@threadbase-sh/streamer 1.69.2 → 1.69.4

package/dist/codex-pty-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-pty-runner.d.ts","sourceRoot":"","sources":["../src/codex-pty-runner.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAEV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EAEnB,WAAW,EACZ,MAAM,SAAS,CAAC;AA+CjB,qBAAa,cAAe,YAAW,aAAa;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,QAAQ,CAAgC;IAChD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,OAAO,CAA+B;IAa9C,OAAO,CAAC,kBAAkB,CAA0C;IACpE,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,GAAG,CAAS;IAGpB,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,YAAY,CAA+B;IAInD,OAAO,CAAC,QAAQ,CAAoC;IAGpD,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,aAAa,CAAsD;IAE3E,OAAO,CAAC,mBAAmB,CAAqC;IAEhE,OAAO,CAAC,iBAAiB,CAAqC;IAG9D,OAAO,CAAC,WAAW,CAA6B;IAKhD,OAAO,CAAC,QAAQ,CAAqB;IAErC,OAAO,CAAC,kBAAkB,CAA6B;IAIvD,OAAO,CAAC,mBAAmB,CAA6B;IAGxD,OAAO,CAAC,aAAa,CAA6B;IAIlD,OAAO,CAAC,aAAa,CAA8C;IAEnE,YAAY,OAAO,GAAE,iBAAsB,EAQ1C;IAKK,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAepF;YAEa,OAAO;YAcP,MAAM;IA+Dd,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe3E;IAED;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAOzE;IAOD,OAAO,CAAC,gBAAgB;YASV,gBAAgB;IAkD9B,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAqB9C;IAQD,OAAO,CAAC,iBAAiB;IA0BzB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA0ClD;IAOD,OAAO,CAAC,WAAW;IAyDnB,OAAO,CAAC,cAAc;YAWR,sBAAsB;IAmCpC,OAAO,CAAC,iBAAiB;IAoCzB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI9B;IAED,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMzB;IAGD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAkBjC;IAKD,OAAO,CAAC,qBAAqB;IAyB7B,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAInC;IAIK,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc3E;IAED,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,EAAE,CAEhD;IAID,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEvC;IAID,OAAO,CAAC,iBAAiB;IASzB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGnD;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErC;IAED,YAAY,IAAI,cAAc,EAAE,CAE/B;IAED,OAAO,IAAI,IAAI,CA+Bd;IAED,OAAO,CAAC,YAAY;YA2DN,iBAAiB;IA6J/B,OAAO,CAAC,oBAAoB;IA6B5B,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,UAAU;IAiClB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IAsCjB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAoCnB,OAAO,CAAC,UAAU;CAyBnB"}
+{"version":3,"file":"codex-pty-runner.d.ts","sourceRoot":"","sources":["../src/codex-pty-runner.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAEV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EAEnB,WAAW,EACZ,MAAM,SAAS,CAAC;AA+CjB,qBAAa,cAAe,YAAW,aAAa;IAClD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,QAAQ,CAAgC;IAChD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,OAAO,CAA+B;IAa9C,OAAO,CAAC,kBAAkB,CAA0C;IACpE,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,GAAG,CAAS;IAGpB,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,YAAY,CAA+B;IAInD,OAAO,CAAC,QAAQ,CAAoC;IAGpD,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,aAAa,CAAsD;IAE3E,OAAO,CAAC,mBAAmB,CAAqC;IAEhE,OAAO,CAAC,iBAAiB,CAAqC;IAG9D,OAAO,CAAC,WAAW,CAA6B;IAKhD,OAAO,CAAC,QAAQ,CAAqB;IAErC,OAAO,CAAC,kBAAkB,CAA6B;IAIvD,OAAO,CAAC,mBAAmB,CAA6B;IAGxD,OAAO,CAAC,aAAa,CAA6B;IAIlD,OAAO,CAAC,aAAa,CAA8C;IAEnE,YAAY,OAAO,GAAE,iBAAsB,EAQ1C;IAKK,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAepF;YAEa,OAAO;YAcP,MAAM;IA+Dd,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe3E;IAED;;;;;;;;;;OAUG;IACG,SAAS,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAOzE;IAOD,OAAO,CAAC,gBAAgB;YASV,gBAAgB;IA6C9B,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAsB9C;IAQD,OAAO,CAAC,iBAAiB;IA0BzB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA0ClD;IAOD,OAAO,CAAC,WAAW;IAwDnB,OAAO,CAAC,cAAc;YAWR,sBAAsB;IAkCpC,OAAO,CAAC,iBAAiB;IAoCzB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI9B;IAED,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMzB;IAGD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAkBjC;IAKD,OAAO,CAAC,qBAAqB;IAyB7B,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAInC;IAIK,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAc3E;IAED,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,EAAE,CAEhD;IAID,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEvC;IAID,OAAO,CAAC,iBAAiB;IASzB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGnD;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErC;IAED,YAAY,IAAI,cAAc,EAAE,CAE/B;IAED,OAAO,IAAI,IAAI,CA+Bd;IAED,OAAO,CAAC,YAAY;YA2DN,iBAAiB;IA6J/B,OAAO,CAAC,oBAAoB;IA4B5B,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,UAAU;IAgClB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,SAAS;IAsCjB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAoCnB,OAAO,CAAC,UAAU;CAyBnB"}

package/dist/index.cjs

@@ -1099,11 +1099,6 @@ var PTY_COLS = 120;
 var PTY_ROWS = 40;
 var SCREEN_SCROLLBACK = 1e3;
 var REPLAY_MAX_LINES = SCREEN_SCROLLBACK + PTY_ROWS;
-function digestBytes(s) {
-  const escaped = s.replace(new RegExp(String.fromCharCode(27), "g"), "\\x1b").replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\t/g, "\\t");
-  if (escaped.length <= 200) return escaped;
-  return `${escaped.slice(0, 100)}\u2026[${escaped.length - 200}B omitted]\u2026${escaped.slice(-100)}`;
-}
 var pty = null;
 async function loadPty() {
   if (pty) return pty;
@@ -1538,17 +1533,12 @@ var CodexPtyRunner = class {
       const lines = await this.getOutputLines(sessionId, PTY_ROWS);
       if (!this.pendingReady.has(sessionId)) return;
       const busy = codexScreenBlocksComposer(lines);
-      const bar = codexStatusBarLine(lines);
-      this.log.info(
-        `[codex.ready_fallback] ${sessionId.slice(0, 8)} busy=${busy} bar=${JSON.stringify(bar.slice(0, 120))}`,
-        {
-          event: "codex.ready_fallback",
-          sessionId,
-          busy,
-          hasReady: codexScreenShowsReady(lines),
-          statusBar: bar.slice(0, 160)
-        }
-      );
+      this.log.info(`[codex.ready_fallback] ${sessionId.slice(0, 8)} busy=${busy}`, {
+        event: "codex.ready_fallback",
+        sessionId,
+        busy,
+        hasReady: codexScreenShowsReady(lines)
+      });
       if (busy) {
         this.armReadyFallback(sessionId);
         return;
@@ -1583,10 +1573,11 @@ var CodexPtyRunner = class {
     const gate = this.openGate.get(sessionId);
     const digit = gate ? /^([0-9])\r?$/.exec(keys)?.[1] : void 0;
     const out = gate && digit ? this.resolveGateAnswer(sessionId, gate, digit) : keys;
-    this.log.info(
-      `[codex.keys.write] ${sessionId.slice(0, 8)} bytes=${out.length} digest=${digestBytes(out)}`,
-      { event: "codex.keys_write", sessionId, byteLen: out.length }
-    );
+    this.log.info(`[codex.keys.write] ${sessionId.slice(0, 8)} bytes=${out.length}`, {
+      event: "codex.keys_write",
+      sessionId,
+      byteLen: out.length
+    });
     session.process.write(out);
     session.lastActivityAt = /* @__PURE__ */ new Date();
   }
@@ -1665,13 +1656,12 @@ var CodexPtyRunner = class {
   writeSubmit(sessionId, session, input, path, promptCount) {
     this.recordUserMessage(session, input);
     this.log.info(
-      `[codex.input.write] ${sessionId.slice(0, 8)} promptCount=${promptCount} bytes=${input.length} digest=${digestBytes(input)}`,
+      `[codex.input.write] ${sessionId.slice(0, 8)} promptCount=${promptCount} bytes=${input.length}`,
       {
         event: "codex.input_write",
         sessionId,
         promptCount,
         byteLen: input.length,
-        digest: digestBytes(input),
         path,
         phase: "input"
       }
@@ -1735,8 +1725,7 @@ var CodexPtyRunner = class {
       }
       this.log.info(`[codex.submit_stale] ${sessionId.slice(0, 8)} recovering`, {
         event: "codex.submit_stale",
-        sessionId,
-        statusBar: codexStatusBarLine(lines).slice(0, 160)
+        sessionId
       });
       this.markReady(sessionId, session, "quiet-fallback", "submit-stale");
     } catch (err) {
@@ -2019,7 +2008,7 @@ var CodexPtyRunner = class {
