@dudousxd/nestjs-agent-dashboard 0.7.0 → 0.9.0

package/dist/server/index.cjs

@@ -29,38 +29,377 @@ __export(index_exports, {
   AGENT_PRICING_STORE: () => AGENT_PRICING_STORE,
   AgentApiController: () => AgentApiController,
   AgentApiModule: () => AgentApiModule,
+  AgentDashboardAuthController: () => AgentDashboardAuthController,
   AgentDashboardModule: () => AgentDashboardModule,
   AgentUiController: () => AgentUiController,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF: () => DASHBOARD_APPROVAL_ACTOR_REF,
+  DASHBOARD_AUTH: () => DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
   DashboardService: () => DashboardService,
   agentDashboardMountPaths: () => agentDashboardMountPaths,
-  parsePriceInput: () => parsePriceInput
+  parsePriceInput: () => parsePriceInput,
+  resolveDashboardAuth: () => resolveDashboardAuth
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/server/agent-api.controller.ts
-var import_common4 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
+
+// src/server/auth/dashboard-auth.guard.ts
+var import_common = require("@nestjs/common");
+
+// src/server/tokens.ts
+var AGENT_GOVERNANCE_QUERIES = Symbol.for("@dudousxd/nestjs-agent:governance-queries");
+var AGENT_ACTOR_DIRECTORY = Symbol.for("@dudousxd/nestjs-agent:actor-directory");
+var AGENT_PRICING_STORE = Symbol.for("@dudousxd/nestjs-agent:pricing-store");
+var AGENT_APPROVAL_PORT = Symbol.for("@dudousxd/nestjs-agent:approval-port");
+var AGENT_ACTOR_RESOLVER = Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
+var DASHBOARD_BASE_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
+var DASHBOARD_API_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
+var DASHBOARD_APPROVAL_ACTOR_REF = Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+var DASHBOARD_AUTH = Symbol.for("@dudousxd/nestjs-agent-dashboard:dashboard-auth");
+
+// src/server/auth/cookie-header.ts
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (typeof header !== "string" || header === "") return cookies;
+  for (const segment of header.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq <= 0) continue;
+    const name = segment.slice(0, eq).trim();
+    if (name === "") continue;
+    let rawValue = segment.slice(eq + 1).trim();
+    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
+      rawValue = rawValue.slice(1, -1);
+    }
+    if (name in cookies) continue;
+    try {
+      cookies[name] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[name] = rawValue;
+    }
+  }
+  return cookies;
+}
+__name(parseCookieHeader, "parseCookieHeader");
+function serializeSetCookie(name, value, options) {
+  const parts = [
+    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
+  ];
+  parts.push(`Path=${options.path}`);
+  parts.push("HttpOnly");
+  parts.push("SameSite=Lax");
+  if (options.secure) parts.push("Secure");
+  if (options.clear) {
+    parts.push("Max-Age=0");
+    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+  } else {
+    parts.push(`Max-Age=${options.maxAgeSeconds}`);
+  }
+  return parts.join("; ");
+}
+__name(serializeSetCookie, "serializeSetCookie");
+
+// src/server/auth/http-request.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord, "isRecord");
+function readHeaders(request) {
+  if (!isRecord(request)) return {};
+  const headers = request.headers;
+  return isRecord(headers) ? headers : {};
+}
+__name(readHeaders, "readHeaders");
+function headerToString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
+    return value.join(",");
+  }
+  return void 0;
+}
+__name(headerToString, "headerToString");
+function readCookieHeader(request) {
+  return headerToString(readHeaders(request).cookie);
+}
+__name(readCookieHeader, "readCookieHeader");
+function isHttpsRequest(request) {
+  if (isRecord(request) && request.protocol === "https") return true;
+  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
+  if (forwarded === void 0) return false;
+  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
+}
+__name(isHttpsRequest, "isHttpsRequest");
+function readOriginalUrl(request) {
+  if (!isRecord(request)) return "/";
+  const originalUrl = request.originalUrl;
+  if (typeof originalUrl === "string" && originalUrl !== "") return originalUrl;
+  const url = request.url;
+  return typeof url === "string" && url !== "" ? url : "/";
+}
+__name(readOriginalUrl, "readOriginalUrl");
+function attachSession(request, session) {
+  if (!isRecord(request)) return;
+  const target = request;
+  target.dashboardSession = session;
+}
+__name(attachSession, "attachSession");
+
+// src/server/auth/response.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord2, "isRecord");
+function isHeaderCapableResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
+}
+__name(isHeaderCapableResponse, "isHeaderCapableResponse");
+function resolveHeaderCapableResponse(response) {
+  if (isHeaderCapableResponse(response)) return response;
+  if (isRecord2(response) && isHeaderCapableResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveHeaderCapableResponse, "resolveHeaderCapableResponse");
+function existingSetCookies(response) {
+  const current = response.getHeader("set-cookie");
+  if (Array.isArray(current)) return current;
+  if (typeof current === "string") return [
+    current
+  ];
+  return [];
+}
+__name(existingSetCookies, "existingSetCookies");
+function appendSetCookie(response, cookie) {
+  const raw = resolveHeaderCapableResponse(response);
+  if (!raw) return;
+  raw.setHeader("set-cookie", [
+    ...existingSetCookies(raw),
+    cookie
+  ]);
+}
+__name(appendSetCookie, "appendSetCookie");
+function isRawNodeResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
+}
+__name(isRawNodeResponse, "isRawNodeResponse");
+function resolveRawResponse(response) {
+  if (isRawNodeResponse(response)) return response;
+  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveRawResponse, "resolveRawResponse");
+function sendRedirect(response, status, location) {
+  const raw = resolveRawResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("location", location);
+  raw.end();
+}
+__name(sendRedirect, "sendRedirect");
+
+// src/server/auth/session-cookie.ts
+var import_node_crypto = require("crypto");
+var EXP_GRACE_MS = 3e4;
