@dudousxd/nestjs-agent-dashboard 0.8.0 → 0.9.0

package/dist/server/index.js

@@ -2,12 +2,348 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/server/agent-api.controller.ts
-import { Body, Controller, Get, HttpCode, Inject as Inject2, Optional as Optional2, Param, Post, Query, Req, Sse } from "@nestjs/common";
+import { Body, Controller, Get, HttpCode, Inject as Inject3, Optional as Optional3, Param, Post, Query, Req, Sse, UseGuards } from "@nestjs/common";
+
+// src/server/auth/dashboard-auth.guard.ts
+import { Inject, Injectable, Optional, UnauthorizedException } from "@nestjs/common";
+
+// src/server/tokens.ts
+var AGENT_GOVERNANCE_QUERIES = Symbol.for("@dudousxd/nestjs-agent:governance-queries");
+var AGENT_ACTOR_DIRECTORY = Symbol.for("@dudousxd/nestjs-agent:actor-directory");
+var AGENT_PRICING_STORE = Symbol.for("@dudousxd/nestjs-agent:pricing-store");
+var AGENT_APPROVAL_PORT = Symbol.for("@dudousxd/nestjs-agent:approval-port");
+var AGENT_ACTOR_RESOLVER = Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
+var DASHBOARD_BASE_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
+var DASHBOARD_API_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
+var DASHBOARD_APPROVAL_ACTOR_REF = Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
+var DASHBOARD_AUTH = Symbol.for("@dudousxd/nestjs-agent-dashboard:dashboard-auth");
+
+// src/server/auth/cookie-header.ts
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (typeof header !== "string" || header === "") return cookies;
+  for (const segment of header.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq <= 0) continue;
+    const name = segment.slice(0, eq).trim();
+    if (name === "") continue;
+    let rawValue = segment.slice(eq + 1).trim();
+    if (rawValue.length >= 2 && rawValue.startsWith('"') && rawValue.endsWith('"')) {
+      rawValue = rawValue.slice(1, -1);
+    }
+    if (name in cookies) continue;
+    try {
+      cookies[name] = decodeURIComponent(rawValue);
+    } catch {
+      cookies[name] = rawValue;
+    }
+  }
+  return cookies;
+}
+__name(parseCookieHeader, "parseCookieHeader");
+function serializeSetCookie(name, value, options) {
+  const parts = [
+    `${name}=${options.clear ? "" : encodeURIComponent(value)}`
+  ];
+  parts.push(`Path=${options.path}`);
+  parts.push("HttpOnly");
+  parts.push("SameSite=Lax");
+  if (options.secure) parts.push("Secure");
+  if (options.clear) {
+    parts.push("Max-Age=0");
+    parts.push("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+  } else {
+    parts.push(`Max-Age=${options.maxAgeSeconds}`);
+  }
+  return parts.join("; ");
+}
+__name(serializeSetCookie, "serializeSetCookie");
+
+// src/server/auth/http-request.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord, "isRecord");
+function readHeaders(request) {
+  if (!isRecord(request)) return {};
+  const headers = request.headers;
+  return isRecord(headers) ? headers : {};
+}
+__name(readHeaders, "readHeaders");
+function headerToString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((part) => typeof part === "string")) {
+    return value.join(",");
+  }
+  return void 0;
+}
+__name(headerToString, "headerToString");
+function readCookieHeader(request) {
+  return headerToString(readHeaders(request).cookie);
+}
+__name(readCookieHeader, "readCookieHeader");
+function isHttpsRequest(request) {
+  if (isRecord(request) && request.protocol === "https") return true;
+  const forwarded = headerToString(readHeaders(request)["x-forwarded-proto"]);
+  if (forwarded === void 0) return false;
+  return forwarded.split(",").map((proto) => proto.trim().toLowerCase()).includes("https");
+}
+__name(isHttpsRequest, "isHttpsRequest");
+function readOriginalUrl(request) {
+  if (!isRecord(request)) return "/";
+  const originalUrl = request.originalUrl;
+  if (typeof originalUrl === "string" && originalUrl !== "") return originalUrl;
+  const url = request.url;
+  return typeof url === "string" && url !== "" ? url : "/";
+}
+__name(readOriginalUrl, "readOriginalUrl");
+function attachSession(request, session) {
+  if (!isRecord(request)) return;
+  const target = request;
+  target.dashboardSession = session;
+}
+__name(attachSession, "attachSession");
+
+// src/server/auth/response.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isRecord2, "isRecord");
+function isHeaderCapableResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function";
+}
+__name(isHeaderCapableResponse, "isHeaderCapableResponse");
+function resolveHeaderCapableResponse(response) {
+  if (isHeaderCapableResponse(response)) return response;
+  if (isRecord2(response) && isHeaderCapableResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveHeaderCapableResponse, "resolveHeaderCapableResponse");
+function existingSetCookies(response) {
+  const current = response.getHeader("set-cookie");
+  if (Array.isArray(current)) return current;
+  if (typeof current === "string") return [
+    current
+  ];
+  return [];
+}
+__name(existingSetCookies, "existingSetCookies");
+function appendSetCookie(response, cookie) {
+  const raw = resolveHeaderCapableResponse(response);
