@xopcai/xopc 0.0.231 → 0.0.233

package/dist/src/gateway/hono/routes/agents.js

@@ -1,83 +1,40 @@
-import { ToolPolicySetSchema, init_schema } from "../../../agent-manifest/schema.js";
-import { AgentModelsSchema, init_schema as init_schema$1 } from "../../../config/schema.js";
+import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
+import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveManifest, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
-init_schema$1();
-init_schema();
+init_agent_config();
 init_agent_scope();
-function parseProfileFiles(raw) {
-	if (raw === void 0) return;
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "profileFiles must be an object" };
-	const profileFiles = {};
-	for (const [name, content] of Object.entries(raw)) {
-		if (typeof content !== "string") return { error: `profileFiles["${name}"] must be a string` };
-		profileFiles[name] = content;
-	}
-	return profileFiles;
-}
 function isParseError(value) {
 	return typeof value === "object" && value !== null && "error" in value && typeof value.error === "string";
 }
 function parseCreateAgentBody(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "each agent must be an object" };
 	const body = raw;
-	if (Object.hasOwn(body, "model")) return { error: "model is not supported; use models.defaultRole and models.roles" };
-	if (Object.hasOwn(body, "toolsDisable")) return { error: "toolsDisable was removed; use tools.builtin policies" };
-	if (Object.hasOwn(body, "typedModels")) return { error: "typedModels is not supported; use models.roles" };
-	if (Object.hasOwn(body, "agentDir")) return { error: "agentDir was removed from agent manifests" };
-	if (Object.hasOwn(body, "name")) return { error: "name is not supported; write IDENTITY.md in profileFiles" };
-	if (Object.hasOwn(body, "description")) return { error: "description is not supported; write IDENTITY.md in profileFiles" };
-	const workspace = typeof body.workspace === "string" ? body.workspace : "";
-	const models = Object.hasOwn(body, "models") ? AgentModelsSchema.safeParse(body.models) : void 0;
-	if (models && !models.success) return { error: `models ${models.error.issues[0]?.message ?? "is invalid"}` };
+	const allowedKeys = new Set([
+		"id",
+		"workspace",
+		"profile"
+	]);
+	const unknownKey = Object.keys(body).find((key) => !allowedKeys.has(key));
+	if (unknownKey) return { error: `unknown create-agent field "${unknownKey}"` };
+	const workspace = typeof body.workspace === "string" ? body.workspace : void 0;
+	const profile = AgentProfileSchema.safeParse(body.profile);
+	if (!profile.success) return { error: `profile ${profile.error.issues[0]?.message ?? "is required"}` };
 	const id = typeof body.id === "string" ? body.id : void 0;
-	const presetIds = Object.hasOwn(body, "extends") ? Array.isArray(body.extends) ? body.extends.map((x) => normalizeAgentId(String(x))).filter(Boolean) : null : void 0;
-	if (presetIds === null) return { error: "extends must be an array" };
-	const skills = Object.hasOwn(body, "skills") ? Array.isArray(body.skills) ? body.skills.map((x) => String(x).trim()).filter(Boolean) : null : void 0;
-	if (skills === null) return { error: "skills must be an array" };
-	const toolsRaw = Object.hasOwn(body, "tools") ? body.tools : void 0;
-	let tools;
-	if (toolsRaw !== void 0) {
-		if (toolsRaw === null || typeof toolsRaw !== "object" || Array.isArray(toolsRaw)) return { error: "tools must be an object" };
-		const parsedTools = ToolPolicySetSchema.safeParse(toolsRaw);
-		if (!parsedTools.success) return { error: `tools ${parsedTools.error.issues[0]?.message ?? "is invalid"}` };
-		tools = parsedTools.data;
-	}
-	let profileFiles;
-	if (Object.hasOwn(body, "profileFiles")) {
-		const parsed = parseProfileFiles(body.profileFiles);
-		if (isParseError(parsed)) return parsed;
-		profileFiles = parsed;
-	}
-	if (!profileFiles?.["IDENTITY.md"] && typeof body.cloneFrom !== "string") return { error: "profileFiles.IDENTITY.md is required" };