+function base64urlEncode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+__name(base64urlEncode, "base64urlEncode");
+function base64urlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+__name(base64urlDecode, "base64urlDecode");
+function hmac(secret, payload) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("base64url");
+}
+__name(hmac, "hmac");
+function signSessionCookie(user, options) {
+  const issuedAt = options.now ?? Date.now();
+  const session = {
+    sub: user.id,
+    ...user.name !== void 0 ? {
+      name: user.name
+    } : {},
+    roles: user.roles ?? [],
+    iat: issuedAt,
+    exp: issuedAt + options.ttlMs
+  };
+  const encodedPayload = base64urlEncode(JSON.stringify(session));
+  const signature = hmac(options.secret, encodedPayload);
+  return `${encodedPayload}.${signature}`;
+}
+__name(signSessionCookie, "signSessionCookie");
+function isSessionPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = {
+    ...value
+  };
+  if (typeof record.sub !== "string") return false;
+  if (record.name !== void 0 && typeof record.name !== "string") return false;
+  if (!Array.isArray(record.roles)) return false;
+  if (!record.roles.every((role) => typeof role === "string")) return false;
+  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
+  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
+  return true;
+}
+__name(isSessionPayload, "isSessionPayload");
+function verifySessionCookie(value, options) {
+  try {
+    const dot = value.indexOf(".");
+    if (dot <= 0 || dot === value.length - 1) return null;
+    const encodedPayload = value.slice(0, dot);
+    const providedSignature = value.slice(dot + 1);
+    const expectedSignature = hmac(options.secret, encodedPayload);
+    const provided = Buffer.from(providedSignature, "base64url");
+    const expected = Buffer.from(expectedSignature, "base64url");
+    if (provided.length !== expected.length) return null;
+    if (!(0, import_node_crypto.timingSafeEqual)(provided, expected)) return null;
+    const decoded = JSON.parse(base64urlDecode(encodedPayload));
+    if (!isSessionPayload(decoded)) return null;
+    const now = options.now ?? Date.now();
+    if (now > decoded.exp + EXP_GRACE_MS) return null;
+    const session = {
+      sub: decoded.sub,
+      ...decoded.name !== void 0 ? {
+        name: decoded.name
+      } : {},
+      roles: decoded.roles,
+      iat: decoded.iat,
+      exp: decoded.exp
+    };
+    return session;
+  } catch {
+    return null;
+  }
+}
+__name(verifySessionCookie, "verifySessionCookie");
+
+// src/server/auth/session-cookie-io.ts
+var SESSION_COOKIE_NAME = "agent_dashboard_session";
+var COOKIE_PATH = "/";
+function issueSessionCookie(user, context) {
+  const value = signSessionCookie(user, {
+    secret: context.auth.secret,
+    ttlMs: context.auth.ttlMs,
+    ...context.now !== void 0 ? {
+      now: context.now
+    } : {}
+  });
+  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
+    path: COOKIE_PATH,
+    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
+    secure: isHttpsRequest(context.request)
+  });
+  appendSetCookie(context.response, cookie);
+}
+__name(issueSessionCookie, "issueSessionCookie");
+function clearSessionCookie(context) {
+  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
+    path: COOKIE_PATH,
+    maxAgeSeconds: 0,
+    secure: isHttpsRequest(context.request),
+    clear: true
+  });
+  appendSetCookie(context.response, cookie);
+}
+__name(clearSessionCookie, "clearSessionCookie");
+
+// src/server/auth/dashboard-auth.guard.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var DashboardAuthGuard = class {
+  static {
+    __name(this, "DashboardAuthGuard");
+  }
+  auth;
+  constructor(auth) {
+    this.auth = auth;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) throw new import_common.UnauthorizedException();
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    const auth = this.auth;
+    if (!auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
+  * response, so an active user never gets logged out mid-session.
+  */
+  maybeRenew(response, request, session) {
+    const auth = this.auth;
+    if (!auth) return;
+    const now = Date.now();
+    if (now - session.iat <= auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth,
+      request,
+      response,
+      now
+    });
+  }
+};
+DashboardAuthGuard = _ts_decorate([
+  (0, import_common.Injectable)(),
+  _ts_param(0, (0, import_common.Optional)()),
+  _ts_param(0, (0, import_common.Inject)(DASHBOARD_AUTH)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    Object
+  ])
+], DashboardAuthGuard);
 
 // src/server/dashboard.service.ts
 var import_node_diagnostics_channel = require("diagnostics_channel");
 var import_nestjs_diagnostics = require("@dudousxd/nestjs-diagnostics");
-var import_common3 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 var import_rxjs = require("rxjs");
 
 // src/server/parse-approval-decision.ts
-var import_common = require("@nestjs/common");
+var import_common2 = require("@nestjs/common");
 function parseApprovalDecision(body) {
   if (typeof body !== "object" || body === null) {
-    throw new import_common.BadRequestException("Expected a JSON object body.");
+    throw new import_common2.BadRequestException("Expected a JSON object body.");
   }
   const { approved, reason } = body;
   if (typeof approved !== "boolean") {
-    throw new import_common.BadRequestException('"approved" must be a boolean.');
+    throw new import_common2.BadRequestException('"approved" must be a boolean.');
   }
   if (reason !== void 0 && typeof reason !== "string") {
-    throw new import_common.BadRequestException('"reason" must be a string when present.');
+    throw new import_common2.BadRequestException('"reason" must be a string when present.');
   }
   return {
     approved,
@@ -72,26 +411,26 @@ function parseApprovalDecision(body) {
 __name(parseApprovalDecision, "parseApprovalDecision");
 
 // src/server/parse-price-input.ts
-var import_common2 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 function parsePriceInput(body) {
   if (typeof body !== "object" || body === null) {
-    throw new import_common2.BadRequestException("Expected a JSON object body.");
+    throw new import_common3.BadRequestException("Expected a JSON object body.");
