@xopcai/xopc 0.0.130 → 0.0.131

package/dist/src/gateway/hono/middleware/auth.js

@@ -14,9 +14,12 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
 init_logger();
 const log = createLogger("Gateway:Auth");
-function validateToken(providedToken, expectedToken) {
-	if (!providedToken) return false;
-	return safeEqualSecret(providedToken, expectedToken);
+function resolveExpectedCredential(auth) {
+	return auth.mode === "token" ? auth.token : auth.mode === "password" ? auth.password : void 0;
+}
+function validateCredential(providedCredential, expectedCredential) {
+	if (!providedCredential) return false;
+	return safeEqualSecret(providedCredential, expectedCredential);
 }
 function extractTokenFromHeader(authHeader) {
 	if (!authHeader) return null;
@@ -97,10 +100,20 @@ function blockedResponse(c, retryAfterSec) {
 	}, 429);
 }
 function auth(config) {
-	const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};
+	const { getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};
 	return createMiddleware(async (c, next) => {
 		const resolvedAuth = getResolvedAuth?.();
-		const authMode = resolvedAuth?.mode ?? (token ? "token" : "none");
+		if (!resolvedAuth) {
+			log.error({
+				path: c.req.path,
+				method: c.req.method
+			}, "HTTP auth rejected: gateway auth is unavailable");
+			return c.json({
+				error: "Unauthorized",
+				code: "auth_unavailable"
+			}, 401);
+		}
+		const authMode = resolvedAuth.mode;
 		if (authMode === "trusted-proxy") {
 			const proxyContext = getTrustedProxyContext?.();
 			const trustedProxies = proxyContext?.trustedProxies;
@@ -157,21 +170,33 @@ function auth(config) {
 			await next();
 			return;
 		}
-		if (authMode === "none" || !token) return next();
+		if (authMode === "none") return next();
+		const expectedCredential = resolveExpectedCredential(resolvedAuth);
+		if (!expectedCredential) {
+			log.error({
+				path: c.req.path,
+				method: c.req.method,
+				authMode
+			}, "HTTP auth rejected: credential is unavailable");
+			return c.json({
+				error: "Unauthorized",
+				code: "auth_unconfigured"
+			}, 401);
+		}
 		const proxyContext = getTrustedProxyContext?.();
 		const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);
 		const origin = c.req.header("origin");
 		const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);
 		const authHeader = extractTokenFromHeader(c.req.header("authorization"));
 		const requestPath = new URL(c.req.url).pathname;
-		const queryToken = isQueryTokenAllowedPath(requestPath, c.req.method) ? extractTokenFromQuery(c.req.url) : null;
+		const queryToken = authMode === "token" && isQueryTokenAllowedPath(requestPath, c.req.method) ? extractTokenFromQuery(c.req.url) : null;
 		if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has("token")) log.warn({
 			path: requestPath,
 			method: c.req.method,
 			clientIp
-		}, "Token in query string rejected: use Authorization header for this endpoint");
-		const providedToken = authHeader || queryToken;
-		if (providedToken && validateToken(providedToken, token)) {
+		}, "Credential in query string rejected: use Authorization header for this endpoint");
+		const providedCredential = authHeader || queryToken;
+		if (providedCredential && validateCredential(providedCredential, expectedCredential)) {
 			recordSuccess(rl);
 			await next();
 			return;
@@ -188,23 +213,23 @@ function auth(config) {
 			}, "Auth rate limit blocked");
 			return blockedResponse(c, blocked.retryAfterSec);
 		}
-		if (!providedToken) {
+		if (!providedCredential) {
 			log.warn({
 				path: c.req.path,
 				method: c.req.method,
 				clientIp,
-				reason: "missing_token",
+				reason: "missing_credential",
 				phase: "gateway.http.auth"
-			}, "HTTP auth rejected: no Bearer or ?token=");
+			}, "HTTP auth rejected: no Authorization credential");
 			logAuthEvent("auth.failed", {
 				ip: clientIp,
 				result: "denied",
-				reason: "missing_token"
+				reason: "missing_credential"
 			});
 			return c.json({
 				error: "Unauthorized",
-				code: "missing_token",
-				message: "Missing authentication token"
+				code: "missing_credential",
+				message: "Missing authentication credential"
 			}, 401);
 		}
 		recordFailure(rl);
@@ -212,18 +237,18 @@ function auth(config) {
 			path: c.req.path,
 			method: c.req.method,
 			clientIp,
-			reason: "invalid_token",
+			reason: "invalid_credential",
 			phase: "gateway.http.auth"
-		}, "HTTP auth rejected: token mismatch");
+		}, "HTTP auth rejected: credential mismatch");
 		logAuthEvent("auth.failed", {
 			ip: clientIp,
 			result: "failure",
-			reason: "invalid_token"
+			reason: "invalid_credential"
 		});
 		return c.json({
 			error: "Unauthorized",
-			code: "invalid_token",
-			message: "Invalid authentication token"
+			code: "invalid_credential",
+			message: "Invalid authentication credential"
 		}, 401);
 	});
 }

package/dist/src/gateway/hono/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger, logAuthEvent } from '../../../utils/logger.js';\n\nconst log = createLogger('Gateway:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only where the `Authorization` header cannot\n * be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent\n * avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nconst AGENT_AVATAR_GET_PATH = /^\\/api\\/agents\\/[^/]+\\/avatar$/;\n\n/** Exported for gateway security tests. */\nexport function isQueryTokenAllowedPath(path: string, method: string): boolean {\n  if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events')) {\n    return true;\n  }\n  if (method === 'GET' && AGENT_AVATAR_GET_PATH.test(path)) {\n    return true;\n  }\n  return false;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath, c.req.method)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token', phase: 'gateway.http.auth' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      void logAuthEvent('auth.failed', {\n        ip: clientIp,\n        result: 'denied',\n        reason: 'missing_token',\n      });\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token', phase: 'gateway.http.auth' },\n      'HTTP auth rejected: token mismatch',\n    );\n    void logAuthEvent('auth.failed', {\n      ip: clientIp,\n      result: 'failure',\n      reason: 'invalid_token',\n    });\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;aAkBsE;AAEtE,MAAM,MAAM,aAAa,eAAe;AAaxC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,MAAM,wBAAwB;;AAG9B,SAAgB,wBAAwB,MAAc,QAAyB;AAC7E,KAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc,CACvE,QAAO;AAET,KAAI,WAAW,SAAS,sBAAsB,KAAK,KAAK,CACtD,QAAO;AAET,QAAO;;AAGT,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,aAAa,EAAE,IAAI,OAAO,GACjE,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,OAAO;IAAqB,EACzG,2CACD;AACI,gBAAa,eAAe;IAC/B,IAAI;IACJ,QAAQ;IACR,QAAQ;IACT,CAAC;AACF,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,OAAO;GAAqB,EACzG,qCACD;AACI,eAAa,eAAe;GAC/B,IAAI;GACJ,QAAQ;GACR,QAAQ;GACT,CAAC;AACF,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger, logAuthEvent } from '../../../utils/logger.js';\n\nconst log = createLogger('Gateway:Auth');\n\nexport interface AuthConfig {\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction resolveExpectedCredential(auth: ResolvedGatewayAuth): string | undefined {\n  return auth.mode === 'token' ? auth.token : auth.mode === 'password' ? auth.password : undefined;\n}\n\nfunction validateCredential(providedCredential: string | undefined, expectedCredential: string): boolean {\n  if (!providedCredential) return false;\n  return safeEqualSecret(providedCredential, expectedCredential);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only where the `Authorization` header cannot\n * be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent\n * avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nconst AGENT_AVATAR_GET_PATH = /^\\/api\\/agents\\/[^/]+\\/avatar$/;\n\n/** Exported for gateway security tests. */\nexport function isQueryTokenAllowedPath(path: string, method: string): boolean {\n  if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events')) {\n    return true;\n  }\n  if (method === 'GET' && AGENT_AVATAR_GET_PATH.test(path)) {\n    return true;\n  }\n  return false;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    if (!resolvedAuth) {\n      log.error({ path: c.req.path, method: c.req.method }, 'HTTP auth rejected: gateway auth is unavailable');\n      return c.json({ error: 'Unauthorized', code: 'auth_unavailable' }, 401);\n    }\n    const authMode = resolvedAuth.mode;\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none') {\n      return next();\n    }\n\n    const expectedCredential = resolveExpectedCredential(resolvedAuth);\n    if (!expectedCredential) {\n      log.error({ path: c.req.path, method: c.req.method, authMode }, 'HTTP auth rejected: credential is unavailable');\n      return c.json({ error: 'Unauthorized', code: 'auth_unconfigured' }, 401);\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = authMode === 'token' && isQueryTokenAllowedPath(requestPath, c.req.method)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Credential in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedCredential = authHeader || queryToken;\n\n    if (providedCredential && validateCredential(providedCredential, expectedCredential)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing credentials are unauthenticated requests, not brute-force signals —\n    // page reloads / SDK cold starts often hit endpoints before credentials are\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedCredential) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_credential', phase: 'gateway.http.auth' },\n        'HTTP auth rejected: no Authorization credential',\n      );\n      void logAuthEvent('auth.failed', {\n        ip: clientIp,\n        result: 'denied',\n        reason: 'missing_credential',\n      });\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_credential', message: 'Missing authentication credential' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_credential', phase: 'gateway.http.auth' },\n      'HTTP auth rejected: credential mismatch',\n    );\n    void logAuthEvent('auth.failed', {\n      ip: clientIp,\n      result: 'failure',\n      reason: 'invalid_credential',\n    });\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_credential', message: 'Invalid authentication credential' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;aAkBsE;AAEtE,MAAM,MAAM,aAAa,eAAe;AAYxC,SAAS,0BAA0B,MAA+C;AAChF,QAAO,KAAK,SAAS,UAAU,KAAK,QAAQ,KAAK,SAAS,aAAa,KAAK,WAAW,KAAA;;AAGzF,SAAS,mBAAmB,oBAAwC,oBAAqC;AACvG,KAAI,CAAC,mBAAoB,QAAO;AAChC,QAAO,gBAAgB,oBAAoB,mBAAmB;;AAGhE,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,MAAM,wBAAwB;;AAG9B,SAAgB,wBAAwB,MAAc,QAAyB;AAC7E,KAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc,CACvE,QAAO;AAET,KAAI,WAAW,SAAS,sBAAsB,KAAK,KAAK,CACtD,QAAO;AAET,QAAO;;AAGT,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEhF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;AACxC,MAAI,CAAC,cAAc;AACjB,OAAI,MAAM;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ,EAAE,kDAAkD;AACxG,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,MAAM;IAAoB,EAAE,IAAI;;EAEzE,MAAM,WAAW,aAAa;AAE9B,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,OACf,QAAO,MAAM;EAGf,MAAM,qBAAqB,0BAA0B,aAAa;AAClE,MAAI,CAAC,oBAAoB;AACvB,OAAI,MAAM;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,EAAE,gDAAgD;AAChH,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,MAAM;IAAqB,EAAE,IAAI;;EAG1E,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,aAAa,WAAW,wBAAwB,aAAa,EAAE,IAAI,OAAO,GACzF,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,kFACD;EAGH,MAAM,qBAAqB,cAAc;AAEzC,MAAI,sBAAsB,mBAAmB,oBAAoB,mBAAmB,EAAE;AACpF,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,oBAAoB;AACvB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAsB,OAAO;IAAqB,EAC9G,kDACD;AACI,gBAAa,eAAe;IAC/B,IAAI;IACJ,QAAQ;IACR,QAAQ;IACT,CAAC;AACF,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAsB,SAAS;IAAqC,EACnG,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAsB,OAAO;GAAqB,EAC9G,0CACD;AACI,eAAa,eAAe;GAC/B,IAAI;GACJ,QAAQ;GACR,QAAQ;GACT,CAAC;AACF,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAsB,SAAS;GAAqC,EACnG,IACD;GACD"}

package/dist/src/gateway/hono/routes/sessions.js

@@ -7,6 +7,7 @@ import { deleteMediaUrisNoLongerReferenced } from "../../../media/session-refere
 import { createGatewayRouteLogger, logRouteError } from "../lib/route-logger.js";
 import { computeUserRoundDeleteRange } from "../../../session/user-round-delete.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
+import { randomUUID } from "node:crypto";
 //#region src/gateway/hono/routes/sessions.ts
 init_session_key();
 const log = createGatewayRouteLogger("Sessions");
@@ -54,16 +55,6 @@ function buildDirectSessionMetadata(params) {
 		customData: { genericNewChatShell: params.source === "webchat" && params.peerId.startsWith("chat_") }
 	};
 }
-function isGenericNewChatShell(session, agentId, projectId) {
-	if (session.messageCount !== 0) return false;
-	if (session.routing?.agentId !== agentId) return false;
-	if (projectId ? session.projectId !== projectId : Boolean(session.projectId)) return false;
-	if (session.parentSessionKey || session.workflowRunId || session.workflowDefinitionId) return false;
-	if (session.customData?.genericNewChatShell === false) return false;
-	const sourceBinding = session.customData?.sourceBinding;
-	if (sourceBinding && typeof sourceBinding === "object") return false;
-	return Boolean(session.routing?.peerId?.startsWith("chat_"));
-}
 function registerSessionsRoutes(authenticated, deps) {
 	const { service } = deps;
 	authenticated.get("/api/sidebar/chat-list", async (c) => {
@@ -158,23 +149,7 @@ function registerSessionsRoutes(authenticated, deps) {
 			const session = await service.sessions.getSession(sessionKey);
 			return c.json({ session }, 201);
 		}
-		const emptySession = (await service.sessions.listSessions({
-			channel,
-			includeHidden: true,
-			limit: 50,
-			sortBy: "updatedAt",
-			sortOrder: "desc"
-		})).items.find((s) => {
-			return isGenericNewChatShell(s, agentId, projectId);
-		});
-		if (emptySession) {
-			const session = await service.sessions.getSession(emptySession.key);
-			return c.json({
-				session,
-				reused: true
-			}, 200);
-		}
-		const chatId = `chat_${Date.now()}`;
+		const chatId = `chat_${randomUUID()}`;
 		const sessionKey = buildSessionKey({
 			agentId,
 			source: channel,

