@xopcai/xopc 0.0.149 → 0.0.151

package/dist/src/gateway/hono/app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport type { Context } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { WORK_ITEM_ATTACHMENT_UPLOAD_BODY_MAX_BYTES } from '../../work-items/index.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { isLoopbackIpAddress, isTrustedProxyAddress } from '../client-ip.js';\nimport { resolveReverseProxyPublicUrl } from '../public-url.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport {\n  createChannelRateLimitMiddleware,\n  createStrictRateLimitMiddleware,\n} from './middleware/strict-rate-limit.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { routeErrorMiddleware } from './middleware/route-errors.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nimport { registerPublicLocalAppPreviewRoutes } from './routes/local-apps.js';\nimport { resetLazyRouteBundlesForTests } from './routes/lazy-fallback.js';\nimport { prewarmStaticUiCache } from './lib/static-ui.js';\nimport { registerSiteShareMiddleware } from '../../share/site-share-router.js';\nconst log = createLogger('Gateway:App');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path)\n    || /^\\/api\\/local-apps\\/preview\\/[^/]+\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  if (process.env.VITEST) {\n    resetLazyRouteBundlesForTests();\n  }\n  const { service } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n      reverseProxyPublicUrl: resolveReverseProxyPublicUrl(service.currentConfig),\n    });\n\n  /**\n   * TCP source for the in-flight request, normalized for trusted-proxy checks.\n   * Returns undefined when the runtime doesn't expose conninfo (tests, mocks).\n   */\n  const resolveRequestRemoteAddress = (c: Context): string | undefined => {\n    try {\n      return getConnInfo(c).remote.address;\n    } catch {\n      return undefined;\n    }\n  };\n\n  /**\n   * A request's TCP source qualifies as a \"trusted proxy hop\" when it's\n   * loopback (the user's own machine, where any reverse proxy lives) or\n   * listed in `gateway.trustedProxies`. We use this signal to safely\n   * auto-allow same-host Origins through CSRF without requiring a manual\n   * `corsOrigins` entry for every reverse-proxy hostname.\n   */\n  const isRequestFromTrustedProxy = (c: Context): boolean => {\n    const remote = resolveRequestRemoteAddress(c);\n    if (!remote) return false;\n    if (isLoopbackIpAddress(remote)) return true;\n    return isTrustedProxyAddress(remote, service.currentConfig.gateway?.trustedProxies);\n  };\n\n  app.use(logContextMiddleware());\n  app.use(logger({\n    trustedProxies: service.currentConfig.gateway?.trustedProxies,\n    allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n  }));\n\n  // Site-share middleware runs BEFORE CORS/CSP — it owns the request when the\n  // Host header matches `*.<publicHostSuffix>` (default `*.share.xopc.ai`) or\n  // the path starts with `/site/:token/`. Otherwise it falls through.\n  registerSiteShareMiddleware(app, service);\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      autoAllowSameHostFromTrustedProxy: isRequestFromTrustedProxy(c),\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        {\n          origin,\n          requestHost: c.req.header('host'),\n          reason: 'reason' in result ? result.reason : 'unknown',\n          path: c.req.path,\n          method: c.req.method,\n        },\n        `Browser origin check failed: ${origin} not in allowed list`,\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const SKILL_UPLOAD_BODY_MAX = 10 * 1024 * 1024;\n  const NOTE_MEDIA_BODY_MAX = 25 * 1024 * 1024;\n  const VOICE_TRANSCRIBE_BODY_MAX = 35 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  const isNoteMediaUploadRequest = (path: string, method: string, contentType: string | undefined): boolean => {\n    if (method !== 'POST') return false;\n    if (/^\\/api\\/notes\\/[^/]+\\/media$/.test(path)) return true;\n    return path === '/api/notes' && contentType?.includes('multipart/form-data') === true;\n  };\n\n  const isWorkItemAttachmentUploadRequest = (path: string, method: string, contentType: string | undefined): boolean => {\n    if (method !== 'POST' || contentType?.includes('multipart/form-data') !== true) return false;\n    return /^\\/api\\/work-items\\/[^/]+\\/attachments$/.test(path)\n      || /^\\/api\\/projects\\/[^/]+\\/work-items$/.test(path);\n  };\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: SKILL_UPLOAD_BODY_MAX,\n    onError: (c) => {\n      log.warn({ path: c.req.path, maxSizeMb: 10 }, 'Request body too large: skills upload exceeds 10MB limit');\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  app.use('/api/*', async (c, next) => {\n    const contentType = c.req.header('content-type');\n    const maxSize = c.req.path === '/api/agent'\n      ? WEBCHAT_AGENT_BODY_MAX\n      : c.req.path === '/api/skills/upload'\n        ? SKILL_UPLOAD_BODY_MAX\n        : c.req.path === '/api/voice/transcribe' || c.req.path === '/api/voice/transcriptions'\n          ? VOICE_TRANSCRIBE_BODY_MAX\n          : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType)\n            ? NOTE_MEDIA_BODY_MAX\n            : isWorkItemAttachmentUploadRequest(c.req.path, c.req.method, contentType)\n              ? WORK_ITEM_ATTACHMENT_UPLOAD_BODY_MAX_BYTES\n              : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) => {\n        log.warn({ path: ctx.req.path, maxSizeMb }, `Request body too large: exceeds ${maxSizeMb}MB limit`);\n        return ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413);\n      },\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n  registerPublicLocalAppPreviewRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(routeErrorMiddleware());\n  authenticated.use(\n    auth({\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => service.getResolvedAuth(),\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimitMiddleware = createStrictRateLimitMiddleware({\n    getTrustedProxyContext: () => ({\n      trustedProxies: service.currentConfig.gateway?.trustedProxies,\n      allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n    }),\n  });\n  const channelRateLimitMiddleware = createChannelRateLimitMiddleware({\n    getTrustedProxyContext: () => ({\n      trustedProxies: service.currentConfig.gateway?.trustedProxies,\n      allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n    }),\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    channelRateLimitMiddleware,\n    sseConfig,\n  });\n\n  const prewarm = prewarmStaticUiCache();\n  if (prewarm.loaded > 0) {\n    log.debug({ loaded: prewarm.loaded, missing: prewarm.missing }, 'Static UI cache prewarmed');\n  }\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    const isApiRoute = c.req.path.startsWith('/api/');\n    const fields = { path: c.req.path, method: c.req.method };\n    if (isApiRoute) {\n      log.warn(fields, 'Route not found');\n    } else {\n      log.debug(fields, 'Route not found');\n    }\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error(\n      {\n        err,\n        phase: 'gateway.http.unhandled',\n        path: c.req.path,\n        method: c.req.method,\n        userAgent: c.req.header('user-agent'),\n      },\n      `Hono error on ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAQqD;AA0BrD,MAAM,MAAM,aAAa,cAAc;;;;;;AAWvC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK,IAClD,uCAAuC,KAAK,KAAK;;AAGxD,SAAgB,cAAc,QAA6B;AACzD,KAAI,QAAQ,IAAI,OACd,gCAA+B;CAEjC,MAAM,EAAE,YAAY;CACpB,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACpC,uBAAuB,6BAA6B,QAAQ,cAAc;EAC3E,CAAC;;;;;CAMJ,MAAM,+BAA+B,MAAmC;AACtE,MAAI;AACF,UAAO,YAAY,EAAE,CAAC,OAAO;UACvB;AACN;;;;;;;;;;CAWJ,MAAM,6BAA6B,MAAwB;EACzD,MAAM,SAAS,4BAA4B,EAAE;AAC7C,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,oBAAoB,OAAO,CAAE,QAAO;AACxC,SAAO,sBAAsB,QAAQ,QAAQ,cAAc,SAAS,eAAe;;AAGrF,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,OAAO;EACb,gBAAgB,QAAQ,cAAc,SAAS;EAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;EAC7E,CAAC,CAAC;AAKH,6BAA4B,KAAK,QAAQ;AACzC,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,mCAAmC,0BAA0B,EAAE;GAC/D,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IACE;IACA,aAAa,EAAE,IAAI,OAAO,OAAO;IACjC,QAAQ,YAAY,SAAS,OAAO,SAAS;IAC7C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACf,EACD,gCAAgC,OAAO,sBACxC;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,wBAAwB,KAAK,OAAO;CAC1C,MAAM,sBAAsB,KAAK,OAAO;CACxC,MAAM,4BAA4B,KAAK,OAAO;CAC9C,MAAM,yBAAyB,iCAAiC;CAEhE,MAAM,4BAA4B,MAAc,QAAgB,gBAA6C;AAC3G,MAAI,WAAW,OAAQ,QAAO;AAC9B,MAAI,+BAA+B,KAAK,KAAK,CAAE,QAAO;AACtD,SAAO,SAAS,gBAAgB,aAAa,SAAS,sBAAsB,KAAK;;CAGnF,MAAM,qCAAqC,MAAc,QAAgB,gBAA6C;AACpH,MAAI,WAAW,UAAU,aAAa,SAAS,sBAAsB,KAAK,KAAM,QAAO;AACvF,SAAO,0CAA0C,KAAK,KAAK,IACtD,uCAAuC,KAAK,KAAK;;AAGxD,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS;EACT,UAAU,MAAM;AACd,OAAI,KAAK;IAAE,MAAM,EAAE,IAAI;IAAM,WAAW;IAAI,EAAE,2DAA2D;AACzG,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;AAEH,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,cAAc,EAAE,IAAI,OAAO,eAAe;EAChD,MAAM,UAAU,EAAE,IAAI,SAAS,eAC3B,yBACA,EAAE,IAAI,SAAS,uBACb,wBACA,EAAE,IAAI,SAAS,2BAA2B,EAAE,IAAI,SAAS,8BACvD,4BACA,yBAAyB,EAAE,IAAI,MAAM,EAAE,IAAI,QAAQ,YAAY,GAC7D,sBACA,kCAAkC,EAAE,IAAI,MAAM,EAAE,IAAI,QAAQ,YAAY,GACtE,6CACA;EACZ,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QAAQ;AAChB,QAAI,KAAK;KAAE,MAAM,IAAI,IAAI;KAAM;KAAW,EAAE,mCAAmC,UAAU,UAAU;AACnG,WAAO,IAAI,KAAK;KAAE,OAAO;KAA0B,SAAS,GAAG,UAAU;KAAK,EAAE,IAAI;;GAEvF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;AAChD,qCAAoC,KAAK,QAAQ;CAEjD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IAAI,sBAAsB,CAAC;AACzC,eAAc,IACZ,KAAK;EACH,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB,QAAQ,iBAAiB;EAChD,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;AAoBnC,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BApBgC,gCAAgC,EAChE,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E,GACF,CAe0B;EACzB,4BAfiC,iCAAiC,EAClE,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E,GACF,CAU2B;EAC1B,WAAA;GARA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAOxC;EACV,CAAC;CAEF,MAAM,UAAU,sBAAsB;AACtC,KAAI,QAAQ,SAAS,EACnB,KAAI,MAAM;EAAE,QAAQ,QAAQ;EAAQ,SAAS,QAAQ;EAAS,EAAE,4BAA4B;AAG9F,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;EAClB,MAAM,aAAa,EAAE,IAAI,KAAK,WAAW,QAAQ;EACjD,MAAM,SAAS;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;AACzD,MAAI,WACF,KAAI,KAAK,QAAQ,kBAAkB;MAEnC,KAAI,MAAM,QAAQ,kBAAkB;AAEtC,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MACF;GACE;GACA,OAAO;GACP,MAAM,EAAE,IAAI;GACZ,QAAQ,EAAE,IAAI;GACd,WAAW,EAAE,IAAI,OAAO,aAAa;GACtC,EACD,iBAAiB,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;AACD,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}

package/dist/src/gateway/hono/lib/agent-model.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-model.js","names":[],"sources":["../../../../../src/gateway/hono/lib/agent-model.ts"],"sourcesContent":["import type { AgentTypedModel } from '../../../config/schema.js';\n\nconst TYPED_MODEL_ID_RE = /^[a-z][a-z0-9_-]{0,63}$/;\n\nfunction isValidProviderModelRef(ref: string): boolean {\n  const trimmed = ref.trim();\n  const idx = trimmed.indexOf('/');\n  return idx > 0 && idx < trimmed.length - 1;\n}\n\n/**\n * Coerce PATCH body `{ roles: Record<id, role> }` into validated typed model roles.\n * Returns `null` to clear, `undefined` when input should be skipped, or cleaned roles.\n * Empty roles after filtering → `null` (same as clear).\n */\nexport function normalizePatchTypedModels(\n  v: unknown,\n): Record<string, Omit<AgentTypedModel, 'id'>> | null | undefined {\n  if (v === undefined) return undefined;\n  if (v === null) return null;\n  if (!v || typeof v !== 'object' || Array.isArray(v) || !('roles' in v)) return undefined;\n  const rawRoles = (v as { roles?: unknown }).roles;\n  if (!rawRoles || typeof rawRoles !== 'object' || Array.isArray(rawRoles)) return undefined;\n  const rows = Object.entries(rawRoles).map(([id, role]) => ({ id, ...(role as object) }));\n\n  const byId = new Map<string, Omit<AgentTypedModel, 'id'>>();\n  for (const raw of rows) {\n    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue;\n    const o = raw as Record<string, unknown>;\n    const id = typeof o.id === 'string' ? o.id.trim() : '';\n    const model = typeof o.model === 'string' ? o.model.trim() : '';\n    if (!id || !TYPED_MODEL_ID_RE.test(id) || !model || !isValidProviderModelRef(model)) continue;\n    const description =\n      typeof o.description === 'string' && o.description.trim()\n        ? o.description.trim().slice(0, 500)\n        : undefined;\n    byId.set(id, description ? { description, model } : { model });\n  }\n\n  if (byId.size === 0) return null;\n  return Object.fromEntries(byId.entries());\n}\n\n/** Read `primary` from an `AgentModelConfig` object. */\nexport function agentModelRefToString(ref: unknown): string | undefined {\n  if (!ref || typeof ref !== 'object' || Array.isArray(ref)) return undefined;\n  const p = (ref as { primary?: string }).primary;\n  return typeof p === 'string' && p.trim() ? p : undefined;\n}\n\nexport function agentModelFallbacksToArray(ref: unknown): string[] {\n  if (!ref || typeof ref !== 'object' || Array.isArray(ref)) return [];\n  const f = (ref as { fallbacks?: unknown }).fallbacks;\n  if (!Array.isArray(f)) return [];\n  return f.filter((x): x is string => typeof x === 'string' && x.trim().length > 0);\n}\n\n/**\n * Coerce a PATCH body `model` value into the canonical `{ primary, fallbacks? }`\n * object form. Returns `undefined` when the input has no usable primary so the\n * caller can skip the assignment.\n */\nexport function normalizePatchAgentModel(v: unknown): { primary: string; fallbacks?: string[] } | undefined {\n  if (!v || typeof v !== 'object' || Array.isArray(v)) return undefined;\n  const o = v as Record<string, unknown>;\n  const primary = typeof o.primary === 'string' ? o.primary.trim() : '';\n  if (!primary) return undefined;\n  const fallbacks = Array.isArray(o.fallbacks)\n    ? o.fallbacks.filter((x): x is string => typeof x === 'string' && x.trim().length > 0)\n    : [];\n  return fallbacks.length > 0 ? { primary, fallbacks } : { primary };\n}\n\n/** Read `timeoutMs` from an image-generation model ref (only set when ref is an object). */\nexport function agentImageGenerationModelTimeoutMs(ref: unknown): number | null {\n  if (!ref || typeof ref !== 'object' || Array.isArray(ref)) return null;\n  const v = (ref as { timeoutMs?: unknown }).timeoutMs;\n  return typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : null;\n}\n\n/** Read `autoProviderFallback` from an image-generation model ref. Defaults to false. */\nexport function agentImageGenerationModelAutoProviderFallback(ref: unknown): boolean {\n  if (!ref || typeof ref !== 'object' || Array.isArray(ref)) return false;\n  return (ref as { autoProviderFallback?: unknown }).autoProviderFallback === true;\n}\n\n/**\n * PATCH body normalizer for image-generation model refs. Always\n * emits `{ primary, fallbacks?, timeoutMs?, autoProviderFallback? }`. Returns\n * `undefined` when the input has no usable primary so the caller can skip the\n * assignment.\n */\nexport function normalizePatchAgentImageGenerationModel(\n  v: unknown,\n): { primary: string; fallbacks?: string[]; timeoutMs?: number; autoProviderFallback?: true } | undefined {\n  if (!v || typeof v !== 'object' || Array.isArray(v)) return undefined;\n  const o = v as Record<string, unknown>;\n  const primary = typeof o.primary === 'string' ? o.primary.trim() : '';\n  if (!primary) return undefined;\n  const out: { primary: string; fallbacks?: string[]; timeoutMs?: number; autoProviderFallback?: true } = { primary };\n  const fallbacks = Array.isArray(o.fallbacks)\n    ? o.fallbacks\n        .filter((x): x is string => typeof x === 'string' && x.trim().length > 0)\n        .map((x) => x.trim())\n    : [];\n  if (fallbacks.length > 0) out.fallbacks = fallbacks;\n  if (typeof o.timeoutMs === 'number' && Number.isFinite(o.timeoutMs) && o.timeoutMs > 0) {\n    out.timeoutMs = Math.floor(o.timeoutMs);\n  }\n  if (o.autoProviderFallback === true) out.autoProviderFallback = true;\n  return out;\n}\n"],"mappings":";AAEA,MAAM,oBAAoB;AAE1B,SAAS,wBAAwB,KAAsB;CACrD,MAAM,UAAU,IAAI,MAAM;CAC1B,MAAM,MAAM,QAAQ,QAAQ,IAAI;AAChC,QAAO,MAAM,KAAK,MAAM,QAAQ,SAAS;;;;;;;AAQ3C,SAAgB,0BACd,GACgE;AAChE,KAAI,MAAM,KAAA,EAAW,QAAO,KAAA;AAC5B,KAAI,MAAM,KAAM,QAAO;AACvB,KAAI,CAAC,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,GAAI,QAAO,KAAA;CAC/E,MAAM,WAAY,EAA0B;AAC5C,KAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CAAE,QAAO,KAAA;CACjF,MAAM,OAAO,OAAO,QAAQ,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW;EAAE;EAAI,GAAI;EAAiB,EAAE;CAExF,MAAM,uBAAO,IAAI,KAA0C;AAC3D,MAAK,MAAM,OAAO,MAAM;AACtB,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE;EAC3D,MAAM,IAAI;EACV,MAAM,KAAK,OAAO,EAAE,OAAO,WAAW,EAAE,GAAG,MAAM,GAAG;EACpD,MAAM,QAAQ,OAAO,EAAE,UAAU,WAAW,EAAE,MAAM,MAAM,GAAG;AAC7D,MAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,wBAAwB,MAAM,CAAE;EACrF,MAAM,cACJ,OAAO,EAAE,gBAAgB,YAAY,EAAE,YAAY,MAAM,GACrD,EAAE,YAAY,MAAM,CAAC,MAAM,GAAG,IAAI,GAClC,KAAA;AACN,OAAK,IAAI,IAAI,cAAc;GAAE;GAAa;GAAO,GAAG,EAAE,OAAO,CAAC;;AAGhE,KAAI,KAAK,SAAS,EAAG,QAAO;AAC5B,QAAO,OAAO,YAAY,KAAK,SAAS,CAAC;;;AAI3C,SAAgB,sBAAsB,KAAkC;AACtE,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO,KAAA;CAClE,MAAM,IAAK,IAA6B;AACxC,QAAO,OAAO,MAAM,YAAY,EAAE,MAAM,GAAG,IAAI,KAAA;;AAGjD,SAAgB,2BAA2B,KAAwB;AACjE,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO,EAAE;CACpE,MAAM,IAAK,IAAgC;AAC3C,KAAI,CAAC,MAAM,QAAQ,EAAE,CAAE,QAAO,EAAE;AAChC,QAAO,EAAE,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE;;;;;;;AAQnF,SAAgB,yBAAyB,GAAmE;AAC1G,KAAI,CAAC,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,EAAE,CAAE,QAAO,KAAA;CAC5D,MAAM,IAAI;CACV,MAAM,UAAU,OAAO,EAAE,YAAY,WAAW,EAAE,QAAQ,MAAM,GAAG;AACnE,KAAI,CAAC,QAAS,QAAO,KAAA;CACrB,MAAM,YAAY,MAAM,QAAQ,EAAE,UAAU,GACxC,EAAE,UAAU,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,GACpF,EAAE;AACN,QAAO,UAAU,SAAS,IAAI;EAAE;EAAS;EAAW,GAAG,EAAE,SAAS;;;AAIpE,SAAgB,mCAAmC,KAA6B;AAC9E,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO;CAClE,MAAM,IAAK,IAAgC;AAC3C,QAAO,OAAO,MAAM,YAAY,OAAO,SAAS,EAAE,IAAI,IAAI,IAAI,IAAI;;;AAIpE,SAAgB,8CAA8C,KAAuB;AACnF,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO;AAClE,QAAQ,IAA2C,yBAAyB;;;;;;;;AAS9E,SAAgB,wCACd,GACwG;AACxG,KAAI,CAAC,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,EAAE,CAAE,QAAO,KAAA;CAC5D,MAAM,IAAI;CACV,MAAM,UAAU,OAAO,EAAE,YAAY,WAAW,EAAE,QAAQ,MAAM,GAAG;AACnE,KAAI,CAAC,QAAS,QAAO,KAAA;CACrB,MAAM,MAAkG,EAAE,SAAS;CACnH,MAAM,YAAY,MAAM,QAAQ,EAAE,UAAU,GACxC,EAAE,UACC,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,CACxE,KAAK,MAAM,EAAE,MAAM,CAAC,GACvB,EAAE;AACN,KAAI,UAAU,SAAS,EAAG,KAAI,YAAY;AAC1C,KAAI,OAAO,EAAE,cAAc,YAAY,OAAO,SAAS,EAAE,UAAU,IAAI,EAAE,YAAY,EACnF,KAAI,YAAY,KAAK,MAAM,EAAE,UAAU;AAEzC,KAAI,EAAE,yBAAyB,KAAM,KAAI,uBAAuB;AAChE,QAAO"}