   }
   const { modelId, inputPricePer1m, outputPricePer1m, cacheWritePricePer1m, cacheReadPricePer1m } = body;
   if (typeof modelId !== "string" || modelId.trim().length === 0) {
-    throw new import_common2.BadRequestException('"modelId" must be a non-empty string.');
+    throw new import_common3.BadRequestException('"modelId" must be a non-empty string.');
   }
   if (!isFiniteNonNegative(inputPricePer1m)) {
-    throw new import_common2.BadRequestException('"inputPricePer1m" must be a non-negative number.');
+    throw new import_common3.BadRequestException('"inputPricePer1m" must be a non-negative number.');
   }
   if (!isFiniteNonNegative(outputPricePer1m)) {
-    throw new import_common2.BadRequestException('"outputPricePer1m" must be a non-negative number.');
+    throw new import_common3.BadRequestException('"outputPricePer1m" must be a non-negative number.');
   }
   if (cacheWritePricePer1m !== void 0 && !isFiniteNonNegative(cacheWritePricePer1m)) {
-    throw new import_common2.BadRequestException('"cacheWritePricePer1m" must be a non-negative number when present.');
+    throw new import_common3.BadRequestException('"cacheWritePricePer1m" must be a non-negative number when present.');
   }
   if (cacheReadPricePer1m !== void 0 && !isFiniteNonNegative(cacheReadPricePer1m)) {
-    throw new import_common2.BadRequestException('"cacheReadPricePer1m" must be a non-negative number when present.');
+    throw new import_common3.BadRequestException('"cacheReadPricePer1m" must be a non-negative number when present.');
   }
   return {
     modelId,
@@ -111,34 +450,24 @@ function isFiniteNonNegative(value) {
 }
 __name(isFiniteNonNegative, "isFiniteNonNegative");
 
-// src/server/tokens.ts
-var AGENT_GOVERNANCE_QUERIES = Symbol.for("@dudousxd/nestjs-agent:governance-queries");
-var AGENT_ACTOR_DIRECTORY = Symbol.for("@dudousxd/nestjs-agent:actor-directory");
-var AGENT_PRICING_STORE = Symbol.for("@dudousxd/nestjs-agent:pricing-store");
-var AGENT_APPROVAL_PORT = Symbol.for("@dudousxd/nestjs-agent:approval-port");
-var AGENT_ACTOR_RESOLVER = Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
-var DASHBOARD_BASE_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
-var DASHBOARD_API_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
-var DASHBOARD_APPROVAL_ACTOR_REF = Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
-
 // src/server/dashboard.service.ts
-function _ts_decorate(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param, "_ts_param");
+__name(_ts_param2, "_ts_param");
 var PRICING_STORE_UNBOUND_MESSAGE = "Pricing CRUD is unavailable: no AGENT_PRICING_STORE is bound. Bind a pricing store (e.g. MikroOrmPricingStore from @dudousxd/nestjs-agent-store-mikro-orm) to enable it.";
 var APPROVAL_PORT_UNBOUND_MESSAGE = "Approve/reject is unavailable: no AGENT_APPROVAL_PORT is bound. Import AgentModule from @dudousxd/nestjs-agent alongside this dashboard to enable it \u2014 the approvals inbox stays read-only until then.";
 var AGENT_EVENTS = [
@@ -209,6 +538,14 @@ var DashboardService = class {
   recentToolCalls(limit) {
     return this.queries.recentToolCalls(limit);
   }
+  /** Paged, filterable tool calls for the Runs & tools activity table. */
+  toolCallsPage(query) {
+    return this.queries.toolCallsPage(query);
+  }
+  /** Paged, filterable runs for the Reliability recent-runs table. */
+  runsPage(query) {
+    return this.queries.runsPage(query);
+  }
   /** Tool calls sitting `pending_approval`, oldest first, for the cross-thread approvals inbox. */
   pendingApprovals(limit) {
     return this.queries.pendingApprovals(limit);
@@ -227,7 +564,7 @@ var DashboardService = class {
   */
   async decideApproval(toolCallId, body, executedByRef) {
     if (this.approvalPort === void 0) {
-      throw new import_common3.NotImplementedException(APPROVAL_PORT_UNBOUND_MESSAGE);
+      throw new import_common4.NotImplementedException(APPROVAL_PORT_UNBOUND_MESSAGE);
     }
     const decision = parseApprovalDecision(body);
     const opts = executedByRef !== void 0 ? {
@@ -250,6 +587,18 @@ var DashboardService = class {
     return this.withActorLabels(rows);
   }
   /**
+  * Paged, filterable threads for the Runs & tools threads table — actor-labeled the same way
+  * {@link recentThreads} is.
+  */
+  async threadsPage(query) {
+    const page = await this.queries.threadsPage(query);
+    const rows = await this.withActorLabels(page.rows);
+    return {
+      ...page,
+      rows
+    };
+  }
+  /**
   * Decorate actor-scoped rows with `actorLabel`, batching the distinct `actorRef`s into ONE
   * {@link ActorDirectory.resolveDisplay} call per response. `null` for every row when no directory
   * is bound, or for a ref the directory didn't resolve.
@@ -276,7 +625,7 @@ var DashboardService = class {
   /** Current price row per model, for the pricing tab. 501s when no `AGENT_PRICING_STORE` is bound. */
   async listPrices() {
     if (this.pricingStore === void 0) {
-      throw new import_common3.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
+      throw new import_common4.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
     }
     return this.pricingStore.listCurrentPrices();
   }
@@ -287,7 +636,7 @@ var DashboardService = class {
   */
   async upsertPrice(body) {
     if (this.pricingStore === void 0) {
-      throw new import_common3.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
+      throw new import_common4.NotImplementedException(PRICING_STORE_UNBOUND_MESSAGE);
     }
     await this.pricingStore.upsertModelPrice(parsePriceInput(body));
   }
@@ -322,17 +671,17 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate([
-  (0, import_common3.Injectable)(),
-  _ts_param(0, (0, import_common3.Inject)(AGENT_GOVERNANCE_QUERIES)),
-  _ts_param(1, (0, import_common3.Optional)()),
-  _ts_param(1, (0, import_common3.Inject)(AGENT_ACTOR_DIRECTORY)),
-  _ts_param(2, (0, import_common3.Optional)()),
-  _ts_param(2, (0, import_common3.Inject)(AGENT_PRICING_STORE)),
-  _ts_param(3, (0, import_common3.Optional)()),
-  _ts_param(3, (0, import_common3.Inject)(AGENT_APPROVAL_PORT)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+DashboardService = _ts_decorate2([
+  (0, import_common4.Injectable)(),
