@bd7pil/ocrc 0.9.0

package/dist/transport/telegram/types/question.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"question.js","sourceRoot":"","sources":["../../../../src/transport/telegram/types/question.ts"],"names":[],"mappings":""}

package/dist/transport/telegram/types/rename.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rename.js.map

package/dist/transport/telegram/types/rename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.js","sourceRoot":"","sources":["../../../../src/transport/telegram/types/rename.ts"],"names":[],"mappings":""}

package/dist/transport/telegram/types/scheduled-task.js

@@ -0,0 +1,23 @@
+export const DEFAULT_TASK_AGENT = "build";
+export function createScheduledTaskModel(model) {
+    return {
+        providerID: model.providerID,
+        modelID: model.modelID,
+        variant: model.variant ?? null,
+    };
+}
+export function cloneParsedTaskSchedule(schedule) {
+    return { ...schedule };
+}
+export function cloneScheduledTaskModel(model) {
+    return { ...model };
+}
+export function cloneScheduledTask(task) {
+    return {
+        ...task,
+        // Backfill for tasks persisted before the agent field existed (they ran with "build").
+        agent: task.agent ?? DEFAULT_TASK_AGENT,
+        model: cloneScheduledTaskModel(task.model),
+    };
+}
+//# sourceMappingURL=scheduled-task.js.map

package/dist/transport/telegram/types/scheduled-task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-task.js","sourceRoot":"","sources":["../../../../src/transport/telegram/types/scheduled-task.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAuE1C,MAAM,UAAU,wBAAwB,CAAC,KAAgB;IACvD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA4B;IAClE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,OAAO;QACL,GAAG,IAAI;QACP,uFAAuF;QACvF,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,kBAAkB;QACvC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/transport/telegram/types/session.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session.js.map

package/dist/transport/telegram/types/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/transport/telegram/types/session.ts"],"names":[],"mappings":""}

package/dist/transport/telegram/ui.js

@@ -0,0 +1,28 @@
+// Minimal Telegram-UI and error helpers shared by the grammY transport.
+// These preserve the old Markup call-shapes (spread-friendly {reply_markup})
+// so call sites stay a mechanical find/replace, and read both grammY's
+// top-level error fields and the legacy response-envelope shape.
+import { InlineKeyboard } from 'grammy';
+export const btn = (text, callback_data) => ({ text, callback_data });
+/** Build an InlineKeyboard from row arrays; returns {reply_markup} for spreading into reply opts. */
+export function inlineKeyboard(rows) {
+    let kb = new InlineKeyboard();
+    rows.forEach((row, i) => {
+        for (const b of row)
+            kb = kb.text(b.text, b.callback_data);
+        if (i < rows.length - 1)
+            kb = kb.row();
+    });
+    return { reply_markup: kb };
+}
+/** Telegram API error code — grammY raises GrammyError with a top-level code. */
+export function errorCodeOf(e) {
+    const anyE = e;
+    return anyE?.error_code ?? anyE?.response?.error_code;
+}
+/** retry_after from a 429 — grammY exposes it on the error's parameters. */
+export function retryAfterOf(e) {
+    const anyE = e;
+    return anyE?.parameters?.retry_after ?? anyE?.response?.parameters?.retry_after;
+}
+//# sourceMappingURL=ui.js.map

package/dist/transport/telegram/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../../src/transport/telegram/ui.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,6EAA6E;AAC7E,uEAAuE;AACvE,iEAAiE;AAEjE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAOvC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,aAAqB,EAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;AAE5F,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,IAAI,EAAE,GAAG,IAAI,cAAc,EAAE,CAAA;IAC7B,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,GAAG;YAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAA;QAC1D,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,MAAM,IAAI,GAAG,CAAQ,CAAA;IACrB,OAAO,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAA;AACvD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,IAAI,GAAG,CAAQ,CAAA;IACrB,OAAO,IAAI,EAAE,UAAU,EAAE,WAAW,IAAI,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAA;AACjF,CAAC"}