package/dist/src/gateway/hono/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","names":[],"sources":["../../../../../src/gateway/hono/routes/sessions.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { buildSessionKey } from '../../../routing/session-key.js';\nimport { resolveProjectAgentId } from '../../../projects/index.js';\nimport type { SessionMetadataSeed } from '../../../storage/sqlite/index.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { createGatewayRouteLogger, logRouteError } from '../lib/route-logger.js';\nimport { messagesToClientHistory } from '../../../session/client-history.js';\nimport type { SessionType } from '../../../session/types.js';\nimport { computeUserRoundDeleteRange } from '../../../session/user-round-delete.js';\nimport { deleteMediaUrisNoLongerReferenced } from '../../../media/session-references.js';\nimport { respondStartupUnavailable } from '../lib/startup-unavailable.js';\nimport type { StartupUnavailableGatewayMethod } from '../../startup-readiness.js';\nimport { evictEmbeddedSessionRunner } from '../../../agent/embedded/session-runner.js';\n\nconst log = createGatewayRouteLogger('Sessions');\n\ntype SessionsStartupMethod = StartupUnavailableGatewayMethod;\n\nconst SESSION_TYPES = new Set<SessionType>(['chat', 'workflow-run', 'workflow-subagent', 'cron', 'heartbeat']);\nconst DEFAULT_SIDEBAR_STALE_DAYS = 60;\n\nfunction isSessionType(value: string): value is SessionType {\n  return SESSION_TYPES.has(value as SessionType);\n}\n\nfunction ensureGatewayReadyForSessions(\n  c: Parameters<typeof respondStartupUnavailable>[0],\n  service: AuthenticatedRouteDeps['service'],\n  method: SessionsStartupMethod,\n): Response | null {\n  if (service.isGatewayReady()) {\n    return null;\n  }\n  return respondStartupUnavailable(c, method);\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number, max: number): number {\n  const parsed = value ? Number.parseInt(value, 10) : fallback;\n  if (!Number.isFinite(parsed)) return fallback;\n  return Math.min(max, Math.max(1, parsed));\n}\n\nfunction parseOffset(value: string | undefined): number {\n  const parsed = value ? Number.parseInt(value, 10) : 0;\n  return Number.isFinite(parsed) ? Math.max(0, parsed) : 0;\n}\n\nfunction buildDirectSessionMetadata(params: {\n  agentId: string;\n  source: string;\n  accountId: string;\n  peerId: string;\n}): SessionMetadataSeed {\n  return {\n    sourceChannel: params.source,\n    sourceChatId: [params.accountId, 'direct', params.peerId].join(':'),\n    sessionType: 'chat',\n    hiddenFromSessionList: true,\n    routing: {\n      agentId: params.agentId,\n      source: params.source,\n      accountId: params.accountId,\n      peerKind: 'direct',\n      peerId: params.peerId,\n    },\n    customData: {\n      genericNewChatShell: params.source === 'webchat' && params.peerId.startsWith('chat_'),\n    },\n  };\n}\n\nfunction isGenericNewChatShell(session: {\n  messageCount?: number;\n  routing?: { agentId?: string; peerId?: string };\n  projectId?: string;\n  customData?: Record<string, unknown>;\n  parentSessionKey?: string;\n  workflowRunId?: string;\n  workflowDefinitionId?: string;\n}, agentId: string, projectId: string | undefined): boolean {\n  if (session.messageCount !== 0) return false;\n  if (session.routing?.agentId !== agentId) return false;\n  if (projectId ? session.projectId !== projectId : Boolean(session.projectId)) return false;\n  if (session.parentSessionKey || session.workflowRunId || session.workflowDefinitionId) return false;\n  if (session.customData?.genericNewChatShell === false) return false;\n  const sourceBinding = session.customData?.sourceBinding;\n  if (sourceBinding && typeof sourceBinding === 'object') return false;\n  return Boolean(session.routing?.peerId?.startsWith('chat_'));\n}\n\nexport function registerSessionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  // ========== Session REST API (/api/sessions) ==========\n\n  authenticated.get('/api/sidebar/chat-list', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.list');\n    if (blocked) {\n      return blocked;\n    }\n\n    const projectLimit = parsePositiveInt(c.req.query('projectLimit'), 12, 50);\n    const projectOffset = parseOffset(c.req.query('projectOffset'));\n    const sessionPreviewLimit = parsePositiveInt(c.req.query('sessionPreviewLimit'), 5, 20);\n    const inboxLimit = parsePositiveInt(c.req.query('inboxLimit'), 20, 100);\n    const inboxOffset = parseOffset(c.req.query('inboxOffset'));\n    const staleDays = parsePositiveInt(c.req.query('staleDays'), DEFAULT_SIDEBAR_STALE_DAYS, 3650);\n    const updatedAfter = Date.now() - staleDays * 24 * 60 * 60 * 1000;\n    const includeSessionKey = c.req.query('includeSessionKey')?.trim() || undefined;\n\n    const projects = service.projects.listWithSidebarSessions({\n      status: 'active',\n      limit: projectLimit,\n      offset: projectOffset,\n      updatedAfter,\n      includePinned: true,\n      includeSessionKey,\n    });\n    const projectItems = await Promise.all(\n      projects.items.map(async (project) => {\n        const sessions = await service.sessions.listSessions({\n          projectId: project.id,\n          limit: sessionPreviewLimit,\n          offset: 0,\n          updatedAfter,\n          includePinned: true,\n          includeSessionKey,\n          sortBy: 'updatedAt',\n          sortOrder: 'desc',\n        });\n        return {\n          project,\n          sessions: sessions.items,\n          sessionTotal: sessions.total,\n          sessionHasMore: sessions.hasMore,\n        };\n      }),\n    );\n    const inbox = await service.sessions.listSessions({\n      unassigned: true,\n      limit: inboxLimit,\n      offset: inboxOffset,\n      updatedAfter,\n      includePinned: true,\n      includeSessionKey,\n      sortBy: 'updatedAt',\n      sortOrder: 'desc',\n    });\n\n    return c.json({\n      ok: true,\n      projects: {\n        items: projectItems,\n        total: projects.total,\n        limit: projects.limit,\n        offset: projects.offset,\n        hasMore: projects.hasMore,\n      },\n      inbox,\n    });\n  });\n\n  // POST /api/sessions - Create new session (reuses empty sessions)\n  authenticated.post('/api/sessions', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const channel = body.channel || 'webchat';\n    const projectId = typeof body.projectId === 'string' && body.projectId.trim() ? body.projectId.trim() : undefined;\n    const routingCfg = service.currentConfig;\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ ok: false, error: 'Project not found' }, 404);\n    }\n    const agentId = resolveProjectAgentId({\n      config: routingCfg,\n      projects: service.projects,\n      explicitAgentId: typeof body.agentId === 'string' ? body.agentId : undefined,\n      projectId,\n    });\n\n    // If a specific chat_id is provided, use it (for advanced use cases)\n    // Otherwise, try to find and reuse an existing empty session\n    if (body.chat_id) {\n      const sessionKey = buildSessionKey({\n        agentId,\n        source: channel,\n        accountId: 'default',\n        peerKind: 'direct',\n        peerId: body.chat_id,\n      });\n\n      await service.sessionIndexInstance.saveMessages(sessionKey, [], {\n        metadata: buildDirectSessionMetadata({\n          agentId,\n          source: channel,\n          accountId: 'default',\n          peerId: body.chat_id,\n        }),\n      });\n      if (projectId) {\n        service.projects.attachSession(sessionKey, projectId);\n      }\n      const session = await service.sessions.getSession(sessionKey);\n      return c.json({ session }, 201);\n    }\n\n    // Look for existing empty sessions to reuse\n    const existingSessions = await service.sessions.listSessions({\n      channel,\n      includeHidden: true,\n      limit: 50,\n      sortBy: 'updatedAt',\n      sortOrder: 'desc',\n    });\n    \n    // Reuse an empty session only when it matches the requested agent (session key embeds agent id).\n    const emptySession = existingSessions.items.find((s) => {\n      return isGenericNewChatShell(s, agentId, projectId);\n    });\n    \n    if (emptySession) {\n      // Return existing empty session instead of creating a new one\n      const session = await service.sessions.getSession(emptySession.key);\n      return c.json({ session, reused: true }, 200);\n    }\n    \n    // No empty session found, create a new one\n    const chatId = `chat_${Date.now()}`;\n    const sessionKey = buildSessionKey({\n      agentId,\n      source: channel,\n      accountId: 'default',\n      peerKind: 'direct',\n      peerId: chatId,\n    });\n\n    await service.sessionIndexInstance.saveMessages(sessionKey, [], {\n      metadata: buildDirectSessionMetadata({\n        agentId,\n        source: channel,\n        accountId: 'default',\n        peerId: chatId,\n      }),\n    });\n\n    if (projectId) {\n      service.projects.attachSession(sessionKey, projectId);\n    }\n    const session = await service.sessions.getSession(sessionKey);\n    return c.json({ session }, 201);\n  });\n\n  // GET /api/sessions - List sessions\n  authenticated.get('/api/sessions', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.list');\n    if (blocked) {\n      return blocked;\n    }\n    const query = c.req.query();\n    const sessionTypes = query.types\n      ?.split(',')\n      .map((value) => value.trim())\n      .filter(isSessionType);\n    const result = await service.sessions.listSessions({\n      status: query.status as any,\n      search: query.search,\n      channel: query.channel,\n      sessionTypes: sessionTypes?.length ? sessionTypes : undefined,\n      includeHidden: query.includeHidden === 'true',\n      projectId: query.projectId,\n      unassigned: query.unassigned === 'true',\n      updatedAfter: query.updatedAfter ? parseInt(query.updatedAfter) : undefined,\n      includePinned: query.includePinned === 'true',\n      includeSessionKey: query.includeSessionKey,\n      limit: query.limit ? parseInt(query.limit) : undefined,\n      offset: query.offset ? parseInt(query.offset) : undefined,\n    });\n    return c.json(result);\n  });\n\n  // GET /api/sessions/stats - Get session stats (must be before /:key)\n  authenticated.get('/api/sessions/stats', async (c) => {\n    const result = await service.sessions.stats();\n    return c.json(result);\n  });\n\n  // GET /api/sessions/chat-ids - Get unique chat IDs from sessions (must be before /:key)\n  authenticated.get('/api/sessions/chat-ids', async (c) => {\n    const channel = c.req.query('channel');\n    const chatIds = await service.sessions.chatIds(channel || undefined);\n    return c.json({ ok: true, payload: { chatIds } });\n  });\n\n  // GET /api/sessions/resolve?sessionId=... - Resolve OpenClaw-style session id to canonical key.\n  authenticated.get('/api/sessions/resolve', async (c) => {\n    const result = await service.sessions.resolveSession({\n      sessionId: c.req.query('sessionId'),\n      sessionKey: c.req.query('sessionKey') ?? c.req.query('key'),\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: result });\n  });\n\n  // POST /api/sessions/resolve - Resolve by JSON body (`sessionId`, `sessionKey`, or `key`).\n  authenticated.post('/api/sessions/resolve', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const result = await service.sessions.resolveSession({\n      sessionId: typeof body.sessionId === 'string' ? body.sessionId : undefined,\n      sessionKey: typeof body.sessionKey === 'string' ? body.sessionKey : undefined,\n      key: typeof body.key === 'string' ? body.key : undefined,\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: result });\n  });\n\n  // GET /api/sessions/:key/run — read-only active webchat agent run (for UI resume)\n  authenticated.get('/api/sessions/:key/run', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.run');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: service.sessions.getActiveRun(key) });\n  });\n\n  // GET /api/sessions/:key/agent-config — resolved session agent settings (thinking, etc.)\n  authenticated.get('/api/sessions/:key/agent-config', async (c) => {\n    const key = c.req.param('key');\n    const payload = await service.sessions.getAgentConfig(key);\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.patch('/api/sessions/:key/agent-config', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const result = await service.sessions.patchAgentConfig(key, body);\n    if (!result.ok) {\n      return c.json({ ok: false, error: result.error }, 400);\n    }\n    return c.json({ ok: true });\n  });\n\n  // GET /api/sessions/:key/messages — flattened transcript for TUI / clients\n  authenticated.get('/api/sessions/:key/messages', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.messages');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const limitRaw = c.req.query('limit');\n    const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;\n    const limit =\n      parsedLimit !== undefined && Number.isFinite(parsedLimit)\n        ? Math.min(500, Math.max(1, parsedLimit))\n        : undefined;\n\n    const before = c.req.query('before')?.trim();\n    const offsetRaw = c.req.query('offset');\n    const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n    const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n\n    const result = await service.sessions.getMessagePage(key, {\n      limit,\n      offset,\n      ...(before ? { before } : {}),\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n\n    const messages = messagesToClientHistory(result.session.messages, { limit });\n    return c.json({\n      ok: true,\n      payload: { messages },\n      pagination: result.pagination,\n    });\n  });\n\n  // GET /api/sessions/:key/history — UI chat history page from the newest tail.\n  authenticated.get('/api/sessions/:key/history', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const offsetRaw = c.req.query('offset');\n    const limitRaw = c.req.query('limit');\n    const before = c.req.query('before')?.trim();\n    const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n    const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : 50;\n    const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n    const limit = Number.isFinite(parsedLimit) ? Math.min(200, Math.max(1, parsedLimit)) : 50;\n    const result = await service.sessions.getMessagePage(key, {\n      offset,\n      limit,\n      ...(before ? { before } : {}),\n    });\n\n    if (!result) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    return c.json(result);\n  });\n\n  // GET /api/sessions/:key/timeline — row-backed conversation outline for Web / TUI navigation.\n  authenticated.get('/api/sessions/:key/timeline', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const items = await service.sessions.getTimeline(key);\n    if (!items) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, items });\n  });\n\n  // GET /api/sessions/:key/transcript/window — TUI-focused transcript slice around a row.\n  authenticated.get('/api/sessions/:key/transcript/window', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const rowNumberRaw = c.req.query('rowNumber');\n    const rowNumber = rowNumberRaw ? Number.parseInt(rowNumberRaw, 10) : NaN;\n    if (!Number.isFinite(rowNumber) || rowNumber < 1) {\n      return c.json({ ok: false, error: 'rowNumber must be a positive integer' }, 400);\n    }\n    const before = parsePositiveInt(c.req.query('before'), 80, 200);\n    const after = parsePositiveInt(c.req.query('after'), 120, 200);\n    const window = await service.sessions.getTranscriptWindow(key, { rowNumber, before, after });\n    if (!window) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: window });\n  });\n\n  // POST /api/sessions/:key/transcript/context — append persisted-only `kind: 'context'` row (not in LLM context)\n  authenticated.post('/api/sessions/:key/transcript/context', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const id = typeof body.id === 'string' && body.id.trim() ? body.id.trim() : undefined;\n    const text = typeof body.text === 'string' ? body.text : undefined;\n    const data =\n      body.data !== undefined && typeof body.data === 'object' && body.data !== null && !Array.isArray(body.data)\n        ? (body.data as Record<string, unknown>)\n        : undefined;\n    await service.sessionIndexInstance.appendTranscriptContextEntry(key, { id, text, data });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/label — append label change for a transcript entry.\n  authenticated.post('/api/sessions/:key/transcript/label', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const targetId = typeof body.targetId === 'string' ? body.targetId.trim() : '';\n    if (!targetId) {\n      return c.json({ ok: false, error: 'targetId is required' }, 400);\n    }\n    const label = typeof body.label === 'string' && body.label.trim() ? body.label.trim() : undefined;\n    await service.sessionIndexInstance.appendTranscriptLabelEntry(key, { targetId, label });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/custom — append extension state for TUI replay.\n  authenticated.post('/api/sessions/:key/transcript/custom', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const customType = typeof body.customType === 'string' ? body.customType.trim() : '';\n    if (!customType) {\n      return c.json({ ok: false, error: 'customType is required' }, 400);\n    }\n    await service.sessionIndexInstance.appendTranscriptCustomEntry(key, {\n      customType,\n      data: body.data,\n    });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/custom-message — append visible extension custom message.\n  authenticated.post('/api/sessions/:key/transcript/custom-message', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const customType = typeof body.customType === 'string' ? body.customType.trim() : '';\n    if (!customType) {\n      return c.json({ ok: false, error: 'customType is required' }, 400);\n    }\n    const content =\n      typeof body.content === 'string' || Array.isArray(body.content) ? body.content : '';\n    await service.sessionIndexInstance.appendTranscriptCustomMessageEntry(key, {\n      customType,\n      content,\n      display: typeof body.display === 'boolean' ? body.display : undefined,\n      details: body.details,\n    });\n    evictEmbeddedSessionRunner(key, 'gateway_custom_message_appended');\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/bash — append local TUI shell execution.