@dudousxd/nestjs-agent-dashboard 0.19.1 → 0.21.0

package/dist/server/index.cjs

@@ -1,8 +1,10 @@
 const __importMetaUrl = require('url').pathToFileURL(__filename).href;
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
@@ -17,6 +19,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/server/index.ts
@@ -30,13 +40,30 @@ __export(index_exports, {
   AgentApiController: () => AgentApiController,
   AgentApiModule: () => AgentApiModule,
   AgentDashboardModule: () => AgentDashboardModule,
+  AgentDevToolsRegistration: () => AgentDevToolsRegistration,
   AgentUiController: () => AgentUiController,
+  CONSOLE_AUTHORIZE_MISSING_WARNING: () => CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE: () => CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA: () => CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied: () => ConsoleAccessDenied,
+  ConsoleAuthorizeFilter: () => ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard: () => ConsoleAuthorizeGuard,
+  ConsolePage: () => ConsolePage,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF: () => DASHBOARD_APPROVAL_ACTOR_REF,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
+  DASHBOARD_CONSOLE_OPTIONS: () => DASHBOARD_CONSOLE_OPTIONS,
+  DASHBOARD_DEV_TOOLS: () => DASHBOARD_DEV_TOOLS,
+  DashboardConsoleAccess: () => DashboardConsoleAccess,
   DashboardService: () => DashboardService,
+  UseConsoleAuthorize: () => UseConsoleAuthorize,
   agentDashboardMountPaths: () => agentDashboardMountPaths,
-  parsePriceInput: () => parsePriceInput
+  agentDevTools: () => agentDevTools,
+  anyAuthorize: () => anyAuthorize,
+  authorizeByToken: () => authorizeByToken,
+  normalizeConsoleResult: () => normalizeConsoleResult,
+  parsePriceInput: () => parsePriceInput,
+  resolveConsoleAuthorize: () => resolveConsoleAuthorize
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -121,6 +148,8 @@ var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:ac
 var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
 var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
 var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+var DASHBOARD_CONSOLE_OPTIONS = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:console-options");
+var DASHBOARD_DEV_TOOLS = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:dev-tools");
 
 // src/server/dashboard.service.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -199,8 +228,8 @@ var DashboardService = class {
     };
   }
   /** Top threads by cost for a day range (default 10, highest cost first). */
-  async topThreads(range, limit = 10) {
-    const rows = await this.queries.spendByThread(range, limit);
+  async topThreads(range, limit2 = 10) {
+    const rows = await this.queries.spendByThread(range, limit2);
     return this.withActorLabels(rows);
   }
   /** Run reliability for a day range: metrics, by-agent/by-error breakdowns and the trend, in parallel. */
@@ -219,12 +248,12 @@ var DashboardService = class {
     };
   }
   /** Most recent runs (status/agent/duration/error) for the Reliability recent-runs table. */
-  recentRuns(limit) {
-    return this.queries.recentRuns(limit);
+  recentRuns(limit2) {
+    return this.queries.recentRuns(limit2);
   }
   /** Most recent tool calls (status/type/thread) for the Runs & tools activity feed. */
-  recentToolCalls(limit) {
-    return this.queries.recentToolCalls(limit);
+  recentToolCalls(limit2) {
+    return this.queries.recentToolCalls(limit2);
   }
   /** Paged, filterable tool calls for the Runs & tools activity table. */
   toolCallsPage(query) {
@@ -239,8 +268,8 @@ var DashboardService = class {
   * Capped and totalless — kept because the SPA still calls `GET approvals`; new callers want
   * {@link approvalsPage}, which reports how much of the backlog the cap hid.
   */
-  pendingApprovals(limit) {
-    return this.queries.pendingApprovals(limit);
+  pendingApprovals(limit2) {
+    return this.queries.pendingApprovals(limit2);
   }
   /** Paged, filterable approvals inbox with a total — the backlog-safe read of the HITL queue. */
   approvalsPage(query) {
@@ -328,8 +357,8 @@ var DashboardService = class {
     });
   }
   /** Most recent threads with rolled-up message/token counts. */
-  async recentThreads(limit) {
-    const rows = await this.queries.recentThreads(limit);
+  async recentThreads(limit2) {
+    const rows = await this.queries.recentThreads(limit2);
     return this.withActorLabels(rows);
   }
   /**
@@ -337,10 +366,10 @@ var DashboardService = class {
   * {@link recentThreads} is.
