@xopcai/xopc 0.0.230 → 0.0.232

package/dist/src/migrations/config/default-capability-preset.js

@@ -1,133 +0,0 @@
-import { CapabilityPresetSchema, DEFAULT_CAPABILITY_PRESET_ID, init_schema } from "../../agent-manifest/schema.js";
-import { ConfigSchema, init_schema as init_schema$1 } from "../../config/schema.js";
-import { existsSync, readFileSync } from "node:fs";
-//#region src/migrations/config/default-capability-preset.ts
-init_schema();
-init_schema$1();
-const DEFAULT_CAPABILITY_PRESET_MIGRATION_ID = "2026-07-ensure-default-capability-preset";
-function createDefaultCapabilityPreset() {
-	return {
-		id: DEFAULT_CAPABILITY_PRESET_ID,
-		name: "Global defaults",
-		description: "Default capabilities inherited by every agent.",
-		version: 1,
-		models: {
-			defaultRole: "deep",
-			roles: {}
-		}
-	};
-}
-function ensureDefaultCapabilityPresetInitialized(config) {
-	const agents = config.agents;
-	const capabilityPresets = { ...agents.capabilityPresets ?? {} };
-	let changed = false;
-	if (!capabilityPresets["default"]) {
-		capabilityPresets[DEFAULT_CAPABILITY_PRESET_ID] = createDefaultCapabilityPreset();
-		changed = true;
-	}
-	const defaultPreset = agents.defaultPreset?.trim() || "default";
-	if (defaultPreset !== agents.defaultPreset) changed = true;
-	if (!changed) return {
-		config,
-		changed: false
-	};
-	return {
-		config: ConfigSchema.parse({
-			...config,
-			agents: {
-				...agents,
-				defaultPreset,
-				capabilityPresets
-			}
-		}),
-		changed: true
-	};
-}
-function planned(message, details) {
-	return {
-		id: DEFAULT_CAPABILITY_PRESET_MIGRATION_ID,
-		title: "Initialize global default capability preset",
-		kind: "config",
-		safety: "auto",
-		status: "planned",
-		message,
-		details
-	};
-}
-function conflict(message, details) {
-	return {
-		id: DEFAULT_CAPABILITY_PRESET_MIGRATION_ID,
-		title: "Initialize global default capability preset",
-		kind: "config",
-		safety: "manual",
-		status: "conflict",
-		message,
-		details
-	};
-}
-function readRawConfigObject(configPath) {
-	if (!existsSync(configPath)) return null;
-	const raw = readFileSync(configPath, "utf8");
-	const parsed = JSON.parse(raw);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Config root must be an object");
-	return parsed;
-}
-const defaultCapabilityPresetMigration = {
-	id: DEFAULT_CAPABILITY_PRESET_MIGRATION_ID,
-	kind: "config",
-	safety: "auto",
-	detect(ctx) {
-		const raw = readRawConfigObject(ctx.configPath);
-		if (!raw) return null;
-		const rawAgents = raw.agents;
-		if (rawAgents !== void 0 && (rawAgents === null || typeof rawAgents !== "object" || Array.isArray(rawAgents))) return conflict("agents config is not an object; cannot initialize global defaults automatically.");
-		const agents = rawAgents ?? {};
-		const rawPresets = agents.capabilityPresets;
-		if (rawPresets !== void 0 && (rawPresets === null || typeof rawPresets !== "object" || Array.isArray(rawPresets))) return conflict("agents.capabilityPresets is not an object; cannot initialize global defaults automatically.");
-		const existingDefault = (rawPresets ?? {})[DEFAULT_CAPABILITY_PRESET_ID];
-		if (existingDefault !== void 0) {
-			const parsedPreset = CapabilityPresetSchema.safeParse(existingDefault);
-			if (!parsedPreset.success) return conflict("Existing default capability preset is invalid; please repair it manually.", { issues: parsedPreset.error.issues.slice(0, 5).map((issue) => ({
-				path: issue.path.join("."),
-				message: issue.message
-			})) });
-		}
-		const needsDefaultPresetPointer = typeof agents.defaultPreset !== "string" || agents.defaultPreset.trim().length === 0;
-		const needsDefaultPresetObject = existingDefault === void 0;
-		if (!needsDefaultPresetPointer && !needsDefaultPresetObject) return null;
-		return planned("Global default capability preset is missing and will be initialized.", {
-			addDefaultPresetPointer: needsDefaultPresetPointer,
-			addDefaultPresetObject: needsDefaultPresetObject
-		});
-	},
-	apply(ctx) {
-		const detected = this.detect(ctx);
-		if (!detected) return {
-			id: this.id,
-			title: "Initialize global default capability preset",
-			kind: "config",
-			safety: "auto",
-			status: "not_needed",
-			message: "Global default capability preset is already initialized."
-		};
-		if (detected.status === "conflict") return detected;
-		const raw = readRawConfigObject(ctx.configPath);
-		const ensured = ensureDefaultCapabilityPresetInitialized(ConfigSchema.parse(raw ?? void 0));
-		if (!ensured.changed) return {
-			...detected,
-			status: "not_needed",
-			message: "Global default capability preset is already initialized."
-		};
-		return {
-			...detected,
-			status: "applied",
-			message: "Initialized global default capability preset.",
-			details: {
-				...detected.details,
-				config: ensured.config
-			}
-		};
-	}
-};
-//#endregion
-export { DEFAULT_CAPABILITY_PRESET_MIGRATION_ID, createDefaultCapabilityPreset, defaultCapabilityPresetMigration, ensureDefaultCapabilityPresetInitialized };

