@dudousxd/nestjs-agent-dashboard 0.19.1 → 0.21.0

package/dist/server/index.js

@@ -82,6 +82,8 @@ var AGENT_ACTOR_RESOLVER = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent:ac
 var DASHBOARD_BASE_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
 var DASHBOARD_API_PATH = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
 var DASHBOARD_APPROVAL_ACTOR_REF = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+var DASHBOARD_CONSOLE_OPTIONS = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:console-options");
+var DASHBOARD_DEV_TOOLS = /* @__PURE__ */ Symbol.for("@dudousxd/nestjs-agent-dashboard:dev-tools");
 
 // src/server/dashboard.service.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -160,8 +162,8 @@ var DashboardService = class {
     };
   }
   /** Top threads by cost for a day range (default 10, highest cost first). */
-  async topThreads(range, limit = 10) {
-    const rows = await this.queries.spendByThread(range, limit);
+  async topThreads(range, limit2 = 10) {
+    const rows = await this.queries.spendByThread(range, limit2);
     return this.withActorLabels(rows);
   }
   /** Run reliability for a day range: metrics, by-agent/by-error breakdowns and the trend, in parallel. */
@@ -180,12 +182,12 @@ var DashboardService = class {
     };
   }
   /** Most recent runs (status/agent/duration/error) for the Reliability recent-runs table. */
-  recentRuns(limit) {
-    return this.queries.recentRuns(limit);
+  recentRuns(limit2) {
+    return this.queries.recentRuns(limit2);
   }
   /** Most recent tool calls (status/type/thread) for the Runs & tools activity feed. */
-  recentToolCalls(limit) {
-    return this.queries.recentToolCalls(limit);
+  recentToolCalls(limit2) {
+    return this.queries.recentToolCalls(limit2);
   }
   /** Paged, filterable tool calls for the Runs & tools activity table. */
   toolCallsPage(query) {
@@ -200,8 +202,8 @@ var DashboardService = class {
   * Capped and totalless — kept because the SPA still calls `GET approvals`; new callers want
   * {@link approvalsPage}, which reports how much of the backlog the cap hid.
   */
-  pendingApprovals(limit) {
-    return this.queries.pendingApprovals(limit);
+  pendingApprovals(limit2) {
+    return this.queries.pendingApprovals(limit2);
   }
   /** Paged, filterable approvals inbox with a total — the backlog-safe read of the HITL queue. */
   approvalsPage(query) {
@@ -289,8 +291,8 @@ var DashboardService = class {
     });
   }
   /** Most recent threads with rolled-up message/token counts. */
-  async recentThreads(limit) {
-    const rows = await this.queries.recentThreads(limit);
+  async recentThreads(limit2) {
+    const rows = await this.queries.recentThreads(limit2);
     return this.withActorLabels(rows);
   }
   /**
@@ -298,10 +300,10 @@ var DashboardService = class {
   * {@link recentThreads} is.
   */
   async threadsPage(query) {
-    const page = await this.queries.threadsPage(query);
-    const rows = await this.withActorLabels(page.rows);
+    const page2 = await this.queries.threadsPage(query);
+    const rows = await this.withActorLabels(page2.rows);
     return {
-      ...page,
+      ...page2,
       rows
     };
   }
@@ -622,27 +624,27 @@ var AgentApiController = class {
     return this.dashboard.spend(resolveRange(from, to));
   }
   /** Top threads by cost (default 10, max 200) for a day range (defaults to the last 30 days). */
-  topThreads(from, to, limit) {
-    return this.dashboard.topThreads(resolveRange(from, to), parseLimit(limit, 10));
+  topThreads(from, to, limit2) {
+    return this.dashboard.topThreads(resolveRange(from, to), parseLimit(limit2, 10));
   }
   /** `{ metrics, byAgent, errors, trend }` for a day range (defaults to the last 30 days). */
   reliability(from, to) {
     return this.dashboard.reliability(resolveRange(from, to));
   }
   /** Most recent runs (default 50, max 200) for the Reliability recent-runs table. */
-  runs(limit) {
-    return this.dashboard.recentRuns(parseLimit(limit, 50));
+  runs(limit2) {
+    return this.dashboard.recentRuns(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable runs for the Reliability recent-runs table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[agentName]`/`where[status]`/`where[errorCode]`/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  runsPage(page, limit, where) {
-    const parsedWhere = parseRunWhere(where);
+  runsPage(page2, limit2, where2) {
+    const parsedWhere = parseRunWhere(where2);
     return this.dashboard.runsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -659,19 +661,19 @@ var AgentApiController = class {
     return this.dashboard.runDetail(runId);
   }
   /** Most recent tool calls (default 50, max 200) for the activity feed. */
-  toolCalls(limit) {
-    return this.dashboard.recentToolCalls(parseLimit(limit, 50));
+  toolCalls(limit2) {
+    return this.dashboard.recentToolCalls(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable tool calls for the Runs & tools activity table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[toolName]`/`where[toolType]`/`where[status]`/`where[threadId]`/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  toolCallsPage(page, limit, where) {
-    const parsedWhere = parseToolCallWhere(where);
+  toolCallsPage(page2, limit2, where2) {
+    const parsedWhere = parseToolCallWhere(where2);
     return this.dashboard.toolCallsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -683,8 +685,8 @@ var AgentApiController = class {
   * Capped with NO total, so a backlog past `limit` is invisible from the response alone. Kept
   * because the SPA still calls it; anything new should call `approvals-page` instead.
