@
 import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, FeatureSpendRow, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ApprovalWhere, GovernanceRunDetail, GovernanceThreadDetailQuery, GovernanceThreadDetail, ThreadActivityRow, ToolStatRow, GenuiStats, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
 export { ActorDirectory } from '@dudousxd/nestjs-agent-core';
 import { Observable } from 'rxjs';
-import { DynamicModule, Type, CanActivate, Provider, InjectionToken, OptionalFactoryDependency, StreamableFile } from '@nestjs/common';
+import { DynamicModule, StreamableFile } from '@nestjs/common';
 
 /** An actor-scoped row decorated with its resolved display label — `null` when unbound or unresolved. */
 interface WithActorLabel {
@@ -151,9 +151,8 @@ declare class DashboardService {
  * JSON + SSE API consumed by the AI-gateway console SPA. Mounted at `apiBasePath` (set by
  * `RouterModule` in {@link AgentDashboardModule.forRoot}), so the controller routes are relative.
  *
- * `@UseGuards(DashboardAuthGuard)` is a NO-OP unless the host configured `dashboardAuth` — see
- * that guard's own doc. Host `guards` (see {@link AgentDashboardOptions.guards}) are APPENDED onto
- * this baseline by `stampGuards` (`./guards.js`), never replacing it.
+ * Who reaches it is the app's: `decorators` on `AgentDashboardModule.forRoot`, or the app mounts it
+ * itself (`routes: false`) — with `@nestjs/authentication` / `@nestjs/authorization`.
  */
 declare class AgentApiController {
     private readonly dashboard;
@@ -263,185 +262,6 @@ declare class AgentApiController {
     }>;
 }
 
-/** The session user the host's `login` hook returns to mint a cookie. */
-interface DashboardSessionUser {
-    id: string;
-    name?: string;
-    roles?: string[];
-}
-
-/**
- * Host hook for Mode A: validates the host's own auth on the raw request POSTed to
- * `<basePath>/auth/session`. Return the session user to grant access, or `null` to deny.
- */
-type SessionHook = (request: unknown) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
-/** Host hook for Mode B: validates submitted credentials for the built-in login screen. */
-type LoginHook = (username: string, password: string) => Promise<DashboardSessionUser | null> | DashboardSessionUser | null;
-/**
- * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` PER
- * COOKIE GENERATION — the gate is on the inbound cookie's `iat`, so every request still carrying a
- * not-yet-renewed cookie would, on its own, invoke this hook again; `maybeRenewSession` de-dupes
- * concurrent calls for the same session (`sub` + `iat`) into a single in-flight call, so a page
- * load that fires N parallel API calls still costs exactly ONE host round-trip, not N. Still not a
- * per-session-lifetime cap — this can run again every `ttl/2` as the session keeps sliding, so a
- * slow or expensive check should still debounce/cache across renewal windows on its own. Return
- * `false` to revoke (the cookie is cleared and the request denied). Distinct from `session`: that
- * hook reads the host's auth off a fresh request, which a console XHR does not carry — this one
- * receives the already-minted session.
- */
-type RevalidateHook = (session: DashboardSessionUser) => Promise<boolean> | boolean;
-/** What `unauthenticatedPage` receives. An object (not positional args) so fields can be added later. */
-interface UnauthenticatedPageContext {
-    /**
-     * The platform-native request — Express' `Request`, Fastify's `FastifyRequest`. Typed `unknown`
-     * for the same reason `SessionHook`'s is: this package refuses to depend on either platform.
-     * Cast it to whatever your app actually runs on.
-     */
-    request: unknown;
-    /**
-     * The platform-native response. The hook OWNS it: it must write AND end it (`res.render(...)`,
-     * `res.status(401).send(...)`, an Inertia render, ...). If the hook returns without writing, the
-     * library falls back to its own built-in page rather than leaving the request hanging.
-     */
-    response: unknown;
-    /** Where this console is mounted (e.g. `/ai-gateway`) — useful for a "back to the console" link. */
-    basePath: string;
-}
-/**
- * Host-owned page for an unauthenticated navigation to the console.