package/dist/src/tunnel/enable-lan-pairing.d.ts

@@ -1,8 +0,0 @@
-import type { Config } from '../config/schema.js';
-export declare function applyLanPairingGatewayPatch(config: Config): {
-    ok: true;
-    changed: boolean;
-} | {
-    ok: false;
-    message: string;
-};

package/dist/src/tunnel/enable-lan-pairing.js

@@ -1,41 +0,0 @@
-import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../gateway/auth.js";
-import { assertGatewayRuntimeConfig } from "../gateway/runtime-config.js";
-//#region src/tunnel/enable-lan-pairing.ts
-function applyLanPairingGatewayPatch(config) {
-	if (!config.gateway) return {
-		ok: false,
-		message: "Gateway section missing from config"
-	};
-	const previousGateway = JSON.stringify(config.gateway);
-	const nextGateway = {
-		...config.gateway,
-		bind: "lan"
-	};
-	delete nextGateway.customBindHost;
-	const candidate = {
-		...config,
-		gateway: nextGateway
-	};
-	const port = nextGateway.port ?? 18790;
-	try {
-		const auth = resolveGatewayAuth({ authConfig: candidate.gateway.auth });
-		assertGatewayAuthConfigured(auth);
-		assertGatewayRuntimeConfig({
-			cfg: candidate,
-			auth,
-			port
-		});
-	} catch (err) {
-		return {
-			ok: false,
-			message: err instanceof Error ? err.message : String(err)
-		};
-	}
-	config.gateway = candidate.gateway;
-	return {
-		ok: true,
-		changed: previousGateway !== JSON.stringify(config.gateway)
-	};
-}
-//#endregion
-export { applyLanPairingGatewayPatch };

package/dist/src/tunnel/pair-context.d.ts

@@ -1,36 +0,0 @@
-import type { Config } from '../config/schema.js';
-import type { GatewayBindMode } from '../config/schema.js';
-export type MobilePairCandidateKind = 'lan' | 'tunnel' | 'reverse-proxy';
-export type MobilePairBlockReason = 'GATEWAY_LOOPBACK_ONLY' | 'NO_REACHABLE_URL';
-export type MobilePairCandidate = {
-    kind: MobilePairCandidateKind;
-    url: string;
-    label?: string;
-    reachable: boolean;
-    note?: string;
-};
-export type MobilePairContext = {
-    port: number;
-    bindMode: GatewayBindMode;
-    listenHost: string;
-    pairingReady: boolean;
-    blockReason?: MobilePairBlockReason;
-    candidates: MobilePairCandidate[];
-    recommended: {
-        mode: MobilePairCandidateKind | null;
-        url: string | null;
-    };
-    /** Ordered URLs for mobile clients (LAN first when available, then tunnel). */
-    connectUrls: string[];
-};
-export declare function buildMobilePairContext(params: {
-    config: Config;
-    tunnelPublicUrl?: string | null;
-    tunnelConnected?: boolean;
-    /**
-     * Optional override for `gateway.publicUrl`. Falls back to the configured
-     * value when omitted; useful for transient candidates (e.g. UI auto-detect
-     * from `window.location.origin` before the user persists the value).
-     */
-    reverseProxyPublicUrl?: string | null;
-}): MobilePairContext;