   */
-  approvals(limit) {
-    return this.dashboard.pendingApprovals(parseLimit(limit, 50));
+  approvals(limit2) {
+    return this.dashboard.pendingApprovals(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable approvals inbox, oldest first. `page` (default 1), `limit` (default 25, max
@@ -694,11 +696,11 @@ var AgentApiController = class {
   * Unlike `GET approvals` this reports `total`, so the console can say "showing N of M" instead of
   * silently hiding pending decisions behind a row cap.
   */
-  approvalsPage(page, limit, where) {
-    const parsedWhere = parseApprovalWhere(where);
+  approvalsPage(page2, limit2, where2) {
+    const parsedWhere = parseApprovalWhere(where2);
     return this.dashboard.approvalsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -745,19 +747,19 @@ var AgentApiController = class {
     return this.dashboard.genuiStats(resolveRange(from, to));
   }
   /** Most recent threads (default 50, max 200) with rolled-up counts. */
-  threads(limit) {
-    return this.dashboard.recentThreads(parseLimit(limit, 50));
+  threads(limit2) {
+    return this.dashboard.recentThreads(parseLimit(limit2, 50));
   }
   /**
   * Paged, filterable threads for the Runs & tools threads table. `page` (default 1), `limit`
   * (default 25, max 200), and `where[actorRef]`/`where[title]` (case-insensitive substring)/
   * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
   */
-  threadsPage(page, limit, where) {
-    const parsedWhere = parseThreadWhere(where);
+  threadsPage(page2, limit2, where2) {
+    const parsedWhere = parseThreadWhere(where2);
     return this.dashboard.threadsPage({
-      page: parsePageNumber(page),
-      pageSize: parseLimit(limit, 25),
+      page: parsePageNumber(page2),
+      pageSize: parseLimit(limit2, 25),
       ...parsedWhere !== void 0 ? {
         where: parsedWhere
       } : {}
@@ -1043,7 +1045,7 @@ __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 // src/server/agent-dashboard.module.ts
 import { withControllerDecorators } from "@dudousxd/nestjs-agent-core";
 import "reflect-metadata";
-import { Module } from "@nestjs/common";
+import { Module, UseFilters as UseFilters2, UseGuards as UseGuards2 } from "@nestjs/common";
 import { RouterModule } from "@nestjs/core";
 
 // src/server/agent-ui.controller.ts
@@ -1051,7 +1053,241 @@ import { existsSync, readFileSync } from "fs";
 import { basename, extname, join, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { CanAnyone as CanAnyone2 } from "@dudousxd/nestjs-agent-core";
-import { Controller as Controller2, Get as Get2, Header, Inject as Inject3, NotFoundException as NotFoundException2, Param as Param2, Req as Req2, Res, StreamableFile } from "@nestjs/common";
+import { Controller as Controller2, Get as Get2, Header, Inject as Inject4, NotFoundException as NotFoundException2, Param as Param2, Req as Req2, Res, StreamableFile } from "@nestjs/common";
+
+// src/server/console-authorize.guard.ts
+import { Catch, HttpException, Inject as Inject3, Injectable as Injectable2, SetMetadata, UseFilters, UseGuards, applyDecorators } from "@nestjs/common";
+import { HttpAdapterHost, ModuleRef as ModuleRef2 } from "@nestjs/core";
+
+// src/server/console-authorize.ts
+import { createHash, timingSafeEqual } from "crypto";
+import { Logger } from "@nestjs/common";
+import { ModuleRef } from "@nestjs/core";
+var CONSOLE_GATE = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:console-gate");
+var PACKAGE = "@dudousxd/nestjs-agent-dashboard";
+var MODULE = "AgentDashboardModule";
+var logger = new Logger(MODULE);
+var CONSOLE_AUTHORIZE_MISSING_WARNING = `[${PACKAGE}] console has no \`authorize\` configured: it is open outside production and denies every request in production. Set \`authorize\` in ${MODULE}.forRoot().`;
+var allow = /* @__PURE__ */ __name((caller) => caller !== void 0 && caller !== "" ? {
+  allowed: true,
+  caller
+} : {
+  allowed: true
+}, "allow");
+var forbidden = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "forbidden"
+}), "forbidden");
+var unauthenticated = /* @__PURE__ */ __name(() => ({
+  allowed: false,
+  reason: "unauthenticated"
+}), "unauthenticated");
+function isProduction() {
+  return (process.env.NODE_ENV ?? "").trim().toLowerCase() === "production";
+}
+__name(isProduction, "isProduction");
+function normalizeConsoleResult(result) {
+  if (result === true) return allow();
+  if (result === null || typeof result !== "object") return forbidden();
+  const value = result;
+  if (typeof value.redirectTo === "string" && value.redirectTo !== "" && value.allowed !== true) {
+    return {
+      allowed: false,
+      reason: "unauthenticated",
+      redirectTo: value.redirectTo
+    };
+  }
+  if (value.allowed === true) {
+    return allow(typeof value.caller === "string" ? value.caller : void 0);
+  }
+  return value.reason === "unauthenticated" ? unauthenticated() : forbidden();
+}
+__name(normalizeConsoleResult, "normalizeConsoleResult");
