@pixelzx/genesis 2026.6.29 → 2026.7.9

package/dist/control-ui-CKQ17fcd.js

@@ -0,0 +1,1043 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DPP_aYVc.js";
+import { m as resolveUserPath } from "./utils-CWrkFsp0.js";
+import { s as resolveRuntimeServiceVersion } from "./version-qod78efn.js";
+import { _ as resolveRequestClientIp } from "./net-BzaeD_3Q.js";
+import { i as AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET, n as AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN } from "./auth-rate-limit-aUMFOR7H.js";
+import { r as authorizeHttpGatewayConnect } from "./auth-tZtxLgsL.js";
+import { t as openVerifiedFileSync } from "./safe-open-sync-COtvg2e4.js";
+import { i as openBoundaryFileSync, n as matchBoundaryFileOpenFailure } from "./boundary-file-read-BuF0sFdl.js";
+import { t as AVATAR_MAX_BYTES } from "./avatar-policy-CKdoS8bu.js";
+import { n as authorizeOperatorScopesForMethod } from "./method-scopes-TWVLEUXZ.js";
+import { i as resolveAssistantAvatarUrl, n as buildControlUiAvatarUrl, r as normalizeControlUiBasePath, t as CONTROL_UI_AVATAR_PREFIX } from "./control-ui-shared-D6HGEH4K.js";
+import { t as detectMime } from "./mime-uYFJ8ocK.js";
+import { c as openLocalFileSafely, t as SafeOpenError } from "./fs-safe-B265VM-X.js";
+import { t as isWithinDir } from "./path-safety-BTQKbjiO.js";
+import { a as safeFileURLToPath } from "./local-file-access-DEO41UGf.js";
+import { r as getAgentScopedMediaLocalRoots } from "./local-roots-BfA76lH8.js";
+import { c as resolveMediaReferenceLocalPath, n as assertLocalMediaAllowed, r as getDefaultLocalRoots } from "./local-media-access-d5OkEPuA.js";
+import { a as updateCanvasDocument, n as inferCanvasDocumentKindFromSource, t as createCanvasDocument } from "./canvas-documents--R39OBE3.js";
+import { a as isRequestBodyLimitError, c as requestBodyErrorToText, r as RequestBodyLimitError } from "./http-body-C0x1hv3x.js";
+import { n as verifyPairingToken } from "./pairing-token-Bia1olYb.js";
+import { l as listDevicePairing, v as verifyDeviceToken } from "./device-pairing-DcVtuZyt.js";
+import { d as resolveHttpBrowserOriginPolicy, h as resolveTrustedHttpOperatorScopes, o as getBearerToken, y as sendGatewayAuthFailure } from "./http-utils-LFOvdepz.js";
+import { n as isPackageProvenControlUiRootSync, o as resolveControlUiRootSync } from "./control-ui-assets-C5xI2-j0.js";
+import { n as resolveAssistantIdentity, t as DEFAULT_ASSISTANT_IDENTITY } from "./assistant-identity-Cp1M0TM3.js";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import fs$1 from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { clearTimeout, setTimeout } from "node:timers";
+//#endregion
+//#region src/gateway/control-ui-csp.ts
+const SCRIPT_ATTRIBUTE_NAME_RE = /\s([^\s=/>]+)(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+))?/g;
+/**
+* Compute SHA-256 CSP hashes for inline `<script>` blocks in an HTML string.
+* Only scripts without a `src` attribute are considered inline.
+*/
+function computeInlineScriptHashes(html) {
+	const hashes = [];
+	const re = /<script(?:\s[^>]*)?>([^]*?)<\/script>/gi;
+	let match;
+	while ((match = re.exec(html)) !== null) {
+		if (hasScriptSrcAttribute(match[0].slice(0, match[0].indexOf(">") + 1))) continue;
+		const content = match[1];
+		if (!content) continue;
+		const hash = createHash("sha256").update(content, "utf8").digest("base64");
+		hashes.push(`sha256-${hash}`);
+	}
+	return hashes;
+}
+function hasScriptSrcAttribute(openTag) {
+	return Array.from(openTag.matchAll(SCRIPT_ATTRIBUTE_NAME_RE)).some((match) => normalizeLowercaseStringOrEmpty(match[1]) === "src");
+}
+function buildControlUiCspHeader(opts) {
+	const hashes = opts?.inlineScriptHashes;
+	return [
+		"default-src 'self'",
+		"base-uri 'none'",
+		"object-src 'none'",
+		"frame-ancestors 'none'",
+		hashes?.length ? `script-src 'self' ${hashes.map((h) => `'${h}'`).join(" ")}` : "script-src 'self'",
+		"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+		"img-src 'self' data: blob:",
+		"font-src 'self' https://fonts.gstatic.com",
+		"connect-src 'self' ws: wss:"
+	].join("; ");
+}
+//#endregion
+//#region src/gateway/control-ui-http-utils.ts
+function isReadHttpMethod(method) {
+	return method === "GET" || method === "HEAD";
+}
+function respondPlainText(res, statusCode, body) {
+	res.statusCode = statusCode;
+	res.setHeader("Content-Type", "text/plain; charset=utf-8");
+	res.end(body);
+}
+function respondNotFound(res) {
+	respondPlainText(res, 404, "Not Found");
+}
+//#endregion
+//#region src/gateway/control-ui-routing.ts
+const ROOT_MOUNTED_GATEWAY_PROBE_PATHS = new Set([