package/dist/src/tunnel/pair-context.js

@@ -1,77 +0,0 @@
-import { init_public_url, normalizePublicUrlOrNull } from "../config/public-url.js";
-import { enumerateLanGatewayCandidates } from "../gateway/host.js";
-import { isNetworkAccessibleBindHost, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
-import { buildMobileConnectUrlOrder } from "./pair-url.js";
-//#region src/tunnel/pair-context.ts
-init_public_url();
-function buildMobilePairContext(params) {
-	const port = params.config.gateway?.port ?? 18790;
-	const bindMode = resolveGatewayBindMode(params.config);
-	const listenHost = resolveGatewayEffectiveHost(params.config);
-	const lanListenReady = isNetworkAccessibleBindHost(listenHost);
-	const lanEnumerated = enumerateLanGatewayCandidates(port);
-	const candidates = lanEnumerated.map((entry) => ({
-		kind: "lan",
-		url: entry.url,
-		label: entry.interfaceName,
-		reachable: lanListenReady,
-		...lanListenReady ? {} : { note: "requires_lan_bind" }
-	}));
-	const tunnelUrl = params.tunnelPublicUrl?.trim() || null;
-	const tunnelConnected = params.tunnelConnected === true && Boolean(tunnelUrl);
-	if (tunnelConnected && tunnelUrl) candidates.unshift({
-		kind: "tunnel",
-		url: tunnelUrl,
-		reachable: true
-	});
-	const configuredReverseProxy = normalizePublicUrlOrNull(params.config.gateway?.publicUrl);
-	const reverseProxyUrl = params.reverseProxyPublicUrl !== void 0 ? normalizePublicUrlOrNull(params.reverseProxyPublicUrl) : configuredReverseProxy;
-	if (reverseProxyUrl) candidates.unshift({
-		kind: "reverse-proxy",
-		url: reverseProxyUrl,
-		reachable: true
-	});
-	let recommended = {
-		mode: null,
-		url: null
-	};
-	if (reverseProxyUrl) recommended = {
-		mode: "reverse-proxy",
-		url: reverseProxyUrl
-	};
-	else if (tunnelConnected && tunnelUrl) recommended = {
-		mode: "tunnel",
-		url: tunnelUrl
-	};
-	else if (lanListenReady && lanEnumerated[0]) recommended = {
-		mode: "lan",
-		url: lanEnumerated[0].url
-	};
-	else if (lanEnumerated[0]) recommended = {
-		mode: "lan",
-		url: lanEnumerated[0].url
-	};
-	const pairingReady = Boolean(reverseProxyUrl || tunnelConnected || lanListenReady && lanEnumerated.length > 0);
-	let blockReason;
-	if (!pairingReady) blockReason = !lanListenReady && !tunnelConnected ? "GATEWAY_LOOPBACK_ONLY" : "NO_REACHABLE_URL";
-	const lanUrlForConnect = lanListenReady && lanEnumerated[0] ? lanEnumerated[0].url : null;
-	const hasUpstream = Boolean(reverseProxyUrl) || tunnelConnected;
-	const connectUrls = buildMobileConnectUrlOrder({
-		reverseProxyUrl,
-		baseUrl: reverseProxyUrl ? reverseProxyUrl : tunnelConnected && tunnelUrl ? tunnelUrl : lanListenReady && recommended.url ? recommended.url : null,
-		lanUrl: hasUpstream ? lanUrlForConnect : null,
-		tunnelUrl: tunnelConnected ? tunnelUrl : null
-	});
-	return {
-		port,
-		bindMode,
-		listenHost,
-		pairingReady,
-		...blockReason ? { blockReason } : {},
-		candidates,
-		recommended,
-		connectUrls
-	};
-}
-//#endregion
-export { buildMobilePairContext };

