@xopcai/xopc 0.0.231 → 0.0.232

package/dist/src/gateway/hono/routes/tunnel.js

@@ -1,22 +1,13 @@
 import { init_public_url, validatePublicUrl } from "../../../config/public-url.js";
-import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
-import { loadTunnelState } from "../../../tunnel/tunnel-state.js";
-import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { extractToken } from "../../auth.js";
-import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
-import { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from "../../../tunnel/pairing.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
+import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
-import { applyLanPairingGatewayPatch } from "../../../tunnel/enable-lan-pairing.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
-import { buildMobileConnectUrlOrder, resolveMobilePairLanUrl, validateMobilePairBaseUrl } from "../../../tunnel/pair-url.js";
-import { buildMobilePairContext } from "../../../tunnel/pair-context.js";
-import { consumePairingExchangeFailLimit } from "../../../tunnel/pairing-rate-limit.js";
 import { provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
 //#region src/gateway/hono/routes/tunnel.ts
 init_public_url();
@@ -64,188 +55,17 @@ function createTunnelMutationRateLimitMiddleware() {
 		await next();
 	};
 }
-function registerTunnelPublicRoutes(app, service) {
-	app.get("/api/tunnel/pair/ping", async (c) => {
-		const config = service.currentConfig;
-		const status = getTunnelService().getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json({
-			ok: true,
-			service: "xopc-gateway",
-			mobilePairing: true,
-			port: context.port,
-			bindMode: context.bindMode,
-			listenHost: context.listenHost,
-			pairingReady: context.pairingReady,
-			blockReason: context.blockReason ?? null,
-			tunnelConnected: status.state === "connected",
-			reverseProxyConfigured: Boolean(resolveReverseProxyPublicUrl(config)),
-			connectUrls: context.connectUrls
-		});
-	});
-	app.post("/api/tunnel/pair/validate-url", async (c) => {
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const result = validateMobilePairBaseUrl(typeof body.baseUrl === "string" ? body.baseUrl : "");
-		if (result.ok === false) return c.json({
-			ok: false,
-			code: result.code,
-			message: result.message
-		});
-		return c.json({
-			ok: true,
-			url: result.url,
-			loopback: false,
-			probePath: "/api/tunnel/pair/ping"
-		});
-	});
-	app.post("/api/tunnel/exchange-token", async (c) => {
-		const clientIp = getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 }) ?? "unknown";
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const pairingSecret = typeof body.pairingSecret === "string" ? body.pairingSecret.trim() : "";
-		if (!pairingSecret) return c.json({ error: "pairingSecret required" }, 400);
-		const cached = getCachedPairingExchange(pairingSecret);
-		if (cached) {
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: true,
-				clientIp,
-				phase: "pairing_exchange",
-				replay: true
-			}, "Pairing secret replayed (duplicate mobile exchange)");
-			return c.json(cached);
-		}
-		const token = service.getAuthToken();
-		if (!token) return c.json({ error: "Gateway token not configured" }, 500);
-		const persisted = loadTunnelState();
-		const config = service.currentConfig;
-		const tunnelUrl = persisted?.publicUrl?.trim() || null;
-		const reverseProxyUrl = resolveReverseProxyPublicUrl(config);
-		const lanUrl = resolveMobilePairLanUrl(config);
-		const connectUrls = buildMobileConnectUrlOrder({
-			reverseProxyUrl,
-			baseUrl: reverseProxyUrl ?? tunnelUrl,
-			lanUrl,
-			tunnelUrl
-		});
-		const advertisedBaseUrl = reverseProxyUrl ?? tunnelUrl;
-		const payload = await exchangePairingSecretOnce(pairingSecret, () => ({
-			token,
-			baseUrl: advertisedBaseUrl,
-			lanUrl,
-			connectUrls
-		}));
-		if (!payload) {
-			const limited = consumePairingExchangeFailLimit(clientIp);
-			if (!limited.allowed) c.header("Retry-After", String(Math.ceil(limited.retryAfterMs / 1e3)));
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: false,
-				clientIp,
-				phase: "pairing_exchange"
-			}, "Pairing exchange denied: invalid or expired secret");
-			return c.json({
-				error: "Invalid or expired pairing secret",
-				code: "PAIRING_INVALID"
-			}, 401);
-		}
-		logTunnelAudit("tunnel.exchange_token", {
-			ok: true,
-			clientIp,
-			subdomain: persisted?.subdomain ?? null,
-			phase: "pairing_exchange"
-		}, "Pairing secret exchanged for gateway token");
-		return c.json(payload);
-	});
-}
 function registerTunnelRoutes(authenticated, deps) {
 	const { strictRateLimitMiddleware } = deps;
 	const tunnel = getTunnelService();
 	const tunnelMutationLimit = createTunnelMutationRateLimitMiddleware();
-	authenticated.get("/api/tunnel/pair/context", async (c) => {
-		const config = deps.service.currentConfig;
