@dudousxd/nestjs-agent-dashboard 0.19.0 → 0.20.0

package/dist/server/index.cjs

@@ -1,8 +1,10 @@
 const __importMetaUrl = require('url').pathToFileURL(__filename).href;
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
@@ -17,6 +19,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/server/index.ts
@@ -31,12 +41,25 @@ __export(index_exports, {
   AgentApiModule: () => AgentApiModule,
   AgentDashboardModule: () => AgentDashboardModule,
   AgentUiController: () => AgentUiController,
+  CONSOLE_AUTHORIZE_MISSING_WARNING: () => CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE: () => CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA: () => CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied: () => ConsoleAccessDenied,
+  ConsoleAuthorizeFilter: () => ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard: () => ConsoleAuthorizeGuard,
+  ConsolePage: () => ConsolePage,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF: () => DASHBOARD_APPROVAL_ACTOR_REF,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
+  DASHBOARD_CONSOLE_OPTIONS: () => DASHBOARD_CONSOLE_OPTIONS,
+  DashboardConsoleAccess: () => DashboardConsoleAccess,
   DashboardService: () => DashboardService,
+  UseConsoleAuthorize: () => UseConsoleAuthorize,
   agentDashboardMountPaths: () => agentDashboardMountPaths,
-  parsePriceInput: () => parsePriceInput
+  authorizeByToken: () => authorizeByToken,
+  normalizeConsoleResult: () => normalizeConsoleResult,
+  parsePriceInput: () => parsePriceInput,
+  resolveConsoleAuthorize: () => resolveConsoleAuthorize
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -121,6 +144,7 @@ var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:ac
 var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
 var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
 var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+var DASHBOARD_CONSOLE_OPTIONS = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:console-options");
 
 // src/server/dashboard.service.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -1082,15 +1106,195 @@ __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 // src/server/agent-dashboard.module.ts
 var import_nestjs_agent_core3 = require("@dudousxd/nestjs-agent-core");
 var import_reflect_metadata = require("reflect-metadata");
-var import_common7 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
+var import_common9 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
 
 // src/server/agent-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
 var import_nestjs_agent_core2 = require("@dudousxd/nestjs-agent-core");
+var import_common8 = require("@nestjs/common");
+
+// src/server/console-authorize.guard.ts
+var import_common7 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+
+// src/server/console-authorize.ts
+var import_node_crypto = require("crypto");
 var import_common6 = require("@nestjs/common");
+var CONSOLE_GATE = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-agent-dashboard";
+var MODULE = "AgentDashboardModule";
+var logger = new import_common6.Logger(MODULE);
+var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
+var allow = /* @__PURE__ */ __name(() => ({
+  allowed: true
+}), "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (result === null || typeof result !== "object") return forbidden();
+  const value = result;
+  if (typeof value.redirectTo === "string" && value.redirectTo !== "" && value.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: value.redirectTo
+    };
+  }
+  if (value.allowed === true) return allow();
+  return value.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
+  }
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function lazyModuleClass(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const candidate = value.default;
+  return isAuthorizerClass(candidate) ? candidate : void 0;
+}
+__name(lazyModuleClass, "lazyModuleClass");
+function tryGet(moduleRef, token) {
+  try {
+    return moduleRef.get(token, {
+      strict: false
+    }) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(tryGet, "tryGet");
+function classInstances(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  return (Class) => {
+    let instance = instances.get(Class);
+    if (instance === void 0) {
+      const registered = tryGet(moduleRef, Class);
+      instance = registered !== void 0 ? Promise.resolve(registered) : moduleRef.create(Class);
+      instance.catch(() => instances.delete(Class));
+      instances.set(Class, instance);
+    }
+    return instance;
+  };
+}
+__name(classInstances, "classInstances");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+async function policyDecider(check, moduleRef) {
+  let mod;
+  try {
+    mod = await import("@nestjs/authorization");
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs @nestjs/authorization installed and AuthorizationModule imported; or pass a function, a class, or a gate name.`);
+  }
+  const service = tryGet(moduleRef, mod.AuthorizationService);
+  if (service === void 0) {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app.`);
+  }
+  const options = tryGet(moduleRef, mod.AUTHORIZATION_MODULE_OPTIONS);
+  const getUser = options?.getUser ?? mod.defaultGetUser;
+  return async (context) => {
+    const user = await getUser(context);
+    const signedIn = hasUser(user);
+    if (await service.can(check.policy, check.ability, signedIn ? user : null)) return allow();
+    return signedIn ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const log = options.logger ?? logger;
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) log.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    const production = isProduction();
+    return async () => production ? forbidden() : allow();
+  }
+  const instanceOf = classInstances(moduleRef);
+  let decide;
+  if (typeof authorize === "string") {
+    const name = authorize;
+    const gate = tryGet(moduleRef, CONSOLE_GATE);
+    if (gate === void 0) {
+      throw new Error(`${MODULE}: \`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }.`);
+    }
+    decide = /* @__PURE__ */ __name((context) => gate.allows(name, context), "decide");