+function isAuthorizerClass(value) {
+  if (typeof value !== "function") return false;
+  if (typeof value.prototype?.authorize === "function") {
+    return true;
+  }
+  return /^class[\s{]/.test(Function.prototype.toString.call(value));
+}
+__name(isAuthorizerClass, "isAuthorizerClass");
+function isPolicyCheck(value) {
+  return typeof value === "object" && value !== null && typeof value.policy === "function" && typeof value.ability === "string";
+}
+__name(isPolicyCheck, "isPolicyCheck");
+function lazyModuleClass(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const candidate = value.default;
+  return isAuthorizerClass(candidate) ? candidate : void 0;
+}
+__name(lazyModuleClass, "lazyModuleClass");
+function tryGet(moduleRef, token) {
+  try {
+    return moduleRef.get(token, {
+      strict: false
+    }) ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(tryGet, "tryGet");
+function classInstances(moduleRef) {
+  const instances = /* @__PURE__ */ new Map();
+  return (Class) => {
+    let instance = instances.get(Class);
+    if (instance === void 0) {
+      const registered = tryGet(moduleRef, Class);
+      instance = registered !== void 0 ? Promise.resolve(registered) : moduleRef.create(Class);
+      instance.catch(() => instances.delete(Class));
+      instances.set(Class, instance);
+    }
+    return instance;
+  };
+}
+__name(classInstances, "classInstances");
+function hasUser(user) {
+  return user !== null && user !== void 0 && user !== false;
+}
+__name(hasUser, "hasUser");
+async function policyDecider(check, moduleRef) {
+  let mod;
+  try {
+    mod = await import("@nestjs/authorization");
+  } catch {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs @nestjs/authorization installed and AuthorizationModule imported; or pass a function, a class, or a gate name.`);
+  }
+  const service = tryGet(moduleRef, mod.AuthorizationService);
+  if (service === void 0) {
+    throw new Error(`${MODULE}: \`authorize: { policy, ability }\` needs AuthorizationModule.forRoot() from @nestjs/authorization imported in the app.`);
+  }
+  const options = tryGet(moduleRef, mod.AUTHORIZATION_MODULE_OPTIONS);
+  const getUser = options?.getUser ?? mod.defaultGetUser;
+  return async (context) => {
+    const user = await getUser(context);
+    const signedIn = hasUser(user);
+    if (await service.can(check.policy, check.ability, signedIn ? user : null)) return allow();
+    return signedIn ? forbidden() : unauthenticated();
+  };
+}
+__name(policyDecider, "policyDecider");
+async function resolveConsoleAuthorize(authorize, moduleRef, options = {}) {
+  const log = options.logger ?? logger;
+  if (authorize === void 0) {
+    if (options.warnIfMissing !== false) log.warn(CONSOLE_AUTHORIZE_MISSING_WARNING);
+    const production = isProduction();
+    return async () => production ? forbidden() : allow("dev-open");
+  }
+  const instanceOf = classInstances(moduleRef);
+  let decide;
+  if (typeof authorize === "string") {
+    const name = authorize;
+    const gate = tryGet(moduleRef, CONSOLE_GATE);
+    if (gate === void 0) {
+      throw new Error(`${MODULE}: \`authorize: '${name}'\` needs @dudousxd/nestjs-authz's AuthzModule (it resolves gate names); or pass a function, a class, or { policy, ability }.`);
+    }
+    decide = /* @__PURE__ */ __name((context) => gate.allows(name, context), "decide");
+  } else if (isPolicyCheck(authorize)) {
+    decide = await policyDecider(authorize, moduleRef);
+  } else if (isAuthorizerClass(authorize)) {
+    const Class = authorize;
+    decide = /* @__PURE__ */ __name(async (context) => (await instanceOf(Class)).authorize(context), "decide");
+  } else if (typeof authorize === "function") {
+    const fn = authorize;
+    let lazyClass;
+    decide = /* @__PURE__ */ __name(async (context) => {
+      if (lazyClass !== void 0) return (await instanceOf(lazyClass)).authorize(context);
+      const result = await fn(context);
+      const Class = lazyModuleClass(result);
+      if (Class === void 0) return result;
+      lazyClass = Class;
+      return (await instanceOf(Class)).authorize(context);
+    }, "decide");
+  } else {
+    throw new Error(`${MODULE}: \`authorize\` must be a function, a class with authorize(), a lazy import, { policy, ability } or a gate name.`);
+  }
+  return async (context) => {
+    try {
+      return normalizeConsoleResult(await decide(context));
+    } catch (error) {
+      log.warn(`console \`authorize\` threw, denying the request: ${error instanceof Error ? error.message : String(error)}`);
+      return forbidden();
+    }
+  };
+}
+__name(resolveConsoleAuthorize, "resolveConsoleAuthorize");
+function sha256(value) {
+  return createHash("sha256").update(value).digest();
+}
+__name(sha256, "sha256");
+function authorizeByToken(options) {
+  const token = options.token;
+  if (typeof token !== "string" || token === "") {
