@dudousxd/nestjs-agent-dashboard 0.6.0 → 0.8.0

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, PendingApprovalRow, ToolStatRow, ThreadActivityRow, CurrentModelPrice, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
+import { ActorSpendRow, AgentGovernanceQueries, ActorDirectory, AgentPricingStore, AgentApprovalPort, GovernanceRange, ModelSpendRow, UsageTrendPoint, ThreadSpendRow, RunMetrics, RunAgentBreakdownRow, RunErrorBreakdownRow, RunTrendPoint, RecentRunRow, ToolCallActivityRow, GovernancePageQuery, ToolCallWhere, GovernancePage, RunWhere, PendingApprovalRow, ToolStatRow, ThreadActivityRow, ThreadWhere, CurrentModelPrice, ActorResolver, ModelPriceInput } from '@dudousxd/nestjs-agent-core';
 export { ActorDirectory } from '@dudousxd/nestjs-agent-core';
 import { Observable } from 'rxjs';
 import { DynamicModule, Type, CanActivate, StreamableFile } from '@nestjs/common';
@@ -61,6 +61,10 @@ declare class DashboardService {
     recentRuns(limit: number): Promise<RecentRunRow[]>;
     /** Most recent tool calls (status/type/thread) for the Runs & tools activity feed. */
     recentToolCalls(limit: number): Promise<ToolCallActivityRow[]>;
+    /** Paged, filterable tool calls for the Runs & tools activity table. */
+    toolCallsPage(query: GovernancePageQuery<ToolCallWhere>): Promise<GovernancePage<ToolCallActivityRow>>;
+    /** Paged, filterable runs for the Reliability recent-runs table. */
+    runsPage(query: GovernancePageQuery<RunWhere>): Promise<GovernancePage<RecentRunRow>>;
     /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
     pendingApprovals(limit: number): Promise<PendingApprovalRow[]>;
     /** Per-tool call/failure/rejection/latency rollup for a day range, for the Tools section. */
@@ -76,6 +80,11 @@ declare class DashboardService {
     decideApproval(toolCallId: string, body: unknown, executedByRef: string | undefined): Promise<void>;
     /** Most recent threads with rolled-up message/token counts. */
     recentThreads(limit: number): Promise<ThreadActivityRowWithLabel[]>;
+    /**
+     * Paged, filterable threads for the Runs & tools threads table — actor-labeled the same way
+     * {@link recentThreads} is.
+     */
+    threadsPage(query: GovernancePageQuery<ThreadWhere>): Promise<GovernancePage<ThreadActivityRowWithLabel>>;
     /**
      * Decorate actor-scoped rows with `actorLabel`, batching the distinct `actorRef`s into ONE
      * {@link ActorDirectory.resolveDisplay} call per response. `null` for every row when no directory
@@ -107,7 +116,8 @@ declare class DashboardService {
 declare class AgentApiController {
     private readonly dashboard;
     private readonly approvalActorRef;
-    constructor(dashboard: DashboardService, approvalActorRef: ((req: unknown) => string | undefined) | undefined);
+    private readonly actorResolver?;
+    constructor(dashboard: DashboardService, approvalActorRef: ((req: unknown) => string | undefined) | undefined, actorResolver?: ActorResolver | undefined);
     /** `{ byModel, byActor, trend }` for a day range (defaults to the last 30 days). */
     spend(from?: string, to?: string): Promise<SpendOverview>;
     /** Top threads by cost (default 10, max 200) for a day range (defaults to the last 30 days). */
@@ -116,20 +126,46 @@ declare class AgentApiController {
     reliability(from?: string, to?: string): Promise<ReliabilityOverview>;
     /** Most recent runs (default 50, max 200) for the Reliability recent-runs table. */
     runs(limit?: string): Promise<RecentRunRow[]>;
+    /**
+     * Paged, filterable runs for the Reliability recent-runs table. `page` (default 1), `limit`
+     * (default 25, max 200), and `where[agentName]`/`where[status]`/`where[errorCode]`/
+     * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+     */
+    runsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<RecentRunRow>>;
     /** Most recent tool calls (default 50, max 200) for the activity feed. */
     toolCalls(limit?: string): Promise<ToolCallActivityRow[]>;
+    /**
+     * Paged, filterable tool calls for the Runs & tools activity table. `page` (default 1), `limit`
+     * (default 25, max 200), and `where[toolName]`/`where[toolType]`/`where[status]`/`where[threadId]`/
+     * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+     */
+    toolCallsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ToolCallActivityRow>>;
     /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
     approvals(limit?: string): Promise<PendingApprovalRow[]>;
     /**
      * Decide a pending HITL tool call. Body `{ approved: boolean; reason?: string }`. 501s (via
      * `DashboardService.decideApproval`) when no `AGENT_APPROVAL_PORT` is bound. `executedByRef`
-     * comes from the host's `approvalActorRef` extractor run against the live request, when configured.