     if (this.lastScreenLog.get(sessionId) !== screenFp) {
       this.lastScreenLog.set(sessionId, screenFp);
       this.log.info(
-        `[codex.screen] ${sessionId.slice(0, 8)} pending=${this.pendingReady.has(sessionId)} status=${session.status} ready=${hasReady} busy=${busy} usage=${Boolean(blocking)} bar=${JSON.stringify(bar.slice(0, 100))}`,
+        `[codex.screen] ${sessionId.slice(0, 8)} pending=${this.pendingReady.has(sessionId)} status=${session.status} ready=${hasReady} busy=${busy} usage=${Boolean(blocking)}`,
         {
           event: "codex.screen",
           sessionId,
@@ -2029,8 +2018,7 @@ var CodexPtyRunner = class {
           hasReady,
           busy,
           usageHit: Boolean(blocking),
-          usageSoft: Boolean(blocking?.soft),
-          statusBar: bar.slice(0, 160)
+          usageSoft: Boolean(blocking?.soft)
         }
       );
     }
@@ -2065,8 +2053,7 @@ var CodexPtyRunner = class {
       session.failureReason = blocking.detail ? `${blocking.prompt} ${blocking.detail}` : blocking.prompt;
       this.log.info(`[codex.usage_limit] ${sessionId.slice(0, 8)}`, {
         event: "codex.usage_limit",
-        sessionId,
-        prompt: blocking.prompt
+        sessionId
       });
       this.onPermissionChange?.(sessionId, blocking);
     }
@@ -2112,8 +2099,7 @@ var CodexPtyRunner = class {
     this.log.info(`[codex.gate_prompt] ${sessionId.slice(0, 8)} ${gate}`, {
       event: "codex.gate_prompt",
       sessionId,
-      gate,
-      prompt: card.prompt
+      gate
     });
     this.onPermissionChange?.(sessionId, card);
   }
@@ -3131,10 +3117,11 @@ var PTYManager = class {
       session.statusUpdatedAt = /* @__PURE__ */ new Date();
       this.onStatusChange?.(toPublicSession2(session));
     }
-    this.log.info(
-      `[pty.keys.write] ${sessionId.slice(0, 8)} bytes=${keys.length} digest=${digestBytes(keys)}`,
-      { event: "pty.keys_write", sessionId, byteLen: keys.length }
-    );
+    this.log.info(`[pty.keys.write] ${sessionId.slice(0, 8)} bytes=${keys.length}`, {
+      event: "pty.keys_write",
+      sessionId,
+      byteLen: keys.length
+    });
     session.process.write(keys);
     session.lastActivityAt = /* @__PURE__ */ new Date();
     const openGate = this.permissionOpen.get(sessionId);
@@ -3196,13 +3183,12 @@ var PTYManager = class {
     this.recordUserMessage(session, input);
     const pasteBytes = buildPasteBytes(input);
     this.log.info(
-      `[pty.input.write] ${sessionId.slice(0, 8)} promptCount=${promptCount} bytes=${pasteBytes.length} digest=${digestBytes(pasteBytes)}`,
+      `[pty.input.write] ${sessionId.slice(0, 8)} promptCount=${promptCount} bytes=${pasteBytes.length}`,
       {
         event: "pty.input_write",
         sessionId,
         promptCount,
         byteLen: pasteBytes.length,
-        digest: digestBytes(pasteBytes),
         path,
         phase: "paste"
       }
@@ -3402,7 +3388,7 @@ var PTYManager = class {
     this.lastChunkAt.set(sessionId, now);
     const gapMs = last == null ? 0 : now - last;
     this.log.info(
-      `[pty.chunk] ${sessionId.slice(0, 8)} #${idx} +${chunk.length}B gap=${gapMs}ms status=${session.status} digest=${digestBytes(data)}`,
+      `[pty.chunk] ${sessionId.slice(0, 8)} #${idx} +${chunk.length}B gap=${gapMs}ms status=${session.status}`,
       {
         event: "pty.chunk",
         sessionId,
@@ -3410,8 +3396,7 @@ var PTYManager = class {
         chunkBytes: chunk.length,
         gapMs,
         status: session.status,
-        pendingReady: this.pendingReady.has(sessionId),
-        digest: digestBytes(data)
+        pendingReady: this.pendingReady.has(sessionId)
       }
     );
     session.outputBuffer = Buffer.concat([session.outputBuffer, chunk]);
@@ -3475,15 +3460,18 @@ var PTYManager = class {
     }
     const askFooterOnScreen = lines.some((l) => /Enter to select/i.test(l));
     if (oscPermission || hasAskFooter || askFooterOnScreen) {
+      const permGate = oscPermission && !askFooterOnScreen ? scrapePermissionGate(lines) : null;