   */
   async threadsPage(query) {
-    const page = await this.queries.threadsPage(query);
-    const rows = await this.withActorLabels(page.rows);
+    const page2 = await this.queries.threadsPage(query);
+    const rows = await this.withActorLabels(page2.rows);
     return {
-      ...page,
+      ...page2,
       rows
     };
   }
@@ -661,27 +690,27 @@ var AgentApiController = class {
     return this.dashboard.spend(resolveRange(from, to));
   }
   /** Top threads by cost (default 10, max 200) for a day range (defaults to the last 30 days). */
-  topThreads(from, to, limit) {
-    return this.dashboard.topThreads(resolveRange(from, to), parseLimit(limit, 10));
+  topThreads(from, to, limit2) {
+    return this.dashboard.topThreads(resolveRange(from, to), parseLimit(limit2, 10));
   }
   /** `{ metrics, byAgent, errors, trend }` for a day range (defaults to the last 30 days). */
   reliability(from, to) {
     return this.dashboard.reliability(resolveRange(from, to));
   }
   /** Most recent runs (default 50, max 200) for the Reliability recent-runs table. */
-  runs(limit) {
-    return this.dashboard.recentRuns(parseLimit(limit, 50));
+  runs(limit2) {
+    return this.dashboard.recentRuns(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable runs for the Reliability recent-runs table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[agentName]`/`where[status]`/`where[errorCode]`/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  runsPage(page, limit, where) {
-    const parsedWhere = parseRunWhere(where);
+  runsPage(page2, limit2, where2) {
+    const parsedWhere = parseRunWhere(where2);
     return this.dashboard.runsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -698,19 +727,19 @@ var AgentApiController = class {
     return this.dashboard.runDetail(runId);
   }
   /** Most recent tool calls (default 50, max 200) for the activity feed. */
-  toolCalls(limit) {
-    return this.dashboard.recentToolCalls(parseLimit(limit, 50));
+  toolCalls(limit2) {
+    return this.dashboard.recentToolCalls(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable tool calls for the Runs & tools activity table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[toolName]`/`where[toolType]`/`where[status]`/`where[threadId]`/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  toolCallsPage(page, limit, where) {
-    const parsedWhere = parseToolCallWhere(where);
+  toolCallsPage(page2, limit2, where2) {
+    const parsedWhere = parseToolCallWhere(where2);
     return this.dashboard.toolCallsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -722,8 +751,8 @@ var AgentApiController = class {
   * Capped with NO total, so a backlog past `limit` is invisible from the response alone. Kept
   * because the SPA still calls it; anything new should call `approvals-page` instead.
   */
-  approvals(limit) {
-    return this.dashboard.pendingApprovals(parseLimit(limit, 50));
+  approvals(limit2) {
+    return this.dashboard.pendingApprovals(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable approvals inbox, oldest first. `page` (default 1), `limit` (default 25, max
@@ -733,11 +762,11 @@ var AgentApiController = class {
   * Unlike `GET approvals` this reports `total`, so the console can say "showing N of M" instead of
   * silently hiding pending decisions behind a row cap.