+  _ts_param2(0, (0, import_common4.Inject)(AGENT_GOVERNANCE_QUERIES)),
+  _ts_param2(1, (0, import_common4.Optional)()),
+  _ts_param2(1, (0, import_common4.Inject)(AGENT_ACTOR_DIRECTORY)),
+  _ts_param2(2, (0, import_common4.Optional)()),
+  _ts_param2(2, (0, import_common4.Inject)(AGENT_PRICING_STORE)),
+  _ts_param2(3, (0, import_common4.Optional)()),
+  _ts_param2(3, (0, import_common4.Inject)(AGENT_APPROVAL_PORT)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof AgentGovernanceQueries === "undefined" ? Object : AgentGovernanceQueries,
     typeof ActorDirectory === "undefined" ? Object : ActorDirectory,
     typeof AgentPricingStore === "undefined" ? Object : AgentPricingStore,
@@ -340,32 +689,153 @@ DashboardService = _ts_decorate([
   ])
 ], DashboardService);
 
+// src/server/parse-page-query.ts
+var import_common5 = require("@nestjs/common");
+var ISO_DAY = /^\d{4}-\d{2}-\d{2}$/;
+function parsePageNumber(value) {
+  const parsed = value === void 0 ? Number.NaN : Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed < 1) return 1;
+  return parsed;
+}
+__name(parsePageNumber, "parsePageNumber");
+function assertKnownFields(raw, allowed) {
+  for (const field of Object.keys(raw)) {
+    if (!allowed.includes(field)) {
+      throw new import_common5.BadRequestException(`Unknown where field "${field}".`);
+    }
+  }
+}
+__name(assertKnownFields, "assertKnownFields");
+function assertDayFields(raw, dayFields) {
+  for (const field of dayFields) {
+    const value = raw[field];
+    if (value !== void 0 && !ISO_DAY.test(value)) {
+      throw new import_common5.BadRequestException(`"where[${field}]" must be YYYY-MM-DD.`);
+    }
+  }
+}
+__name(assertDayFields, "assertDayFields");
+var DAY_FIELDS = [
+  "fromDay",
+  "toDay"
+];
+var TOOL_CALL_WHERE_FIELDS = [
+  "toolName",
+  "toolType",
+  "status",
+  "threadId",
+  "fromDay",
+  "toDay"
+];
+function parseToolCallWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, TOOL_CALL_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.toolName !== void 0 ? {
+      toolName: raw.toolName
+    } : {},
+    ...raw.toolType !== void 0 ? {
+      toolType: raw.toolType
+    } : {},
+    ...raw.status !== void 0 ? {
+      status: raw.status
+    } : {},
+    ...raw.threadId !== void 0 ? {
+      threadId: raw.threadId
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseToolCallWhere, "parseToolCallWhere");
+var THREAD_WHERE_FIELDS = [
+  "actorRef",
+  "title",
+  "fromDay",
+  "toDay"
+];
+function parseThreadWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, THREAD_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.actorRef !== void 0 ? {
+      actorRef: raw.actorRef
+    } : {},
+    ...raw.title !== void 0 ? {
+      title: raw.title
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseThreadWhere, "parseThreadWhere");
+var RUN_WHERE_FIELDS = [
+  "agentName",
+  "status",
+  "errorCode",
+  "fromDay",
+  "toDay"
+];
+function parseRunWhere(raw) {
+  if (raw === void 0 || Object.keys(raw).length === 0) return void 0;
+  assertKnownFields(raw, RUN_WHERE_FIELDS);
+  assertDayFields(raw, DAY_FIELDS);
+  return {
+    ...raw.agentName !== void 0 ? {
+      agentName: raw.agentName
+    } : {},
+    ...raw.status !== void 0 ? {
+      status: raw.status
+    } : {},
+    ...raw.errorCode !== void 0 ? {
+      errorCode: raw.errorCode
+    } : {},
+    ...raw.fromDay !== void 0 ? {
+      fromDay: raw.fromDay
+    } : {},
+    ...raw.toDay !== void 0 ? {
+      toDay: raw.toDay
+    } : {}
+  };
+}
+__name(parseRunWhere, "parseRunWhere");
+
 // src/server/agent-api.controller.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var DAY_MS = 864e5;
-var ISO_DAY = /^\d{4}-\d{2}-\d{2}$/;
+var ISO_DAY2 = /^\d{4}-\d{2}-\d{2}$/;
 function utcDay(daysAgo) {
   return new Date(Date.now() - daysAgo * DAY_MS).toISOString().slice(0, 10);
 }
 __name(utcDay, "utcDay");
 function dayOr(value, fallback) {
-  return value !== void 0 && ISO_DAY.test(value) ? value : fallback;
+  return value !== void 0 && ISO_DAY2.test(value) ? value : fallback;
 }
 __name(dayOr, "dayOr");
 function resolveRange(from, to) {
@@ -409,10 +879,40 @@ var AgentApiController = class {
   runs(limit) {
     return this.dashboard.recentRuns(parseLimit(limit, 50));
   }
+  /**
+  * Paged, filterable runs for the Reliability recent-runs table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[agentName]`/`where[status]`/`where[errorCode]`/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  runsPage(page, limit, where) {
+    const parsedWhere = parseRunWhere(where);
+    return this.dashboard.runsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
   /** Most recent tool calls (default 50, max 200) for the activity feed. */
   toolCalls(limit) {
     return this.dashboard.recentToolCalls(parseLimit(limit, 50));
   }
+  /**
+  * Paged, filterable tool calls for the Runs & tools activity table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[toolName]`/`where[toolType]`/`where[status]`/`where[threadId]`/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  toolCallsPage(page, limit, where) {
+    const parsedWhere = parseToolCallWhere(where);
+    return this.dashboard.toolCallsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
   /** Tool calls sitting `pending_approval` (default 50, max 200), oldest first — the approvals inbox. */
   approvals(limit) {
     return this.dashboard.pendingApprovals(parseLimit(limit, 50));
@@ -454,6 +954,21 @@ var AgentApiController = class {
     return this.dashboard.recentThreads(parseLimit(limit, 50));
   }
   /**
+  * Paged, filterable threads for the Runs & tools threads table. `page` (default 1), `limit`
+  * (default 25, max 200), and `where[actorRef]`/`where[title]` (case-insensitive substring)/
+  * `where[fromDay]`/`where[toDay]` (`YYYY-MM-DD`) — an unknown `where` field 400s naming it.
+  */
+  threadsPage(page, limit, where) {
+    const parsedWhere = parseThreadWhere(where);
+    return this.dashboard.threadsPage({
+      page: parsePageNumber(page),
+      pageSize: parseLimit(limit, 25),
+      ...parsedWhere !== void 0 ? {
+        where: parsedWhere
+      } : {}
+    });
+  }
+  /**
   * Current price row per model, for the pricing tab. 501s (via `DashboardService.listPrices`) when
   * no `AGENT_PRICING_STORE` is bound.