package/dist/src/gateway/hono/lib/config-payload.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-payload.js","names":["getModelsJsonPath"],"sources":["../../../../../src/gateway/hono/lib/config-payload.ts"],"sourcesContent":["import {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport {\n  buildChannelCatalogForConfig,\n  buildChannelCatalogFromSnapshot,\n  getChannelSetupStatus,\n} from '../../../channels/catalog/channel-catalog-service.js';\nimport { normalizeConfiguredMcpServers } from '../../../config/mcp-config-normalize.js';\nimport type { Config } from '../../../config/schema.js';\nimport {\n  GENERIC_MASKED_SECRET,\n  maskSecretLength,\n} from './mask-secret-length.js';\nimport { maskTunnelSecretForWeb } from '../../../tunnel/env.js';\nimport { resolveShareConfig } from '../../../share/share-config.js';\nimport {\n  resolveGoalsConfigForWeb,\n  resolveSessionConfigForWeb,\n  resolveUpdateConfigForWeb,\n} from '../../../config/web-patch.js';\nimport { CredentialResolver } from '../../../auth/credentials.js';\nimport { loadModelsJson, getModelsJsonPath } from '../../../config/models-json.js';\nimport { getAllProviders, isProviderConfigured } from '../../../providers/index.js';\nimport { getProviderRegistry } from '../../../providers/plugin-registry.js';\nimport type { GatewayService } from '../../service.js';\nimport { safeToolsWebForGet } from '../../config-tools-web.js';\nimport { buildSafeProvidersConfigForWeb } from './safe-providers-config.js';\nimport { maskSttConfigForWeb, maskTtsConfigForWeb } from './safe-voice-config.js';\n\nfunction readModelsJsonProviderApiKey(providerId: string): string | undefined {\n  const { config } = loadModelsJson(getModelsJsonPath());\n  const entry = config.providers?.[providerId];\n  const key = entry?.apiKey;\n  return typeof key === 'string' && key.trim() ? key.trim() : undefined;\n}\n\n/** Length-preserving mask for LLM provider keys in GET `/api/config`. */\nasync function maskLlmProviderApiKeyForWeb(provider: string): Promise<string> {\n  const resolver = new CredentialResolver();\n  const stored = await resolver.revealGatewayStoredApiKey(provider);\n  if (stored) return maskSecretLength(stored);\n\n  const fromModelsJson = readModelsJsonProviderApiKey(provider);\n  if (fromModelsJson) return maskSecretLength(fromModelsJson);\n\n  // Extension plugins manage their own auth; don't show a fake gateway key mask.\n  if (getProviderRegistry().has(provider)) return '';\n\n  if (await isProviderConfigured(provider)) return GENERIC_MASKED_SECRET;\n  return '';\n}\n\n/** MCP block for GET/PATCH `/api/config` (authenticated console editing). */\nexport function buildSafeMcpConfigForWeb(config: Config) {\n  const mcp = config.mcp;\n  if (!mcp) {\n    return { servers: {} as Record<string, Record<string, unknown>> };\n  }\n  return {\n    ...(mcp.sessionIdleTtlMs !== undefined ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {}),\n    servers: normalizeConfiguredMcpServers(mcp.servers),\n  };\n}\n\nfunction maskBrowserCloudConfigForWeb(cloud: unknown): Record<string, unknown> | null {\n  if (!cloud || typeof cloud !== 'object' || Array.isArray(cloud)) {\n    return null;\n  }\n  const raw = cloud as Record<string, unknown>;\n  const safe: Record<string, unknown> = {};\n  if (typeof raw.apiKey === 'string' && raw.apiKey.trim()) {\n    safe.apiKey = maskSecretLength(raw.apiKey);\n  }\n  if (typeof raw.projectId === 'string' && raw.projectId.trim()) {\n    safe.projectId = raw.projectId.trim();\n  }\n  if (typeof raw.region === 'string' && raw.region.trim()) {\n    safe.region = raw.region.trim();\n  }\n  return Object.keys(safe).length > 0 ? safe : null;\n}\n\nexport function buildSafeBrowserConfigForWeb(browser: unknown) {\n  if (!browser || typeof browser !== 'object') {\n    return {\n      enabled: false,\n      headless: false,\n      allowPrivateUrls: false,\n      commandTimeout: null,\n      backend: null,\n      cloudProvider: null,\n      cloud: null,\n      cdpUrl: null,\n      extension: null,\n      cloakbrowser: null,\n      humanize: null,\n      humanPreset: null,\n      dialogPolicy: null,\n      dialogTimeoutSeconds: null,\n    };\n  }\n\n  return {\n    enabled: (browser as Record<string, unknown>).enabled !== false,\n    headless: (browser as Record<string, unknown>).headless === true,\n    allowPrivateUrls: (browser as Record<string, unknown>).allowPrivateUrls === true,\n    commandTimeout:\n      typeof (browser as Record<string, unknown>).commandTimeout === 'number' &&\n      Number.isFinite((browser as Record<string, unknown>).commandTimeout as number)\n        ? Math.floor((browser as Record<string, unknown>).commandTimeout as number)\n        : null,\n    backend:\n      (browser as Record<string, unknown>).backend === 'local' ||\n      (browser as Record<string, unknown>).backend === 'cdp' ||\n      (browser as Record<string, unknown>).backend === 'cloud' ||\n      (browser as Record<string, unknown>).backend === 'extension' ||\n      (browser as Record<string, unknown>).backend === 'cloakbrowser'\n        ? (browser as Record<string, unknown>).backend\n        : null,\n    cloudProvider:\n      (browser as Record<string, unknown>).cloudProvider === 'browserbase' ||\n      (browser as Record<string, unknown>).cloudProvider === 'browser-use'\n        ? (browser as Record<string, unknown>).cloudProvider\n        : null,\n    cloud: maskBrowserCloudConfigForWeb((browser as Record<string, unknown>).cloud),\n    cdpUrl:\n      typeof (browser as Record<string, unknown>).cdpUrl === 'string' &&\n      ((browser as Record<string, unknown>).cdpUrl as string).trim()\n        ? ((browser as Record<string, unknown>).cdpUrl as string).trim()\n        : null,\n    extension:\n      (browser as Record<string, unknown>).extension &&\n      typeof (browser as Record<string, unknown>).extension === 'object' &&\n      !Array.isArray((browser as Record<string, unknown>).extension)\n        ? (browser as Record<string, unknown>).extension\n      : null,\n    cloakbrowser:\n      (browser as Record<string, unknown>).cloakbrowser &&\n      typeof (browser as Record<string, unknown>).cloakbrowser === 'object' &&\n      !Array.isArray((browser as Record<string, unknown>).cloakbrowser)\n        ? (browser as Record<string, unknown>).cloakbrowser\n        : null,\n    humanize:\n      typeof (browser as Record<string, unknown>).humanize === 'boolean'\n        ? (browser as Record<string, unknown>).humanize\n        : null,\n    humanPreset:\n      (browser as Record<string, unknown>).humanPreset === 'default' ||\n      (browser as Record<string, unknown>).humanPreset === 'careful'\n        ? (browser as Record<string, unknown>).humanPreset\n        : null,\n    dialogPolicy:\n      (browser as Record<string, unknown>).dialogPolicy === 'must_respond' ||\n      (browser as Record<string, unknown>).dialogPolicy === 'auto_accept' ||\n      (browser as Record<string, unknown>).dialogPolicy === 'auto_dismiss'\n        ? (browser as Record<string, unknown>).dialogPolicy\n        : null,\n    dialogTimeoutSeconds:\n      typeof (browser as Record<string, unknown>).dialogTimeoutSeconds === 'number' &&\n      Number.isFinite((browser as Record<string, unknown>).dialogTimeoutSeconds as number)\n        ? Math.floor((browser as Record<string, unknown>).dialogTimeoutSeconds as number)\n        : null,\n  };\n}\n\n/** Sanitized config snapshot for GET/PATCH `/api/config` (matches persisted `service.currentConfig`). */\nexport async function buildSafeWebConfigPayload(service: GatewayService, options: { locale?: string } = {}) {\n  const config = service.currentConfig;\n  const extensionLoader =\n    typeof service.getExtensionLoader === 'function' ? service.getExtensionLoader() : undefined;\n  const snapshot = extensionLoader?.getManifestSnapshot();\n  const catalog = snapshot\n    ? buildChannelCatalogFromSnapshot(snapshot, { locale: options.locale })\n    : buildChannelCatalogForConfig(config, { locale: options.locale });\n  const channelsPayload = Object.fromEntries(\n    catalog.entries.map((entry) => {\n      const plugin =\n        typeof service.getChannelRuntimePlugin === 'function'\n          ? service.getChannelRuntimePlugin(entry.id)\n          : undefined;\n      const channelCfgKey = entry.configPath.startsWith('channels.')\n        ? entry.configPath.slice('channels.'.length).split('.')[0] || entry.id\n        : entry.id;\n      const channelCfg = config.channels?.[channelCfgKey] as Record<string, unknown> | undefined;\n      const setupStatus = getChannelSetupStatus(config, entry.id, entry);\n      return [\n        entry.id,\n        {\n          enabled: setupStatus.enabled,\n          configured: setupStatus.ready,\n          setupStatus,\n          config: plugin?.configSurface?.buildConfigSurface(config) ?? channelCfg ?? {},\n          schema: entry.configSchema,\n          uiHints: entry.uiHints,\n        },\n      ];\n    }),\n  );\n  return {\n    agents: {\n      defaultId: resolveDefaultAgentId(config),\n      list: listAgentEntries(config)\n        .filter((e) => e.enabled !== false)\n        .map((e) => ({\n          id: normalizeAgentId(e.id),\n          identity: e.identity,\n          workspace: e.workspace,\n          models: e.models,\n          tools: e.tools,\n          skills: e.skills,\n          workflows: e.workflows,\n          boundaries: e.boundaries,\n        })),\n      capabilityPresets: config.agents?.capabilityPresets ?? {},\n    },\n    channels: channelsPayload,\n    providers: Object.fromEntries(\n      await Promise.all(\n        getAllProviders().map(async (provider) => [\n          provider,\n          await maskLlmProviderApiKeyForWeb(provider),\n        ]),\n      ),\n    ),\n    /** Masked `cfg.providers` for capability keys (image / STT / etc.). */\n    providersConfig: buildSafeProvidersConfigForWeb(config.providers),\n    gateway: {\n      bind: config.gateway?.bind ?? 'loopback',\n      customBindHost: config.gateway?.customBindHost,\n      port: config.gateway?.port,\n      corsOrigins: Array.isArray(config.gateway?.corsOrigins) ? config.gateway.corsOrigins : [],\n      trustedProxies: Array.isArray(config.gateway?.trustedProxies)\n        ? config.gateway.trustedProxies\n        : [],\n      allowRealIpFallback: config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback:\n        config.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n      security: {\n        strict: config.gateway?.security?.strict === true,\n      },\n      auth: {\n        mode: config.gateway?.auth?.mode || 'token',\n        token: config.gateway?.auth?.token ? maskSecretLength(config.gateway.auth.token) : '',\n        password: config.gateway?.auth?.password\n          ? maskSecretLength(config.gateway.auth.password)\n          : '',\n        trustedProxy: config.gateway?.auth?.trustedProxy\n          ? {\n              userHeader: config.gateway.auth.trustedProxy.userHeader,\n              requiredHeaders: config.gateway.auth.trustedProxy.requiredHeaders ?? [],\n              allowUsers: config.gateway.auth.trustedProxy.allowUsers ?? [],\n              allowLoopback: config.gateway.auth.trustedProxy.allowLoopback === true,\n            }\n          : undefined,\n        rateLimit: {\n          enabled: config.gateway?.auth?.rateLimit?.enabled !== false,\n          maxAttempts:\n            typeof config.gateway?.auth?.rateLimit?.maxAttempts === 'number'\n              ? config.gateway.auth.rateLimit.maxAttempts\n              : 5,\n          windowMs:\n            typeof config.gateway?.auth?.rateLimit?.windowMs === 'number'\n              ? config.gateway.auth.rateLimit.windowMs\n              : 900_000,\n          blockDurationMs:\n            typeof config.gateway?.auth?.rateLimit?.blockDurationMs === 'number'\n              ? config.gateway.auth.rateLimit.blockDurationMs\n              : typeof config.gateway?.auth?.rateLimit?.lockoutMs === 'number'\n                ? config.gateway.auth.rateLimit.lockoutMs\n                : 300_000,\n          exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false,\n        },\n      },\n      heartbeat: {\n        enabled: config.gateway?.heartbeat?.enabled,\n        intervalMs: config.gateway?.heartbeat?.intervalMs,\n        includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,\n        target: config.gateway?.heartbeat?.target,\n        targetChatId: config.gateway?.heartbeat?.targetChatId,\n        prompt: config.gateway?.heartbeat?.prompt,\n        ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,\n        isolatedSession: config.gateway?.heartbeat?.isolatedSession,\n        activeHours: config.gateway?.heartbeat?.activeHours,\n      },\n      maxSseConnections:\n        typeof config.gateway?.maxSseConnections === 'number'\n          ? config.gateway.maxSseConnections\n          : 100,\n      channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? 'auto',\n      channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds)\n        ? config.gateway.channelConnectDeferIds\n        : [],\n      channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds)\n        ? config.gateway.channelConnectDeferSkipIds\n        : [],\n      share: resolveShareConfig(config.gateway?.share),\n      publicUrl: config.gateway?.publicUrl ?? null,\n      skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? 'store',\n      skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? 'https://store.xopc.ai',\n    },\n    browser: buildSafeBrowserConfigForWeb(config.browser),\n    goals: resolveGoalsConfigForWeb(config),\n    session: resolveSessionConfigForWeb(config),\n    tui: {\n      defaultAgent: config.tui?.defaultAgent ?? 'coder',\n    },\n    tunnel: {\n      enabled: config.tunnel?.enabled === true,\n      autoStart: config.tunnel?.autoStart === true,\n      brokerUrl: config.tunnel?.brokerUrl ?? 'https://frp.xopc.ai/api',\n      registrationSecret: config.tunnel?.registrationSecret\n        ? maskTunnelSecretForWeb(config.tunnel.registrationSecret)\n        : '',\n      consent: config.tunnel?.consent\n        ? {\n            version: config.tunnel.consent.version,\n            acceptedAt: config.tunnel.consent.acceptedAt,\n          }\n        : undefined,\n      transport: { tls: 'broker_terminated' as const },\n    },\n    update: {\n      ...resolveUpdateConfigForWeb(config),\n    },\n    stt: maskSttConfigForWeb(config.tools?.media?.audio),\n    tts: maskTtsConfigForWeb(config.messages?.tts),\n    voice: config.voice,\n    tools: safeToolsWebForGet(config),\n    bindings: Array.isArray(config.bindings) ? config.bindings : [],\n    mcp: buildSafeMcpConfigForWeb(config),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;kBAIuC;8BAKuB;kBAcI;kBACiB;gBACC;sBACR;AAM5E,SAAS,6BAA6B,YAAwC;CAC5E,MAAM,EAAE,WAAW,eAAeA,uBAAmB,CAAC;CAEtD,MAAM,OADQ,OAAO,YAAY,cACd;AACnB,QAAO,OAAO,QAAQ,YAAY,IAAI,MAAM,GAAG,IAAI,MAAM,GAAG,KAAA;;;AAI9D,eAAe,4BAA4B,UAAmC;CAE5E,MAAM,SAAS,MAAM,IADA,oBACQ,CAAC,0BAA0B,SAAS;AACjE,KAAI,OAAQ,QAAO,iBAAiB,OAAO;CAE3C,MAAM,iBAAiB,6BAA6B,SAAS;AAC7D,KAAI,eAAgB,QAAO,iBAAiB,eAAe;AAG3D,KAAI,qBAAqB,CAAC,IAAI,SAAS,CAAE,QAAO;AAEhD,KAAI,MAAM,qBAAqB,SAAS,CAAE,QAAO;AACjD,QAAO;;;AAIT,SAAgB,yBAAyB,QAAgB;CACvD,MAAM,MAAM,OAAO;AACnB,KAAI,CAAC,IACH,QAAO,EAAE,SAAS,EAAE,EAA6C;AAEnE,QAAO;EACL,GAAI,IAAI,qBAAqB,KAAA,IAAY,EAAE,kBAAkB,IAAI,kBAAkB,GAAG,EAAE;EACxF,SAAS,8BAA8B,IAAI,QAAQ;EACpD;;AAGH,SAAS,6BAA6B,OAAgD;AACpF,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;CAET,MAAM,MAAM;CACZ,MAAM,OAAgC,EAAE;AACxC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,iBAAiB,IAAI,OAAO;AAE5C,KAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,MAAM,CAC3D,MAAK,YAAY,IAAI,UAAU,MAAM;AAEvC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,IAAI,OAAO,MAAM;AAEjC,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;;AAG/C,SAAgB,6BAA6B,SAAkB;AAC7D,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO;EACL,SAAS;EACT,UAAU;EACV,kBAAkB;EAClB,gBAAgB;EAChB,SAAS;EACT,eAAe;EACf,OAAO;EACP,QAAQ;EACR,WAAW;EACX,cAAc;EACd,UAAU;EACV,aAAa;EACb,cAAc;EACd,sBAAsB;EACvB;AAGH,QAAO;EACL,SAAU,QAAoC,YAAY;EAC1D,UAAW,QAAoC,aAAa;EAC5D,kBAAmB,QAAoC,qBAAqB;EAC5E,gBACE,OAAQ,QAAoC,mBAAmB,YAC/D,OAAO,SAAU,QAAoC,eAAyB,GAC1E,KAAK,MAAO,QAAoC,eAAyB,GACzE;EACN,SACG,QAAoC,YAAY,WAChD,QAAoC,YAAY,SAChD,QAAoC,YAAY,WAChD,QAAoC,YAAY,eAChD,QAAoC,YAAY,iBAC5C,QAAoC,UACrC;EACN,eACG,QAAoC,kBAAkB,iBACtD,QAAoC,kBAAkB,gBAClD,QAAoC,gBACrC;EACN,OAAO,6BAA8B,QAAoC,MAAM;EAC/E,QACE,OAAQ,QAAoC,WAAW,YACrD,QAAoC,OAAkB,MAAM,GACxD,QAAoC,OAAkB,MAAM,GAC9D;EACN,WACG,QAAoC,aACrC,OAAQ,QAAoC,cAAc,YAC1D,CAAC,MAAM,QAAS,QAAoC,UAAU,GACzD,QAAoC,YACvC;EACJ,cACG,QAAoC,gBACrC,OAAQ,QAAoC,iBAAiB,YAC7D,CAAC,MAAM,QAAS,QAAoC,aAAa,GAC5D,QAAoC,eACrC;EACN,UACE,OAAQ,QAAoC,aAAa,YACpD,QAAoC,WACrC;EACN,aACG,QAAoC,gBAAgB,aACpD,QAAoC,gBAAgB,YAChD,QAAoC,cACrC;EACN,cACG,QAAoC,iBAAiB,kBACrD,QAAoC,iBAAiB,iBACrD,QAAoC,iBAAiB,iBACjD,QAAoC,eACrC;EACN,sBACE,OAAQ,QAAoC,yBAAyB,YACrE,OAAO,SAAU,QAAoC,qBAA+B,GAChF,KAAK,MAAO,QAAoC,qBAA+B,GAC/E;EACP;;;AAIH,eAAsB,0BAA0B,SAAyB,UAA+B,EAAE,EAAE;CAC1G,MAAM,SAAS,QAAQ;CAGvB,MAAM,YADJ,OAAO,QAAQ,uBAAuB,aAAa,QAAQ,oBAAoB,GAAG,KAAA,IAClD,qBAAqB;CACvD,MAAM,UAAU,WACZ,gCAAgC,UAAU,EAAE,QAAQ,QAAQ,QAAQ,CAAC,GACrE,6BAA6B,QAAQ,EAAE,QAAQ,QAAQ,QAAQ,CAAC;CACpE,MAAM,kBAAkB,OAAO,YAC7B,QAAQ,QAAQ,KAAK,UAAU;EAC7B,MAAM,SACJ,OAAO,QAAQ,4BAA4B,aACvC,QAAQ,wBAAwB,MAAM,GAAG,GACzC,KAAA;EACN,MAAM,gBAAgB,MAAM,WAAW,WAAW,YAAY,GAC1D,MAAM,WAAW,MAAM,EAAmB,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,KAClE,MAAM;EACV,MAAM,aAAa,OAAO,WAAW;EACrC,MAAM,cAAc,sBAAsB,QAAQ,MAAM,IAAI,MAAM;AAClE,SAAO,CACL,MAAM,IACN;GACE,SAAS,YAAY;GACrB,YAAY,YAAY;GACxB;GACA,QAAQ,QAAQ,eAAe,mBAAmB,OAAO,IAAI,cAAc,EAAE;GAC7E,QAAQ,MAAM;GACd,SAAS,MAAM;GAChB,CACF;GACD,CACH;AACD,QAAO;EACL,QAAQ;GACN,WAAW,sBAAsB,OAAO;GACxC,MAAM,iBAAiB,OAAO,CAC3B,QAAQ,MAAM,EAAE,YAAY,MAAM,CAClC,KAAK,OAAO;IACX,IAAI,iBAAiB,EAAE,GAAG;IAC1B,UAAU,EAAE;IACZ,WAAW,EAAE;IACb,QAAQ,EAAE;IACV,OAAO,EAAE;IACT,QAAQ,EAAE;IACV,WAAW,EAAE;IACb,YAAY,EAAE;IACf,EAAE;GACL,mBAAmB,OAAO,QAAQ,qBAAqB,EAAE;GAC1D;EACD,UAAU;EACV,WAAW,OAAO,YAChB,MAAM,QAAQ,IACZ,iBAAiB,CAAC,IAAI,OAAO,aAAa,CACxC,UACA,MAAM,4BAA4B,SAAS,CAC5C,CAAC,CACH,CACF;;EAED,iBAAiB,+BAA+B,OAAO,UAAU;EACjE,SAAS;GACP,MAAM,OAAO,SAAS,QAAQ;GAC9B,gBAAgB,OAAO,SAAS;GAChC,MAAM,OAAO,SAAS;GACtB,aAAa,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,OAAO,QAAQ,cAAc,EAAE;GACzF,gBAAgB,MAAM,QAAQ,OAAO,SAAS,eAAe,GACzD,OAAO,QAAQ,iBACf,EAAE;GACN,qBAAqB,OAAO,SAAS,wBAAwB;GAC7D,0CACE,OAAO,SAAS,6CAA6C;GAC/D,UAAU,EACR,QAAQ,OAAO,SAAS,UAAU,WAAW,MAC9C;GACD,MAAM;IACJ,MAAM,OAAO,SAAS,MAAM,QAAQ;IACpC,OAAO,OAAO,SAAS,MAAM,QAAQ,iBAAiB,OAAO,QAAQ,KAAK,MAAM,GAAG;IACnF,UAAU,OAAO,SAAS,MAAM,WAC5B,iBAAiB,OAAO,QAAQ,KAAK,SAAS,GAC9C;IACJ,cAAc,OAAO,SAAS,MAAM,eAChC;KACE,YAAY,OAAO,QAAQ,KAAK,aAAa;KAC7C,iBAAiB,OAAO,QAAQ,KAAK,aAAa,mBAAmB,EAAE;KACvE,YAAY,OAAO,QAAQ,KAAK,aAAa,cAAc,EAAE;KAC7D,eAAe,OAAO,QAAQ,KAAK,aAAa,kBAAkB;KACnE,GACD,KAAA;IACJ,WAAW;KACT,SAAS,OAAO,SAAS,MAAM,WAAW,YAAY;KACtD,aACE,OAAO,OAAO,SAAS,MAAM,WAAW,gBAAgB,WACpD,OAAO,QAAQ,KAAK,UAAU,cAC9B;KACN,UACE,OAAO,OAAO,SAAS,MAAM,WAAW,aAAa,WACjD,OAAO,QAAQ,KAAK,UAAU,WAC9B;KACN,iBACE,OAAO,OAAO,SAAS,MAAM,WAAW,oBAAoB,WACxD,OAAO,QAAQ,KAAK,UAAU,kBAC9B,OAAO,OAAO,SAAS,MAAM,WAAW,cAAc,WACpD,OAAO,QAAQ,KAAK,UAAU,YAC9B;KACR,gBAAgB,OAAO,SAAS,MAAM,WAAW,mBAAmB;KACrE;IACF;GACD,WAAW;IACT,SAAS,OAAO,SAAS,WAAW;IACpC,YAAY,OAAO,SAAS,WAAW;IACvC,4BAA4B,OAAO,SAAS,WAAW,+BAA+B;IACtF,QAAQ,OAAO,SAAS,WAAW;IACnC,cAAc,OAAO,SAAS,WAAW;IACzC,QAAQ,OAAO,SAAS,WAAW;IACnC,aAAa,OAAO,SAAS,WAAW;IACxC,iBAAiB,OAAO,SAAS,WAAW;IAC5C,aAAa,OAAO,SAAS,WAAW;IACzC;GACD,mBACE,OAAO,OAAO,SAAS,sBAAsB,WACzC,OAAO,QAAQ,oBACf;GACN,yBAAyB,OAAO,SAAS,2BAA2B;GACpE,wBAAwB,MAAM,QAAQ,OAAO,SAAS,uBAAuB,GACzE,OAAO,QAAQ,yBACf,EAAE;GACN,4BAA4B,MAAM,QAAQ,OAAO,SAAS,2BAA2B,GACjF,OAAO,QAAQ,6BACf,EAAE;GACN,OAAO,mBAAmB,OAAO,SAAS,MAAM;GAChD,WAAW,OAAO,SAAS,aAAa;GACxC,2BAA2B,OAAO,SAAS,6BAA6B;GACxE,oBAAoB,OAAO,SAAS,sBAAsB;GAC3D;EACD,SAAS,6BAA6B,OAAO,QAAQ;EACrD,OAAO,yBAAyB,OAAO;EACvC,SAAS,2BAA2B,OAAO;EAC3C,KAAK,EACH,cAAc,OAAO,KAAK,gBAAgB,SAC3C;EACD,QAAQ;GACN,SAAS,OAAO,QAAQ,YAAY;GACpC,WAAW,OAAO,QAAQ,cAAc;GACxC,WAAW,OAAO,QAAQ,aAAa;GACvC,oBAAoB,OAAO,QAAQ,qBAC/B,uBAAuB,OAAO,OAAO,mBAAmB,GACxD;GACJ,SAAS,OAAO,QAAQ,UACpB;IACE,SAAS,OAAO,OAAO,QAAQ;IAC/B,YAAY,OAAO,OAAO,QAAQ;IACnC,GACD,KAAA;GACJ,WAAW,EAAE,KAAK,qBAA8B;GACjD;EACD,QAAQ,EACN,GAAG,0BAA0B,OAAO,EACrC;EACD,KAAK,oBAAoB,OAAO,OAAO,OAAO,MAAM;EACpD,KAAK,oBAAoB,OAAO,UAAU,IAAI;EAC9C,OAAO,OAAO;EACd,OAAO,mBAAmB,OAAO;EACjC,UAAU,MAAM,QAAQ,OAAO,SAAS,GAAG,OAAO,WAAW,EAAE;EAC/D,KAAK,yBAAyB,OAAO;EACtC"}

package/dist/src/gateway/hono/lib/extension-assets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"extension-assets.js","names":[],"sources":["../../../../../src/gateway/hono/lib/extension-assets.ts"],"sourcesContent":["export function extensionAssetMimeType(filePath: string): string {\n  const ext = filePath.split('.').pop()?.toLowerCase();\n  const mimeTypes: Record<string, string> = {\n    html: 'text/html; charset=utf-8',\n    js: 'application/javascript; charset=utf-8',\n    mjs: 'application/javascript; charset=utf-8',\n    css: 'text/css; charset=utf-8',\n    json: 'application/json; charset=utf-8',\n    svg: 'image/svg+xml',\n    png: 'image/png',\n    jpg: 'image/jpeg',\n    jpeg: 'image/jpeg',\n    gif: 'image/gif',\n    webp: 'image/webp',\n    ico: 'image/x-icon',\n    woff: 'font/woff',\n    woff2: 'font/woff2',\n    ttf: 'font/ttf',\n    txt: 'text/plain; charset=utf-8',\n    map: 'application/json; charset=utf-8',\n  };\n  return mimeTypes[ext ?? ''] ?? 'application/octet-stream';\n}\n"],"mappings":";AAAA,SAAgB,uBAAuB,UAA0B;AAqB/D,QAAO;EAlBL,MAAM;EACN,IAAI;EACJ,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,MAAM;EACN,KAAK;EACL,MAAM;EACN,OAAO;EACP,KAAK;EACL,KAAK;EACL,KAAK;EAES,CApBJ,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAoB5B,OAAO"}

package/dist/src/gateway/hono/lib/extension-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"extension-store.js","names":[],"sources":["../../../../../src/gateway/hono/lib/extension-store.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\nimport { writeTextAtomic } from '../../../infra/write-file-atomic.js';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\n/** Extension UI: write-through JSON KV per namespace under ~/.xopc/extensions/{namespace}/storage.json */\nconst extensionStoreCache = new Map<string, Record<string, unknown>>();\n\nfunction getExtensionStorePath(namespace: string): string {\n  const safeNamespace = namespace.replace(/[^a-zA-Z0-9_-]/g, '_');\n  return join(homedir(), '.xopc', 'extensions', safeNamespace, 'storage.json');\n}\n\nexport async function loadExtensionStore(namespace: string): Promise<Record<string, unknown>> {\n  const cached = extensionStoreCache.get(namespace);\n  if (cached) return cached;\n\n  const filePath = getExtensionStorePath(namespace);\n  try {\n    const raw = await readFile(filePath, 'utf-8');\n    const data = JSON.parse(raw) as Record<string, unknown>;\n    extensionStoreCache.set(namespace, data);\n    return data;\n  } catch {\n    const empty: Record<string, unknown> = {};\n    extensionStoreCache.set(namespace, empty);\n    return empty;\n  }\n}\n\nexport async function saveExtensionStore(namespace: string, data: Record<string, unknown>): Promise<void> {\n  const filePath = getExtensionStorePath(namespace);\n  await writeTextAtomic(filePath, JSON.stringify(data, null, 2));\n  extensionStoreCache.set(namespace, data);\n}\n"],"mappings":";;;;;wBACsE;;AAKtE,MAAM,sCAAsB,IAAI,KAAsC;AAEtE,SAAS,sBAAsB,WAA2B;CACxD,MAAM,gBAAgB,UAAU,QAAQ,mBAAmB,IAAI;AAC/D,QAAO,KAAK,SAAS,EAAE,SAAS,cAAc,eAAe,eAAe;;AAG9E,eAAsB,mBAAmB,WAAqD;CAC5F,MAAM,SAAS,oBAAoB,IAAI,UAAU;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,WAAW,sBAAsB,UAAU;AACjD,KAAI;EACF,MAAM,MAAM,MAAM,SAAS,UAAU,QAAQ;EAC7C,MAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,sBAAoB,IAAI,WAAW,KAAK;AACxC,SAAO;SACD;EACN,MAAM,QAAiC,EAAE;AACzC,sBAAoB,IAAI,WAAW,MAAM;AACzC,SAAO;;;AAIX,eAAsB,mBAAmB,WAAmB,MAA8C;AAExG,OAAM,gBADW,sBAAsB,UACT,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC9D,qBAAoB,IAAI,WAAW,KAAK"}