\n  authenticated.post('/api/sessions/:key/transcript/bash', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const command = typeof body.command === 'string' ? body.command.trim() : '';\n    if (!command) {\n      return c.json({ ok: false, error: 'command is required' }, 400);\n    }\n    await service.sessionIndexInstance.appendTranscriptBashExecutionEntry(key, {\n      command,\n      output: typeof body.output === 'string' ? body.output : '',\n      exitCode: typeof body.exitCode === 'number' ? body.exitCode : body.exitCode === null ? null : undefined,\n      signal: typeof body.signal === 'string' ? body.signal : body.signal === null ? null : undefined,\n      excludeFromContext: body.excludeFromContext === true,\n      truncated: body.truncated === true,\n      fullOutputPath: typeof body.fullOutputPath === 'string' ? body.fullOutputPath : undefined,\n    });\n    evictEmbeddedSessionRunner(key, 'gateway_bash_execution_appended');\n    return c.json({ ok: true });\n  });\n\n  // GET /api/sessions/:key/compaction/checkpoints — list pre-compaction snapshots (OpenClaw-style)\n  authenticated.get('/api/sessions/:key/compaction/checkpoints', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const checkpoints = await service.sessions.listCompactionCheckpoints(key);\n    return c.json({ ok: true, payload: { checkpoints } });\n  });\n\n  authenticated.get('/api/sessions/:key/compaction/checkpoints/:checkpointId', async (c) => {\n    const key = c.req.param('key');\n    const checkpointId = c.req.param('checkpointId');\n    const checkpoint = await service.sessions.getCompactionCheckpoint(key, checkpointId);\n    if (!checkpoint) {\n      return c.json({ ok: false, error: 'Checkpoint not found' }, 404);\n    }\n    return c.json({ ok: true, payload: { checkpoint } });\n  });\n\n  authenticated.post('/api/sessions/:key/compaction/restore', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const checkpointId = typeof body.checkpointId === 'string' ? body.checkpointId.trim() : '';\n    if (!checkpointId) {\n      return c.json({ ok: false, error: 'checkpointId required' }, 400);\n    }\n    try {\n      await service.sessions.restoreCompactionCheckpoint(key, checkpointId);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.sessions', { operation: 'restoreCheckpoint', sessionKey: key });\n      const msg = err instanceof Error ? err.message : String(err);\n      if (msg.includes('not found') || msg.includes('Invalid')) {\n        return c.json({ ok: false, error: msg }, 404);\n      }\n      return c.json({ ok: false, error: msg }, 500);\n    }\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, session });\n  });\n\n  authenticated.post('/api/sessions/:key/compaction/run', async (c) => {\n    const key = c.req.param('key');\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const instructions = typeof body.instructions === 'string' ? body.instructions : undefined;\n    const force = typeof body.force === 'boolean' ? body.force : true;\n    const result = await service.sessions.runCompaction(key, { instructions, force });\n    return c.json({ ok: true, payload: { result } });\n  });\n\n  // GET /api/sessions/:key - Get single session (must be after /stats and /chat-ids)\n  authenticated.get('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const includeRaw = c.req.query('include') ?? '';\n    const includeSet = new Set(\n      includeRaw\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean),\n    );\n    const includeTranscript = includeSet.has('transcript');\n    const includeTranscriptRows = includeSet.has('transcriptRows');\n    const offsetRaw = c.req.query('offset');\n    const limitRaw = c.req.query('limit');\n    const hasPagingQuery = offsetRaw !== undefined || limitRaw !== undefined;\n\n    if (hasPagingQuery) {\n      const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n      if (blocked) {\n        return blocked;\n      }\n      const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n      const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : 50;\n      const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n      const limit = Number.isFinite(parsedLimit) ? Math.min(200, Math.max(1, parsedLimit)) : 50;\n      const result = await service.sessions.getMessagePage(key, {\n        offset,\n        limit,\n        includeTranscriptSummary: includeTranscript,\n        includeTranscriptRows,\n      });\n      if (!result) {\n        return c.json({ error: 'Session not found' }, 404);\n      }\n      return c.json(result);\n    }\n\n    const session = await service.sessions.getSession(key, {\n      includeTranscriptSummary: includeTranscript,\n      includeTranscriptRows,\n    });\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n    return c.json({ session });\n  });\n\n  // PATCH /api/sessions/:key - Partial metadata (name, tags, customData); OpenClaw-style patch subset\n  authenticated.patch('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const patch: {\n      name?: string;\n      tags?: string[];\n      replaceTags?: boolean;\n      customData?: Record<string, unknown>;\n    } = {};\n    if (typeof body.name === 'string') {\n      patch.name = body.name;\n    }\n    if (Array.isArray(body.tags)) {\n      patch.tags = body.tags;\n    }\n    if (typeof body.replaceTags === 'boolean') {\n      patch.replaceTags = body.replaceTags;\n    }\n    if (body.customData !== undefined && typeof body.customData === 'object' && body.customData !== null) {\n      patch.customData = body.customData as Record<string, unknown>;\n    }\n    let requestedProjectId: string | null | undefined;\n    if ('projectId' in body) {\n      requestedProjectId = typeof body.projectId === 'string' && body.projectId.trim() ? body.projectId.trim() : null;\n      if (requestedProjectId && !service.projects.get(requestedProjectId)) {\n        return c.json({ ok: false, error: 'Project not found' }, 404);\n      }\n    }\n    const result = await service.sessions.patch(key, patch);\n    if (result.ok === false) {\n      return c.json({ ok: false, error: result.error }, 404);\n    }\n    if (requestedProjectId !== undefined) {\n      try {\n        if (requestedProjectId) {\n          service.projects.attachSession(key, requestedProjectId);\n        } else {\n          service.projects.detachSession(key);\n        }\n      } catch (error) {\n        return c.json({ ok: false, error: error instanceof Error ? error.message : String(error) }, 404);\n      }\n    }\n\n    const session = await service.sessions.getSession(key);\n    return c.json({ ok: true, session });\n  });\n\n  // GET /api/sessions/:key/export - Export session (must be before /:key)\n  authenticated.get('/api/sessions/:key/export', async (c) => {\n    const key = c.req.param('key');\n    const format = c.req.query('format') as any || 'json';\n    const result = await service.sessions.export(key, format);\n    return c.json(result);\n  });\n\n  authenticated.post('/api/sessions/import', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    const content = typeof body.content === 'string' ? body.content : '';\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    if (!content.trim()) {\n      return c.json({ ok: false, error: 'content is required' }, 400);\n    }\n    try {\n      const result = await service.sessions.importExport(targetKey, content);\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  authenticated.post('/api/sessions/:key/btw', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const question = typeof body.question === 'string' ? body.question : '';\n    const result = await service.sessions.btwQuery(key, question);\n    return c.json(result);\n  });\n\n  authenticated.post('/api/sessions/:key/fork', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    try {\n      const result = await service.sessions.fork(key, targetKey);\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  authenticated.post('/api/sessions/:key/fork-row', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    const throughRow = typeof body.throughRow === 'number' ? Math.trunc(body.throughRow) : NaN;\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    if (!Number.isFinite(throughRow) || throughRow < 1) {\n      return c.json({ ok: false, error: 'throughRow must be a positive integer' }, 400);\n    }\n    try {\n      const result = await service.sessions.forkRows(key, targetKey, { throughRow });\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  // DELETE /api/sessions/:key/messages — delete LLM rows by range or by user turn.\n  // `userRoundIndex` (0-based among user messages) removes the user row and every following\n  // assistant / tool / toolResult row until the next user. Prefer this from the web console so\n  // tool loops are not left orphaned after retry/delete.\n  authenticated.delete('/api/sessions/:key/messages', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const loaded = await service.sessionIndexInstance.loadMessages(key);\n    if (!loaded) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    let startIndex = typeof body.startIndex === 'number' ? body.startIndex : -1;\n    let count = typeof body.count === 'number' ? body.count : 0;\n    const userRoundIndex =\n      typeof body.userRoundIndex === 'number' ? body.userRoundIndex : undefined;\n\n    if (userRoundIndex !== undefined) {\n      const range = computeUserRoundDeleteRange(loaded, userRoundIndex);\n      if (!range) {\n        return c.json({ error: 'User round index out of range' }, 400);\n      }\n      startIndex = range.startIndex;\n      count = range.count;\n    }\n\n    if (startIndex < 0 || count <= 0) {\n      return c.json({ error: 'Invalid startIndex or count' }, 400);\n    }\n    if (startIndex >= loaded.length) {\n      return c.json({ error: 'Index out of range' }, 400);\n    }\n    const deleteCount = Math.min(count, loaded.length - startIndex);\n    const removed = loaded.slice(startIndex, startIndex + deleteCount);\n    const next = loaded.slice(0, startIndex).concat(loaded.slice(startIndex + deleteCount));\n    await service.sessionIndexInstance.saveMessages(key, next);\n    await deleteMediaUrisNoLongerReferenced({ removed, remaining: next });\n    return c.json({ ok: true, deleted: deleteCount });\n  });\n\n  // POST /api/sessions/:key/reset - Reset session (archive transcript, new session id; keep key + overrides)\n  authenticated.post('/api/sessions/:key/reset', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.reset');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const result = await service.sessions.reset(key);\n    if (result.ok === false) {\n      const status = result.error === 'Session not found' ? 404 : 400;\n      return c.json({ ok: false, error: result.error }, status);\n    }\n    const session = await service.sessions.getSession(key);\n    return c.json({\n      ok: true,\n      reset: true,\n      sessionId: result.sessionId,\n      previousSessionId: result.previousSessionId,\n      session,\n    });\n  });\n\n  // DELETE /api/sessions/:key - Delete session (removes key from index)\n  authenticated.delete('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.delete(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/archive - Archive session\n  authenticated.post('/api/sessions/:key/archive', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.archive(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/unarchive - Unarchive session\n  authenticated.post('/api/sessions/:key/unarchive', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.unarchive(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/pin - Pin session\n  authenticated.post('/api/sessions/:key/pin', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.pin(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/unpin - Unpin session\n  authenticated.post('/api/sessions/:key/unpin', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.unpin(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/rename - Rename session\n  authenticated.post('/api/sessions/:key/rename', async (c) => {\n    const key = c.req.param('key');\n\n    const body = await c.req.json();\n    const { name } = body;\n    const result = await service.sessions.rename(key, name);\n    return c.json(result);\n  });\n\n  // ========== Subagent REST API (/api/subagents) ==========\n\n  // GET /api/subagents - List subagent sessions\n  authenticated.get('/api/subagents', async (c) => {\n    const query = c.req.query();\n    const result = await service.sessions.listSubagents({\n      limit: query.limit ? parseInt(query.limit) : undefined,\n      offset: query.offset ? parseInt(query.offset) : undefined,\n    });\n    return c.json(result);\n  });\n\n  // GET /api/subagents/:key - Get subagent session detail\n  authenticated.get('/api/subagents/:key', async (c) => {\n    const key = c.req.param('key');\n    // Verify it's a subagent session\n    if (!key.startsWith('subagent:')) {\n      return c.json({ error: 'Not a subagent session' }, 400);\n    }\n    const includeRaw = c.req.query('include') ?? '';\n    const includeSet = new Set(\n      includeRaw\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean),\n    );\n    const session = await service.sessions.getSession(key, {\n      includeTranscriptSummary: includeSet.has('transcript'),\n      includeTranscriptRows: includeSet.has('transcriptRows'),\n    });\n    if (!session) {\n      return c.json({ error: 'Subagent session not found' }, 404);\n    }\n    return c.json({ session });\n  });\n}\n"],"mappings":";;;;;;;;;;kBAEkE;AAalE,MAAM,MAAM,yBAAyB,WAAW;AAIhD,MAAM,gBAAgB,IAAI,IAAiB;CAAC;CAAQ;CAAgB;CAAqB;CAAQ;CAAY,CAAC;AAC9G,MAAM,6BAA6B;AAEnC,SAAS,cAAc,OAAqC;AAC1D,QAAO,cAAc,IAAI,MAAqB;;AAGhD,SAAS,8BACP,GACA,SACA,QACiB;AACjB,KAAI,QAAQ,gBAAgB,CAC1B,QAAO;AAET,QAAO,0BAA0B,GAAG,OAAO;;AAG7C,SAAS,iBAAiB,OAA2B,UAAkB,KAAqB;CAC1F,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,GAAG,GAAG;AACpD,KAAI,CAAC,OAAO,SAAS,OAAO,CAAE,QAAO;AACrC,QAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;;AAG3C,SAAS,YAAY,OAAmC;CACtD,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,GAAG,GAAG;AACpD,QAAO,OAAO,SAAS,OAAO,GAAG,KAAK,IAAI,GAAG,OAAO,GAAG;;AAGzD,SAAS,2BAA2B,QAKZ;AACtB,QAAO;EACL,eAAe,OAAO;EACtB,cAAc;GAAC,OAAO;GAAW;GAAU,OAAO;GAAO,CAAC,KAAK,IAAI;EACnE,aAAa;EACb,uBAAuB;EACvB,SAAS;GACP,SAAS,OAAO;GAChB,QAAQ,OAAO;GACf,WAAW,OAAO;GAClB,UAAU;GACV,QAAQ,OAAO;GAChB;EACD,YAAY,EACV,qBAAqB,OAAO,WAAW,aAAa,OAAO,OAAO,WAAW,QAAQ,EACtF;EACF;;AAGH,SAAS,sBAAsB,SAQ5B,SAAiB,WAAwC;AAC1D,KAAI,QAAQ,iBAAiB,EAAG,QAAO;AACvC,KAAI,QAAQ,SAAS,YAAY,QAAS,QAAO;AACjD,KAAI,YAAY,QAAQ,cAAc,YAAY,QAAQ,QAAQ,UAAU,CAAE,QAAO;AACrF,KAAI,QAAQ,oBAAoB,QAAQ,iBAAiB,QAAQ,qBAAsB,QAAO;AAC9F,KAAI,QAAQ,YAAY,wBAAwB,MAAO,QAAO;CAC9D,MAAM,gBAAgB,QAAQ,YAAY;AAC1C,KAAI,iBAAiB,OAAO,kBAAkB,SAAU,QAAO;AAC/D,QAAO,QAAQ,QAAQ,SAAS,QAAQ,WAAW,QAAQ,CAAC;;AAG9D,SAAgB,uBAAuB,eAAqB,MAAoC;CAC9F,MAAM,EAAE,YAAY;AAIpB,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,8BAA8B,GAAG,SAAS,gBAAgB;AAC1E,MAAI,QACF,QAAO;EAGT,MAAM,eAAe,iBAAiB,EAAE,IAAI,MAAM,eAAe,EAAE,IAAI,GAAG;EAC1E,MAAM,gBAAgB,YAAY,EAAE,IAAI,MAAM,gBAAgB,CAAC;EAC/D,MAAM,sBAAsB,iBAAiB,EAAE,IAAI,MAAM,sBAAsB,EAAE,GAAG,GAAG;EACvF,MAAM,aAAa,iBAAiB,EAAE,IAAI,MAAM,aAAa,EAAE,IAAI,IAAI;EACvE,MAAM,cAAc,YAAY,EAAE,IAAI,MAAM,cAAc,CAAC;EAC3D,MAAM,YAAY,iBAAiB,EAAE,IAAI,MAAM,YAAY,EAAE,4BAA4B,KAAK;EAC9F,MAAM,eAAe,KAAK,KAAK,GAAG,YAAY,KAAK,KAAK,KAAK;EAC7D,MAAM,oBAAoB,EAAE,IAAI,MAAM,oBAAoB,EAAE,MAAM,IAAI,KAAA;EAEtE,MAAM,WAAW,QAAQ,SAAS,wBAAwB;GACxD,QAAQ;GACR,OAAO;GACP,QAAQ;GACR;GACA,eAAe;GACf;GACD,CAAC;EACF,MAAM,eAAe,MAAM,QAAQ,IACjC,SAAS,MAAM,IAAI,OAAO,YAAY;GACpC,MAAM,WAAW,MAAM,QAAQ,SAAS,aAAa;IACnD,WAAW,QAAQ;IACnB,OAAO;IACP,QAAQ;IACR;IACA,eAAe;IACf;IACA,QAAQ;IACR,WAAW;IACZ,CAAC;AACF,UAAO;IACL;IACA,UAAU,SAAS;IACnB,cAAc,SAAS;IACvB,gBAAgB,SAAS;IAC1B;IACD,CACH;EACD,MAAM,QAAQ,MAAM,QAAQ,SAAS,aAAa;GAChD,YAAY;GACZ,OAAO;GACP,QAAQ;GACR;GACA,eAAe;GACf;GACA,QAAQ;GACR,WAAW;GACZ,CAAC;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,UAAU;IACR,OAAO;IACP,OAAO,SAAS;IAChB,OAAO,SAAS;IAChB,QAAQ,SAAS;IACjB,SAAS,SAAS;IACnB;GACD;GACD,CAAC;GACF;AAGF,eAAc,KAAK,iBAAiB,OAAO,MAAM;EAC/C,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