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    const Class = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => (await instanceOf(Class)).authorize(context), "decide");
+  } else if (typeof authorize === "function") {
+    const fn = authorize;
+    let lazyClass;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazyClass !== void 0) return (await instanceOf(lazyClass)).authorize(context);
+      const result = await fn(context);
+      const Class = lazyModuleClass(result);
+      if (Class === void 0) return result;
+      lazyClass = Class;
+      return (await instanceOf(Class)).authorize(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return normalizeConsoleResult(await decide(context));
+    } catch (error) {
+      log.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+function sha256(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value).digest();
+}
+__name(sha256, "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token === "") {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  return (context) => {
+    const req = context.switchToHttp().getRequest();
+    const header = req?.headers?.authorization;
+    const value = Array.isArray(header) ? header[0] : header;
+    const match = typeof value === "string" ? /^Bearer\s+(.+)$/i.exec(value.trim()) : null;
+    if (match?.[1] !== void 0 && (0, import_node_crypto.timingSafeEqual)(sha256(match[1]), expected)) return true;
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+
+// src/server/console-authorize.guard.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1117,6 +1321,161 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
+var DashboardConsoleAccess = class {
+  static {
+    __name(this, "DashboardConsoleAccess");
+  }
+  options;
+  moduleRef;
+  #decide;
+  constructor(options, moduleRef) {
+    this.options = options;
+    this.moduleRef = moduleRef;
+  }
+  #resolving;
+  /** Resolves `authorize` at boot: a configuration mistake fails the boot, and the warning logs once. */
+  async onModuleInit() {
+    this.#resolving ??= resolveConsoleAuthorize(this.options.authorize, this.moduleRef);
+    this.#decide = await this.#resolving;
+  }
+  /** The decision for one request. */
+  async check(context) {
+    if (this.#decide === void 0) await this.onModuleInit();
+    return this.#decide(context);
+  }
+};
+DashboardConsoleAccess = _ts_decorate3([
+  (0, import_common7.Injectable)(),
+  _ts_param3(0, (0, import_common7.Inject)(DASHBOARD_CONSOLE_OPTIONS)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleOptions === "undefined" ? Object : DashboardConsoleOptions,
+    typeof import_core.ModuleRef === "undefined" ? Object : import_core.ModuleRef
+  ])
+], DashboardConsoleAccess);
+var CONSOLE_PAGE_METADATA = "@dudousxd/nestjs-agent-dashboard:console-page";
+var ConsolePage = /* @__PURE__ */ __name(() => (0, import_common7.SetMetadata)(CONSOLE_PAGE_METADATA, true), "ConsolePage");
+var ConsoleAccessDenied = class extends import_common7.HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page) {
+    super(decision.reason === "forbidden" ? {
+      error: "forbidden"
+    } : {
+      error: "unauthenticated",
+      ...decision.redirectTo !== void 0 ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    }, decision.reason === "forbidden" ? 403 : 401), this.decision = decision, this.page = page;
+  }
+};
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  const page = Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getHandler()) === true || Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) === true;
+  if (!page) return false;
+  const req = context.switchToHttp().getRequest();
+  if ((req.method ?? "GET").toUpperCase() !== "GET") return false;
+  const accept = req.headers?.accept;
+  const value = Array.isArray(accept) ? accept.join(",") : accept ?? "";
+  return value.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  access;
+  constructor(access) {
+    this.access = access;
+  }
+  async canActivate(context) {
+    const decision = await this.access.check(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
+  }
+};
+ConsoleAuthorizeGuard = _ts_decorate3([
+  (0, import_common7.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleAccess === "undefined" ? Object : DashboardConsoleAccess
+  ])
+], ConsoleAuthorizeGuard);
+function deniedPage(title, message) {
+  const body = "font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="${body}"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`;
+}
+__name(deniedPage, "deniedPage");
+var FORBIDDEN_PAGE = deniedPage("Access denied", "You do not have access to this console.");
+var UNAUTHENTICATED_PAGE = deniedPage("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const res = host.switchToHttp().getResponse();
+    const { decision, page } = exception;
+    if (page && decision.reason === "unauthenticated" && decision.redirectTo !== void 0) {
+      adapter.redirect(res, 302, decision.redirectTo);
+      return;
+    }
+    if (page) {
+      const forbidden2 = decision.reason === "forbidden";
+      adapter.setHeader(res, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(res, forbidden2 ? FORBIDDEN_PAGE : UNAUTHENTICATED_PAGE, forbidden2 ? 403 : 401);
+      return;
+    }
+    adapter.reply(res, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate3([
+  (0, import_common7.Catch)(ConsoleAccessDenied),
+  (0, import_common7.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof import_core.HttpAdapterHost === "undefined" ? Object : import_core.HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+function UseConsoleAuthorize() {
+  return (0, import_common7.applyDecorators)((0, import_common7.UseGuards)(ConsoleAuthorizeGuard), (0, import_common7.UseFilters)(ConsoleAuthorizeFilter));
+}
+__name(UseConsoleAuthorize, "UseConsoleAuthorize");
+
+// src/server/agent-ui.controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", __importMetaUrl));
@@ -1152,7 +1511,7 @@ var AgentUiController = class {
     }
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common6.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common8.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -1160,57 +1519,58 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common6.NotFoundException();