-		const status = tunnel.getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json(context);
-	});
-	authenticated.post("/api/tunnel/pair/enable-lan", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const config = deps.service.currentConfig;
-		const patchResult = applyLanPairingGatewayPatch(config);
-		if (patchResult.ok === false) return c.json({
-			ok: false,
-			error: {
-				message: patchResult.message,
-				code: "LAN_PAIRING_CONFIG"
-			}
-		}, 400);
-		if (patchResult.changed) {
-			const saveResult = await deps.service.saveConfig(config);
-			if (!saveResult.saved) return c.json({
-				ok: false,
-				error: {
-					message: saveResult.error ?? "Failed to save config",
-					code: "SAVE_FAILED"
-				}
-			}, 500);
-			logTunnelAudit("tunnel.enable_lan_pairing", { gatewayTokenHash: hashGatewayToken(token).slice(0, 12) }, "Gateway bind switched to LAN for mobile pairing");
-		}
-		const status = tunnel.getStatus();
-		let context = buildMobilePairContext({
-			config: deps.service.currentConfig,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(deps.service.currentConfig)
-		});
-		if (patchResult.changed) context = {
-			...context,
-			pairingReady: false,
-			blockReason: "GATEWAY_LOOPBACK_ONLY"
-		};
-		return c.json({
-			ok: true,
-			requiresRestart: patchResult.changed,
-			context
-		});
-	});
-	authenticated.post("/api/tunnel/pair", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const { secret, expiresAt } = createPairingSecret();
-		logTunnelAudit("tunnel.pair", {
-			expiresAt: expiresAt.toISOString(),
-			gatewayTokenHash: hashGatewayToken(token).slice(0, 12)
-		}, "Mobile pairing session created");
-		return c.json({
-			pairingSecret: secret,
-			expiresAt: expiresAt.toISOString()
-		});
-	});
 	/**
 	* Probe a candidate reverse-proxy URL before persisting it. The check round-trips
-	* a `GET /api/tunnel/pair/ping` and validates the response identifies as
+	* a `GET /api/health` and validates the response identifies as
 	* `service: 'xopc-gateway'`. Surface-area errors are mapped to stable codes so
 	* the UI can render targeted hints (TLS / DNS / wrong service / blocked path).
 	*/
-	authenticated.post("/api/tunnel/pair/probe-public", tunnelMutationLimit, async (c) => {
+	authenticated.post("/api/tunnel/probe-public", tunnelMutationLimit, async (c) => {
 		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
 		let body;
 		try {
@@ -263,7 +83,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			code: validation.code,
 			message: validation.message
 		});
-		const pingUrl = `${validation.url}/api/tunnel/pair/ping`;
+		const pingUrl = `${validation.url}/api/health`;
 		const startedAt = Date.now();
 		let response;
 		try {
@@ -305,7 +125,7 @@ function registerTunnelRoutes(authenticated, deps) {
 				message: "Response was not JSON"
 			});
 		}
-		if (!parsed || parsed.service !== "xopc-gateway") return c.json({
+		if (!parsed || parsed.status !== "ok" && parsed.status !== "starting") return c.json({
 			ok: false,
 			code: "NOT_XOPC_GATEWAY",
 			message: "Endpoint did not identify as an xopc gateway"
@@ -314,7 +134,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			ok: true,
 			url: validation.url,
 			latencyMs: Date.now() - startedAt,
-			mobilePairing: parsed.mobilePairing === true
+			gatewayReady: true
 		});
 	});
 	authenticated.get("/api/tunnel/status", async (c) => {
@@ -391,7 +211,7 @@ function registerTunnelRoutes(authenticated, deps) {
 		}
 		const port = config.gateway.port ?? 18790;
 		try {
-			const qr = await tunnel.start(port, token);
+			await tunnel.start(port, token);
 			setTunnelEnabledInConfig(config, true);
 			const saved = await deps.service.saveConfig(config);
 			if (!saved.saved) {
@@ -401,10 +221,8 @@ function registerTunnelRoutes(authenticated, deps) {
 			}
 			const status = tunnel.getStatus();
 			return c.json({
-				publicUrl: qr.publicUrl,
-				subdomain: status.subdomain,
-				qrPayload: qr.qrPayload,
-				lanUrl: qr.lanUrl
+				publicUrl: status.publicUrl,
+				subdomain: status.subdomain
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
@@ -436,13 +254,6 @@ function registerTunnelRoutes(authenticated, deps) {
 			released
 		});
 	});
-	authenticated.get("/api/tunnel/qr", async (c) => {
-		const port = deps.service.currentConfig.gateway.port ?? 18790;
-		const host = resolveGatewayEffectiveHost(deps.service.currentConfig);
-		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
-		const qr = await tunnel.buildQr(port, host);
-		return c.json(qr);
-	});
 	authenticated.get("/api/tunnel/transport-status", async (c) => {
 		return c.json({ transport: { tls: "broker_terminated" } });
 	});
@@ -462,4 +273,4 @@ function registerTunnelRoutes(authenticated, deps) {
 	});
 }
 //#endregion
-export { registerTunnelPublicRoutes, registerTunnelRoutes };
+export { registerTunnelRoutes };