package/dist/src/gateway/hono/lib/mask-secret-length.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mask-secret-length.js","names":[],"sources":["../../../../../src/gateway/hono/lib/mask-secret-length.ts"],"sourcesContent":["/** Fallback mask when the real secret length is unknown (e.g. env-sourced keys). */\nexport const GENERIC_MASKED_SECRET = '••••••••••••';\n\n/** Length-preserving mask for secrets returned to the web console. */\nexport function maskSecretLength(secret: string): string {\n  const trimmed = secret.trim();\n  return trimmed ? '•'.repeat(trimmed.length) : '';\n}\n\n/** True when a PATCH body carries a masked sentinel instead of a new secret. */\nexport function isMaskedSecretPatchValue(value: string): boolean {\n  return value === '***' || value === GENERIC_MASKED_SECRET || /^•+$/.test(value);\n}\n"],"mappings":";;AACA,MAAa,wBAAwB;;AAGrC,SAAgB,iBAAiB,QAAwB;CACvD,MAAM,UAAU,OAAO,MAAM;AAC7B,QAAO,UAAU,IAAI,OAAO,QAAQ,OAAO,GAAG;;;AAIhD,SAAgB,yBAAyB,OAAwB;AAC/D,QAAO,UAAU,SAAS,UAAA,kBAAmC,OAAO,KAAK,MAAM"}

package/dist/src/gateway/hono/lib/route-logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route-logger.js","names":[],"sources":["../../../../../src/gateway/hono/lib/route-logger.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport { createLogger, type ContextualLogger } from '../../../utils/logger.js';\n\n/** Stable gateway route logger prefix: `Gateway:<Name>`. */\nexport function createGatewayRouteLogger(name: string): ContextualLogger {\n  return createLogger(`Gateway:${name}`);\n}\n\nexport function logRouteError(\n  log: ContextualLogger,\n  c: Context,\n  err: unknown,\n  phase: string,\n  extra?: Record<string, unknown>,\n): void {\n  const em = err instanceof Error ? err.message : String(err);\n  log.error(\n    {\n      err,\n      errorMessage: em,\n      phase,\n      method: c.req.method,\n      path: c.req.path,\n      ...extra,\n    },\n    `Route error ${c.req.method} ${c.req.path}: ${em}`,\n  );\n}\n\nexport function logRouteWarn(\n  log: ContextualLogger,\n  c: Context,\n  message: string,\n  phase: string,\n  extra?: Record<string, unknown>,\n): void {\n  log.warn(\n    {\n      phase,\n      method: c.req.method,\n      path: c.req.path,\n      ...extra,\n    },\n    message,\n  );\n}\n"],"mappings":";;;aAE+E;;AAG/E,SAAgB,yBAAyB,MAAgC;AACvE,QAAO,aAAa,WAAW,OAAO;;AAGxC,SAAgB,cACd,KACA,GACA,KACA,OACA,OACM;CACN,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,KAAI,MACF;EACE;EACA,cAAc;EACd;EACA,QAAQ,EAAE,IAAI;EACd,MAAM,EAAE,IAAI;EACZ,GAAG;EACJ,EACD,eAAe,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,KAC/C;;AAGH,SAAgB,aACd,KACA,GACA,SACA,OACA,OACM;AACN,KAAI,KACF;EACE;EACA,QAAQ,EAAE,IAAI;EACd,MAAM,EAAE,IAAI;EACZ,GAAG;EACJ,EACD,QACD"}

package/dist/src/gateway/hono/lib/safe-providers-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"safe-providers-config.js","names":[],"sources":["../../../../../src/gateway/hono/lib/safe-providers-config.ts"],"sourcesContent":["import type { Config } from '../../../config/schema.js';\nimport { maskSecretLength } from './mask-secret-length.js';\n\n/**\n * Per-vendor slice of {@link Config.providers} safe for GET `/api/config`.\n * Secrets are never sent verbatim; `apiKey` is length-preserving bullets when set, else empty.\n */\nexport type SafeProviderAuthEntry = {\n  apiKey: string;\n  region?: string;\n  baseUrl?: string;\n  imageBaseUrl?: string;\n};\n\n/**\n * Build a redacted `providersConfig` map for the gateway console (image / audio / video keys).\n */\nexport function buildSafeProvidersConfigForWeb(\n  providers: Config['providers'] | undefined,\n): Record<string, SafeProviderAuthEntry> {\n  if (!providers || typeof providers !== 'object') return {};\n  const out: Record<string, SafeProviderAuthEntry> = {};\n  for (const [id, raw] of Object.entries(providers)) {\n    if (!id) continue;\n    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue;\n    const o = raw as Record<string, unknown>;\n    const apiKey =\n      typeof o.apiKey === 'string' && o.apiKey.trim() ? maskSecretLength(o.apiKey) : '';\n    const entry: SafeProviderAuthEntry = { apiKey };\n    if (typeof o.region === 'string' && o.region.trim()) {\n      entry.region = o.region.trim();\n    }\n    if (typeof o.baseUrl === 'string' && o.baseUrl.trim()) {\n      entry.baseUrl = o.baseUrl.trim();\n    }\n    if (typeof o.imageBaseUrl === 'string' && o.imageBaseUrl.trim()) {\n      entry.imageBaseUrl = o.imageBaseUrl.trim();\n    }\n    out[id] = entry;\n  }\n  return out;\n}\n"],"mappings":";;;;;AAiBA,SAAgB,+BACd,WACuC;AACvC,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO,EAAE;CAC1D,MAAM,MAA6C,EAAE;AACrD,MAAK,MAAM,CAAC,IAAI,QAAQ,OAAO,QAAQ,UAAU,EAAE;AACjD,MAAI,CAAC,GAAI;AACT,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE;EAC3D,MAAM,IAAI;EAGV,MAAM,QAA+B,EAAE,QADrC,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,MAAM,GAAG,iBAAiB,EAAE,OAAO,GAAG,IAClC;AAC/C,MAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,MAAM,CACjD,OAAM,SAAS,EAAE,OAAO,MAAM;AAEhC,MAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,MAAM,CACnD,OAAM,UAAU,EAAE,QAAQ,MAAM;AAElC,MAAI,OAAO,EAAE,iBAAiB,YAAY,EAAE,aAAa,MAAM,CAC7D,OAAM,eAAe,EAAE,aAAa,MAAM;AAE5C,MAAI,MAAM;;AAEZ,QAAO"}

package/dist/src/gateway/hono/lib/safe-voice-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"safe-voice-config.js","names":[],"sources":["../../../../../src/gateway/hono/lib/safe-voice-config.ts"],"sourcesContent":["import { isMaskedApiKey } from '../../config-tools-web.js';\nimport { maskSecretLength } from './mask-secret-length.js';\n\nfunction maskProviderSlice(slice: Record<string, unknown>): Record<string, unknown> {\n  const next = { ...slice };\n  if (typeof next.apiKey === 'string' && next.apiKey.trim()) {\n    next.apiKey = maskSecretLength(next.apiKey);\n  }\n  return next;\n}\n\nfunction mergeApiKeyField(incoming: unknown, previous: unknown): unknown {\n  if (typeof incoming !== 'string') return previous;\n  if (isMaskedApiKey(incoming) && typeof previous === 'string' && previous.trim()) {\n    return previous;\n  }\n  return incoming;\n}\n\nfunction mergeProviderSlice(\n  incoming: Record<string, unknown>,\n  previous: Record<string, unknown>,\n): Record<string, unknown> {\n  const next = { ...previous, ...incoming };\n  if ('apiKey' in incoming) {\n    next.apiKey = mergeApiKeyField(incoming.apiKey, previous.apiKey);\n  }\n  return next;\n}\n\nfunction maskProviderMap(providers: Record<string, unknown>): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [id, value] of Object.entries(providers)) {\n    out[id] =\n      value && typeof value === 'object' && !Array.isArray(value)\n        ? maskProviderSlice(value as Record<string, unknown>)\n        : value;\n  }\n  return out;\n}\n\nfunction mergeProviderMap(\n  incoming: Record<string, unknown>,\n  previous: Record<string, unknown>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = { ...previous };\n  for (const [id, value] of Object.entries(incoming)) {\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      out[id] = mergeProviderSlice(value as Record<string, unknown>, (out[id] ?? {}) as Record<string, unknown>);\n    } else {\n      out[id] = value;\n    }\n  }\n  return out;\n}\n\nfunction maskVoiceConfigForWeb(cfg: unknown): unknown {\n  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) return cfg;\n  const raw = { ...(cfg as Record<string, unknown>) };\n  if (raw.providers && typeof raw.providers === 'object' && !Array.isArray(raw.providers)) {\n    raw.providers = maskProviderMap(raw.providers as Record<string, unknown>);\n  }\n  return raw;\n}\n\n/** Mask STT api keys for GET `/api/config`. */\nexport function maskSttConfigForWeb(stt: unknown): unknown {\n  return maskVoiceConfigForWeb(stt);\n}\n\n/** Mask TTS api keys for GET `/api/config`. */\nexport function maskTtsConfigForWeb(tts: unknown): unknown {\n  return maskVoiceConfigForWeb(tts);\n}\n\nfunction mergeVoiceConfigPatch(previous: unknown, incoming: unknown): unknown {\n  if (!incoming || typeof incoming !== 'object' || Array.isArray(incoming)) return previous ?? incoming;\n  const prev = previous && typeof previous === 'object' && !Array.isArray(previous)\n    ? (previous as Record<string, unknown>)\n    : {};\n  const patch = incoming as Record<string, unknown>;\n  const next: Record<string, unknown> = { ...prev, ...patch };\n  if (patch.providers && typeof patch.providers === 'object' && !Array.isArray(patch.providers)) {\n    next.providers = mergeProviderMap(\n      patch.providers as Record<string, unknown>,\n      (prev.providers ?? {}) as Record<string, unknown>,\n    );\n  }\n  return next;\n}\n\n/** Merge incoming STT patch, preserving api keys when the UI sends masked sentinels. */\nexport function mergeSttConfigPatch(previous: unknown, incoming: unknown): unknown {\n  return mergeVoiceConfigPatch(previous, incoming);\n}\n\n/** Merge incoming TTS patch, preserving api keys when the UI sends masked sentinels. */\nexport function mergeTtsConfigPatch(previous: unknown, incoming: unknown): unknown {\n  return mergeVoiceConfigPatch(previous, incoming);\n}\n"],"mappings":";;;AAGA,SAAS,kBAAkB,OAAyD;CAClF,MAAM,OAAO,EAAE,GAAG,OAAO;AACzB,KAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,MAAM,CACvD,MAAK,SAAS,iBAAiB,KAAK,OAAO;AAE7C,QAAO;;AAGT,SAAS,iBAAiB,UAAmB,UAA4B;AACvE,KAAI,OAAO,aAAa,SAAU,QAAO;AACzC,KAAI,eAAe,SAAS,IAAI,OAAO,aAAa,YAAY,SAAS,MAAM,CAC7E,QAAO;AAET,QAAO;;AAGT,SAAS,mBACP,UACA,UACyB;CACzB,MAAM,OAAO;EAAE,GAAG;EAAU,GAAG;EAAU;AACzC,KAAI,YAAY,SACd,MAAK,SAAS,iBAAiB,SAAS,QAAQ,SAAS,OAAO;AAElE,QAAO;;AAGT,SAAS,gBAAgB,WAA6D;CACpF,MAAM,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,IAAI,UAAU,OAAO,QAAQ,UAAU,CACjD,KAAI,MACF,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,GACvD,kBAAkB,MAAiC,GACnD;AAER,QAAO;;AAGT,SAAS,iBACP,UACA,UACyB;CACzB,MAAM,MAA+B,EAAE,GAAG,UAAU;AACpD,MAAK,MAAM,CAAC,IAAI,UAAU,OAAO,QAAQ,SAAS,CAChD,KAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,CAC7D,KAAI,MAAM,mBAAmB,OAAmC,IAAI,OAAO,EAAE,CAA6B;KAE1G,KAAI,MAAM;AAGd,QAAO;;AAGT,SAAS,sBAAsB,KAAuB;AACpD,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO;CAClE,MAAM,MAAM,EAAE,GAAI,KAAiC;AACnD,KAAI,IAAI,aAAa,OAAO,IAAI,cAAc,YAAY,CAAC,MAAM,QAAQ,IAAI,UAAU,CACrF,KAAI,YAAY,gBAAgB,IAAI,UAAqC;AAE3E,QAAO;;;AAIT,SAAgB,oBAAoB,KAAuB;AACzD,QAAO,sBAAsB,IAAI;;;AAInC,SAAgB,oBAAoB,KAAuB;AACzD,QAAO,sBAAsB,IAAI;;AAGnC,SAAS,sBAAsB,UAAmB,UAA4B;AAC5E,KAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CAAE,QAAO,YAAY;CAC7F,MAAM,OAAO,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,SAAS,GAC5E,WACD,EAAE;CACN,MAAM,QAAQ;CACd,MAAM,OAAgC;EAAE,GAAG;EAAM,GAAG;EAAO;AAC3D,KAAI,MAAM,aAAa,OAAO,MAAM,cAAc,YAAY,CAAC,MAAM,QAAQ,MAAM,UAAU,CAC3F,MAAK,YAAY,iBACf,MAAM,WACL,KAAK,aAAa,EAAE,CACtB;AAEH,QAAO;;;AAIT,SAAgB,oBAAoB,UAAmB,UAA4B;AACjF,QAAO,sBAAsB,UAAU,SAAS;;;AAIlD,SAAgB,oBAAoB,UAAmB,UAA4B;AACjF,QAAO,sBAAsB,UAAU,SAAS"}

package/dist/src/gateway/hono/lib/startup-unavailable.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-unavailable.js","names":[],"sources":["../../../../../src/gateway/hono/lib/startup-unavailable.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  buildStartupUnavailablePayload,\n  type StartupUnavailableGatewayMethod,\n} from '../../startup-readiness.js';\n\nexport function respondStartupUnavailable(\n  c: Context,\n  method: StartupUnavailableGatewayMethod,\n  retryAfterMs = 500,\n): Response {\n  const payload = buildStartupUnavailablePayload({ method, retryAfterMs });\n  const retrySeconds = Math.max(1, Math.ceil(payload.retryAfterMs / 1000));\n  return c.json(payload, 503, {\n    'Retry-After': String(retrySeconds),\n  });\n}\n"],"mappings":";;AAOA,SAAgB,0BACd,GACA,QACA,eAAe,KACL;CACV,MAAM,UAAU,+BAA+B;EAAE;EAAQ;EAAc,CAAC;CACxE,MAAM,eAAe,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAe,IAAK,CAAC;AACxE,QAAO,EAAE,KAAK,SAAS,KAAK,EAC1B,eAAe,OAAO,aAAa,EACpC,CAAC"}

package/dist/src/gateway/hono/lib/static-ui.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"static-ui.js","names":[],"sources":["../../../../../src/gateway/hono/lib/static-ui.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { readFileSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = dirname(__filename);\n\n/**\n * Web UI build output: `pnpm run build:web` → `dist/gateway/static/root` (see web/vite.config.ts).\n * This module compiles under `dist/src/gateway/hono/lib/`; resolve static root relative to this file.\n */\nfunction resolveUiStaticRoot(): string {\n  const env = process.env['XOPC_UI_STATIC_ROOT']?.trim();\n  if (env) return resolve(env);\n\n  const here = __dirname;\n  const normalized = here.replace(/\\\\/g, '/');\n  if (normalized.includes('/dist/src/gateway/')) {\n    const fromLib = /\\/hono\\/lib(?:\\/|$)/.test(normalized);\n    return resolve(here, fromLib ? '../../../../gateway/static/root' : '../../../gateway/static/root');\n  }\n  if (normalized.includes('/out/server')) {\n    return resolve(here, '../../dist/gateway/static/root');\n  }\n  const fromLib = /\\/gateway\\/hono\\/lib(?:\\/|$)/.test(normalized);\n  return resolve(here, fromLib ? '../../../../dist/gateway/static/root' : '../../../dist/gateway/static/root');\n}\n\nconst UI_STATIC_ROOT = resolveUiStaticRoot();\n\nconst MIME_TYPES: Record<string, string> = {\n  js: 'application/javascript',\n  css: 'text/css',\n  json: 'application/json',\n  html: 'text/html',\n  svg: 'image/svg+xml',\n  png: 'image/png',\n  jpg: 'image/jpeg',\n  jpeg: 'image/jpeg',\n  webp: 'image/webp',\n  ico: 'image/x-icon',\n  woff: 'font/woff',\n  woff2: 'font/woff2',\n  txt: 'text/plain; charset=utf-8',\n};\n\ntype CachedStaticFile = {\n  content: Buffer;\n  contentType: string;\n  etag: string;\n  cacheControl: string;\n};\n\nconst fileCache = new Map<string, CachedStaticFile>();\n\nexport type StaticUiCacheStats = {\n  hits: number;\n  misses: number;\n  entries: number;\n  notModified: number;\n};\n\nconst stats: StaticUiCacheStats = {\n  hits: 0,\n  misses: 0,\n  entries: 0,\n  notModified: 0,\n};\n\nfunction computeEtag(content: Buffer): string {\n  return `\"${createHash('sha256').update(content).digest('hex').slice(0, 16)}\"`;\n}\n\nfunction resolveCacheControl(relativePath: string): string {\n  if (relativePath === 'index.html') {\n    return 'no-cache';\n  }\n  if (relativePath.startsWith('assets/')) {\n    return 'public, max-age=31536000, immutable';\n  }\n  return 'public, max-age=3600';\n}\n\nfunction resolveContentType(relativePath: string): string {\n  const ext = relativePath.split('.').pop()?.toLowerCase() || '';\n  return MIME_TYPES[ext] || 'application/octet-stream';\n}\n\nfunction loadIntoCache(relativePath: string): CachedStaticFile | null {\n  const filePath = resolve(UI_STATIC_ROOT, relativePath);\n  try {\n    const content = readFileSync(filePath);\n    const cached: CachedStaticFile = {\n      content,\n      contentType: resolveContentType(relativePath),\n      etag: computeEtag(content),\n      cacheControl: resolveCacheControl(relativePath),\n    };\n    fileCache.set(relativePath, cached);\n    stats.entries = fileCache.size;\n    stats.misses += 1;\n    return cached;\n  } catch {\n    return null;\n  }\n}\n\nfunction getCachedFile(relativePath: string): CachedStaticFile | null {\n  const cached = fileCache.get(relativePath);\n  if (cached) {\n    stats.hits += 1;\n    return cached;\n  }\n  return loadIntoCache(relativePath);\n}\n\nexport function getStaticUiCacheStats(): StaticUiCacheStats {\n  return { ...stats };\n}\n\nexport function clearStaticUiCacheForTests(): void {\n  fileCache.clear();\n  stats.hits = 0;\n  stats.misses = 0;\n  stats.entries = 0;\n  stats.notModified = 0;\n}\n\nexport function resolveStaticUiRootForTests(): string {\n  return UI_STATIC_ROOT;\n}\n\nconst DEFAULT_PREWARM_PATHS = [\n  'index.html',\n  'favicon.ico',\n  'logo.svg',\n  'logo-dark.svg',\n] as const;\n\n/** Warm commonly requested UI files into memory at gateway startup. */\nexport function prewarmStaticUiCache(\n  relativePaths: readonly string[] = DEFAULT_PREWARM_PATHS,\n): { loaded: number; missing: number } {\n  let loaded = 0;\n  let missing = 0;\n  for (const relativePath of relativePaths) {\n    if (getCachedFile(relativePath)) {\n      loaded += 1;\n    } else {\n      missing += 1;\n    }\n  }\n  return { loaded, missing };\n}\n\nfunction buildStaticResponse(\n  cached: CachedStaticFile,\n  request?: Request,\n): Response {\n  const ifNoneMatch = request?.headers.get('if-none-match');\n  if (ifNoneMatch && ifNoneMatch === cached.etag) {\n    stats.notModified += 1;\n    return new Response(null, {\n      status: 304,\n      headers: {\n        ETag: cached.etag,\n        'Cache-Control': cached.cacheControl,\n      },\n    });\n  }\n\n  return new Response(new Uint8Array(cached.content), {\n    headers: {\n      'Content-Type': cached.contentType,\n      ETag: cached.etag,\n      'Cache-Control': cached.cacheControl,\n    },\n  });\n}\n\n/** Serve a static file from the gateway console build output directory. */\nexport function serveStaticFile(relativePath: string, request?: Request): Response | null {\n  const cached = getCachedFile(relativePath);\n  if (!cached) {\n    return null;\n  }\n  return buildStaticResponse(cached, request);\n}\n\n/** Exposed for tests: verify cache invalidation when source file changes. */\nexport function invalidateStaticUiCacheEntry(relativePath: string): void {\n  fileCache.delete(relativePath);\n  stats.entries = fileCache.size;\n}\n"],"mappings":";;;;;AAMA,MAAM,YAAY,QADC,cAAc,OAAO,KAAK,IACT,CAAC;;;;;AAMrC,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI,wBAAwB,MAAM;AACtD,KAAI,IAAK,QAAO,QAAQ,IAAI;CAE5B,MAAM,OAAO;CACb,MAAM,aAAa,KAAK,QAAQ,OAAO,IAAI;AAC3C,KAAI,WAAW,SAAS,qBAAqB,CAE3C,QAAO,QAAQ,MADC,sBAAsB,KAAK,WACf,GAAG,oCAAoC,+BAA+B;AAEpG,KAAI,WAAW,SAAS,cAAc,CACpC,QAAO,QAAQ,MAAM,iCAAiC;AAGxD,QAAO,QAAQ,MADC,+BAA+B,KAAK,WACxB,GAAG,yCAAyC,oCAAoC;;AAG9G,MAAM,iBAAiB,qBAAqB;AAE5C,MAAM,aAAqC;CACzC,IAAI;CACJ,KAAK;CACL,MAAM;CACN,MAAM;CACN,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,MAAM;CACN,KAAK;CACL,MAAM;CACN,OAAO;CACP,KAAK;CACN;AASD,MAAM,4BAAY,IAAI,KAA+B;AASrD,MAAM,QAA4B;CAChC,MAAM;CACN,QAAQ;CACR,SAAS;CACT,aAAa;CACd;AAED,SAAS,YAAY,SAAyB;AAC5C,QAAO,IAAI,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;;AAG7E,SAAS,oBAAoB,cAA8B;AACzD,KAAI,iBAAiB,aACnB,QAAO;AAET,KAAI,aAAa,WAAW,UAAU,CACpC,QAAO;AAET,QAAO;;AAGT,SAAS,mBAAmB,cAA8B;AAExD,QAAO,WADK,aAAa,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,OAClC;;AAG5B,SAAS,cAAc,cAA+C;CACpE,MAAM,WAAW,QAAQ,gBAAgB,aAAa;AACtD,KAAI;EACF,MAAM,UAAU,aAAa,SAAS;EACtC,MAAM,SAA2B;GAC/B;GACA,aAAa,mBAAmB,aAAa;GAC7C,MAAM,YAAY,QAAQ;GAC1B,cAAc,oBAAoB,aAAa;GAChD;AACD,YAAU,IAAI,cAAc,OAAO;AACnC,QAAM,UAAU,UAAU;AAC1B,QAAM,UAAU;AAChB,SAAO;SACD;AACN,SAAO;;;AAIX,SAAS,cAAc,cAA+C;CACpE,MAAM,SAAS,UAAU,IAAI,aAAa;AAC1C,KAAI,QAAQ;AACV,QAAM,QAAQ;AACd,SAAO;;AAET,QAAO,cAAc,aAAa;;AAGpC,SAAgB,wBAA4C;AAC1D,QAAO,EAAE,GAAG,OAAO;;AAGrB,SAAgB,6BAAmC;AACjD,WAAU,OAAO;AACjB,OAAM,OAAO;AACb,OAAM,SAAS;AACf,OAAM,UAAU;AAChB,OAAM,cAAc;;AAGtB,SAAgB,8BAAsC;AACpD,QAAO;;AAGT,MAAM,wBAAwB;CAC5B;CACA;CACA;CACA;CACD;;AAGD,SAAgB,qBACd,gBAAmC,uBACE;CACrC,IAAI,SAAS;CACb,IAAI,UAAU;AACd,MAAK,MAAM,gBAAgB,cACzB,KAAI,cAAc,aAAa,CAC7B,WAAU;KAEV,YAAW;AAGf,QAAO;EAAE;EAAQ;EAAS;;AAG5B,SAAS,oBACP,QACA,SACU;CACV,MAAM,cAAc,SAAS,QAAQ,IAAI,gBAAgB;AACzD,KAAI,eAAe,gBAAgB,OAAO,MAAM;AAC9C,QAAM,eAAe;AACrB,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,MAAM,OAAO;IACb,iBAAiB,OAAO;IACzB;GACF,CAAC;;AAGJ,QAAO,IAAI,SAAS,IAAI,WAAW,OAAO,QAAQ,EAAE,EAClD,SAAS;EACP,gBAAgB,OAAO;EACvB,MAAM,OAAO;EACb,iBAAiB,OAAO;EACzB,EACF,CAAC;;;AAIJ,SAAgB,gBAAgB,cAAsB,SAAoC;CACxF,MAAM,SAAS,cAAc,aAAa;AAC1C,KAAI,CAAC,OACH,QAAO;AAET,QAAO,oBAAoB,QAAQ,QAAQ;;;AAI7C,SAAgB,6BAA6B,cAA4B;AACvE,WAAU,OAAO,aAAa;AAC9B,OAAM,UAAU,UAAU"}