+    if (safe !== file) throw new import_common8.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common6.NotFoundException();
+      throw new import_common8.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common8.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate3([
-  (0, import_common6.Get)(),
-  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_param3(0, (0, import_common6.Req)()),
-  _ts_param3(1, (0, import_common6.Res)({
+_ts_decorate4([
+  (0, import_common8.Get)(),
+  ConsolePage(),
+  (0, import_common8.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common8.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param4(0, (0, import_common8.Req)()),
+  _ts_param4(1, (0, import_common8.Res)({
     passthrough: true
   })),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata4("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate3([
-  (0, import_common6.Get)("assets/:file"),
-  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, (0, import_common6.Param)("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common8.Get)("assets/:file"),
+  (0, import_common8.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param4(0, (0, import_common8.Param)("file")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
+  _ts_metadata4("design:returntype", typeof import_common8.StreamableFile === "undefined" ? Object : import_common8.StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate3([
+AgentUiController = _ts_decorate4([
   (0, import_nestjs_agent_core2.CanAnyone)(),
-  (0, import_common6.Controller)(),
-  _ts_param3(0, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  (0, import_common8.Controller)(),
+  _ts_param4(0, (0, import_common8.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, (0, import_common8.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
 // src/server/agent-dashboard.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1223,23 +1583,29 @@ function _ts_decorate4(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate5, "_ts_decorate");
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
-function assertProtected(options) {
-  if (process.env.NODE_ENV !== "production") return;
-  if (options.routes === false) return;
-  if ((options.decorators ?? []).length > 0) return;
-  throw new Error("AgentDashboardModule: the AI-gateway console would be served open in production. Say who reaches it, with `decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]`, or mount its routes yourself with `routes: false` and extend `AgentApiController` / `AgentUiController` under your own guards.");
+function consoleDecorators(decorators) {
+  return [
+    ...decorators ?? [],
+    (0, import_common9.UseGuards)(ConsoleAuthorizeGuard),
+    (0, import_common9.UseFilters)(ConsoleAuthorizeFilter)
+  ];
 }
-__name(assertProtected, "assertProtected");
+__name(consoleDecorators, "consoleDecorators");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
+    const consoleOptions = {
+      ...options.authorize !== void 0 ? {
+        authorize: options.authorize
+      } : {}
+    };
     return {
       module: _AgentApiModule,
       imports: [
@@ -1247,7 +1613,7 @@ var AgentApiModule = class _AgentApiModule {
       ],
       controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
         AgentApiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         DashboardService,
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
@@ -1255,25 +1621,31 @@ var AgentApiModule = class _AgentApiModule {
         {
           provide: DASHBOARD_APPROVAL_ACTOR_REF,
           useValue: options.approvalActorRef
-        }
+        },
+        {
+          provide: DASHBOARD_CONSOLE_OPTIONS,
+          useValue: consoleOptions
+        },
+        DashboardConsoleAccess
       ],
-      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`).
+      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`), and the
+      // access check `UseConsoleAuthorize()` runs.
       exports: [
         DashboardService,
-        DASHBOARD_APPROVAL_ACTOR_REF
+        DASHBOARD_APPROVAL_ACTOR_REF,
+        DashboardConsoleAccess
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate4([
-  (0, import_common7.Module)({})
+AgentApiModule = _ts_decorate5([
+  (0, import_common9.Module)({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
   static {
     __name(this, "AgentDashboardModule");
   }
   static forRoot(options = {}) {
-    assertProtected(options);
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     return {
@@ -1293,10 +1665,13 @@ var AgentDashboardModule = class _AgentDashboardModule {
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
+          } : {},
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
           } : {}
         }),
         ...options.routes === false ? [] : [
-          import_core.RouterModule.register([
+          import_core2.RouterModule.register([
             {
               path: basePath,
               module: _AgentDashboardModule
@@ -1310,7 +1685,7 @@ var AgentDashboardModule = class _AgentDashboardModule {
       ],
       controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
         AgentUiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         {
           provide: DASHBOARD_BASE_PATH,
@@ -1331,8 +1706,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
     };
   }
 };
-AgentDashboardModule = _ts_decorate4([
-  (0, import_common7.Module)({})
+AgentDashboardModule = _ts_decorate5([
+  (0, import_common9.Module)({})
 ], AgentDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1345,11 +1720,24 @@ AgentDashboardModule = _ts_decorate4([
   AgentApiModule,
   AgentDashboardModule,
   AgentUiController,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
   DASHBOARD_BASE_PATH,
+  DASHBOARD_CONSOLE_OPTIONS,
+  DashboardConsoleAccess,
   DashboardService,
+  UseConsoleAuthorize,
   agentDashboardMountPaths,
-  parsePriceInput
+  authorizeByToken,
+  normalizeConsoleResult,
+  parsePriceInput,
+  resolveConsoleAuthorize
 });
 //# sourceMappingURL=index.cjs.map