package/dist/src/gateway/image-generation-setup.d.ts

@@ -14,9 +14,9 @@ export declare function getAgentImageGenerationConfig(config: Config, agentIdRaw
     agentId: string;
     model: {
         primary: string;
-        fallbacks?: string[];
+        fallbacks: string[];
+        autoProviderFallback: boolean;
         timeoutMs?: number;
-        autoProviderFallback?: boolean;
     };
 };
 export declare function prepareImageGenerationSetup(config: Config, agentIdRaw: string, input: ImageGenerationSetupInput): {

package/dist/src/gateway/image-generation-setup.js

@@ -1,6 +1,6 @@
 import { ConfigSchema, init_schema } from "../config/schema.js";
 import { init_agent_scope, normalizeAgentId } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentManifestForAgent } from "../config/agent-profile.js";
+import { resolveEffectiveAgentConfigForAgent } from "../config/agent-profile.js";
 import { fetchWithTimeoutGuarded } from "../media-shared/http/provider-http.js";
 import "../media-shared/http/index.js";
 import { getImageGenerationProvider, listImageGenerationProvidersSummary } from "../agent/image/generation/provider-registry.js";
@@ -56,7 +56,7 @@ function getAgentImageGenerationConfig(config, agentIdRaw) {
 	if (!config.agents.list.some((entry) => entry.enabled !== false && normalizeAgentId(entry.id) === agentId)) throw new Error(`Agent not found: ${agentId}`);
 	return {
 		agentId,
-		model: resolveEffectiveAgentManifestForAgent(config, agentId).models.imageGenerationModel ?? null
+		model: resolveEffectiveAgentConfigForAgent(config, agentId).config.models.imageGeneration ?? null
 	};
 }
 function prepareImageGenerationSetup(config, agentIdRaw, input) {
@@ -96,11 +96,12 @@ function prepareImageGenerationSetup(config, agentIdRaw, input) {
 	};
 	const entry = next.agents.list[index];
 	entry.models = {
-		...entry.models ?? {
-			defaultRole: resolveEffectiveAgentManifestForAgent(config, agentId).models.defaultRole,
-			roles: {}
-		},
-		imageGenerationModel: { primary: `${providerId}/${modelId}` }
+		...entry.models ?? {},
+		imageGeneration: {
+			primary: `${providerId}/${modelId}`,
+			fallbacks: [],
+			autoProviderFallback: false
+		}
 	};
 	const parsed = ConfigSchema.safeParse(next);
 	if (!parsed.success) return {