+  if (!raw) return;
+  raw.setHeader("set-cookie", [
+    ...existingSetCookies(raw),
+    cookie
+  ]);
+}
+__name(appendSetCookie, "appendSetCookie");
+function isRawNodeResponse(value) {
+  return isRecord2(value) && typeof value.getHeader === "function" && typeof value.setHeader === "function" && typeof value.end === "function";
+}
+__name(isRawNodeResponse, "isRawNodeResponse");
+function resolveRawResponse(response) {
+  if (isRawNodeResponse(response)) return response;
+  if (isRecord2(response) && isRawNodeResponse(response.raw)) return response.raw;
+  return null;
+}
+__name(resolveRawResponse, "resolveRawResponse");
+function sendRedirect(response, status, location) {
+  const raw = resolveRawResponse(response);
+  if (!raw) return;
+  raw.statusCode = status;
+  raw.setHeader("location", location);
+  raw.end();
+}
+__name(sendRedirect, "sendRedirect");
+
+// src/server/auth/session-cookie.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+var EXP_GRACE_MS = 3e4;
+function base64urlEncode(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+__name(base64urlEncode, "base64urlEncode");
+function base64urlDecode(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+__name(base64urlDecode, "base64urlDecode");
+function hmac(secret, payload) {
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+__name(hmac, "hmac");
+function signSessionCookie(user, options) {
+  const issuedAt = options.now ?? Date.now();
+  const session = {
+    sub: user.id,
+    ...user.name !== void 0 ? {
+      name: user.name
+    } : {},
+    roles: user.roles ?? [],
+    iat: issuedAt,
+    exp: issuedAt + options.ttlMs
+  };
+  const encodedPayload = base64urlEncode(JSON.stringify(session));
+  const signature = hmac(options.secret, encodedPayload);
+  return `${encodedPayload}.${signature}`;
+}
+__name(signSessionCookie, "signSessionCookie");
+function isSessionPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = {
+    ...value
+  };
+  if (typeof record.sub !== "string") return false;
+  if (record.name !== void 0 && typeof record.name !== "string") return false;
+  if (!Array.isArray(record.roles)) return false;
+  if (!record.roles.every((role) => typeof role === "string")) return false;
+  if (typeof record.iat !== "number" || !Number.isFinite(record.iat)) return false;
+  if (typeof record.exp !== "number" || !Number.isFinite(record.exp)) return false;
+  return true;
+}
+__name(isSessionPayload, "isSessionPayload");
+function verifySessionCookie(value, options) {
+  try {
+    const dot = value.indexOf(".");
+    if (dot <= 0 || dot === value.length - 1) return null;
+    const encodedPayload = value.slice(0, dot);
+    const providedSignature = value.slice(dot + 1);
+    const expectedSignature = hmac(options.secret, encodedPayload);
+    const provided = Buffer.from(providedSignature, "base64url");
+    const expected = Buffer.from(expectedSignature, "base64url");
+    if (provided.length !== expected.length) return null;
+    if (!timingSafeEqual(provided, expected)) return null;
+    const decoded = JSON.parse(base64urlDecode(encodedPayload));
+    if (!isSessionPayload(decoded)) return null;
+    const now = options.now ?? Date.now();
+    if (now > decoded.exp + EXP_GRACE_MS) return null;
+    const session = {
+      sub: decoded.sub,
+      ...decoded.name !== void 0 ? {
+        name: decoded.name
+      } : {},
+      roles: decoded.roles,
+      iat: decoded.iat,
+      exp: decoded.exp
+    };
+    return session;
+  } catch {
+    return null;
+  }
+}
+__name(verifySessionCookie, "verifySessionCookie");
+
+// src/server/auth/session-cookie-io.ts
+var SESSION_COOKIE_NAME = "agent_dashboard_session";
+var COOKIE_PATH = "/";
+function issueSessionCookie(user, context) {
+  const value = signSessionCookie(user, {
+    secret: context.auth.secret,
+    ttlMs: context.auth.ttlMs,
+    ...context.now !== void 0 ? {
+      now: context.now
+    } : {}
+  });
+  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, value, {
+    path: COOKIE_PATH,
+    maxAgeSeconds: Math.floor(context.auth.ttlMs / 1e3),
+    secure: isHttpsRequest(context.request)
+  });
+  appendSetCookie(context.response, cookie);
+}
+__name(issueSessionCookie, "issueSessionCookie");
+function clearSessionCookie(context) {
+  const cookie = serializeSetCookie(SESSION_COOKIE_NAME, "", {
+    path: COOKIE_PATH,
+    maxAgeSeconds: 0,
+    secure: isHttpsRequest(context.request),
+    clear: true
+  });
+  appendSetCookie(context.response, cookie);
+}
+__name(clearSessionCookie, "clearSessionCookie");
+
+// src/server/auth/dashboard-auth.guard.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var DashboardAuthGuard = class {
+  static {
+    __name(this, "DashboardAuthGuard");
+  }
+  auth;
+  constructor(auth) {
+    this.auth = auth;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) throw new UnauthorizedException();
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    const auth = this.auth;
+    if (!auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
+  * response, so an active user never gets logged out mid-session.