,KAAK,WAAW;EAChC,MAAM,YAAY,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,MAAM,GAAG,KAAA;EACxG,MAAM,aAAa,QAAQ;AAC3B,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,UAAU,sBAAsB;GACpC,QAAQ;GACR,UAAU,QAAQ;GAClB,iBAAiB,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAA;GACnE;GACD,CAAC;AAIF,MAAI,KAAK,SAAS;GAChB,MAAM,aAAa,gBAAgB;IACjC;IACA,QAAQ;IACR,WAAW;IACX,UAAU;IACV,QAAQ,KAAK;IACd,CAAC;AAEF,SAAM,QAAQ,qBAAqB,aAAa,YAAY,EAAE,EAAE,EAC9D,UAAU,2BAA2B;IACnC;IACA,QAAQ;IACR,WAAW;IACX,QAAQ,KAAK;IACd,CAAC,EACH,CAAC;AACF,OAAI,UACF,SAAQ,SAAS,cAAc,YAAY,UAAU;GAEvD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,WAAW;AAC7D,UAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI;;EAajC,MAAM,gBAAe,MATU,QAAQ,SAAS,aAAa;GAC3D;GACA,eAAe;GACf,OAAO;GACP,QAAQ;GACR,WAAW;GACZ,CAAC,EAGoC,MAAM,MAAM,MAAM;AACtD,UAAO,sBAAsB,GAAG,SAAS,UAAU;IACnD;AAEF,MAAI,cAAc;GAEhB,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,aAAa,IAAI;AACnE,UAAO,EAAE,KAAK;IAAE;IAAS,QAAQ;IAAM,EAAE,IAAI;;EAI/C,MAAM,SAAS,QAAQ,KAAK,KAAK;EACjC,MAAM,aAAa,gBAAgB;GACjC;GACA,QAAQ;GACR,WAAW;GACX,UAAU;GACV,QAAQ;GACT,CAAC;AAEF,QAAM,QAAQ,qBAAqB,aAAa,YAAY,EAAE,EAAE,EAC9D,UAAU,2BAA2B;GACnC;GACA,QAAQ;GACR,WAAW;GACX,QAAQ;GACT,CAAC,EACH,CAAC;AAEF,MAAI,UACF,SAAQ,SAAS,cAAc,YAAY,UAAU;EAEvD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,WAAW;AAC7D,SAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI;GAC/B;AAGF,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,UAAU,8BAA8B,GAAG,SAAS,gBAAgB;AAC1E,MAAI,QACF,QAAO;EAET,MAAM,QAAQ,EAAE,IAAI,OAAO;EAC3B,MAAM,eAAe,MAAM,OACvB,MAAM,IAAI,CACX,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,cAAc;EACxB,MAAM,SAAS,MAAM,QAAQ,SAAS,aAAa;GACjD,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,cAAc,cAAc,SAAS,eAAe,KAAA;GACpD,eAAe,MAAM,kBAAkB;GACvC,WAAW,MAAM;GACjB,YAAY,MAAM,eAAe;GACjC,cAAc,MAAM,eAAe,SAAS,MAAM,aAAa,GAAG,KAAA;GAClE,eAAe,MAAM,kBAAkB;GACvC,mBAAmB,MAAM;GACzB,OAAO,MAAM,QAAQ,SAAS,MAAM,MAAM,GAAG,KAAA;GAC7C,QAAQ,MAAM,SAAS,SAAS,MAAM,OAAO,GAAG,KAAA;GACjD,CAAC;AACF,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO;AAC7C,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,EAAE,IAAI,MAAM,UAAU;EACtC,MAAM,UAAU,MAAM,QAAQ,SAAS,QAAQ,WAAW,KAAA,EAAU;AACpE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;AAGF,eAAc,IAAI,yBAAyB,OAAO,MAAM;EACtD,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe;GACnD,WAAW,EAAE,IAAI,MAAM,YAAY;GACnC,YAAY,EAAE,IAAI,MAAM,aAAa,IAAI,EAAE,IAAI,MAAM,MAAM;GAC5D,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,KAAK,yBAAyB,OAAO,MAAM;EACvD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe;GACnD,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAA;GACjE,YAAY,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,KAAA;GACpE,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,KAAA;GAChD,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,8BAA8B,GAAG,SAAS,eAAe;AACzE,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADiB,QAAQ,SAAS,WAAW,IAAI,CAEpD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,QAAQ,SAAS,aAAa,IAAI;GAAE,CAAC;GACxE;AAGF,eAAc,IAAI,mCAAmC,OAAO,MAAM;EAChE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,UAAU,MAAM,QAAQ,SAAS,eAAe,IAAI;AAC1D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,MAAM,mCAAmC,OAAO,MAAM;EAClE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,SAAS,iBAAiB,KAAK,KAAK;AACjE,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO;GAAO,EAAE,IAAI;AAExD,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,UAAU,8BAA8B,GAAG,SAAS,oBAAoB;AAC9E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG,KAAA;EAC/D,MAAM,QACJ,gBAAgB,KAAA,KAAa,OAAO,SAAS,YAAY,GACrD,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GACvC,KAAA;EAEN,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM;EAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;EAClE,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;EAE3E,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;GACxD;GACA;GACA,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC7B,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAG/D,MAAM,WAAW,wBAAwB,OAAO,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC5E,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,UAAU;GACrB,YAAY,OAAO;GACpB,CAAC;GACF;AAGF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM;EAC5C,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;EAClE,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG;EAC/D,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;EAC3E,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GAAG;EACvF,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;GACxD;GACA;GACA,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC7B,CAAC;AAEF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,QAAQ,MAAM,QAAQ,SAAS,YAAY,IAAI;AACrD,MAAI,CAAC,MACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAO,CAAC;GAClC;AAGF,eAAc,IAAI,wCAAwC,OAAO,MAAM;EACrE,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,eAAe,EAAE,IAAI,MAAM,YAAY;EAC7C,MAAM,YAAY,eAAe,OAAO,SAAS,cAAc,GAAG,GAAG;AACrE,MAAI,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,EAC7C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwC,EAAE,IAAI;EAElF,MAAM,SAAS,iBAAiB,EAAE,IAAI,MAAM,SAAS,EAAE,IAAI,IAAI;EAC/D,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,QAAQ,EAAE,KAAK,IAAI;EAC9D,MAAM,SAAS,MAAM,QAAQ,SAAS,oBAAoB,KAAK;GAAE;GAAW;GAAQ;GAAO,CAAC;AAC5F,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,KAAK,yCAAyC,OAAO,MAAM;EACvE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,KAAK,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAA;EAC5E,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAA;EACzD,MAAM,OACJ,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,GACtG,KAAK,OACN,KAAA;AACN,QAAM,QAAQ,qBAAqB,6BAA6B,KAAK;GAAE;GAAI;GAAM;GAAM,CAAC;AACxF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,uCAAuC,OAAO,MAAM;EACrE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,SAAS,MAAM,GAAG;AAC5E,MAAI,CAAC,SACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,GAAG,KAAK,MAAM,MAAM,GAAG,KAAA;AACxF,QAAM,QAAQ,qBAAqB,2BAA2B,KAAK;GAAE;GAAU;GAAO,CAAC;AACvF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,wCAAwC,OAAO,MAAM;EACtE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,MAAM,GAAG;AAClF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA0B,EAAE,IAAI;AAEpE,QAAM,QAAQ,qBAAqB,4BAA4B,KAAK;GAClE;GACA,MAAM,KAAK;GACZ,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,gDAAgD,OAAO,MAAM;EAC9E,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,MAAM,GAAG;AAClF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA0B,EAAE,IAAI;EAEpE,MAAM,UACJ,OAAO,KAAK,YAAY,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,UAAU;AACnF,QAAM,QAAQ,qBAAqB,mCAAmC,KAAK;GACzE;GACA;GACA,SAAS,OAAO,KAAK,YAAY,YAAY,KAAK,UAAU,KAAA;GAC5D,SAAS,KAAK;GACf,CAAC;AACF,6BAA2B,KAAK,kCAAkC;AAClE,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG;AACzE,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;AAEjE,QAAM,QAAQ,qBAAqB,mCAAmC,KAAK;GACzE;GACA,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;GACxD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,KAAK,aAAa,OAAO,OAAO,KAAA;GAC9F,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAK,WAAW,OAAO,OAAO,KAAA;GACtF,oBAAoB,KAAK,uBAAuB;GAChD,WAAW,KAAK,cAAc;GAC9B,gBAAgB,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,KAAA;GACjF,CAAC;AACF,6BAA2B,KAAK,kCAAkC;AAClE,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,IAAI,6CAA6C,OAAO,MAAM;EAC1E,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,cAAc,MAAM,QAAQ,SAAS,0BAA0B,IAAI;AACzE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,aAAa;GAAE,CAAC;GACrD;AAEF,eAAc,IAAI,2DAA2D,OAAO,MAAM;EACxF,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe;EAChD,MAAM,aAAa,MAAM,QAAQ,SAAS,wBAAwB,KAAK,aAAa;AACpF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;AAElE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,YAAY;GAAE,CAAC;GACpD;AAEF,eAAc,KAAK,yCAAyC,OAAO,MAAM;EACvE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,eAAe,OAAO,KAAK,iBAAiB,WAAW,KAAK,aAAa,MAAM,GAAG;AACxF,MAAI,CAAC,aACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI;AACF,SAAM,QAAQ,SAAS,4BAA4B,KAAK,aAAa;WAC9D,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,0BAA0B;IAAE,WAAW;IAAqB,YAAY;IAAK,CAAC;GACzG,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,OAAI,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,UAAU,CACtD,QAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAK,EAAE,IAAI;AAE/C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAK,EAAE,IAAI;;EAE/C,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,KAAK,qCAAqC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADiB,QAAQ,SAAS,WAAW,IAAI,CAEpD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,eAAe,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,KAAA;EACjF,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ;EAC7D,MAAM,SAAS,MAAM,QAAQ,SAAS,cAAc,KAAK;GAAE;GAAc;GAAO,CAAC;AACjF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,QAAQ;GAAE,CAAC;GAChD;AAGF,eAAc,IAAI,sBAAsB,OAAO,MAAM;EACnD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,aAAa,EAAE,IAAI,MAAM,UAAU,IAAI;EAC7C,MAAM,aAAa,IAAI,IACrB,WACG,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ,CACnB;EACD,MAAM,oBAAoB,WAAW,IAAI,aAAa;EACtD,MAAM,wBAAwB,WAAW,IAAI,iBAAiB;EAC9D,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;AAGrC,MAFuB,cAAc,KAAA,KAAa,aAAa,KAAA,GAE3C;GAClB,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,OAAI,QACF,QAAO;GAET,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;GAClE,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG;GAC/D,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;GAC3E,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GAAG;GACvF,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;IACxD;IACA;IACA,0BAA0B;IAC1B;IACD,CAAC;AACF,OAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAEpD,UAAO,EAAE,KAAK,OAAO;;EAGvB,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,KAAK;GACrD,0BAA0B;GAC1B;GACD,CAAC;AACF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAEpD,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B;AAGF,eAAc,MAAM,sBAAsB,OAAO,MAAM;EACrD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,QAKF,EAAE;AACN,MAAI,OAAO,KAAK,SAAS,SACvB,OAAM,OAAO,KAAK;AAEpB,MAAI,MAAM,QAAQ,KAAK,KAAK,CAC1B,OAAM,OAAO,KAAK;AAEpB,MAAI,OAAO,KAAK,gBAAgB,UAC9B,OAAM,cAAc,KAAK;AAE3B,MAAI,KAAK,eAAe,KAAA,KAAa,OAAO,KAAK,eAAe,YAAY,KAAK,eAAe,KAC9F,OAAM,aAAa,KAAK;EAE1B,IAAI;AACJ,MAAI,eAAe,MAAM;AACvB,wBAAqB,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,MAAM,GAAG;AAC3G,OAAI,sBAAsB,CAAC,QAAQ,SAAS,IAAI,mBAAmB,CACjE,QAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAqB,EAAE,IAAI;;EAGjE,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,KAAK,MAAM;AACvD,MAAI,OAAO,OAAO,MAChB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO;GAAO,EAAE,IAAI;AAExD,MAAI,uBAAuB,KAAA,EACzB,KAAI;AACF,OAAI,mBACF,SAAQ,SAAS,cAAc,KAAK,mBAAmB;OAEvD,SAAQ,SAAS,cAAc,IAAI;WAE9B,OAAO;AACd,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAAE,EAAE,IAAI;;EAIpG,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAGF,eAAc,IAAI,6BAA6B,OAAO,MAAM;EAC1D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAW;EAC/C,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,KAAK,OAAO;AACzD,SAAO,EAAE,KAAK,OAAO;GACrB;AAEF,eAAc,KAAK,wBAAwB,OAAO,MAAM;EACtD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;EACxE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;AAEjE,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,aAAa,WAAW,QAAQ;AACtE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAEF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;EACrE,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK,SAAS;AAC7D,SAAO,EAAE,KAAK,OAAO;GACrB;AAEF,eAAc,KAAK,2BAA2B,OAAO,MAAM;EACzD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,KAAK,KAAK,UAAU;AAC1D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAEF,eAAc,KAAK,+BAA+B,OAAO,MAAM;EAC7D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;EACxE,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,MAAM,KAAK,WAAW,GAAG;AACvF,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI,CAAC,OAAO,SAAS,WAAW,IAAI,aAAa,EAC/C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyC,EAAE,IAAI;AAEnF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK,WAAW,EAAE,YAAY,CAAC;AAC9E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAMF,eAAc,OAAO,+BAA+B,OAAO,MAAM;EAC/D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,qBAAqB,aAAa,IAAI;AACnE,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAGpD,IAAI,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;EACzE,IAAI,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;EAC1D,MAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,KAAA;AAElE,MAAI,mBAAmB,KAAA,GAAW;GAChC,MAAM,QAAQ,4BAA4B,QAAQ,eAAe;AACjE,OAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,iCAAiC,EAAE,IAAI;AAEhE,gBAAa,MAAM;AACnB,WAAQ,MAAM;;AAGhB,MAAI,aAAa,KAAK,SAAS,EAC7B,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,EAAE,IAAI;AAE9D,MAAI,cAAc,OAAO,OACvB,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,IAAI;EAErD,MAAM,cAAc,KAAK,IAAI,OAAO,OAAO,SAAS,WAAW;EAC/D,MAAM,UAAU,OAAO,MAAM,YAAY,aAAa,YAAY;EAClE,MAAM,OAAO,OAAO,MAAM,GAAG,WAAW,CAAC,OAAO,OAAO,MAAM,aAAa,YAAY,CAAC;AACvF,QAAM,QAAQ,qBAAqB,aAAa,KAAK,KAAK;AAC1D,QAAM,kCAAkC;GAAE;GAAS,WAAW;GAAM,CAAC;AACrE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAa,CAAC;GACjD;AAGF,eAAc,KAAK,4BAA4B,OAAO,MAAM;EAC1D,MAAM,UAAU,8BAA8B,GAAG,SAAS,iBAAiB;AAC3E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,IAAI;AAChD,MAAI,OAAO,OAAO,OAAO;GACvB,MAAM,SAAS,OAAO,UAAU,sBAAsB,MAAM;AAC5D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,OAAO;IAAO,EAAE,OAAO;;EAE3D,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,OAAO;GACP,WAAW,OAAO;GAClB,mBAAmB,OAAO;GAC1B;GACD,CAAC;GACF;AAGF,eAAc,OAAO,sBAAsB,OAAO,MAAM;EACtD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,IAAI;AACjD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,8BAA8B,OAAO,MAAM;EAC5D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ,IAAI;AAClD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,gCAAgC,OAAO,MAAM;EAC9D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,IAAI;AACpD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,IAAI;AAC9C,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,4BAA4B,OAAO,MAAM;EAC1D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,IAAI;AAChD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,6BAA6B,OAAO,MAAM;EAC3D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAG9B,MAAM,EAAE,SAAS,MADE,EAAE,IAAI,MAAM;EAE/B,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,KAAK,KAAK;AACvD,SAAO,EAAE,KAAK,OAAO;GACrB;AAKF,eAAc,IAAI,kBAAkB,OAAO,MAAM;EAC/C,MAAM,QAAQ,EAAE,IAAI,OAAO;EAC3B,MAAM,SAAS,MAAM,QAAQ,SAAS,cAAc;GAClD,OAAO,MAAM,QAAQ,SAAS,MAAM,MAAM,GAAG,KAAA;GAC7C,QAAQ,MAAM,SAAS,SAAS,MAAM,OAAO,GAAG,KAAA;GACjD,CAAC;AACF,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,IAAI,WAAW,YAAY,CAC9B,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEzD,MAAM,aAAa,EAAE,IAAI,MAAM,UAAU,IAAI;EAC7C,MAAM,aAAa,IAAI,IACrB,WACG,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ,CACnB;EACD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,KAAK;GACrD,0BAA0B,WAAW,IAAI,aAAa;GACtD,uBAAuB,WAAW,IAAI,iBAAiB;GACxD,CAAC;AACF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,EAAE,IAAI;AAE7D,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B"}