package/dist/src/gateway/public-url.d.ts

@@ -1,7 +1,7 @@
 /**
  * Runtime accessors for `gateway.publicUrl` (the user-deployed reverse-proxy
  * URL). Centralizes the "is it configured?" + "normalized origin" lookup so
- * callers (pair-context, exchange-token, CORS allowlist, UI status) all agree
+ * callers (device access, CORS allowlist, UI status) all agree
  * on the same value.
  */
 import type { Config } from '../config/schema.js';

package/dist/src/gateway/security/gateway-principal.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from 'hono';
+import type { GatewayScope } from './gateway-scopes.js';
+export type GatewayPrincipal = {
+    kind: 'owner' | 'device' | 'trusted-proxy';
+    principalId: string;
+    deviceId?: string;
+    accessSessionId?: string;
+    scopes: readonly GatewayScope[];
+};
+export declare function setGatewayPrincipal(c: Context, principal: GatewayPrincipal): void;
+export declare function getGatewayPrincipal(c: Context): GatewayPrincipal;

package/dist/src/gateway/security/gateway-principal.js

@@ -0,0 +1,12 @@
+//#region src/gateway/security/gateway-principal.ts
+const PRINCIPAL_CONTEXT_KEY = "gatewayPrincipal";
+function setGatewayPrincipal(c, principal) {
+	c.set(PRINCIPAL_CONTEXT_KEY, principal);
+}
+function getGatewayPrincipal(c) {
+	const principal = c.get(PRINCIPAL_CONTEXT_KEY);
+	if (!principal) throw new Error("Gateway principal is unavailable");
+	return principal;
+}
+//#endregion
+export { getGatewayPrincipal, setGatewayPrincipal };

package/dist/src/gateway/security/gateway-scopes.d.ts

@@ -0,0 +1,7 @@
+export declare const GATEWAY_SCOPES: readonly ["gateway.status", "agents.read", "agents.run", "sessions.read", "sessions.write", "workspace.read", "workspace.write", "tasks.read", "tasks.write", "automations.read", "automations.write", "notifications.self", "device.self", "gateway.admin"];
+export type GatewayScope = typeof GATEWAY_SCOPES[number];
+export declare const DEFAULT_MOBILE_SCOPES: readonly GatewayScope[];
+export declare function isGatewayScope(value: unknown): value is GatewayScope;
+export declare function parseGatewayScopes(value: string): GatewayScope[];
+export declare function requiredGatewayScope(method: string, path: string): GatewayScope;
+export declare function hasGatewayScope(granted: readonly GatewayScope[], required: GatewayScope): boolean;