package/dist/transport/web/index.js

@@ -0,0 +1,148 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { serve } from '@hono/node-server';
+import { WebSocketServer } from 'ws';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { buildServer } from './server.js';
+import { createWsHub } from './ws-hub.js';
+import { createLogger } from '../../utils/logger.js';
+const log = createLogger('web');
+const CAPS = {
+    edit: true, maxMessageLength: Number.POSITIVE_INFINITY,
+    buttons: true, richText: true, streaming: true,
+};
+export function createWebTransport(cfg) {
+    let messageHandler;
+    let server;
+    let wss;
+    return {
+        name: 'web',
+        capabilities: CAPS,
+        async start(deps) {
+            if (!existsSync(cfg.staticRoot)) {
+                throw new Error(`Web static root not found: ${cfg.staticRoot}. Run 'cd web && npm run build' first.`);
+            }
+            const wsHub = createWsHub({ cardBus: deps.cardBus, registry: cfg.registry, state: deps.state });
+            const app = buildServer({
+                auth: cfg.auth,
+                registry: cfg.registry,
+                state: deps.state,
+                cardBus: deps.cardBus,
+                onMessage: (msg) => messageHandler ? messageHandler(msg) : Promise.resolve(),
+                scheduler: cfg.scheduler,
+                channels: cfg.channels,
+                telegramStatus: cfg.telegramStatus,
+            });
+            // Immutable hashed assets cache forever; everything else (above all
+            // index.html, which references those hashes) must revalidate on every
+            // load — a cached stale index points at deleted hashes and the app
+            // half-loads after any redeploy ("every refresh looks different").
+            app.use('/_app/immutable/*', async (c, next) => {
+                await next();
+                c.header('Cache-Control', 'public, max-age=31536000, immutable');
+            });
+            // index.html — served BOTH as the static file ('/') and by the SPA
+            // fallback below — must always revalidate.
+            app.use(async (c, next) => {
+                await next();
+                if (c.req.path === '/' || c.req.path === '/index.html') {
+                    c.header('Cache-Control', 'no-cache');
+                }
+            });
+            app.use('/*', serveStatic({ root: cfg.staticRoot }));
+            // SPA fallback — SvelteKit static adapter only prerenders index.html;
+            // dynamic routes like /[sessionId]/ resolve client-side, so any non-API
+            // path that doesn't match a real file must serve index.html.
+            // Critical: ONLY fall back navigation-style paths. If a missing asset
+            // (e.g. stale /_app/old-hash.js a cached browser still asks for) gets
+            // index.html, the browser sees text/html where it expects JS and the
+            // whole module graph silently stalls.
+            const indexHtmlPath = join(cfg.staticRoot, 'index.html');
+            // Read once at startup — the previous per-request readFileSync put a
+            // synchronous disk hit on every unmatched GET.
+            const indexHtml = readFileSync(indexHtmlPath, 'utf-8');
+            app.get('*', (c) => {
+                const path = c.req.path;
+                if (path.startsWith('/api/') || path === '/ws')
+                    return c.notFound();
+                return c.html(indexHtml);
+            });
+            // serve() returns immediately and bind errors (EADDRINUSE, EACCES) only
+            // surface as an async 'error' event. Await the listening callback so a
+            // failed bind REJECTS start() — the entrypoint's transport retry loop
+            // (1s→30s backoff) then actually recovers, e.g. when the port is held by
+            // a still-shutting-down predecessor. Without this, the error used to end
+            // up an uncaughtException that installProcessGuards() swallows, leaving
+            // the transport "started" but silently unbound.