   */
-  approvalsPage(page, limit, where) {
-    const parsedWhere = parseApprovalWhere(where);
+  approvalsPage(page2, limit2, where2) {
+    const parsedWhere = parseApprovalWhere(where2);
     return this.dashboard.approvalsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -784,19 +813,19 @@ var AgentApiController = class {
     return this.dashboard.genuiStats(resolveRange(from, to));
   }
   /** Most recent threads (default 50, max 200) with rolled-up counts. */
-  threads(limit) {
-    return this.dashboard.recentThreads(parseLimit(limit, 50));
+  threads(limit2) {
+    return this.dashboard.recentThreads(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable threads for the Runs & tools threads table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[actorRef]`/`where[title]` (case-insensitive substring)/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  threadsPage(page, limit, where) {
-    const parsedWhere = parseThreadWhere(where);
+  threadsPage(page2, limit2, where2) {
+    const parsedWhere = parseThreadWhere(where2);
     return this.dashboard.threadsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -1082,15 +1111,249 @@ __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 // src/server/agent-dashboard.module.ts
 var import_nestjs_agent_core3 = require("@dudousxd/nestjs-agent-core");
 var import_reflect_metadata = require("reflect-metadata");
-var import_common7 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
+var import_common10 = require("@nestjs/common");
+var import_core3 = require("@nestjs/core");
 
 // src/server/agent-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
 var import_nestjs_agent_core2 = require("@dudousxd/nestjs-agent-core");
+var import_common8 = require("@nestjs/common");
+
+// src/server/console-authorize.guard.ts
+var import_common7 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
+
+// src/server/console-authorize.ts
+var import_node_crypto = require("crypto");
 var import_common6 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+var CONSOLE_GATE = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-agent-dashboard";
+var MODULE = "AgentDashboardModule";
+var logger = new import_common6.Logger(MODULE);
+var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
+var allow = /* @__PURE__ */ __name((caller) => caller !== void 0 && caller !== "" ? {
+  allowed: true,
+  caller
+} : {
+  allowed: true
+}, "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (result === null || typeof result !== "object") return forbidden();
+  const value = result;
+  if (typeof value.redirectTo === "string" && value.redirectTo !== "" && value.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: value.redirectTo
+    };
+  }
+  if (value.allowed === true) {
+    return allow(typeof value.caller === "string" ? value.caller : void 0);
+  }
+  return value.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
+  }
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function lazyModuleClass(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const candidate = value.default;
+  return isAuthorizerClass(candidate) ? candidate : void 0;
+}
+__name(lazyModuleClass, "lazyModuleClass");
+function tryGet(moduleRef, token) {
+  try {
+    return moduleRef.get(token, {
+      strict: false
+    }) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(tryGet, "tryGet");
+function classInstances(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  return (Class) => {
+    let instance = instances.get(Class);
+    if (instance === void 0) {
+      const registered = tryGet(moduleRef, Class);
+      instance = registered !== void 0 ? Promise.resolve(registered) : moduleRef.create(Class);
+      instance.catch(() => instances.delete(Class));
+      instances.set(Class, instance);
+    }
+    return instance;
+  };
+}
+__name(classInstances, "classInstances");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+async function policyDecider(check, moduleRef) {
+  let mod;
+  try {
+    mod = await import("@nestjs/authorization");
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs @nestjs/authorization installed and AuthorizationModule imported; or pass a function, a class, or a gate name.`);
+  }
+  const service = tryGet(moduleRef, mod.AuthorizationService);
+  if (service === void 0) {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app.`);
+  }
+  const options = tryGet(moduleRef, mod.AUTHORIZATION_MODULE_OPTIONS);
+  const getUser = options?.getUser ?? mod.defaultGetUser;
+  return async (context) => {
+    const user = await getUser(context);
+    const signedIn = hasUser(user);
+    if (await service.can(check.policy, check.ability, signedIn ? user : null)) return allow();
+    return signedIn ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const log = options.logger ?? logger;
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) log.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    const production = isProduction();
+    return async () => production ? forbidden() : allow("dev-open");
+  }
+  const instanceOf = classInstances(moduleRef);
+  let decide;
+  if (typeof authorize === "string") {
+    const name = authorize;
+    const gate = tryGet(moduleRef, CONSOLE_GATE);
+    if (gate === void 0) {
+      throw new Error(`${MODULE}: \`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }.`);
+    }
+    decide = /* @__PURE__ */ __name((context) => gate.allows(name, context), "decide");