+      const askQuestion = askFooterOnScreen ? detectQuestionFromScreen(lines) : null;
       this.log.debug?.(`[pty.prompt_detect] ${sessionId.slice(0, 8)} trigger`, {
         event: "pty.prompt_detect",
         sessionId,
         oscPermission,
         hasAskFooter,
         askFooterOnScreen,
-        permGate: oscPermission && !askFooterOnScreen ? scrapePermissionGate(lines) : void 0,
-        askQuestion: askFooterOnScreen ? detectQuestionFromScreen(lines) : void 0,
-        renderedTail: lines.slice(-25)
+        permGateDetected: permGate !== null,
+        permGateOptionCount: permGate?.options.length ?? 0,
+        askQuestionDetected: askQuestion !== null,
+        askQuestionCount: askQuestion?.questions.length ?? 0
       });
     }
     if (oscPermission && !askFooterOnScreen) {
@@ -4154,7 +4142,7 @@ async function readGitBranch(dir) {
 // src/server.ts
 var import_node_ws = require("@hono/node-ws");
 var import_client = require("@temporalio/client");
-var import_crypto13 = require("crypto");
+var import_crypto14 = require("crypto");
 var import_events = require("events");
 var import_fs28 = require("fs");
 var import_promises7 = require("fs/promises");
@@ -9263,6 +9251,7 @@ var ConversationHandlers = class {
 };
 
 // src/api/handlers/sessions.handlers.ts
+var import_crypto9 = require("crypto");
 var import_fs15 = require("fs");
 var import_path16 = require("path");
 
@@ -10558,7 +10547,9 @@ var SessionHandlers = class {
     }
     const key = permissionContentKey(gate);
     if (this.pendingPermissionKey.get(sessionId) === key) return;
-    this.pendingPermission.set(sessionId, gate);
+    const prior = this.pendingPermission.get(sessionId);
+    const gateId = prior && permissionGateKey(prior) === permissionGateKey(gate) ? prior.gateId : (0, import_crypto9.randomUUID)();
+    this.pendingPermission.set(sessionId, { ...gate, gateId });
     this.pendingPermissionKey.set(sessionId, key);
     const subscriberCount = this.sessionSubscribers.get(sessionId)?.size ?? 0;
     this.log.info(
@@ -10572,7 +10563,8 @@ var SessionHandlers = class {
       ...gate.detail ? { detail: gate.detail } : {},
       options: gate.options,
       ...gate.cursor !== void 0 ? { cursor: gate.cursor } : {},
-      contentKey: permissionGateKey(gate)
+      contentKey: permissionGateKey(gate),
+      gateId
     });
   }
   /**
@@ -10600,10 +10592,15 @@ var SessionHandlers = class {
     const body = await readBody2(req);
     const contentKey = body?.contentKey;
     const optionIndex = body?.optionIndex;
+    const gateId = body?.gateId;
     if (typeof contentKey !== "string" || !Number.isInteger(optionIndex) || optionIndex < 0) {
       json(res, 400, { ok: false, reason: "Expected { contentKey: string, optionIndex: number }" });
       return;
     }
+    if (gateId !== void 0 && typeof gateId !== "string") {
+      json(res, 400, { ok: false, reason: "Expected gateId to be a string" });
+      return;
+    }
     const gateClosed = () => {
       this.pendingPermission.delete(sessionId);
       this.pendingPermissionKey.delete(sessionId);
@@ -10615,6 +10612,16 @@ var SessionHandlers = class {
       gateClosed();
       return;
     }
+    if (gateId !== void 0 && gateId !== gate.gateId) {
+      json(res, 409, { ok: false, reason: "gate_mismatch" });
+      return;
+    }
+    if (gateId === void 0) {
+      this.log.info(`[permission.answer_legacy_identity] ${sessionId.slice(0, 8)}`, {
+        event: "permission.answer_legacy_identity",
+        sessionId
+      });
+    }
     if (permissionGateKey(gate) !== contentKey) {
       json(res, 409, { ok: false, reason: "gate_mismatch" });
       return;
@@ -10624,7 +10631,8 @@ var SessionHandlers = class {
       json(res, 409, { ok: false, reason: "unknown_option" });
       return;
     }
-    if (!await this.permissionGateStillOpen(sessionId, contentKey)) {
+    const provider = this.sessionStore.getManaged(sessionId)?.provider;
+    if (provider !== CODEX_CLI_PROVIDER && !await this.permissionGateStillOpen(sessionId, contentKey)) {