+            server = await new Promise((resolveBind, rejectBind) => {
+                const s = serve({ fetch: app.fetch, hostname: cfg.host, port: cfg.port }, (info) => {
+                    log.info(`web transport listening on http://${info.address}:${info.port}`);
+                    resolveBind(s);
+                });
+                s.once('error', rejectBind);
+            });
+            server.on('error', (err) => {
+                log.error(`web transport error after bind: ${err.message}`);
+                setImmediate(() => { throw err; });
+            });
+            // Clients only ever send ping/subscribe — cap frames well below the 100MiB
+            // default so a rogue client can't exhaust memory.
+            wss = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 });
+            server.on('upgrade', async (req, socket, head) => {
+                const hasCookie = !!req.headers?.cookie;
+                const hasAccessHdr = !!req.headers?.['cf-access-jwt-assertion'];
+                const reqUrl = new URL(req.url, 'http://localhost');
+                log.info(`ws upgrade attempt path=${reqUrl.pathname} cookie=${hasCookie} cf-access-hdr=${hasAccessHdr}`);
+                if (reqUrl.pathname !== '/ws') {
+                    log.info(`ws upgrade rejected: wrong path=${reqUrl.pathname}`);
+                    socket.destroy();
+                    return;
+                }
+                // Auth: delegate to the configured strategy (token or CF Access). A throw
+                // here would otherwise hang the TCP socket and raise unhandledRejection.
+                let user;
+                try {
+                    user = await cfg.auth.verifyUpgrade({ headers: req.headers, url: req.url, socket: req.socket });
+                }
+                catch (e) {
+                    log.warn(`ws upgrade rejected: verifyUpgrade threw: ${e.message}`);
+                    socket.destroy();
+                    return;
+                }
+                if (!user) {
+                    log.warn(`ws upgrade rejected: JWT verify failed (cookie=${hasCookie} cf-access-hdr=${hasAccessHdr})`);
+                    socket.destroy();
+                    return;
+                }
+                const wsUser = { email: user.email ?? user.sub ?? 'user' };
+                log.info(`ws upgrade accepted: ${wsUser.email}`);
+                wss.handleUpgrade(req, socket, head, (ws) => {
+                    log.info(`ws handleUpgrade callback fired, attaching`);
+                    wsHub.attach(ws, wsUser);
+                    ws.on('message', (data) => {
+                        try {
+                            wsHub.handleClientMessage(ws, JSON.parse(data.toString()));
+                        }
+                        catch { }
+                    });
+                    ws.on('close', (code, reason) => {
+                        log.info(`ws closed code=${code} reason="${reason.toString()}"`);
+                        wsHub.detach(ws);
+                    });
+                    ws.on('error', (err) => log.warn(`ws error: ${err.message}`));
+                });
+            });
+        },
+        async stop() {
+            wss?.close();
+            server?.close();
+        },
+        async send(_chatId, _card) {
+            throw new Error('Transport.send not implemented for Web in v0.5.0 (use cardBus.publish)');
+        },
+        onMessage(h) { messageHandler = h; },
+        onCommand() { },