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    const Class = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => (await instanceOf(Class)).authorize(context), "decide");
+  } else if (typeof authorize === "function") {
+    const fn = authorize;
+    let lazyClass;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazyClass !== void 0) return (await instanceOf(lazyClass)).authorize(context);
+      const result = await fn(context);
+      const Class = lazyModuleClass(result);
+      if (Class === void 0) return result;
+      lazyClass = Class;
+      return (await instanceOf(Class)).authorize(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return normalizeConsoleResult(await decide(context));
+    } catch (error) {
+      log.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+function sha256(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value).digest();
+}
+__name(sha256, "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token === "") {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  const caller = `token:${expected.toString("hex").slice(0, 12)}`;
+  return (context) => {
+    const req = context.switchToHttp().getRequest();
+    const header = req?.headers?.authorization;
+    const value = Array.isArray(header) ? header[0] : header;
+    const match = typeof value === "string" ? /^Bearer\s+(.+)$/i.exec(value.trim()) : null;
+    if (match?.[1] !== void 0 && (0, import_node_crypto.timingSafeEqual)(sha256(match[1]), expected)) {
+      return {
+        allowed: true,
+        caller
+      };
+    }
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+function anyAuthorize(...forms) {
+  if (forms.length === 0) throw new Error("anyAuthorize: pass at least one authorize form.");
+  let AnyConsoleAuthorizer = class AnyConsoleAuthorizer {
+    static {
+      __name(this, "AnyConsoleAuthorizer");
+    }
+    moduleRef;
+    #decides;
+    constructor(moduleRef) {
+      this.moduleRef = moduleRef;
+    }
+    async authorize(context) {
+      this.#decides ??= Promise.all(forms.map((form) => resolveConsoleAuthorize(form, this.moduleRef, {
+        warnIfMissing: false
+      })));
+      this.#decides.catch(() => {
+        this.#decides = void 0;
+      });
+      let unauthenticated2;
+      for (const decide of await this.#decides) {
+        const decision = await decide(context);
+        if (decision.allowed) return decision;
+        if (decision.reason === "unauthenticated") unauthenticated2 ??= decision;
+      }
+      if (unauthenticated2 === void 0) return {
+        allowed: false,
+        reason: "forbidden"
+      };
+      return "redirectTo" in unauthenticated2 && unauthenticated2.redirectTo !== void 0 ? {
+        redirectTo: unauthenticated2.redirectTo
+      } : {
+        allowed: false,
+        reason: "unauthenticated"
+      };
+    }
+  };
+  Reflect.defineMetadata("design:paramtypes", [
+    import_core.ModuleRef
+  ], AnyConsoleAuthorizer);
+  return AnyConsoleAuthorizer;
+}
+__name(anyAuthorize, "anyAuthorize");
+
+// src/server/console-authorize.guard.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1117,6 +1380,161 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
+var DashboardConsoleAccess = class {
+  static {
+    __name(this, "DashboardConsoleAccess");
+  }
+  options;
+  moduleRef;
+  #decide;
+  constructor(options, moduleRef) {
+    this.options = options;
+    this.moduleRef = moduleRef;
+  }
+  #resolving;
+  /** Resolves `authorize` at boot: a configuration mistake fails the boot, and the warning logs once. */
+  async onModuleInit() {
+    this.#resolving ??= resolveConsoleAuthorize(this.options.authorize, this.moduleRef);
+    this.#decide = await this.#resolving;
+  }
+  /** The decision for one request. */
+  async check(context) {
+    if (this.#decide === void 0) await this.onModuleInit();
+    return this.#decide(context);
+  }
+};
+DashboardConsoleAccess = _ts_decorate3([
+  (0, import_common7.Injectable)(),
+  _ts_param3(0, (0, import_common7.Inject)(DASHBOARD_CONSOLE_OPTIONS)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleOptions === "undefined" ? Object : DashboardConsoleOptions,
+    typeof import_core2.ModuleRef === "undefined" ? Object : import_core2.ModuleRef
+  ])
+], DashboardConsoleAccess);
+var CONSOLE_PAGE_METADATA = "@dudousxd/nestjs-agent-dashboard:console-page";
+var ConsolePage = /* @__PURE__ */ __name(() => (0, import_common7.SetMetadata)(CONSOLE_PAGE_METADATA, true), "ConsolePage");
+var ConsoleAccessDenied = class extends import_common7.HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page2) {
+    super(decision.reason === "forbidden" ? {
+      error: "forbidden"
+    } : {
+      error: "unauthenticated",
+      ...decision.redirectTo !== void 0 ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    }, decision.reason === "forbidden" ? 403 : 401), this.decision = decision, this.page = page2;
+  }
+};
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  const page2 = Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getHandler()) === true || Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) === true;
+  if (!page2) return false;
+  const req = context.switchToHttp().getRequest();
+  if ((req.method ?? "GET").toUpperCase() !== "GET") return false;
+  const accept = req.headers?.accept;
+  const value = Array.isArray(accept) ? accept.join(",") : accept ?? "";
+  return value.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  access;
+  constructor(access) {
+    this.access = access;
+  }