package/dist/src/tunnel/pair-url.d.ts

@@ -1,43 +0,0 @@
-import type { Config } from '../config/schema.js';
-export type MobilePairUrlValidationCode = 'INVALID_URL' | 'LOOPBACK_NOT_REACHABLE';
-export type MobilePairUrlValidationResult = {
-    ok: true;
-    url: string;
-    loopback: false;
-} | {
-    ok: false;
-    code: MobilePairUrlValidationCode;
-    message: string;
-};
-/** Normalize a gateway root URL (no trailing slash, no path). */
-export declare function normalizeGatewayBaseUrl(raw: string): string | null;
-/** True when a phone on the network cannot reach this gateway root URL. */
-export declare function isLoopbackGatewayBaseUrl(raw: string): boolean;
-export declare function validateMobilePairBaseUrl(raw: string): MobilePairUrlValidationResult;
-export type ParsedMobileConnectDeepLink = {
-    baseUrl: string;
-    lanUrl: string | null;
-    pairingSecret: string;
-};
-/** Parse `xopc://gateway/mobile-connect?...` payloads from QR codes. */
-export declare function parseMobileConnectDeepLink(raw: string): ParsedMobileConnectDeepLink | null;
-/**
- * Ordered URLs for mobile clients. Priority:
- *   1. reverse-proxy public URL (user-deployed HTTPS, typically fastest + works on cellular)
- *   2. LAN URL (zero-RTT on same network)
- *   3. baseUrl (legacy: usually the FRP tunnel public URL, kept for callers that
- *      do not yet split reverseProxyUrl from tunnelUrl)
- *   4. tunnelUrl (explicit FRP tunnel URL, kept as a fallback even when a
- *      reverse-proxy URL is also configured)
- *
- * Loopback URLs are dropped (they only work on the gateway host) and
- * duplicates are de-duped while preserving first occurrence order.
- */
-export declare function buildMobileConnectUrlOrder(params: {
-    baseUrl: string | null | undefined;
-    lanUrl: string | null | undefined;
-    reverseProxyUrl?: string | null | undefined;
-    tunnelUrl?: string | null | undefined;
-}): string[];
-/** First LAN URL when the gateway listens on a network-accessible bind host. */
-export declare function resolveMobilePairLanUrl(config: Config): string | null;