+    throw new Error("authorizeByToken: `token` is empty; set it (e.g. from an env var).");
+  }
+  const expected = sha256(token);
+  const caller = `token:${expected.toString("hex").slice(0, 12)}`;
+  return (context) => {
+    const req = context.switchToHttp().getRequest();
+    const header = req?.headers?.authorization;
+    const value = Array.isArray(header) ? header[0] : header;
+    const match = typeof value === "string" ? /^Bearer\s+(.+)$/i.exec(value.trim()) : null;
+    if (match?.[1] !== void 0 && timingSafeEqual(sha256(match[1]), expected)) {
+      return {
+        allowed: true,
+        caller
+      };
+    }
+    return {
+      allowed: false,
+      reason: "unauthenticated"
+    };
+  };
+}
+__name(authorizeByToken, "authorizeByToken");
+function anyAuthorize(...forms) {
+  if (forms.length === 0) throw new Error("anyAuthorize: pass at least one authorize form.");
+  let AnyConsoleAuthorizer = class AnyConsoleAuthorizer {
+    static {
+      __name(this, "AnyConsoleAuthorizer");
+    }
+    moduleRef;
+    #decides;
+    constructor(moduleRef) {
+      this.moduleRef = moduleRef;
+    }
+    async authorize(context) {
+      this.#decides ??= Promise.all(forms.map((form) => resolveConsoleAuthorize(form, this.moduleRef, {
+        warnIfMissing: false
+      })));
+      this.#decides.catch(() => {
+        this.#decides = void 0;
+      });
+      let unauthenticated2;
+      for (const decide of await this.#decides) {
+        const decision = await decide(context);
+        if (decision.allowed) return decision;
+        if (decision.reason === "unauthenticated") unauthenticated2 ??= decision;
+      }
+      if (unauthenticated2 === void 0) return {
+        allowed: false,
+        reason: "forbidden"
+      };
+      return "redirectTo" in unauthenticated2 && unauthenticated2.redirectTo !== void 0 ? {
+        redirectTo: unauthenticated2.redirectTo
+      } : {
+        allowed: false,
+        reason: "unauthenticated"
+      };
+    }
+  };
+  Reflect.defineMetadata("design:paramtypes", [
+    ModuleRef
+  ], AnyConsoleAuthorizer);
+  return AnyConsoleAuthorizer;
+}
+__name(anyAuthorize, "anyAuthorize");
+
+// src/server/console-authorize.guard.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1078,6 +1314,161 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
+var DashboardConsoleAccess = class {
+  static {
+    __name(this, "DashboardConsoleAccess");
+  }
+  options;
+  moduleRef;
+  #decide;
+  constructor(options, moduleRef) {
+    this.options = options;
+    this.moduleRef = moduleRef;
+  }
+  #resolving;
+  /** Resolves `authorize` at boot: a configuration mistake fails the boot, and the warning logs once. */
+  async onModuleInit() {
+    this.#resolving ??= resolveConsoleAuthorize(this.options.authorize, this.moduleRef);
+    this.#decide = await this.#resolving;
+  }
+  /** The decision for one request. */
+  async check(context) {
+    if (this.#decide === void 0) await this.onModuleInit();
+    return this.#decide(context);
+  }
+};
+DashboardConsoleAccess = _ts_decorate3([
+  Injectable2(),
+  _ts_param3(0, Inject3(DASHBOARD_CONSOLE_OPTIONS)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleOptions === "undefined" ? Object : DashboardConsoleOptions,
+    typeof ModuleRef2 === "undefined" ? Object : ModuleRef2
+  ])
+], DashboardConsoleAccess);
+var CONSOLE_PAGE_METADATA = "@dudousxd/nestjs-agent-dashboard:console-page";
+var ConsolePage = /* @__PURE__ */ __name(() => SetMetadata(CONSOLE_PAGE_METADATA, true), "ConsolePage");
+var ConsoleAccessDenied = class extends HttpException {
+  static {
+    __name(this, "ConsoleAccessDenied");
+  }
+  decision;
+  page;
+  constructor(decision, page2) {
+    super(decision.reason === "forbidden" ? {
+      error: "forbidden"
+    } : {
+      error: "unauthenticated",
+      ...decision.redirectTo !== void 0 ? {
+        redirectTo: decision.redirectTo
+      } : {}
+    }, decision.reason === "forbidden" ? 403 : 401), this.decision = decision, this.page = page2;
+  }
+};
+function isPageNavigation(context) {
+  if (context.getType() !== "http") return false;
+  const page2 = Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getHandler()) === true || Reflect.getMetadata(CONSOLE_PAGE_METADATA, context.getClass()) === true;
+  if (!page2) return false;
+  const req = context.switchToHttp().getRequest();
+  if ((req.method ?? "GET").toUpperCase() !== "GET") return false;
+  const accept = req.headers?.accept;
+  const value = Array.isArray(accept) ? accept.join(",") : accept ?? "";
+  return value.includes("text/html");
+}
+__name(isPageNavigation, "isPageNavigation");
+var ConsoleAuthorizeGuard = class {
+  static {
+    __name(this, "ConsoleAuthorizeGuard");
+  }
+  access;
+  constructor(access) {
+    this.access = access;
+  }
+  async canActivate(context) {
+    const decision = await this.access.check(context);
+    if (decision.allowed) return true;
+    throw new ConsoleAccessDenied(decision, isPageNavigation(context));