+  */
+  maybeRenew(response, request, session) {
+    const auth = this.auth;
+    if (!auth) return;
+    const now = Date.now();
+    if (now - session.iat <= auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth,
+      request,
+      response,
+      now
+    });
+  }
+};
+DashboardAuthGuard = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Optional()),
+  _ts_param(0, Inject(DASHBOARD_AUTH)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    Object
+  ])
+], DashboardAuthGuard);
 
 // src/server/dashboard.service.ts
 import { subscribe, unsubscribe } from "node:diagnostics_channel";
 import { channelName } from "@dudousxd/nestjs-diagnostics";
-import { Inject, Injectable, NotImplementedException, Optional } from "@nestjs/common";
+import { Inject as Inject2, Injectable as Injectable2, NotImplementedException, Optional as Optional2 } from "@nestjs/common";
 import { Observable as Observable2 } from "rxjs";
 
 // src/server/parse-approval-decision.ts
@@ -72,34 +408,24 @@ function isFiniteNonNegative(value) {
 }
 __name(isFiniteNonNegative, "isFiniteNonNegative");
 
-// src/server/tokens.ts
-var AGENT_GOVERNANCE_QUERIES = Symbol.for("@dudousxd/nestjs-agent:governance-queries");
-var AGENT_ACTOR_DIRECTORY = Symbol.for("@dudousxd/nestjs-agent:actor-directory");
-var AGENT_PRICING_STORE = Symbol.for("@dudousxd/nestjs-agent:pricing-store");
-var AGENT_APPROVAL_PORT = Symbol.for("@dudousxd/nestjs-agent:approval-port");
-var AGENT_ACTOR_RESOLVER = Symbol.for("@dudousxd/nestjs-agent:actor-resolver");
-var DASHBOARD_BASE_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:base-path");
-var DASHBOARD_API_PATH = Symbol.for("@dudousxd/nestjs-agent-dashboard:api-path");
-var DASHBOARD_APPROVAL_ACTOR_REF = Symbol.for("@dudousxd/nestjs-agent-dashboard:approval-actor-ref");
-
 // src/server/dashboard.service.ts
-function _ts_decorate(decorators, target, key, desc) {
+function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param, "_ts_param");
+__name(_ts_param2, "_ts_param");
 var PRICING_STORE_UNBOUND_MESSAGE = "Pricing CRUD is unavailable: no AGENT_PRICING_STORE is bound. Bind a pricing store (e.g. MikroOrmPricingStore from @dudousxd/nestjs-agent-store-mikro-orm) to enable it.";
 var APPROVAL_PORT_UNBOUND_MESSAGE = "Approve/reject is unavailable: no AGENT_APPROVAL_PORT is bound. Import AgentModule from @dudousxd/nestjs-agent alongside this dashboard to enable it \u2014 the approvals inbox stays read-only until then.";
 var AGENT_EVENTS = [
@@ -303,17 +629,17 @@ var DashboardService = class {
     });
   }
 };
-DashboardService = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Inject(AGENT_GOVERNANCE_QUERIES)),
-  _ts_param(1, Optional()),
-  _ts_param(1, Inject(AGENT_ACTOR_DIRECTORY)),
-  _ts_param(2, Optional()),
-  _ts_param(2, Inject(AGENT_PRICING_STORE)),
-  _ts_param(3, Optional()),
-  _ts_param(3, Inject(AGENT_APPROVAL_PORT)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+DashboardService = _ts_decorate2([
+  Injectable2(),
+  _ts_param2(0, Inject2(AGENT_GOVERNANCE_QUERIES)),
+  _ts_param2(1, Optional2()),
+  _ts_param2(1, Inject2(AGENT_ACTOR_DIRECTORY)),
+  _ts_param2(2, Optional2()),
+  _ts_param2(2, Inject2(AGENT_PRICING_STORE)),
+  _ts_param2(3, Optional2()),
+  _ts_param2(3, Inject2(AGENT_APPROVAL_PORT)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof AgentGovernanceQueries === "undefined" ? Object : AgentGovernanceQueries,
     typeof ActorDirectory === "undefined" ? Object : ActorDirectory,
     typeof AgentPricingStore === "undefined" ? Object : AgentPricingStore,
@@ -443,23 +769,23 @@ function parseRunWhere(raw) {
 __name(parseRunWhere, "parseRunWhere");
 
 // src/server/agent-api.controller.ts
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var DAY_MS = 864e5;
 var ISO_DAY2 = /^\d{4}-\d{2}-\d{2}$/;
 function utcDay(daysAgo) {
@@ -620,175 +946,469 @@ var AgentApiController = class {
     return this.dashboard.streamEvents();
   }
 };
-_ts_decorate2([
+_ts_decorate3([
   Get("spend"),
-  _ts_param2(0, Query("from")),
-  _ts_param2(1, Query("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("from")),
+  _ts_param3(1, Query("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "spend", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("top-threads"),
-  _ts_param2(0, Query("from")),
-  _ts_param2(1, Query("to")),
-  _ts_param2(2, Query("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("from")),
+  _ts_param3(1, Query("to")),
+  _ts_param3(2, Query("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "topThreads", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("reliability"),
-  _ts_param2(0, Query("from")),
-  _ts_param2(1, Query("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("from")),
+  _ts_param3(1, Query("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "reliability", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("runs"),
-  _ts_param2(0, Query("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runs", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("runs-page"),
-  _ts_param2(0, Query("page")),
-  _ts_param2(1, Query("limit")),
-  _ts_param2(2, Query("where")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("page")),
+  _ts_param3(1, Query("limit")),
+  _ts_param3(2, Query("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "runsPage", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("tool-calls"),
-  _ts_param2(0, Query("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCalls", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("tool-calls-page"),
-  _ts_param2(0, Query("page")),