+	"/health",
+	"/healthz",
+	"/ready",
+	"/readyz"
+]);
+function classifyControlUiRequest(params) {
+	const { basePath, pathname, search, method } = params;
+	if (!basePath) {
+		if (pathname === "/ui" || pathname.startsWith("/ui/")) return { kind: "not-found" };
+		if (ROOT_MOUNTED_GATEWAY_PROBE_PATHS.has(pathname)) return { kind: "not-control-ui" };
+		if (pathname === "/plugins" || pathname.startsWith("/plugins/")) return { kind: "not-control-ui" };
+		if (pathname === "/api" || pathname.startsWith("/api/")) return { kind: "not-control-ui" };
+		if (!isReadHttpMethod(method)) return { kind: "not-control-ui" };
+		return { kind: "serve" };
+	}
+	if (!pathname.startsWith(`${basePath}/`) && pathname !== basePath) return { kind: "not-control-ui" };
+	if (!isReadHttpMethod(method)) return { kind: "not-control-ui" };
+	if (pathname === basePath) return {
+		kind: "redirect",
+		location: `${basePath}/${search}`
+	};
+	return { kind: "serve" };
+}
+//#endregion
+//#region src/gateway/control-ui.ts
+const ROOT_PREFIX = "/";
+const CONTROL_UI_ASSISTANT_MEDIA_PREFIX = "/__genesis__/assistant-media";
+const CONTROL_UI_CANVAS_UPLOAD_PREFIX = "/__genesis__/canvas-upload";
+const CONTROL_UI_ASSETS_MISSING_MESSAGE = "Control UI assets not found. Build them with `pnpm ui:build` (auto-installs UI deps), or run `pnpm ui:dev` during development.";
+const CONTROL_UI_OPERATOR_READ_SCOPE = "operator.read";
+const CONTROL_UI_OPERATOR_WRITE_SCOPE = "operator.write";
+const CONTROL_UI_OPERATOR_ROLE = "operator";
+const CANVAS_UPLOAD_BODY_TIMEOUT_MS = 3e4;
+function contentTypeForExt(ext) {
+	switch (ext) {
+		case ".html": return "text/html; charset=utf-8";
+		case ".js": return "application/javascript; charset=utf-8";
+		case ".css": return "text/css; charset=utf-8";
+		case ".json":
+		case ".map": return "application/json; charset=utf-8";
+		case ".svg": return "image/svg+xml";
+		case ".png": return "image/png";
+		case ".jpg":
+		case ".jpeg": return "image/jpeg";
+		case ".gif": return "image/gif";
+		case ".webp": return "image/webp";
+		case ".ico": return "image/x-icon";
+		case ".txt": return "text/plain; charset=utf-8";
+		default: return "application/octet-stream";
+	}
+}
+/**
+* Extensions recognised as static assets.  Missing files with these extensions
+* return 404 instead of the SPA index.html fallback.  `.html` is intentionally
+* excluded — actual HTML files on disk are served earlier, and missing `.html`
+* paths should fall through to the SPA router (client-side routers may use
+* `.html`-suffixed routes).
+*/
+const STATIC_ASSET_EXTENSIONS = new Set([
+	".js",
+	".css",
+	".json",
+	".map",
+	".svg",
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".webp",
+	".ico",
+	".txt"
+]);
+function applyControlUiSecurityHeaders(res) {
+	res.setHeader("X-Frame-Options", "DENY");
+	res.setHeader("Content-Security-Policy", buildControlUiCspHeader());
+	res.setHeader("X-Content-Type-Options", "nosniff");
+	res.setHeader("Referrer-Policy", "no-referrer");
+}
+function sendJson(res, status, body) {
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json; charset=utf-8");
+	res.setHeader("Cache-Control", "no-cache");
+	res.end(JSON.stringify(body));
+}
+function respondControlUiAssetsUnavailable(res, options) {
+	if (options?.configuredRootPath) {
+		respondPlainText(res, 503, `Control UI assets not found at ${options.configuredRootPath}. Build them with \`pnpm ui:build\` (auto-installs UI deps), or update gateway.controlUi.root.`);
+		return;
+	}
+	respondPlainText(res, 503, CONTROL_UI_ASSETS_MISSING_MESSAGE);
+}
+function respondControlUiStartupPending(req, res) {
+	res.statusCode = 503;
+	res.setHeader("Content-Type", "text/plain; charset=utf-8");
+	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Retry-After", "1");
+	if (req.method === "HEAD") {
+		res.end();
+		return;
+	}
+	res.end("Gateway is still starting; retry shortly.");
+}
+function isGatewayStartupPending(getReadiness) {
+	if (!getReadiness) return false;
+	try {
+		const readiness = getReadiness();
+		return !readiness.ready && readiness.failing.includes("startup-sidecars");
+	} catch {
+		return false;
+	}
+}
+function respondHeadForFile(req, res, filePath) {
+	if (req.method !== "HEAD") return false;
+	res.statusCode = 200;
+	setStaticFileHeaders(res, filePath);
+	res.end();
+	return true;
+}
+function isValidAgentId(agentId) {
+	return /^[a-z0-9][a-z0-9_-]{0,63}$/i.test(agentId);
+}
+function normalizeAssistantMediaSource(source) {
+	const trimmed = source.trim();
+	if (!trimmed) return null;
+	if (trimmed.startsWith("file://")) try {