+  async canActivate(context) {
+    const decision = await this.access.check(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
+  }
+};
+ConsoleAuthorizeGuard = _ts_decorate3([
+  (0, import_common7.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleAccess === "undefined" ? Object : DashboardConsoleAccess
+  ])
+], ConsoleAuthorizeGuard);
+function deniedPage(title, message) {
+  const body = "font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="${body}"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`;
+}
+__name(deniedPage, "deniedPage");
+var FORBIDDEN_PAGE = deniedPage("Access denied", "You do not have access to this console.");
+var UNAUTHENTICATED_PAGE = deniedPage("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const res = host.switchToHttp().getResponse();
+    const { decision, page: page2 } = exception;
+    if (page2 && decision.reason === "unauthenticated" && decision.redirectTo !== void 0) {
+      adapter.redirect(res, 302, decision.redirectTo);
+      return;
+    }
+    if (page2) {
+      const forbidden2 = decision.reason === "forbidden";
+      adapter.setHeader(res, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(res, forbidden2 ? FORBIDDEN_PAGE : UNAUTHENTICATED_PAGE, forbidden2 ? 403 : 401);
+      return;
+    }
+    adapter.reply(res, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate3([
+  (0, import_common7.Catch)(ConsoleAccessDenied),
+  (0, import_common7.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof import_core2.HttpAdapterHost === "undefined" ? Object : import_core2.HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+function UseConsoleAuthorize() {
+  return (0, import_common7.applyDecorators)((0, import_common7.UseGuards)(ConsoleAuthorizeGuard), (0, import_common7.UseFilters)(ConsoleAuthorizeFilter));
+}
+__name(UseConsoleAuthorize, "UseConsoleAuthorize");
+
+// src/server/agent-ui.controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", __importMetaUrl));
@@ -1152,7 +1570,7 @@ var AgentUiController = class {
     }
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common6.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common8.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -1160,57 +1578,464 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common6.NotFoundException();
+    if (safe !== file) throw new import_common8.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common6.NotFoundException();
+      throw new import_common8.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common6.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common8.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate3([
-  (0, import_common6.Get)(),
-  (0, import_common6.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common6.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_param3(0, (0, import_common6.Req)()),
-  _ts_param3(1, (0, import_common6.Res)({
+_ts_decorate4([
+  (0, import_common8.Get)(),
+  ConsolePage(),
+  (0, import_common8.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common8.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param4(0, (0, import_common8.Req)()),
+  _ts_param4(1, (0, import_common8.Res)({
     passthrough: true
   })),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata4("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate3([
-  (0, import_common6.Get)("assets/:file"),
-  (0, import_common6.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, (0, import_common6.Param)("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate4([
+  (0, import_common8.Get)("assets/:file"),
+  (0, import_common8.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param4(0, (0, import_common8.Param)("file")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof import_common6.StreamableFile === "undefined" ? Object : import_common6.StreamableFile)
+  _ts_metadata4("design:returntype", typeof import_common8.StreamableFile === "undefined" ? Object : import_common8.StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate3([
+AgentUiController = _ts_decorate4([
   (0, import_nestjs_agent_core2.CanAnyone)(),
-  (0, import_common6.Controller)(),
-  _ts_param3(0, (0, import_common6.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  (0, import_common8.Controller)(),
+  _ts_param4(0, (0, import_common8.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, (0, import_common8.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
+// src/server/dev-tools.ts
+var import_common9 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var DEV_TOOLS_SLOT = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:dev-tools");
+function devToolsSlot() {
+  const holder = globalThis;
+  const existing = holder[DEV_TOOLS_SLOT];
+  if (existing !== void 0) return existing;
+  const libs = [];
+  const slot = {
+    version: 1,
+    libs,
+    register(lib) {
+      if (libs.some((entry) => entry.lib === lib.lib)) {
+        throw new Error(`dev tools: the lib "${lib.lib}" is already registered`);
+      }
+      libs.push(lib);
+      return () => {
+        const index = libs.indexOf(lib);
+        if (index !== -1) libs.splice(index, 1);
+      };
+    }
+  };
+  holder[DEV_TOOLS_SLOT] = slot;
+  return slot;
+}
+__name(devToolsSlot, "devToolsSlot");
+var DEFAULT_LIMIT = 20;
+var MAX_LIMIT = 100;
+var MESSAGE_LIMIT = 50;
+var MESSAGE_BYTES = 2 * 1024;
+var DAY_MS2 = 864e5;
+var ISO_DAY3 = /^\d{4}-\d{2}-\d{2}$/;
+var day = {
+  type: "string",
+  description: "UTC day, YYYY-MM-DD."