package/dist/src/gateway/security/gateway-scopes.js

@@ -0,0 +1,66 @@
+//#region src/gateway/security/gateway-scopes.ts
+const GATEWAY_SCOPES = [
+	"gateway.status",
+	"agents.read",
+	"agents.run",
+	"sessions.read",
+	"sessions.write",
+	"workspace.read",
+	"workspace.write",
+	"tasks.read",
+	"tasks.write",
+	"automations.read",
+	"automations.write",
+	"notifications.self",
+	"device.self",
+	"gateway.admin"
+];
+const KNOWN_GATEWAY_SCOPES = new Set(GATEWAY_SCOPES);
+const DEFAULT_MOBILE_SCOPES = [
+	"gateway.status",
+	"agents.read",
+	"agents.run",
+	"sessions.read",
+	"sessions.write",
+	"workspace.read",
+	"workspace.write",
+	"tasks.read",
+	"tasks.write",
+	"automations.read",
+	"automations.write",
+	"notifications.self",
+	"device.self"
+];
+function isGatewayScope(value) {
+	return typeof value === "string" && KNOWN_GATEWAY_SCOPES.has(value);
+}
+function parseGatewayScopes(value) {
+	const parsed = JSON.parse(value);
+	if (!Array.isArray(parsed) || !parsed.every(isGatewayScope)) throw new Error("Stored device scopes are invalid");
+	return [...new Set(parsed)];
+}
+function methodScope(method, read, write) {
+	return method === "GET" ? read : write;
+}
+function requiredGatewayScope(method, path) {
+	if (path === "/api/realtime/tickets" || path.startsWith("/api/status")) return "gateway.status";
+	if (path === "/api/device-auth/refresh" || path === "/api/devices/me") return "device.self";
+	if (path.startsWith("/api/devices/me/push")) return "notifications.self";
+	if (path.startsWith("/api/endpoint-tools")) return "device.self";
+	if (path === "/api/agent" || path.startsWith("/api/agent/")) return "agents.run";
+	if (path.startsWith("/api/agents") || path.startsWith("/api/models")) return methodScope(method, "agents.read", "gateway.admin");
+	if (path.startsWith("/api/sessions") || path.startsWith("/api/side-chats")) return methodScope(method, "sessions.read", "sessions.write");
+	if (path.startsWith("/api/tasks")) return methodScope(method, "tasks.read", "tasks.write");
+	if (path.startsWith("/api/home") || path.startsWith("/api/inbox")) return methodScope(method, "tasks.read", "tasks.write");
+	if (path.startsWith("/api/automations") || path.startsWith("/api/automation-runs")) return methodScope(method, "automations.read", "automations.write");
+	if (path.startsWith("/api/workflows")) return methodScope(method, "automations.read", "automations.write");
+	if (path.startsWith("/api/voice") || path.startsWith("/api/media") || path.startsWith("/api/clarify")) return "sessions.write";
+	if (path.startsWith("/api/commands") || path.startsWith("/api/skills")) return methodScope(method, "agents.read", "gateway.admin");
+	if (path.startsWith("/api/workspace") || path.startsWith("/api/files") || path.startsWith("/api/projects") || path.startsWith("/api/notes") || path.startsWith("/api/shares")) return methodScope(method, "workspace.read", "workspace.write");
+	return "gateway.admin";
+}
+function hasGatewayScope(granted, required) {
+	return granted.includes("gateway.admin") || granted.includes(required);
+}
+//#endregion
+export { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope };

package/dist/src/gateway/security/index.d.ts

@@ -2,7 +2,8 @@ export { safeEqualSecret } from './secret-equal.js';
 export { assertGatewayAuthNotKnownWeak, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, } from './known-weak-secrets.js';
 export { checkBrowserOrigin } from './origin-check.js';
 export { computeInlineScriptHashes, buildGatewayConsoleCspHeader } from './csp.js';
-export { ADMIN_SCOPE, READ_SCOPE, WRITE_SCOPE, KNOWN_OPERATOR_SCOPES, DEFAULT_OPERATOR_SCOPES, isOperatorScope, authorizeRouteScope, authorizeScope, parseScopesHeader, type OperatorScope, } from './operator-scopes.js';
+export { GATEWAY_SCOPES, DEFAULT_MOBILE_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope, type GatewayScope, } from './gateway-scopes.js';
+export { getGatewayPrincipal, setGatewayPrincipal, type GatewayPrincipal, } from './gateway-principal.js';
 export { DEFAULT_GATEWAY_HTTP_TOOL_DENY, isDangerousHttpTool, filterDangerousHttpTools, } from './dangerous-tools.js';
 export { createPreauthConnectionBudget, getMaxPreauthConnectionsPerIp, type PreauthConnectionBudget, } from './preauth-connection-budget.js';
 export { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, type SecurityAuditFinding, } from './audit.js';