+     * comes from {@link deciderRef} run against the live request.
      */
     decideApproval(toolCallId: string, body: unknown, req: unknown): Promise<void>;
+    /**
+     * WHO decided, as an opaque ref: an explicit `approvalActorRef` override wins outright (no
+     * resolver fallback, even when it returns `undefined`); otherwise the AgentModule-configured
+     * actor resolver — the same identity seam chat requests use. A resolver that throws is an
+     * unauthenticated/unreadable request, not an error to surface: the decision itself was already
+     * authorized by the dashboard's guards, so the ref is simply omitted.
+     */
+    private deciderRef;
     /** Per-tool call/failure/rejection/latency rollup for a day range (defaults to the last 30 days). */
     tools(from?: string, to?: string): Promise<ToolStatRow[]>;
     /** Most recent threads (default 50, max 200) with rolled-up counts. */
     threads(limit?: string): Promise<ThreadActivityRowWithLabel[]>;
+    /**
+     * Paged, filterable threads for the Runs & tools threads table. `page` (default 1), `limit`
+     * (default 25, max 200), and `where[actorRef]`/`where[title]` (case-insensitive substring)/
+     * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+     */
+    threadsPage(page?: string, limit?: string, where?: Record<string, string>): Promise<GovernancePage<ThreadActivityRowWithLabel>>;
     /**
      * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
      * no `AGENT_PRICING_STORE` is bound.
@@ -178,7 +214,13 @@ interface AgentDashboardMountPathsOptions {
  */
 declare function agentDashboardMountPaths(options?: AgentDashboardMountPathsOptions): string[];
 
-interface AgentDashboardOptions {
+/**
+ * `TReq` mirrors core's `ActorResolver<TReq>` convention: the transport request type
+ * {@link AgentDashboardOptions.approvalActorRef} receives. Defaults to `unknown` so untyped usage
+ * compiles unchanged; a host may narrow it (e.g. `forRoot<Request>({ approvalActorRef: ... })`)
+ * instead of writing its own `unknown`-narrowing type guard.
+ */
+interface AgentDashboardOptions<TReq = unknown> {
     /**
      * Where the SPA (UI) is served. Default `/ai-gateway`. This is a page route — keep it out of an
      * `/api` prefix so it reads as a UI, not an endpoint.
@@ -208,13 +250,17 @@ interface AgentDashboardOptions {
      */
     imports?: DynamicModule['imports'];
     /**
-     * Extracts WHO is deciding a HITL approval from the live request — invoked on the incoming
+     * OVERRIDE for WHO is deciding a HITL approval — invoked on the incoming
      * `POST <api>/approvals/:toolCallId` request to stamp `AgentApprovalPort`'s `opts.executedByRef`.
-     * Typically pulls the authenticated principal your own auth guard/middleware already attached to
-     * the request (e.g. `(req) => (req as { user?: { id: string } }).user?.id`). Omit to leave
-     * `executedByRef` unset — the decision still goes through, just without a recorded decider ref.