+        onButtonClick() { },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/transport/web/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/transport/web/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAK5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAIpD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;AAe/B,MAAM,IAAI,GAAwB;IAChC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;IACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;CAC/C,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,cAAqE,CAAA;IACzE,IAAI,MAA8B,CAAA;IAClC,IAAI,GAAgC,CAAA;IAEpC,OAAO;QACL,IAAI,EAAE,KAAK;QACX,YAAY,EAAE,IAAI;QAClB,KAAK,CAAC,KAAK,CAAC,IAAwB;YAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,UAAU,wCAAwC,CAAC,CAAA;YACvG,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YAC/F,MAAM,GAAG,GAAG,WAAW,CAAC;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;gBAC5E,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAC,CAAA;YAEF,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBAC7C,MAAM,IAAI,EAAE,CAAA;gBACZ,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;YACF,mEAAmE;YACnE,2CAA2C;YAC3C,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,IAAI,EAAE,CAAA;gBACZ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACvD,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;YAEpD,sEAAsE;YACtE,wEAAwE;YACxE,6DAA6D;YAC7D,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;YACxD,qEAAqE;YACrE,+CAA+C;YAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;YACtD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;gBACjB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;gBACvB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,KAAK;oBAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;gBACnE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,gDAAgD;YAChD,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;gBACrD,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;oBACjF,GAAG,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;oBAC1E,WAAW,CAAC,CAAC,CAAC,CAAA;gBAChB,CAAC,CAAC,CAAA;gBACF,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC7B,CAAC,CAAC,CAGD;YAAC,MAAc,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAC1C,GAAG,CAAC,KAAK,CAAC,mCAAmC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC3D,YAAY,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,CAAA,CAAC,CAAC,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;YAEF,2EAA2E;YAC3E,kDAAkD;YAClD,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CACnE;YAAC,MAAc,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAQ,EAAE,MAAW,EAAE,IAAS,EAAE,EAAE;gBACxE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAA;gBACvC,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,yBAAyB,CAAC,CAAA;gBAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;gBACnD,GAAG,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,QAAQ,WAAW,SAAS,kBAAkB,YAAY,EAAE,CAAC,CAAA;gBACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;oBAC9D,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,OAAM;gBACR,CAAC;gBACD,0EAA0E;gBAC1E,yEAAyE;gBACzE,IAAI,IAAI,CAAA;gBACR,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CACjC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAC3D,CAAA;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,6CAA8C,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;oBAC7E,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,IAAI,CAAC,kDAAkD,SAAS,kBAAkB,YAAY,GAAG,CAAC,CAAA;oBACtG,MAAM,CAAC,OAAO,EAAE,CAAA;oBAChB,OAAM;gBACR,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAAA;gBAC1D,GAAG,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;gBAChD,GAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;oBAC3C,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;oBACtD,KAAK,CAAC,MAAM,CAAC,EAAS,EAAE,MAAM,CAAC,CAAA;oBAC/B,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;wBACxB,IAAI,CAAC;4BAAC,KAAK,CAAC,mBAAmB,CAAC,EAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAA,CAAC;oBACpF,CAAC,CAAC,CAAA;oBACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;wBAC9B,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,YAAY,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;wBAChE,KAAK,CAAC,MAAM,CAAC,EAAS,CAAC,CAAA;oBACzB,CAAC,CAAC,CAAA;oBACF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBAC/D,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,IAAI;YACR,GAAG,EAAE,KAAK,EAAE,CAAA;YACZ,MAAM,EAAE,KAAK,EAAE,CAAA;QACjB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAqB;YACvC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,SAAS,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAA,CAAC,CAAC;QACnC,SAAS,KAAK,CAAC;QACf,aAAa,KAAK,CAAC;KACpB,CAAA;AACH,CAAC"}