   */
@@ -473,136 +988,469 @@ var AgentApiController = class {
     return this.dashboard.streamEvents();
   }
 };
-_ts_decorate2([
-  (0, import_common4.Get)("spend"),
-  _ts_param2(0, (0, import_common4.Query)("from")),
-  _ts_param2(1, (0, import_common4.Query)("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("spend"),
+  _ts_param3(0, (0, import_common6.Query)("from")),
+  _ts_param3(1, (0, import_common6.Query)("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "spend", null);
-_ts_decorate2([
-  (0, import_common4.Get)("top-threads"),
-  _ts_param2(0, (0, import_common4.Query)("from")),
-  _ts_param2(1, (0, import_common4.Query)("to")),
-  _ts_param2(2, (0, import_common4.Query)("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("top-threads"),
+  _ts_param3(0, (0, import_common6.Query)("from")),
+  _ts_param3(1, (0, import_common6.Query)("to")),
+  _ts_param3(2, (0, import_common6.Query)("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "topThreads", null);
-_ts_decorate2([
-  (0, import_common4.Get)("reliability"),
-  _ts_param2(0, (0, import_common4.Query)("from")),
-  _ts_param2(1, (0, import_common4.Query)("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("reliability"),
+  _ts_param3(0, (0, import_common6.Query)("from")),
+  _ts_param3(1, (0, import_common6.Query)("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "reliability", null);
-_ts_decorate2([
-  (0, import_common4.Get)("runs"),
-  _ts_param2(0, (0, import_common4.Query)("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("runs"),
+  _ts_param3(0, (0, import_common6.Query)("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runs", null);
-_ts_decorate2([
-  (0, import_common4.Get)("tool-calls"),
-  _ts_param2(0, (0, import_common4.Query)("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("runs-page"),
+  _ts_param3(0, (0, import_common6.Query)("page")),
+  _ts_param3(1, (0, import_common6.Query)("limit")),
+  _ts_param3(2, (0, import_common6.Query)("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "runsPage", null);
+_ts_decorate3([
+  (0, import_common6.Get)("tool-calls"),
+  _ts_param3(0, (0, import_common6.Query)("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCalls", null);
-_ts_decorate2([
-  (0, import_common4.Get)("approvals"),
-  _ts_param2(0, (0, import_common4.Query)("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("tool-calls-page"),
+  _ts_param3(0, (0, import_common6.Query)("page")),
+  _ts_param3(1, (0, import_common6.Query)("limit")),
+  _ts_param3(2, (0, import_common6.Query)("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "toolCallsPage", null);
+_ts_decorate3([
+  (0, import_common6.Get)("approvals"),
+  _ts_param3(0, (0, import_common6.Query)("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvals", null);
-_ts_decorate2([
-  (0, import_common4.Post)("approvals/:toolCallId"),
-  (0, import_common4.HttpCode)(204),
-  _ts_param2(0, (0, import_common4.Param)("toolCallId")),
-  _ts_param2(1, (0, import_common4.Body)()),
-  _ts_param2(2, (0, import_common4.Req)()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Post)("approvals/:toolCallId"),
+  (0, import_common6.HttpCode)(204),
+  _ts_param3(0, (0, import_common6.Param)("toolCallId")),
+  _ts_param3(1, (0, import_common6.Body)()),
+  _ts_param3(2, (0, import_common6.Req)()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     Object,
     Object
   ]),
-  _ts_metadata2("design:returntype", Promise)
+  _ts_metadata3("design:returntype", Promise)
 ], AgentApiController.prototype, "decideApproval", null);
-_ts_decorate2([
-  (0, import_common4.Get)("tools"),
-  _ts_param2(0, (0, import_common4.Query)("from")),
-  _ts_param2(1, (0, import_common4.Query)("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("tools"),
+  _ts_param3(0, (0, import_common6.Query)("from")),
+  _ts_param3(1, (0, import_common6.Query)("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "tools", null);
-_ts_decorate2([
-  (0, import_common4.Get)("threads"),
-  _ts_param2(0, (0, import_common4.Query)("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Get)("threads"),
+  _ts_param3(0, (0, import_common6.Query)("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threads", null);
-_ts_decorate2([
-  (0, import_common4.Get)("pricing"),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+_ts_decorate3([
+  (0, import_common6.Get)("threads-page"),
+  _ts_param3(0, (0, import_common6.Query)("page")),
+  _ts_param3(1, (0, import_common6.Query)("limit")),
+  _ts_param3(2, (0, import_common6.Query)("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    String,
+    String,
+    typeof Record === "undefined" ? Object : Record
+  ]),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], AgentApiController.prototype, "threadsPage", null);
+_ts_decorate3([
+  (0, import_common6.Get)("pricing"),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "listPrices", null);
-_ts_decorate2([
-  (0, import_common4.Post)("pricing"),
-  _ts_param2(0, (0, import_common4.Body)()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+_ts_decorate3([
+  (0, import_common6.Post)("pricing"),
+  _ts_param3(0, (0, import_common6.Body)()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     Object
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "upsertPrice", null);
-_ts_decorate2([
-  (0, import_common4.Sse)("stream"),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", typeof Observable === "undefined" ? Object : Observable)
+_ts_decorate3([
+  (0, import_common6.Sse)("stream"),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:returntype", typeof Observable === "undefined" ? Object : Observable)
 ], AgentApiController.prototype, "stream", null);
-AgentApiController = _ts_decorate2([
-  (0, import_common4.Controller)(),
-  _ts_param2(1, (0, import_common4.Inject)(DASHBOARD_APPROVAL_ACTOR_REF)),
-  _ts_param2(2, (0, import_common4.Optional)()),
-  _ts_param2(2, (0, import_common4.Inject)(AGENT_ACTOR_RESOLVER)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+AgentApiController = _ts_decorate3([
+  (0, import_common6.Controller)(),
+  (0, import_common6.UseGuards)(DashboardAuthGuard),
+  _ts_param3(1, (0, import_common6.Inject)(DASHBOARD_APPROVAL_ACTOR_REF)),
+  _ts_param3(2, (0, import_common6.Optional)()),
+  _ts_param3(2, (0, import_common6.Inject)(AGENT_ACTOR_RESOLVER)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     Object,
     typeof ActorResolver === "undefined" ? Object : ActorResolver
   ])
 ], AgentApiController);
 
+// src/server/agent-dashboard-auth.controller.ts
+var import_common7 = require("@nestjs/common");
+
+// src/server/auth/login-page.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+__name(escapeHtml, "escapeHtml");
+function renderLoginPage(options) {
+  const action = escapeHtml(options.actionUrl);
+  const returnTo = escapeHtml(options.returnTo);
+  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>Sign in \u2014 AI Gateway</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: #09090b;
+    color: #e4e4e7;
+    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    padding: 16px;
+  }
+  .card {
+    width: 100%;
+    max-width: 384px;
+    border: 1px solid #27272a;
+    background: #18181b;
+    border-radius: 8px;
+    padding: 32px;
+    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
+  }
+  .brand {
+    margin: 0 0 24px;
+    text-align: center;
+    font-size: 18px;
+    font-weight: 600;
+    color: #34d399;
+  }
+  form { display: flex; flex-direction: column; gap: 16px; }
+  label { display: flex; flex-direction: column; gap: 6px; }
+  .field-label {
+    font-size: 11px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: #71717a;
+  }
+  input {
+    border-radius: 4px;
+    border: 1px solid #3f3f46;
+    background: #09090b;
+    color: #f4f4f5;
+    padding: 8px 12px;
+    font: inherit;
+    outline: none;
+  }
+  input:focus { border-color: rgb(52 211 153 / 0.6); }
+  .error { margin: 0; font-size: 12px; color: #fb7185; }
+  button {
+    margin-top: 8px;
+    border-radius: 4px;
+    border: 1px solid rgb(52 211 153 / 0.4);
+    background: rgb(52 211 153 / 0.1);
+    color: #6ee7b7;
+    padding: 8px 12px;
+    font: inherit;
+    font-size: 12px;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    cursor: pointer;
+  }
+  button:hover { background: rgb(52 211 153 / 0.2); }
+</style>
+</head>
+<body>
+  <div class="card">
+    <p class="brand">AI Gateway</p>