+     *
+     * DEFAULT (option omitted): the AgentModule-configured actor resolver (`AGENT_ACTOR_RESOLVER`) is
+     * consulted — the same identity seam chat requests use — and its actor id becomes the decider ref
+     * (a throwing resolver, i.e. an unauthenticated request, just omits the ref). Set this only when
+     * console auth differs from chat auth (e.g. the console sits behind a separate SSO whose principal
+     * the chat resolver can't read); returning `undefined` leaves `executedByRef` unset — the explicit
+     * override wins outright, with no resolver fallback.
      */
-    approvalActorRef?: (req: unknown) => string | undefined;
+    approvalActorRef?: (req: TReq) => string | undefined;
 }
 /**
  * Holds the JSON API + SSE controller and its read service, mounted on its own path by `forRoot`.
@@ -225,10 +271,10 @@ interface AgentDashboardOptions {
  * the right `imports` to `forRoot`.
  */
 declare class AgentApiModule {
-    static register(options: {
+    static register<TReq = unknown>(options: {
         imports?: DynamicModule['imports'];
         guards?: Type<CanActivate>[];
-        approvalActorRef?: (req: unknown) => string | undefined;
+        approvalActorRef?: (req: TReq) => string | undefined;
     }): DynamicModule;
 }
 /**
@@ -239,11 +285,31 @@ declare class AgentApiModule {
  * (global), which must provide `AGENT_GOVERNANCE_QUERIES` (bound by a store adapter). Front the
  * routes with the first-class `guards` option (plus `imports` for the guards' own dependencies) —
  * see {@link AgentDashboardOptions.guards}.
+ *
+ * Inertia hosts: the console is a full-page app, not an Inertia page. An in-app `<Link>` visit to
+ * `basePath` (an XHR carrying `X-Inertia`) is bounced with the protocol's own external-redirect
+ * mechanism — `409 Conflict` + `X-Inertia-Location: <the visited URL>` — so the Inertia client
+ * performs a full `window.location` load and the console renders normally. In-app links to the
+ * console therefore just work; no host-side special-casing needed.
  */
 declare class AgentDashboardModule {
-    static forRoot(options?: AgentDashboardOptions): DynamicModule;
+    static forRoot<TReq = unknown>(options?: AgentDashboardOptions<TReq>): DynamicModule;
 }
 
+/**
+ * The slice of the express request the Inertia bounce below reads — structural, so the package
+ * needs no express dependency (the API controller similarly takes `@Req() req: unknown`).
+ */
+interface UiPageRequest {
+    headers: Record<string, string | string[] | undefined>;
+    /** Path + query as received (express `originalUrl`) — what the full-page visit must reload. */
+    originalUrl: string;
+}
+/** The slice of the express response the Inertia bounce writes (passthrough mode — Nest still sends). */
+interface UiPageResponse {
+    status(code: number): unknown;
+    setHeader(name: string, value: string): unknown;
+}
 /**
  * Serves the bundled AI-gateway console SPA at the configured base (+ hashed assets at
  * `<base>/assets`). The path comes from `RouterModule` (set by
@@ -254,7 +320,7 @@ declare class AgentUiController {
     private readonly apiBasePath;
     private readonly dir;
     constructor(basePath: string, apiBasePath: string);
-    index(): string;
+    index(req: UiPageRequest, res: UiPageResponse): string;
     asset(file: string): StreamableFile;
 }
 
@@ -301,16 +367,26 @@ declare const AGENT_PRICING_STORE: unique symbol;
  * absent, `POST <api>/approvals/:toolCallId` 501s and the approvals inbox renders read-only.
  */
 declare const AGENT_APPROVAL_PORT: unique symbol;
+/**
+ * The app's request-identity seam (`ActorResolver`), owned by `@dudousxd/nestjs-agent-core` and
+ * bound + exported by the (global) `AgentModule` from the host's `actorResolver` option. Re-declared
+ * here BY VALUE for the same reason as {@link AGENT_GOVERNANCE_QUERIES} above. Optional: the default
+ * decider attribution for `POST <api>/approvals/:toolCallId` — absent (or throwing, i.e.