package/dist/transport/web/middleware/cf-access.js

@@ -0,0 +1,104 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+function isLoopbackAddr(addr) {
+    if (!addr)
+        return false;
+    // Strip IPv6 prefix
+    const clean = addr.replace(/^::ffff:/, '').split('%')[0];
+    return clean === '127.0.0.1' || clean === '::1';
+}
+/**
+ * Whether dev bypass should grant access for this request.
+ *
+ * When the real peer address is known, ONLY a loopback peer qualifies — a
+ * remote peer must never be bypassed just because the server binds to loopback,
+ * otherwise host-header spoofing behind a tunnel (peer is 127.0.0.1 but the
+ * real client is remote) would defeat CF Access. Only when the peer address is
+ * unavailable (Bun/Nitropack, where raw socket info isn't exposed) do we fall
+ * back to opts.host.
+ *
+ * WARNING: with devBypass on, a same-host cloudflared/quick-tunnel makes ALL
+ * remote traffic arrive from 127.0.0.1 — every request looks loopback and auth
+ * is silently wide open. Never combine devBypass with a tunnel; a startup
+ * warning is logged when devBypass is enabled (see createCfAccessAuth).
+ */
+function devBypassAllowed(peer, opts) {
+    if (!opts.devBypass)
+        return false;
+    const peerKnown = peer !== undefined && peer !== '';
+    return peerKnown ? isLoopbackAddr(peer) : isLoopbackAddr(opts.host);
+}
+function remoteAddr(c) {
+    try {
+        // Hono on Node.js / Bun: use raw request socket
+        const raw = c.env?.incoming ?? c.req?.raw;
+        return raw?.socket?.remoteAddress;
+    }
+    catch {
+        return undefined;
+    }
+}
+function extractJwt(headers, query) {
+    const header = headers['cf-access-jwt-assertion'];
+    if (typeof header === 'string')
+        return header;
+    if (query) {
+        const q = new URLSearchParams(query);
+        const j = q.get('cf_access_jwt');
+        if (j)
+            return j;
+    }
+    const cookie = headers['cookie'];
+    if (typeof cookie === 'string') {
+        const m = cookie.match(/CF_Authorization=([^;]+)/);
+        if (m)
+            return m[1];
+    }
+}
+export async function verifyUpgradeJwt(req, opts, jwks) {
+    if (devBypassAllowed(req.socket?.remoteAddress, opts)) {
+        return { email: opts.devEmail ?? 'dev@localhost', sub: 'dev' };
+    }
+    const query = req.url?.startsWith('/ws') ? req.url.split('?')[1] : undefined;
+    const jwt = extractJwt(req.headers, query);
+    if (!jwt)
+        return null;
+    try {
+        const keys = jwks ?? createRemoteJWKSet(new URL(`https://${opts.team}.cloudflareaccess.com/cdn-cgi/access/certs`));
+        const { payload } = await jwtVerify(jwt, keys, {
+            issuer: `https://${opts.team}.cloudflareaccess.com`,
+            audience: opts.aud,
+        });
+        return { email: payload.email, sub: payload.sub };
+    }
+    catch {
+        return null;
+    }
+}
+export function cfAccessMiddleware(opts) {
+    const jwksUri = `https://${opts.team}.cloudflareaccess.com/cdn-cgi/access/certs`;
+    const issuer = `https://${opts.team}.cloudflareaccess.com`;
+    const jwks = createRemoteJWKSet(new URL(jwksUri));
+    return async (c, next) => {
+        if (devBypassAllowed(remoteAddr(c), opts)) {
+            c.set('user', { email: opts.devEmail ?? 'dev@localhost', sub: 'dev' });
+            return next();
+        }
+        // No query-string JWT here: ?cf_access_jwt= on a normal HTTP URL would leak
+        // into browser history/referer. It is accepted only on the WS upgrade path
+        // (/ws) — see verifyUpgradeJwt — because browsers can't set WS headers.
+        const jwt = c.req.header('cf-access-jwt-assertion') ||
+            c.req.header('cookie')?.match(/CF_Authorization=([^;]+)/)?.[1];
+        if (!jwt) {
+            return c.json({ error: 'Unauthorized' }, 401);
+        }
+        try {
+            const { payload } = await jwtVerify(jwt, jwks, { issuer, audience: opts.aud });
+            c.set('user', { email: payload.email, sub: payload.sub });
+            return next();
+        }
+        catch {
+            return c.json({ error: 'Unauthorized' }, 401);
+        }
+    };
+}
+//# sourceMappingURL=cf-access.js.map