package/dist/src/gateway/hono/middleware/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger, logAuthEvent } from '../../../utils/logger.js';\n\nconst log = createLogger('Gateway:Auth');\n\nexport interface AuthConfig {\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction resolveExpectedCredential(auth: ResolvedGatewayAuth): string | undefined {\n  return auth.mode === 'token' ? auth.token : auth.mode === 'password' ? auth.password : undefined;\n}\n\nfunction validateCredential(providedCredential: string | undefined, expectedCredential: string): boolean {\n  if (!providedCredential) return false;\n  return safeEqualSecret(providedCredential, expectedCredential);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only where the `Authorization` header cannot\n * be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent\n * avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nconst AGENT_AVATAR_GET_PATH = /^\\/api\\/agents\\/[^/]+\\/avatar$/;\n\n/** Exported for gateway security tests. */\nexport function isQueryTokenAllowedPath(path: string, method: string): boolean {\n  if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events')) {\n    return true;\n  }\n  if (method === 'GET' && AGENT_AVATAR_GET_PATH.test(path)) {\n    return true;\n  }\n  return false;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    if (!resolvedAuth) {\n      log.error({ path: c.req.path, method: c.req.method }, 'HTTP auth rejected: gateway auth is unavailable');\n      return c.json({ error: 'Unauthorized', code: 'auth_unavailable' }, 401);\n    }\n    const authMode = resolvedAuth.mode;\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none') {\n      return next();\n    }\n\n    const expectedCredential = resolveExpectedCredential(resolvedAuth);\n    if (!expectedCredential) {\n      log.error({ path: c.req.path, method: c.req.method, authMode }, 'HTTP auth rejected: credential is unavailable');\n      return c.json({ error: 'Unauthorized', code: 'auth_unconfigured' }, 401);\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = authMode === 'token' && isQueryTokenAllowedPath(requestPath, c.req.method)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Credential in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedCredential = authHeader || queryToken;\n\n    if (providedCredential && validateCredential(providedCredential, expectedCredential)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing credentials are unauthenticated requests, not brute-force signals —\n    // page reloads / SDK cold starts often hit endpoints before credentials are\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedCredential) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_credential', phase: 'gateway.http.auth' },\n        'HTTP auth rejected: no Authorization credential',\n      );\n      void logAuthEvent('auth.failed', {\n        ip: clientIp,\n        result: 'denied',\n        reason: 'missing_credential',\n      });\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_credential', message: 'Missing authentication credential' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_credential', phase: 'gateway.http.auth' },\n      'HTTP auth rejected: credential mismatch',\n    );\n    void logAuthEvent('auth.failed', {\n      ip: clientIp,\n      result: 'failure',\n      reason: 'invalid_credential',\n    });\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_credential', message: 'Invalid authentication credential' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;aAkBsE;AAEtE,MAAM,MAAM,aAAa,eAAe;AAYxC,SAAS,0BAA0B,MAA+C;AAChF,QAAO,KAAK,SAAS,UAAU,KAAK,QAAQ,KAAK,SAAS,aAAa,KAAK,WAAW,KAAA;;AAGzF,SAAS,mBAAmB,oBAAwC,oBAAqC;AACvG,KAAI,CAAC,mBAAoB,QAAO;AAChC,QAAO,gBAAgB,oBAAoB,mBAAmB;;AAGhE,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,MAAM,wBAAwB;;AAG9B,SAAgB,wBAAwB,MAAc,QAAyB;AAC7E,KAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc,CACvE,QAAO;AAET,KAAI,WAAW,SAAS,sBAAsB,KAAK,KAAK,CACtD,QAAO;AAET,QAAO;;AAGT,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEhF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;AACxC,MAAI,CAAC,cAAc;AACjB,OAAI,MAAM;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ,EAAE,kDAAkD;AACxG,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,MAAM;IAAoB,EAAE,IAAI;;EAEzE,MAAM,WAAW,aAAa;AAE9B,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,OACf,QAAO,MAAM;EAGf,MAAM,qBAAqB,0BAA0B,aAAa;AAClE,MAAI,CAAC,oBAAoB;AACvB,OAAI,MAAM;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,EAAE,gDAAgD;AAChH,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,MAAM;IAAqB,EAAE,IAAI;;EAG1E,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,aAAa,WAAW,wBAAwB,aAAa,EAAE,IAAI,OAAO,GACzF,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,kFACD;EAGH,MAAM,qBAAqB,cAAc;AAEzC,MAAI,sBAAsB,mBAAmB,oBAAoB,mBAAmB,EAAE;AACpF,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,oBAAoB;AACvB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAsB,OAAO;IAAqB,EAC9G,kDACD;AACI,gBAAa,eAAe;IAC/B,IAAI;IACJ,QAAQ;IACR,QAAQ;IACT,CAAC;AACF,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAsB,SAAS;IAAqC,EACnG,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAsB,OAAO;GAAqB,EAC9G,0CACD;AACI,eAAa,eAAe;GAC/B,IAAI;GACJ,QAAQ;GACR,QAAQ;GACT,CAAC;AACF,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAsB,SAAS;GAAqC,EACnG,IACD;GACD"}

package/dist/src/gateway/hono/middleware/log-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"log-context.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/log-context.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { createMiddleware } from 'hono/factory';\n\nimport { runWithActivityContext } from '../../../activity/index.js';\nimport { runWithLogContext } from '../../../utils/logger/context.js';\n\n/**\n * Binds request (and optional session) correlation into AsyncLocalStorage so\n * all pino logs in the request inherit requestId / sessionId without a child logger.\n */\nexport function logContextMiddleware() {\n  return createMiddleware(async (c, next) => {\n    const headerRequestId = c.req.header('x-request-id')?.trim();\n    const requestId = headerRequestId && headerRequestId.length > 0 ? headerRequestId : randomUUID();\n    const sessionHeader = c.req.header('x-session-id')?.trim();\n\n    c.header('X-Request-Id', requestId);\n\n    return runWithLogContext(\n      {\n        requestId,\n        ...(sessionHeader ? { sessionId: sessionHeader } : {}),\n      },\n      async () => {\n        await runWithActivityContext(\n          { source: { kind: 'gateway_api', requestId } },\n          async () => {\n            await next();\n          },\n        );\n      },\n    );\n  });\n}\n"],"mappings":";;;;;;cAKqE;;;;;AAMrE,SAAgB,uBAAuB;AACrC,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,kBAAkB,EAAE,IAAI,OAAO,eAAe,EAAE,MAAM;EAC5D,MAAM,YAAY,mBAAmB,gBAAgB,SAAS,IAAI,kBAAkB,YAAY;EAChG,MAAM,gBAAgB,EAAE,IAAI,OAAO,eAAe,EAAE,MAAM;AAE1D,IAAE,OAAO,gBAAgB,UAAU;AAEnC,SAAO,kBACL;GACE;GACA,GAAI,gBAAgB,EAAE,WAAW,eAAe,GAAG,EAAE;GACtD,EACD,YAAY;AACV,SAAM,uBACJ,EAAE,QAAQ;IAAE,MAAM;IAAe;IAAW,EAAE,EAC9C,YAAY;AACV,UAAM,MAAM;KAEf;IAEJ;GACD"}

package/dist/src/gateway/hono/middleware/logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/logger.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Gateway:HTTP');\n\nexport interface LoggerMiddlewareConfig {\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveRequestClientIp(c: Context, config?: LoggerMiddlewareConfig): string {\n  const trustedProxies = config?.trustedProxies;\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback: config?.allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name) => c.req.header(name) ?? undefined,\n  });\n}\n\nexport function logger(config?: LoggerMiddlewareConfig) {\n  return createMiddleware(async (c, next) => {\n    const start = Date.now();\n\n    const clientIp = resolveRequestClientIp(c, config);\n    const userAgent = c.req.header('user-agent') ?? undefined;\n    const contentLength = c.req.header('content-length');\n    const referer = c.req.header('referer') ?? undefined;\n\n    await next();\n\n    const duration = Date.now() - start;\n    const status = c.res.status;\n    const isServerError = status >= 500;\n    const isClientError = status >= 400 && status < 500;\n    const isSlow = duration > 1000;\n\n    const logData = {\n      method: c.req.method,\n      path: c.req.path,\n      status,\n      durationMs: duration,\n      clientIp,\n      ...(userAgent ? { userAgent } : {}),\n      ...(contentLength ? { contentLength: Number(contentLength) } : {}),\n      ...(referer ? { referer } : {}),\n    };\n\n    const msg = `HTTP ${c.req.method} ${c.req.path} → ${status} (${duration}ms)`;\n\n    if (isServerError || isSlow) {\n      log.warn(logData, msg);\n    } else if (isClientError) {\n      // 4xx: info avoids doubling warn noise from auth / rate-limit handlers\n      log.info(logData, msg);\n    } else {\n      log.debug(logData, msg);\n    }\n  });\n}\n"],"mappings":";;;;;;;aAMwD;AAExD,MAAM,MAAM,aAAa,eAAe;AAOxC,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,uBAAuB,GAAY,QAAyC;CACnF,MAAM,iBAAiB,QAAQ;AAC/B,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA,qBAAqB,QAAQ;EAC9B,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAS,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GACtC,CAAC;;AAGJ,SAAgB,OAAO,QAAiC;AACtD,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,QAAQ,KAAK,KAAK;EAExB,MAAM,WAAW,uBAAuB,GAAG,OAAO;EAClD,MAAM,YAAY,EAAE,IAAI,OAAO,aAAa,IAAI,KAAA;EAChD,MAAM,gBAAgB,EAAE,IAAI,OAAO,iBAAiB;EACpD,MAAM,UAAU,EAAE,IAAI,OAAO,UAAU,IAAI,KAAA;AAE3C,QAAM,MAAM;EAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;EAC9B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,gBAAgB,UAAU;EAChC,MAAM,gBAAgB,UAAU,OAAO,SAAS;EAChD,MAAM,SAAS,WAAW;EAE1B,MAAM,UAAU;GACd,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA,YAAY;GACZ;GACA,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;GAClC,GAAI,gBAAgB,EAAE,eAAe,OAAO,cAAc,EAAE,GAAG,EAAE;GACjE,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;GAC/B;EAED,MAAM,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,OAAO,IAAI,SAAS;AAExE,MAAI,iBAAiB,OACnB,KAAI,KAAK,SAAS,IAAI;WACb,cAET,KAAI,KAAK,SAAS,IAAI;MAEtB,KAAI,MAAM,SAAS,IAAI;GAEzB"}

package/dist/src/gateway/hono/middleware/route-errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route-errors.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/route-errors.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\n\nimport { createGatewayRouteLogger, logRouteError } from '../lib/route-logger.js';\n\nconst log = createGatewayRouteLogger('Routes');\n\nexport function routeErrorMiddleware() {\n  return createMiddleware(async (c, next) => {\n    try {\n      await next();\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.http.route');\n      throw err;\n    }\n  });\n}\n\nexport function registerGatewayOnError(app: { onError: (handler: (err: Error, c: Context) => Response | Promise<Response>) => void }) {\n  app.onError((err, c) => {\n    logRouteError(log, c, err, 'gateway.http.unhandled');\n    return c.json(\n      {\n        error: 'Internal Server Error',\n        message: err instanceof Error ? err.message : 'Unknown error',\n      },\n      500,\n    );\n  });\n}\n"],"mappings":";;;AAKA,MAAM,MAAM,yBAAyB,SAAS;AAE9C,SAAgB,uBAAuB;AACrC,QAAO,iBAAiB,OAAO,GAAG,SAAS;AACzC,MAAI;AACF,SAAM,MAAM;WACL,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,qBAAqB;AAChD,SAAM;;GAER;;AAGJ,SAAgB,uBAAuB,KAA+F;AACpI,KAAI,SAAS,KAAK,MAAM;AACtB,gBAAc,KAAK,GAAG,KAAK,yBAAyB;AACpD,SAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS,eAAe,QAAQ,IAAI,UAAU;GAC/C,EACD,IACD;GACD"}

package/dist/src/gateway/hono/middleware/scopes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scopes.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/scopes.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport { authorizeRouteScope, DEFAULT_OPERATOR_SCOPES, type OperatorScope } from '../../security/operator-scopes.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Scopes');\n\n/**\n * Middleware that enforces operator scope requirements on API routes.\n *\n * This middleware runs AFTER the auth middleware. For authenticated requests,\n * it checks that the declared operator scopes (defaulting to full access for\n * token-authenticated users) satisfy the minimum scope required by the route.\n *\n * The scope system is currently implicit: all authenticated users get\n * DEFAULT_OPERATOR_SCOPES. This lays the groundwork for future per-device\n * or per-token scope restrictions (similar to OpenClaw's device pairing scopes).\n */\nexport function operatorScopes() {\n  return createMiddleware(async (c, next) => {\n    // All currently authenticated users get full operator scopes.\n    // In the future, device-paired connections or scoped tokens can provide\n    // a narrower set via x-xopc-scopes header or connect payload.\n    const grantedScopes: OperatorScope[] = [...DEFAULT_OPERATOR_SCOPES];\n\n    const scopeCheck = authorizeRouteScope(c.req.path, grantedScopes);\n    if (!scopeCheck.allowed && 'requiredScope' in scopeCheck) {\n      const { requiredScope } = scopeCheck;\n      log.warn(\n        { path: c.req.path, method: c.req.method, requiredScope },\n        `Scope check failed: missing ${requiredScope}`,\n      );\n      return c.json(\n        {\n          error: 'Forbidden',\n          message: `Missing required scope: ${requiredScope}`,\n        },\n        403,\n      );\n    }\n\n    await next();\n  });\n}\n"],"mappings":";;;;;aAEwD;AAExD,MAAM,MAAM,aAAa,cAAc;;;;;;;;;;;;AAavC,SAAgB,iBAAiB;AAC/B,QAAO,iBAAiB,OAAO,GAAG,SAAS;EAIzC,MAAM,gBAAiC,CAAC,GAAG,wBAAwB;EAEnE,MAAM,aAAa,oBAAoB,EAAE,IAAI,MAAM,cAAc;AACjE,MAAI,CAAC,WAAW,WAAW,mBAAmB,YAAY;GACxD,MAAM,EAAE,kBAAkB;AAC1B,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAe,EACzD,+BAA+B,gBAChC;AACD,UAAO,EAAE,KACP;IACE,OAAO;IACP,SAAS,2BAA2B;IACrC,EACD,IACD;;AAGH,QAAM,MAAM;GACZ"}

package/dist/src/gateway/hono/middleware/strict-rate-limit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"strict-rate-limit.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/strict-rate-limit.ts"],"sourcesContent":["/**\n * Per-client request-rate gate for sensitive admin/mutation endpoints.\n * Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.\n */\n\nimport { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { buckets } from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:StrictRateLimit');\n\nexport type StrictRateLimitDeps = {\n  getTrustedProxyContext: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n};\n\nfunction resolveClientIp(c: Context, deps: StrictRateLimitDeps): string {\n  const { trustedProxies, allowRealIpFallback } = deps.getTrustedProxyContext();\n  if (trustedProxies?.length) {\n    let remoteAddress: string | undefined;\n    try {\n      remoteAddress = getConnInfo(c).remote.address;\n    } catch {\n      remoteAddress = undefined;\n    }\n    return resolveClientIpFromRequest({\n      remoteAddress,\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? undefined });\n}\n\nfunction createClientRateLimitMiddleware(\n  deps: StrictRateLimitDeps,\n  options: {\n    limiter: () => ReturnType<typeof buckets.strictApi>;\n    exceededMessage: string;\n    reason: string;\n  },\n) {\n  return createMiddleware(async (c, next) => {\n    const limiter = options.limiter();\n    const clientIp = resolveClientIp(c, deps);\n    const result = limiter.consume(clientIp);\n\n    if (!result.allowed) {\n      const retryAfterSec = Math.ceil(result.retryAfterMs / 1000);\n      log.warn(\n        {\n          clientIp,\n          path: c.req.path,\n          method: c.req.method,\n          retryAfterSec,\n          reason: options.reason,\n        },\n        options.exceededMessage,\n      );\n      c.header('Retry-After', String(retryAfterSec));\n      c.header('X-RateLimit-Remaining', '0');\n      return c.json({ error: 'Too many requests', code: 'rate_limited' }, 429);\n    }\n\n    c.header('X-RateLimit-Remaining', String(result.remaining));\n    await next();\n  });\n}\n\nexport function createStrictRateLimitMiddleware(deps: StrictRateLimitDeps) {\n  return createClientRateLimitMiddleware(deps, {\n    limiter: () => buckets.strictApi(),\n    exceededMessage: 'Strict API rate limit exceeded',\n    reason: 'strict_rate_limit_exceeded',\n  });\n}\n\nexport function createChannelRateLimitMiddleware(deps: StrictRateLimitDeps) {\n  return createClientRateLimitMiddleware(deps, {\n    limiter: () => buckets.channelApi(),\n    exceededMessage: 'Channel API rate limit exceeded',\n    reason: 'channel_rate_limit_exceeded',\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAYwD;AAExD,MAAM,MAAM,aAAa,uBAAuB;AAShD,SAAS,gBAAgB,GAAY,MAAmC;CACtE,MAAM,EAAE,gBAAgB,wBAAwB,KAAK,wBAAwB;AAC7E,KAAI,gBAAgB,QAAQ;EAC1B,IAAI;AACJ,MAAI;AACF,mBAAgB,YAAY,EAAE,CAAC,OAAO;UAChC;AACN,mBAAgB,KAAA;;AAElB,SAAO,2BAA2B;GAChC;GACA,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;GACvC;GACA;GACD,CAAC;;AAEJ,QAAO,uBAAuB,EAAE,MAAM,SAAS,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAAW,CAAC;;AAGnF,SAAS,gCACP,MACA,SAKA;AACA,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,UAAU,QAAQ,SAAS;EACjC,MAAM,WAAW,gBAAgB,GAAG,KAAK;EACzC,MAAM,SAAS,QAAQ,QAAQ,SAAS;AAExC,MAAI,CAAC,OAAO,SAAS;GACnB,MAAM,gBAAgB,KAAK,KAAK,OAAO,eAAe,IAAK;AAC3D,OAAI,KACF;IACE;IACA,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd;IACA,QAAQ,QAAQ;IACjB,EACD,QAAQ,gBACT;AACD,KAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,KAAE,OAAO,yBAAyB,IAAI;AACtC,UAAO,EAAE,KAAK;IAAE,OAAO;IAAqB,MAAM;IAAgB,EAAE,IAAI;;AAG1E,IAAE,OAAO,yBAAyB,OAAO,OAAO,UAAU,CAAC;AAC3D,QAAM,MAAM;GACZ;;AAGJ,SAAgB,gCAAgC,MAA2B;AACzE,QAAO,gCAAgC,MAAM;EAC3C,eAAe,QAAQ,WAAW;EAClC,iBAAiB;EACjB,QAAQ;EACT,CAAC;;AAGJ,SAAgB,iCAAiC,MAA2B;AAC1E,QAAO,gCAAgC,MAAM;EAC3C,eAAe,QAAQ,YAAY;EACnC,iBAAiB;EACjB,QAAQ;EACT,CAAC"}