+ * unauthenticated), `executedByRef` is simply omitted.
+ */
+declare const AGENT_ACTOR_RESOLVER: unique symbol;
 /** DI token carrying the UI mount base (e.g. `/ai-gateway`). */
 declare const DASHBOARD_BASE_PATH: unique symbol;
 /** DI token carrying the JSON API base the SPA fetches from (e.g. `/ai-gateway/api`). */
 declare const DASHBOARD_API_PATH: unique symbol;
 /**
  * DI token carrying the host-provided {@link AgentDashboardOptions.approvalActorRef} extractor (or
- * `undefined` when the host didn't set one). Threaded to `AgentApiModule` (where the API controller
- * actually lives) same as the pattern above — `useValue` even when `undefined`, so injecting it
- * needs no `@Optional()` (mirrors `AGENT_QUOTA_STORE`'s factory in `@dudousxd/nestjs-agent`).
+ * `undefined` when the host didn't set one — the controller then falls back to
+ * {@link AGENT_ACTOR_RESOLVER} for decider attribution). Threaded to `AgentApiModule` (where the API
+ * controller actually lives) same as the pattern above — `useValue` even when `undefined`, so
+ * injecting it needs no `@Optional()` (mirrors `AGENT_QUOTA_STORE`'s factory in
+ * `@dudousxd/nestjs-agent`).
  */
 declare const DASHBOARD_APPROVAL_ACTOR_REF: unique symbol;
 
-export { AGENT_ACTOR_DIRECTORY, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_BASE_PATH, DashboardService, type LiveAgentEvent, type ReliabilityOverview, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadSpendRowWithLabel, type WithActorLabel, agentDashboardMountPaths, parsePriceInput };
+export { AGENT_ACTOR_DIRECTORY, AGENT_ACTOR_RESOLVER, AGENT_APPROVAL_PORT, AGENT_GOVERNANCE_QUERIES, AGENT_PRICING_STORE, type ActorSpendRowWithLabel, AgentApiController, AgentApiModule, AgentDashboardModule, type AgentDashboardMountPathsOptions, type AgentDashboardOptions, AgentUiController, DASHBOARD_API_PATH, DASHBOARD_APPROVAL_ACTOR_REF, DASHBOARD_BASE_PATH, DashboardService, type LiveAgentEvent, type ReliabilityOverview, type SpendOverview, type ThreadActivityRowWithLabel, type ThreadSpendRowWithLabel, type WithActorLabel, agentDashboardMountPaths, parsePriceInput };

package/dist/server/index.js

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/server/agent-api.controller.ts
-import { Body, Controller, Get, HttpCode, Inject as Inject2, Param, Post, Query, Req, Sse } from "@nestjs/common";
+import { Body, Controller, Get, HttpCode, Inject as Inject2, Optional as Optional2, Param, Post, Query, Req, Sse } from "@nestjs/common";
 
 // src/server/dashboard.service.ts
 import { subscribe, unsubscribe } from "node:diagnostics_channel";
@@ -77,6 +77,7 @@ var AGENT_GOVERNANCE_QUERIES = Symbol.for("@dudousxd/nestjs-agent:governance-que
 var AGENT_ACTOR_DIRECTORY = Symbol.for("@dudousxd/nestjs-agent:actor-directory");
 var AGENT_PRICING_STORE = Symbol.for("@dudousxd/nestjs-agent:pricing-store");
 var AGENT_APPROVAL_PORT = Symbol.for("@dudousxd/nestjs-agent:approval-port");
+var AGENT_ACTOR_RESOLVER = Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
 var DASHBOARD_BASE_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
 var DASHBOARD_API_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
 var DASHBOARD_APPROVAL_ACTOR_REF = Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
@@ -169,6 +170,14 @@ var DashboardService = class {
   recentToolCalls(limit) {
     return this.queries.recentToolCalls(limit);
   }
+  /** Paged, filterable tool calls for the Runs & tools activity table. */
+  toolCallsPage(query) {
+    return this.queries.toolCallsPage(query);
+  }
+  /** Paged, filterable runs for the Reliability recent-runs table. */
+  runsPage(query) {
+    return this.queries.runsPage(query);
+  }
   /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
   pendingApprovals(limit) {
     return this.queries.pendingApprovals(limit);
@@ -210,6 +219,18 @@ var DashboardService = class {
     return this.withActorLabels(rows);
   }
   /**
+  * Paged, filterable threads for the Runs & tools threads table — actor-labeled the same way
+  * {@link recentThreads} is.