- *
- * The built-in page cannot know who hosts the console, so it can only say "open this console from
- * your application" in the abstract — it can't name the launcher, link to it, or look like the rest
- * of the host's product. This hook hands the whole response to the host instead: render through
- * your own template engine, your own Inertia page, whatever.
- *
- * Served at `<basePath>/auth/session-required`, which is where `DashboardAuthPageGuard` already
- * redirects a denied Mode-A navigation today — this hook changes what that page CONTAINS, not the
- * flow that reaches it.
- *
- * Deliberately NOT a replacement for Mode B's built-in login form. A host that wants its own login
- * UI uses Mode A plus this hook, and posts to `<basePath>/auth/session` from its own page — the
- * mint endpoint is the supported primitive for that.
- *
- * Fail-closed by construction: it only ever runs on a request that has ALREADY been denied. A hook
- * that throws, or that returns without writing, falls back to the built-in page — it cannot let
- * anyone in.
- */
-type UnauthenticatedPageHook = (context: UnauthenticatedPageContext) => void | Promise<void>;
-/** Which `dashboardAuth` hook(s) a resolved config was given — see `resolveDashboardAuth`. */
-type AuthMode = 'session' | 'login';
-/**
- * Author-facing `dashboardAuth` option (see `AgentDashboardOptions.dashboardAuth`). Gates the
- * console (SPA + API) behind a signed session cookie. Two ways to mint that cookie: Mode A
- * (`session`) — the host frontend, already carrying its own auth, POSTs to
- * `<basePath>/auth/session` and the host hook decides — or Mode B (`login`) — the built-in,
- * dependency-free server-rendered login screen. Mirrors `@dudousxd/nestjs-telescope`'s
- * `dashboardAuth` two-mode shape. At least one of the two is required so an un-mintable gate is a
- * boot error, not a silently-open (or silently-stuck) console.
- */
-interface DashboardAuthOptions {
-    /** REQUIRED HMAC-SHA256 signing key (32+ bytes recommended). Missing/empty => boot error (fail closed). */
-    secret: string;
-    /** Cookie TTL (duration string `'<n><ms|s|m|h|d>'`, e.g. `'30m'`, `'7d'`). Default `'8h'`. */
-    ttl?: string;
-    /**
-     * Mode A: validates the host's own auth on the raw request POSTed to `<basePath>/auth/session`.
-     * Return the session user to grant access, or `null` to deny. No credential reaches this
-     * library — the host decides from whatever it already has (a header, an SSO cookie, ...).
-     */
-    session?: SessionHook;
-    /**
-     * Mode B: validates submitted username/password. Return the session user to grant access, or
-     * `null` to deny — the login endpoint responds identically (generic failure) for an unknown user
-     * and a wrong password, so it never reveals which one was wrong.
-     */
-    login?: LoginHook;
-    /** Re-checks a live session on sliding renewal; see `RevalidateHook`. Not a mode — it cannot
-     *  mint a session, only revoke one already minted by `session`/`login`. */
-    revalidate?: RevalidateHook;
-    /** Renders the host's own page for an unauthenticated navigation, in place of the built-in
-     *  "open this console from your application" card; see `UnauthenticatedPageHook`. */
-    unauthenticatedPage?: UnauthenticatedPageHook;
-}
-/** Resolved, validated `dashboardAuth` config used by the guards/controller. */
-interface ResolvedDashboardAuth {
-    secret: string;
-    ttlMs: number;
-    modes: AuthMode[];
-    session?: SessionHook;
-    login?: LoginHook;
-    revalidate?: RevalidateHook;
-    unauthenticatedPage?: UnauthenticatedPageHook;
-}
-/**
- * Validate + resolve `dashboardAuth`. Returns `null` when unconfigured (behavior unchanged — the
- * console stays open, front it with your own `guards`). Throws at boot (fail closed) when
- * configured but missing a secret, when neither `session` nor `login` is given, or when a given
- * hook isn't a function — the host learns immediately rather than shipping an open, stuck, or
- * un-mintable console.