package/dist/src/gateway/hono/oauth-async.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-async.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth-async.ts"],"sourcesContent":["/**\n * Async OAuth Handler\n * \n * Provides non-blocking OAuth flow with session-based state management.\n * This allows OAuth flows that require user interaction (browser login) \n * without blocking the HTTP request.\n */\n\nimport { Hono } from 'hono';\nimport type { Context } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\nimport { isLoopbackHost } from '../host.js';\nimport { resolveReverseProxyPublicUrl } from '../public-url.js';\nimport { createLogger } from '../../utils/logger.js';\n\nconst log = createLogger('OAuthAsync');\n\n/** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */\nfunction formatOAuthAsyncError(err: unknown): string {\n\tconst base = err instanceof Error ? err.message : 'OAuth login failed';\n\tconst cause =\n\t\terr instanceof Error && err.cause instanceof Error\n\t\t\t? err.cause.message\n\t\t\t: err instanceof Error && typeof err.cause === 'string'\n\t\t\t\t? err.cause\n\t\t\t\t: '';\n\tconst detail = cause ? ` (${cause})` : '';\n\tif (/^fetch failed$/i.test(base) || base.includes('fetch failed')) {\n\t\treturn (\n\t\t\t`Network request failed${detail}. If the browser opened on another device, the redirect goes to that device's localhost — ` +\n\t\t\t`copy the full URL from the browser address bar after sign-in (starts with http://127.0.0.1 or http://localhost) and paste it below. ` +\n\t\t\t`Otherwise check VPN/proxy/DNS/firewall access to Google OAuth.`\n\t\t);\n\t}\n\treturn base;\n}\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// OAuth session state\ninterface OAuthSession {\n  id: string;\n  provider: string;\n  preferredLoginMethod?: string;\n  status: 'pending' | 'waiting_auth' | 'waiting_code' | 'completed' | 'failed' | 'cancelled';\n  authUrl?: string;\n  instructions?: string;\n  deviceCode?: string;\n  verificationUri?: string;\n  message?: string;\n  error?: string;\n  credentials?: OAuthCredentials;\n  createdAt: number;\n  expiresAt: number;\n  abortController?: AbortController;\n  manualCodeResolve?: (code: string) => void;\n  manualCodeReject?: (error: Error) => void;\n}\n\n// In-memory session store (could be moved to Redis for production)\nconst oauthSessions = new Map<string, OAuthSession>();\nconst SESSION_TTL_MS = 10 * 60 * 1000; // 10 minutes\n\n// Clean up expired sessions periodically\nsetInterval(() => {\n  const now = Date.now();\n  for (const [id, session] of oauthSessions.entries()) {\n    if (now > session.expiresAt) {\n      cancelOAuthSession(session, 'OAuth flow expired');\n      oauthSessions.delete(id);\n      log.debug({ sessionId: id }, 'Cleaned up expired OAuth session');\n    }\n  }\n}, 60 * 1000);\n\nfunction generateSessionId(): string {\n  return `oauth_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;\n}\n\nfunction cancelOAuthSession(session: OAuthSession, message = 'OAuth flow cancelled'): void {\n  if (session.abortController) {\n    session.abortController.abort();\n  }\n\n  if (session.manualCodeResolve) {\n    session.manualCodeResolve('');\n  }\n\n  session.manualCodeResolve = undefined;\n  session.manualCodeReject = undefined;\n  session.status = 'cancelled';\n  session.message = message;\n}\n\nfunction hostWithoutPort(value: string | undefined): string | undefined {\n  const raw = value?.split(',')[0]?.trim();\n  if (!raw) return undefined;\n\n  try {\n    return new URL(raw.includes('://') ? raw : `http://${raw}`).hostname.replace(/^\\[/, '').replace(/\\]$/, '');\n  } catch {\n    const unbracketed = raw.replace(/^\\[/, '').replace(/\\]$/, '');\n    return unbracketed.includes(':') && !unbracketed.includes('.') ? unbracketed : unbracketed.split(':')[0];\n  }\n}\n\nfunction requestLooksRemote(c: Context): boolean {\n  const originHost = hostWithoutPort(c.req.header('origin'));\n  const forwardedHost = hostWithoutPort(c.req.header('x-forwarded-host'));\n  const host = hostWithoutPort(c.req.header('host'));\n\n  return [originHost, forwardedHost, host].some((candidate) => candidate && !isLoopbackHost(candidate));\n}\n\nfunction preferredOAuthLoginMethod(params: {\n  provider: string;\n  requestedMethod?: unknown;\n  c: Context;\n  service: GatewayService;\n}): string | undefined {\n  if (typeof params.requestedMethod === 'string' && params.requestedMethod.trim()) {\n    return params.requestedMethod.trim();\n  }\n\n  if (params.provider !== 'openai-codex') {\n    return undefined;\n  }\n\n  const publicUrl = resolveReverseProxyPublicUrl(params.service.currentConfig);\n  const publicHost = hostWithoutPort(publicUrl ?? undefined);\n  if ((publicHost && !isLoopbackHost(publicHost)) || requestLooksRemote(params.c)) {\n    return 'device_code';\n  }\n\n  return undefined;\n}\n\nexport function createOAuthAsyncHandler(service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth-async/start\n   * Start async OAuth flow - returns immediately with session ID\n   */\n  oauth.post('/start', async (c) => {\n    const body = await c.req.json().catch(() => ({}));\n    const { provider } = body;\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    const sessionId = generateSessionId();\n    const session: OAuthSession = {\n      id: sessionId,\n      provider,\n      preferredLoginMethod: preferredOAuthLoginMethod({\n        provider,\n        requestedMethod: body.loginMethod,\n        c,\n        service,\n      }),\n      status: 'pending',\n      createdAt: Date.now(),\n      expiresAt: Date.now() + SESSION_TTL_MS,\n    };\n\n    oauthSessions.set(sessionId, session);\n\n    // Start OAuth flow in background\n    runOAuthFlow(session, oauthProvider, service).catch(err => {\n      log.error({ sessionId, provider, error: err }, 'Background OAuth flow failed');\n      session.status = 'failed';\n      session.error = err instanceof Error ? err.message : 'OAuth flow failed';\n    });\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId,\n        provider,\n        status: session.status,\n      } \n    });\n  });\n\n  /**\n   * GET /api/auth/oauth-async/:sessionId/status\n   * Check OAuth session status\n   */\n  oauth.get('/:sessionId/status', (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    return c.json({ \n      ok: true, \n      payload: { \n        sessionId: session.id,\n        provider: session.provider,\n        status: session.status,\n        authUrl: session.authUrl,\n        instructions: session.instructions,\n        deviceCode: session.deviceCode,\n        verificationUri: session.verificationUri,\n        message: session.message,\n        error: session.error,\n        expiresAt: session.expiresAt,\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/code\n   * Submit manual authorization code\n   */\n  oauth.post('/:sessionId/code', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const { code } = await c.req.json().catch(() => ({}));\n    \n    if (!code) {\n      return c.json({ error: 'Code is required' }, 400);\n    }\n\n    const session = oauthSessions.get(sessionId);\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    if (session.status !== 'waiting_code' || !session.manualCodeResolve) {\n      return c.json({ error: 'Session is not waiting for code' }, 400);\n    }\n\n    // Resolve the manual code promise\n    session.manualCodeResolve(code);\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'Code submitted, processing...',\n      } \n    });\n  });\n\n  /**\n   * POST /api/auth/oauth-async/:sessionId/cancel\n   * Cancel OAuth flow\n   */\n  oauth.post('/:sessionId/cancel', async (c) => {\n    const sessionId = c.req.param('sessionId');\n    const session = oauthSessions.get(sessionId);\n\n    if (!session) {\n      return c.json({ error: 'Session not found' }, 404);\n    }\n\n    cancelOAuthSession(session);\n\n    return c.json({ \n      ok: true, \n      payload: { \n        message: 'OAuth flow cancelled',\n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth-async/:sessionId\n   * Clean up OAuth session\n   */\n  oauth.delete('/:sessionId', (c) => {\n    const sessionId = c.req.param('sessionId');\n    \n    if (oauthSessions.has(sessionId)) {\n      const session = oauthSessions.get(sessionId)!;\n      cancelOAuthSession(session);\n      oauthSessions.delete(sessionId);\n    }\n\n    return c.json({ ok: true });\n  });\n\n  return oauth;\n}\n\n/**\n * Run OAuth flow in background\n */\nasync function runOAuthFlow(\n  session: OAuthSession,\n  oauthProvider: OAuthProviderInterface,\n  _service: GatewayService\n): Promise<void> {\n  const abortController = new AbortController();\n  session.abortController = abortController;\n\n  let manualCodePromise: Promise<string> | null = null;\n  let manualCodeResolve: ((code: string) => void) | undefined;\n  let manualCodeReject: ((error: Error) => void) | undefined;\n\n  const callbacks: OAuthLoginCallbacks = {\n    onAuth: (auth: { url: string; instructions?: string }) => {\n      session.authUrl = auth.url;\n      session.instructions = auth.instructions;\n      \n      if (oauthProvider.usesCallbackServer) {\n        // For callback server providers, prepare for manual code input\n        session.status = 'waiting_code';\n        session.message = 'Complete authorization in browser, or paste the redirect URL below';\n        manualCodePromise = new Promise((resolve, reject) => {\n          manualCodeResolve = resolve;\n          manualCodeReject = reject;\n        });\n        session.manualCodeResolve = manualCodeResolve;\n        session.manualCodeReject = manualCodeReject;\n      } else {\n        session.status = 'waiting_auth';\n        session.message = 'Complete authorization in browser';\n      }\n    },\n    onDeviceCode: (info) => {\n      session.status = 'waiting_auth';\n      session.authUrl = info.verificationUri;\n      session.deviceCode = info.userCode;\n      session.verificationUri = info.verificationUri;\n      session.instructions = `Enter code ${info.userCode}`;\n      session.message = `Open ${info.verificationUri} and enter code ${info.userCode}`;\n    },\n    onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n      session.status = 'waiting_code';\n      session.deviceCode = prompt.deviceCode;\n      session.verificationUri = prompt.verificationUri;\n      session.message = prompt.message;\n      \n      // For device code flow, wait for manual input\n      manualCodePromise = new Promise((resolve, reject) => {\n        manualCodeResolve = resolve;\n        manualCodeReject = reject;\n      });\n      session.manualCodeResolve = manualCodeResolve;\n      session.manualCodeReject = manualCodeReject;\n      \n      // Return empty for now, will be resolved by manual code submission\n      return '';\n    },\n    onProgress: (message: string) => {\n      log.debug({ sessionId: session.id, message }, 'OAuth progress');\n      session.message = message;\n    },\n    onManualCodeInput: async () => {\n      // Return the manual code promise for callback server providers\n      if (manualCodePromise) {\n        return manualCodePromise;\n      }\n      return '';\n    },\n    onSelect: async (prompt) => {\n      const preferredOption = session.preferredLoginMethod\n        ? prompt.options.find((option) => option.id === session.preferredLoginMethod)\n        : undefined;\n      const browserOption = prompt.options.find((option) => option.id === 'browser');\n      const firstOption = prompt.options[0];\n      const selectedOption = preferredOption ?? browserOption ?? firstOption;\n      if (!selectedOption) {\n        throw new Error('OAuth login did not provide any selectable auth method');\n      }\n      log.debug(\n        { sessionId: session.id, provider: session.provider, selected: selectedOption.id },\n        'Selected OAuth auth method',\n      );\n      return selectedOption.id;\n    },\n    signal: abortController.signal,\n  };\n\n  try {\n    const credentials = await oauthProvider.login(callbacks);\n    \n    // Save credentials to cache and persist them as first-class OAuth credentials.\n    setOAuthCredentialsToCache(session.provider, credentials);\n\n    const resolver = new CredentialResolver();\n    await resolver.saveOAuthToken(session.provider, {\n      access: oauthProvider.getApiKey(credentials),\n      refresh: credentials.refresh,\n      expiresAt: credentials.expires,\n      scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value): value is string => typeof value === 'string') : undefined,\n      createdAt: new Date().toISOString(),\n    });\n\n    session.status = 'completed';\n    session.credentials = credentials;\n    session.message = 'OAuth login successful';\n    \n    log.info({ sessionId: session.id, provider: session.provider }, 'OAuth login completed');\n  } catch (err) {\n    if (abortController.signal.aborted || session.status === 'cancelled') {\n      session.status = 'cancelled';\n      session.message ??= 'OAuth flow cancelled by user';\n    } else {\n      session.status = 'failed';\n      session.error = formatOAuthAsyncError(err);\n      log.error({ sessionId: session.id, provider: session.provider, error: err }, 'OAuth login failed');\n    }\n  } finally {\n    session.abortController = undefined;\n    session.manualCodeResolve = undefined;\n    session.manualCodeReject = undefined;\n  }\n}\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nexport function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nexport function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nexport function deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;kBA0B+D;aAGV;AAErD,MAAM,MAAM,aAAa,aAAa;;AAGtC,SAAS,sBAAsB,KAAsB;CACpD,MAAM,OAAO,eAAe,QAAQ,IAAI,UAAU;CAClD,MAAM,QACL,eAAe,SAAS,IAAI,iBAAiB,QAC1C,IAAI,MAAM,UACV,eAAe,SAAS,OAAO,IAAI,UAAU,WAC5C,IAAI,QACJ;CACL,MAAM,SAAS,QAAQ,KAAK,MAAM,KAAK;AACvC,KAAI,kBAAkB,KAAK,KAAK,IAAI,KAAK,SAAS,eAAe,CAChE,QACC,yBAAyB,OAAO;AAKlC,QAAO;;AAIR,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAuBD,MAAM,gCAAgB,IAAI,KAA2B;AACrD,MAAM,iBAAiB,MAAU;AAGjC,kBAAkB;CAChB,MAAM,MAAM,KAAK,KAAK;AACtB,MAAK,MAAM,CAAC,IAAI,YAAY,cAAc,SAAS,CACjD,KAAI,MAAM,QAAQ,WAAW;AAC3B,qBAAmB,SAAS,qBAAqB;AACjD,gBAAc,OAAO,GAAG;AACxB,MAAI,MAAM,EAAE,WAAW,IAAI,EAAE,mCAAmC;;GAGnE,KAAK,IAAK;AAEb,SAAS,oBAA4B;AACnC,QAAO,SAAS,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,UAAU,GAAG,GAAG;;AAG3E,SAAS,mBAAmB,SAAuB,UAAU,wBAA8B;AACzF,KAAI,QAAQ,gBACV,SAAQ,gBAAgB,OAAO;AAGjC,KAAI,QAAQ,kBACV,SAAQ,kBAAkB,GAAG;AAG/B,SAAQ,oBAAoB,KAAA;AAC5B,SAAQ,mBAAmB,KAAA;AAC3B,SAAQ,SAAS;AACjB,SAAQ,UAAU;;AAGpB,SAAS,gBAAgB,OAA+C;CACtE,MAAM,MAAM,OAAO,MAAM,IAAI,CAAC,IAAI,MAAM;AACxC,KAAI,CAAC,IAAK,QAAO,KAAA;AAEjB,KAAI;AACF,SAAO,IAAI,IAAI,IAAI,SAAS,MAAM,GAAG,MAAM,UAAU,MAAM,CAAC,SAAS,QAAQ,OAAO,GAAG,CAAC,QAAQ,OAAO,GAAG;SACpG;EACN,MAAM,cAAc,IAAI,QAAQ,OAAO,GAAG,CAAC,QAAQ,OAAO,GAAG;AAC7D,SAAO,YAAY,SAAS,IAAI,IAAI,CAAC,YAAY,SAAS,IAAI,GAAG,cAAc,YAAY,MAAM,IAAI,CAAC;;;AAI1G,SAAS,mBAAmB,GAAqB;AAK/C,QAAO;EAJY,gBAAgB,EAAE,IAAI,OAAO,SAAS,CAIvC;EAHI,gBAAgB,EAAE,IAAI,OAAO,mBAAmB,CAGrC;EAFpB,gBAAgB,EAAE,IAAI,OAAO,OAAO,CAEV;EAAC,CAAC,MAAM,cAAc,aAAa,CAAC,eAAe,UAAU,CAAC;;AAGvG,SAAS,0BAA0B,QAKZ;AACrB,KAAI,OAAO,OAAO,oBAAoB,YAAY,OAAO,gBAAgB,MAAM,CAC7E,QAAO,OAAO,gBAAgB,MAAM;AAGtC,KAAI,OAAO,aAAa,eACtB;CAIF,MAAM,aAAa,gBADD,6BAA6B,OAAO,QAAQ,cAClB,IAAI,KAAA,EAAU;AAC1D,KAAK,cAAc,CAAC,eAAe,WAAW,IAAK,mBAAmB,OAAO,EAAE,CAC7E,QAAO;;AAMX,SAAgB,wBAAwB,SAAyB;CAC/D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;EACjD,MAAM,EAAE,aAAa;AAErB,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;EAGtE,MAAM,YAAY,mBAAmB;EACrC,MAAM,UAAwB;GAC5B,IAAI;GACJ;GACA,sBAAsB,0BAA0B;IAC9C;IACA,iBAAiB,KAAK;IACtB;IACA;IACD,CAAC;GACF,QAAQ;GACR,WAAW,KAAK,KAAK;GACrB,WAAW,KAAK,KAAK,GAAG;GACzB;AAED,gBAAc,IAAI,WAAW,QAAQ;AAGrC,eAAa,SAAS,eAAe,QAAQ,CAAC,OAAM,QAAO;AACzD,OAAI,MAAM;IAAE;IAAW;IAAU,OAAO;IAAK,EAAE,+BAA+B;AAC9E,WAAQ,SAAS;AACjB,WAAQ,QAAQ,eAAe,QAAQ,IAAI,UAAU;IACrD;AAEF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA;IACA,QAAQ,QAAQ;IACjB;GACF,CAAC;GACF;;;;;AAMF,OAAM,IAAI,uBAAuB,MAAM;EACrC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,WAAW,QAAQ;IACnB,UAAU,QAAQ;IAClB,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IACjB,cAAc,QAAQ;IACtB,YAAY,QAAQ;IACpB,iBAAiB,QAAQ;IACzB,SAAS,QAAQ;IACjB,OAAO,QAAQ;IACf,WAAW,QAAQ;IACpB;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,oBAAoB,OAAO,MAAM;EAC1C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,EAAE,SAAS,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAErD,MAAI,CAAC,KACH,QAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,EAAE,IAAI;EAGnD,MAAM,UAAU,cAAc,IAAI,UAAU;AAC5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,MAAI,QAAQ,WAAW,kBAAkB,CAAC,QAAQ,kBAChD,QAAO,EAAE,KAAK,EAAE,OAAO,mCAAmC,EAAE,IAAI;AAIlE,UAAQ,kBAAkB,KAAK;AAC/B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;AAE3B,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,iCACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,KAAK,sBAAsB,OAAO,MAAM;EAC5C,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;EAC1C,MAAM,UAAU,cAAc,IAAI,UAAU;AAE5C,MAAI,CAAC,QACH,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;AAGpD,qBAAmB,QAAQ;AAE3B,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EACP,SAAS,wBACV;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,gBAAgB,MAAM;EACjC,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY;AAE1C,MAAI,cAAc,IAAI,UAAU,EAAE;AAEhC,sBADgB,cAAc,IAAI,UACR,CAAC;AAC3B,iBAAc,OAAO,UAAU;;AAGjC,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,QAAO;;;;;AAMT,eAAe,aACb,SACA,eACA,UACe;CACf,MAAM,kBAAkB,IAAI,iBAAiB;AAC7C,SAAQ,kBAAkB;CAE1B,IAAI,oBAA4C;CAChD,IAAI;CACJ,IAAI;CAEJ,MAAM,YAAiC;EACrC,SAAS,SAAiD;AACxD,WAAQ,UAAU,KAAK;AACvB,WAAQ,eAAe,KAAK;AAE5B,OAAI,cAAc,oBAAoB;AAEpC,YAAQ,SAAS;AACjB,YAAQ,UAAU;AAClB,wBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,yBAAoB;AACpB,wBAAmB;MACnB;AACF,YAAQ,oBAAoB;AAC5B,YAAQ,mBAAmB;UACtB;AACL,YAAQ,SAAS;AACjB,YAAQ,UAAU;;;EAGtB,eAAe,SAAS;AACtB,WAAQ,SAAS;AACjB,WAAQ,UAAU,KAAK;AACvB,WAAQ,aAAa,KAAK;AAC1B,WAAQ,kBAAkB,KAAK;AAC/B,WAAQ,eAAe,cAAc,KAAK;AAC1C,WAAQ,UAAU,QAAQ,KAAK,gBAAgB,kBAAkB,KAAK;;EAExE,UAAU,OAAO,WAA+E;AAC9F,WAAQ,SAAS;AACjB,WAAQ,aAAa,OAAO;AAC5B,WAAQ,kBAAkB,OAAO;AACjC,WAAQ,UAAU,OAAO;AAGzB,uBAAoB,IAAI,SAAS,SAAS,WAAW;AACnD,wBAAoB;AACpB,uBAAmB;KACnB;AACF,WAAQ,oBAAoB;AAC5B,WAAQ,mBAAmB;AAG3B,UAAO;;EAET,aAAa,YAAoB;AAC/B,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI;IAAS,EAAE,iBAAiB;AAC/D,WAAQ,UAAU;;EAEpB,mBAAmB,YAAY;AAE7B,OAAI,kBACF,QAAO;AAET,UAAO;;EAET,UAAU,OAAO,WAAW;GAC1B,MAAM,kBAAkB,QAAQ,uBAC5B,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,QAAQ,qBAAqB,GAC3E,KAAA;GACJ,MAAM,gBAAgB,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,UAAU;GAC9E,MAAM,cAAc,OAAO,QAAQ;GACnC,MAAM,iBAAiB,mBAAmB,iBAAiB;AAC3D,OAAI,CAAC,eACH,OAAM,IAAI,MAAM,yDAAyD;AAE3E,OAAI,MACF;IAAE,WAAW,QAAQ;IAAI,UAAU,QAAQ;IAAU,UAAU,eAAe;IAAI,EAClF,6BACD;AACD,UAAO,eAAe;;EAExB,QAAQ,gBAAgB;EACzB;AAED,KAAI;EACF,MAAM,cAAc,MAAM,cAAc,MAAM,UAAU;AAGxD,6BAA2B,QAAQ,UAAU,YAAY;AAGzD,QAAM,IADe,oBACP,CAAC,eAAe,QAAQ,UAAU;GAC9C,QAAQ,cAAc,UAAU,YAAY;GAC5C,SAAS,YAAY;GACrB,WAAW,YAAY;GACvB,OAAO,MAAM,QAAQ,YAAY,MAAM,GAAG,YAAY,MAAM,QAAQ,UAA2B,OAAO,UAAU,SAAS,GAAG,KAAA;GAC5H,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC,CAAC;AAEF,UAAQ,SAAS;AACjB,UAAQ,cAAc;AACtB,UAAQ,UAAU;AAElB,MAAI,KAAK;GAAE,WAAW,QAAQ;GAAI,UAAU,QAAQ;GAAU,EAAE,wBAAwB;UACjF,KAAK;AACZ,MAAI,gBAAgB,OAAO,WAAW,QAAQ,WAAW,aAAa;AACpE,WAAQ,SAAS;AACjB,WAAQ,YAAY;SACf;AACL,WAAQ,SAAS;AACjB,WAAQ,QAAQ,sBAAsB,IAAI;AAC1C,OAAI,MAAM;IAAE,WAAW,QAAQ;IAAI,UAAU,QAAQ;IAAU,OAAO;IAAK,EAAE,qBAAqB;;WAE5F;AACR,UAAQ,kBAAkB,KAAA;AAC1B,UAAQ,oBAAoB,KAAA;AAC5B,UAAQ,mBAAmB,KAAA;;;AAK/B,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAgB,6BAA6B,UAAgD;AAC3F,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAgB,2BAA2B,UAAkB,OAA+B;AAC1F,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAgB,gCAAgC,UAAwB;AACtE,uBAAsB,OAAO,SAAS"}

package/dist/src/gateway/hono/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","names":["googleGeminiCliOAuthProvider","googleAntigravityOAuthProvider"],"sources":["../../../../src/gateway/hono/oauth.ts"],"sourcesContent":["/**\n * OAuth HTTP Handler\n * \n * Provides HTTP endpoints for OAuth login flow.\n */\n\nimport { Hono } from 'hono';\nimport type { GatewayService } from '../service.js';\nimport { \n  type OAuthProviderInterface, \n  type OAuthLoginCallbacks,\n  type OAuthCredentials \n} from '../../auth/oauth/types.js';\nimport {\n  kimiCodingOAuthProvider,\n  minimaxOAuthProvider,\n  minimaxCnOAuthProvider,\n  anthropicOAuthProvider,\n  githubCopilotOAuthProvider,\n  googleGeminiCliOAuthProvider,\n  googleAntigravityOAuthProvider,\n  openaiCodexOAuthProvider,\n} from '../../auth/oauth/index.js';\nimport { CredentialResolver } from '../../auth/credentials.js';\nimport { getProviderAuthState, isProviderConfigured } from '../../providers/index.js';\n\n// Static OAuth providers map\nconst OAUTH_PROVIDERS: Record<string, OAuthProviderInterface> = {\n  'kimi-coding': kimiCodingOAuthProvider,\n  'minimax': minimaxOAuthProvider,\n  'minimax-cn': minimaxCnOAuthProvider,\n  'anthropic': anthropicOAuthProvider,\n  'github-copilot': githubCopilotOAuthProvider,\n  'google-gemini-cli': googleGeminiCliOAuthProvider,\n  'google-antigravity': googleAntigravityOAuthProvider,\n  'openai-codex': openaiCodexOAuthProvider,\n};\n\n// Simple in-memory cache for OAuth credentials\nconst oauthCredentialsCache: Map<string, OAuthCredentials> = new Map();\n\nfunction getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined {\n  return oauthCredentialsCache.get(provider);\n}\n\nfunction setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void {\n  oauthCredentialsCache.set(provider, creds);\n}\n\nfunction deleteOAuthCredentialsFromCache(provider: string): void {\n  oauthCredentialsCache.delete(provider);\n}\n\n/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */\nexport function loadOAuthCredentialsToCache(_service: GatewayService): void {}\n\nexport function createOAuthHandler(_service: GatewayService) {\n  const oauth = new Hono();\n\n  /**\n   * POST /api/auth/oauth/start\n   * Start OAuth flow for a provider\n   */\n  oauth.post('/start', async (c) => {\n    const { provider } = await c.req.json().catch(() => ({}));\n    \n    if (!provider) {\n      return c.json({ error: 'Provider is required' }, 400);\n    }\n\n    const oauthProvider = OAUTH_PROVIDERS[provider];\n    if (!oauthProvider) {\n      return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);\n    }\n\n    try {\n      let authResult: any = null;\n      let manualCodeRequested = false;\n      \n      const callbacks: OAuthLoginCallbacks = {\n        onAuth: (auth: { url: string; instructions?: string }) => {\n          authResult = { url: auth.url, instructions: auth.instructions };\n        },\n        onDeviceCode: (info) => {\n          authResult = {\n            url: info.verificationUri,\n            instructions: `Enter code ${info.userCode}`,\n            message: `Open ${info.verificationUri} and enter code ${info.userCode}`,\n            deviceCode: info.userCode,\n            verificationUri: info.verificationUri,\n          };\n        },\n        onPrompt: async (prompt: { message: string; deviceCode?: string; verificationUri?: string }) => {\n          authResult = { \n            message: prompt.message, \n            deviceCode: prompt.deviceCode,\n            verificationUri: prompt.verificationUri,\n          };\n          return prompt.deviceCode || '';\n        },\n        onProgress: (message: string) => {\n          console.log('OAuth progress:', message);\n        },\n        onManualCodeInput: async () => {\n          // For callback server providers, signal that manual code input is needed\n          manualCodeRequested = true;\n          // Return empty - frontend will handle manual input\n          return '';\n        },\n        onSelect: async (prompt) => {\n          const browserOption = prompt.options.find((option) => option.id === 'browser');\n          return browserOption?.id ?? prompt.options[0]?.id;\n        },\n      };\n\n      const credentials = await oauthProvider.login(callbacks);\n      setOAuthCredentialsToCache(provider, credentials);\n\n      const resolver = new CredentialResolver();\n      await resolver.saveOAuthToken(provider, {\n        access: oauthProvider.getApiKey(credentials),\n        refresh: credentials.refresh,\n        expiresAt: credentials.expires,\n        scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value): value is string => typeof value === 'string') : undefined,\n        createdAt: new Date().toISOString(),\n      });\n\n      return c.json({ \n        ok: true, \n        payload: { \n          success: true,\n          provider,\n          message: 'OAuth login successful',\n          expires: credentials.expires,\n          authUrl: authResult?.url,\n          deviceCode: authResult?.deviceCode,\n          verificationUri: authResult?.verificationUri,\n          instructions: authResult?.instructions,\n          usesCallbackServer: oauthProvider.usesCallbackServer ?? false,\n          manualCodeRequested,\n        } \n      });\n    } catch (err) {\n      console.error('OAuth login error:', err);\n      return c.json({ \n        error: err instanceof Error ? err.message : 'OAuth login failed' \n      }, 500);\n    }\n  });\n\n  /**\n   * GET /api/auth/oauth/:provider\n   * Check OAuth status for a provider\n   */\n  oauth.get('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    const credentials = getOAuthCredentialsFromCache(provider);\n    const authState = await getProviderAuthState(provider);\n    const configured = await isProviderConfigured(provider);\n\n    return c.json({ \n      ok: true, \n      payload: { \n        configured: configured || !!credentials,\n        authMode: authState.authMode,\n        authStatus: authState.authStatus,\n        expiresAt: authState.expiresAt ?? credentials?.expires,\n      } \n    });\n  });\n\n  /**\n   * DELETE /api/auth/oauth/:provider\n   * Revoke OAuth credentials\n   */\n  oauth.delete('/:provider', async (c) => {\n    const provider = c.req.param('provider');\n    \n    deleteOAuthCredentialsFromCache(provider);\n    const resolver = new CredentialResolver();\n    await resolver.deleteProviderCredential(provider);\n\n    return c.json({ ok: true, payload: { disconnected: provider } });\n  });\n\n  /**\n   * GET /api/auth/oauth\n   * List available OAuth providers\n   */\n  oauth.get('/', (c) => {\n    const result = Object.entries(OAUTH_PROVIDERS).map(([id, p]) => ({\n      id,\n      name: p.name,\n    }));\n\n    return c.json({ ok: true, payload: { providers: result } });\n  });\n\n  return oauth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;kBAuB+D;gBACuB;AAGtF,MAAM,kBAA0D;CAC9D,eAAe;CACf,WAAW;CACX,cAAc;CACd,aAAa;CACb,kBAAkB;CAClB,qBAAqBA;CACrB,sBAAsBC;CACtB,gBAAgB;CACjB;AAGD,MAAM,wCAAuD,IAAI,KAAK;AAEtE,SAAS,6BAA6B,UAAgD;AACpF,QAAO,sBAAsB,IAAI,SAAS;;AAG5C,SAAS,2BAA2B,UAAkB,OAA+B;AACnF,uBAAsB,IAAI,UAAU,MAAM;;AAG5C,SAAS,gCAAgC,UAAwB;AAC/D,uBAAsB,OAAO,SAAS;;;AAIxC,SAAgB,4BAA4B,UAAgC;AAE5E,SAAgB,mBAAmB,UAA0B;CAC3D,MAAM,QAAQ,IAAI,MAAM;;;;;AAMxB,OAAM,KAAK,UAAU,OAAO,MAAM;EAChC,MAAM,EAAE,aAAa,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE;AAEzD,MAAI,CAAC,SACH,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EAGvD,MAAM,gBAAgB,gBAAgB;AACtC,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,2BAA2B,YAAY,EAAE,IAAI;AAGtE,MAAI;GACF,IAAI,aAAkB;GACtB,IAAI,sBAAsB;GAsC1B,MAAM,cAAc,MAAM,cAAc,MAAM;IAnC5C,SAAS,SAAiD;AACxD,kBAAa;MAAE,KAAK,KAAK;MAAK,cAAc,KAAK;MAAc;;IAEjE,eAAe,SAAS;AACtB,kBAAa;MACX,KAAK,KAAK;MACV,cAAc,cAAc,KAAK;MACjC,SAAS,QAAQ,KAAK,gBAAgB,kBAAkB,KAAK;MAC7D,YAAY,KAAK;MACjB,iBAAiB,KAAK;MACvB;;IAEH,UAAU,OAAO,WAA+E;AAC9F,kBAAa;MACX,SAAS,OAAO;MAChB,YAAY,OAAO;MACnB,iBAAiB,OAAO;MACzB;AACD,YAAO,OAAO,cAAc;;IAE9B,aAAa,YAAoB;AAC/B,aAAQ,IAAI,mBAAmB,QAAQ;;IAEzC,mBAAmB,YAAY;AAE7B,2BAAsB;AAEtB,YAAO;;IAET,UAAU,OAAO,WAAW;AAE1B,YADsB,OAAO,QAAQ,MAAM,WAAW,OAAO,OAAO,UAChD,EAAE,MAAM,OAAO,QAAQ,IAAI;;IAII,CAAC;AACxD,8BAA2B,UAAU,YAAY;AAGjD,SAAM,IADe,oBACP,CAAC,eAAe,UAAU;IACtC,QAAQ,cAAc,UAAU,YAAY;IAC5C,SAAS,YAAY;IACrB,WAAW,YAAY;IACvB,OAAO,MAAM,QAAQ,YAAY,MAAM,GAAG,YAAY,MAAM,QAAQ,UAA2B,OAAO,UAAU,SAAS,GAAG,KAAA;IAC5H,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC,CAAC;AAEF,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT;KACA,SAAS;KACT,SAAS,YAAY;KACrB,SAAS,YAAY;KACrB,YAAY,YAAY;KACxB,iBAAiB,YAAY;KAC7B,cAAc,YAAY;KAC1B,oBAAoB,cAAc,sBAAsB;KACxD;KACD;IACF,CAAC;WACK,KAAK;AACZ,WAAQ,MAAM,sBAAsB,IAAI;AACxC,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,sBAC7C,EAAE,IAAI;;GAET;;;;;AAMF,OAAM,IAAI,cAAc,OAAO,MAAM;EACnC,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;EACxC,MAAM,cAAc,6BAA6B,SAAS;EAC1D,MAAM,YAAY,MAAM,qBAAqB,SAAS;EACtD,MAAM,aAAa,MAAM,qBAAqB,SAAS;AAEvD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,YAAY,cAAc,CAAC,CAAC;IAC5B,UAAU,UAAU;IACpB,YAAY,UAAU;IACtB,WAAW,UAAU,aAAa,aAAa;IAChD;GACF,CAAC;GACF;;;;;AAMF,OAAM,OAAO,cAAc,OAAO,MAAM;EACtC,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AAExC,kCAAgC,SAAS;AAEzC,QAAM,IADe,oBACP,CAAC,yBAAyB,SAAS;AAEjD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,cAAc,UAAU;GAAE,CAAC;GAChE;;;;;AAMF,OAAM,IAAI,MAAM,MAAM;EACpB,MAAM,SAAS,OAAO,QAAQ,gBAAgB,CAAC,KAAK,CAAC,IAAI,QAAQ;GAC/D;GACA,MAAM,EAAE;GACT,EAAE;AAEH,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,WAAW,QAAQ;GAAE,CAAC;GAC3D;AAEF,QAAO"}