+  }
+};
+ConsoleAuthorizeGuard = _ts_decorate3([
+  Injectable2(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DashboardConsoleAccess === "undefined" ? Object : DashboardConsoleAccess
+  ])
+], ConsoleAuthorizeGuard);
+function deniedPage(title, message) {
+  const body = "font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="${body}"><main style="text-align:center"><h1>${title}</h1><p>${message}</p></main></body></html>`;
+}
+__name(deniedPage, "deniedPage");
+var FORBIDDEN_PAGE = deniedPage("Access denied", "You do not have access to this console.");
+var UNAUTHENTICATED_PAGE = deniedPage("Sign in required", "Sign in to open this console.");
+var ConsoleAuthorizeFilter = class {
+  static {
+    __name(this, "ConsoleAuthorizeFilter");
+  }
+  adapterHost;
+  constructor(adapterHost) {
+    this.adapterHost = adapterHost;
+  }
+  catch(exception, host) {
+    const adapter = this.adapterHost.httpAdapter;
+    const res = host.switchToHttp().getResponse();
+    const { decision, page: page2 } = exception;
+    if (page2 && decision.reason === "unauthenticated" && decision.redirectTo !== void 0) {
+      adapter.redirect(res, 302, decision.redirectTo);
+      return;
+    }
+    if (page2) {
+      const forbidden2 = decision.reason === "forbidden";
+      adapter.setHeader(res, "Content-Type", "text/html; charset=utf-8");
+      adapter.reply(res, forbidden2 ? FORBIDDEN_PAGE : UNAUTHENTICATED_PAGE, forbidden2 ? 403 : 401);
+      return;
+    }
+    adapter.reply(res, exception.getResponse(), exception.getStatus());
+  }
+};
+ConsoleAuthorizeFilter = _ts_decorate3([
+  Catch(ConsoleAccessDenied),
+  Injectable2(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof HttpAdapterHost === "undefined" ? Object : HttpAdapterHost
+  ])
+], ConsoleAuthorizeFilter);
+function UseConsoleAuthorize() {
+  return applyDecorators(UseGuards(ConsoleAuthorizeGuard), UseFilters(ConsoleAuthorizeFilter));
+}
+__name(UseConsoleAuthorize, "UseConsoleAuthorize");
+
+// src/server/agent-ui.controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return fileURLToPath(new URL("../spa", import.meta.url));
@@ -1133,45 +1524,452 @@ var AgentUiController = class {
     });
   }
 };
-_ts_decorate3([
+_ts_decorate4([
   Get2(),
+  ConsolePage(),
   Header("Content-Type", "text/html; charset=utf-8"),
   Header("Cache-Control", "no-store, must-revalidate"),
-  _ts_param3(0, Req2()),
-  _ts_param3(1, Res({
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
     passthrough: true
   })),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata4("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate3([
+_ts_decorate4([
   Get2("assets/:file"),
   Header("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, Param2("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param4(0, Param2("file")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata4("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate3([
+AgentUiController = _ts_decorate4([
   CanAnyone2(),
   Controller2(),
-  _ts_param3(0, Inject3(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, Inject3(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_param4(0, Inject4(DASHBOARD_BASE_PATH)),
+  _ts_param4(1, Inject4(DASHBOARD_API_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
+// src/server/dev-tools.ts
+import { Inject as Inject5, Injectable as Injectable3, Logger as Logger2, NotFoundException as NotFoundException3 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+    r = Reflect.decorate(decorators, target, key, desc);
+  } else {
+    for (var i = decorators.length - 1; i >= 0; i--) {
+      if (d = decorators[i]) {
+        r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      }
+    }
+  }
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(metadataKey, metadataValue) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+    return Reflect.metadata(metadataKey, metadataValue);
+  }
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var DEV_TOOLS_SLOT = /* @__PURE__ */ Symbol.for("@dudousxd/aviary:dev-tools");
+function devToolsSlot() {
+  const holder = globalThis;
+  const existing = holder[DEV_TOOLS_SLOT];
+  if (existing !== void 0) return existing;
+  const libs = [];
+  const slot = {
+    version: 1,
+    libs,
+    register(lib) {
+      if (libs.some((entry) => entry.lib === lib.lib)) {
+        throw new Error(`dev tools: the lib "${lib.lib}" is already registered`);
+      }
+      libs.push(lib);
+      return () => {
+        const index = libs.indexOf(lib);
+        if (index !== -1) libs.splice(index, 1);
+      };
+    }
+  };
+  holder[DEV_TOOLS_SLOT] = slot;
+  return slot;
+}
+__name(devToolsSlot, "devToolsSlot");
+var DEFAULT_LIMIT = 20;
+var MAX_LIMIT = 100;
+var MESSAGE_LIMIT = 50;
+var MESSAGE_BYTES = 2 * 1024;
+var DAY_MS2 = 864e5;
+var ISO_DAY3 = /^\d{4}-\d{2}-\d{2}$/;
+var day = {
+  type: "string",
+  description: "UTC day, YYYY-MM-DD."