+{"version":3,"file":"sessions.js","names":[],"sources":["../../../../../src/gateway/hono/routes/sessions.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { Hono } from 'hono';\n\nimport { buildSessionKey } from '../../../routing/session-key.js';\nimport { resolveProjectAgentId } from '../../../projects/index.js';\nimport type { SessionMetadataSeed } from '../../../storage/sqlite/index.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { createGatewayRouteLogger, logRouteError } from '../lib/route-logger.js';\nimport { messagesToClientHistory } from '../../../session/client-history.js';\nimport type { SessionType } from '../../../session/types.js';\nimport { computeUserRoundDeleteRange } from '../../../session/user-round-delete.js';\nimport { deleteMediaUrisNoLongerReferenced } from '../../../media/session-references.js';\nimport { respondStartupUnavailable } from '../lib/startup-unavailable.js';\nimport type { StartupUnavailableGatewayMethod } from '../../startup-readiness.js';\nimport { evictEmbeddedSessionRunner } from '../../../agent/embedded/session-runner.js';\n\nconst log = createGatewayRouteLogger('Sessions');\n\ntype SessionsStartupMethod = StartupUnavailableGatewayMethod;\n\nconst SESSION_TYPES = new Set<SessionType>(['chat', 'workflow-run', 'workflow-subagent', 'cron', 'heartbeat']);\nconst DEFAULT_SIDEBAR_STALE_DAYS = 60;\n\nfunction isSessionType(value: string): value is SessionType {\n  return SESSION_TYPES.has(value as SessionType);\n}\n\nfunction ensureGatewayReadyForSessions(\n  c: Parameters<typeof respondStartupUnavailable>[0],\n  service: AuthenticatedRouteDeps['service'],\n  method: SessionsStartupMethod,\n): Response | null {\n  if (service.isGatewayReady()) {\n    return null;\n  }\n  return respondStartupUnavailable(c, method);\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number, max: number): number {\n  const parsed = value ? Number.parseInt(value, 10) : fallback;\n  if (!Number.isFinite(parsed)) return fallback;\n  return Math.min(max, Math.max(1, parsed));\n}\n\nfunction parseOffset(value: string | undefined): number {\n  const parsed = value ? Number.parseInt(value, 10) : 0;\n  return Number.isFinite(parsed) ? Math.max(0, parsed) : 0;\n}\n\nfunction buildDirectSessionMetadata(params: {\n  agentId: string;\n  source: string;\n  accountId: string;\n  peerId: string;\n}): SessionMetadataSeed {\n  return {\n    sourceChannel: params.source,\n    sourceChatId: [params.accountId, 'direct', params.peerId].join(':'),\n    sessionType: 'chat',\n    hiddenFromSessionList: true,\n    routing: {\n      agentId: params.agentId,\n      source: params.source,\n      accountId: params.accountId,\n      peerKind: 'direct',\n      peerId: params.peerId,\n    },\n    customData: {\n      genericNewChatShell: params.source === 'webchat' && params.peerId.startsWith('chat_'),\n    },\n  };\n}\n\nexport function registerSessionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  // ========== Session REST API (/api/sessions) ==========\n\n  authenticated.get('/api/sidebar/chat-list', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.list');\n    if (blocked) {\n      return blocked;\n    }\n\n    const projectLimit = parsePositiveInt(c.req.query('projectLimit'), 12, 50);\n    const projectOffset = parseOffset(c.req.query('projectOffset'));\n    const sessionPreviewLimit = parsePositiveInt(c.req.query('sessionPreviewLimit'), 5, 20);\n    const inboxLimit = parsePositiveInt(c.req.query('inboxLimit'), 20, 100);\n    const inboxOffset = parseOffset(c.req.query('inboxOffset'));\n    const staleDays = parsePositiveInt(c.req.query('staleDays'), DEFAULT_SIDEBAR_STALE_DAYS, 3650);\n    const updatedAfter = Date.now() - staleDays * 24 * 60 * 60 * 1000;\n    const includeSessionKey = c.req.query('includeSessionKey')?.trim() || undefined;\n\n    const projects = service.projects.listWithSidebarSessions({\n      status: 'active',\n      limit: projectLimit,\n      offset: projectOffset,\n      updatedAfter,\n      includePinned: true,\n      includeSessionKey,\n    });\n    const projectItems = await Promise.all(\n      projects.items.map(async (project) => {\n        const sessions = await service.sessions.listSessions({\n          projectId: project.id,\n          limit: sessionPreviewLimit,\n          offset: 0,\n          updatedAfter,\n          includePinned: true,\n          includeSessionKey,\n          sortBy: 'updatedAt',\n          sortOrder: 'desc',\n        });\n        return {\n          project,\n          sessions: sessions.items,\n          sessionTotal: sessions.total,\n          sessionHasMore: sessions.hasMore,\n        };\n      }),\n    );\n    const inbox = await service.sessions.listSessions({\n      unassigned: true,\n      limit: inboxLimit,\n      offset: inboxOffset,\n      updatedAfter,\n      includePinned: true,\n      includeSessionKey,\n      sortBy: 'updatedAt',\n      sortOrder: 'desc',\n    });\n\n    return c.json({\n      ok: true,\n      projects: {\n        items: projectItems,\n        total: projects.total,\n        limit: projects.limit,\n        offset: projects.offset,\n        hasMore: projects.hasMore,\n      },\n      inbox,\n    });\n  });\n\n  // POST /api/sessions - Create a new session. Empty-shell reuse is a client concern.\n  authenticated.post('/api/sessions', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const channel = body.channel || 'webchat';\n    const projectId = typeof body.projectId === 'string' && body.projectId.trim() ? body.projectId.trim() : undefined;\n    const routingCfg = service.currentConfig;\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ ok: false, error: 'Project not found' }, 404);\n    }\n    const agentId = resolveProjectAgentId({\n      config: routingCfg,\n      projects: service.projects,\n      explicitAgentId: typeof body.agentId === 'string' ? body.agentId : undefined,\n      projectId,\n    });\n\n    // If a specific chat_id is provided, use it (for advanced use cases).\n    if (body.chat_id) {\n      const sessionKey = buildSessionKey({\n        agentId,\n        source: channel,\n        accountId: 'default',\n        peerKind: 'direct',\n        peerId: body.chat_id,\n      });\n\n      await service.sessionIndexInstance.saveMessages(sessionKey, [], {\n        metadata: buildDirectSessionMetadata({\n          agentId,\n          source: channel,\n          accountId: 'default',\n          peerId: body.chat_id,\n        }),\n      });\n      if (projectId) {\n        service.projects.attachSession(sessionKey, projectId);\n      }\n      const session = await service.sessions.getSession(sessionKey);\n      return c.json({ session }, 201);\n    }\n\n    const chatId = `chat_${randomUUID()}`;\n    const sessionKey = buildSessionKey({\n      agentId,\n      source: channel,\n      accountId: 'default',\n      peerKind: 'direct',\n      peerId: chatId,\n    });\n\n    await service.sessionIndexInstance.saveMessages(sessionKey, [], {\n      metadata: buildDirectSessionMetadata({\n        agentId,\n        source: channel,\n        accountId: 'default',\n        peerId: chatId,\n      }),\n    });\n\n    if (projectId) {\n      service.projects.attachSession(sessionKey, projectId);\n    }\n    const session = await service.sessions.getSession(sessionKey);\n    return c.json({ session }, 201);\n  });\n\n  // GET /api/sessions - List sessions\n  authenticated.get('/api/sessions', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.list');\n    if (blocked) {\n      return blocked;\n    }\n    const query = c.req.query();\n    const sessionTypes = query.types\n      ?.split(',')\n      .map((value) => value.trim())\n      .filter(isSessionType);\n    const result = await service.sessions.listSessions({\n      status: query.status as any,\n      search: query.search,\n      channel: query.channel,\n      sessionTypes: sessionTypes?.length ? sessionTypes : undefined,\n      includeHidden: query.includeHidden === 'true',\n      projectId: query.projectId,\n      unassigned: query.unassigned === 'true',\n      updatedAfter: query.updatedAfter ? parseInt(query.updatedAfter) : undefined,\n      includePinned: query.includePinned === 'true',\n      includeSessionKey: query.includeSessionKey,\n      limit: query.limit ? parseInt(query.limit) : undefined,\n      offset: query.offset ? parseInt(query.offset) : undefined,\n    });\n    return c.json(result);\n  });\n\n  // GET /api/sessions/stats - Get session stats (must be before /:key)\n  authenticated.get('/api/sessions/stats', async (c) => {\n    const result = await service.sessions.stats();\n    return c.json(result);\n  });\n\n  // GET /api/sessions/chat-ids - Get unique chat IDs from sessions (must be before /:key)\n  authenticated.get('/api/sessions/chat-ids', async (c) => {\n    const channel = c.req.query('channel');\n    const chatIds = await service.sessions.chatIds(channel || undefined);\n    return c.json({ ok: true, payload: { chatIds } });\n  });\n\n  // GET /api/sessions/resolve?sessionId=... - Resolve OpenClaw-style session id to canonical key.\n  authenticated.get('/api/sessions/resolve', async (c) => {\n    const result = await service.sessions.resolveSession({\n      sessionId: c.req.query('sessionId'),\n      sessionKey: c.req.query('sessionKey') ?? c.req.query('key'),\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: result });\n  });\n\n  // POST /api/sessions/resolve - Resolve by JSON body (`sessionId`, `sessionKey`, or `key`).\n  authenticated.post('/api/sessions/resolve', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const result = await service.sessions.resolveSession({\n      sessionId: typeof body.sessionId === 'string' ? body.sessionId : undefined,\n      sessionKey: typeof body.sessionKey === 'string' ? body.sessionKey : undefined,\n      key: typeof body.key === 'string' ? body.key : undefined,\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: result });\n  });\n\n  // GET /api/sessions/:key/run — read-only active webchat agent run (for UI resume)\n  authenticated.get('/api/sessions/:key/run', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.run');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: service.sessions.getActiveRun(key) });\n  });\n\n  // GET /api/sessions/:key/agent-config — resolved session agent settings (thinking, etc.)\n  authenticated.get('/api/sessions/:key/agent-config', async (c) => {\n    const key = c.req.param('key');\n    const payload = await service.sessions.getAgentConfig(key);\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.patch('/api/sessions/:key/agent-config', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const result = await service.sessions.patchAgentConfig(key, body);\n    if (!result.ok) {\n      return c.json({ ok: false, error: result.error }, 400);\n    }\n    return c.json({ ok: true });\n  });\n\n  // GET /api/sessions/:key/messages — flattened transcript for TUI / clients\n  authenticated.get('/api/sessions/:key/messages', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.messages');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const limitRaw = c.req.query('limit');\n    const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;\n    const limit =\n      parsedLimit !== undefined && Number.isFinite(parsedLimit)\n        ? Math.min(500, Math.max(1, parsedLimit))\n        : undefined;\n\n    const before = c.req.query('before')?.trim();\n    const offsetRaw = c.req.query('offset');\n    const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n    const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n\n    const result = await service.sessions.getMessagePage(key, {\n      limit,\n      offset,\n      ...(before ? { before } : {}),\n    });\n    if (!result) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n\n    const messages = messagesToClientHistory(result.session.messages, { limit });\n    return c.json({\n      ok: true,\n      payload: { messages },\n      pagination: result.pagination,\n    });\n  });\n\n  // GET /api/sessions/:key/history — UI chat history page from the newest tail.\n  authenticated.get('/api/sessions/:key/history', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const offsetRaw = c.req.query('offset');\n    const limitRaw = c.req.query('limit');\n    const before = c.req.query('before')?.trim();\n    const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n    const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : 50;\n    const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n    const limit = Number.isFinite(parsedLimit) ? Math.min(200, Math.max(1, parsedLimit)) : 50;\n    const result = await service.sessions.getMessagePage(key, {\n      offset,\n      limit,\n      ...(before ? { before } : {}),\n    });\n\n    if (!result) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    return c.json(result);\n  });\n\n  // GET /api/sessions/:key/timeline — row-backed conversation outline for Web / TUI navigation.\n  authenticated.get('/api/sessions/:key/timeline', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const items = await service.sessions.getTimeline(key);\n    if (!items) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, items });\n  });\n\n  // GET /api/sessions/:key/transcript/window — TUI-focused transcript slice around a row.\n  authenticated.get('/api/sessions/:key/transcript/window', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const rowNumberRaw = c.req.query('rowNumber');\n    const rowNumber = rowNumberRaw ? Number.parseInt(rowNumberRaw, 10) : NaN;\n    if (!Number.isFinite(rowNumber) || rowNumber < 1) {\n      return c.json({ ok: false, error: 'rowNumber must be a positive integer' }, 400);\n    }\n    const before = parsePositiveInt(c.req.query('before'), 80, 200);\n    const after = parsePositiveInt(c.req.query('after'), 120, 200);\n    const window = await service.sessions.getTranscriptWindow(key, { rowNumber, before, after });\n    if (!window) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, payload: window });\n  });\n\n  // POST /api/sessions/:key/transcript/context — append persisted-only `kind: 'context'` row (not in LLM context)\n  authenticated.post('/api/sessions/:key/transcript/context', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const id = typeof body.id === 'string' && body.id.trim() ? body.id.trim() : undefined;\n    const text = typeof body.text === 'string' ? body.text : undefined;\n    const data =\n      body.data !== undefined && typeof body.data === 'object' && body.data !== null && !Array.isArray(body.data)\n        ? (body.data as Record<string, unknown>)\n        : undefined;\n    await service.sessionIndexInstance.appendTranscriptContextEntry(key, { id, text, data });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/label — append label change for a transcript entry.\n  authenticated.post('/api/sessions/:key/transcript/label', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const targetId = typeof body.targetId === 'string' ? body.targetId.trim() : '';\n    if (!targetId) {\n      return c.json({ ok: false, error: 'targetId is required' }, 400);\n    }\n    const label = typeof body.label === 'string' && body.label.trim() ? body.label.trim() : undefined;\n    await service.sessionIndexInstance.appendTranscriptLabelEntry(key, { targetId, label });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/custom — append extension state for TUI replay.\n  authenticated.post('/api/sessions/:key/transcript/custom', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const customType = typeof body.customType === 'string' ? body.customType.trim() : '';\n    if (!customType) {\n      return c.json({ ok: false, error: 'customType is required' }, 400);\n    }\n    await service.sessionIndexInstance.appendTranscriptCustomEntry(key, {\n      customType,\n      data: body.data,\n    });\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/custom-message — append visible extension custom message.\n  authenticated.post('/api/sessions/:key/transcript/custom-message', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const customType = typeof body.customType === 'string' ? body.customType.trim() : '';\n    if (!customType) {\n      return c.json({ ok: false, error: 'customType is required' }, 400);\n    }\n    const content =\n      typeof body.content === 'string' || Array.isArray(body.content) ? body.content : '';\n    await service.sessionIndexInstance.appendTranscriptCustomMessageEntry(key, {\n      customType,\n      content,\n      display: typeof body.display === 'boolean' ? body.display : undefined,\n      details: body.details,\n    });\n    evictEmbeddedSessionRunner(key, 'gateway_custom_message_appended');\n    return c.json({ ok: true });\n  });\n\n  // POST /api/sessions/:key/transcript/bash — append local TUI shell execution.