package/dist/src/tunnel/pair-url.js

@@ -1,117 +0,0 @@
-import { enumerateLanGatewayCandidates } from "../gateway/host.js";
-import { isNetworkAccessibleBindHost, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
-import net from "node:net";
-//#region src/tunnel/pair-url.ts
-/** Normalize a gateway root URL (no trailing slash, no path). */
-function normalizeGatewayBaseUrl(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return null;
-	try {
-		const u = new URL(trimmed);
-		if (u.protocol !== "http:" && u.protocol !== "https:") return null;
-		if (u.username || u.password) return null;
-		if (u.pathname && u.pathname !== "/") return null;
-		if (u.search || u.hash) return null;
-		const portSuffix = u.port ? `:${u.port}` : "";
-		return `${u.protocol}//${u.hostname}${portSuffix}`;
-	} catch {
-		return null;
-	}
-}
-/** True when a phone on the network cannot reach this gateway root URL. */
-function isLoopbackGatewayBaseUrl(raw) {
-	const normalized = normalizeGatewayBaseUrl(raw);
-	if (!normalized) return false;
-	try {
-		const host = new URL(normalized).hostname.trim().toLowerCase();
-		if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]") return true;
-		if (net.isIP(host) === 4) {
-			const parts = host.split(".").map((p) => Number(p));
-			if (parts.length === 4 && parts.every((n) => Number.isInteger(n)) && parts[0] === 127) return true;
-		}
-		return false;
-	} catch {
-		return false;
-	}
-}
-function validateMobilePairBaseUrl(raw) {
-	const url = normalizeGatewayBaseUrl(raw);
-	if (!url) return {
-		ok: false,
-		code: "INVALID_URL",
-		message: "Enter an absolute gateway URL starting with http:// or https:// (no path)."
-	};
-	if (isLoopbackGatewayBaseUrl(url)) return {
-		ok: false,
-		code: "LOOPBACK_NOT_REACHABLE",
-		message: "127.0.0.1 and localhost only work on the gateway machine. Use a LAN IP or tunnel URL instead."
-	};
-	return {
-		ok: true,
-		url,
-		loopback: false
-	};
-}
-/** Parse `xopc://gateway/mobile-connect?...` payloads from QR codes. */
-function parseMobileConnectDeepLink(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return null;
-	try {
-		const u = new URL(trimmed);
-		if (u.protocol !== "xopc:" || u.hostname !== "gateway" || u.pathname !== "/mobile-connect") return null;
-		const baseUrl = u.searchParams.get("baseUrl")?.trim() ?? "";
-		const psRaw = u.searchParams.get("ps")?.trim() ?? "";
-		let pairingSecret = psRaw;
-		if (psRaw) try {
-			pairingSecret = decodeURIComponent(psRaw);
-		} catch {
-			pairingSecret = psRaw;
-		}
-		if (!baseUrl || !pairingSecret) return null;
-		const lanRaw = u.searchParams.get("lanUrl")?.trim() ?? "";
-		const lanUrl = lanRaw ? normalizeGatewayBaseUrl(lanRaw) : null;
-		const normalizedBase = normalizeGatewayBaseUrl(baseUrl);
-		if (!normalizedBase) return null;
-		return {
-			baseUrl: normalizedBase,
-			lanUrl,
-			pairingSecret
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* Ordered URLs for mobile clients. Priority:
-*   1. reverse-proxy public URL (user-deployed HTTPS, typically fastest + works on cellular)
-*   2. LAN URL (zero-RTT on same network)
-*   3. baseUrl (legacy: usually the FRP tunnel public URL, kept for callers that
-*      do not yet split reverseProxyUrl from tunnelUrl)
-*   4. tunnelUrl (explicit FRP tunnel URL, kept as a fallback even when a
-*      reverse-proxy URL is also configured)
-*
-* Loopback URLs are dropped (they only work on the gateway host) and
-* duplicates are de-duped while preserving first occurrence order.
-*/
-function buildMobileConnectUrlOrder(params) {
-	const ordered = [];
-	const seen = /* @__PURE__ */ new Set();
-	const push = (raw) => {
-		const url = raw ? normalizeGatewayBaseUrl(raw) : null;
-		if (!url || isLoopbackGatewayBaseUrl(url) || seen.has(url)) return;
-		seen.add(url);
-		ordered.push(url);
-	};
-	push(params.reverseProxyUrl);
-	push(params.lanUrl);
-	push(params.baseUrl);
-	push(params.tunnelUrl);
-	return ordered;
-}
-/** First LAN URL when the gateway listens on a network-accessible bind host. */
-function resolveMobilePairLanUrl(config) {
-	if (!isNetworkAccessibleBindHost(resolveGatewayEffectiveHost(config))) return null;
-	return enumerateLanGatewayCandidates(config.gateway?.port ?? 18790)[0]?.url ?? null;
-}
-//#endregion
-export { buildMobileConnectUrlOrder, isLoopbackGatewayBaseUrl, normalizeGatewayBaseUrl, parseMobileConnectDeepLink, resolveMobilePairLanUrl, validateMobilePairBaseUrl };

package/dist/src/tunnel/pairing-rate-limit.d.ts

@@ -1,12 +0,0 @@
-export type PairingFailureLimitResult = {
-    allowed: boolean;
-    retryAfterMs: number;
-};
-/**
- * Records a failed pairing exchange and returns whether subsequent attempts
- * are still permitted. Called from the route handler on every invalid /
- * expired pairing secret — successful exchanges do NOT call this.
- */
-export declare function consumePairingExchangeFailLimit(clientKey: string): PairingFailureLimitResult;
-/** @internal */
-export declare function resetPairingExchangeLimitsForTests(): void;