+};
+var page = {
+  type: "integer",
+  description: "Page, from 1. Pass the `next` of the previous page.",
+  minimum: 1
+};
+var limit = {
+  type: "integer",
+  description: `Rows per page (default ${DEFAULT_LIMIT}, max ${MAX_LIMIT}).`,
+  minimum: 1,
+  maximum: MAX_LIMIT
+};
+var str = /* @__PURE__ */ __name((value) => typeof value === "string" && value !== "" ? value : void 0, "str");
+function dayOf(input, key) {
+  const value = str(input[key]);
+  if (value !== void 0 && !ISO_DAY3.test(value)) throw new Error(`"${key}" must be YYYY-MM-DD`);
+  return value;
+}
+__name(dayOf, "dayOf");
+function rangeOf(input) {
+  const utcDay2 = /* @__PURE__ */ __name((daysAgo) => new Date(Date.now() - daysAgo * DAY_MS2).toISOString().slice(0, 10), "utcDay");
+  return {
+    fromDay: dayOf(input, "from") ?? utcDay2(29),
+    toDay: dayOf(input, "to") ?? utcDay2(0)
+  };
+}
+__name(rangeOf, "rangeOf");
+function pageOf(input) {
+  return {
+    page: typeof input.page === "number" ? input.page : 1,
+    pageSize: typeof input.limit === "number" ? input.limit : DEFAULT_LIMIT
+  };
+}
+__name(pageOf, "pageOf");
+function where(fields) {
+  const set = Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0));
+  return Object.keys(set).length > 0 ? {
+    where: set
+  } : {};
+}
+__name(where, "where");
+function listOf(result) {
+  return {
+    items: result.rows,
+    next: result.page * result.pageSize < result.total ? result.page + 1 : null,
+    total: result.total
+  };
+}
+__name(listOf, "listOf");
+function cut(text, maxBytes) {
+  const size = Buffer.byteLength(text, "utf8");
+  if (size <= maxBytes) return text;
+  const suffix = `\u2026(truncated, ${size} bytes)`;
+  const keep = Math.max(0, maxBytes - Buffer.byteLength(suffix, "utf8"));
+  let head = Buffer.from(text, "utf8").subarray(0, keep).toString("utf8");
+  if (head.endsWith("\uFFFD")) head = head.slice(0, -1);
+  return `${head}${suffix}`;
+}
+__name(cut, "cut");
+function agentDevTools(dashboard) {
+  return [
+    {
+      name: "agent_list_runs",
+      kind: "read",
+      description: "Agent runs, newest first: agent, actor, status, duration, cost, error. Filters: agent, status, errorCode, threadId, from/to (UTC days). Returns { items, next, total }; pass next as page.",
+      input: {
+        type: "object",
+        properties: {
+          agent: {
+            type: "string",
+            description: "Agent name."
+          },
+          status: {
+            type: "string",
+            enum: [
+              "running",
+              "completed",
+              "failed",
+              "cancelled"
+            ]
+          },
+          errorCode: {
+            type: "string"
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.runsPage({
+          ...pageOf(input),
+          ...where({
+            agentName: str(input.agent),
+            status: str(input.status),
+            errorCode: str(input.errorCode),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    },
+    {
+      name: "agent_get_run",
+      kind: "read",
+      description: "One run: the run, its thread, its tool calls and timings. With includeMessages: true, the thread's latest 50 messages, each cut to 2 KB. An error when no run has that id.",
+      input: {
+        type: "object",
+        properties: {
+          id: {
+            type: "string",
+            description: "Run id."
+          },
+          includeMessages: {
+            type: "boolean",
+            description: "Include messages (default false)."