       gateClosed();
       return;
     }
@@ -11332,7 +11340,7 @@ var ManagedSessionsRepository = class {
 };
 
 // src/db/repositories/projects.repository.ts
-var import_crypto9 = require("crypto");
+var import_crypto10 = require("crypto");
 function rowToProject(row) {
   return {
     id: row.id,
@@ -11417,7 +11425,7 @@ var ProjectsRepository = class {
       });
       return rowToProject(this.getById.get(existing.id));
     }
-    const id = (0, import_crypto9.randomUUID)();
+    const id = (0, import_crypto10.randomUUID)();
     this.insert.run({
       id,
       path,
@@ -11547,7 +11555,7 @@ var RuntimeStore = class _RuntimeStore {
 };
 
 // src/e2ee/noise.ts
-var import_crypto10 = require("crypto");
+var import_crypto11 = require("crypto");
 var NOISE_PROTOCOL_NAME = "Noise_IKpsk1_25519_ChaChaPoly_SHA256";
 var PAIR_PROLOGUE = Buffer.from("threadbase-e2ee/1 pair", "utf-8");
 var DHLEN = 32;
@@ -11563,15 +11571,15 @@ var NoiseError = class extends Error {
   }
 };
 function generateKeyPair() {
-  const { publicKey, privateKey } = (0, import_crypto10.generateKeyPairSync)("x25519");
+  const { publicKey, privateKey } = (0, import_crypto11.generateKeyPairSync)("x25519");
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function keyPairFrom(privateKey) {
-  const publicKey = (0, import_crypto10.createPublicKey)(privateKey);
+  const publicKey = (0, import_crypto11.createPublicKey)(privateKey);
   return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
 }
 function rawPublicKey(key) {
-  const pub = key.type === "public" ? key : (0, import_crypto10.createPublicKey)(key);
+  const pub = key.type === "public" ? key : (0, import_crypto11.createPublicKey)(key);
   const jwk = pub.export({ format: "jwk" });
   if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
     throw new NoiseError("Not an X25519 public key");
@@ -11583,7 +11591,7 @@ function publicKeyFromRaw(raw) {
     throw new NoiseError(`X25519 public key must be ${DHLEN} bytes, got ${raw.length}`);
   }
   try {
-    return (0, import_crypto10.createPublicKey)({
+    return (0, import_crypto11.createPublicKey)({
       key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
       format: "jwk"
     });
@@ -11592,7 +11600,7 @@ function publicKeyFromRaw(raw) {
   }
 }
 function pskFromPairToken(token) {
-  return (0, import_crypto10.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
+  return (0, import_crypto11.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
 }
 function chachaNonce(n) {
   const nonce = Buffer.alloc(12);
@@ -11611,7 +11619,7 @@ var CipherState = class {
   }
   encryptWithAd(ad, plaintext) {
     if (!this.k) return plaintext;
-    const cipher = (0, import_crypto10.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const cipher = (0, import_crypto11.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     cipher.setAAD(ad, { plaintextLength: plaintext.length });
@@ -11624,7 +11632,7 @@ var CipherState = class {
     if (ciphertext.length < TAGLEN) throw new NoiseError("Ciphertext shorter than its tag");
     const body = ciphertext.subarray(0, ciphertext.length - TAGLEN);
     const tag = ciphertext.subarray(ciphertext.length - TAGLEN);
-    const decipher = (0, import_crypto10.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+    const decipher = (0, import_crypto11.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
       authTagLength: TAGLEN
     });
     decipher.setAAD(ad, { plaintextLength: body.length });
@@ -11645,7 +11653,7 @@ var SymmetricState = class {
   cipher = new CipherState();
   constructor(protocolName) {
     const name = Buffer.from(protocolName, "utf-8");
-    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto10.createHash)("sha256").update(name).digest();
+    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto11.createHash)("sha256").update(name).digest();
     this.ck = Buffer.from(this.h);
     this.cipher.initializeKey(null);
   }
@@ -11657,7 +11665,7 @@ var SymmetricState = class {
    * subtly wrong.