-  _ts_param2(1, Query("limit")),
-  _ts_param2(2, Query("where")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("page")),
+  _ts_param3(1, Query("limit")),
+  _ts_param3(2, Query("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "toolCallsPage", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("approvals"),
-  _ts_param2(0, Query("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "approvals", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("approvals/:toolCallId"),
   HttpCode(204),
-  _ts_param2(0, Param("toolCallId")),
-  _ts_param2(1, Body()),
-  _ts_param2(2, Req()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Param("toolCallId")),
+  _ts_param3(1, Body()),
+  _ts_param3(2, Req()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     Object,
     Object
   ]),
-  _ts_metadata2("design:returntype", Promise)
+  _ts_metadata3("design:returntype", Promise)
 ], AgentApiController.prototype, "decideApproval", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("tools"),
-  _ts_param2(0, Query("from")),
-  _ts_param2(1, Query("to")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("from")),
+  _ts_param3(1, Query("to")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "tools", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("threads"),
-  _ts_param2(0, Query("limit")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("limit")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threads", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("threads-page"),
-  _ts_param2(0, Query("page")),
-  _ts_param2(1, Query("limit")),
-  _ts_param2(2, Query("where")),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Query("page")),
+  _ts_param3(1, Query("limit")),
+  _ts_param3(2, Query("where")),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     String,
     String,
     typeof Record === "undefined" ? Object : Record
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "threadsPage", null);
-_ts_decorate2([
+_ts_decorate3([
   Get("pricing"),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "listPrices", null);
-_ts_decorate2([
+_ts_decorate3([
   Post("pricing"),
-  _ts_param2(0, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  _ts_param3(0, Body()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     Object
   ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  _ts_metadata3("design:returntype", typeof Promise === "undefined" ? Object : Promise)
 ], AgentApiController.prototype, "upsertPrice", null);
-_ts_decorate2([
+_ts_decorate3([
   Sse("stream"),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", typeof Observable === "undefined" ? Object : Observable)
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:returntype", typeof Observable === "undefined" ? Object : Observable)
 ], AgentApiController.prototype, "stream", null);
-AgentApiController = _ts_decorate2([
+AgentApiController = _ts_decorate3([
   Controller(),
-  _ts_param2(1, Inject2(DASHBOARD_APPROVAL_ACTOR_REF)),
-  _ts_param2(2, Optional2()),
-  _ts_param2(2, Inject2(AGENT_ACTOR_RESOLVER)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+  UseGuards(DashboardAuthGuard),
+  _ts_param3(1, Inject3(DASHBOARD_APPROVAL_ACTOR_REF)),
+  _ts_param3(2, Optional3()),
+  _ts_param3(2, Inject3(AGENT_ACTOR_RESOLVER)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof DashboardService === "undefined" ? Object : DashboardService,
     Object,
     typeof ActorResolver === "undefined" ? Object : ActorResolver
   ])
 ], AgentApiController);
 
+// src/server/agent-dashboard-auth.controller.ts
+import { Body as Body2, Controller as Controller2, Get as Get2, Header, Inject as Inject4, Logger, NotFoundException, Optional as Optional4, Post as Post2, Query as Query2, Req as Req2, Res } from "@nestjs/common";
+
+// src/server/auth/login-page.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+__name(escapeHtml, "escapeHtml");
+function renderLoginPage(options) {
+  const action = escapeHtml(options.actionUrl);
+  const returnTo = escapeHtml(options.returnTo);
+  const errorBanner = options.error === true ? '<p role="alert" class="error">Invalid username or password.</p>' : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<meta name="robots" content="noindex, nofollow" />
+<title>Sign in \u2014 AI Gateway</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background: #09090b;
+    color: #e4e4e7;
+    font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    padding: 16px;
+  }
+  .card {
+    width: 100%;
+    max-width: 384px;
+    border: 1px solid #27272a;
+    background: #18181b;
+    border-radius: 8px;
+    padding: 32px;
+    box-shadow: 0 25px 50px -12px rgb(0 0 0 / 0.5);
+  }
+  .brand {
+    margin: 0 0 24px;
+    text-align: center;
+    font-size: 18px;
+    font-weight: 600;
+    color: #34d399;
+  }
+  form { display: flex; flex-direction: column; gap: 16px; }
+  label { display: flex; flex-direction: column; gap: 6px; }
+  .field-label {
+    font-size: 11px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: #71717a;
+  }
+  input {
+    border-radius: 4px;
+    border: 1px solid #3f3f46;
+    background: #09090b;
+    color: #f4f4f5;
+    padding: 8px 12px;
+    font: inherit;
+    outline: none;
+  }
+  input:focus { border-color: rgb(52 211 153 / 0.6); }
+  .error { margin: 0; font-size: 12px; color: #fb7185; }
+  button {
+    margin-top: 8px;
+    border-radius: 4px;
+    border: 1px solid rgb(52 211 153 / 0.4);
+    background: rgb(52 211 153 / 0.1);
+    color: #6ee7b7;
+    padding: 8px 12px;
+    font: inherit;
+    font-size: 12px;