- */
-declare function resolveDashboardAuth(options: DashboardAuthOptions | undefined): ResolvedDashboardAuth | null;
-
-/** The slice of the platform request this controller reads — structural, no Express/Fastify dependency. */
-interface AuthPageRequest {
-    headers: Record<string, string | string[] | undefined>;
-}
-/** The slice of the platform response this controller writes (passthrough mode — Nest still sends). */
-interface AuthPageResponse {
-    status(code: number): unknown;
-    setHeader(name: string, value: string): unknown;
-}
-interface LoginFormBody {
-    username?: unknown;
-    password?: unknown;
-    returnTo?: unknown;
-}
-/**
- * Mounted directly on `AgentDashboardModule` at `<basePath>/auth/*` — a SEPARATE controller from
- * `AgentUiController`/`AgentApiController` so it carries neither `DashboardAuthPageGuard`,
- * `DashboardAuthGuard`, nor any host `guards`: these routes MINT (and clear) the session cookie the
- * built-in gates check for, so they can never be made to require the very auth they grant. Mirrors
- * `@dudousxd/nestjs-telescope`'s own auth controller staying outside its `stampGuards` call.
- *
- * Two ways to mint that cookie, matching `resolveDashboardAuth`'s modes: Mode A (`session`) — the
- * host frontend, already carrying its own auth, POSTs to `<basePath>/auth/session` and the host
- * hook decides — or Mode B (`login`), a dependency-free, server-rendered login form (GET/POST) —
- * the bundled React SPA in this package is a built Vite artifact with no auth-aware UI of its own,
- * so gating the actual page navigation needs a self-contained flow that doesn't touch it. Each
- * mode's routes 404 when that mode isn't listed in `auth.modes` — the single source of truth for
- * which mode(s) are configured, not hook-presence truthiness — and every route 404s outright when
- * `dashboardAuth` is unconfigured (`DASHBOARD_AUTH` resolves to `null`) — no dangling login page
- * when the feature is off.
- */
-declare class AgentDashboardAuthController {
-    private readonly auth;
-    private readonly basePath;
-    private readonly logger;
-    /** Warn once PER HOOK KIND (not per request) so a broken hook can't be used to flood the logs. */
-    private readonly warnedHooks;
-    constructor(auth: ResolvedDashboardAuth | null, basePath: string);
-    loginPage(req: AuthPageRequest, res: AuthPageResponse, returnToQuery?: string, error?: string): string;
-    login(body: LoginFormBody, req: unknown, res: AuthPageResponse): Promise<string>;
-    logout(req: unknown, res: AuthPageResponse): string;
-    session(request: unknown, response: unknown): Promise<void>;
-    sessionRequiredPage(req: AuthPageRequest, res: unknown): Promise<void>;
-    /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
-    private redirectToLoginError;
-    private currentSession;
-    /**
-     * Run a host hook (`login` or `session`) defensively: a throw (sync or async) is treated as a
-     * denial (`null`) and warn-logged ONCE PER KIND, so a buggy/unreachable hook never 500s the
-     * endpoint into a stack-trace leak nor floods the logs on repeated bad attempts.
-     */
-    private runHook;
-    /**
-     * Warn once per hook kind for the life of the process, not once per request: a broken hook fires
-     * on every denied navigation and would otherwise flood the logs.
-     */
-    private warnHookOnce;
-    private requireAuth;
-}
-
 /** Same shape {@link AgentDashboardModule.forRoot} accepts — kept local so this stays a pure, DI-free helper. */
 interface AgentDashboardMountPathsOptions {
     basePath?: string;
@@ -475,9 +295,7 @@ declare function agentDashboardMountPaths(options?: AgentDashboardMountPathsOpti
 
 /**
  * `TReq` mirrors core's `ActorResolver<TReq>` convention: the transport request type
- * {@link AgentDashboardOptions.approvalActorRef} receives. Defaults to `unknown` so untyped usage
- * compiles unchanged; a host may narrow it (e.g. `forRoot<Request>({ approvalActorRef: ... })`)
- * instead of writing its own `unknown`-narrowing type guard.