    */
   hkdf(ikm, outputs) {
-    const raw = Buffer.from((0, import_crypto10.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
+    const raw = Buffer.from((0, import_crypto11.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
     const out = [];
     for (let i = 0; i < outputs; i++) out.push(raw.subarray(i * HASHLEN, (i + 1) * HASHLEN));
     return out;
@@ -11668,7 +11676,7 @@ var SymmetricState = class {
     this.cipher.initializeKey(tempK);
   }
   mixHash(data) {
-    this.h = (0, import_crypto10.createHash)("sha256").update(this.h).update(data).digest();
+    this.h = (0, import_crypto11.createHash)("sha256").update(this.h).update(data).digest();
   }
   /** Spec §5.2. Used only by the `psk` token. */
   mixKeyAndHash(ikm) {
@@ -11698,7 +11706,7 @@ var SymmetricState = class {
   }
 };
 function dh(privateKey, publicKey) {
-  return (0, import_crypto10.diffieHellman)({ privateKey, publicKey });
+  return (0, import_crypto11.diffieHellman)({ privateKey, publicKey });
 }
 function readMessage1(args) {
   assertMessageSize(args.message1, NOISE_MESSAGE_1_OVERHEAD);
@@ -12010,7 +12018,7 @@ var ExternalTailManager = class {
 };
 
 // src/pair-store.ts
-var import_crypto11 = require("crypto");
+var import_crypto12 = require("crypto");
 var DEFAULT_TTL_SECONDS = 180;
 var SWEEP_INTERVAL_MS = 6e4;
 var PairTokenStore = class {
@@ -12025,7 +12033,7 @@ var PairTokenStore = class {
     }
   }
   mint() {
-    const token = `pt_${(0, import_crypto11.randomBytes)(16).toString("hex")}`;
+    const token = `pt_${(0, import_crypto12.randomBytes)(16).toString("hex")}`;
     const expiresAt = Date.now() + this.ttlMs;
     this.current = { token, expiresAt, used: false };
     return {
@@ -13183,7 +13191,8 @@ function createApiDeps(deps) {
                 ...pendingGate.detail ? { detail: pendingGate.detail } : {},
                 options: pendingGate.options,
                 ...pendingGate.cursor !== void 0 ? { cursor: pendingGate.cursor } : {},
-                contentKey: permissionGateKey(pendingGate)
+                contentKey: permissionGateKey(pendingGate),
+                gateId: pendingGate.gateId
               })
             );
           }
@@ -13250,7 +13259,7 @@ function createApiDeps(deps) {
 }
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
-var import_crypto12 = require("crypto");
+var import_crypto13 = require("crypto");
 var import_fs23 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
@@ -13315,7 +13324,7 @@ function envInt(name, fallback) {
 }
 function fingerprintOf(ids) {
   const sorted = [...ids].sort();
-  return `sha256:${(0, import_crypto12.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
+  return `sha256:${(0, import_crypto13.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
   constructor(cache, wsHub, log10, cacheDir, rescan, runDuringReset) {
@@ -16041,7 +16050,7 @@ var StreamerServer = class {
   runtimeStore = null;
   // Identifies this streamer run. A registry row carrying a different id is a
   // session that outlived the process that started it.
-  streamerInstanceId = (0, import_crypto13.randomUUID)();
+  streamerInstanceId = (0, import_crypto14.randomUUID)();
   cacheMetadataRepo = null;
   // Push registration + delivery state (C7). Null when the cache DB failed to
   // open — registration then degrades to a no-op rather than 500ing.