+    font-weight: 500;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    cursor: pointer;
+  }
+  button:hover { background: rgb(52 211 153 / 0.2); }
+</style>
+</head>
+<body>
+  <div class="card">
+    <p class="brand">AI Gateway</p>
+    <form method="post" action="${action}">
+      <input type="hidden" name="returnTo" value="${returnTo}" />
+      <label>
+        <span class="field-label">Username</span>
+        <input type="text" name="username" autocomplete="username" autofocus />
+      </label>
+      <label>
+        <span class="field-label">Password</span>
+        <input type="password" name="password" autocomplete="current-password" />
+      </label>
+      ${errorBanner}
+      <button type="submit">Sign in</button>
+    </form>
+  </div>
+</body>
+</html>`;
+}
+__name(renderLoginPage, "renderLoginPage");
+
+// src/server/auth/sanitize-return-to.ts
+function sanitizeReturnTo(basePath, returnTo) {
+  if (typeof returnTo !== "string" || returnTo === "") return basePath;
+  if (!returnTo.startsWith("/") || returnTo.startsWith("//")) return basePath;
+  if (returnTo !== basePath && !returnTo.startsWith(`${basePath}/`) && !returnTo.startsWith(`${basePath}?`)) {
+    return basePath;
+  }
+  return returnTo;
+}
+__name(sanitizeReturnTo, "sanitizeReturnTo");
+
+// src/server/agent-dashboard-auth.controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+function isNonEmptyString(value) {
+  return typeof value === "string" && value !== "";
+}
+__name(isNonEmptyString, "isNonEmptyString");
+var AgentDashboardAuthController = class _AgentDashboardAuthController {
+  static {
+    __name(this, "AgentDashboardAuthController");
+  }
+  auth;
+  basePath;
+  logger = new Logger(_AgentDashboardAuthController.name);
+  /** Warn once (not per request) so a broken hook can't be used to flood the logs. */
+  warnedLoginHookThrow = false;
+  constructor(auth, basePath) {
+    this.auth = auth;
+    this.basePath = basePath;
+  }
+  loginPage(req, res, returnToQuery, error) {
+    this.requireAuth();
+    const returnTo = sanitizeReturnTo(this.basePath, returnToQuery);
+    if (this.currentSession(req)) {
+      res.status(302);
+      res.setHeader("Location", returnTo);
+      return "";
+    }
+    return renderLoginPage({
+      actionUrl: `${this.basePath}/auth/login`,
+      returnTo,
+      error: error !== void 0
+    });
+  }
+  async login(body, req, res) {
+    const auth = this.requireAuth();
+    const returnTo = sanitizeReturnTo(this.basePath, body?.returnTo);
+    const username = body?.username;
+    const password = body?.password;
+    if (!isNonEmptyString(username) || !isNonEmptyString(password)) {
+      this.redirectToLoginError(res, returnTo);
+      return "";
+    }
+    const user = await this.runLoginHook(auth, username, password);
+    if (!user) {
+      this.redirectToLoginError(res, returnTo);
+      return "";
+    }
+    issueSessionCookie(user, {
+      auth,
+      request: req,
+      response: res
+    });
+    res.status(302);
+    res.setHeader("Location", returnTo);
+    return "";
+  }
+  logout(req, res) {
+    clearSessionCookie({
+      request: req,
+      response: res
+    });
+    res.status(302);
+    res.setHeader("Location", `${this.basePath}/auth/login`);
+    return "";
+  }
+  /** Uniform failure: same redirect (generic error flag) whether the user is unknown or the password is wrong. */
+  redirectToLoginError(res, returnTo) {
+    res.status(303);
+    res.setHeader("Location", `${this.basePath}/auth/login?error=1&returnTo=${encodeURIComponent(returnTo)}`);
+  }
+  currentSession(req) {
+    const auth = this.auth;
+    if (!auth) return false;
+    const cookieValue = parseCookieHeader(readCookieHeader(req))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return false;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    }) !== null;
+  }
+  /**
+  * Run the host's `login` hook defensively: a throw (sync or async) is treated as a denial
+  * (`null`) and warn-logged ONCE, so a buggy/unreachable hook never 500s the endpoint into a
+  * stack-trace leak nor floods the logs.
+  */
+  async runLoginHook(auth, username, password) {
+    try {
+      return await auth.login(username, password) ?? null;
+    } catch (error) {
+      if (!this.warnedLoginHookThrow) {
+        this.warnedLoginHookThrow = true;
+        this.logger.warn(`AgentDashboardModule dashboardAuth login hook threw; treating as denial. ${error instanceof Error ? error.message : String(error)}`);
+      }
+      return null;
+    }
+  }
+  requireAuth() {
+    if (!this.auth) throw new NotFoundException();
+    return this.auth;
+  }
+};
+_ts_decorate4([
+  Get2("login"),
+  Header("Content-Type", "text/html; charset=utf-8"),
+  Header("Cache-Control", "no-store"),
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_param4(2, Query2("returnTo")),
+  _ts_param4(3, Query2("error")),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof AuthPageRequest === "undefined" ? Object : AuthPageRequest,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse,
+    String,
+    String
+  ]),
+  _ts_metadata4("design:returntype", String)
+], AgentDashboardAuthController.prototype, "loginPage", null);
+_ts_decorate4([
+  Post2("login"),
+  _ts_param4(0, Body2()),
+  _ts_param4(1, Req2()),
+  _ts_param4(2, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof LoginFormBody === "undefined" ? Object : LoginFormBody,
+    Object,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], AgentDashboardAuthController.prototype, "login", null);
+_ts_decorate4([
+  Post2("logout"),
+  _ts_param4(0, Req2()),
+  _ts_param4(1, Res({