package/dist/src/gateway/hono/routes/activity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"activity.js","names":[],"sources":["../../../../../src/gateway/hono/routes/activity.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { ActivityService } from '../../../activity/index.js';\nimport type { ActivityObjectKind, ActivityVisibility } from '../../../activity/types.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst ACTIVITY_OBJECT_KINDS = new Set<ActivityObjectKind>([\n  'project',\n  'note',\n  'work_item',\n  'session',\n  'goal',\n  'workflow_run',\n  'automation',\n]);\n\nfunction parseActivityVisibility(raw: string | undefined): ActivityVisibility | undefined {\n  return raw === 'timeline' || raw === 'audit' || raw === 'debug' ? raw : undefined;\n}\n\nfunction parseActivityLimit(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const n = Number.parseInt(raw, 10);\n  return Number.isFinite(n) ? Math.min(100, Math.max(1, n)) : undefined;\n}\n\nfunction parseActivityOffset(raw: string | undefined): number | undefined {\n  if (!raw) return undefined;\n  const n = Number.parseInt(raw, 10);\n  return Number.isFinite(n) ? Math.max(0, n) : undefined;\n}\n\nexport function parseActivityQuery(c: {\n  req: { query(name: string): string | undefined };\n}): {\n  visibility?: ActivityVisibility;\n  limit?: number;\n  offset?: number;\n} {\n  return {\n    visibility: parseActivityVisibility(c.req.query('visibility')),\n    limit: parseActivityLimit(c.req.query('limit')),\n    offset: parseActivityOffset(c.req.query('offset')),\n  };\n}\n\nexport function parseActivityIncludeRelated(raw: string | undefined): boolean {\n  return raw === 'true' || raw === '1';\n}\n\nexport function registerActivityRoutes(authenticated: Hono, _deps: AuthenticatedRouteDeps): void {\n  const activity = new ActivityService();\n\n  authenticated.get('/api/activity', (c) => {\n    const result = activity.list(parseActivityQuery(c));\n    return c.json({ ok: true, ...result });\n  });\n\n  authenticated.get('/api/activity/objects/:kind/:id', (c) => {\n    const kind = c.req.param('kind') as ActivityObjectKind;\n    if (!ACTIVITY_OBJECT_KINDS.has(kind)) {\n      return c.json({ ok: false, error: 'Unsupported activity object kind' }, 400);\n    }\n    const id = c.req.param('id').trim();\n    if (!id) return c.json({ ok: false, error: 'Missing activity object id' }, 400);\n    const result = activity.listForObject({\n      object: { kind, id },\n      ...parseActivityQuery(c),\n    });\n    return c.json({ ok: true, ...result });\n  });\n}\n"],"mappings":";;;AAMA,MAAM,wBAAwB,IAAI,IAAwB;CACxD;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,wBAAwB,KAAyD;AACxF,QAAO,QAAQ,cAAc,QAAQ,WAAW,QAAQ,UAAU,MAAM,KAAA;;AAG1E,SAAS,mBAAmB,KAA6C;AACvE,KAAI,CAAC,IAAK,QAAO,KAAA;CACjB,MAAM,IAAI,OAAO,SAAS,KAAK,GAAG;AAClC,QAAO,OAAO,SAAS,EAAE,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,CAAC,GAAG,KAAA;;AAG9D,SAAS,oBAAoB,KAA6C;AACxE,KAAI,CAAC,IAAK,QAAO,KAAA;CACjB,MAAM,IAAI,OAAO,SAAS,KAAK,GAAG;AAClC,QAAO,OAAO,SAAS,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,GAAG,KAAA;;AAG/C,SAAgB,mBAAmB,GAMjC;AACA,QAAO;EACL,YAAY,wBAAwB,EAAE,IAAI,MAAM,aAAa,CAAC;EAC9D,OAAO,mBAAmB,EAAE,IAAI,MAAM,QAAQ,CAAC;EAC/C,QAAQ,oBAAoB,EAAE,IAAI,MAAM,SAAS,CAAC;EACnD;;AAGH,SAAgB,4BAA4B,KAAkC;AAC5E,QAAO,QAAQ,UAAU,QAAQ;;AAGnC,SAAgB,uBAAuB,eAAqB,OAAqC;CAC/F,MAAM,WAAW,IAAI,iBAAiB;AAEtC,eAAc,IAAI,kBAAkB,MAAM;EACxC,MAAM,SAAS,SAAS,KAAK,mBAAmB,EAAE,CAAC;AACnD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,GAAG;GAAQ,CAAC;GACtC;AAEF,eAAc,IAAI,oCAAoC,MAAM;EAC1D,MAAM,OAAO,EAAE,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,sBAAsB,IAAI,KAAK,CAClC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;EAE9E,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,CAAC,MAAM;AACnC,MAAI,CAAC,GAAI,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAA8B,EAAE,IAAI;EAC/E,MAAM,SAAS,SAAS,cAAc;GACpC,QAAQ;IAAE;IAAM;IAAI;GACpB,GAAG,mBAAmB,EAAE;GACzB,CAAC;AACF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,GAAG;GAAQ,CAAC;GACtC"}

package/dist/src/gateway/hono/routes/agent-stream.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-stream.js","names":[],"sources":["../../../../../src/gateway/hono/routes/agent-stream.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport {\n  createAgentResumeHandler,\n  createAgentSSEHandler,\n  createEventsSSEHandler,\n  createSendHandler,\n} from '../sse.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { createGatewayRouteLogger, logRouteWarn } from '../lib/route-logger.js';\n\nconst log = createGatewayRouteLogger('AgentStream');\n\nexport function registerAgentStreamRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware, sseConfig } = deps;\n\n  authenticated.post('/api/agent', strictRateLimitMiddleware, createAgentSSEHandler(sseConfig));\n\n  authenticated.post('/api/agent/resume', strictRateLimitMiddleware, createAgentResumeHandler(sseConfig));\n\n  authenticated.post('/api/agent/abort', strictRateLimitMiddleware, async (c) => {\n    const body = await c.req.json().catch(() => null);\n    const runId =\n      body && typeof body === 'object' && typeof (body as { runId?: unknown }).runId === 'string'\n        ? (body as { runId: string }).runId.trim()\n        : '';\n    if (!runId) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing runId' } },\n        400,\n      );\n    }\n    const aborted = service.abortAgentRun(runId);\n    return c.json({ ok: true, payload: { aborted } });\n  });\n\n  authenticated.post('/api/agent/steer', strictRateLimitMiddleware, async (c) => {\n    const body = await c.req.json().catch(() => null);\n    if (!body || typeof body !== 'object') {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Invalid JSON body' } },\n        400,\n      );\n    }\n    const sessionKey =\n      typeof (body as { sessionKey?: unknown }).sessionKey === 'string'\n        ? (body as { sessionKey: string }).sessionKey.trim()\n        : '';\n    const message =\n      typeof (body as { message?: unknown }).message === 'string'\n        ? (body as { message: string }).message\n        : '';\n    if (!sessionKey) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing sessionKey' } },\n        400,\n      );\n    }\n    const result = await service.steerWebchatAgent(sessionKey, message);\n    if (result.ok === false) {\n      logRouteWarn(log, c, `Agent steer failed: ${result.code}`, 'gateway.route.agent', { sessionKey, code: result.code });\n      const code = result.code;\n      const status = code === 'BAD_REQUEST' ? 400 : code === 'NO_ACTIVE_RUN' ? 409 : 500;\n      const msg =\n        code === 'NO_ACTIVE_RUN'\n              ? 'No active agent run for this session'\n          : code === 'STEER_FAILED'\n            ? 'Steer failed'\n            : 'Message required';\n      return c.json({ ok: false, error: { code, message: msg } }, status);\n    }\n    return c.json({ ok: true, payload: { steered: true } });\n  });\n\n  authenticated.post('/api/clarify/:requestId', strictRateLimitMiddleware, async (c) => {\n    const requestId = c.req.param('requestId')?.trim() ?? '';\n    if (!requestId) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing requestId' } },\n        400,\n      );\n    }\n    const body = await c.req.json().catch(() => null);\n    const skip =\n      body &&\n      typeof body === 'object' &&\n      (body as { skip?: unknown }).skip === true;\n    const rawAnswer =\n      body && typeof body === 'object' && typeof (body as { answer?: unknown }).answer === 'string'\n        ? (body as { answer: string }).answer\n        : '';\n    const answer = typeof rawAnswer === 'string' ? rawAnswer.trim() : '';\n    if (!skip && !answer) {\n      return c.json(\n        { ok: false, error: { code: 'BAD_REQUEST', message: 'Missing answer field' } },\n        400,\n      );\n    }\n    const handled = service.submitClarifyResponse(requestId, skip ? '' : answer);\n    if (!handled) {\n      return c.json(\n        { ok: false, error: { code: 'NOT_FOUND', message: 'No pending clarification with this ID' } },\n        404,\n      );\n    }\n    return c.json({ ok: true, payload: { received: true } });\n  });\n\n  authenticated.post('/api/send', strictRateLimitMiddleware, createSendHandler(sseConfig));\n\n  authenticated.get('/api/events', createEventsSSEHandler(sseConfig));\n}\n"],"mappings":";;;AAWA,MAAM,MAAM,yBAAyB,cAAc;AAEnD,SAAgB,0BAA0B,eAAqB,MAAoC;CACjG,MAAM,EAAE,SAAS,2BAA2B,cAAc;AAE1D,eAAc,KAAK,cAAc,2BAA2B,sBAAsB,UAAU,CAAC;AAE7F,eAAc,KAAK,qBAAqB,2BAA2B,yBAAyB,UAAU,CAAC;AAEvG,eAAc,KAAK,oBAAoB,2BAA2B,OAAO,MAAM;EAC7E,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EACjD,MAAM,QACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAA6B,UAAU,WAC9E,KAA2B,MAAM,MAAM,GACxC;AACN,MAAI,CAAC,MACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAiB;GAAE,EACvE,IACD;EAEH,MAAM,UAAU,QAAQ,cAAc,MAAM;AAC5C,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GACjD;AAEF,eAAc,KAAK,oBAAoB,2BAA2B,OAAO,MAAM;EAC7E,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqB;GAAE,EAC3E,IACD;EAEH,MAAM,aACJ,OAAQ,KAAkC,eAAe,WACpD,KAAgC,WAAW,MAAM,GAClD;EACN,MAAM,UACJ,OAAQ,KAA+B,YAAY,WAC9C,KAA6B,UAC9B;AACN,MAAI,CAAC,WACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAsB;GAAE,EAC5E,IACD;EAEH,MAAM,SAAS,MAAM,QAAQ,kBAAkB,YAAY,QAAQ;AACnE,MAAI,OAAO,OAAO,OAAO;AACvB,gBAAa,KAAK,GAAG,uBAAuB,OAAO,QAAQ,uBAAuB;IAAE;IAAY,MAAM,OAAO;IAAM,CAAC;GACpH,MAAM,OAAO,OAAO;GACpB,MAAM,SAAS,SAAS,gBAAgB,MAAM,SAAS,kBAAkB,MAAM;GAC/E,MAAM,MACJ,SAAS,kBACD,yCACJ,SAAS,iBACP,iBACA;AACR,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;KAAE;KAAM,SAAS;KAAK;IAAE,EAAE,OAAO;;AAErE,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS,MAAM;GAAE,CAAC;GACvD;AAEF,eAAc,KAAK,2BAA2B,2BAA2B,OAAO,MAAM;EACpF,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY,EAAE,MAAM,IAAI;AACtD,MAAI,CAAC,UACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAqB;GAAE,EAC3E,IACD;EAEH,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EACjD,MAAM,OACJ,QACA,OAAO,SAAS,YACf,KAA4B,SAAS;EACxC,MAAM,YACJ,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAA8B,WAAW,WAChF,KAA4B,SAC7B;EACN,MAAM,SAAS,OAAO,cAAc,WAAW,UAAU,MAAM,GAAG;AAClE,MAAI,CAAC,QAAQ,CAAC,OACZ,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAe,SAAS;IAAwB;GAAE,EAC9E,IACD;AAGH,MAAI,CADY,QAAQ,sBAAsB,WAAW,OAAO,KAAK,OACzD,CACV,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;IAAE,MAAM;IAAa,SAAS;IAAyC;GAAE,EAC7F,IACD;AAEH,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,UAAU,MAAM;GAAE,CAAC;GACxD;AAEF,eAAc,KAAK,aAAa,2BAA2B,kBAAkB,UAAU,CAAC;AAExF,eAAc,IAAI,eAAe,uBAAuB,UAAU,CAAC"}