+		return safeFileURLToPath(trimmed);
+	} catch {
+		return null;
+	}
+	if (trimmed.startsWith("~")) return resolveUserPath(trimmed);
+	return trimmed;
+}
+function resolveAssistantMediaRoutePath(basePath) {
+	return `${basePath && basePath !== "/" ? basePath.endsWith("/") ? basePath.slice(0, -1) : basePath : ""}${CONTROL_UI_ASSISTANT_MEDIA_PREFIX}`;
+}
+function resolveCanvasUploadRoutePath(basePath) {
+	return `${normalizeControlUiBasePath(basePath)}${CONTROL_UI_CANVAS_UPLOAD_PREFIX}`;
+}
+function parseContentLength(req) {
+	const raw = req.headers["content-length"];
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	if (typeof value !== "string") return null;
+	const parsed = Number.parseInt(value, 10);
+	return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+function headerValue(req, name) {
+	const raw = req.headers[name.toLowerCase()];
+	if (typeof raw === "string") return raw;
+	return Array.isArray(raw) ? raw[0] : void 0;
+}
+function decodeHeaderFileName(raw) {
+	try {
+		return decodeURIComponent(raw);
+	} catch {
+		return raw;
+	}
+}
+function normalizeUploadFileName(raw) {
+	const decoded = decodeHeaderFileName(raw?.trim() ?? "");
+	if (!decoded || decoded.includes("\0")) return null;
+	const baseName = path.basename(path.win32.basename(decoded)).trim();
+	return baseName && baseName !== "." && baseName !== ".." ? baseName : null;
+}
+function normalizeCanvasDocumentKind(raw) {
+	if (!raw) return null;
+	switch (raw) {
+		case "html_bundle":
+		case "url_embed":
+		case "document":
+		case "image":
+		case "video_asset":
+		case "presentation_asset":
+		case "model_3d":
+		case "vector_image": return raw;
+		default: return null;
+	}
+}
+function normalizeSourceMime(raw) {
+	return raw?.split(";")[0]?.trim() || void 0;
+}
+function normalizePreferredHeight(raw) {
+	if (!raw?.trim()) return;
+	const parsed = Number(raw);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+async function writeRequestBodyToFile(req, filePath, opts) {
+	const declaredLength = parseContentLength(req);
+	if (declaredLength !== null && declaredLength > opts.maxBytes) {
+		if (!req.destroyed) req.destroy();
+		throw new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" });
+	}
+	await fs$1.mkdir(path.dirname(filePath), { recursive: true });
+	const output = fs.createWriteStream(filePath, { flags: "wx" });
+	return await new Promise((resolve, reject) => {
+		let done = false;
+		let ended = false;
+		let bytes = 0;
+		const cleanup = () => {
+			req.removeListener("data", onData);
+			req.removeListener("end", onEnd);
+			req.removeListener("error", onError);
+			req.removeListener("close", onClose);
+			output.removeListener("drain", onDrain);
+			output.removeListener("finish", onFinish);
+			output.removeListener("error", onError);
+			clearTimeout(timer);
+		};
+		const finish = (cb) => {
+			if (done) return;
+			done = true;
+			cleanup();
+			cb();
+		};
+		const fail = (error) => {
+			finish(() => {
+				output.destroy();
+				reject(error);
+			});
+		};
+		const timer = setTimeout(() => {
+			if (!req.destroyed) req.destroy();
+			fail(new RequestBodyLimitError({ code: "REQUEST_BODY_TIMEOUT" }));
+		}, opts.timeoutMs);
+		function onData(chunk) {
+			if (done) return;
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			bytes += buffer.length;
+			if (bytes > opts.maxBytes) {
+				if (!req.destroyed) req.destroy();
+				fail(new RequestBodyLimitError({ code: "PAYLOAD_TOO_LARGE" }));
+				return;
+			}
+			if (!output.write(buffer)) req.pause();
+		}
+		function onDrain() {
+			if (!done) req.resume();
+		}
+		function onEnd() {
+			ended = true;
+			output.end();
+		}
+		function onFinish() {
+			finish(() => resolve({ bytes }));
+		}
+		function onError(error) {
+			fail(error);
+		}
+		function onClose() {
+			if (!done && !ended) fail(new RequestBodyLimitError({ code: "CONNECTION_CLOSED" }));
+		}
+		req.on("data", onData);
+		req.on("end", onEnd);
+		req.on("error", onError);
+		req.on("close", onClose);
+		output.on("drain", onDrain);
+		output.on("finish", onFinish);
+		output.on("error", onError);
+	});
+}
+function resolveAssistantMediaAuthToken(req) {
+	const bearer = getBearerToken(req);
+	if (bearer) return bearer;
+	const urlRaw = req.url;
+	if (!urlRaw) return;
+	try {
+		return new URL(urlRaw, "http://localhost").searchParams.get("token")?.trim() || void 0;
+	} catch {
+		return;
+	}
+}
+function resolveControlUiReadAuthToken(req, opts) {
+	const bearer = getBearerToken(req);
+	if (bearer) return bearer;
+	if (!opts?.allowQueryToken) return;
+	return resolveAssistantMediaAuthToken(req);
+}