package/dist/transport/web/middleware/cf-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.js","sourceRoot":"","sources":["../../../../src/transport/web/middleware/cf-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAYpD,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,oBAAoB;IACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,IAAwB,EAAE,IAAkB;IACpE,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IACjC,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAA;IACnD,OAAO,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,CAAM;IACxB,IAAI,CAAC;QACH,gDAAgD;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAA;QACzC,OAAO,GAAG,EAAE,MAAM,EAAE,aAAmC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAsD,EAAE,KAAc;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAC7C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAChC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAClD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkH,EAClH,IAAkB,EAClB,IAA4C;IAE5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,4CAA4C,CAAC,CAAC,CAAA;QAClH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7C,MAAM,EAAE,WAAW,IAAI,CAAC,IAAI,uBAAuB;YACnD,QAAQ,EAAE,IAAI,CAAC,GAAG;SACnB,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAa,EAAE,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,IAAI,4CAA4C,CAAA;IAChF,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,IAAI,uBAAuB,CAAA;IAC1D,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;IAEjD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACtE,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,GAAG,GACP,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,yBAAyB,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAEhE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;YAC9E,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,GAAG,EAAE,OAAO,CAAC,GAAa,EAAE,CAAC,CAAA;YAC7E,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/transport/web/opencode-config.js

@@ -0,0 +1,15 @@
+/** Best-effort GET of an opencode raw-config endpoint. Returns {} on any failure. */
+export async function fetchOpencodeConfig(baseUrl, path) {
+    if (!baseUrl)
+        return {};
+    try {
+        const res = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, { signal: AbortSignal.timeout(5000) });
+        if (!res.ok)
+            return {};
+        return await res.json();
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=opencode-config.js.map

package/dist/transport/web/opencode-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-config.js","sourceRoot":"","sources":["../../../src/transport/web/opencode-config.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,IAAY;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAA;QACtB,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/transport/web/routes/abort.js

@@ -0,0 +1,12 @@
+export function registerAbort(app, reg, state) {
+    app.post('/api/abort', async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        if (typeof body.sessionId !== 'string' || !body.sessionId)
+            return c.json({ error: 'sessionId required' }, 400);
+        const id = state.normalizeSessionId(body.sessionId);
+        state.getActiveAbort(id)?.abort();
+        await reg.forSession(id).abort(id);
+        return c.json({ ok: true });
+    });
+}
+//# sourceMappingURL=abort.js.map

package/dist/transport/web/routes/abort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/abort.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,aAAa,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IAChF,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA2B,CAAA;QAC3E,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9G,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnD,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;QACjC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/approval.js

@@ -0,0 +1,16 @@
+const DECISIONS = ['once', 'always', 'reject'];
+export function registerApproval(app, reg, state) {
+    app.post('/api/approval', async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        if (typeof body.sessionId !== 'string' || !body.sessionId)
+            return c.json({ error: 'sessionId required' }, 400);
+        if (typeof body.requestId !== 'string' || !body.requestId)
+            return c.json({ error: 'requestId required' }, 400);
+        if (!DECISIONS.includes(body.decision))
+            return c.json({ error: 'decision must be once|always|reject' }, 400);
+        const id = state.normalizeSessionId(body.sessionId);
+        await reg.forSession(id).resolvePermission(id, body.requestId, body.decision);
+        return c.json({ ok: true });
+    });
+}
+//# sourceMappingURL=approval.js.map

package/dist/transport/web/routes/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/approval.ts"],"names":[],"mappings":"AAKA,MAAM,SAAS,GAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEpE,MAAM,UAAU,gBAAgB,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IACnF,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA8E,CAAA;QAC9H,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9G,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9G,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAA8B,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,GAAG,CAAC,CAAA;QAClI,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAA8B,CAAC,CAAA;QACnG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/catalog.js

@@ -0,0 +1,11 @@
+export function registerCatalog(app, reg) {
+    app.get('/api/agents', async (c) => {
+        const b = reg.get(c.req.query('backend') ?? '') ?? reg.active();
+        return c.json(await b.getAgents());
+    });
+    app.get('/api/models', async (c) => {
+        const b = reg.get(c.req.query('backend') ?? '') ?? reg.active();
+        return c.json(await b.getModels());
+    });
+}
+//# sourceMappingURL=catalog.js.map

package/dist/transport/web/routes/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/catalog.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,eAAe,CAAC,GAAS,EAAE,GAAoB;IAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/channels.js