+    passthrough: true
+  })),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    typeof AuthPageResponse === "undefined" ? Object : AuthPageResponse
+  ]),
+  _ts_metadata4("design:returntype", String)
+], AgentDashboardAuthController.prototype, "logout", null);
+AgentDashboardAuthController = _ts_decorate4([
+  Controller2("auth"),
+  _ts_param4(0, Optional4()),
+  _ts_param4(0, Inject4(DASHBOARD_AUTH)),
+  _ts_param4(1, Inject4(DASHBOARD_BASE_PATH)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    Object,
+    String
+  ])
+], AgentDashboardAuthController);
+
 // src/server/normalize-path.ts
 function normalizeDashboardPath(path) {
   return `/${path.replace(/^\/+|\/+$/g, "")}`;
@@ -823,24 +1443,147 @@ import { RouterModule } from "@nestjs/core";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, extname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Controller as Controller2, Get as Get2, Header, Inject as Inject3, NotFoundException, Param as Param2, Req as Req2, Res, StreamableFile } from "@nestjs/common";
-function _ts_decorate3(decorators, target, key, desc) {
+import { Controller as Controller3, Get as Get3, Header as Header2, Inject as Inject6, NotFoundException as NotFoundException2, Param as Param2, Req as Req3, Res as Res2, StreamableFile, UseFilters, UseGuards as UseGuards2 } from "@nestjs/common";
+
+// src/server/auth/dashboard-auth-page.guard.ts
+import { Inject as Inject5, Injectable as Injectable4, Optional as Optional5 } from "@nestjs/common";
+
+// src/server/auth/dashboard-auth-redirect.ts
+import { Catch, Injectable as Injectable3 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+var DashboardAuthRedirect = class extends Error {
+  static {
+    __name(this, "DashboardAuthRedirect");
+  }
+  redirectTo;
+  constructor(redirectTo) {
+    super(`Redirect to ${redirectTo}`), this.redirectTo = redirectTo;
+    this.name = "DashboardAuthRedirect";
+  }
+};
+var DashboardAuthRedirectFilter = class {
+  static {
+    __name(this, "DashboardAuthRedirectFilter");
+  }
+  catch(exception, host) {
+    const response = host.switchToHttp().getResponse();
+    sendRedirect(response, 302, exception.redirectTo);
+  }
+};
+DashboardAuthRedirectFilter = _ts_decorate5([
+  Injectable3(),
+  Catch(DashboardAuthRedirect)
+], DashboardAuthRedirectFilter);
+
+// src/server/auth/dashboard-auth-page.guard.ts
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param5, "_ts_param");
+var DashboardAuthPageGuard = class {
+  static {
+    __name(this, "DashboardAuthPageGuard");
+  }
+  auth;
+  basePath;
+  constructor(auth, basePath) {
+    this.auth = auth;
+    this.basePath = basePath;
+  }
+  canActivate(context) {
+    if (!this.auth) return true;
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const session = this.verifyRequestSession(request);
+    if (!session) {
+      const returnTo = readOriginalUrl(request);
+      throw new DashboardAuthRedirect(`${this.basePath}/auth/login?returnTo=${encodeURIComponent(returnTo)}`);
+    }
+    attachSession(request, session);
+    this.maybeRenew(http.getResponse(), request, session);
+    return true;
+  }
+  verifyRequestSession(request) {
+    const auth = this.auth;
+    if (!auth) return null;
+    const cookieValue = parseCookieHeader(readCookieHeader(request))[SESSION_COOKIE_NAME];
+    if (cookieValue === void 0) return null;
+    return verifySessionCookie(cookieValue, {
+      secret: auth.secret
+    });
+  }
+  /**
+  * Sliding renewal: a valid cookie past 50% of its TTL is transparently re-issued on the
+  * response, so an active user never gets logged out mid-session.
+  */
+  maybeRenew(response, request, session) {
+    const auth = this.auth;
+    if (!auth) return;
+    const now = Date.now();
+    if (now - session.iat <= auth.ttlMs / 2) return;
+    issueSessionCookie({
+      id: session.sub,
+      ...session.name !== void 0 ? {
+        name: session.name
+      } : {},
+      roles: session.roles
+    }, {
+      auth,
+      request,
+      response,
+      now
+    });
+  }
+};
+DashboardAuthPageGuard = _ts_decorate6([
+  Injectable4(),
+  _ts_param5(0, Optional5()),
+  _ts_param5(0, Inject5(DASHBOARD_AUTH)),
+  _ts_param5(1, Inject5(DASHBOARD_BASE_PATH)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    Object,
+    String
+  ])
+], DashboardAuthPageGuard);
+
+// src/server/agent-ui.controller.ts
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
 var BUILD_BASE = "/ai-gateway";
 function spaDir() {
   return fileURLToPath(new URL("../spa", import.meta.url));
@@ -876,7 +1619,7 @@ var AgentUiController = class {
     }
     const indexPath = join(this.dir, "index.html");
     if (!existsSync(indexPath)) {
-      throw new NotFoundException("Dashboard is not built. Run the package build.");
+      throw new NotFoundException2("Dashboard is not built. Run the package build.");
     }
     const html = readFileSync(indexPath, "utf8").replaceAll(`="${BUILD_BASE}/`, `="${this.basePath}/`);
     const inject = `<script>window.__AGENT_BASE__='${this.basePath}';window.__AGENT_API__='${this.apiBasePath}';</script>`;
@@ -884,11 +1627,11 @@ var AgentUiController = class {
   }
   asset(file) {
     const safe = basename(file);
-    if (safe !== file) throw new NotFoundException();
+    if (safe !== file) throw new NotFoundException2();
     const root = resolve(this.dir, "assets");
     const assetPath = resolve(root, safe);
     if (!assetPath.startsWith(root + sep) || !existsSync(assetPath)) {
-      throw new NotFoundException();
+      throw new NotFoundException2();
     }