+async function authorizeControlUiReadRequest(req, res, opts) {
+	if (!opts?.auth) return true;
+	const token = resolveControlUiReadAuthToken(req, { allowQueryToken: opts.allowQueryToken });
+	const clientIp = resolveRequestClientIp(req, opts.trustedProxies, opts.allowRealIpFallback === true) ?? req.socket?.remoteAddress;
+	let resolvedAuthResult = await authorizeHttpGatewayConnect({
+		auth: opts.auth,
+		connectAuth: token ? {
+			token,
+			password: token
+		} : null,
+		req,
+		browserOriginPolicy: resolveHttpBrowserOriginPolicy(req),
+		trustedProxies: opts.trustedProxies,
+		allowRealIpFallback: opts.allowRealIpFallback,
+		rateLimiter: token ? opts.rateLimiter : void 0,
+		clientIp,
+		rateLimitScope: AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET
+	});
+	if (!resolvedAuthResult.ok && token && opts.auth.mode !== "trusted-proxy" && opts.auth.mode !== "none") {
+		const deviceRateCheck = opts.rateLimiter?.check(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+		if (deviceRateCheck && !deviceRateCheck.allowed) resolvedAuthResult = {
+			ok: false,
+			reason: "rate_limited",
+			rateLimited: true,
+			retryAfterMs: deviceRateCheck.retryAfterMs
+		};
+		else if (await authorizeControlUiDeviceReadToken(token)) {
+			opts.rateLimiter?.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+			opts.rateLimiter?.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET);
+			resolvedAuthResult = {
+				ok: true,
+				method: "device-token"
+			};
+		} else opts.rateLimiter?.recordFailure(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+	}
+	if (!resolvedAuthResult.ok) {
+		sendGatewayAuthFailure(res, resolvedAuthResult);
+		return false;
+	}
+	const trustDeclaredOperatorScopes = resolvedAuthResult.method === "trusted-proxy";
+	if (!trustDeclaredOperatorScopes) return true;
+	const scopeAuth = authorizeOperatorScopesForMethod("assistant.media.get", resolveTrustedHttpOperatorScopes(req, { trustDeclaredOperatorScopes }));
+	if (!scopeAuth.allowed) {
+		sendJson(res, 403, {
+			ok: false,
+			error: {
+				type: "forbidden",
+				message: `missing scope: ${scopeAuth.missingScope}`
+			}
+		});
+		return false;
+	}
+	return true;
+}
+async function authorizeControlUiWriteRequest(req, res, opts) {
+	if (!opts.auth) return true;
+	const token = resolveControlUiReadAuthToken(req);
+	const clientIp = resolveRequestClientIp(req, opts.trustedProxies, opts.allowRealIpFallback === true) ?? req.socket?.remoteAddress;
+	let resolvedAuthResult = await authorizeHttpGatewayConnect({
+		auth: opts.auth,
+		connectAuth: token ? {
+			token,
+			password: token
+		} : null,
+		req,
+		browserOriginPolicy: resolveHttpBrowserOriginPolicy(req),
+		trustedProxies: opts.trustedProxies,
+		allowRealIpFallback: opts.allowRealIpFallback,
+		rateLimiter: token ? opts.rateLimiter : void 0,
+		clientIp,
+		rateLimitScope: AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET
+	});
+	if (!resolvedAuthResult.ok && token && opts.auth.mode !== "trusted-proxy" && opts.auth.mode !== "none") {
+		const deviceRateCheck = opts.rateLimiter?.check(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+		if (deviceRateCheck && !deviceRateCheck.allowed) resolvedAuthResult = {
+			ok: false,
+			reason: "rate_limited",
+			rateLimited: true,
+			retryAfterMs: deviceRateCheck.retryAfterMs
+		};
+		else if (await authorizeControlUiDeviceToken(token, [CONTROL_UI_OPERATOR_WRITE_SCOPE])) {
+			opts.rateLimiter?.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+			opts.rateLimiter?.reset(clientIp, AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET);
+			resolvedAuthResult = {
+				ok: true,
+				method: "device-token"
+			};
+		} else opts.rateLimiter?.recordFailure(clientIp, AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN);
+	}
+	if (!resolvedAuthResult.ok) {
+		sendGatewayAuthFailure(res, resolvedAuthResult);
+		return false;
+	}
+	if (resolvedAuthResult.method !== "trusted-proxy") return true;
+	const requestedScopes = resolveTrustedHttpOperatorScopes(req, { trustDeclaredOperatorScopes: true });
+	const scopeAuth = authorizeOperatorScopesForMethod(opts.operatorMethod, requestedScopes);
+	if (!scopeAuth.allowed) {
+		sendJson(res, 403, {
+			ok: false,
+			error: {
+				type: "forbidden",
+				message: `missing scope: ${scopeAuth.missingScope}`
+			}
+		});
+		return false;
+	}
+	return true;
+}
+async function authorizeControlUiDeviceToken(token, scopes) {
+	const pairing = await listDevicePairing();
+	for (const device of pairing.paired) {
+		const operatorToken = device.tokens?.[CONTROL_UI_OPERATOR_ROLE];
+		if (!operatorToken || operatorToken.revokedAtMs) continue;