+          }
+        },
+        required: [
+          "id"
+        ]
+      },
+      async run(input) {
+        let detail;
+        try {
+          detail = await dashboard.runDetail(String(input.id));
+        } catch (error) {
+          if (error instanceof NotFoundException3) throw new Error(`run ${String(input.id)} not found`);
+          throw error;
+        }
+        if (input.includeMessages !== true) return detail;
+        const thread = await dashboard.threadDetail({
+          threadId: detail.run.threadId,
+          messageLimit: MESSAGE_LIMIT,
+          runLimit: 1
+        });
+        return {
+          ...detail,
+          messages: thread.messages.map((message) => ({
+            ...message,
+            content: cut(message.content, MESSAGE_BYTES)
+          }))
+        };
+      }
+    },
+    {
+      name: "agent_get_spend",
+      kind: "read",
+      description: "Tokens and cost over UTC days from/to (default the last 30 days): by model, by actor, by feature and the daily trend. `by` returns one of them.",
+      input: {
+        type: "object",
+        properties: {
+          by: {
+            type: "string",
+            enum: [
+              "model",
+              "actor",
+              "feature"
+            ]
+          },
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        const spend = await dashboard.spend(rangeOf(input));
+        switch (input.by) {
+          case "model":
+            return {
+              items: spend.byModel
+            };
+          case "actor":
+            return {
+              items: spend.byActor
+            };
+          case "feature":
+            return {
+              items: spend.byFeature ?? []
+            };
+          default:
+            return spend;
+        }
+      }
+    },
+    {
+      name: "agent_get_tool_stats",
+      kind: "read",
+      description: "Per tool: calls, failures, rejections and latency, over UTC days from/to (default the last 30 days).",
+      input: {
+        type: "object",
+        properties: {
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        return {
+          items: await dashboard.toolStats(rangeOf(input))
+        };
+      }
+    },
+    {
+      name: "agent_get_reliability",
+      kind: "read",
+      description: "Run metrics, by-agent and by-error breakdowns and the trend, over UTC days from/to (default the last 30 days).",
+      input: {
+        type: "object",
+        properties: {
+          from: day,
+          to: day
+        }
+      },
+      async run(input) {
+        return dashboard.reliability(rangeOf(input));
+      }
+    },
+    {
+      name: "agent_list_pending_approvals",
+      kind: "read",
+      description: "Tool calls waiting for a human approval, oldest first. Read-only: approve them in the app. Returns { items, next, total }.",
+      input: {
+        type: "object",
+        properties: {
+          toolName: {
+            type: "string"
+          },
+          agent: {
+            type: "string",
+            description: "Agent name."
+          },
+          actor: {
+            type: "string",
+            description: "Actor ref of the thread owner."
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.approvalsPage({
+          ...pageOf(input),
+          ...where({
+            toolName: str(input.toolName),
+            agentName: str(input.agent),
+            actorRef: str(input.actor),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    },
+    {
+      name: "agent_list_recent_tool_calls",
+      kind: "read",
+      description: "Tool calls of every agent, newest first. Filters: toolName, status, threadId, from/to (UTC days). Returns { items, next, total }.",
+      input: {
+        type: "object",
+        properties: {
+          toolName: {
+            type: "string"
+          },
+          status: {
+            type: "string"
+          },
+          threadId: {
+            type: "string"
+          },
+          from: day,
+          to: day,
+          page,
+          limit
+        }
+      },
+      async run(input) {
+        return listOf(await dashboard.toolCallsPage({
+          ...pageOf(input),
+          ...where({
+            toolName: str(input.toolName),
+            status: str(input.status),
+            threadId: str(input.threadId),
+            fromDay: dayOf(input, "from"),
+            toDay: dayOf(input, "to")
+          })
+        }));
+      }
+    }
+  ];
+}
+__name(agentDevTools, "agentDevTools");
+var logger2 = new Logger2("AgentDashboardModule");
+var AgentDevToolsRegistration = class {
+  static {
+    __name(this, "AgentDevToolsRegistration");
+  }
+  enabled;
+  dashboard;
+  access;
+  #unregister;
+  constructor(enabled, dashboard, access) {
+    this.enabled = enabled;
+    this.dashboard = dashboard;
+    this.access = access;
+  }
+  onModuleInit() {
+    if (!this.enabled) return;
+    const slot = devToolsSlot();
+    if (slot.version !== 1 || typeof slot.register !== "function") return;
+    try {
+      this.#unregister = slot.register({
+        lib: "agent",
+        title: "Agent governance",
+        authorize: /* @__PURE__ */ __name((context) => this.access.check(context), "authorize"),
+        tools: agentDevTools(this.dashboard)