+  */
+  async threadsPage(query) {
+    const page = await this.queries.threadsPage(query);
+    const rows = await this.withActorLabels(page.rows);
+    return {
+      ...page,
+      rows
+    };
+  }
+  /**
   * Decorate actor-scoped rows with `actorLabel`, batching the distinct `actorRef`s into ONE
   * {@link ActorDirectory.resolveDisplay} call per response. `null` for every row when no directory
   * is bound, or for a ref the directory didn't resolve.
@@ -300,6 +321,127 @@ DashboardService = _ts_decorate([
   ])
 ], DashboardService);
 
+// src/server/parse-page-query.ts
+import { BadRequestException as BadRequestException3 } from "@nestjs/common";
+var ISO_DAY = /^\d{4}-\d{2}-\d{2}$/;
+function parsePageNumber(value) {
+  const parsed = value === void 0 ? Number.NaN : Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed < 1) return 1;
+  return parsed;
+}
+__name(parsePageNumber, "parsePageNumber");
+function assertKnownFields(raw, allowed) {
+  for (const field of Object.keys(raw)) {
+    if (!allowed.includes(field)) {
+      throw new BadRequestException3(`Unknown where field "${field}".`);
+    }
+  }
+}
+__name(assertKnownFields, "assertKnownFields");
+function assertDayFields(raw, dayFields) {
+  for (const field of dayFields) {
+    const value = raw[field];
+    if (value !== void 0 && !ISO_DAY.test(value)) {
+      throw new BadRequestException3(`"where[${field}]" must be YYYY-MM-DD.`);
+    }
+  }
+}
+__name(assertDayFields, "assertDayFields");
+var DAY_FIELDS = [
+  "fromDay",
+  "toDay"
+];
+var TOOL_CALL_WHERE_FIELDS = [
+  "toolName",
+  "toolType",
+  "status",
+  "threadId",
+  "fromDay",
+  "toDay"
+];
+function parseToolCallWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, TOOL_CALL_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.toolName !== void 0 ? {
+      toolName: raw.toolName
+    } : {},
+    ...raw.toolType !== void 0 ? {
+      toolType: raw.toolType
+    } : {},
+    ...raw.status !== void 0 ? {
+      status: raw.status
+    } : {},
+    ...raw.threadId !== void 0 ? {
+      threadId: raw.threadId
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseToolCallWhere, "parseToolCallWhere");
+var THREAD_WHERE_FIELDS = [
+  "actorRef",
+  "title",
+  "fromDay",
+  "toDay"
+];
+function parseThreadWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, THREAD_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.actorRef !== void 0 ? {
+      actorRef: raw.actorRef
+    } : {},
+    ...raw.title !== void 0 ? {
+      title: raw.title
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseThreadWhere, "parseThreadWhere");
+var RUN_WHERE_FIELDS = [
+  "agentName",
+  "status",
+  "errorCode",
+  "fromDay",
+  "toDay"
+];
+function parseRunWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, RUN_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.agentName !== void 0 ? {
+      agentName: raw.agentName
+    } : {},
+    ...raw.status !== void 0 ? {
+      status: raw.status
+    } : {},
+    ...raw.errorCode !== void 0 ? {
+      errorCode: raw.errorCode
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseRunWhere, "parseRunWhere");
+
 // src/server/agent-api.controller.ts
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -319,13 +461,13 @@ function _ts_param2(paramIndex, decorator) {
 }