+};
+var page = {
+  type: "integer",
+  description: "Page, from 1. Pass the `next` of the previous page.",
+  minimum: 1
+};
+var limit = {
+  type: "integer",
+  description: `Rows per page (default ${DEFAULT_LIMIT}, max ${MAX_LIMIT}).`,
+  minimum: 1,
+  maximum: MAX_LIMIT
+};
+var str = /* @__PURE__ */ __name((value) => typeof value === "string" && value !== "" ? value : void 0, "str");
+function dayOf(input, key) {
+  const value = str(input[key]);
+  if (value !== void 0 && !ISO_DAY3.test(value)) throw new Error(`"${key}" must be YYYY-MM-DD`);
+  return value;
+}
+__name(dayOf, "dayOf");
+function rangeOf(input) {
+  const utcDay2 = /* @__PURE__ */ __name((daysAgo) => new Date(Date.now() - daysAgo * DAY_MS2).toISOString().slice(0, 10), "utcDay");
+  return {
+    fromDay: dayOf(input, "from") ?? utcDay2(29),
+    toDay: dayOf(input, "to") ?? utcDay2(0)
+  };
+}
+__name(rangeOf, "rangeOf");
+function pageOf(input) {
+  return {
+    page: typeof input.page === "number" ? input.page : 1,
+    pageSize: typeof input.limit === "number" ? input.limit : DEFAULT_LIMIT
+  };
+}
+__name(pageOf, "pageOf");
+function where(fields) {
+  const set = Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0));
+  return Object.keys(set).length > 0 ? {
+    where: set
+  } : {};
+}
+__name(where, "where");
+function listOf(result) {
+  return {
+    items: result.rows,
+    next: result.page * result.pageSize < result.total ? result.page + 1 : null,
+    total: result.total
+  };
+}
+__name(listOf, "listOf");
+function cut(text, maxBytes) {
+  const size = Buffer.byteLength(text, "utf8");
+  if (size <= maxBytes) return text;
+  const suffix = `\u2026(truncated, ${size} bytes)`;
+  const keep = Math.max(0, maxBytes - Buffer.byteLength(suffix, "utf8"));
+  let head = Buffer.from(text, "utf8").subarray(0, keep).toString("utf8");
+  if (head.endsWith("\uFFFD")) head = head.slice(0, -1);
+  return `${head}${suffix}`;
+}
+__name(cut, "cut");
+function agentDevTools(dashboard) {
+  return [
+    {
+      name: "agent_list_runs",
+      kind: "read",
+      description: "Agent runs, newest first: agent, actor, status, duration, cost, error. Filters: agent, status, errorCode, threadId, from/to (UTC days). Returns { items, next, total }; pass next as page.",
+      input: {
+        type: "object",
+        properties: {
+          agent: {
+            type: "string",
+            description: "Agent name."
+          },
+          status: {
+            type: "string",
+            enum: [
+              "running",
+              "completed",
+              "failed",
+              "cancelled"
+            ]
+          },
+          errorCode: {
+            type: "string"
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.runsPage({
+          ...pageOf(input),
+          ...where({
+            agentName: str(input.agent),
+            status: str(input.status),
+            errorCode: str(input.errorCode),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    },
+    {
+      name: "agent_get_run",
+      kind: "read",
+      description: "One run: the run, its thread, its tool calls and timings. With includeMessages: true, the thread's latest 50 messages, each cut to 2 KB. An error when no run has that id.",
+      input: {
+        type: "object",
+        properties: {
+          id: {
+            type: "string",
+            description: "Run id."
+          },
+          includeMessages: {
+            type: "boolean",
+            description: "Include messages (default false)."