+ * {@link AgentDashboardOptions.approvalActorRef} receives. Defaults to `unknown`.
  */
 interface AgentDashboardOptions<TReq = unknown> {
     /**
@@ -492,20 +310,26 @@ interface AgentDashboardOptions<TReq = unknown> {
      */
     apiBasePath?: string;
     /**
-     * Guard classes fronting BOTH dashboard controllers (the SPA at `basePath` and its JSON API at
-     * `apiBasePath`) — APPENDED onto the built-in `dashboardAuth` gate (a no-op unless configured;
-     * see {@link dashboardAuth}), so a request must pass BOTH. Omit to leave the routes gated by
-     * `dashboardAuth` alone (or fully open when that's unset too).
+     * Who reaches the console: class decorators applied to every controller this module mounts — the
+     * ecosystem's convention, like `@nestjs/mcp`'s `decorators` — with the official tools, e.g.
+     * `[UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]` from `@nestjs/authentication` /
+     * `@nestjs/authorization`, or a function as a guard instance, `UseGuards({ canActivate })`.
+     * Applied to a per-registration subclass, so nothing sticks to the shared classes.
      *
-     * A guard's own DEPENDENCIES resolve from this module's `imports` (see {@link imports}) — the
-     * dashboard module has no application context of its own to pull them from otherwise.
+     * In production (`NODE_ENV=production`) the console refuses to boot without them, unless the app
+     * mounts the routes itself (`routes: false`): a governance console is never served open there by
+     * default. Outside production the routes are open (and to `@nestjs/authorization`'s
+     * deny-by-default guard: `CanAnyone()`). Static wiring.
      */
-    guards?: Type<CanActivate>[];
+    decorators?: ClassDecorator[];
     /**
-     * Extra `imports` merged into the dashboard's dynamic module — the DI resolution path for a class
-     * passed to {@link guards} (or any other provider the controllers need reachable). Typically the
-     * host's own auth module, e.g. `imports: [AuthModule]` alongside `guards: [JwtAuthGuard]`.
+     * `false` mounts none of the console's routes, while its services still run — the way NestJS's
+     * own packages leave routes to you: serve them from controllers of your own, protected with the
+     * official tools, by extending the exported `AgentApiController` / `AgentUiController` under your
+     * own path and decorators (the module exports what they inject). Static wiring.
      */
+    routes?: boolean;
+    /** Extra `imports` merged into the console's modules — what a decorator's guard injects. */
     imports?: DynamicModule['imports'];
     /**
      * OVERRIDE for WHO is deciding a HITL approval — invoked on the incoming
@@ -514,95 +338,27 @@ interface AgentDashboardOptions<TReq = unknown> {
      * DEFAULT (option omitted): the AgentModule-configured actor resolver (`AGENT_ACTOR_RESOLVER`) is
      * consulted — the same identity seam chat requests use — and its actor id becomes the decider ref
      * (a throwing resolver, i.e. an unauthenticated request, just omits the ref). Set this only when
-     * console auth differs from chat auth (e.g. the console sits behind a separate SSO whose principal
-     * the chat resolver can't read); returning `undefined` leaves `executedByRef` unset — the explicit
-     * override wins outright, with no resolver fallback.
+     * the console's caller is identified differently from chat's; returning `undefined` leaves
+     * `executedByRef` unset — the explicit override wins outright, with no resolver fallback.
      */
     approvalActorRef?: (req: TReq) => string | undefined;
-    /**
-     * Gate the console (SPA + API) behind a built-in, signed session cookie. Two ways to mint it:
-     *
-     * - **Mode A (`session`, recommended)**: your host app already has its own auth (SSO/OIDC/
-     *   whatever) — the host frontend, carrying that auth, POSTs to `<basePath>/auth/session`, your
-     *   `session` hook validates the raw request and returns the session user, and this library
-     *   mints its cookie from that. No credential this library understands ever exists; you keep
-     *   your own identity provider as the source of truth. A page-level request with no valid
-     *   session (and only Mode A configured) gets a small server-rendered instruction page telling
-     *   the visitor to sign in through your host app, since there is no login page to redirect to.