 __name(_ts_param2, "_ts_param");
 var DAY_MS = 864e5;
-var ISO_DAY = /^\d{4}-\d{2}-\d{2}$/;
+var ISO_DAY2 = /^\d{4}-\d{2}-\d{2}$/;
 function utcDay(daysAgo) {
   return new Date(Date.now() - daysAgo * DAY_MS).toISOString().slice(0, 10);
 }
 __name(utcDay, "utcDay");
 function dayOr(value, fallback) {
-  return value !== void 0 && ISO_DAY.test(value) ? value : fallback;
+  return value !== void 0 && ISO_DAY2.test(value) ? value : fallback;
 }
 __name(dayOr, "dayOr");
 function resolveRange(from, to) {
@@ -347,9 +489,11 @@ var AgentApiController = class {
   }
   dashboard;
   approvalActorRef;
-  constructor(dashboard, approvalActorRef) {
+  actorResolver;
+  constructor(dashboard, approvalActorRef, actorResolver) {
     this.dashboard = dashboard;
     this.approvalActorRef = approvalActorRef;
+    this.actorResolver = actorResolver;
   }
   /** `{ byModel, byActor, trend }` for a day range (defaults to the last 30 days). */
   spend(from, to) {
@@ -367,10 +511,40 @@ var AgentApiController = class {
   runs(limit) {
     return this.dashboard.recentRuns(parseLimit(limit, 50));
   }
+  /**
+  * Paged, filterable runs for the Reliability recent-runs table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[agentName]`/`where[status]`/`where[errorCode]`/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  runsPage(page, limit, where) {
+    const parsedWhere = parseRunWhere(where);
+    return this.dashboard.runsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
   /** Most recent tool calls (default 50, max 200) for the activity feed. */
   toolCalls(limit) {
     return this.dashboard.recentToolCalls(parseLimit(limit, 50));
   }
+  /**
+  * Paged, filterable tool calls for the Runs & tools activity table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[toolName]`/`where[toolType]`/`where[status]`/`where[threadId]`/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  toolCallsPage(page, limit, where) {
+    const parsedWhere = parseToolCallWhere(where);
+    return this.dashboard.toolCallsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
   /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
   approvals(limit) {
     return this.dashboard.pendingApprovals(parseLimit(limit, 50));
@@ -378,10 +552,30 @@ var AgentApiController = class {
   /**
   * Decide a pending HITL tool call. Body `{ approved: boolean; reason?: string }`. 501s (via
   * `DashboardService.decideApproval`) when no `AGENT_APPROVAL_PORT` is bound. `executedByRef`
-  * comes from the host's `approvalActorRef` extractor run against the live request, when configured.
+  * comes from {@link deciderRef} run against the live request.
   */
   async decideApproval(toolCallId, body, req) {
-    await this.dashboard.decideApproval(toolCallId, body, this.approvalActorRef?.(req));
+    await this.dashboard.decideApproval(toolCallId, body, await this.deciderRef(req));
+  }
+  /**
+  * WHO decided, as an opaque ref: an explicit `approvalActorRef` override wins outright (no
+  * resolver fallback, even when it returns `undefined`); otherwise the AgentModule-configured
+  * actor resolver — the same identity seam chat requests use. A resolver that throws is an
+  * unauthenticated/unreadable request, not an error to surface: the decision itself was already
+  * authorized by the dashboard's guards, so the ref is simply omitted.