@@ -0,0 +1,53 @@
+/**
+ * M9: bot-channel settings — list + update. `tgStatus` (injected by entry)
+ * reports the live Telegram polling state so the web panel can show
+ * connected/未绑定 like the ZCode reference.
+ */
+export function registerChannels(app, channels, tgStatus) {
+    if (!channels)
+        return;
+    app.get('/api/channels', (c) => {
+        const status = tgStatus?.() ?? null;
+        return c.json({
+            channels: channels.list().map((b) => ({
+                ...b,
+                live: b.channel === 'telegram' && status ? { connected: status.connected, username: status.username } : null,
+            })),
+        });
+    });
+    app.patch('/api/channels/:id', async (c) => {
+        const body = (await c.req.json().catch(() => ({})));
+        if (body.replyGranularity && body.replyGranularity !== 'standard' && body.replyGranularity !== 'detailed') {
+            return c.json({ error: 'replyGranularity must be standard|detailed' }, 400);
+        }
+        if (body.workspaces && body.workspaces.mode !== 'all' && body.workspaces.mode !== 'custom') {
+            return c.json({ error: 'invalid workspaces' }, 400);
+        }
+        const updated = channels.update(c.req.param('id'), body);
+        if (!updated)
+            return c.json({ error: 'not found' }, 404);
+        return c.json({ channel: updated });
+    });
+    app.post('/api/channels/:id/reset', (c) => {
+        const updated = channels.reset(c.req.param('id'));
+        if (!updated)
+            return c.json({ error: 'not found' }, 404);
+        return c.json({ channel: updated });
+    });
+    // Pairing QR — the pair URL carries the token in its fragment, so this is
+    // only ever rendered inside an already-paired session (same trust model as
+    // TG's /pair command).
+    app.get('/api/pair/qr', async (c) => {
+        try {
+            const { buildPairContext } = await import('../../../connectivity/pairing.js');
+            const QRCode = (await import('qrcode')).default;
+            const { token, url } = await buildPairContext();
+            const svg = await QRCode.toString(url, { type: 'svg', margin: 1 });
+            return c.json({ url, svg });
+        }
+        catch (err) {
+            return c.json({ error: err.message }, 500);
+        }
+    });
+}
+//# sourceMappingURL=channels.js.map

package/dist/transport/web/routes/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/channels.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAS,EACT,QAAwB,EACxB,QAA0C;IAE1C,IAAI,CAAC,QAAQ;QAAE,OAAM;IAErB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAA;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,CAAC;gBACJ,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;aAC7G,CAAC,CAAC;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKjD,CAAA;QACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,KAAK,UAAU,IAAI,IAAI,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC1G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,uBAAuB;IACvB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC7E,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAA;YAC/C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/commands.js

@@ -0,0 +1,15 @@
+export function registerCommands(app, reg, state) {
+    app.get('/api/commands', async (c) => {
+        const b = reg.get(c.req.query('backend') ?? '') ?? reg.active();
+        return c.json(await b.listCommands());
+    });
+    app.post('/api/command', async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        if (!body.sessionId || !body.command)
+            return c.json({ error: 'sessionId and command required' }, 400);
+        const id = state.normalizeSessionId(body.sessionId);
+        await reg.forSession(id).runCommand(id, body.command, body.arguments);
+        return c.json({ ok: true });
+    });
+}
+//# sourceMappingURL=commands.js.map

package/dist/transport/web/routes/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/commands.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,gBAAgB,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IACnF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAiE,CAAA;QACjH,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAA;QACrG,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/context.js

@@ -0,0 +1,17 @@
+export function registerContext(app, reg, state) {
+    app.get('/api/session/:id/context', async (c) => {
+        const id = state.normalizeSessionId(c.req.param('id'));
+        const ctx = await reg.forSession(id).getContext(id);
+        return c.json({
+            sessionId: id,
+            agent: ctx.agent,
+            model: ctx.model,
+            tokens: ctx.tokens,
+            cost: ctx.cost ?? state.getSessionCost(id),
+            directory: ctx.directory,
+            nextAgent: state.getNextAgent(),
+            nextModel: state.getNextModel(),
+        });
+    });
+}
+//# sourceMappingURL=context.js.map

package/dist/transport/web/routes/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/context.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,eAAe,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IAClF,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE;YAC/B,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE;SAChC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/controls.js