package/dist/src/gateway/security/index.js

@@ -1,3 +1,4 @@
+import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
 import { safeEqualSecret } from "./secret-equal.js";
 import { KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak } from "./known-weak-secrets.js";
 import { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings } from "./audit.js";
@@ -5,6 +6,6 @@ import { detectSuspiciousPatterns, wrapExternalContent, wrapWebContent } from ".
 import { createPreauthConnectionBudget, getMaxPreauthConnectionsPerIp } from "./preauth-connection-budget.js";
 import { buildGatewayConsoleCspHeader, computeInlineScriptHashes } from "./csp.js";
 import { checkBrowserOrigin } from "./origin-check.js";
-import { ADMIN_SCOPE, DEFAULT_OPERATOR_SCOPES, KNOWN_OPERATOR_SCOPES, READ_SCOPE, WRITE_SCOPE, authorizeRouteScope, authorizeScope, isOperatorScope, parseScopesHeader } from "./operator-scopes.js";
+import { getGatewayPrincipal, setGatewayPrincipal } from "./gateway-principal.js";
 import { DEFAULT_GATEWAY_HTTP_TOOL_DENY, filterDangerousHttpTools, isDangerousHttpTool } from "./dangerous-tools.js";
-export { ADMIN_SCOPE, DEFAULT_GATEWAY_HTTP_TOOL_DENY, DEFAULT_OPERATOR_SCOPES, KNOWN_OPERATOR_SCOPES, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, READ_SCOPE, WRITE_SCOPE, assertGatewayAuthNotKnownWeak, auditGatewayConfig, authorizeRouteScope, authorizeScope, buildGatewayConsoleCspHeader, checkBrowserOrigin, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, computeInlineScriptHashes, createPreauthConnectionBudget, detectSuspiciousPatterns, filterDangerousHttpTools, getMaxPreauthConnectionsPerIp, isDangerousHttpTool, isOperatorScope, parseScopesHeader, safeEqualSecret, wrapExternalContent, wrapWebContent };
+export { DEFAULT_GATEWAY_HTTP_TOOL_DENY, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak, auditGatewayConfig, buildGatewayConsoleCspHeader, checkBrowserOrigin, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, computeInlineScriptHashes, createPreauthConnectionBudget, detectSuspiciousPatterns, filterDangerousHttpTools, getGatewayPrincipal, getMaxPreauthConnectionsPerIp, hasGatewayScope, isDangerousHttpTool, isGatewayScope, parseGatewayScopes, requiredGatewayScope, safeEqualSecret, setGatewayPrincipal, wrapExternalContent, wrapWebContent };

package/dist/src/gateway/service.js

@@ -50,6 +50,12 @@ import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
+import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
+import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
+import "../knowledge/index.js";
+import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
+import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
+import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
@@ -58,14 +64,9 @@ import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
-import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
-import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
-import "../knowledge/index.js";
-import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
-import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
+import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";
 import { NotesStore } from "../notes/store.js";
 import { buildNoteAgentContext } from "../notes/agent-context.js";
@@ -80,7 +81,6 @@ import { EphemeralSideChatManager } from "./side-chat/manager.js";
 import { SideChatRunService } from "./side-chat/run-service.js";
 import "./side-chat/index.js";
 import { wireTunnelEventsToGateway } from "../tunnel/gateway-lifecycle.js";
-import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
 import { getExposureManager } from "../remote-access/exposure-manager.js";
 import { sanitizeTunnelConfig } from "../tunnel/tunnel-config.js";
 import { assertGatewayAuthNotKnownWeak } from "./security/known-weak-secrets.js";