+    <form method="post" action="${action}">
+      <input type="hidden" name="returnTo" value="${returnTo}" />
+      <label>
+        <span class="field-label">Username</span>
+        <input type="text" name="username" autocomplete="username" autofocus />
+      </label>
+      <label>
+        <span class="field-label">Password</span>
+        <input type="password" name="password" autocomplete="current-password" />
+      </label>
+      ${errorBanner}
+      <button type="submit">Sign in</button>
+    </form>
+  </div>
+</body>
+</html>`;
+}
+__name(renderLoginPage, "renderLoginPage");
+
+// src/server/auth/sanitize-return-to.ts
+function sanitizeReturnTo(basePath, returnTo) {
+  if (typeof returnTo !== "string" || returnTo === "") return basePath;
+  if (!returnTo.startsWith("/") || returnTo.startsWith("//")) return basePath;
+  if (returnTo !== basePath && !returnTo.startsWith(`${basePath}/`) && !returnTo.startsWith(`${basePath}?`)) {
+    return basePath;
+  }
+  return returnTo;
+}
+__name(sanitizeReturnTo, "sanitizeReturnTo");
+
+// src/server/agent-dashboard-auth.controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+function isNonEmptyString(value) {
+  return typeof value === "string" && value !== "";
+}
+__name(isNonEmptyString, "isNonEmptyString");
+var AgentDashboardAuthController = class _AgentDashboardAuthController {
+  static {
+    __name(this, "AgentDashboardAuthController");
+  }
+  auth;
+  basePath;
+  logger = new import_common7.Logger(_AgentDashboardAuthController.name);
+  /** Warn once (not per request) so a broken hook can't be used to flood the logs. */
+  warnedLoginHookThrow = false;
+  constructor(auth, basePath) {
+    this.auth = auth;
+    this.basePath = basePath;
+  }
+  loginPage(req, res, returnToQuery, error) {
+    this.requireAuth();
+    const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
+    if (this.currentSession(req)) {
+      res.status(302);
+      res.setHeader("Location", returnTo);
+      return "";
+    }
+    return renderLoginPage({
+      actionUrl: `${this.basePath}/auth/login`,
+      returnTo,
+      error: error !== void 0
+    });
+  }
+  async login(body, req, res) {
+    const auth = this.requireAuth();
+    const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
+    const username = body?.username;
+    const password = body?.password;
+    if (!isNonEmptyString(username) || !isNonEmptyString(password)) {
+      this.redirectToLoginError(res, returnTo);
+      return "";
+    }
+    const user = await this.runLoginHook(auth, username, password);
+    if (!user) {
+      this.redirectToLoginError(res, returnTo);
+      return "";
+    }
+    issueSessionCookie(user, {
+      auth,
+      request: req,
+      response: res
+    });
+    res.status(302);
+    res.setHeader("Location", returnTo);
+    return "";
+  }
+  logout(req, res) {
+    clearSessionCookie({
+      request: req,
+      response: res
+    });
+    res.status(302);
+    res.setHeader("Location", `${this.basePath}/auth/login`);
+    return "";
+  }
+  /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
+  redirectToLoginError(res, returnTo) {
+    res.status(303);
+    res.setHeader("Location", `${this.basePath}/auth/login?error=1&returnTo=${encodeURIComponent(returnTo)}`);
+  }
+  currentSession(req) {
+    const auth = this.auth;
+    if (!auth) return false;
+    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return false;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    }) !== null;
+  }
+  /**
+  * Run the host's `login` hook defensively: a throw (sync or async) is treated as a denial
+  * (`null`) and warn-logged ONCE, so a buggy/unreachable hook never 500s the endpoint into a
+  * stack-trace leak nor floods the logs.
+  */
+  async runLoginHook(auth, username, password) {
+    try {
+      return await auth.login(username, password) ?? null;
+    } catch (error) {
+      if (!this.warnedLoginHookThrow) {
+        this.warnedLoginHookThrow = true;
+        this.logger.warn(`AgentDashboardModule dashboardAuth login hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
+      }
+      return null;
+    }
+  }
+  requireAuth() {
+    if (!this.auth) throw new import_common7.NotFoundException();
+    return this.auth;
+  }
+};
+_ts_decorate4([
+  (0, import_common7.Get)("login"),
+  (0, import_common7.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common7.Header)("Cache-Control", "no-store"),
+  _ts_param4(0, (0, import_common7.Req)()),
+  _ts_param4(1, (0, import_common7.Res)({
+    passthrough: true
+  })),
+  _ts_param4(2, (0, import_common7.Query)("returnTo")),
+  _ts_param4(3, (0, import_common7.Query)("error")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse,
+    String,
+    String
+  ]),
+  _ts_metadata4("design:returntype", String)
+], AgentDashboardAuthController.prototype, "loginPage", null);
+_ts_decorate4([
+  (0, import_common7.Post)("login"),
+  _ts_param4(0, (0, import_common7.Body)()),
+  _ts_param4(1, (0, import_common7.Req)()),
+  _ts_param4(2, (0, import_common7.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof LoginFormBody === "undefined" ? Object : LoginFormBody,
+    Object,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], AgentDashboardAuthController.prototype, "login", null);
+_ts_decorate4([
+  (0, import_common7.Post)("logout"),
+  _ts_param4(0, (0, import_common7.Req)()),
+  _ts_param4(1, (0, import_common7.Res)({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
+  ]),
+  _ts_metadata4("design:returntype", String)
+], AgentDashboardAuthController.prototype, "logout", null);
+AgentDashboardAuthController = _ts_decorate4([
+  (0, import_common7.Controller)("auth"),
+  _ts_param4(0, (0, import_common7.Optional)()),
+  _ts_param4(0, (0, import_common7.Inject)(DASHBOARD_AUTH)),
+  _ts_param4(1, (0, import_common7.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    String
+  ])
+], AgentDashboardAuthController);
+
 // src/server/normalize-path.ts
 function normalizeDashboardPath(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -629,32 +1477,155 @@ function agentDashboardMountPaths(options) {
 __name(agentDashboardMountPaths, "agentDashboardMountPaths");
 
 // src/server/agent-dashboard.module.ts
-var import_reflect_metadata = require("reflect-metadata");
-var import_common6 = require("@nestjs/common");
+var import_reflect_metadata2 = require("reflect-metadata");
+var import_common11 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
 // src/server/agent-ui.controller.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
 var import_node_url = require("url");
-var import_common5 = require("@nestjs/common");
-function _ts_decorate3(decorators, target, key, desc) {
+var import_common10 = require("@nestjs/common");
+
+// src/server/auth/dashboard-auth-page.guard.ts
+var import_common9 = require("@nestjs/common");
+
+// src/server/auth/dashboard-auth-redirect.ts
+var import_common8 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+var DashboardAuthRedirect = class extends Error {
+  static {
+    __name(this, "DashboardAuthRedirect");
+  }
+  redirectTo;
+  constructor(redirectTo) {
+    super(`Redirect to ${redirectTo}`), this.redirectTo = redirectTo;
+    this.name = "DashboardAuthRedirect";
+  }
+};
+var DashboardAuthRedirectFilter = class {
+  static {
+    __name(this, "DashboardAuthRedirectFilter");
+  }
+  catch(exception, host) {
+    const response = host.switchToHttp().getResponse();
+    sendRedirect(response, 302, exception.redirectTo);
+  }
+};
+DashboardAuthRedirectFilter = _ts_decorate5([
+  (0, import_common8.Injectable)(),
+  (0, import_common8.Catch)(DashboardAuthRedirect)
+], DashboardAuthRedirectFilter);
+
+// src/server/auth/dashboard-auth-page.guard.ts
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param5, "_ts_param");
+var DashboardAuthPageGuard = class {
+  static {
+    __name(this, "DashboardAuthPageGuard");
+  }
+  auth;
+  basePath;
+  constructor(auth, basePath) {
+    this.auth = auth;
+    this.basePath = basePath;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) {
+      const returnTo = readOriginalUrl(request);
+      throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
+    }
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    const auth = this.auth;
+    if (!auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
+  * response, so an active user never gets logged out mid-session.