     const type = CONTENT_TYPES[extname(safe)] ?? "application/octet-stream";
     return new StreamableFile(readFileSync(assetPath), {
@@ -896,66 +1639,135 @@ var AgentUiController = class {
     });
   }
 };
-_ts_decorate3([
-  Get2(),
-  Header("Content-Type", "text/html; charset=utf-8"),
-  Header("Cache-Control", "no-store, must-revalidate"),
-  _ts_param3(0, Req2()),
-  _ts_param3(1, Res({
+_ts_decorate7([
+  Get3(),
+  Header2("Content-Type", "text/html; charset=utf-8"),
+  Header2("Cache-Control", "no-store, must-revalidate"),
+  _ts_param6(0, Req3()),
+  _ts_param6(1, Res2({
     passthrough: true
   })),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof UiPageRequest === "undefined" ? Object : UiPageRequest,
     typeof UiPageResponse === "undefined" ? Object : UiPageResponse
   ]),
-  _ts_metadata3("design:returntype", String)
+  _ts_metadata6("design:returntype", String)
 ], AgentUiController.prototype, "index", null);
-_ts_decorate3([
-  Get2("assets/:file"),
-  Header("Cache-Control", "public, max-age=31536000, immutable"),
-  _ts_param3(0, Param2("file")),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+_ts_decorate7([
+  Get3("assets/:file"),
+  Header2("Cache-Control", "public, max-age=31536000, immutable"),
+  _ts_param6(0, Param2("file")),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String
   ]),
-  _ts_metadata3("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
+  _ts_metadata6("design:returntype", typeof StreamableFile === "undefined" ? Object : StreamableFile)
 ], AgentUiController.prototype, "asset", null);
-AgentUiController = _ts_decorate3([
-  Controller2(),
-  _ts_param3(0, Inject3(DASHBOARD_BASE_PATH)),
-  _ts_param3(1, Inject3(DASHBOARD_API_PATH)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+AgentUiController = _ts_decorate7([
+  Controller3(),
+  UseGuards2(DashboardAuthPageGuard),
+  UseFilters(new DashboardAuthRedirectFilter()),
+  _ts_param6(0, Inject6(DASHBOARD_BASE_PATH)),
+  _ts_param6(1, Inject6(DASHBOARD_API_PATH)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     String,
     String
   ])
 ], AgentUiController);
 
+// src/server/auth/dashboard-auth-config.ts
+var DEFAULT_TTL = "8h";
+function unitToMs(unit) {
+  switch (unit) {
+    case "ms":
+      return 1;
+    case "s":
+      return 1e3;
+    case "m":
+      return 6e4;
+    case "h":
+      return 36e5;
+    case "d":
+      return 864e5;
+    default:
+      return void 0;
+  }
+}
+__name(unitToMs, "unitToMs");
+function durationToMs(duration) {
+  const match = /^(\d+)(ms|s|m|h|d)$/.exec(duration.trim());
+  const amount = match?.[1];
+  const unit = match?.[2] !== void 0 ? unitToMs(match[2]) : void 0;
+  if (amount === void 0 || unit === void 0) {
+    throw new Error(`AgentDashboardModule dashboardAuth: invalid \`ttl\` duration: ${duration}`);
+  }
+  return Number(amount) * unit;
+}
+__name(durationToMs, "durationToMs");
+function resolveDashboardAuth(options) {
+  if (options === void 0) return null;
+  if (typeof options.secret !== "string" || options.secret === "") {
+    throw new Error("AgentDashboardModule dashboardAuth: `secret` is required and must be a non-empty string (HMAC-SHA256 signing key, 32+ bytes recommended). Failing closed.");
+  }
+  if (typeof options.login !== "function") {
+    throw new Error("AgentDashboardModule dashboardAuth: `login` is required (validates submitted credentials for the built-in login screen). Failing closed.");
+  }
+  return {
+    secret: options.secret,
+    ttlMs: durationToMs(options.ttl ?? DEFAULT_TTL),
+    login: options.login
+  };
+}
+__name(resolveDashboardAuth, "resolveDashboardAuth");
+
+// src/server/guards.ts
+import "reflect-metadata";
+var GUARDS_METADATA = "__guards__";
+function isGuardClass(guard) {
+  return typeof guard === "function";
+}
+__name(isGuardClass, "isGuardClass");
+function baseGuards(controller) {
+  return Reflect.getOwnMetadata(GUARDS_METADATA, controller) ?? [];
+}
+__name(baseGuards, "baseGuards");
+function stampGuards(guards, entries) {
+  for (const [controller, base] of entries) {
+    Reflect.defineMetadata(GUARDS_METADATA, [
+      ...base,
+      ...guards ?? []
+    ], controller);
+  }
+}
+__name(stampGuards, "stampGuards");
+
 // src/server/agent-dashboard.module.ts
-function _ts_decorate4(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-var GUARDS_METADATA = "__guards__";
+__name(_ts_decorate8, "_ts_decorate");
+var API_BASE_GUARDS = baseGuards(AgentApiController);
+var UI_BASE_GUARDS = baseGuards(AgentUiController);
 function normalize(path) {
   return normalizeDashboardPath(path);
 }
 __name(normalize, "normalize");
-function stampGuards(guards, ...controllers) {
-  for (const controller of controllers) {
-    Reflect.defineMetadata(GUARDS_METADATA, guards ?? [], controller);
-  }
-}
-__name(stampGuards, "stampGuards");
 var AgentApiModule = class _AgentApiModule {
   static {
     __name(this, "AgentApiModule");
   }
   static register(options) {
+    stampGuards(options.guards, [
+      [
+        AgentApiController,
+        API_BASE_GUARDS
+      ]
+    ]);
     return {
       module: _AgentApiModule,
       imports: [
@@ -966,7 +1778,9 @@ var AgentApiModule = class _AgentApiModule {
       ],
       providers: [
         DashboardService,
-        ...options.guards ?? [],
+        DashboardAuthGuard,
+        options.dashboardAuth,
+        ...(options.guards ?? []).filter(isGuardClass),
         // `useValue` even when `options.approvalActorRef` is `undefined` — AgentApiController
         // injects this WITHOUT `@Optional()` (same pattern as `AGENT_QUOTA_STORE`'s factory).