-     * - **Mode B (`login`, standalone fallback)**: no host frontend/IdP to lean on — the console
-     *   serves its own small, dependency-free, server-rendered login page (`GET
-     *   <basePath>/auth/login`) and your `login` hook validates submitted username/password. A
-     *   missing/invalid/expired session redirects a page-level request to that login page with
-     *   `?returnTo=<original url>`.
-     *
-     * Either mode can be used alone, or both together (e.g. Mode A for normal use, Mode B as a
-     * break-glass fallback) — at least one is required, or `forRoot`/`forRootAsync` throws at boot
-     * (an un-mintable gate is a boot error, not a silently-open or silently-stuck console). An
-     * unauthenticated API call always gets a plain `401`, regardless of mode — the caller reads the
-     * status code, not HTML. Composes with `guards` — BOTH gates must pass. See
-     * `DashboardAuthOptions` for the `secret`/`ttl`/`session`/`login` shape.
-     */
-    dashboardAuth?: DashboardAuthOptions;
 }
-/**
- * Async variant of {@link AgentDashboardOptions}, for a `session`/`login` hook that needs injected
- * services (e.g. an EntityManager to check credentials against a DB). Everything else stays
- * static/sync — `basePath`/`apiBasePath`/`guards` are needed at module-build time (the same
- * constraint `@dudousxd/nestjs-telescope`'s and `@dudousxd/nestjs-media`'s own `forRootAsync`s
- * document), so only the auth piece itself is resolved through DI.
- */
-interface AgentDashboardAsyncOptions<TReq = unknown> {
-    basePath?: string;
-    apiBasePath?: string;
-    guards?: Type<CanActivate>[];
-    imports?: DynamicModule['imports'];
-    approvalActorRef?: (req: TReq) => string | undefined;
-    /** Providers injected into `useDashboardAuth`, in order. Shared with a guard class's own deps via `imports`. */
-    inject?: Array<InjectionToken | OptionalFactoryDependency>;
-    /**
-     * Build the `dashboardAuth` config from injected deps, or return `undefined` to leave the
-     * console open (or fronted only by `guards`). See {@link AgentDashboardOptions.dashboardAuth}.
-     */
-    useDashboardAuth: (...deps: any[]) => DashboardAuthOptions | undefined | Promise<DashboardAuthOptions | undefined>;
-}
-/**
- * Holds the JSON API + SSE controller and its read service, mounted on its own path by `forRoot`.
- * Dynamic: guards are DI-instantiated by the CONTROLLER's host module, so this module — not the
- * outer wrapper — must carry the guard classes as providers plus the host's `imports` that resolve
- * their dependencies. A static module here made `guards: [SomeGuardWithDeps]` fail at boot with
- * "Nest can't resolve dependencies ... in the AgentApiModule context" even when the host passed
- * the right `imports` to `forRoot`.
- */
+/** Holds the JSON API + SSE controller and its read service, mounted on its own path. */
 declare class AgentApiModule {
     static register<TReq = unknown>(options: {
         imports?: DynamicModule['imports'];
-        guards?: Type<CanActivate>[];
+        decorators?: ClassDecorator[];
+        routes?: boolean;
         approvalActorRef?: (req: TReq) => string | undefined;
-        /** Provider for `DASHBOARD_AUTH` — a `useValue` (`forRoot`) or a `useFactory` (`forRootAsync`). */
-        dashboardAuth: Provider;
     }): DynamicModule;
 }
 /**
- * Mounts the AI-gateway governance console: the bundled React SPA at `basePath` and its JSON + SSE
- * API at `apiBasePath` (default `<basePath>/api`), plus the built-in `dashboardAuth` routes at
- * `<basePath>/auth/*` when {@link AgentDashboardOptions.dashboardAuth} is set — `POST
- * <basePath>/auth/session` for Mode A (the host mints the session from its own auth) and/or `GET`/
- * `POST <basePath>/auth/login` for Mode B (the built-in login screen).