\n  authenticated.post('/api/sessions/:key/transcript/bash', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const command = typeof body.command === 'string' ? body.command.trim() : '';\n    if (!command) {\n      return c.json({ ok: false, error: 'command is required' }, 400);\n    }\n    await service.sessionIndexInstance.appendTranscriptBashExecutionEntry(key, {\n      command,\n      output: typeof body.output === 'string' ? body.output : '',\n      exitCode: typeof body.exitCode === 'number' ? body.exitCode : body.exitCode === null ? null : undefined,\n      signal: typeof body.signal === 'string' ? body.signal : body.signal === null ? null : undefined,\n      excludeFromContext: body.excludeFromContext === true,\n      truncated: body.truncated === true,\n      fullOutputPath: typeof body.fullOutputPath === 'string' ? body.fullOutputPath : undefined,\n    });\n    evictEmbeddedSessionRunner(key, 'gateway_bash_execution_appended');\n    return c.json({ ok: true });\n  });\n\n  // GET /api/sessions/:key/compaction/checkpoints — list pre-compaction snapshots (OpenClaw-style)\n  authenticated.get('/api/sessions/:key/compaction/checkpoints', async (c) => {\n    const key = c.req.param('key');\n    const meta = await service.sessionIndexInstance.getSessionMetadata(key);\n    if (!meta) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const checkpoints = await service.sessions.listCompactionCheckpoints(key);\n    return c.json({ ok: true, payload: { checkpoints } });\n  });\n\n  authenticated.get('/api/sessions/:key/compaction/checkpoints/:checkpointId', async (c) => {\n    const key = c.req.param('key');\n    const checkpointId = c.req.param('checkpointId');\n    const checkpoint = await service.sessions.getCompactionCheckpoint(key, checkpointId);\n    if (!checkpoint) {\n      return c.json({ ok: false, error: 'Checkpoint not found' }, 404);\n    }\n    return c.json({ ok: true, payload: { checkpoint } });\n  });\n\n  authenticated.post('/api/sessions/:key/compaction/restore', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const checkpointId = typeof body.checkpointId === 'string' ? body.checkpointId.trim() : '';\n    if (!checkpointId) {\n      return c.json({ ok: false, error: 'checkpointId required' }, 400);\n    }\n    try {\n      await service.sessions.restoreCompactionCheckpoint(key, checkpointId);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.sessions', { operation: 'restoreCheckpoint', sessionKey: key });\n      const msg = err instanceof Error ? err.message : String(err);\n      if (msg.includes('not found') || msg.includes('Invalid')) {\n        return c.json({ ok: false, error: msg }, 404);\n      }\n      return c.json({ ok: false, error: msg }, 500);\n    }\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    return c.json({ ok: true, session });\n  });\n\n  authenticated.post('/api/sessions/:key/compaction/run', async (c) => {\n    const key = c.req.param('key');\n    const session = await service.sessions.getSession(key);\n    if (!session) {\n      return c.json({ ok: false, error: 'Session not found' }, 404);\n    }\n    const body = await c.req.json().catch(() => ({}));\n    const instructions = typeof body.instructions === 'string' ? body.instructions : undefined;\n    const force = typeof body.force === 'boolean' ? body.force : true;\n    const result = await service.sessions.runCompaction(key, { instructions, force });\n    return c.json({ ok: true, payload: { result } });\n  });\n\n  // GET /api/sessions/:key - Get single session (must be after /stats and /chat-ids)\n  authenticated.get('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const includeRaw = c.req.query('include') ?? '';\n    const includeSet = new Set(\n      includeRaw\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean),\n    );\n    const includeTranscript = includeSet.has('transcript');\n    const includeTranscriptRows = includeSet.has('transcriptRows');\n    const offsetRaw = c.req.query('offset');\n    const limitRaw = c.req.query('limit');\n    const hasPagingQuery = offsetRaw !== undefined || limitRaw !== undefined;\n\n    if (hasPagingQuery) {\n      const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.history');\n      if (blocked) {\n        return blocked;\n      }\n      const parsedOffset = offsetRaw ? Number.parseInt(offsetRaw, 10) : 0;\n      const parsedLimit = limitRaw ? Number.parseInt(limitRaw, 10) : 50;\n      const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;\n      const limit = Number.isFinite(parsedLimit) ? Math.min(200, Math.max(1, parsedLimit)) : 50;\n      const result = await service.sessions.getMessagePage(key, {\n        offset,\n        limit,\n        includeTranscriptSummary: includeTranscript,\n        includeTranscriptRows,\n      });\n      if (!result) {\n        return c.json({ error: 'Session not found' }, 404);\n      }\n      return c.json(result);\n    }\n\n    const session = await service.sessions.getSession(key, {\n      includeTranscriptSummary: includeTranscript,\n      includeTranscriptRows,\n    });\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n    return c.json({ session });\n  });\n\n  // PATCH /api/sessions/:key - Partial metadata (name, tags, customData); OpenClaw-style patch subset\n  authenticated.patch('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const patch: {\n      name?: string;\n      tags?: string[];\n      replaceTags?: boolean;\n      customData?: Record<string, unknown>;\n    } = {};\n    if (typeof body.name === 'string') {\n      patch.name = body.name;\n    }\n    if (Array.isArray(body.tags)) {\n      patch.tags = body.tags;\n    }\n    if (typeof body.replaceTags === 'boolean') {\n      patch.replaceTags = body.replaceTags;\n    }\n    if (body.customData !== undefined && typeof body.customData === 'object' && body.customData !== null) {\n      patch.customData = body.customData as Record<string, unknown>;\n    }\n    let requestedProjectId: string | null | undefined;\n    if ('projectId' in body) {\n      requestedProjectId = typeof body.projectId === 'string' && body.projectId.trim() ? body.projectId.trim() : null;\n      if (requestedProjectId && !service.projects.get(requestedProjectId)) {\n        return c.json({ ok: false, error: 'Project not found' }, 404);\n      }\n    }\n    const result = await service.sessions.patch(key, patch);\n    if (result.ok === false) {\n      return c.json({ ok: false, error: result.error }, 404);\n    }\n    if (requestedProjectId !== undefined) {\n      try {\n        if (requestedProjectId) {\n          service.projects.attachSession(key, requestedProjectId);\n        } else {\n          service.projects.detachSession(key);\n        }\n      } catch (error) {\n        return c.json({ ok: false, error: error instanceof Error ? error.message : String(error) }, 404);\n      }\n    }\n\n    const session = await service.sessions.getSession(key);\n    return c.json({ ok: true, session });\n  });\n\n  // GET /api/sessions/:key/export - Export session (must be before /:key)\n  authenticated.get('/api/sessions/:key/export', async (c) => {\n    const key = c.req.param('key');\n    const format = c.req.query('format') as any || 'json';\n    const result = await service.sessions.export(key, format);\n    return c.json(result);\n  });\n\n  authenticated.post('/api/sessions/import', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    const content = typeof body.content === 'string' ? body.content : '';\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    if (!content.trim()) {\n      return c.json({ ok: false, error: 'content is required' }, 400);\n    }\n    try {\n      const result = await service.sessions.importExport(targetKey, content);\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  authenticated.post('/api/sessions/:key/btw', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const question = typeof body.question === 'string' ? body.question : '';\n    const result = await service.sessions.btwQuery(key, question);\n    return c.json(result);\n  });\n\n  authenticated.post('/api/sessions/:key/fork', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    try {\n      const result = await service.sessions.fork(key, targetKey);\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  authenticated.post('/api/sessions/:key/fork-row', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const targetKey = typeof body.targetKey === 'string' ? body.targetKey : '';\n    const throughRow = typeof body.throughRow === 'number' ? Math.trunc(body.throughRow) : NaN;\n    if (!targetKey.trim()) {\n      return c.json({ ok: false, error: 'targetKey is required' }, 400);\n    }\n    if (!Number.isFinite(throughRow) || throughRow < 1) {\n      return c.json({ ok: false, error: 'throughRow must be a positive integer' }, 400);\n    }\n    try {\n      const result = await service.sessions.forkRows(key, targetKey, { throughRow });\n      return c.json({ ok: true, ...result });\n    } catch (err) {\n      const errorMessage = err instanceof Error ? err.message : String(err);\n      return c.json({ ok: false, error: errorMessage }, 400);\n    }\n  });\n\n  // DELETE /api/sessions/:key/messages — delete LLM rows by range or by user turn.\n  // `userRoundIndex` (0-based among user messages) removes the user row and every following\n  // assistant / tool / toolResult row until the next user. Prefer this from the web console so\n  // tool loops are not left orphaned after retry/delete.\n  authenticated.delete('/api/sessions/:key/messages', async (c) => {\n    const key = c.req.param('key');\n    const body = await c.req.json().catch(() => ({}));\n    const loaded = await service.sessionIndexInstance.loadMessages(key);\n    if (!loaded) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    let startIndex = typeof body.startIndex === 'number' ? body.startIndex : -1;\n    let count = typeof body.count === 'number' ? body.count : 0;\n    const userRoundIndex =\n      typeof body.userRoundIndex === 'number' ? body.userRoundIndex : undefined;\n\n    if (userRoundIndex !== undefined) {\n      const range = computeUserRoundDeleteRange(loaded, userRoundIndex);\n      if (!range) {\n        return c.json({ error: 'User round index out of range' }, 400);\n      }\n      startIndex = range.startIndex;\n      count = range.count;\n    }\n\n    if (startIndex < 0 || count <= 0) {\n      return c.json({ error: 'Invalid startIndex or count' }, 400);\n    }\n    if (startIndex >= loaded.length) {\n      return c.json({ error: 'Index out of range' }, 400);\n    }\n    const deleteCount = Math.min(count, loaded.length - startIndex);\n    const removed = loaded.slice(startIndex, startIndex + deleteCount);\n    const next = loaded.slice(0, startIndex).concat(loaded.slice(startIndex + deleteCount));\n    await service.sessionIndexInstance.saveMessages(key, next);\n    await deleteMediaUrisNoLongerReferenced({ removed, remaining: next });\n    return c.json({ ok: true, deleted: deleteCount });\n  });\n\n  // POST /api/sessions/:key/reset - Reset session (archive transcript, new session id; keep key + overrides)\n  authenticated.post('/api/sessions/:key/reset', async (c) => {\n    const blocked = ensureGatewayReadyForSessions(c, service, 'sessions.reset');\n    if (blocked) {\n      return blocked;\n    }\n    const key = c.req.param('key');\n    const result = await service.sessions.reset(key);\n    if (result.ok === false) {\n      const status = result.error === 'Session not found' ? 404 : 400;\n      return c.json({ ok: false, error: result.error }, status);\n    }\n    const session = await service.sessions.getSession(key);\n    return c.json({\n      ok: true,\n      reset: true,\n      sessionId: result.sessionId,\n      previousSessionId: result.previousSessionId,\n      session,\n    });\n  });\n\n  // DELETE /api/sessions/:key - Delete session (removes key from index)\n  authenticated.delete('/api/sessions/:key', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.delete(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/archive - Archive session\n  authenticated.post('/api/sessions/:key/archive', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.archive(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/unarchive - Unarchive session\n  authenticated.post('/api/sessions/:key/unarchive', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.unarchive(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/pin - Pin session\n  authenticated.post('/api/sessions/:key/pin', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.pin(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/unpin - Unpin session\n  authenticated.post('/api/sessions/:key/unpin', async (c) => {\n    const key = c.req.param('key');\n    const result = await service.sessions.unpin(key);\n    return c.json(result);\n  });\n\n  // POST /api/sessions/:key/rename - Rename session\n  authenticated.post('/api/sessions/:key/rename', async (c) => {\n    const key = c.req.param('key');\n\n    const body = await c.req.json();\n    const { name } = body;\n    const result = await service.sessions.rename(key, name);\n    return c.json(result);\n  });\n\n  // ========== Subagent REST API (/api/subagents) ==========\n\n  // GET /api/subagents - List subagent sessions\n  authenticated.get('/api/subagents', async (c) => {\n    const query = c.req.query();\n    const result = await service.sessions.listSubagents({\n      limit: query.limit ? parseInt(query.limit) : undefined,\n      offset: query.offset ? parseInt(query.offset) : undefined,\n    });\n    return c.json(result);\n  });\n\n  // GET /api/subagents/:key - Get subagent session detail\n  authenticated.get('/api/subagents/:key', async (c) => {\n    const key = c.req.param('key');\n    // Verify it's a subagent session\n    if (!key.startsWith('subagent:')) {\n      return c.json({ error: 'Not a subagent session' }, 400);\n    }\n    const includeRaw = c.req.query('include') ?? '';\n    const includeSet = new Set(\n      includeRaw\n        .split(',')\n        .map((s) => s.trim())\n        .filter(Boolean),\n    );\n    const session = await service.sessions.getSession(key, {\n      includeTranscriptSummary: includeSet.has('transcript'),\n      includeTranscriptRows: includeSet.has('transcriptRows'),\n    });\n    if (!session) {\n      return c.json({ error: 'Subagent session not found' }, 404);\n    }\n    return c.json({ session });\n  });\n}\n"],"mappings":";;;;;;;;;;;kBAIkE;AAalE,MAAM,MAAM,yBAAyB,WAAW;AAIhD,MAAM,gBAAgB,IAAI,IAAiB;CAAC;CAAQ;CAAgB;CAAqB;CAAQ;CAAY,CAAC;AAC9G,MAAM,6BAA6B;AAEnC,SAAS,cAAc,OAAqC;AAC1D,QAAO,cAAc,IAAI,MAAqB;;AAGhD,SAAS,8BACP,GACA,SACA,QACiB;AACjB,KAAI,QAAQ,gBAAgB,CAC1B,QAAO;AAET,QAAO,0BAA0B,GAAG,OAAO;;AAG7C,SAAS,iBAAiB,OAA2B,UAAkB,KAAqB;CAC1F,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,GAAG,GAAG;AACpD,KAAI,CAAC,OAAO,SAAS,OAAO,CAAE,QAAO;AACrC,QAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;;AAG3C,SAAS,YAAY,OAAmC;CACtD,MAAM,SAAS,QAAQ,OAAO,SAAS,OAAO,GAAG,GAAG;AACpD,QAAO,OAAO,SAAS,OAAO,GAAG,KAAK,IAAI,GAAG,OAAO,GAAG;;AAGzD,SAAS,2BAA2B,QAKZ;AACtB,QAAO;EACL,eAAe,OAAO;EACtB,cAAc;GAAC,OAAO;GAAW;GAAU,OAAO;GAAO,CAAC,KAAK,IAAI;EACnE,aAAa;EACb,uBAAuB;EACvB,SAAS;GACP,SAAS,OAAO;GAChB,QAAQ,OAAO;GACf,WAAW,OAAO;GAClB,UAAU;GACV,QAAQ,OAAO;GAChB;EACD,YAAY,EACV,qBAAqB,OAAO,WAAW,aAAa,OAAO,OAAO,WAAW,QAAQ,EACtF;EACF;;AAGH,SAAgB,uBAAuB,eAAqB,MAAoC;CAC9F,MAAM,EAAE,YAAY;AAIpB,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,8BAA8B,GAAG,SAAS,gBAAgB;AAC1E,MAAI,QACF,QAAO;EAGT,MAAM,eAAe,iBAAiB,EAAE,IAAI,MAAM,eAAe,EAAE,IAAI,GAAG;EAC1E,MAAM,gBAAgB,YAAY,EAAE,IAAI,MAAM,gBAAgB,CAAC;EAC/D,MAAM,sBAAsB,iBAAiB,EAAE,IAAI,MAAM,sBAAsB,EAAE,GAAG,GAAG;EACvF,MAAM,aAAa,iBAAiB,EAAE,IAAI,MAAM,aAAa,EAAE,IAAI,IAAI;EACvE,MAAM,cAAc,YAAY,EAAE,IAAI,MAAM,cAAc,CAAC;EAC3D,MAAM,YAAY,iBAAiB,EAAE,IAAI,MAAM,YAAY,EAAE,4BAA4B,KAAK;EAC9F,MAAM,eAAe,KAAK,KAAK,GAAG,YAAY,KAAK,KAAK,KAAK;EAC7D,MAAM,oBAAoB,EAAE,IAAI,MAAM,oBAAoB,EAAE,MAAM,IAAI,KAAA;EAEtE,MAAM,WAAW,QAAQ,SAAS,wBAAwB;GACxD,QAAQ;GACR,OAAO;GACP,QAAQ;GACR;GACA,eAAe;GACf;GACD,CAAC;EACF,MAAM,eAAe,MAAM,QAAQ,IACjC,SAAS,MAAM,IAAI,OAAO,YAAY;GACpC,MAAM,WAAW,MAAM,QAAQ,SAAS,aAAa;IACnD,WAAW,QAAQ;IACnB,OAAO;IACP,QAAQ;IACR;IACA,eAAe;IACf;IACA,QAAQ;IACR,WAAW;IACZ,CAAC;AACF,UAAO;IACL;IACA,UAAU,SAAS;IACnB,cAAc,SAAS;IACvB,gBAAgB,SAAS;IAC1B;IACD,CACH;EACD,MAAM,QAAQ,MAAM,QAAQ,SAAS,aAAa;GAChD,YAAY;GACZ,OAAO;GACP,QAAQ;GACR;GACA,eAAe;GACf;GACA,QAAQ;GACR,WAAW;GACZ,CAAC;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,UAAU;IACR,OAAO;IACP,OAAO,SAAS;IAChB,OAAO,SAAS;IAChB,QAAQ,SAAS;IACjB,SAAS,SAAS;IACnB;GACD;GACD,CAAC;GACF;AAGF,eAAc,KAAK,iBAAiB,OAAO,MAAM;EAC/C,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,KAAK,WAAW;EAChC,MAAM,YAAY,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,MAAM,GAAG,KAAA;EACxG,MAAM,aAAa,QAAQ;AAC3B,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,UAAU,sBAAsB;GACpC,QAAQ;GACR,UAAU,QAAQ;GAClB,iBAAiB,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAA;GACnE;GACD,CAAC;AAGF,MAAI,KAAK,SAAS;GAChB,MAAM,aAAa,gBAAgB;IACjC;IACA,QAAQ;IACR,WAAW;IACX,UAAU;IACV