+		if (!verifyPairingToken(token, operatorToken.token)) continue;
+		if ((await verifyDeviceToken({
+			deviceId: device.deviceId,
+			token,
+			role: CONTROL_UI_OPERATOR_ROLE,
+			scopes: [...scopes]
+		})).ok) return true;
+	}
+	return false;
+}
+async function authorizeControlUiDeviceReadToken(token) {
+	return await authorizeControlUiDeviceToken(token, [CONTROL_UI_OPERATOR_READ_SCOPE]);
+}
+function classifyAssistantMediaError(err) {
+	if (err instanceof SafeOpenError) switch (err.code) {
+		case "not-found": return {
+			available: false,
+			code: "file-not-found",
+			reason: "File not found"
+		};
+		case "not-file": return {
+			available: false,
+			code: "not-a-file",
+			reason: "Not a file"
+		};
+		case "invalid-path":
+		case "path-mismatch":
+		case "symlink": return {
+			available: false,
+			code: "invalid-file",
+			reason: "Invalid file"
+		};
+		default: return {
+			available: false,
+			code: "attachment-unavailable",
+			reason: "Attachment unavailable"
+		};
+	}
+	if (err instanceof Error && "code" in err) {
+		const errorCode = err.code;
+		switch (typeof errorCode === "string" ? errorCode : "") {
+			case "path-not-allowed": return {
+				available: false,
+				code: "outside-allowed-folders",
+				reason: "Outside allowed folders"
+			};
+			case "invalid-file-url":
+			case "invalid-path":
+			case "unsafe-bypass":
+			case "network-path-not-allowed":
+			case "invalid-root": return {
+				available: false,
+				code: "blocked-local-file",
+				reason: "Blocked local file"
+			};
+			case "not-found": return {
+				available: false,
+				code: "file-not-found",
+				reason: "File not found"
+			};
+			case "not-file": return {
+				available: false,
+				code: "not-a-file",
+				reason: "Not a file"
+			};
+			default: break;
+		}
+	}
+	return {
+		available: false,
+		code: "attachment-unavailable",
+		reason: "Attachment unavailable"
+	};
+}
+async function resolveAssistantMediaAvailability(source, localRoots) {
+	try {
+		const localPath = await resolveMediaReferenceLocalPath(source);
+		await assertLocalMediaAllowed(localPath, localRoots);
+		await (await openLocalFileSafely({ filePath: localPath })).handle.close();
+		return { available: true };
+	} catch (err) {
+		return classifyAssistantMediaError(err);
+	}
+}
+async function handleControlUiAssistantMediaRequest(req, res, opts) {
+	const urlRaw = req.url;
+	if (!urlRaw || !isReadHttpMethod(req.method)) return false;
+	const url = new URL(urlRaw, "http://localhost");
+	if (url.pathname !== resolveAssistantMediaRoutePath(opts?.basePath)) return false;
+	applyControlUiSecurityHeaders(res);
+	if (!await authorizeControlUiReadRequest(req, res, {
+		auth: opts?.auth,
+		trustedProxies: opts?.trustedProxies,
+		allowRealIpFallback: opts?.allowRealIpFallback,
+		rateLimiter: opts?.rateLimiter,
+		allowQueryToken: true
+	})) return true;
+	const source = normalizeAssistantMediaSource(url.searchParams.get("source") ?? "");
+	if (!source) {
+		respondNotFound(res);
+		return true;
+	}
+	const localRoots = opts?.config ? getAgentScopedMediaLocalRoots(opts.config, opts.agentId) : getDefaultLocalRoots();
+	if (url.searchParams.get("meta") === "1") {
+		sendJson(res, 200, await resolveAssistantMediaAvailability(source, localRoots));
+		return true;
+	}
+	let opened = null;
+	let localPath = source;
+	let handleClosed = false;
+	const closeOpenedHandle = async () => {
+		if (!opened || handleClosed) return;
+		handleClosed = true;
+		await opened.handle.close().catch(() => {});
+	};
+	try {
+		localPath = await resolveMediaReferenceLocalPath(source);
+		await assertLocalMediaAllowed(localPath, localRoots);
+		opened = await openLocalFileSafely({ filePath: localPath });
+		const sniffLength = Math.min(opened.stat.size, 8192);
+		const sniffBuffer = sniffLength > 0 ? Buffer.allocUnsafe(sniffLength) : void 0;
+		const bytesRead = sniffBuffer && sniffLength > 0 ? (await opened.handle.read(sniffBuffer, 0, sniffLength, 0)).bytesRead : 0;
+		const mime = await detectMime({
+			buffer: sniffBuffer?.subarray(0, bytesRead),
+			filePath: localPath
+		});
+		if (mime) res.setHeader("Content-Type", mime);
+		else res.setHeader("Content-Type", "application/octet-stream");
+		res.setHeader("Cache-Control", "no-cache");
+		res.setHeader("Content-Length", String(opened.stat.size));
+		const stream = opened.handle.createReadStream({
+			start: 0,
+			autoClose: false
+		});
+		const finishClose = () => {
+			closeOpenedHandle();
+		};
+		stream.once("end", finishClose);
+		stream.once("close", finishClose);
+		stream.once("error", () => {