+      });
+    } catch (error) {
+      logger2.warn(`agent dev tools not registered: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  onModuleDestroy() {
+    this.#unregister?.();
+    this.#unregister = void 0;
+  }
+};
+AgentDevToolsRegistration = _ts_decorate5([
+  Injectable3(),
+  _ts_param5(0, Inject5(DASHBOARD_DEV_TOOLS)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    Boolean,
+    typeof DashboardService === "undefined" ? Object : DashboardService,
+    typeof DashboardConsoleAccess === "undefined" ? Object : DashboardConsoleAccess
+  ])
+], AgentDevToolsRegistration);
+
 // src/server/agent-dashboard.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
     r = Reflect.decorate(decorators, target, key, desc);
@@ -1184,23 +1982,29 @@ function _ts_decorate4(decorators, target, key, desc) {
   }
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
-function assertProtected(options) {
-  if (process.env.NODE_ENV !== "production") return;
-  if (options.routes === false) return;
-  if ((options.decorators ?? []).length > 0) return;
-  throw new Error("AgentDashboardModule: the AI-gateway console would be served open in production. Say who reaches it, with `decorators: [UseGuards(AuthenticationGuard), Can(ConsolePolicy, 'view')]`, or mount its routes yourself with `routes: false` and extend `AgentApiController` / `AgentUiController` under your own guards.");
+function consoleDecorators(decorators) {
+  return [
+    ...decorators ?? [],
+    UseGuards2(ConsoleAuthorizeGuard),
+    UseFilters2(ConsoleAuthorizeFilter)
+  ];
 }
-__name(assertProtected, "assertProtected");
+__name(consoleDecorators, "consoleDecorators");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
+    const consoleOptions = {
+      ...options.authorize !== void 0 ? {
+        authorize: options.authorize
+      } : {}
+    };
     return {
       module: _AgentApiModule,
       imports: [
@@ -1208,7 +2012,7 @@ var AgentApiModule = class _AgentApiModule {
       ],
       controllers: options.routes === false ? [] : withControllerDecorators([
         AgentApiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         DashboardService,
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
@@ -1216,17 +2020,29 @@ var AgentApiModule = class _AgentApiModule {
         {
           provide: DASHBOARD_APPROVAL_ACTOR_REF,
           useValue: options.approvalActorRef
-        }
+        },
+        {
+          provide: DASHBOARD_CONSOLE_OPTIONS,
+          useValue: consoleOptions
+        },
+        DashboardConsoleAccess,
+        {
+          provide: DASHBOARD_DEV_TOOLS,
+          useValue: options.devTools ?? options.routes !== false
+        },
+        AgentDevToolsRegistration
       ],
-      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`).
+      // What a self-mounted `AgentApiController` subclass injects, too (`routes: false`), and the
+      // access check `UseConsoleAuthorize()` runs.
       exports: [
         DashboardService,
-        DASHBOARD_APPROVAL_ACTOR_REF
+        DASHBOARD_APPROVAL_ACTOR_REF,
+        DashboardConsoleAccess
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate4([
+AgentApiModule = _ts_decorate6([
   Module({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
@@ -1234,7 +2050,6 @@ var AgentDashboardModule = class _AgentDashboardModule {
     __name(this, "AgentDashboardModule");
   }
   static forRoot(options = {}) {
-    assertProtected(options);
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
     return {
@@ -1254,6 +2069,12 @@ var AgentDashboardModule = class _AgentDashboardModule {
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
+          } : {},
+          ...options.authorize !== void 0 ? {
+            authorize: options.authorize
+          } : {},
+          ...options.devTools !== void 0 ? {
+            devTools: options.devTools
           } : {}
         }),
         ...options.routes === false ? [] : [
@@ -1271,7 +2092,7 @@ var AgentDashboardModule = class _AgentDashboardModule {
       ],
       controllers: options.routes === false ? [] : withControllerDecorators([
         AgentUiController
-      ], options.decorators),
+      ], consoleDecorators(options.decorators)),
       providers: [
         {
           provide: DASHBOARD_BASE_PATH,
@@ -1292,7 +2113,7 @@ var AgentDashboardModule = class _AgentDashboardModule {
     };
   }
 };
-AgentDashboardModule = _ts_decorate4([
+AgentDashboardModule = _ts_decorate6([
   Module({})
 ], AgentDashboardModule);
 export {
@@ -1304,12 +2125,29 @@ export {
   AgentApiController,
   AgentApiModule,
   AgentDashboardModule,
+  AgentDevToolsRegistration,
   AgentUiController,
+  CONSOLE_AUTHORIZE_MISSING_WARNING,
+  CONSOLE_GATE,
+  CONSOLE_PAGE_METADATA,
+  ConsoleAccessDenied,
+  ConsoleAuthorizeFilter,
+  ConsoleAuthorizeGuard,
+  ConsolePage,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
   DASHBOARD_BASE_PATH,
+  DASHBOARD_CONSOLE_OPTIONS,
+  DASHBOARD_DEV_TOOLS,
+  DashboardConsoleAccess,
   DashboardService,
+  UseConsoleAuthorize,
   agentDashboardMountPaths,
-  parsePriceInput
+  agentDevTools,
+  anyAuthorize,
+  authorizeByToken,
+  normalizeConsoleResult,
+  parsePriceInput,
+  resolveConsoleAuthorize
 };
 //# sourceMappingURL=index.js.map