+          }
+        },
+        required: [
+          "id"
+        ]
+      },
+      async run(input) {
+        let detail;
+        try {
+          detail = await dashboard.runDetail(String(input.id));
+        } catch (error) {
+          if (error instanceof import_common9.NotFoundException) throw new Error(`run ${String(input.id)} not found`);
+          throw error;
+        }
+        if (input.includeMessages !== true) return detail;
+        const thread = await dashboard.threadDetail({
+          threadId: detail.run.threadId,
+          messageLimit: MESSAGE_LIMIT,
+          runLimit: 1
+        });
+        return {
+          ...detail,
+          messages: thread.messages.map((message) => ({
+            ...message,
+            content: cut(message.content, MESSAGE_BYTES)
+          }))
+        };
+      }
+    },
+    {
+      name: "agent_get_spend",
+      kind: "read",
+      description: "Tokens and cost over UTC days from/to (default the last 30 days): by model, by actor, by feature and the daily trend. `by` returns one of them.",
+      input: {
+        type: "object",
+        properties: {
+          by: {
+            type: "string",
+            enum: [
+              "model",
+              "actor",
+              "feature"
+            ]
+          },
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        const spend = await dashboard.spend(rangeOf(input));
+        switch (input.by) {
+          case "model":
+            return {
+              items: spend.byModel
+            };
+          case "actor":
+            return {
+              items: spend.byActor
+            };
+          case "feature":
+            return {
+              items: spend.byFeature ?? []
+            };
+          default:
+            return spend;
+        }
+      }
+    },
+    {
+      name: "agent_get_tool_stats",
+      kind: "read",
+      description: "Per tool: calls, failures, rejections and latency, over UTC days from/to (default the last 30 days).",
+      input: {
+        type: "object",
+        properties: {
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        return {
+          items: await dashboard.toolStats(rangeOf(input))
+        };
+      }
+    },
+    {
+      name: "agent_get_reliability",
+      kind: "read",
+      description: "Run metrics, by-agent and by-error breakdowns and the trend, over UTC days from/to (default the last 30 days).",
+      input: {
+        type: "object",
+        properties: {
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        return dashboard.reliability(rangeOf(input));
+      }
+    },
+    {
+      name: "agent_list_pending_approvals",
+      kind: "read",
+      description: "Tool calls waiting for a human approval, oldest first. Read-only: approve them in the app. Returns { items, next, total }.",
+      input: {
+        type: "object",
+        properties: {
+          toolName: {
+            type: "string"
+          },
+          agent: {
+            type: "string",
+            description: "Agent name."
+          },
+          actor: {
+            type: "string",
+            description: "Actor ref of the thread owner."
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.approvalsPage({
+          ...pageOf(input),
+          ...where({
+            toolName: str(input.toolName),
+            agentName: str(input.agent),
+            actorRef: str(input.actor),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    },
+    {
+      name: "agent_list_recent_tool_calls",
+      kind: "read",
+      description: "Tool calls of every agent, newest first. Filters: toolName, status, threadId, from/to (UTC days). Returns { items, next, total }.",
+      input: {
+        type: "object",
+        properties: {
+          toolName: {
+            type: "string"
+          },
+          status: {
+            type: "string"
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.toolCallsPage({
+          ...pageOf(input),
+          ...where({
+            toolName: str(input.toolName),
+            status: str(input.status),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    }
+  ];
+}
+__name(agentDevTools, "agentDevTools");
+var logger2 = new import_common9.Logger("AgentDashboardModule");
+var AgentDevToolsRegistration = class {
+  static {
+    __name(this, "AgentDevToolsRegistration");
+  }
+  enabled;
+  dashboard;
+  access;
+  #unregister;
+  constructor(enabled, dashboard, access) {
+    this.enabled = enabled;
+    this.dashboard = dashboard;
+    this.access = access;
+  }
+  onModuleInit() {
+    if (!this.enabled) return;
+    const slot = devToolsSlot();
+    if (slot.version !== 1 || typeof slot.register !== "function") return;
+    try {
+      this.#unregister = slot.register({
+        lib: "agent",
+        title: "Agent governance",
+        authorize: /* @__PURE__ */ __name((context) => this.access.check(context), "authorize"),
+        tools: agentDevTools(this.dashboard)
+      });
+    } catch (error) {
+      logger2.warn(`agent dev tools not registered: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  onModuleDestroy() {