package/dist/src/tunnel/pairing-rate-limit.js

@@ -1,28 +0,0 @@
-import { buckets } from "../gateway/rate-limit/buckets.js";
-import "../gateway/rate-limit/index.js";
-//#region src/tunnel/pairing-rate-limit.ts
-/**
-* Records a failed pairing exchange and returns whether subsequent attempts
-* are still permitted. Called from the route handler on every invalid /
-* expired pairing secret — successful exchanges do NOT call this.
-*/
-function consumePairingExchangeFailLimit(clientKey) {
-	const fl = buckets.pairingExchange();
-	const key = clientKey.trim() || "unknown";
-	fl.fail(key);
-	const status = fl.check(key);
-	if (status.blocked) return {
-		allowed: false,
-		retryAfterMs: status.retryAfterSec * 1e3
-	};
-	return {
-		allowed: true,
-		retryAfterMs: 0
-	};
-}
-/** @internal */
-function resetPairingExchangeLimitsForTests() {
-	buckets.pairingExchange().resetForTests();
-}
-//#endregion
-export { consumePairingExchangeFailLimit, resetPairingExchangeLimitsForTests };

package/dist/src/tunnel/pairing.d.ts

@@ -1,21 +0,0 @@
-export type PairingSecretResult = {
-    secret: string;
-    expiresAt: Date;
-};
-export type PairingExchangePayload = {
-    token: string;
-    baseUrl: string | null;
-    lanUrl: string | null;
-    connectUrls: string[];
-};
-export declare function cachePairingExchange(secret: string, payload: PairingExchangePayload): void;
-export declare function getCachedPairingExchange(secret: string): PairingExchangePayload | null;
-/**
- * Consume a pairing secret once and build the exchange payload.
- * Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).
- */
-export declare function exchangePairingSecretOnce(secret: string, buildPayload: () => PairingExchangePayload): Promise<PairingExchangePayload | null>;
-export declare function createPairingSecret(): PairingSecretResult;
-export declare function consumePairingSecret(secret: string): boolean;
-/** @internal */
-export declare function resetPairingSessionsForTests(): void;