@@ -0,0 +1,34 @@
+/**
+ * Session controls — read the switchable mode + model for a session, and switch
+ * them. Backed by the optional getControls/setMode/setModel (present only when the
+ * backend's `sessionControls` capability is true; ACP/kimi). Missing → 404/empty.
+ */
+export function registerControls(app, reg, state) {
+    app.get('/api/session/:id/controls', async (c) => {
+        const id = state.normalizeSessionId(c.req.param('id'));
+        return c.json((await reg.forSession(id).getControls?.(id)) ?? {});
+    });
+    app.post('/api/session/:id/mode', async (c) => {
+        const id = state.normalizeSessionId(c.req.param('id'));
+        const { modeId } = await c.req.json().catch(() => ({ modeId: undefined }));
+        if (!modeId)
+            return c.json({ error: 'modeId required' }, 400);
+        const b = reg.forSession(id);
+        if (!b.setMode)
+            return c.json({ error: 'mode switching not supported' }, 404);
+        await b.setMode(id, modeId);
+        return c.json({ ok: true });
+    });
+    app.post('/api/session/:id/model', async (c) => {
+        const id = state.normalizeSessionId(c.req.param('id'));
+        const { modelId } = await c.req.json().catch(() => ({ modelId: undefined }));
+        if (!modelId)
+            return c.json({ error: 'modelId required' }, 400);
+        const b = reg.forSession(id);
+        if (!b.setModel)
+            return c.json({ error: 'model switching not supported' }, 404);
+        await b.setModel(id, modelId);
+        return c.json({ ok: true });
+    });
+}
+//# sourceMappingURL=controls.js.map

package/dist/transport/web/routes/controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controls.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/controls.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IACnF,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QAC/F,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC7D,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAA;QAC7E,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAwB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QAClG,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/E,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/create-session.js

@@ -0,0 +1,21 @@
+export function registerCreateSession(app, reg) {
+    app.post('/api/session', async (c) => {
+        const body = (await c.req.json().catch(() => ({})));
+        const backend = (body.backendId && reg.get(body.backendId)) || reg.active();
+        const directory = typeof body.directory === 'string' ? body.directory.trim() : '';
+        // Backends that don't enumerate workspaces (e.g. ACP) create in their own
+        // default working directory — the directory is optional there.
+        if (!directory && backend.capabilities.workspaces) {
+            return c.json({ error: 'directory required' }, 400);
+        }
+        try {
+            const { id } = await backend.createSession({ directory, title: body.title });
+            reg.tag(id, backend.id);
+            return c.json({ id, backendId: backend.id });
+        }
+        catch {
+            return c.json({ error: 'create failed' }, 500);
+        }
+    });
+}
+//# sourceMappingURL=create-session.js.map

package/dist/transport/web/routes/create-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-session.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/create-session.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CAAC,GAAS,EAAE,GAAoB;IACnE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA+D,CAAA;QACjH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACjF,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YAC5E,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YACvB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/transport/web/routes/diff.js

@@ -0,0 +1,7 @@
+export function registerDiff(app, reg, state) {
+    app.get('/api/session/:id/diff', async (c) => {
+        const id = state.normalizeSessionId(c.req.param('id'));
+        return c.json(await reg.forSession(id).getDiff(id));
+    });
+}
+//# sourceMappingURL=diff.js.map

package/dist/transport/web/routes/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../../src/transport/web/routes/diff.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,YAAY,CAAC,GAAS,EAAE,GAAoB,EAAE,KAAmB;IAC/E,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC"}