+    this.#unregister?.();
+    this.#unregister = void 0;
+  }
+};
+AgentDevToolsRegistration = _ts_decorate5([
+  (0, import_common9.Injectable)(),
+  _ts_param5(0, (0, import_common9.Inject)(DASHBOARD_DEV_TOOLS)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    Boolean,
+    typeof DashboardService === "undefined" ? Object : DashboardService,
+    typeof DashboardConsoleAccess === "undefined" ? Object : DashboardConsoleAccess
+  ])
+], AgentDevToolsRegistration);
+
 // src/server/agent-dashboard.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1223,23 +2048,29 @@ function _ts_decorate4(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
-function assertProtected(options) {
-  if (process.env.NODE_ENV !== "production") return;
-  if (options.routes === false) return;
-  if ((options.decorators ?? []).length > 0) return;
-  throw new Error("AgentDashboardModule: the AI-gateway console would be served open in production. Say who reaches it, with `decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]`, or mount its routes yourself with `routes: false` and extend `AgentApiController` / `AgentUiController` under your own guards.");
+function consoleDecorators(decorators) {
+  return [
+    ...decorators ?? [],
+    (0, import_common10.UseGuards)(ConsoleAuthorizeGuard),
+    (0, import_common10.UseFilters)(ConsoleAuthorizeFilter)
+  ];
 }
-__name(assertProtected, "assertProtected");
+__name(consoleDecorators, "consoleDecorators");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
+    const consoleOptions = {
+      ...options.authorize !== void 0 ? {
+        authorize: options.authorize
+      } : {}
+    };
     return {
       module: _AgentApiModule,
       imports: [
@@ -1247,7 +2078,7 @@ var AgentApiModule = class _AgentApiModule {
       ],
       controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
         AgentApiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         DashboardService,
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
@@ -1255,25 +2086,36 @@ var AgentApiModule = class _AgentApiModule {
         {
           provide: DASHBOARD_APPROVAL_ACTOR_REF,
           useValue: options.approvalActorRef
-        }
+        },
+        {
+          provide: DASHBOARD_CONSOLE_OPTIONS,
+          useValue: consoleOptions
+        },
+        DashboardConsoleAccess,
+        {
+          provide: DASHBOARD_DEV_TOOLS,
+          useValue: options.devTools ?? options.routes !== false
+        },
+        AgentDevToolsRegistration
       ],
-      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`).
+      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`), and the
+      // access check `UseConsoleAuthorize()` runs.
       exports: [
         DashboardService,
-        DASHBOARD_APPROVAL_ACTOR_REF
+        DASHBOARD_APPROVAL_ACTOR_REF,
+        DashboardConsoleAccess
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate4([
-  (0, import_common7.Module)({})
+AgentApiModule = _ts_decorate6([
+  (0, import_common10.Module)({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
   static {
     __name(this, "AgentDashboardModule");
   }
   static forRoot(options = {}) {
-    assertProtected(options);
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     return {
@@ -1293,10 +2135,16 @@ var AgentDashboardModule = class _AgentDashboardModule {
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
+          } : {},
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
+          } : {},
+          ...options.devTools !== void 0 ? {
+            devTools: options.devTools
           } : {}
         }),
         ...options.routes === false ? [] : [
-          import_core.RouterModule.register([
+          import_core3.RouterModule.register([
             {
               path: basePath,
               module: _AgentDashboardModule
@@ -1310,7 +2158,7 @@ var AgentDashboardModule = class _AgentDashboardModule {
       ],
       controllers: options.routes === false ? [] : (0, import_nestjs_agent_core3.withControllerDecorators)([
         AgentUiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         {
           provide: DASHBOARD_BASE_PATH,
@@ -1331,8 +2179,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
     };
   }
 };
-AgentDashboardModule = _ts_decorate4([
-  (0, import_common7.Module)({})
+AgentDashboardModule = _ts_decorate6([
+  (0, import_common10.Module)({})
 ], AgentDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1344,12 +2192,29 @@ AgentDashboardModule = _ts_decorate4([
   AgentApiController,
   AgentApiModule,
   AgentDashboardModule,
+  AgentDevToolsRegistration,
   AgentUiController,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
   DASHBOARD_BASE_PATH,
+  DASHBOARD_CONSOLE_OPTIONS,
+  DASHBOARD_DEV_TOOLS,
+  DashboardConsoleAccess,
   DashboardService,
+  UseConsoleAuthorize,
   agentDashboardMountPaths,
-  parsePriceInput
+  agentDevTools,
+  anyAuthorize,
+  authorizeByToken,
+  normalizeConsoleResult,
+  parsePriceInput,
+  resolveConsoleAuthorize
 });
 //# sourceMappingURL=index.cjs.map