package/dist/src/gateway/xopc-cloud-capability-setup.js

@@ -1,6 +1,6 @@
 import { getModelCatalogStore, init_model_catalog_store } from "../providers/model-catalog-store.js";
 import { compareCatalogModels } from "../providers/model-catalog-ranking.js";
-import { ensureGlobalDefaultsConfig, prepareUpdateGlobalDefaults } from "./global-defaults-admin.js";
+import { prepareUpdateGlobalDefaults } from "./global-defaults-admin.js";
 //#region src/gateway/xopc-cloud-capability-setup.ts
 init_model_catalog_store();
 function supportsCapability(model, capability) {
@@ -49,27 +49,25 @@ function prepareXopcCloudCapabilitySetup(config, source) {
 		missing: selected.missing
 	};
 	const selection = selected.selection;
-	const normalized = ensureGlobalDefaultsConfig(config);
-	const presetId = normalized.agents.defaultPreset;
-	const currentModels = normalized.agents.capabilityPresets[presetId]?.models;
-	const defaultRole = currentModels?.defaultRole ?? "deep";
-	const defaultsUpdate = prepareUpdateGlobalDefaults(normalized, { models: {
-		...currentModels,
-		defaultRole,
-		roles: {
-			...currentModels?.roles ?? {},
-			[defaultRole]: {
-				...currentModels?.roles?.[defaultRole],
-				model: `xopc-cloud/${selection.chat}`
+	const currentModels = config.agents.defaults.models;
+	const defaultsUpdate = prepareUpdateGlobalDefaults(config, { defaults: {
+		...config.agents.defaults,
+		models: {
+			...currentModels,
+			chat: {
+				primary: `xopc-cloud/${selection.chat}`,
+				fallbacks: []
+			},
+			imageUnderstanding: {
+				...currentModels.imageUnderstanding,
+				primary: `xopc-cloud/${selection.vision}`,
+				fallbacks: currentModels.imageUnderstanding?.fallbacks ?? []
+			},
+			imageGeneration: {
+				...currentModels.imageGeneration,
+				primary: `xopc-cloud/${selection.imageGeneration}`,
+				fallbacks: currentModels.imageGeneration?.fallbacks ?? []
 			}
-		},
-		imageModel: {
-			...currentModels?.imageModel,
-			primary: `xopc-cloud/${selection.vision}`
-		},
-		imageGenerationModel: {
-			...currentModels?.imageGenerationModel,
-			primary: `xopc-cloud/${selection.imageGeneration}`
 		}
 	} });
 	if (defaultsUpdate.ok === false) return {

package/dist/src/migrations/index.d.ts

@@ -1,4 +1,3 @@
 export * from './types.js';
 export * from './runner.js';
 export * from './registry.js';
-export * from './config/default-capability-preset.js';

package/dist/src/migrations/index.js

@@ -1,4 +1,3 @@
 import { listRegisteredMigrations, registerMigration, unregisterMigrationsForSource } from "./registry.js";
-import { DEFAULT_CAPABILITY_PRESET_MIGRATION_ID, createDefaultCapabilityPreset, defaultCapabilityPresetMigration, ensureDefaultCapabilityPresetInitialized } from "./config/default-capability-preset.js";
 import { CORE_MIGRATIONS, applyMigrations, detectMigrations, runBootstrapMigrationsSync } from "./runner.js";
-export { CORE_MIGRATIONS, DEFAULT_CAPABILITY_PRESET_MIGRATION_ID, applyMigrations, createDefaultCapabilityPreset, defaultCapabilityPresetMigration, detectMigrations, ensureDefaultCapabilityPresetInitialized, listRegisteredMigrations, registerMigration, runBootstrapMigrationsSync, unregisterMigrationsForSource };
+export { CORE_MIGRATIONS, applyMigrations, detectMigrations, listRegisteredMigrations, registerMigration, runBootstrapMigrationsSync, unregisterMigrationsForSource };

package/dist/src/migrations/runner.js

@@ -2,7 +2,6 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "../config/schema.js";
 import { listRegisteredMigrations } from "./registry.js";
-import { defaultCapabilityPresetMigration } from "./config/default-capability-preset.js";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 //#region src/migrations/runner.ts
@@ -11,7 +10,7 @@ init_logger();
 const log = createLogger("Migrations");
 const MIGRATION_LEDGER_FILENAME = "migrations.json";
 const CONFIG_BACKUP_COUNT = 10;
-const CORE_MIGRATIONS = [...[defaultCapabilityPresetMigration]];
+const CORE_MIGRATIONS = [];
 function listAllMigrations() {
 	return [...CORE_MIGRATIONS, ...listRegisteredMigrations().map((entry) => entry.migration)];
 }

package/dist/src/notifications/device-store.d.ts

@@ -1,6 +1,6 @@
 import { type NotificationDevice, type NotificationDevicePlatform, type NotificationLanguage, type NotificationPermission, type NotificationPreferences } from './types.js';
 export type RegisterNotificationDeviceInput = {
-    id: string;
+    deviceId: string;
     platform: NotificationDevicePlatform;
     pushToken: string;
     permissions: NotificationPermission;