+  */
+  async deciderRef(req) {
+    if (this.approvalActorRef !== void 0) {
+      return this.approvalActorRef(req);
+    }
+    if (this.actorResolver === void 0) {
+      return void 0;
+    }
+    try {
+      return (await this.actorResolver.resolve(req)).id;
+    } catch {
+      return void 0;
+    }
   }
   /** Per-tool call/failure/rejection/latency rollup for a day range (defaults to the last 30 days). */
   tools(from, to) {
@@ -392,6 +586,21 @@ var AgentApiController = class {
     return this.dashboard.recentThreads(parseLimit(limit, 50));
   }
   /**
+  * Paged, filterable threads for the Runs & tools threads table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[actorRef]`/`where[title]` (case-insensitive substring)/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  threadsPage(page, limit, where) {
+    const parsedWhere = parseThreadWhere(where);
+    return this.dashboard.threadsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
+  /**
   * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
   * no `AGENT_PRICING_STORE` is bound.
   */
@@ -455,6 +664,19 @@ _ts_decorate2([
   ]),
   _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runs", null);
+_ts_decorate2([
+  Get("runs-page"),
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "runsPage", null);
 _ts_decorate2([
   Get("tool-calls"),
   _ts_param2(0, Query("limit")),
@@ -464,6 +686,19 @@ _ts_decorate2([
   ]),
   _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCalls", null);
+_ts_decorate2([
+  Get("tool-calls-page"),
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "toolCallsPage", null);
 _ts_decorate2([
   Get("approvals"),
   _ts_param2(0, Query("limit")),
@@ -507,6 +742,19 @@ _ts_decorate2([
   ]),
   _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threads", null);
+_ts_decorate2([
+  Get("threads-page"),
+  _ts_param2(0, Query("page")),
+  _ts_param2(1, Query("limit")),
+  _ts_param2(2, Query("where")),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "threadsPage", null);
 _ts_decorate2([
   Get("pricing"),
   _ts_metadata2("design:type", Function),
@@ -531,10 +779,13 @@ _ts_decorate2([
 AgentApiController = _ts_decorate2([
   Controller(),
   _ts_param2(1, Inject2(DASHBOARD_APPROVAL_ACTOR_REF)),
+  _ts_param2(2, Optional2()),
+  _ts_param2(2, Inject2(AGENT_ACTOR_RESOLVER)),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
-    Object
+    Object,
+    typeof ActorResolver === "undefined" ? Object : ActorResolver
   ])
 ], AgentApiController);
 
@@ -572,7 +823,7 @@ import { RouterModule } from "@nestjs/core";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header, Inject as Inject3, NotFoundException, Param as Param2, StreamableFile } from "@nestjs/common";
+import { Controller as Controller2, Get as Get2, Header, Inject as Inject3, NotFoundException, Param as Param2, Req as Req2, Res, StreamableFile } from "@nestjs/common";
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -617,7 +868,12 @@ var AgentUiController = class {
   }
   // index.html references hash-named bundles, so it MUST NOT be cached (stale bundle = the classic
   // "stuck loading after a deploy"). The hashed assets below are immutable.
-  index() {
+  index(req, res) {
+    if (req.headers["x-inertia"] !== void 0) {
+      res.status(409);
+      res.setHeader("X-Inertia-Location", req.originalUrl);
+      return "";
+    }
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
       throw new NotFoundException("Dashboard is not built. Run the package build.");
@@ -644,8 +900,15 @@ _ts_decorate3([
   Get2(),
   Header("Content-Type", "text/html; charset=utf-8"),
   Header("Cache-Control", "no-store, must-revalidate"),
+  _ts_param3(0, Req2()),
+  _ts_param3(1, Res({
+    passthrough: true
+  })),
   _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:paramtypes", [
+    typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
+    typeof UiPageResponse === "undefined" ? Object : UiPageResponse
+  ]),
   _ts_metadata3("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
 _ts_decorate3([
@@ -784,6 +1047,7 @@ AgentDashboardModule = _ts_decorate4([
 ], AgentDashboardModule);
 export {
   AGENT_ACTOR_DIRECTORY,
+  AGENT_ACTOR_RESOLVER,
   AGENT_APPROVAL_PORT,
   AGENT_GOVERNANCE_QUERIES,
   AGENT_PRICING_STORE,