- *
- * Import via `AgentDashboardModule.forRoot(...)` alongside your `@dudousxd/nestjs-agent` module
- * (global), which must provide `AGENT_GOVERNANCE_QUERIES` (bound by a store adapter). Front the
- * routes with the first-class `guards` option (plus `imports` for the guards' own dependencies) —
- * see {@link AgentDashboardOptions.guards} — and/or the built-in `dashboardAuth` session cookie.
- *
- * Inertia hosts: the console is a full-page app, not an Inertia page. An in-app `<Link>` visit to
- * `basePath` (an XHR carrying `X-Inertia`) is bounced with the protocol's own external-redirect
- * mechanism — `409 Conflict` + `X-Inertia-Location: <the visited URL>` — so the Inertia client
- * performs a full `window.location` load and the console renders normally. In-app links to the
- * console therefore just work; no host-side special-casing needed.
+ * The AI-gateway console: the SPA at `basePath` and its JSON API at `apiBasePath`. Who reaches them
+ * is the app's — `decorators`, or the app mounts them itself (`routes: false`) — with
+ * `@nestjs/authentication` / `@nestjs/authorization`.
  */
 declare class AgentDashboardModule {
     static forRoot<TReq = unknown>(options?: AgentDashboardOptions<TReq>): DynamicModule;
-    static forRootAsync<TReq = unknown>(options: AgentDashboardAsyncOptions<TReq>): DynamicModule;
 }
 
 /**
@@ -624,11 +380,8 @@ interface UiPageResponse {
  * `<base>/assets`). The path comes from `RouterModule` (set by
  * {@link AgentDashboardModule.forRoot}({ basePath })), so the controller routes are relative.
  *
- * `@UseGuards(DashboardAuthPageGuard)` is a NO-OP unless the host configured `dashboardAuth` — see
- * that guard's own doc. Host `guards` (see {@link AgentDashboardOptions.guards}) are APPENDED onto
- * this baseline by `stampGuards` (`./guards.js`), never replacing it. `@UseFilters` turns the
- * guard's redirect-on-deny into an actual 302 response; it is a no-op when the guard never throws
- * (i.e. `dashboardAuth` unconfigured).
+ * Who reaches it is the app's: `decorators` on `AgentDashboardModule.forRoot`, or the app mounts it
+ * itself (`routes: false`) — with `@nestjs/authentication` / `@nestjs/authorization`.
  */
 declare class AgentUiController {
     private readonly basePath;
@@ -702,13 +455,5 @@ declare const DASHBOARD_API_PATH: unique symbol;
  * injecting it needs no `@Optional()`.
  */
 declare const DASHBOARD_APPROVAL_ACTOR_REF: unique symbol;
-/**
- * DI token carrying the resolved `dashboardAuth` config (`ResolvedDashboardAuth | null`) — `null`
- * when the host didn't configure it (the built-in guards are then a no-op, today's behavior
- * byte-for-byte). Bound once by `AgentApiModule.register` and re-exported so `AgentUiController`
- * and `AgentDashboardAuthController` (hosted directly by `AgentDashboardModule`, which imports
- * `AgentApiModule`) resolve the SAME instance rather than re-running a host's async factory twice.
- */
-declare const DASHBOARD_AUTH: unique symbol;
 
-export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, type AgentDashboardAsyncOptions, AgentDashboardAuthController, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, type AuthMode, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_AUTH, DASHBOARD_BASE_PATH, type DashboardAuthOptions, DashboardService, type LiveAgentEvent, type LoginHook, type ReliabilityOverview, type ResolvedDashboardAuth, type RevalidateHook, type RunDetailWithLabel, type SessionHook, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadDetailWithLabel, type ThreadSpendRowWithLabel, type UnauthenticatedPageContext, type UnauthenticatedPageHook, type WithActorLabel, agentDashboardMountPaths, parsePriceInput, resolveDashboardAuth };
+export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_BASE_PATH, DashboardService, type LiveAgentEvent, type ReliabilityOverview, type RunDetailWithLabel, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadDetailWithLabel, type ThreadSpendRowWithLabel, type WithActorLabel, agentDashboardMountPaths, parsePriceInput };