+  */
+  maybeRenew(response, request, session) {
+    const auth = this.auth;
+    if (!auth) return;
+    const now = Date.now();
+    if (now - session.iat <= auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth,
+      request,
+      response,
+      now
+    });
+  }
+};
+DashboardAuthPageGuard = _ts_decorate6([
+  (0, import_common9.Injectable)(),
+  _ts_param5(0, (0, import_common9.Optional)()),
+  _ts_param5(0, (0, import_common9.Inject)(DASHBOARD_AUTH)),
+  _ts_param5(1, (0, import_common9.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    Object,
+    String
+  ])
+], DashboardAuthPageGuard);
+
+// src/server/agent-ui.controller.ts
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return (0, import_node_url.fileURLToPath)(new URL("../spa", __importMetaUrl));
@@ -690,7 +1661,7 @@ var AgentUiController = class {
     }
     const indexPath = (0, import_node_path.join)(this.dir, "index.html");
     if (!(0, import_node_fs.existsSync)(indexPath)) {
-      throw new import_common5.NotFoundException("Dashboard is not built. Run the package build.");
+      throw new import_common10.NotFoundException("Dashboard is not built. Run the package build.");
     }
     const html = (0, import_node_fs.readFileSync)(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -698,78 +1669,147 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = (0, import_node_path.basename)(file);
-    if (safe !== file) throw new import_common5.NotFoundException();
+    if (safe !== file) throw new import_common10.NotFoundException();
     const root = (0, import_node_path.resolve)(this.dir, "assets");
     const assetPath = (0, import_node_path.resolve)(root, safe);
     if (!assetPath.startsWith(root + import_node_path.sep) || !(0, import_node_fs.existsSync)(assetPath)) {
-      throw new import_common5.NotFoundException();
+      throw new import_common10.NotFoundException();
     }
     const type = CONTENT_TYPES[(0, import_node_path.extname)(safe)] ?? "application/octet-stream";
-    return new import_common5.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
+    return new import_common10.StreamableFile((0, import_node_fs.readFileSync)(assetPath), {
       type
     });
   }
 };
-_ts_decorate3([
-  (0, import_common5.Get)(),
-  (0, import_common5.Header)("Content-Type", "text/html; charset=utf-8"),
-  (0, import_common5.Header)("Cache-Control", "no-store, must-revalidate"),
-  _ts_param3(0, (0, import_common5.Req)()),
-  _ts_param3(1, (0, import_common5.Res)({
+_ts_decorate7([
+  (0, import_common10.Get)(),
+  (0, import_common10.Header)("Content-Type", "text/html; charset=utf-8"),
+  (0, import_common10.Header)("Cache-Control", "no-store, must-revalidate"),
+  _ts_param6(0, (0, import_common10.Req)()),
+  _ts_param6(1, (0, import_common10.Res)({
     passthrough: true
   })),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata6("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate3([
-  (0, import_common5.Get)("assets/:file"),
-  (0, import_common5.Header)("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, (0, import_common5.Param)("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate7([
+  (0, import_common10.Get)("assets/:file"),
+  (0, import_common10.Header)("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param6(0, (0, import_common10.Param)("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof import_common5.StreamableFile === "undefined" ? Object : import_common5.StreamableFile)
+  _ts_metadata6("design:returntype", typeof import_common10.StreamableFile === "undefined" ? Object : import_common10.StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate3([
-  (0, import_common5.Controller)(),
-  _ts_param3(0, (0, import_common5.Inject)(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, (0, import_common5.Inject)(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+AgentUiController = _ts_decorate7([
+  (0, import_common10.Controller)(),
+  (0, import_common10.UseGuards)(DashboardAuthPageGuard),
+  (0, import_common10.UseFilters)(new DashboardAuthRedirectFilter()),
+  _ts_param6(0, (0, import_common10.Inject)(DASHBOARD_BASE_PATH)),
+  _ts_param6(1, (0, import_common10.Inject)(DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
+// src/server/auth/dashboard-auth-config.ts
+var DEFAULT_TTL = "8h";
+function unitToMs(unit) {
+  switch (unit) {
+    case "ms":
+      return 1;
+    case "s":
+      return 1e3;
+    case "m":
+      return 6e4;
+    case "h":
+      return 36e5;
+    case "d":
+      return 864e5;
+    default:
+      return void 0;
+  }
+}
+__name(unitToMs, "unitToMs");
+function durationToMs(duration) {
+  const match = /^(\d+)(ms|s|m|h|d)$/.exec(duration.trim());
+  const amount = match?.[1];
+  const unit = match?.[2] !== void 0 ? unitToMs(match[2]) : void 0;
+  if (amount === void 0 || unit === void 0) {
+    throw new Error(`AgentDashboardModule dashboardAuth: invalid \`ttl\` duration: ${duration}`);
+  }
+  return Number(amount) * unit;
+}
+__name(durationToMs, "durationToMs");
+function resolveDashboardAuth(options) {
+  if (options === void 0) return null;
+  if (typeof options.secret !== "string" || options.secret === "") {
+    throw new Error("AgentDashboardModule dashboardAuth: `secret` is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
+  }
+  if (typeof options.login !== "function") {
+    throw new Error("AgentDashboardModule dashboardAuth: `login` is required (validates submitted credentials for the built-in login screen). Failing closed.");
+  }
+  return {
+    secret: options.secret,
+    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
+    login: options.login
+  };
+}
+__name(resolveDashboardAuth, "resolveDashboardAuth");
+
+// src/server/guards.ts
+var import_reflect_metadata = require("reflect-metadata");
+var GUARDS_METADATA = "__guards__";
+function isGuardClass(guard) {
+  return typeof guard === "function";
+}
+__name(isGuardClass, "isGuardClass");
+function baseGuards(controller) {
+  return Reflect.getOwnMetadata(GUARDS_METADATA, controller) ?? [];
+}
+__name(baseGuards, "baseGuards");
+function stampGuards(guards, entries) {