,QAAQ,KAAK;IACd,CAAC;AAEF,SAAM,QAAQ,qBAAqB,aAAa,YAAY,EAAE,EAAE,EAC9D,UAAU,2BAA2B;IACnC;IACA,QAAQ;IACR,WAAW;IACX,QAAQ,KAAK;IACd,CAAC,EACH,CAAC;AACF,OAAI,UACF,SAAQ,SAAS,cAAc,YAAY,UAAU;GAEvD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,WAAW;AAC7D,UAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI;;EAGjC,MAAM,SAAS,QAAQ,YAAY;EACnC,MAAM,aAAa,gBAAgB;GACjC;GACA,QAAQ;GACR,WAAW;GACX,UAAU;GACV,QAAQ;GACT,CAAC;AAEF,QAAM,QAAQ,qBAAqB,aAAa,YAAY,EAAE,EAAE,EAC9D,UAAU,2BAA2B;GACnC;GACA,QAAQ;GACR,WAAW;GACX,QAAQ;GACT,CAAC,EACH,CAAC;AAEF,MAAI,UACF,SAAQ,SAAS,cAAc,YAAY,UAAU;EAEvD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,WAAW;AAC7D,SAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI;GAC/B;AAGF,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,UAAU,8BAA8B,GAAG,SAAS,gBAAgB;AAC1E,MAAI,QACF,QAAO;EAET,MAAM,QAAQ,EAAE,IAAI,OAAO;EAC3B,MAAM,eAAe,MAAM,OACvB,MAAM,IAAI,CACX,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,cAAc;EACxB,MAAM,SAAS,MAAM,QAAQ,SAAS,aAAa;GACjD,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,cAAc,cAAc,SAAS,eAAe,KAAA;GACpD,eAAe,MAAM,kBAAkB;GACvC,WAAW,MAAM;GACjB,YAAY,MAAM,eAAe;GACjC,cAAc,MAAM,eAAe,SAAS,MAAM,aAAa,GAAG,KAAA;GAClE,eAAe,MAAM,kBAAkB;GACvC,mBAAmB,MAAM;GACzB,OAAO,MAAM,QAAQ,SAAS,MAAM,MAAM,GAAG,KAAA;GAC7C,QAAQ,MAAM,SAAS,SAAS,MAAM,OAAO,GAAG,KAAA;GACjD,CAAC;AACF,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO;AAC7C,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,EAAE,IAAI,MAAM,UAAU;EACtC,MAAM,UAAU,MAAM,QAAQ,SAAS,QAAQ,WAAW,KAAA,EAAU;AACpE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;AAGF,eAAc,IAAI,yBAAyB,OAAO,MAAM;EACtD,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe;GACnD,WAAW,EAAE,IAAI,MAAM,YAAY;GACnC,YAAY,EAAE,IAAI,MAAM,aAAa,IAAI,EAAE,IAAI,MAAM,MAAM;GAC5D,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,KAAK,yBAAyB,OAAO,MAAM;EACvD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe;GACnD,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAA;GACjE,YAAY,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,KAAA;GACpE,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,KAAA;GAChD,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,UAAU,8BAA8B,GAAG,SAAS,eAAe;AACzE,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADiB,QAAQ,SAAS,WAAW,IAAI,CAEpD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,QAAQ,SAAS,aAAa,IAAI;GAAE,CAAC;GACxE;AAGF,eAAc,IAAI,mCAAmC,OAAO,MAAM;EAChE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,UAAU,MAAM,QAAQ,SAAS,eAAe,IAAI;AAC1D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,MAAM,mCAAmC,OAAO,MAAM;EAClE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,SAAS,iBAAiB,KAAK,KAAK;AACjE,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO;GAAO,EAAE,IAAI;AAExD,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,UAAU,8BAA8B,GAAG,SAAS,oBAAoB;AAC9E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG,KAAA;EAC/D,MAAM,QACJ,gBAAgB,KAAA,KAAa,OAAO,SAAS,YAAY,GACrD,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GACvC,KAAA;EAEN,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM;EAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;EAClE,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;EAE3E,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;GACxD;GACA;GACA,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC7B,CAAC;AACF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAG/D,MAAM,WAAW,wBAAwB,OAAO,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC5E,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,UAAU;GACrB,YAAY,OAAO;GACpB,CAAC;GACF;AAGF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;EACrC,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM;EAC5C,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;EAClE,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG;EAC/D,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;EAC3E,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GAAG;EACvF,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;GACxD;GACA;GACA,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC7B,CAAC;AAEF,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,QAAQ,MAAM,QAAQ,SAAS,YAAY,IAAI;AACrD,MAAI,CAAC,MACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAO,CAAC;GAClC;AAGF,eAAc,IAAI,wCAAwC,OAAO,MAAM;EACrE,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,eAAe,EAAE,IAAI,MAAM,YAAY;EAC7C,MAAM,YAAY,eAAe,OAAO,SAAS,cAAc,GAAG,GAAG;AACrE,MAAI,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,EAC7C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwC,EAAE,IAAI;EAElF,MAAM,SAAS,iBAAiB,EAAE,IAAI,MAAM,SAAS,EAAE,IAAI,IAAI;EAC/D,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,QAAQ,EAAE,KAAK,IAAI;EAC9D,MAAM,SAAS,MAAM,QAAQ,SAAS,oBAAoB,KAAK;GAAE;GAAW;GAAQ;GAAO,CAAC;AAC5F,MAAI,CAAC,OACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAQ,CAAC;GAC5C;AAGF,eAAc,KAAK,yCAAyC,OAAO,MAAM;EACvE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,KAAK,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAA;EAC5E,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAA;EACzD,MAAM,OACJ,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,GACtG,KAAK,OACN,KAAA;AACN,QAAM,QAAQ,qBAAqB,6BAA6B,KAAK;GAAE;GAAI;GAAM;GAAM,CAAC;AACxF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,uCAAuC,OAAO,MAAM;EACrE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,SAAS,MAAM,GAAG;AAC5E,MAAI,CAAC,SACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,GAAG,KAAK,MAAM,MAAM,GAAG,KAAA;AACxF,QAAM,QAAQ,qBAAqB,2BAA2B,KAAK;GAAE;GAAU;GAAO,CAAC;AACvF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,wCAAwC,OAAO,MAAM;EACtE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,MAAM,GAAG;AAClF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA0B,EAAE,IAAI;AAEpE,QAAM,QAAQ,qBAAqB,4BAA4B,KAAK;GAClE;GACA,MAAM,KAAK;GACZ,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,gDAAgD,OAAO,MAAM;EAC9E,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,WAAW,MAAM,GAAG;AAClF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA0B,EAAE,IAAI;EAEpE,MAAM,UACJ,OAAO,KAAK,YAAY,YAAY,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,UAAU;AACnF,QAAM,QAAQ,qBAAqB,mCAAmC,KAAK;GACzE;GACA;GACA,SAAS,OAAO,KAAK,YAAY,YAAY,KAAK,UAAU,KAAA;GAC5D,SAAS,KAAK;GACf,CAAC;AACF,6BAA2B,KAAK,kCAAkC;AAClE,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG;AACzE,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;AAEjE,QAAM,QAAQ,qBAAqB,mCAAmC,KAAK;GACzE;GACA,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;GACxD,UAAU,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW,KAAK,aAAa,OAAO,OAAO,KAAA;GAC9F,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAK,WAAW,OAAO,OAAO,KAAA;GACtF,oBAAoB,KAAK,uBAAuB;GAChD,WAAW,KAAK,cAAc;GAC9B,gBAAgB,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,KAAA;GACjF,CAAC;AACF,6BAA2B,KAAK,kCAAkC;AAClE,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAGF,eAAc,IAAI,6CAA6C,OAAO,MAAM;EAC1E,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADc,QAAQ,qBAAqB,mBAAmB,IAAI,CAErE,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,cAAc,MAAM,QAAQ,SAAS,0BAA0B,IAAI;AACzE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,aAAa;GAAE,CAAC;GACrD;AAEF,eAAc,IAAI,2DAA2D,OAAO,MAAM;EACxF,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe;EAChD,MAAM,aAAa,MAAM,QAAQ,SAAS,wBAAwB,KAAK,aAAa;AACpF,MAAI,CAAC,WACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;AAElE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,YAAY;GAAE,CAAC;GACpD;AAEF,eAAc,KAAK,yCAAyC,OAAO,MAAM;EACvE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,eAAe,OAAO,KAAK,iBAAiB,WAAW,KAAK,aAAa,MAAM,GAAG;AACxF,MAAI,CAAC,aACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI;AACF,SAAM,QAAQ,SAAS,4BAA4B,KAAK,aAAa;WAC9D,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,0BAA0B;IAAE,WAAW;IAAqB,YAAY;IAAK,CAAC;GACzG,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,OAAI,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,UAAU,CACtD,QAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAK,EAAE,IAAI;AAE/C,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAK,EAAE,IAAI;;EAE/C,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,MAAI,CAAC,QACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;AAE/D,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,KAAK,qCAAqC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,MADiB,QAAQ,SAAS,WAAW,IAAI,CAEpD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAqB,EAAE,IAAI;EAE/D,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,eAAe,OAAO,KAAK,iBAAiB,WAAW,KAAK,eAAe,KAAA;EACjF,MAAM,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,QAAQ;EAC7D,MAAM,SAAS,MAAM,QAAQ,SAAS,cAAc,KAAK;GAAE;GAAc;GAAO,CAAC;AACjF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,QAAQ;GAAE,CAAC;GAChD;AAGF,eAAc,IAAI,sBAAsB,OAAO,MAAM;EACnD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,aAAa,EAAE,IAAI,MAAM,UAAU,IAAI;EAC7C,MAAM,aAAa,IAAI,IACrB,WACG,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ,CACnB;EACD,MAAM,oBAAoB,WAAW,IAAI,aAAa;EACtD,MAAM,wBAAwB,WAAW,IAAI,iBAAiB;EAC9D,MAAM,YAAY,EAAE,IAAI,MAAM,SAAS;EACvC,MAAM,WAAW,EAAE,IAAI,MAAM,QAAQ;AAGrC,MAFuB,cAAc,KAAA,KAAa,aAAa,KAAA,GAE3C;GAClB,MAAM,UAAU,8BAA8B,GAAG,SAAS,mBAAmB;AAC7E,OAAI,QACF,QAAO;GAET,MAAM,eAAe,YAAY,OAAO,SAAS,WAAW,GAAG,GAAG;GAClE,MAAM,cAAc,WAAW,OAAO,SAAS,UAAU,GAAG,GAAG;GAC/D,MAAM,SAAS,OAAO,SAAS,aAAa,GAAG,KAAK,IAAI,GAAG,aAAa,GAAG;GAC3E,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,GAAG;GACvF,MAAM,SAAS,MAAM,QAAQ,SAAS,eAAe,KAAK;IACxD;IACA;IACA,0BAA0B;IAC1B;IACD,CAAC;AACF,OAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAEpD,UAAO,EAAE,KAAK,OAAO;;EAGvB,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,KAAK;GACrD,0BAA0B;GAC1B;GACD,CAAC;AACF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAEpD,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B;AAGF,eAAc,MAAM,sBAAsB,OAAO,MAAM;EACrD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,QAKF,EAAE;AACN,MAAI,OAAO,KAAK,SAAS,SACvB,OAAM,OAAO,KAAK;AAEpB,MAAI,MAAM,QAAQ,KAAK,KAAK,CAC1B,OAAM,OAAO,KAAK;AAEpB,MAAI,OAAO,KAAK,gBAAgB,UAC9B,OAAM,cAAc,KAAK;AAE3B,MAAI,KAAK,eAAe,KAAA,KAAa,OAAO,KAAK,eAAe,YAAY,KAAK,eAAe,KAC9F,OAAM,aAAa,KAAK;EAE1B,IAAI;AACJ,MAAI,eAAe,MAAM;AACvB,wBAAqB,OAAO,KAAK,cAAc,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,MAAM,GAAG;AAC3G,OAAI,sBAAsB,CAAC,QAAQ,SAAS,IAAI,mBAAmB,CACjE,QAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAqB,EAAE,IAAI;;EAGjE,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,KAAK,MAAM;AACvD,MAAI,OAAO,OAAO,MAChB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO;GAAO,EAAE,IAAI;AAExD,MAAI,uBAAuB,KAAA,EACzB,KAAI;AACF,OAAI,mBACF,SAAQ,SAAS,cAAc,KAAK,mBAAmB;OAEvD,SAAQ,SAAS,cAAc,IAAI;WAE9B,OAAO;AACd,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAAE,EAAE,IAAI;;EAIpG,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAGF,eAAc,IAAI,6BAA6B,OAAO,MAAM;EAC1D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAW;EAC/C,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,KAAK,OAAO;AACzD,SAAO,EAAE,KAAK,OAAO;GACrB;AAEF,eAAc,KAAK,wBAAwB,OAAO,MAAM;EACtD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;EACxE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AAClE,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI,CAAC,QAAQ,MAAM,CACjB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAuB,EAAE,IAAI;AAEjE,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,aAAa,WAAW,QAAQ;AACtE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAEF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;EACrE,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK,SAAS;AAC7D,SAAO,EAAE,KAAK,OAAO;GACrB;AAEF,eAAc,KAAK,2BAA2B,OAAO,MAAM;EACzD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;AACxE,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,KAAK,KAAK,UAAU;AAC1D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAEF,eAAc,KAAK,+BAA+B,OAAO,MAAM;EAC7D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;EACxE,MAAM,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,MAAM,KAAK,WAAW,GAAG;AACvF,MAAI,CAAC,UAAU,MAAM,CACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyB,EAAE,IAAI;AAEnE,MAAI,CAAC,OAAO,SAAS,WAAW,IAAI,aAAa,EAC/C,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAyC,EAAE,IAAI;AAEnF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,SAAS,SAAS,KAAK,WAAW,EAAE,YAAY,CAAC;AAC9E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM,GAAG;IAAQ,CAAC;WAC/B,KAAK;GACZ,MAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AACrE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAc,EAAE,IAAI;;GAExD;AAMF,eAAc,OAAO,+BAA+B,OAAO,MAAM;EAC/D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,SAAS,MAAM,QAAQ,qBAAqB,aAAa,IAAI;AACnE,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAGpD,IAAI,aAAa,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa;EACzE,IAAI,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;EAC1D,MAAM,iBACJ,OAAO,KAAK,mBAAmB,WAAW,KAAK,iBAAiB,KAAA;AAElE,MAAI,mBAAmB,KAAA,GAAW;GAChC,MAAM,QAAQ,4BAA4B,QAAQ,eAAe;AACjE,OAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,iCAAiC,EAAE,IAAI;AAEhE,gBAAa,MAAM;AACnB,WAAQ,MAAM;;AAGhB,MAAI,aAAa,KAAK,SAAS,EAC7B,QAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,EAAE,IAAI;AAE9D,MAAI,cAAc,OAAO,OACvB,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,IAAI;EAErD,MAAM,cAAc,KAAK,IAAI,OAAO,OAAO,SAAS,WAAW;EAC/D,MAAM,UAAU,OAAO,MAAM,YAAY,aAAa,YAAY;EAClE,MAAM,OAAO,OAAO,MAAM,GAAG,WAAW,CAAC,OAAO,OAAO,MAAM,aAAa,YAAY,CAAC;AACvF,QAAM,QAAQ,qBAAqB,aAAa,KAAK,KAAK;AAC1D,QAAM,kCAAkC;GAAE;GAAS,WAAW;GAAM,CAAC;AACrE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAa,CAAC;GACjD;AAGF,eAAc,KAAK,4BAA4B,OAAO,MAAM;EAC1D,MAAM,UAAU,8BAA8B,GAAG,SAAS,iBAAiB;AAC3E,MAAI,QACF,QAAO;EAET,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,IAAI;AAChD,MAAI,OAAO,OAAO,OAAO;GACvB,MAAM,SAAS,OAAO,UAAU,sBAAsB,MAAM;AAC5D,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,OAAO;IAAO,EAAE,OAAO;;EAE3D,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,IAAI;AACtD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,OAAO;GACP,WAAW,OAAO;GAClB,mBAAmB,OAAO;GAC1B;GACD,CAAC;GACF;AAGF,eAAc,OAAO,sBAAsB,OAAO,MAAM;EACtD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,IAAI;AACjD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,8BAA8B,OAAO,MAAM;EAC5D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ,IAAI;AAClD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,gCAAgC,OAAO,MAAM;EAC9D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,IAAI;AACpD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,IAAI;AAC9C,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,4BAA4B,OAAO,MAAM;EAC1D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,MAAM,IAAI;AAChD,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,KAAK,6BAA6B,OAAO,MAAM;EAC3D,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;EAG9B,MAAM,EAAE,SAAS,MADE,EAAE,IAAI,MAAM;EAE/B,MAAM,SAAS,MAAM,QAAQ,SAAS,OAAO,KAAK,KAAK;AACvD,SAAO,EAAE,KAAK,OAAO;GACrB;AAKF,eAAc,IAAI,kBAAkB,OAAO,MAAM;EAC/C,MAAM,QAAQ,EAAE,IAAI,OAAO;EAC3B,MAAM,SAAS,MAAM,QAAQ,SAAS,cAAc;GAClD,OAAO,MAAM,QAAQ,SAAS,MAAM,MAAM,GAAG,KAAA;GAC7C,QAAQ,MAAM,SAAS,SAAS,MAAM,OAAO,GAAG,KAAA;GACjD,CAAC;AACF,SAAO,EAAE,KAAK,OAAO;GACrB;AAGF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,MAAM,EAAE,IAAI,MAAM,MAAM;AAE9B,MAAI,CAAC,IAAI,WAAW,YAAY,CAC9B,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEzD,MAAM,aAAa,EAAE,IAAI,MAAM,UAAU,IAAI;EAC7C,MAAM,aAAa,IAAI,IACrB,WACG,MAAM,IAAI,CACV,KAAK,MAAM,EAAE,MAAM,CAAC,CACpB,OAAO,QAAQ,CACnB;EACD,MAAM,UAAU,MAAM,QAAQ,SAAS,WAAW,KAAK;GACrD,0BAA0B,WAAW,IAAI,aAAa;GACtD,uBAAuB,WAAW,IAAI,iBAAiB;GACxD,CAAC;AACF,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,EAAE,IAAI;AAE7D,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B"}

package/dist/src/gateway/server.js

@@ -51,11 +51,7 @@ var GatewayServer = class {
 		});
 		const { configureTunnelFromGatewayConfig } = await import("../tunnel/gateway-lifecycle.js");
 		await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });
-		const effectiveToken = this.config.token || this.service.getAuthToken();
-		const app = createHonoApp({
-			service: this.service,
-			token: effectiveToken
-		});
+		const app = createHonoApp({ service: this.service });
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
 			server.on("upgrade", (req, socket, head) => {