package/dist/src/tunnel/pairing.js

@@ -1,103 +0,0 @@
-import { createLogger } from "../utils/logger/index.js";
-import { init_logger } from "../utils/logger.js";
-import { randomBytes } from "node:crypto";
-//#region src/tunnel/pairing.ts
-init_logger();
-const log = createLogger("TunnelPairing");
-const PAIRING_TTL_MS = 5 * 6e4;
-const CLEANUP_INTERVAL_MS = 6e4;
-const sessions = /* @__PURE__ */ new Map();
-let cleanupTimer = null;
-function ensureCleanupTimer() {
-	if (cleanupTimer) return;
-	cleanupTimer = setInterval(() => {
-		const now = Date.now();
-		for (const [key, session] of sessions) if (now > session.expiresAt.getTime()) sessions.delete(key);
-	}, CLEANUP_INTERVAL_MS);
-	cleanupTimer.unref?.();
-}
-const EXCHANGE_REPLAY_MS = 6e4;
-const exchangeReplayCache = /* @__PURE__ */ new Map();
-function cachePairingExchange(secret, payload) {
-	exchangeReplayCache.set(secret, {
-		expiresAt: Date.now() + EXCHANGE_REPLAY_MS,
-		payload
-	});
-}
-function getCachedPairingExchange(secret) {
-	const entry = exchangeReplayCache.get(secret);
-	if (!entry) return null;
-	if (Date.now() > entry.expiresAt) {
-		exchangeReplayCache.delete(secret);
-		return null;
-	}
-	return entry.payload;
-}
-const inflightExchanges = /* @__PURE__ */ new Map();
-/**
-* Consume a pairing secret once and build the exchange payload.
-* Concurrent requests for the same secret share one in-flight exchange (mobile cold-start deeplink).
-*/
-async function exchangePairingSecretOnce(secret, buildPayload) {
-	const key = secret.trim();
-	if (!key) return null;
-	const replay = getCachedPairingExchange(key);
-	if (replay) return replay;
-	let inflight = inflightExchanges.get(key);
-	if (!inflight) {
-		inflight = (async () => {
-			const cached = getCachedPairingExchange(key);
-			if (cached) return cached;
-			if (!consumePairingSecret(key)) return getCachedPairingExchange(key);
-			const payload = buildPayload();
-			cachePairingExchange(key, payload);
-			return payload;
-		})();
-		inflightExchanges.set(key, inflight);
-	}
-	try {
-		return await inflight;
-	} finally {
-		if (inflightExchanges.get(key) === inflight) inflightExchanges.delete(key);
-	}
-}
-function createPairingSecret() {
-	ensureCleanupTimer();
-	const secret = randomBytes(32).toString("base64url");
-	const expiresAt = new Date(Date.now() + PAIRING_TTL_MS);
-	sessions.set(secret, {
-		expiresAt,
-		consumed: false
-	});
-	log.info({ expiresAt: expiresAt.toISOString() }, "Pairing session created");
-	return {
-		secret,
-		expiresAt
-	};
-}
-function consumePairingSecret(secret) {
-	if (!secret.trim()) return false;
-	const session = sessions.get(secret);
-	if (!session) return false;
-	if (session.consumed) return false;
-	if (Date.now() > session.expiresAt.getTime()) {
-		sessions.delete(secret);
-		return false;
-	}
-	session.consumed = true;
-	sessions.delete(secret);
-	log.info("Pairing session consumed");
-	return true;
-}
-/** @internal */
-function resetPairingSessionsForTests() {
-	sessions.clear();
-	exchangeReplayCache.clear();
-	inflightExchanges.clear();
-	if (cleanupTimer) {
-		clearInterval(cleanupTimer);
-		cleanupTimer = null;
-	}
-}
-//#endregion
-export { cachePairingExchange, consumePairingSecret, createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange, resetPairingSessionsForTests };

package/dist/src/tunnel/tunnel-qr.d.ts

@@ -1,9 +0,0 @@
-import type { TunnelQrPayload } from './tunnel-types.js';
-/** First non-internal IPv4 suitable for LAN QR (when gateway listens on 0.0.0.0). */
-export declare function resolveLanGatewayUrl(gatewayHost: string, gatewayPort: number): string | null;
-export declare function buildMobileConnectQrPayload(input: {
-    publicUrl: string;
-    lanUrl: string | null;
-    pairingSecret: string;
-    expiresAt?: string;
-}): TunnelQrPayload;

package/dist/src/tunnel/tunnel-qr.js

@@ -1,29 +0,0 @@
-import { enumerateLanGatewayCandidates } from "../gateway/host.js";
-//#region src/tunnel/tunnel-qr.ts
-function trimBase(raw) {
-	return raw.trim().replace(/\/+$/, "");
-}
-/** First non-internal IPv4 suitable for LAN QR (when gateway listens on 0.0.0.0). */
-function resolveLanGatewayUrl(gatewayHost, gatewayPort) {
-	const host = gatewayHost.trim().toLowerCase();
-	if (host === "127.0.0.1" || host === "localhost" || host === "::1") return null;
-	let ip;
-	if (host === "0.0.0.0" || host === "::" || host === "") ip = enumerateLanGatewayCandidates(gatewayPort)[0]?.address;
-	else if (!host.includes(":")) ip = host;
-	if (!ip) return null;
-	return trimBase(`http://${ip}:${gatewayPort}`);
-}
-function buildMobileConnectQrPayload(input) {
-	const params = new URLSearchParams();
-	params.set("baseUrl", input.publicUrl);
-	if (input.lanUrl) params.set("lanUrl", input.lanUrl);
-	if (input.pairingSecret) params.set("ps", input.pairingSecret);
-	return {
-		qrPayload: `xopc://gateway/mobile-connect?${params.toString()}`,
-		publicUrl: input.publicUrl,
-		lanUrl: input.lanUrl,
-		expiresAt: input.expiresAt
-	};
-}
-//#endregion
-export { buildMobileConnectQrPayload, resolveLanGatewayUrl };