         {
@@ -974,13 +1788,17 @@ var AgentApiModule = class _AgentApiModule {
           useValue: options.approvalActorRef
         }
       ],
+      // DASHBOARD_AUTH re-exported so AgentUiController/AgentDashboardAuthController (hosted
+      // directly by AgentDashboardModule, which imports this module) resolve the SAME instance
+      // instead of re-running a host's async factory a second time.
       exports: [
-        DashboardService
+        DashboardService,
+        DASHBOARD_AUTH
       ]
     };
   }
 };
-AgentApiModule = _ts_decorate4([
+AgentApiModule = _ts_decorate8([
   Module({})
 ], AgentApiModule);
 var AgentDashboardModule = class _AgentDashboardModule {
@@ -990,7 +1808,16 @@ var AgentDashboardModule = class _AgentDashboardModule {
   static forRoot(options = {}) {
     const basePath = normalize(options.basePath ?? "/ai-gateway");
     const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
-    stampGuards(options.guards, AgentApiController, AgentUiController);
+    stampGuards(options.guards, [
+      [
+        AgentUiController,
+        UI_BASE_GUARDS
+      ]
+    ]);
+    const dashboardAuthProvider = {
+      provide: DASHBOARD_AUTH,
+      useValue: resolveDashboardAuth(options.dashboardAuth)
+    };
     return {
       module: _AgentDashboardModule,
       imports: [
@@ -1007,7 +1834,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
           } : {},
           ...options.approvalActorRef ? {
             approvalActorRef: options.approvalActorRef
-          } : {}
+          } : {},
+          dashboardAuth: dashboardAuthProvider
         }),
         RouterModule.register([
           {
@@ -1021,7 +1849,8 @@ var AgentDashboardModule = class _AgentDashboardModule {
         ])
       ],
       controllers: [
-        AgentUiController
+        AgentUiController,
+        AgentDashboardAuthController
       ],
       providers: [
         {
@@ -1032,8 +1861,9 @@ var AgentDashboardModule = class _AgentDashboardModule {
           provide: DASHBOARD_API_PATH,
           useValue: apiBasePath
         },
+        DashboardAuthPageGuard,
         // AgentUiController is hosted HERE, so its guards DI-instantiate from this module.
-        ...options.guards ?? []
+        ...(options.guards ?? []).filter(isGuardClass)
       ],
       // Re-export the API module so its DashboardService reaches importers (e.g. the host's own controllers).
       exports: [
@@ -1041,8 +1871,70 @@ var AgentDashboardModule = class _AgentDashboardModule {
       ]
     };
   }
+  static forRootAsync(options) {
+    const basePath = normalize(options.basePath ?? "/ai-gateway");
+    const apiBasePath = normalize(options.apiBasePath ?? `${basePath}/api`);
+    stampGuards(options.guards, [
+      [
+        AgentUiController,
+        UI_BASE_GUARDS
+      ]
+    ]);
+    const dashboardAuthProvider = {
+      provide: DASHBOARD_AUTH,
+      inject: options.inject ?? [],
+      useFactory: /* @__PURE__ */ __name(async (...deps) => resolveDashboardAuth(await options.useDashboardAuth(...deps)), "useFactory")
+    };
+    return {
+      module: _AgentDashboardModule,
+      imports: [
+        ...options.imports ?? [],
+        AgentApiModule.register({
+          ...options.imports ? {
+            imports: options.imports
+          } : {},
+          ...options.guards ? {
+            guards: options.guards
+          } : {},
+          ...options.approvalActorRef ? {
+            approvalActorRef: options.approvalActorRef
+          } : {},
+          dashboardAuth: dashboardAuthProvider
+        }),
+        RouterModule.register([
+          {
+            path: basePath,
+            module: _AgentDashboardModule
+          },
+          {
+            path: apiBasePath,
+            module: AgentApiModule
+          }
+        ])
+      ],
+      controllers: [
+        AgentUiController,
+        AgentDashboardAuthController
+      ],
+      providers: [
+        {
+          provide: DASHBOARD_BASE_PATH,
+          useValue: basePath
+        },
+        {
+          provide: DASHBOARD_API_PATH,
+          useValue: apiBasePath
+        },
+        DashboardAuthPageGuard,
+        ...(options.guards ?? []).filter(isGuardClass)
+      ],
+      exports: [
+        AgentApiModule
+      ]
+    };
+  }
 };
-AgentDashboardModule = _ts_decorate4([
+AgentDashboardModule = _ts_decorate8([
   Module({})
 ], AgentDashboardModule);
 export {
@@ -1053,13 +1945,16 @@ export {
   AGENT_PRICING_STORE,
   AgentApiController,
   AgentApiModule,
+  AgentDashboardAuthController,
   AgentDashboardModule,
   AgentUiController,
   DASHBOARD_API_PATH,
   DASHBOARD_APPROVAL_ACTOR_REF,
+  DASHBOARD_AUTH,
   DASHBOARD_BASE_PATH,
   DashboardService,
   agentDashboardMountPaths,
-  parsePriceInput
+  parsePriceInput,
+  resolveDashboardAuth
 };
 //# sourceMappingURL=index.js.map