+			closeOpenedHandle();
+			if (!res.headersSent) respondNotFound(res);
+			else res.destroy();
+		});
+		res.once("close", finishClose);
+		stream.pipe(res);
+		return true;
+	} catch {
+		await closeOpenedHandle();
+		respondNotFound(res);
+		return true;
+	}
+}
+async function handleControlUiCanvasUploadRequest(req, res, opts) {
+	const urlRaw = req.url;
+	if (!urlRaw) return false;
+	const url = new URL(urlRaw, "http://localhost");
+	if (url.pathname !== resolveCanvasUploadRoutePath(opts?.basePath)) return false;
+	applyControlUiSecurityHeaders(res);
+	if (req.method !== "POST") {
+		res.setHeader("Allow", "POST");
+		sendJson(res, 405, {
+			ok: false,
+			error: {
+				type: "method_not_allowed",
+				message: "Method Not Allowed"
+			}
+		});
+		return true;
+	}
+	const config = opts?.config;
+	if (process.env.GENESIS_SKIP_CANVAS_HOST === "1" || config?.canvasHost?.enabled === false) {
+		sendJson(res, 503, {
+			ok: false,
+			error: {
+				type: "unavailable",
+				message: "canvas host is disabled"
+			}
+		});
+		return true;
+	}
+	const rawMode = url.searchParams.get("mode")?.trim() || "create";
+	if (rawMode !== "create" && rawMode !== "update") {
+		sendJson(res, 400, {
+			ok: false,
+			error: {
+				type: "invalid_request_error",
+				message: "mode must be create or update"
+			}
+		});
+		return true;
+	}
+	const mode = rawMode;
+	if (!await authorizeControlUiWriteRequest(req, res, {
+		auth: opts?.auth,
+		trustedProxies: opts?.trustedProxies,
+		allowRealIpFallback: opts?.allowRealIpFallback,
+		rateLimiter: opts?.rateLimiter,
+		operatorMethod: mode === "update" ? "canvas.document.update" : "canvas.document.create"
+	})) return true;
+	const sourceFileName = normalizeUploadFileName(headerValue(req, "x-genesis-file-name"));
+	if (!sourceFileName) {
+		sendJson(res, 400, {
+			ok: false,
+			error: {
+				type: "invalid_request_error",
+				message: "X-Genesis-File-Name header required"
+			}
+		});
+		return true;
+	}
+	const id = url.searchParams.get("id")?.trim() || void 0;
+	if (mode === "update" && !id) {
+		sendJson(res, 400, {
+			ok: false,
+			error: {
+				type: "invalid_request_error",
+				message: "id is required for canvas updates"
+			}
+		});
+		return true;
+	}
+	const rawKind = url.searchParams.get("kind");
+	const requestedKind = normalizeCanvasDocumentKind(rawKind);
+	if (rawKind && !requestedKind) {
+		sendJson(res, 400, {
+			ok: false,
+			error: {
+				type: "invalid_request_error",
+				message: "invalid canvas document kind"
+			}
+		});
+		return true;
+	}
+	const uploadDir = await fs$1.mkdtemp(path.join(os.tmpdir(), "genesis-canvas-upload-"));
+	const ext = path.extname(sourceFileName).replace(/[^.A-Za-z0-9_-]/g, "").slice(0, 32);
+	const uploadPath = path.join(uploadDir, `source${ext}`);
+	try {
+		if ((await writeRequestBodyToFile(req, uploadPath, {
+			maxBytes: 104857600,
+			timeoutMs: CANVAS_UPLOAD_BODY_TIMEOUT_MS
+		})).bytes <= 0) {
+			sendJson(res, 400, {
+				ok: false,
+				error: {
+					type: "invalid_request_error",
+					message: "upload body required"
+				}
+			});
+			return true;
+		}
+		const title = url.searchParams.get("title")?.trim() || void 0;
+		const rawPreferredHeight = url.searchParams.get("preferredHeight");
+		const preferredHeight = normalizePreferredHeight(rawPreferredHeight);
+		if (rawPreferredHeight?.trim() && typeof preferredHeight !== "number") {
+			sendJson(res, 400, {
+				ok: false,
+				error: {
+					type: "invalid_request_error",
+					message: "preferredHeight must be positive"
+				}
+			});
+			return true;
+		}
+		const sourceMime = normalizeSourceMime(headerValue(req, "content-type"));
+		const kind = requestedKind ?? inferCanvasDocumentKindFromSource(sourceFileName, "path");
+		const input = {
+			...id ? { id } : {},
+			kind,
+			...title ? { title } : {},
+			...typeof preferredHeight === "number" ? { preferredHeight } : {},
+			entrypoint: {
+				type: "path",
+				value: uploadPath
+			},
+			...sourceMime ? { sourceMime } : {},
+			sourceFileName,
+			surface: "assistant_message"
+		};
+		sendJson(res, 200, {
+			ok: true,
+			document: mode === "update" && id ? await updateCanvasDocument({
+				...input,
+				id
+			}, {
+				canvasRootDir: config?.canvasHost?.root,
+				workspaceDir: uploadDir
+			}) : await createCanvasDocument(input, {
+				canvasRootDir: config?.canvasHost?.root,
+				workspaceDir: uploadDir
+			})
+		});
+		return true;
+	} catch (err) {
+		if (isRequestBodyLimitError(err)) {
+			sendJson(res, err.statusCode, {
+				ok: false,
+				error: {