package/dist/src/gateway/hono/routes/agents.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agents.js","names":[],"sources":["../../../../../src/gateway/hono/routes/agents.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { AgentModelsSchema, type Config } from '../../../config/schema.js';\nimport { ToolPolicySetSchema } from '../../../agent-manifest/schema.js';\nimport { getVoiceModelsConfig } from '../../../config/voice.js';\nimport { normalizeAgentId } from '../../../agent/agent-scope.js';\nimport {\n  deleteAgentAvatarFile,\n  finalizeCreateAgentDirs,\n  getGatewayAgentEffectiveManifest,\n  listAgentProfileFiles,\n  listGatewayAgents,\n  prepareCreateAgent,\n  prepareDeleteAgent,\n  prepareUpdateAgent,\n  readAgentAvatarFile,\n  readAgentProfileFile,\n  readUserProfileFile,\n  runAfterDeletePurge,\n  writeAgentAvatarFromBase64,\n  writeAgentProfileFile,\n  writeUserProfileFile,\n  type CreateAgentBody,\n} from '../../agents-admin.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nfunction parseProfileFiles(raw: unknown): Record<string, string> | undefined | { error: string } {\n  if (raw === undefined) {\n    return undefined;\n  }\n  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {\n    return { error: 'profileFiles must be an object' };\n  }\n  const profileFiles: Record<string, string> = {};\n  for (const [name, content] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof content !== 'string') {\n      return { error: `profileFiles[\"${name}\"] must be a string` };\n    }\n    profileFiles[name] = content;\n  }\n  return profileFiles;\n}\n\nfunction isParseError(value: unknown): value is { error: string } {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    'error' in value &&\n    typeof (value as { error: string }).error === 'string'\n  );\n}\n\nfunction parseCreateAgentBody(raw: unknown): CreateAgentBody | { error: string } {\n  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {\n    return { error: 'each agent must be an object' };\n  }\n  const body = raw as Record<string, unknown>;\n  if (Object.hasOwn(body, 'model')) {\n    return { error: 'model is not supported; use models.defaultRole and models.roles' };\n  }\n  if (Object.hasOwn(body, 'toolsDisable')) {\n    return { error: 'toolsDisable was removed; use tools.builtin policies' };\n  }\n  if (Object.hasOwn(body, 'typedModels')) {\n    return { error: 'typedModels is not supported; use models.roles' };\n  }\n  if (Object.hasOwn(body, 'agentDir')) {\n    return { error: 'agentDir was removed from agent manifests' };\n  }\n  if (Object.hasOwn(body, 'name')) {\n    return { error: 'name is not supported; write IDENTITY.md in profileFiles' };\n  }\n  if (Object.hasOwn(body, 'description')) {\n    return { error: 'description is not supported; write IDENTITY.md in profileFiles' };\n  }\n  const workspace = typeof body.workspace === 'string' ? body.workspace : '';\n  const models = Object.hasOwn(body, 'models')\n    ? AgentModelsSchema.safeParse(body.models)\n    : undefined;\n  if (models && !models.success) {\n    return { error: `models ${models.error.issues[0]?.message ?? 'is invalid'}` };\n  }\n  const id = typeof body.id === 'string' ? body.id : undefined;\n  const presetIds = Object.hasOwn(body, 'extends')\n    ? Array.isArray(body.extends)\n      ? body.extends.map((x: unknown) => normalizeAgentId(String(x))).filter(Boolean)\n      : null\n    : undefined;\n  if (presetIds === null) {\n    return { error: 'extends must be an array' };\n  }\n  const skills = Object.hasOwn(body, 'skills')\n    ? Array.isArray(body.skills)\n      ? body.skills.map((x: unknown) => String(x).trim()).filter(Boolean)\n      : null\n    : undefined;\n  if (skills === null) {\n    return { error: 'skills must be an array' };\n  }\n  const toolsRaw = Object.hasOwn(body, 'tools') ? body.tools : undefined;\n  let tools: CreateAgentBody['tools'] | undefined;\n  if (toolsRaw !== undefined) {\n    if (toolsRaw === null || typeof toolsRaw !== 'object' || Array.isArray(toolsRaw)) {\n      return { error: 'tools must be an object' };\n    }\n    const parsedTools = ToolPolicySetSchema.safeParse(toolsRaw);\n    if (!parsedTools.success) {\n      return { error: `tools ${parsedTools.error.issues[0]?.message ?? 'is invalid'}` };\n    }\n    tools = parsedTools.data;\n  }\n  let profileFiles: Record<string, string> | undefined;\n  if (Object.hasOwn(body, 'profileFiles')) {\n    const parsed = parseProfileFiles(body.profileFiles);\n    if (isParseError(parsed)) {\n      return parsed;\n    }\n    profileFiles = parsed;\n  }\n  if (!profileFiles?.['IDENTITY.md'] && typeof body.cloneFrom !== 'string') {\n    return { error: 'profileFiles.IDENTITY.md is required' };\n  }\n  const cloneFrom = typeof body.cloneFrom === 'string' ? body.cloneFrom : undefined;\n  return {\n    workspace,\n    ...(models && models.data !== undefined ? { models: models.data } : {}),\n    ...(id !== undefined ? { id } : {}),\n    ...(presetIds !== undefined ? { extends: presetIds } : {}),\n    ...(skills !== undefined ? { skills } : {}),\n    ...(tools !== undefined ? { tools } : {}),\n    ...(profileFiles !== undefined ? { profileFiles } : {}),\n    ...(cloneFrom !== undefined ? { cloneFrom } : {}),\n  };\n}\n\ntype PatchModels = {\n  defaultRole?: string | null;\n  roles?: Record<string, { model: string; fallbacks?: string[]; description?: string }>;\n};\n\nfunction parsePatchModels(raw: unknown): PatchModels | null | undefined | { error: string } {\n  if (raw === undefined) {\n    return undefined;\n  }\n  if (raw === null) {\n    return null;\n  }\n  if (typeof raw !== 'object' || Array.isArray(raw)) {\n    return { error: 'models must be an object or null' };\n  }\n  const body = raw as Record<string, unknown>;\n  const out: PatchModels = {};\n  if (Object.hasOwn(body, 'defaultRole')) {\n    out.defaultRole = body.defaultRole === null ? null : String(body.defaultRole ?? '').trim();\n  }\n  if (Object.hasOwn(body, 'roles')) {\n    if (body.roles === null) {\n      return { error: 'models.roles must be an object' };\n    } else {\n      const parsed = AgentModelsSchema.safeParse({ roles: body.roles });\n      if (!parsed.success) {\n        return { error: `models.roles ${parsed.error.issues[0]?.message ?? 'is invalid'}` };\n      }\n      out.roles = parsed.data?.roles;\n    }\n  }\n  return out;\n}\n\nexport function registerAgentsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  authenticated.get('/api/agents', async (c) => {\n    const cfg = service.currentConfig as Config;\n    const locale = c.req.query('locale') || c.req.header('Accept-Language')?.split(',')[0]?.trim();\n    const payload = await listGatewayAgents(cfg, { locale });\n    return c.json({ ok: true, payload });\n  });\n\n  authenticated.get('/api/user-profile', async (c) => {\n    const res = await readUserProfileFile();\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: res.data });\n  });\n\n  authenticated.put('/api/user-profile', strictRateLimitMiddleware, async (c) => {\n    let content = '';\n    try {\n      const body = (await c.req.json()) as { content?: unknown };\n      content = typeof body.content === 'string' ? body.content : '';\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const res = await writeUserProfileFile(content);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: res.data });\n  });\n\n  authenticated.post('/api/agents', strictRateLimitMiddleware, async (c) => {\n    let body: Record<string, unknown> = {};\n    try {\n      body = (await c.req.json()) as Record<string, unknown>;\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const parsed = parseCreateAgentBody(body);\n    if ('error' in parsed) {\n      return c.json({ ok: false, error: { message: parsed.error } }, 400);\n    }\n    const prep = prepareCreateAgent(service.currentConfig as Config, parsed);\n    if (prep.ok === false) {\n      return c.json({ ok: false, error: { message: prep.error } }, prep.status ?? 400);\n    }\n    const { nextConfig, agentId } = prep.data;\n    const save = await service.saveConfig(nextConfig);\n    if (!save.saved) {\n      return c.json({ ok: false, error: { message: save.error ?? 'save failed' } }, 500);\n    }\n    const finalized = await finalizeCreateAgentDirs(service.currentConfig as Config, agentId, {\n      ...(parsed.profileFiles !== undefined ? { profileFiles: parsed.profileFiles } : {}),\n      ...(parsed.cloneFrom ? { cloneFrom: parsed.cloneFrom } : {}),\n    });\n    if (finalized.ok === false) {\n      return c.json({ ok: false, error: { message: finalized.error } }, finalized.status ?? 400);\n    }\n    const locale = c.req.query('locale') || c.req.header('Accept-Language')?.split(',')[0]?.trim();\n    const agentsPayload = await listGatewayAgents(service.currentConfig as Config, { locale });\n    return c.json({\n      ok: true,\n      payload: {\n        agentId,\n        agents: agentsPayload,\n      },\n    });\n  });\n\n  authenticated.get('/api/agents/:id/effective-manifest', async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const res = getGatewayAgentEffectiveManifest(service.currentConfig as Config, id);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: res.data });\n  });\n\n  authenticated.patch('/api/agents/:id', strictRateLimitMiddleware, async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    let body: Record<string, unknown> = {};\n    try {\n      body = (await c.req.json()) as Record<string, unknown>;\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    if (Object.hasOwn(body, 'model')) {\n      return c.json({ ok: false, error: { message: 'model is not supported; use models.defaultRole and models.roles' } }, 400);\n    }\n    if (Object.hasOwn(body, 'typedModels')) {\n      return c.json({ ok: false, error: { message: 'typedModels is not supported; use models.roles' } }, 400);\n    }\n    if (Object.hasOwn(body, 'toolsDisable')) {\n      return c.json({ ok: false, error: { message: 'toolsDisable was removed; use tools.builtin policies' } }, 400);\n    }\n    if (Object.hasOwn(body, 'agentDir')) {\n      return c.json({ ok: false, error: { message: 'agentDir was removed from agent manifests' } }, 400);\n    }\n    if (Object.hasOwn(body, 'name')) {\n      return c.json({ ok: false, error: { message: 'name is not supported; edit IDENTITY.md' } }, 400);\n    }\n    if (Object.hasOwn(body, 'description')) {\n      return c.json({ ok: false, error: { message: 'description is not supported; edit IDENTITY.md' } }, 400);\n    }\n    const skillsPatch =\n      body.skills === null\n        ? null\n        : Array.isArray(body.skills)\n          ? body.skills.map((x: unknown) => String(x).trim()).filter(Boolean)\n          : undefined;\n    const extendsPatch = Object.hasOwn(body, 'extends')\n      ? Array.isArray(body.extends)\n        ? body.extends.map((x: unknown) => String(x).trim()).filter(Boolean)\n        : undefined\n      : undefined;\n    if (Object.hasOwn(body, 'extends') && extendsPatch === undefined) {\n      return c.json({ ok: false, error: { message: 'extends must be an array' } }, 400);\n    }\n    let toolsPatch: CreateAgentBody['tools'] | null | undefined;\n    if (Object.hasOwn(body, 'tools')) {\n      if (body.tools === null) {\n        toolsPatch = null;\n      } else if (typeof body.tools === 'object' && !Array.isArray(body.tools)) {\n        const parsedTools = ToolPolicySetSchema.safeParse(body.tools);\n        if (!parsedTools.success) {\n          return c.json({ ok: false, error: { message: `tools ${parsedTools.error.issues[0]?.message ?? 'is invalid'}` } }, 400);\n        }\n        toolsPatch = parsedTools.data;\n      } else {\n        return c.json({ ok: false, error: { message: 'tools must be an object or null' } }, 400);\n      }\n    }\n    const modelsPatch = Object.hasOwn(body, 'models') ? parsePatchModels(body.models) : undefined;\n    if (isParseError(modelsPatch)) {\n      return c.json({ ok: false, error: { message: modelsPatch.error } }, 400);\n    }\n    if (Object.hasOwn(body, 'memory')) {\n      return c.json({ ok: false, error: { message: 'Agent memory configuration is not supported; use userContext' } }, 400);\n    }\n\n    const prep = prepareUpdateAgent(service.currentConfig as Config, id, {\n      workspace: typeof body.workspace === 'string' ? body.workspace : undefined,\n      ...(extendsPatch !== undefined ? { extends: extendsPatch } : {}),\n      ...(modelsPatch !== undefined ? { models: modelsPatch } : {}),\n      setDefault: body.setDefault === true,\n      ...(skillsPatch !== undefined ? { skills: skillsPatch } : {}),\n      ...(toolsPatch !== undefined ? { tools: toolsPatch } : {}),\n    });\n    if (prep.ok === false) {\n      return c.json({ ok: false, error: { message: prep.error } }, prep.status ?? 400);\n    }\n    const save = await service.saveConfig(prep.data.nextConfig);\n    if (!save.saved) {\n      return c.json({ ok: false, error: { message: save.error ?? 'save failed' } }, 500);\n    }\n    const locale = c.req.query('locale') || c.req.header('Accept-Language')?.split(',')[0]?.trim();\n    const agentsPayload = await listGatewayAgents(service.currentConfig as Config, { locale });\n    return c.json({ ok: true, payload: agentsPayload });\n  });\n\n  authenticated.delete('/api/agents/:id', strictRateLimitMiddleware, async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const purge = c.req.query('purge') === '1' || c.req.query('purge') === 'true';\n    const prep = prepareDeleteAgent(service.currentConfig as Config, id);\n    if (prep.ok === false) {\n      return c.json({ ok: false, error: { message: prep.error } }, prep.status ?? 400);\n    }\n    const { nextConfig, agentId } = prep.data;\n    const save = await service.saveConfig(nextConfig);\n    if (!save.saved) {\n      return c.json({ ok: false, error: { message: save.error ?? 'save failed' } }, 500);\n    }\n    if (purge) {\n      await runAfterDeletePurge(service.currentConfig as Config, agentId);\n    }\n    const locale = c.req.query('locale') || c.req.header('Accept-Language')?.split(',')[0]?.trim();\n    const agentsPayload = await listGatewayAgents(service.currentConfig as Config, { locale });\n    return c.json({\n      ok: true,\n      payload: { agentId, purged: purge, agents: agentsPayload },\n    });\n  });\n\n  authenticated.get('/api/agents/:id/avatar', async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const res = await readAgentAvatarFile(service.currentConfig as Config, id);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return new Response(res.data.buffer, {\n      status: 200,\n      headers: {\n        'Content-Type': res.data.contentType,\n        'Cache-Control': 'private, max-age=3600',\n      },\n    });\n  });\n\n  authenticated.put('/api/agents/:id/avatar', strictRateLimitMiddleware, async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    let body: Record<string, unknown> = {};\n    try {\n      body = (await c.req.json()) as Record<string, unknown>;\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const base64 = typeof body.base64 === 'string' ? body.base64 : '';\n    const mimeType = typeof body.mimeType === 'string' ? body.mimeType : '';\n    const res = await writeAgentAvatarFromBase64(service.currentConfig as Config, id, base64, mimeType);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: { agentId: res.data.agentId } });\n  });\n\n  authenticated.delete('/api/agents/:id/avatar', strictRateLimitMiddleware, async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const res = await deleteAgentAvatarFile(service.currentConfig as Config, id);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: { agentId: res.data.agentId } });\n  });\n\n  authenticated.get('/api/agents/:id/files', async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const res = await listAgentProfileFiles(service.currentConfig as Config, id);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: res.data });\n  });\n\n  authenticated.get('/api/agents/:id/files/:name', async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const name = decodeURIComponent(c.req.param('name') ?? '');\n    const res = await readAgentProfileFile(service.currentConfig as Config, id, name);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: { agentId: res.data.agentId, name, content: res.data.content } });\n  });\n\n  authenticated.put('/api/agents/:id/files/:name', strictRateLimitMiddleware, async (c) => {\n    const id = normalizeAgentId(c.req.param('id') ?? '');\n    const name = decodeURIComponent(c.req.param('name') ?? '');\n    let content = '';\n    try {\n      const body = (await c.req.json()) as { content?: unknown };\n      content = typeof body.content === 'string' ? body.content : '';\n    } catch {\n      return c.json({ ok: false, error: { message: 'Invalid JSON' } }, 400);\n    }\n    const res = await writeAgentProfileFile(service.currentConfig as Config, id, name, content);\n    if (res.ok === false) {\n      return c.json({ ok: false, error: { message: res.error } }, res.status ?? 400);\n    }\n    return c.json({ ok: true, payload: { agentId: res.data.agentId, name } });\n  });\n\n  // GET /api/voice/models - Get available STT/TTS models\n  authenticated.get('/api/voice/models', (c) => {\n    const models = getVoiceModelsConfig();\n    return c.json({ ok: true, payload: { models } });\n  });\n\n}\n"],"mappings":";;;;;;eAE2E;aACH;kBAEP;AAqBjE,SAAS,kBAAkB,KAAsE;AAC/F,KAAI,QAAQ,KAAA,EACV;AAEF,KAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAC/D,QAAO,EAAE,OAAO,kCAAkC;CAEpD,MAAM,eAAuC,EAAE;AAC/C,MAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,IAA+B,EAAE;AAC5E,MAAI,OAAO,YAAY,SACrB,QAAO,EAAE,OAAO,iBAAiB,KAAK,sBAAsB;AAE9D,eAAa,QAAQ;;AAEvB,QAAO;;AAGT,SAAS,aAAa,OAA4C;AAChE,QACE,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAQ,MAA4B,UAAU;;AAIlD,SAAS,qBAAqB,KAAmD;AAC/E,KAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAC/D,QAAO,EAAE,OAAO,gCAAgC;CAElD,MAAM,OAAO;AACb,KAAI,OAAO,OAAO,MAAM,QAAQ,CAC9B,QAAO,EAAE,OAAO,mEAAmE;AAErF,KAAI,OAAO,OAAO,MAAM,eAAe,CACrC,QAAO,EAAE,OAAO,wDAAwD;AAE1E,KAAI,OAAO,OAAO,MAAM,cAAc,CACpC,QAAO,EAAE,OAAO,kDAAkD;AAEpE,KAAI,OAAO,OAAO,MAAM,WAAW,CACjC,QAAO,EAAE,OAAO,6CAA6C;AAE/D,KAAI,OAAO,OAAO,MAAM,OAAO,CAC7B,QAAO,EAAE,OAAO,4DAA4D;AAE9E,KAAI,OAAO,OAAO,MAAM,cAAc,CACpC,QAAO,EAAE,OAAO,mEAAmE;CAErF,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;CACxE,MAAM,SAAS,OAAO,OAAO,MAAM,SAAS,GACxC,kBAAkB,UAAU,KAAK,OAAO,GACxC,KAAA;AACJ,KAAI,UAAU,CAAC,OAAO,QACpB,QAAO,EAAE,OAAO,UAAU,OAAO,MAAM,OAAO,IAAI,WAAW,gBAAgB;CAE/E,MAAM,KAAK,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,KAAA;CACnD,MAAM,YAAY,OAAO,OAAO,MAAM,UAAU,GAC5C,MAAM,QAAQ,KAAK,QAAQ,GACzB,KAAK,QAAQ,KAAK,MAAe,iBAAiB,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,QAAQ,GAC7E,OACF,KAAA;AACJ,KAAI,cAAc,KAChB,QAAO,EAAE,OAAO,4BAA4B;CAE9C,MAAM,SAAS,OAAO,OAAO,MAAM,SAAS,GACxC,MAAM,QAAQ,KAAK,OAAO,GACxB,KAAK,OAAO,KAAK,MAAe,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ,GACjE,OACF,KAAA;AACJ,KAAI,WAAW,KACb,QAAO,EAAE,OAAO,2BAA2B;CAE7C,MAAM,WAAW,OAAO,OAAO,MAAM,QAAQ,GAAG,KAAK,QAAQ,KAAA;CAC7D,IAAI;AACJ,KAAI,aAAa,KAAA,GAAW;AAC1B,MAAI,aAAa,QAAQ,OAAO,aAAa,YAAY,MAAM,QAAQ,SAAS,CAC9E,QAAO,EAAE,OAAO,2BAA2B;EAE7C,MAAM,cAAc,oBAAoB,UAAU,SAAS;AAC3D,MAAI,CAAC,YAAY,QACf,QAAO,EAAE,OAAO,SAAS,YAAY,MAAM,OAAO,IAAI,WAAW,gBAAgB;AAEnF,UAAQ,YAAY;;CAEtB,IAAI;AACJ,KAAI,OAAO,OAAO,MAAM,eAAe,EAAE;EACvC,MAAM,SAAS,kBAAkB,KAAK,aAAa;AACnD,MAAI,aAAa,OAAO,CACtB,QAAO;AAET,iBAAe;;AAEjB,KAAI,CAAC,eAAe,kBAAkB,OAAO,KAAK,cAAc,SAC9D,QAAO,EAAE,OAAO,wCAAwC;CAE1D,MAAM,YAAY,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAA;AACxE,QAAO;EACL;EACA,GAAI,UAAU,OAAO,SAAS,KAAA,IAAY,EAAE,QAAQ,OAAO,MAAM,GAAG,EAAE;EACtE,GAAI,OAAO,KAAA,IAAY,EAAE,IAAI,GAAG,EAAE;EAClC,GAAI,cAAc,KAAA,IAAY,EAAE,SAAS,WAAW,GAAG,EAAE;EACzD,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;EACxC,GAAI,iBAAiB,KAAA,IAAY,EAAE,cAAc,GAAG,EAAE;EACtD,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EACjD;;AAQH,SAAS,iBAAiB,KAAkE;AAC1F,KAAI,QAAQ,KAAA,EACV;AAEF,KAAI,QAAQ,KACV,QAAO;AAET,KAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAC/C,QAAO,EAAE,OAAO,oCAAoC;CAEtD,MAAM,OAAO;CACb,MAAM,MAAmB,EAAE;AAC3B,KAAI,OAAO,OAAO,MAAM,cAAc,CACpC,KAAI,cAAc,KAAK,gBAAgB,OAAO,OAAO,OAAO,KAAK,eAAe,GAAG,CAAC,MAAM;AAE5F,KAAI,OAAO,OAAO,MAAM,QAAQ,CAC9B,KAAI,KAAK,UAAU,KACjB,QAAO,EAAE,OAAO,kCAAkC;MAC7C;EACL,MAAM,SAAS,kBAAkB,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC;AACjE,MAAI,CAAC,OAAO,QACV,QAAO,EAAE,OAAO,gBAAgB,OAAO,MAAM,OAAO,IAAI,WAAW,gBAAgB;AAErF,MAAI,QAAQ,OAAO,MAAM;;AAG7B,QAAO;;AAGT,SAAgB,qBAAqB,eAAqB,MAAoC;CAC5F,MAAM,EAAE,SAAS,8BAA8B;AAE/C,eAAc,IAAI,eAAe,OAAO,MAAM;EAC5C,MAAM,MAAM,QAAQ;EAEpB,MAAM,UAAU,MAAM,kBAAkB,KAAK,EAAE,QADhC,EAAE,IAAI,MAAM,SAAS,IAAI,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,EACvC,CAAC;AACxD,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAS,CAAC;GACpC;AAEF,eAAc,IAAI,qBAAqB,OAAO,MAAM;EAClD,MAAM,MAAM,MAAM,qBAAqB;AACvC,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,IAAI;GAAM,CAAC;GAC9C;AAEF,eAAc,IAAI,qBAAqB,2BAA2B,OAAO,MAAM;EAC7E,IAAI,UAAU;AACd,MAAI;GACF,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM;AAChC,aAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;UACtD;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,MAAM,MAAM,qBAAqB,QAAQ;AAC/C,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,IAAI;GAAM,CAAC;GAC9C;AAEF,eAAc,KAAK,eAAe,2BAA2B,OAAO,MAAM;EACxE,IAAI,OAAgC,EAAE;AACtC,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,SAAS,qBAAqB,KAAK;AACzC,MAAI,WAAW,OACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,OAAO;GAAE,EAAE,IAAI;EAErE,MAAM,OAAO,mBAAmB,QAAQ,eAAyB,OAAO;AACxE,MAAI,KAAK,OAAO,MACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,OAAO;GAAE,EAAE,KAAK,UAAU,IAAI;EAElF,MAAM,EAAE,YAAY,YAAY,KAAK;EACrC,MAAM,OAAO,MAAM,QAAQ,WAAW,WAAW;AACjD,MAAI,CAAC,KAAK,MACR,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,SAAS,eAAe;GAAE,EAAE,IAAI;EAEpF,MAAM,YAAY,MAAM,wBAAwB,QAAQ,eAAyB,SAAS;GACxF,GAAI,OAAO,iBAAiB,KAAA,IAAY,EAAE,cAAc,OAAO,cAAc,GAAG,EAAE;GAClF,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,WAAW,GAAG,EAAE;GAC5D,CAAC;AACF,MAAI,UAAU,OAAO,MACnB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,UAAU,OAAO;GAAE,EAAE,UAAU,UAAU,IAAI;EAE5F,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM;EAC9F,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,eAAyB,EAAE,QAAQ,CAAC;AAC1F,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA,QAAQ;IACT;GACF,CAAC;GACF;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,MAAM,iCAAiC,QAAQ,eAAyB,GAAG;AACjF,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,IAAI;GAAM,CAAC;GAC9C;AAEF,eAAc,MAAM,mBAAmB,2BAA2B,OAAO,MAAM;EAC7E,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,IAAI,OAAgC,EAAE;AACtC,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;AAEvE,MAAI,OAAO,OAAO,MAAM,QAAQ,CAC9B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mEAAmE;GAAE,EAAE,IAAI;AAE1H,MAAI,OAAO,OAAO,MAAM,cAAc,CACpC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,kDAAkD;GAAE,EAAE,IAAI;AAEzG,MAAI,OAAO,OAAO,MAAM,eAAe,CACrC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,wDAAwD;GAAE,EAAE,IAAI;AAE/G,MAAI,OAAO,OAAO,MAAM,WAAW,CACjC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6CAA6C;GAAE,EAAE,IAAI;AAEpG,MAAI,OAAO,OAAO,MAAM,OAAO,CAC7B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2CAA2C;GAAE,EAAE,IAAI;AAElG,MAAI,OAAO,OAAO,MAAM,cAAc,CACpC,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,kDAAkD;GAAE,EAAE,IAAI;EAEzG,MAAM,cACJ,KAAK,WAAW,OACZ,OACA,MAAM,QAAQ,KAAK,OAAO,GACxB,KAAK,OAAO,KAAK,MAAe,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ,GACjE,KAAA;EACR,MAAM,eAAe,OAAO,OAAO,MAAM,UAAU,GAC/C,MAAM,QAAQ,KAAK,QAAQ,GACzB,KAAK,QAAQ,KAAK,MAAe,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ,GAClE,KAAA,IACF,KAAA;AACJ,MAAI,OAAO,OAAO,MAAM,UAAU,IAAI,iBAAiB,KAAA,EACrD,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,4BAA4B;GAAE,EAAE,IAAI;EAEnF,IAAI;AACJ,MAAI,OAAO,OAAO,MAAM,QAAQ,CAC9B,KAAI,KAAK,UAAU,KACjB,cAAa;WACJ,OAAO,KAAK,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,MAAM,EAAE;GACvE,MAAM,cAAc,oBAAoB,UAAU,KAAK,MAAM;AAC7D,OAAI,CAAC,YAAY,QACf,QAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,SAAS,YAAY,MAAM,OAAO,IAAI,WAAW,gBAAgB;IAAE,EAAE,IAAI;AAExH,gBAAa,YAAY;QAEzB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,mCAAmC;GAAE,EAAE,IAAI;EAG5F,MAAM,cAAc,OAAO,OAAO,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,GAAG,KAAA;AACpF,MAAI,aAAa,YAAY,CAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,YAAY,OAAO;GAAE,EAAE,IAAI;AAE1E,MAAI,OAAO,OAAO,MAAM,SAAS,CAC/B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,gEAAgE;GAAE,EAAE,IAAI;EAGvH,MAAM,OAAO,mBAAmB,QAAQ,eAAyB,IAAI;GACnE,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAA;GACjE,GAAI,iBAAiB,KAAA,IAAY,EAAE,SAAS,cAAc,GAAG,EAAE;GAC/D,GAAI,gBAAgB,KAAA,IAAY,EAAE,QAAQ,aAAa,GAAG,EAAE;GAC5D,YAAY,KAAK,eAAe;GAChC,GAAI,gBAAgB,KAAA,IAAY,EAAE,QAAQ,aAAa,GAAG,EAAE;GAC5D,GAAI,eAAe,KAAA,IAAY,EAAE,OAAO,YAAY,GAAG,EAAE;GAC1D,CAAC;AACF,MAAI,KAAK,OAAO,MACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,OAAO;GAAE,EAAE,KAAK,UAAU,IAAI;EAElF,MAAM,OAAO,MAAM,QAAQ,WAAW,KAAK,KAAK,WAAW;AAC3D,MAAI,CAAC,KAAK,MACR,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,SAAS,eAAe;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM;EAC9F,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,eAAyB,EAAE,QAAQ,CAAC;AAC1F,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;GAAe,CAAC;GACnD;AAEF,eAAc,OAAO,mBAAmB,2BAA2B,OAAO,MAAM;EAC9E,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,KAAK,OAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;EACvE,MAAM,OAAO,mBAAmB,QAAQ,eAAyB,GAAG;AACpE,MAAI,KAAK,OAAO,MACd,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,OAAO;GAAE,EAAE,KAAK,UAAU,IAAI;EAElF,MAAM,EAAE,YAAY,YAAY,KAAK;EACrC,MAAM,OAAO,MAAM,QAAQ,WAAW,WAAW;AACjD,MAAI,CAAC,KAAK,MACR,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,KAAK,SAAS,eAAe;GAAE,EAAE,IAAI;AAEpF,MAAI,MACF,OAAM,oBAAoB,QAAQ,eAAyB,QAAQ;EAErE,MAAM,SAAS,EAAE,IAAI,MAAM,SAAS,IAAI,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM;EAC9F,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,eAAyB,EAAE,QAAQ,CAAC;AAC1F,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IAAE;IAAS,QAAQ;IAAO,QAAQ;IAAe;GAC3D,CAAC;GACF;AAEF,eAAc,IAAI,0BAA0B,OAAO,MAAM;EACvD,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,MAAM,MAAM,oBAAoB,QAAQ,eAAyB,GAAG;AAC1E,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,IAAI,SAAS,IAAI,KAAK,QAAQ;GACnC,QAAQ;GACR,SAAS;IACP,gBAAgB,IAAI,KAAK;IACzB,iBAAiB;IAClB;GACF,CAAC;GACF;AAEF,eAAc,IAAI,0BAA0B,2BAA2B,OAAO,MAAM;EAClF,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,IAAI,OAAgC,EAAE;AACtC,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;EAC/D,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;EACrE,MAAM,MAAM,MAAM,2BAA2B,QAAQ,eAAyB,IAAI,QAAQ,SAAS;AACnG,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS,IAAI,KAAK,SAAS;GAAE,CAAC;GACnE;AAEF,eAAc,OAAO,0BAA0B,2BAA2B,OAAO,MAAM;EACrF,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,MAAM,MAAM,sBAAsB,QAAQ,eAAyB,GAAG;AAC5E,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,SAAS,IAAI,KAAK,SAAS;GAAE,CAAC;GACnE;AAEF,eAAc,IAAI,yBAAyB,OAAO,MAAM;EACtD,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,MAAM,MAAM,sBAAsB,QAAQ,eAAyB,GAAG;AAC5E,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,IAAI;GAAM,CAAC;GAC9C;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,OAAO,mBAAmB,EAAE,IAAI,MAAM,OAAO,IAAI,GAAG;EAC1D,MAAM,MAAM,MAAM,qBAAqB,QAAQ,eAAyB,IAAI,KAAK;AACjF,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE,SAAS,IAAI,KAAK;IAAS;IAAM,SAAS,IAAI,KAAK;IAAS;GAAE,CAAC;GACpG;AAEF,eAAc,IAAI,+BAA+B,2BAA2B,OAAO,MAAM;EACvF,MAAM,KAAK,iBAAiB,EAAE,IAAI,MAAM,KAAK,IAAI,GAAG;EACpD,MAAM,OAAO,mBAAmB,EAAE,IAAI,MAAM,OAAO,IAAI,GAAG;EAC1D,IAAI,UAAU;AACd,MAAI;GACF,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM;AAChC,aAAU,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;UACtD;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO,EAAE,SAAS,gBAAgB;IAAE,EAAE,IAAI;;EAEvE,MAAM,MAAM,MAAM,sBAAsB,QAAQ,eAAyB,IAAI,MAAM,QAAQ;AAC3F,MAAI,IAAI,OAAO,MACb,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,IAAI,OAAO;GAAE,EAAE,IAAI,UAAU,IAAI;AAEhF,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS;IAAE,SAAS,IAAI,KAAK;IAAS;IAAM;GAAE,CAAC;GACzE;AAGF,eAAc,IAAI,sBAAsB,MAAM;EAC5C,MAAM,SAAS,sBAAsB;AACrC,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM,SAAS,EAAE,QAAQ;GAAE,CAAC;GAChD"}

package/dist/src/gateway/hono/routes/ai-assist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ai-assist.js","names":[],"sources":["../../../../../src/gateway/hono/routes/ai-assist.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { streamSSE } from 'hono/streaming';\n\nimport { assistText, streamTextAssist, type TextAssistRequest } from '../../../ai-assist/text-assist.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport { createGatewayRouteLogger, logRouteError } from '../lib/route-logger.js';\nimport { stringifySSEData } from '../sse-json.js';\n\nconst log = createGatewayRouteLogger('AiAssist');\n\nfunction isTextAssistIntent(value: unknown): boolean {\n  return value === undefined || value === 'improve' || value === 'expand' || value === 'shorten' || value === 'fix';\n}\n\nexport function registerAiAssistRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  authenticated.post('/api/ai/text-assist', strictRateLimitMiddleware, async (c) => {\n    const body = await c.req.json().catch(() => null);\n    if (!body || typeof body !== 'object') {\n      return c.json({ error: { code: 'BAD_REQUEST', message: 'Invalid JSON body' } }, 400);\n    }\n\n    const request = body as TextAssistRequest;\n    if (!isTextAssistIntent(request.intent)) {\n      return c.json({ error: { code: 'BAD_REQUEST', message: 'Invalid intent' } }, 400);\n    }\n    if (request.input !== undefined && typeof request.input !== 'string') {\n      return c.json({ error: { code: 'BAD_REQUEST', message: 'Invalid input' } }, 400);\n    }\n\n    const accept = c.req.header('Accept') || '';\n    const wantSSE = accept.includes('text/event-stream');\n    if (wantSSE) {\n      c.header('X-Accel-Buffering', 'no');\n      return streamSSE(c, async (stream) => {\n        let eventId = 0;\n        const generator = streamTextAssist(request, service.currentConfig, c.req.raw.signal);\n        try {\n          for await (const event of generator) {\n            await stream.writeSSE({\n              id: String(++eventId),\n              event: event.type,\n              data: stringifySSEData(event),\n            });\n          }\n        } catch (err) {\n          logRouteError(log, c, err, 'gateway.route.ai_assist', { operation: 'textAssistStream' });\n          await stream.writeSSE({\n            id: String(++eventId),\n            event: 'error',\n            data: stringifySSEData({\n              type: 'error',\n              message: err instanceof Error ? err.message : 'AI text assist failed',\n            }),\n          });\n        }\n      });\n    }\n\n    try {\n      const result = await assistText(request, service.currentConfig, c.req.raw.signal);\n      return c.json(result);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.ai_assist', { operation: 'textAssist' });\n      return c.json(\n        {\n          error: {\n            code: 'AI_ASSIST_FAILED',\n            message: err instanceof Error ? err.message : 'AI text assist failed',\n          },\n        },\n        500,\n      );\n    }\n  });\n}\n"],"mappings":";;;;;AAQA,MAAM,MAAM,yBAAyB,WAAW;AAEhD,SAAS,mBAAmB,OAAyB;AACnD,QAAO,UAAU,KAAA,KAAa,UAAU,aAAa,UAAU,YAAY,UAAU,aAAa,UAAU;;AAG9G,SAAgB,uBAAuB,eAAqB,MAAoC;CAC9F,MAAM,EAAE,SAAS,8BAA8B;AAE/C,eAAc,KAAK,uBAAuB,2BAA2B,OAAO,MAAM;EAChF,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAC3B,QAAO,EAAE,KAAK,EAAE,OAAO;GAAE,MAAM;GAAe,SAAS;GAAqB,EAAE,EAAE,IAAI;EAGtF,MAAM,UAAU;AAChB,MAAI,CAAC,mBAAmB,QAAQ,OAAO,CACrC,QAAO,EAAE,KAAK,EAAE,OAAO;GAAE,MAAM;GAAe,SAAS;GAAkB,EAAE,EAAE,IAAI;AAEnF,MAAI,QAAQ,UAAU,KAAA,KAAa,OAAO,QAAQ,UAAU,SAC1D,QAAO,EAAE,KAAK,EAAE,OAAO;GAAE,MAAM;GAAe,SAAS;GAAiB,EAAE,EAAE,IAAI;AAKlF,OAFe,EAAE,IAAI,OAAO,SAAS,IAAI,IAClB,SAAS,oBACrB,EAAE;AACX,KAAE,OAAO,qBAAqB,KAAK;AACnC,UAAO,UAAU,GAAG,OAAO,WAAW;IACpC,IAAI,UAAU;IACd,MAAM,YAAY,iBAAiB,SAAS,QAAQ,eAAe,EAAE,IAAI,IAAI,OAAO;AACpF,QAAI;AACF,gBAAW,MAAM,SAAS,UACxB,OAAM,OAAO,SAAS;MACpB,IAAI,OAAO,EAAE,QAAQ;MACrB,OAAO,MAAM;MACb,MAAM,iBAAiB,MAAM;MAC9B,CAAC;aAEG,KAAK;AACZ,mBAAc,KAAK,GAAG,KAAK,2BAA2B,EAAE,WAAW,oBAAoB,CAAC;AACxF,WAAM,OAAO,SAAS;MACpB,IAAI,OAAO,EAAE,QAAQ;MACrB,OAAO;MACP,MAAM,iBAAiB;OACrB,MAAM;OACN,SAAS,eAAe,QAAQ,IAAI,UAAU;OAC/C,CAAC;MACH,CAAC;;KAEJ;;AAGJ,MAAI;GACF,MAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,eAAe,EAAE,IAAI,IAAI,OAAO;AACjF,UAAO,EAAE,KAAK,OAAO;WACd,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,2BAA2B,EAAE,WAAW,cAAc,CAAC;AAClF,UAAO,EAAE,KACP,EACE,OAAO;IACL,MAAM;IACN,SAAS,eAAe,QAAQ,IAAI,UAAU;IAC/C,EACF,EACD,IACD;;GAEH"}