package/dist/src/gateway/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../../../src/gateway/server.ts"],"sourcesContent":["import { serve, type ServerType } from '@hono/node-server';\nimport type { IncomingMessage } from 'node:http';\nimport type { Socket } from 'node:net';\n\nimport { ensureXopcCliOnPath } from '../infra/path-env.js';\n\nensureXopcCliOnPath();\n\nimport type { GatewayBindMode } from '../config/schema.js';\nimport { resolveGatewayBindHost, resolveGatewayListenHosts } from '../config/gateway-bind.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { GatewayService } from './service.js';\nimport { createHonoApp } from './hono/app.js';\nimport { handleSiteShareUpgrade } from '../share/site-share-router.js';\n\nexport interface GatewayServerConfig {\n  port: number;\n  /** Resolved listen address (sync plan); re-validated async at start when possible. */\n  bindHost: string;\n  bind?: GatewayBindMode;\n  customBindHost?: string;\n  token?: string;\n  verbose?: boolean;\n  configPath?: string;\n  enableHotReload?: boolean;\n}\n\nexport class GatewayServer {\n  private server?: ServerType;\n  private extraServers: ServerType[] = [];\n  private config: GatewayServerConfig;\n  private service: GatewayService;\n\n  constructor(config: GatewayServerConfig) {\n    this.config = config;\n    this.service = new GatewayService({\n      configPath: config.configPath,\n      enableHotReload: config.enableHotReload,\n      deferChannelConnectUntilAfterHttp: true,\n      listenBind: config.bind,\n      listenCustomBindHost: config.customBindHost,\n      listenPort: config.port,\n    });\n  }\n\n  async start(): Promise<void> {\n    const cfg = this.service.currentConfig;\n    const plan = resolveGatewayListenPlan({\n      cfg,\n      bindOverride: this.config.bind,\n    });\n\n    let bindHost: string;\n    try {\n      bindHost = await resolveGatewayBindHost({\n        bindMode: plan.bindMode,\n        customBindHost: plan.customBindHost ?? this.config.customBindHost,\n      });\n    } catch (err) {\n      bindHost = plan.bindHost;\n      if (plan.bindMode === 'custom') {\n        throw err;\n      }\n    }\n\n    if (plan.bindMode === 'custom') {\n      const expected = plan.customBindHost?.trim();\n      if (!expected || bindHost !== expected) {\n        throw new Error(\n          `gateway bind=custom requested ${expected ?? '(missing)'} but resolved ${bindHost}`,\n        );\n      }\n    }\n\n    const listenHosts = await resolveGatewayListenHosts(bindHost);\n    console.log(`[GatewayServer] Starting gateway server on ${bindHost}:${this.config.port}...`);\n\n    await this.service.start();\n    this.service.registerGatewayShutdownForRestart(async () => {\n      await this.stop();\n    });\n\n    const { configureTunnelFromGatewayConfig } = await import('../tunnel/gateway-lifecycle.js');\n    await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });\n\n    const effectiveToken = this.config.token || this.service.getAuthToken();\n    const app = createHonoApp({\n      service: this.service,\n      token: effectiveToken,\n    });\n\n    const primaryHost = listenHosts[0] ?? bindHost;\n    const attachUpgrade = (server: ServerType): void => {\n      // `@hono/node-server`'s `serve()` returns the underlying `http.Server`.\n      const inner = server as unknown as {\n        on(event: 'upgrade', listener: (req: IncomingMessage, socket: Socket, head: Buffer) => void): void;\n      };\n      inner.on('upgrade', (req, socket, head) => {\n        try {\n          handleSiteShareUpgrade(this.service, req, socket, head);\n        } catch (err) {\n          console.error('[GatewayServer] site-share upgrade error:', err);\n          try {\n            socket.destroy();\n          } catch {\n            /* ignore */\n          }\n        }\n      });\n    };\n\n    this.server = serve(\n      {\n        fetch: app.fetch,\n        port: this.config.port,\n        hostname: primaryHost,\n      },\n      () => {\n        console.log(`[GatewayServer] Gateway server running at http://${primaryHost}:${this.config.port}`);\n        this.service.markHttpListening();\n        void this.service.onHttpListening().catch((err) => {\n          console.error('[GatewayServer] Deferred channel startup failed:', err);\n        });\n      },\n    );\n    attachUpgrade(this.server);\n\n    for (const aliasHost of listenHosts.slice(1)) {\n      const extra = serve({\n        fetch: app.fetch,\n        port: this.config.port,\n        hostname: aliasHost,\n      });\n      attachUpgrade(extra);\n      this.extraServers.push(extra);\n    }\n  }\n\n  async close(opts?: { reason?: string; restartExpectedMs?: number | null }): Promise<void> {\n    const reason = opts?.reason ?? 'gateway stopping';\n    console.log(`[GatewayServer] Closing gateway server: ${reason}`);\n    await this.stop();\n  }\n\n  async stop(): Promise<void> {\n    console.log('[GatewayServer] Stopping gateway server...');\n\n    const closeServer = async (server: ServerType | undefined) => {\n      if (!server) {\n        return;\n      }\n      const forceClose = setTimeout(() => {\n        (server as { closeAllConnections?: () => void }).closeAllConnections?.();\n      }, 2000);\n      await new Promise<void>((resolve) => {\n        server.close(() => {\n          clearTimeout(forceClose);\n          resolve();\n        });\n      });\n    };\n\n    await closeServer(this.server);\n    this.server = undefined;\n\n    for (const extra of this.extraServers) {\n      await closeServer(extra);\n    }\n    this.extraServers = [];\n\n    await this.service.stop();\n\n    console.log('[GatewayServer] Gateway server stopped');\n  }\n\n  get isRunning(): boolean {\n    return this.server !== undefined;\n  }\n\n  get serviceInstance(): GatewayService {\n    return this.service;\n  }\n}\n"],"mappings":";;;;;;;;AAMA,qBAAqB;AAqBrB,IAAa,gBAAb,MAA2B;CACzB;CACA,eAAqC,EAAE;CACvC;CACA;CAEA,YAAY,QAA6B;AACvC,OAAK,SAAS;AACd,OAAK,UAAU,IAAI,eAAe;GAChC,YAAY,OAAO;GACnB,iBAAiB,OAAO;GACxB,mCAAmC;GACnC,YAAY,OAAO;GACnB,sBAAsB,OAAO;GAC7B,YAAY,OAAO;GACpB,CAAC;;CAGJ,MAAM,QAAuB;EAC3B,MAAM,MAAM,KAAK,QAAQ;EACzB,MAAM,OAAO,yBAAyB;GACpC;GACA,cAAc,KAAK,OAAO;GAC3B,CAAC;EAEF,IAAI;AACJ,MAAI;AACF,cAAW,MAAM,uBAAuB;IACtC,UAAU,KAAK;IACf,gBAAgB,KAAK,kBAAkB,KAAK,OAAO;IACpD,CAAC;WACK,KAAK;AACZ,cAAW,KAAK;AAChB,OAAI,KAAK,aAAa,SACpB,OAAM;;AAIV,MAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,WAAW,KAAK,gBAAgB,MAAM;AAC5C,OAAI,CAAC,YAAY,aAAa,SAC5B,OAAM,IAAI,MACR,iCAAiC,YAAY,YAAY,gBAAgB,WAC1E;;EAIL,MAAM,cAAc,MAAM,0BAA0B,SAAS;AAC7D,UAAQ,IAAI,8CAA8C,SAAS,GAAG,KAAK,OAAO,KAAK,KAAK;AAE5F,QAAM,KAAK,QAAQ,OAAO;AAC1B,OAAK,QAAQ,kCAAkC,YAAY;AACzD,SAAM,KAAK,MAAM;IACjB;EAEF,MAAM,EAAE,qCAAqC,MAAM,OAAO;AAC1D,QAAM,iCAAiC,KAAK,QAAQ,eAAe,EAAE,qBAAqB,MAAM,CAAC;EAEjG,MAAM,iBAAiB,KAAK,OAAO,SAAS,KAAK,QAAQ,cAAc;EACvE,MAAM,MAAM,cAAc;GACxB,SAAS,KAAK;GACd,OAAO;GACR,CAAC;EAEF,MAAM,cAAc,YAAY,MAAM;EACtC,MAAM,iBAAiB,WAA6B;AAKlD,UAAM,GAAG,YAAY,KAAK,QAAQ,SAAS;AACzC,QAAI;AACF,4BAAuB,KAAK,SAAS,KAAK,QAAQ,KAAK;aAChD,KAAK;AACZ,aAAQ,MAAM,6CAA6C,IAAI;AAC/D,SAAI;AACF,aAAO,SAAS;aACV;;KAIV;;AAGJ,OAAK,SAAS,MACZ;GACE,OAAO,IAAI;GACX,MAAM,KAAK,OAAO;GAClB,UAAU;GACX,QACK;AACJ,WAAQ,IAAI,oDAAoD,YAAY,GAAG,KAAK,OAAO,OAAO;AAClG,QAAK,QAAQ,mBAAmB;AAC3B,QAAK,QAAQ,iBAAiB,CAAC,OAAO,QAAQ;AACjD,YAAQ,MAAM,oDAAoD,IAAI;KACtE;IAEL;AACD,gBAAc,KAAK,OAAO;AAE1B,OAAK,MAAM,aAAa,YAAY,MAAM,EAAE,EAAE;GAC5C,MAAM,QAAQ,MAAM;IAClB,OAAO,IAAI;IACX,MAAM,KAAK,OAAO;IAClB,UAAU;IACX,CAAC;AACF,iBAAc,MAAM;AACpB,QAAK,aAAa,KAAK,MAAM;;;CAIjC,MAAM,MAAM,MAA8E;EACxF,MAAM,SAAS,MAAM,UAAU;AAC/B,UAAQ,IAAI,2CAA2C,SAAS;AAChE,QAAM,KAAK,MAAM;;CAGnB,MAAM,OAAsB;AAC1B,UAAQ,IAAI,6CAA6C;EAEzD,MAAM,cAAc,OAAO,WAAmC;AAC5D,OAAI,CAAC,OACH;GAEF,MAAM,aAAa,iBAAiB;AACjC,WAAgD,uBAAuB;MACvE,IAAK;AACR,SAAM,IAAI,SAAe,YAAY;AACnC,WAAO,YAAY;AACjB,kBAAa,WAAW;AACxB,cAAS;MACT;KACF;;AAGJ,QAAM,YAAY,KAAK,OAAO;AAC9B,OAAK,SAAS,KAAA;AAEd,OAAK,MAAM,SAAS,KAAK,aACvB,OAAM,YAAY,MAAM;AAE1B,OAAK,eAAe,EAAE;AAEtB,QAAM,KAAK,QAAQ,MAAM;AAEzB,UAAQ,IAAI,yCAAyC;;CAGvD,IAAI,YAAqB;AACvB,SAAO,KAAK,WAAW,KAAA;;CAGzB,IAAI,kBAAkC;AACpC,SAAO,KAAK"}
+{"version":3,"file":"server.js","names":[],"sources":["../../../src/gateway/server.ts"],"sourcesContent":["import { serve, type ServerType } from '@hono/node-server';\nimport type { IncomingMessage } from 'node:http';\nimport type { Socket } from 'node:net';\n\nimport { ensureXopcCliOnPath } from '../infra/path-env.js';\n\nensureXopcCliOnPath();\n\nimport type { GatewayBindMode } from '../config/schema.js';\nimport { resolveGatewayBindHost, resolveGatewayListenHosts } from '../config/gateway-bind.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { GatewayService } from './service.js';\nimport { createHonoApp } from './hono/app.js';\nimport { handleSiteShareUpgrade } from '../share/site-share-router.js';\n\nexport interface GatewayServerConfig {\n  port: number;\n  /** Resolved listen address (sync plan); re-validated async at start when possible. */\n  bindHost: string;\n  bind?: GatewayBindMode;\n  customBindHost?: string;\n  token?: string;\n  verbose?: boolean;\n  configPath?: string;\n  enableHotReload?: boolean;\n}\n\nexport class GatewayServer {\n  private server?: ServerType;\n  private extraServers: ServerType[] = [];\n  private config: GatewayServerConfig;\n  private service: GatewayService;\n\n  constructor(config: GatewayServerConfig) {\n    this.config = config;\n    this.service = new GatewayService({\n      configPath: config.configPath,\n      enableHotReload: config.enableHotReload,\n      deferChannelConnectUntilAfterHttp: true,\n      listenBind: config.bind,\n      listenCustomBindHost: config.customBindHost,\n      listenPort: config.port,\n    });\n  }\n\n  async start(): Promise<void> {\n    const cfg = this.service.currentConfig;\n    const plan = resolveGatewayListenPlan({\n      cfg,\n      bindOverride: this.config.bind,\n    });\n\n    let bindHost: string;\n    try {\n      bindHost = await resolveGatewayBindHost({\n        bindMode: plan.bindMode,\n        customBindHost: plan.customBindHost ?? this.config.customBindHost,\n      });\n    } catch (err) {\n      bindHost = plan.bindHost;\n      if (plan.bindMode === 'custom') {\n        throw err;\n      }\n    }\n\n    if (plan.bindMode === 'custom') {\n      const expected = plan.customBindHost?.trim();\n      if (!expected || bindHost !== expected) {\n        throw new Error(\n          `gateway bind=custom requested ${expected ?? '(missing)'} but resolved ${bindHost}`,\n        );\n      }\n    }\n\n    const listenHosts = await resolveGatewayListenHosts(bindHost);\n    console.log(`[GatewayServer] Starting gateway server on ${bindHost}:${this.config.port}...`);\n\n    await this.service.start();\n    this.service.registerGatewayShutdownForRestart(async () => {\n      await this.stop();\n    });\n\n    const { configureTunnelFromGatewayConfig } = await import('../tunnel/gateway-lifecycle.js');\n    await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });\n\n    const app = createHonoApp({ service: this.service });\n\n    const primaryHost = listenHosts[0] ?? bindHost;\n    const attachUpgrade = (server: ServerType): void => {\n      // `@hono/node-server`'s `serve()` returns the underlying `http.Server`.\n      const inner = server as unknown as {\n        on(event: 'upgrade', listener: (req: IncomingMessage, socket: Socket, head: Buffer) => void): void;\n      };\n      inner.on('upgrade', (req, socket, head) => {\n        try {\n          handleSiteShareUpgrade(this.service, req, socket, head);\n        } catch (err) {\n          console.error('[GatewayServer] site-share upgrade error:', err);\n          try {\n            socket.destroy();\n          } catch {\n            /* ignore */\n          }\n        }\n      });\n    };\n\n    this.server = serve(\n      {\n        fetch: app.fetch,\n        port: this.config.port,\n        hostname: primaryHost,\n      },\n      () => {\n        console.log(`[GatewayServer] Gateway server running at http://${primaryHost}:${this.config.port}`);\n        this.service.markHttpListening();\n        void this.service.onHttpListening().catch((err) => {\n          console.error('[GatewayServer] Deferred channel startup failed:', err);\n        });\n      },\n    );\n    attachUpgrade(this.server);\n\n    for (const aliasHost of listenHosts.slice(1)) {\n      const extra = serve({\n        fetch: app.fetch,\n        port: this.config.port,\n        hostname: aliasHost,\n      });\n      attachUpgrade(extra);\n      this.extraServers.push(extra);\n    }\n  }\n\n  async close(opts?: { reason?: string; restartExpectedMs?: number | null }): Promise<void> {\n    const reason = opts?.reason ?? 'gateway stopping';\n    console.log(`[GatewayServer] Closing gateway server: ${reason}`);\n    await this.stop();\n  }\n\n  async stop(): Promise<void> {\n    console.log('[GatewayServer] Stopping gateway server...');\n\n    const closeServer = async (server: ServerType | undefined) => {\n      if (!server) {\n        return;\n      }\n      const forceClose = setTimeout(() => {\n        (server as { closeAllConnections?: () => void }).closeAllConnections?.();\n      }, 2000);\n      await new Promise<void>((resolve) => {\n        server.close(() => {\n          clearTimeout(forceClose);\n          resolve();\n        });\n      });\n    };\n\n    await closeServer(this.server);\n    this.server = undefined;\n\n    for (const extra of this.extraServers) {\n      await closeServer(extra);\n    }\n    this.extraServers = [];\n\n    await this.service.stop();\n\n    console.log('[GatewayServer] Gateway server stopped');\n  }\n\n  get isRunning(): boolean {\n    return this.server !== undefined;\n  }\n\n  get serviceInstance(): GatewayService {\n    return this.service;\n  }\n}\n"],"mappings":";;;;;;;;AAMA,qBAAqB;AAqBrB,IAAa,gBAAb,MAA2B;CACzB;CACA,eAAqC,EAAE;CACvC;CACA;CAEA,YAAY,QAA6B;AACvC,OAAK,SAAS;AACd,OAAK,UAAU,IAAI,eAAe;GAChC,YAAY,OAAO;GACnB,iBAAiB,OAAO;GACxB,mCAAmC;GACnC,YAAY,OAAO;GACnB,sBAAsB,OAAO;GAC7B,YAAY,OAAO;GACpB,CAAC;;CAGJ,MAAM,QAAuB;EAC3B,MAAM,MAAM,KAAK,QAAQ;EACzB,MAAM,OAAO,yBAAyB;GACpC;GACA,cAAc,KAAK,OAAO;GAC3B,CAAC;EAEF,IAAI;AACJ,MAAI;AACF,cAAW,MAAM,uBAAuB;IACtC,UAAU,KAAK;IACf,gBAAgB,KAAK,kBAAkB,KAAK,OAAO;IACpD,CAAC;WACK,KAAK;AACZ,cAAW,KAAK;AAChB,OAAI,KAAK,aAAa,SACpB,OAAM;;AAIV,MAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,WAAW,KAAK,gBAAgB,MAAM;AAC5C,OAAI,CAAC,YAAY,aAAa,SAC5B,OAAM,IAAI,MACR,iCAAiC,YAAY,YAAY,gBAAgB,WAC1E;;EAIL,MAAM,cAAc,MAAM,0BAA0B,SAAS;AAC7D,UAAQ,IAAI,8CAA8C,SAAS,GAAG,KAAK,OAAO,KAAK,KAAK;AAE5F,QAAM,KAAK,QAAQ,OAAO;AAC1B,OAAK,QAAQ,kCAAkC,YAAY;AACzD,SAAM,KAAK,MAAM;IACjB;EAEF,MAAM,EAAE,qCAAqC,MAAM,OAAO;AAC1D,QAAM,iCAAiC,KAAK,QAAQ,eAAe,EAAE,qBAAqB,MAAM,CAAC;EAEjG,MAAM,MAAM,cAAc,EAAE,SAAS,KAAK,SAAS,CAAC;EAEpD,MAAM,cAAc,YAAY,MAAM;EACtC,MAAM,iBAAiB,WAA6B;AAKlD,UAAM,GAAG,YAAY,KAAK,QAAQ,SAAS;AACzC,QAAI;AACF,4BAAuB,KAAK,SAAS,KAAK,QAAQ,KAAK;aAChD,KAAK;AACZ,aAAQ,MAAM,6CAA6C,IAAI;AAC/D,SAAI;AACF,aAAO,SAAS;aACV;;KAIV;;AAGJ,OAAK,SAAS,MACZ;GACE,OAAO,IAAI;GACX,MAAM,KAAK,OAAO;GAClB,UAAU;GACX,QACK;AACJ,WAAQ,IAAI,oDAAoD,YAAY,GAAG,KAAK,OAAO,OAAO;AAClG,QAAK,QAAQ,mBAAmB;AAC3B,QAAK,QAAQ,iBAAiB,CAAC,OAAO,QAAQ;AACjD,YAAQ,MAAM,oDAAoD,IAAI;KACtE;IAEL;AACD,gBAAc,KAAK,OAAO;AAE1B,OAAK,MAAM,aAAa,YAAY,MAAM,EAAE,EAAE;GAC5C,MAAM,QAAQ,MAAM;IAClB,OAAO,IAAI;IACX,MAAM,KAAK,OAAO;IAClB,UAAU;IACX,CAAC;AACF,iBAAc,MAAM;AACpB,QAAK,aAAa,KAAK,MAAM;;;CAIjC,MAAM,MAAM,MAA8E;EACxF,MAAM,SAAS,MAAM,UAAU;AAC/B,UAAQ,IAAI,2CAA2C,SAAS;AAChE,QAAM,KAAK,MAAM;;CAGnB,MAAM,OAAsB;AAC1B,UAAQ,IAAI,6CAA6C;EAEzD,MAAM,cAAc,OAAO,WAAmC;AAC5D,OAAI,CAAC,OACH;GAEF,MAAM,aAAa,iBAAiB;AACjC,WAAgD,uBAAuB;MACvE,IAAK;AACR,SAAM,IAAI,SAAe,YAAY;AACnC,WAAO,YAAY;AACjB,kBAAa,WAAW;AACxB,cAAS;MACT;KACF;;AAGJ,QAAM,YAAY,KAAK,OAAO;AAC9B,OAAK,SAAS,KAAA;AAEd,OAAK,MAAM,SAAS,KAAK,aACvB,OAAM,YAAY,MAAM;AAE1B,OAAK,eAAe,EAAE;AAEtB,QAAM,KAAK,QAAQ,MAAM;AAEzB,UAAQ,IAAI,yCAAyC;;CAGvD,IAAI,YAAqB;AACvB,SAAO,KAAK,WAAW,KAAA;;CAGzB,IAAI,kBAAkC;AACpC,SAAO,KAAK"}

package/dist/src/mcp/channel-bridge.d.ts

@@ -1,5 +1,6 @@
 import type { Config } from '../config/schema.js';
 import type { ApprovalDecision, ApprovalKind, ClaudeChannelMode, ConversationDescriptor, PendingApproval, QueueEvent, WaitFilter } from './channel-shared.js';
+import { type GatewayCredential } from '../gateway/credential.js';
 export declare class XopcChannelBridge {
     private readonly cfg;
     private readonly params;
@@ -11,7 +12,7 @@ export declare class XopcChannelBridge {
     private eventsAbort;
     constructor(cfg: Config, params: {
         gatewayUrl?: string;
-        gatewayToken?: string;
+        gatewayCredential?: GatewayCredential;
         claudeChannelMode: ClaudeChannelMode;
         verbose: boolean;
     });