+					type: err.code === "PAYLOAD_TOO_LARGE" ? "payload_too_large" : err.code === "REQUEST_BODY_TIMEOUT" ? "request_timeout" : "invalid_request_error",
+					message: requestBodyErrorToText(err.code)
+				}
+			});
+			return true;
+		}
+		sendJson(res, 500, {
+			ok: false,
+			error: {
+				type: "unavailable",
+				message: String(err)
+			}
+		});
+		return true;
+	} finally {
+		await fs$1.rm(uploadDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+async function handleControlUiAvatarRequest(req, res, opts) {
+	const urlRaw = req.url;
+	if (!urlRaw) return false;
+	if (!isReadHttpMethod(req.method)) return false;
+	const url = new URL(urlRaw, "http://localhost");
+	const basePath = normalizeControlUiBasePath(opts.basePath);
+	const pathname = url.pathname;
+	const pathWithBase = basePath ? `${basePath}${CONTROL_UI_AVATAR_PREFIX}/` : `${CONTROL_UI_AVATAR_PREFIX}/`;
+	if (!pathname.startsWith(pathWithBase)) return false;
+	applyControlUiSecurityHeaders(res);
+	if (!await authorizeControlUiReadRequest(req, res, {
+		auth: opts.auth,
+		trustedProxies: opts.trustedProxies,
+		allowRealIpFallback: opts.allowRealIpFallback,
+		rateLimiter: opts.rateLimiter
+	})) return true;
+	const agentIdParts = pathname.slice(pathWithBase.length).split("/").filter(Boolean);
+	const agentId = agentIdParts[0] ?? "";
+	if (agentIdParts.length !== 1 || !agentId || !isValidAgentId(agentId)) {
+		respondNotFound(res);
+		return true;
+	}
+	if (url.searchParams.get("meta") === "1") {
+		const resolved = opts.resolveAvatar(agentId);
+		sendJson(res, 200, { avatarUrl: resolved.kind === "local" ? buildControlUiAvatarUrl(basePath, agentId) : resolved.kind === "remote" || resolved.kind === "data" ? resolved.url : null });
+		return true;
+	}
+	const resolved = opts.resolveAvatar(agentId);
+	if (resolved.kind !== "local") {
+		respondNotFound(res);
+		return true;
+	}
+	const safeAvatar = resolveSafeAvatarFile(resolved.filePath);
+	if (!safeAvatar) {
+		respondNotFound(res);
+		return true;
+	}
+	try {
+		if (respondHeadForFile(req, res, safeAvatar.path)) return true;
+		serveResolvedFile(res, safeAvatar.path, fs.readFileSync(safeAvatar.fd));
+		return true;
+	} finally {
+		fs.closeSync(safeAvatar.fd);
+	}
+}
+function setStaticFileHeaders(res, filePath) {
+	const ext = path.extname(filePath).toLowerCase();
+	res.setHeader("Content-Type", contentTypeForExt(ext));
+	res.setHeader("Cache-Control", "no-cache");
+}
+function serveResolvedFile(res, filePath, body) {
+	setStaticFileHeaders(res, filePath);
+	res.end(body);
+}
+function serveResolvedIndexHtml(res, body) {
+	const hashes = computeInlineScriptHashes(body);
+	if (hashes.length > 0) res.setHeader("Content-Security-Policy", buildControlUiCspHeader({ inlineScriptHashes: hashes }));
+	res.setHeader("Content-Type", "text/html; charset=utf-8");
+	res.setHeader("Cache-Control", "no-cache");
+	res.end(body);
+}
+function isExpectedSafePathError(error) {
+	const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
+	return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
+}
+function resolveSafeAvatarFile(filePath) {
+	const opened = openVerifiedFileSync({
+		filePath,
+		rejectPathSymlink: true,
+		maxBytes: AVATAR_MAX_BYTES
+	});
+	if (!opened.ok) return null;
+	return {
+		path: opened.path,
+		fd: opened.fd
+	};
+}
+function resolveSafeControlUiFile(rootReal, filePath, rejectHardlinks) {
+	const opened = openBoundaryFileSync({
+		absolutePath: filePath,
+		rootPath: rootReal,
+		rootRealPath: rootReal,
+		boundaryLabel: "control ui root",
+		skipLexicalRootCheck: true,
+		rejectHardlinks
+	});
+	if (!opened.ok) return matchBoundaryFileOpenFailure(opened, {
+		io: (failure) => {
+			throw failure.error;
+		},
+		fallback: () => null
+	});
+	return {
+		path: opened.path,
+		fd: opened.fd
+	};
+}
+function isSafeRelativePath(relPath) {
+	if (!relPath) return false;
+	const normalized = path.posix.normalize(relPath);
+	if (path.posix.isAbsolute(normalized) || path.win32.isAbsolute(normalized)) return false;
+	if (normalized.startsWith("../") || normalized === "..") return false;
+	if (normalized.includes("\0")) return false;
+	return true;
+}
+async function handleControlUiHttpRequest(req, res, opts) {
+	const urlRaw = req.url;
+	if (!urlRaw) return false;
+	const url = new URL(urlRaw, "http://localhost");
+	const basePath = normalizeControlUiBasePath(opts?.basePath);
+	const pathname = url.pathname;
+	const route = classifyControlUiRequest({
+		basePath,
+		pathname,
+		search: url.search,
+		method: req.method
+	});
+	if (route.kind === "not-control-ui") return false;
+	if (route.kind === "not-found") {
+		applyControlUiSecurityHeaders(res);