package/dist/src/gateway/hono/routes/auth-registry-extensions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-registry-extensions.js","names":["extensionMarketplace.searchExtensions","extensionMarketplace.listExtensions","extensionMarketplace.fetchRegistry"],"sources":["../../../../../src/gateway/hono/routes/auth-registry-extensions.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { relative, resolve } from 'node:path';\n\nimport type { Config as SurfaceConfig } from '../../../config/config-surface.js';\nimport type { GatewayService } from '../../service.js';\nimport { buildWhenContextSnapshot } from '../../../extensions/when-context.js';\nimport * as extensionMarketplace from '../../../extensions/marketplace.js';\nimport { mergeActivationContext } from '../../../extensions/activation-context.js';\nimport { ActivationPlanner } from '../../../extensions/activation-planner.js';\nimport { getAllModels, getAvailableModels, type Model, type Api } from '../../../providers/index.js';\nimport { createOAuthHandler, loadOAuthCredentialsToCache } from '../oauth.js';\nimport { createOAuthAsyncHandler } from '../oauth-async.js';\nimport { extensionAssetMimeType } from '../lib/extension-assets.js';\nimport { loadExtensionStore, saveExtensionStore } from '../lib/extension-store.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst EXTENSION_ASSET_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self' 'unsafe-inline'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"connect-src 'none'; \" +\n  \"frame-ancestors 'self'; \" +\n  \"frame-src 'none'; \" +\n  \"base-uri 'none'; \" +\n  \"object-src 'none'; \" +\n  \"form-action 'none'\";\n\n/** Sandboxed extension iframes send `Origin: null`; echo it (and real origins) so every status includes ACAO. */\nfunction extensionUiAssetCorsAllowOrigin(c: { req: { header: (name: string) => string | undefined } }): string {\n  const origin = c.req.header('origin');\n  if (origin === 'null') return 'null';\n  if (origin) return origin;\n  return '*';\n}\n\nfunction rewriteExtensionAssetHtml(html: string, extensionId: string, assetPath: string): string {\n  const assetDir = assetPath.includes('/') ? assetPath.slice(0, assetPath.lastIndexOf('/') + 1) : '';\n  const assetBase = `/api/extensions/${extensionId}/assets/${assetDir}`;\n\n  return html\n    .replace(/(<script\\b[^>]*?\\ssrc=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedSrc = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedSrc}${quote} crossorigin=\"anonymous\"`;\n    })\n    .replace(/(<link\\b[^>]*?\\shref=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedHref = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedHref}${quote}`;\n    });\n}\n\nfunction hasNonEmptyConfigSchema(schema: unknown): boolean {\n  if (!schema || typeof schema !== 'object') return false;\n  const properties = (schema as { properties?: unknown }).properties;\n  return Boolean(properties && typeof properties === 'object' && Object.keys(properties).length > 0);\n}\n\n/**\n * Register extension UI asset routes on the public (unauthenticated) app.\n *\n * Sandboxed iframes (`sandbox=\"allow-scripts …\"` without `allow-same-origin`) have an\n * opaque origin of `null`, so sub-resource requests from inside the iframe cannot\n * carry the `?token=` query parameter that was on the parent HTML URL. Putting these\n * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.\n *\n * Security is maintained by the strict Content-Security-Policy returned with every\n * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway\n * console itself from embedding the extension iframes.\n */\nexport function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/extensions/:id/assets/*', async (c) => {\n    const acao = extensionUiAssetCorsAllowOrigin(c);\n    const corsHdr = { 'Access-Control-Allow-Origin': acao } as const;\n\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503, corsHdr);\n    }\n\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext || !ext.manifest.ui) {\n      return c.json({ error: 'Extension not found or has no UI' }, 404, corsHdr);\n    }\n\n    const prefix = `/api/extensions/${extensionId}/assets/`;\n    const assetPathEncoded = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : '';\n    let assetPath = assetPathEncoded;\n    try {\n      assetPath = decodeURIComponent(assetPathEncoded);\n    } catch {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    if (!assetPath || assetPath.includes('..')) {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    const root = resolve(ext.path);\n    const fullPath = resolve(root, assetPath);\n    const rel = relative(root, fullPath);\n    if (rel.startsWith('..') || rel === '') {\n      return c.json({ error: 'Path traversal denied' }, 403, corsHdr);\n    }\n\n    if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n      return c.json({ error: 'Not found' }, 404, corsHdr);\n    }\n\n    const rawContent = readFileSync(fullPath);\n    const mimeType = extensionAssetMimeType(assetPath);\n\n    const body: string | Uint8Array = mimeType.startsWith('text/html')\n      ? rewriteExtensionAssetHtml(rawContent.toString('utf-8'), extensionId, assetPath)\n      : new Uint8Array(rawContent);\n\n    return new Response(body, {\n      status: 200,\n      headers: {\n        'Content-Type': mimeType,\n        'Content-Security-Policy': EXTENSION_ASSET_CSP,\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n        'Access-Control-Allow-Origin': acao,\n      },\n    });\n  });\n}\n\nexport function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  // ========== Auth API (/api/auth) ==========\n\n  // GET /api/auth/token - Get current gateway token\n  authenticated.get('/api/auth/token', (c) => {\n    const authToken = service.getAuthToken();\n    return c.json({ \n      ok: true, \n      payload: { \n        token: authToken,\n        mode: service.getAuthMode(),\n      } \n    });\n  });\n\n  // POST /api/auth/token/refresh - Generate new gateway token\n  authenticated.post('/api/auth/token/refresh', async (c) => {\n    try {\n      const newToken = await service.refreshAuthToken();\n      return c.json({ \n        ok: true, \n        payload: { \n          token: newToken,\n          message: 'Token refreshed successfully. Please update your client configuration.'\n        } \n      });\n    } catch (err) {\n      return c.json({ \n        ok: false, \n        error: err instanceof Error ? err.message : 'Failed to refresh token' \n      }, 500);\n    }\n  });\n\n  // ========== OAuth API (/api/auth/oauth) ==========\n  authenticated.route('/api/auth/oauth', createOAuthHandler(service));\n\n  // ========== Async OAuth API (/api/auth/oauth-async) ==========\n  authenticated.route('/api/auth/oauth-async', createOAuthAsyncHandler(service));\n\n  // Load OAuth credentials from config into cache on startup\n  loadOAuthCredentialsToCache(service);\n\n  // ========== Registry API ==========\n  \n  // GET /api/registry - Full registry for frontend\n  authenticated.get('/api/registry', async (c) => {\n    const allModels = getAllModels();\n    const availableModels = await getAvailableModels();\n    const configured = new Set(availableModels.map(m => `${m.provider}/${m.id}`));\n    \n    // Group models by provider\n    const providerMap = new Map<string, Model<Api>[]>();\n    for (const model of allModels) {\n      const list = providerMap.get(model.provider) ?? [];\n      list.push(model);\n      providerMap.set(model.provider, list);\n    }\n    \n    return c.json({\n      ok: true,\n      payload: {\n        version: 'pi-ai',\n        providers: Array.from(providerMap.entries()).map(([id, models]) => ({\n          id,\n          name: id.charAt(0).toUpperCase() + id.slice(1),\n          configured: models.some(m => configured.has(`${m.provider}/${m.id}`)),\n          models: models.map(m => ({\n            ref: `${m.provider}/${m.id}`,\n            id: m.id,\n            name: m.name,\n            provider: m.provider,\n            reasoning: m.reasoning ?? false,\n            input: m.input ?? ['text'],\n            contextWindow: m.contextWindow ?? 128000,\n            maxTokens: m.maxTokens ?? 4096,\n            cost: {\n              input: m.cost?.input ?? 0,\n              output: m.cost?.output ?? 0,\n            },\n            available: configured.has(`${m.provider}/${m.id}`),\n          })),\n        })),\n      },\n    });\n  });\n\n  // ========== Extension UI (manifest discovery + static assets) ==========\n\n  authenticated.get('/api/extensions', async (c) => {\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ extensions: [] });\n    }\n\n    const registry = loader.getRegistry();\n    const discovered = loader.discoverExtensions();\n    const activeIds = new Set<string>();\n    for (const [id] of registry.extensions) {\n      activeIds.add(id);\n    }\n\n    loader.setConfig(service.currentConfig as unknown as SurfaceConfig);\n    let activationEligibleIds: Set<string> = new Set();\n    try {\n      const planner = new ActivationPlanner(loader.buildManifestRegistry());\n      activationEligibleIds = new Set(\n        planner.getActivatedIds(mergeActivationContext(service.currentConfig as unknown as SurfaceConfig)),\n      );\n    } catch {\n      activationEligibleIds = new Set();\n    }\n\n    const extensions = discovered.map((ext) => ({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      active: activeIds.has(ext.id),\n      activationEligible: activationEligibleIds.has(ext.id),\n      hasUi: Boolean(ext.manifest.ui),\n      hasConfigSchema: hasNonEmptyConfigSchema(ext.manifest.configSchema),\n      ui: ext.manifest.ui\n        ? {\n            icon: ext.manifest.ui.icon,\n            permissions: ext.manifest.ui.permissions,\n            contributions: ext.manifest.ui.contributions,\n          }\n        : undefined,\n    }));\n    return c.json({ extensions });\n  });\n\n  /**\n   * Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.\n   * Body: `{ extensionId: string, enabled: boolean }`\n   */\n  authenticated.post('/api/extensions/bundled/activation', strictRateLimitMiddleware, async (c) => {\n    const body = (await c.req.json().catch(() => null)) as\n      | { extensionId?: unknown; enabled?: unknown }\n      | null;\n    const extensionId =\n      typeof body?.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: { message: 'extensionId is required' } }, 400);\n    }\n    if (typeof body?.enabled !== 'boolean') {\n      return c.json({ ok: false, error: { message: 'enabled must be a boolean' } }, 400);\n    }\n    const result = await service.setBundledExtensionActivationTarget(extensionId, body.enabled);\n    if (!result.ok) {\n      return c.json({ ok: false, error: { message: result.error ?? 'Request failed' } }, 400);\n    }\n    return c.json({\n      ok: true,\n      payload: { requiresGatewayRestart: result.requiresGatewayRestart },\n    });\n  });\n\n  authenticated.get('/api/extensions/:id', async (c) => {\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503);\n    }\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext) {\n      return c.json({ error: 'Extension not found' }, 404);\n    }\n    const registry = loader.getRegistry();\n    return c.json({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      path: ext.path,\n      active: registry.extensions.has(ext.id),\n      manifest: ext.manifest,\n    });\n  });\n\n  authenticated.get('/api/extensions/:id/ui-grant', (c) => {\n    return c.json({ grant: service.localApps.getUiGrant(c.req.param('id')) });\n  });\n\n  authenticated.post('/api/extensions/:id/ui-grant', (c) => {\n    return c.json({ grant: service.localApps.grantUiPermissions(c.req.param('id')) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage', async (c) => {\n    const extensionId = c.req.param('id');\n    const store = await loadExtensionStore(extensionId);\n    return c.json({ keys: Object.keys(store) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    if (!(key in store)) {\n      return c.json({ error: 'Key not found' }, 404);\n    }\n    return c.json({ value: store[key] });\n  });\n\n  authenticated.put('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null;\n    if (body === null || !('value' in body)) {\n      return c.json({ error: 'Request body must contain a \"value\" field' }, 400);\n    }\n    const store = await loadExtensionStore(extensionId);\n    store[key] = body.value;\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.delete('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    delete store[key];\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    return c.json(await loadExtensionStore(`__config__${extensionId}`));\n  });\n\n  authenticated.patch('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    const patch = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;\n    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {\n      return c.json({ error: 'Request body must be a JSON object' }, 400);\n    }\n    const namespace = `__config__${extensionId}`;\n    const config = await loadExtensionStore(namespace);\n    Object.assign(config, patch);\n    await saveExtensionStore(namespace, config);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/context', (c) => {\n    const loader = service.getExtensionLoader();\n    const snapshot = buildWhenContextSnapshot(\n      service.currentConfig as unknown as SurfaceConfig,\n      loader,\n    );\n    return c.json(snapshot);\n  });\n\n  authenticated.get('/api/marketplace', async (c) => {\n    const q = c.req.query('q');\n    const category = c.req.query('category');\n    try {\n      let extensions;\n      if (typeof q === 'string' && q.trim()) {\n        extensions = await extensionMarketplace.searchExtensions(q.trim());\n      } else if (typeof category === 'string' && category.trim()) {\n        extensions = await extensionMarketplace.listExtensions(category.trim());\n      } else {\n        const reg = await extensionMarketplace.fetchRegistry();\n        extensions = reg.extensions;\n      }\n      return c.json({ ok: true, extensions });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          extensions: [],\n          error: err instanceof Error ? err.message : 'marketplace fetch failed',\n        },\n        500,\n      );\n    }\n  });\n\n  authenticated.get('/api/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.fetchExtensionPackageDetail(pkgName);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/install', strictRateLimitMiddleware, async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true || body.overwrite === 'true' || body.overwrite === '1';\n    if (!name) {\n      return c.json(\n        { ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' },\n        400,\n      );\n    }\n    try {\n      const payload = await service.marketplace.installExtension({ name, version, overwrite });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/uninstall', strictRateLimitMiddleware, async (c) => {\n    let body: { extensionId?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const extensionId = typeof body.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: 'Expected { extensionId: string }' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.uninstallExtension(extensionId);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Uninstall failed' },\n        400,\n      );\n    }\n  });\n\n  // POST /api/registry/reload — reload gateway config and refresh model list for clients\n  authenticated.post('/api/registry/reload', async (c) => {\n    try {\n      // Reload config\n      await service.reloadConfig();\n      \n      // Reload OAuth credentials from new config\n      loadOAuthCredentialsToCache(service);\n      \n      const models = getAllModels();\n      \n      // Emit SSE event to all connected clients\n      service.emit('registry.updated', { modelCount: models.length });\n      \n      return c.json({\n        ok: true,\n        payload: {\n          message: 'Registry reloaded',\n          modelCount: models.length,\n        },\n      });\n    } catch (err) {\n      return c.json({\n        error: err instanceof Error ? err.message : 'Failed to reload registry',\n      }, 500);\n    }\n  });\n\n}\n"],"mappings":";;;;;;;;;;;;gBAUqG;AAOrG,MAAM,sBACJ;;AAYF,SAAS,gCAAgC,GAAsE;CAC7G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,KAAI,WAAW,OAAQ,QAAO;AAC9B,KAAI,OAAQ,QAAO;AACnB,QAAO;;AAGT,SAAS,0BAA0B,MAAc,aAAqB,WAA2B;CAE/F,MAAM,YAAY,mBAAmB,YAAY,UADhC,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,UAAU,YAAY,IAAI,GAAG,EAAE,GAAG;AAGhG,QAAO,KACJ,QAAQ,qDAAqD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI/F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GAClD,OAAO,GAAG,YAAY,SACjB,MAAM;GAC5C,CACD,QAAQ,oDAAoD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI9F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GACjD,OAAO,GAAG,YAAY,SACjB;GACvC;;AAGN,SAAS,wBAAwB,QAA0B;AACzD,KAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;CAClD,MAAM,aAAc,OAAoC;AACxD,QAAO,QAAQ,cAAc,OAAO,eAAe,YAAY,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE;;;;;;;;;;;;;;AAepG,SAAgB,mCAAmC,KAAW,SAA+B;AAC3F,KAAI,IAAI,gCAAgC,OAAO,MAAM;EACnD,MAAM,OAAO,gCAAgC,EAAE;EAC/C,MAAM,UAAU,EAAE,+BAA+B,MAAM;EAEvD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,KAAK,QAAQ;EAIlE,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,OAAO,CAAC,IAAI,SAAS,GACxB,QAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,EAAE,KAAK,QAAQ;EAG5E,MAAM,SAAS,mBAAmB,YAAY;EAC9C,MAAM,mBAAmB,EAAE,IAAI,KAAK,WAAW,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,OAAO,OAAO,GAAG;EAC3F,IAAI,YAAY;AAChB,MAAI;AACF,eAAY,mBAAmB,iBAAiB;UAC1C;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;;AAG9D,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,CACxC,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;EAG9D,MAAM,OAAO,QAAQ,IAAI,KAAK;EAC9B,MAAM,WAAW,QAAQ,MAAM,UAAU;EACzC,MAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,IAAI,WAAW,KAAK,IAAI,QAAQ,GAClC,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,KAAK,QAAQ;AAGjE,MAAI,CAAC,WAAW,SAAS,IAAI,CAAC,SAAS,SAAS,CAAC,QAAQ,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,KAAK,QAAQ;EAGrD,MAAM,aAAa,aAAa,SAAS;EACzC,MAAM,WAAW,uBAAuB,UAAU;EAElD,MAAM,OAA4B,SAAS,WAAW,YAAY,GAC9D,0BAA0B,WAAW,SAAS,QAAQ,EAAE,aAAa,UAAU,GAC/E,IAAI,WAAW,WAAW;AAE9B,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,2BAA2B;IAC3B,iBAAiB;IACjB,0BAA0B;IAC1B,+BAA+B;IAChC;GACF,CAAC;GACF;;AAGJ,SAAgB,qCAAqC,eAAqB,MAAoC;CAC5G,MAAM,EAAE,SAAS,8BAA8B;AAK/C,eAAc,IAAI,oBAAoB,MAAM;EAC1C,MAAM,YAAY,QAAQ,cAAc;AACxC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,OAAO;IACP,MAAM,QAAQ,aAAa;IAC5B;GACF,CAAC;GACF;AAGF,eAAc,KAAK,2BAA2B,OAAO,MAAM;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,kBAAkB;AACjD,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,OAAO;KACP,SAAS;KACV;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EAAE,IAAI;;GAET;AAGF,eAAc,MAAM,mBAAmB,mBAAmB,QAAQ,CAAC;AAGnE,eAAc,MAAM,yBAAyB,wBAAwB,QAAQ,CAAC;AAQ9E,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,YAAY,cAAc;EAChC,MAAM,kBAAkB,MAAM,oBAAoB;EAClD,MAAM,aAAa,IAAI,IAAI,gBAAgB,KAAI,MAAK,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;EAG7E,MAAM,8BAAc,IAAI,KAA2B;AACnD,OAAK,MAAM,SAAS,WAAW;GAC7B,MAAM,OAAO,YAAY,IAAI,MAAM,SAAS,IAAI,EAAE;AAClD,QAAK,KAAK,MAAM;AAChB,eAAY,IAAI,MAAM,UAAU,KAAK;;AAGvC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,SAAS;IACT,WAAW,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,aAAa;KAClE;KACA,MAAM,GAAG,OAAO,EAAE,CAAC,aAAa,GAAG,GAAG,MAAM,EAAE;KAC9C,YAAY,OAAO,MAAK,MAAK,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;KACrE,QAAQ,OAAO,KAAI,OAAM;MACvB,KAAK,GAAG,EAAE,SAAS,GAAG,EAAE;MACxB,IAAI,EAAE;MACN,MAAM,EAAE;MACR,UAAU,EAAE;MACZ,WAAW,EAAE,aAAa;MAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;MAC1B,eAAe,EAAE,iBAAiB;MAClC,WAAW,EAAE,aAAa;MAC1B,MAAM;OACJ,OAAO,EAAE,MAAM,SAAS;OACxB,QAAQ,EAAE,MAAM,UAAU;OAC3B;MACD,WAAW,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK;MACnD,EAAE;KACJ,EAAE;IACJ;GACF,CAAC;GACF;AAIF,eAAc,IAAI,mBAAmB,OAAO,MAAM;EAChD,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;EAGnC,MAAM,WAAW,OAAO,aAAa;EACrC,MAAM,aAAa,OAAO,oBAAoB;EAC9C,MAAM,4BAAY,IAAI,KAAa;AACnC,OAAK,MAAM,CAAC,OAAO,SAAS,WAC1B,WAAU,IAAI,GAAG;AAGnB,SAAO,UAAU,QAAQ,cAA0C;EACnE,IAAI,wCAAqC,IAAI,KAAK;AAClD,MAAI;GACF,MAAM,UAAU,IAAI,kBAAkB,OAAO,uBAAuB,CAAC;AACrE,2BAAwB,IAAI,IAC1B,QAAQ,gBAAgB,uBAAuB,QAAQ,cAA0C,CAAC,CACnG;UACK;AACN,2CAAwB,IAAI,KAAK;;EAGnC,MAAM,aAAa,WAAW,KAAK,SAAS;GAC1C,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,QAAQ,UAAU,IAAI,IAAI,GAAG;GAC7B,oBAAoB,sBAAsB,IAAI,IAAI,GAAG;GACrD,OAAO,QAAQ,IAAI,SAAS,GAAG;GAC/B,iBAAiB,wBAAwB,IAAI,SAAS,aAAa;GACnE,IAAI,IAAI,SAAS,KACb;IACE,MAAM,IAAI,SAAS,GAAG;IACtB,aAAa,IAAI,SAAS,GAAG;IAC7B,eAAe,IAAI,SAAS,GAAG;IAChC,GACD,KAAA;GACL,EAAE;AACH,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;;;;;AAMF,eAAc,KAAK,sCAAsC,2BAA2B,OAAO,MAAM;EAC/F,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAGlD,MAAM,cACJ,OAAO,MAAM,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACpE,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2BAA2B;GAAE,EAAE,IAAI;AAElF,MAAI,OAAO,MAAM,YAAY,UAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6BAA6B;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,MAAM,QAAQ,oCAAoC,aAAa,KAAK,QAAQ;AAC3F,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,SAAS,kBAAkB;GAAE,EAAE,IAAI;AAEzF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,wBAAwB,OAAO,wBAAwB;GACnE,CAAC;GACF;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,EAAE,IAAI;EAEtD,MAAM,WAAW,OAAO,aAAa;AACrC,SAAO,EAAE,KAAK;GACZ,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,MAAM,IAAI;GACV,QAAQ,SAAS,WAAW,IAAI,IAAI,GAAG;GACvC,UAAU,IAAI;GACf,CAAC;GACF;AAEF,eAAc,IAAI,iCAAiC,MAAM;AACvD,SAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,UAAU,WAAW,EAAE,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;GACzE;AAEF,eAAc,KAAK,iCAAiC,MAAM;AACxD,SAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,UAAU,mBAAmB,EAAE,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;GACjF;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAE5D,MAAM,QAAQ,MAAM,mBADA,EAAE,IAAI,MAAM,KACkB,CAAC;AACnD,SAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;GAC3C;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,MAAI,EAAE,OAAO,OACX,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AAEhD,SAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,CAAC;GACpC;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAClD,MAAI,SAAS,QAAQ,EAAE,WAAW,MAChC,QAAO,EAAE,KAAK,EAAE,OAAO,+CAA6C,EAAE,IAAI;EAE5E,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,QAAM,OAAO,KAAK;AAClB,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,OAAO,oCAAoC,OAAO,MAAM;EACpE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,SAAO,MAAM;AACb,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,MAAM,mBAAmB,aAAa,cAAc,CAAC;GACnE;AAEF,eAAc,MAAM,8BAA8B,OAAO,MAAM;EAC7D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,QAAS,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACnD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,EAAE,IAAI;EAErE,MAAM,YAAY,aAAa;EAC/B,MAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,SAAO,OAAO,QAAQ,MAAM;AAC5B,QAAM,mBAAmB,WAAW,OAAO;AAC3C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,iBAAiB,MAAM;EACvC,MAAM,SAAS,QAAQ,oBAAoB;EAC3C,MAAM,WAAW,yBACf,QAAQ,eACR,OACD;AACD,SAAO,EAAE,KAAK,SAAS;GACvB;AAEF,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI;EAC1B,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AACxC,MAAI;GACF,IAAI;AACJ,OAAI,OAAO,MAAM,YAAY,EAAE,MAAM,CACnC,cAAa,MAAMA,iBAAsC,EAAE,MAAM,CAAC;YACzD,OAAO,aAAa,YAAY,SAAS,MAAM,CACxD,cAAa,MAAMC,eAAoC,SAAS,MAAM,CAAC;OAGvE,eAAa,MADKC,eAAoC,EACrC;AAEnB,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAY,CAAC;WAChC,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,YAAY,EAAE;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EACD,IACD;;GAEH;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,4BAA4B,QAAQ;AAC9E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,4BAA4B,2BAA2B,OAAO,MAAM;EACrF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,cAAc;AAC7E,MAAI,CAAC,KACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;GAAoE,EACxF,IACD;AAEH,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,iBAAiB;IAAE;IAAM;IAAS;IAAW,CAAC;AACxF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,8BAA8B,2BAA2B,OAAO,MAAM;EACvF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACrF,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;AAE9E,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,mBAAmB,YAAY;AACzE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAoB,EAC7E,IACD;;GAEH;AAGF,eAAc,KAAK,wBAAwB,OAAO,MAAM;AACtD,MAAI;AAEF,SAAM,QAAQ,cAAc;GAK5B,MAAM,SAAS,cAAc;AAG7B,WAAQ,KAAK,oBAAoB,EAAE,YAAY,OAAO,QAAQ,CAAC;AAE/D,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT,YAAY,OAAO;KACpB;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,6BAC7C,EAAE,IAAI;;GAET"}