+  for (const [controller, base] of entries) {
+    Reflect.defineMetadata(GUARDS_METADATA, [
+      ...base,
+      ...guards ?? []
+    ], controller);
+  }
+}
+__name(stampGuards, "stampGuards");
+
 // src/server/agent-dashboard.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-var GUARDS_METADATA = "__guards__";
+__name(_ts_decorate8, "_ts_decorate");
+var API_BASE_GUARDS = baseGuards(AgentApiController);
+var UI_BASE_GUARDS = baseGuards(AgentUiController);
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
-function stampGuards(guards, ...controllers) {
-  for (const controller of controllers) {
-    Reflect.defineMetadata(GUARDS_METADATA, guards ?? [], controller);
-  }
-}
-__name(stampGuards, "stampGuards");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
+    stampGuards(options.guards, [
+      [
+        AgentApiController,
+        API_BASE_GUARDS
+      ]
+    ]);
     return {
       module: _AgentApiModule,
       imports: [
@@ -780,7 +1820,9 @@ var AgentApiModule = class _AgentApiModule {
       ],
       providers: [
         DashboardService,
-        ...options.guards ?? [],
+        DashboardAuthGuard,
+        options.dashboardAuth,
+        ...(options.guards ?? []).filter(isGuardClass),
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
         // injects this WITHOUT `@Optional()` (same pattern as `AGENT_QUOTA_STORE`'s factory).
         {
@@ -788,14 +1830,18 @@ var AgentApiModule = class _AgentApiModule {
           useValue: options.approvalActorRef
         }
       ],
+      // DASHBOARD_AUTH re-exported so AgentUiController/AgentDashboardAuthController (hosted
+      // directly by AgentDashboardModule, which imports this module) resolve the SAME instance
+      // instead of re-running a host's async factory a second time.
       exports: [
-        DashboardService
+        DashboardService,
+        DASHBOARD_AUTH
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate4([
-  (0, import_common6.Module)({})
+AgentApiModule = _ts_decorate8([
+  (0, import_common11.Module)({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
   static {
@@ -804,7 +1850,16 @@ var AgentDashboardModule = class _AgentDashboardModule {
   static forRoot(options = {}) {
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, AgentApiController, AgentUiController);
+    stampGuards(options.guards, [
+      [
+        AgentUiController,
+        UI_BASE_GUARDS
+      ]
+    ]);
+    const dashboardAuthProvider = {
+      provide: DASHBOARD_AUTH,
+      useValue: resolveDashboardAuth(options.dashboardAuth)
+    };
     return {
       module: _AgentDashboardModule,
       imports: [
@@ -821,7 +1876,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
-          } : {}
+          } : {},
+          dashboardAuth: dashboardAuthProvider
         }),
         import_core.RouterModule.register([
           {
@@ -835,7 +1891,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
         ])
       ],
       controllers: [
-        AgentUiController
+        AgentUiController,
+        AgentDashboardAuthController
       ],
       providers: [
         {
@@ -846,8 +1903,9 @@ var AgentDashboardModule = class _AgentDashboardModule {
           provide: DASHBOARD_API_PATH,
           useValue: apiBasePath
         },
+        DashboardAuthPageGuard,
         // AgentUiController is hosted HERE, so its guards DI-instantiate from this module.
-        ...options.guards ?? []
+        ...(options.guards ?? []).filter(isGuardClass)
       ],
       // Re-export the API module so its DashboardService reaches importers (e.g. the host's own controllers).
       exports: [
@@ -855,9 +1913,71 @@ var AgentDashboardModule = class _AgentDashboardModule {
       ]
     };
   }
+  static forRootAsync(options) {
+    const basePath = normalize(options.basePath ?? "/ai-gateway");
+    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
+    stampGuards(options.guards, [
+      [
+        AgentUiController,
+        UI_BASE_GUARDS
+      ]
+    ]);
+    const dashboardAuthProvider = {
+      provide: DASHBOARD_AUTH,
+      inject: options.inject ?? [],
+      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
+    };
+    return {
+      module: _AgentDashboardModule,
+      imports: [
+        ...options.imports ?? [],
+        AgentApiModule.register({
+          ...options.imports ? {
+            imports: options.imports
+          } : {},
+          ...options.guards ? {
+            guards: options.guards
+          } : {},
+          ...options.approvalActorRef ? {
+            approvalActorRef: options.approvalActorRef
+          } : {},
+          dashboardAuth: dashboardAuthProvider
+        }),
+        import_core.RouterModule.register([
+          {
+            path: basePath,
+            module: _AgentDashboardModule
+          },
+          {
+            path: apiBasePath,
+            module: AgentApiModule
+          }
+        ])
+      ],
+      controllers: [
+        AgentUiController,
+        AgentDashboardAuthController
+      ],
+      providers: [
+        {
+          provide: DASHBOARD_BASE_PATH,
+          useValue: basePath
+        },
+        {
+          provide: DASHBOARD_API_PATH,
+          useValue: apiBasePath
+        },
+        DashboardAuthPageGuard,
+        ...(options.guards ?? []).filter(isGuardClass)
+      ],
+      exports: [
+        AgentApiModule
+      ]
+    };
+  }
 };
-AgentDashboardModule = _ts_decorate4([
-  (0, import_common6.Module)({})
+AgentDashboardModule = _ts_decorate8([
+  (0, import_common11.Module)({})
 ], AgentDashboardModule);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -868,13 +1988,16 @@ AgentDashboardModule = _ts_decorate4([
   AGENT_PRICING_STORE,
   AgentApiController,
   AgentApiModule,
+  AgentDashboardAuthController,
   AgentDashboardModule,
   AgentUiController,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
+  DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH,
   DashboardService,
   agentDashboardMountPaths,
-  parsePriceInput
+  parsePriceInput,
+  resolveDashboardAuth
 });
 //# sourceMappingURL=index.cjs.map