+		respondNotFound(res);
+		return true;
+	}
+	if (route.kind === "redirect") {
+		applyControlUiSecurityHeaders(res);
+		res.statusCode = 302;
+		res.setHeader("Location", route.location);
+		res.end();
+		return true;
+	}
+	applyControlUiSecurityHeaders(res);
+	if (isGatewayStartupPending(opts?.getReadiness)) {
+		respondControlUiStartupPending(req, res);
+		return true;
+	}
+	if (pathname === (basePath ? `${basePath}/__genesis/control-ui-config.json` : "/__genesis/control-ui-config.json")) {
+		if (!await authorizeControlUiReadRequest(req, res, {
+			auth: opts?.auth,
+			trustedProxies: opts?.trustedProxies,
+			allowRealIpFallback: opts?.allowRealIpFallback,
+			rateLimiter: opts?.rateLimiter
+		})) return true;
+		const config = opts?.config;
+		const identity = config ? resolveAssistantIdentity({
+			cfg: config,
+			agentId: opts?.agentId
+		}) : DEFAULT_ASSISTANT_IDENTITY;
+		const avatarValue = resolveAssistantAvatarUrl({
+			avatar: identity.avatar,
+			agentId: identity.agentId,
+			basePath
+		});
+		if (req.method === "HEAD") {
+			res.statusCode = 200;
+			res.setHeader("Content-Type", "application/json; charset=utf-8");
+			res.setHeader("Cache-Control", "no-cache");
+			res.end();
+			return true;
+		}
+		sendJson(res, 200, {
+			basePath,
+			assistantName: identity.name,
+			assistantAvatar: avatarValue ?? identity.avatar,
+			assistantAgentId: identity.agentId,
+			serverVersion: resolveRuntimeServiceVersion(process.env),
+			localMediaPreviewRoots: [...getAgentScopedMediaLocalRoots(config ?? {}, identity.agentId)],
+			embedSandbox: config?.gateway?.controlUi?.embedSandbox === "trusted" ? "trusted" : config?.gateway?.controlUi?.embedSandbox === "strict" ? "strict" : "scripts",
+			allowExternalEmbedUrls: config?.gateway?.controlUi?.allowExternalEmbedUrls === true
+		});
+		return true;
+	}
+	const rootState = opts?.root;
+	if (rootState?.kind === "invalid") {
+		respondControlUiAssetsUnavailable(res, { configuredRootPath: rootState.path });
+		return true;
+	}
+	if (rootState?.kind === "missing") {
+		respondControlUiAssetsUnavailable(res);
+		return true;
+	}
+	const root = rootState?.kind === "resolved" || rootState?.kind === "bundled" ? rootState.path : resolveControlUiRootSync({
+		moduleUrl: import.meta.url,
+		argv1: process.argv[1],
+		cwd: process.cwd()
+	});
+	if (!root) {
+		respondControlUiAssetsUnavailable(res);
+		return true;
+	}
+	const rootReal = (() => {
+		try {
+			return fs.realpathSync(root);
+		} catch (error) {
+			if (isExpectedSafePathError(error)) return null;
+			throw error;
+		}
+	})();
+	if (!rootReal) {
+		respondControlUiAssetsUnavailable(res);
+		return true;
+	}
+	const uiPath = basePath && pathname.startsWith(`${basePath}/`) ? pathname.slice(basePath.length) : pathname;
+	const rel = (() => {
+		if (uiPath === ROOT_PREFIX) return "";
+		const assetsIndex = uiPath.indexOf("/assets/");
+		if (assetsIndex >= 0) return uiPath.slice(assetsIndex + 1);
+		return uiPath.slice(1);
+	})();
+	const fileRel = (rel && !rel.endsWith("/") ? rel : `${rel}index.html`) || "index.html";
+	if (!isSafeRelativePath(fileRel)) {
+		respondNotFound(res);
+		return true;
+	}
+	const filePath = path.resolve(root, fileRel);
+	if (!isWithinDir(root, filePath)) {
+		respondNotFound(res);
+		return true;
+	}
+	const rejectHardlinks = !(rootState?.kind === "bundled" || rootState === void 0 && isPackageProvenControlUiRootSync(root, {
+		moduleUrl: import.meta.url,
+		argv1: process.argv[1],
+		cwd: process.cwd()
+	}));
+	const safeFile = resolveSafeControlUiFile(rootReal, filePath, rejectHardlinks);
+	if (safeFile) try {
+		if (respondHeadForFile(req, res, safeFile.path)) return true;
+		if (path.basename(safeFile.path) === "index.html") {
+			serveResolvedIndexHtml(res, fs.readFileSync(safeFile.fd, "utf8"));
+			return true;
+		}
+		serveResolvedFile(res, safeFile.path, fs.readFileSync(safeFile.fd));
+		return true;
+	} finally {
+		fs.closeSync(safeFile.fd);
+	}
+	if (STATIC_ASSET_EXTENSIONS.has(path.extname(fileRel).toLowerCase())) {
+		respondNotFound(res);
+		return true;
+	}
+	const safeIndex = resolveSafeControlUiFile(rootReal, path.join(root, "index.html"), rejectHardlinks);
+	if (safeIndex) try {
+		if (respondHeadForFile(req, res, safeIndex.path)) return true;
+		serveResolvedIndexHtml(res, fs.readFileSync(safeIndex.fd, "utf8"));
+		return true;
+	} finally {
+		fs.closeSync(safeIndex.fd);
+	}
+	respondNotFound(res);
+	return true;
+}
+//#endregion
+export { handleControlUiAssistantMediaRequest, handleControlUiAvatarRequest, handleControlUiCanvasUploadRequest, handleControlUiHttpRequest };