-	const cloneFrom = typeof body.cloneFrom === "string" ? body.cloneFrom : void 0;
 	return {
 		workspace,
-		...models && models.data !== void 0 ? { models: models.data } : {},
-		...id !== void 0 ? { id } : {},
-		...presetIds !== void 0 ? { extends: presetIds } : {},
-		...skills !== void 0 ? { skills } : {},
-		...tools !== void 0 ? { tools } : {},
-		...profileFiles !== void 0 ? { profileFiles } : {},
-		...cloneFrom !== void 0 ? { cloneFrom } : {}
+		profile: profile.data,
+		...id !== void 0 ? { id } : {}
 	};
 }
 function parsePatchModels(raw) {
 	if (raw === void 0) return;
 	if (raw === null) return null;
 	if (typeof raw !== "object" || Array.isArray(raw)) return { error: "models must be an object or null" };
-	const body = raw;
-	const out = {};
-	if (Object.hasOwn(body, "defaultRole")) out.defaultRole = body.defaultRole === null ? null : String(body.defaultRole ?? "").trim();
-	if (Object.hasOwn(body, "roles")) if (body.roles === null) return { error: "models.roles must be an object" };
-	else {
-		const parsed = AgentModelsSchema.safeParse({ roles: body.roles });
-		if (!parsed.success) return { error: `models.roles ${parsed.error.issues[0]?.message ?? "is invalid"}` };
-		out.roles = parsed.data?.roles;
-	}
-	return out;
+	const parsed = AgentModelsOverrideSchema.safeParse(raw);
+	return parsed.success ? parsed.data : { error: `models ${parsed.error.issues[0]?.message ?? "is invalid"}` };
 }
 function registerAgentsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
@@ -115,10 +72,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: save.error ?? "save failed" }
 		}, 500);
-		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId, {
-			...parsed.profileFiles !== void 0 ? { profileFiles: parsed.profileFiles } : {},
-			...parsed.cloneFrom ? { cloneFrom: parsed.cloneFrom } : {}
-		});
+		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId);
 		if (finalized.ok === false) return c.json({
 			ok: false,
 			error: { message: finalized.error }
@@ -133,9 +87,9 @@ function registerAgentsRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.get("/api/agents/:id/effective-manifest", async (c) => {
+	authenticated.get("/api/agents/:id/effective-config", async (c) => {
 		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = getGatewayAgentEffectiveManifest(service.currentConfig, id);
+		const res = getGatewayAgentEffectiveConfig(service.currentConfig, id);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -156,40 +110,30 @@ function registerAgentsRoutes(authenticated, deps) {
 				error: { message: "Invalid JSON" }
 			}, 400);
 		}
-		if (Object.hasOwn(body, "model")) return c.json({
-			ok: false,
-			error: { message: "model is not supported; use models.defaultRole and models.roles" }
-		}, 400);
-		if (Object.hasOwn(body, "typedModels")) return c.json({
-			ok: false,
-			error: { message: "typedModels is not supported; use models.roles" }
-		}, 400);
-		if (Object.hasOwn(body, "toolsDisable")) return c.json({
-			ok: false,
-			error: { message: "toolsDisable was removed; use tools.builtin policies" }
-		}, 400);
-		if (Object.hasOwn(body, "agentDir")) return c.json({
+		const allowedPatchKeys = new Set([
+			"workspace",
+			"profile",
+			"models",
+			"skills",
+			"tools",
+			"workflows",
+			"runtime",
+			"setDefault"
+		]);
+		const unknownPatchKey = Object.keys(body).find((key) => !allowedPatchKeys.has(key));
+		if (unknownPatchKey) return c.json({
 			ok: false,
-			error: { message: "agentDir was removed from agent manifests" }
+			error: { message: `unknown agent field "${unknownPatchKey}"` }
 		}, 400);
-		if (Object.hasOwn(body, "name")) return c.json({
+		const skillsPatch = body.skills === null ? null : Object.hasOwn(body, "skills") ? SkillOverrideSchema.safeParse(body.skills) : void 0;
+		if (skillsPatch && skillsPatch !== null && !skillsPatch.success) return c.json({
 			ok: false,
-			error: { message: "name is not supported; edit IDENTITY.md" }
-		}, 400);
-		if (Object.hasOwn(body, "description")) return c.json({
-			ok: false,
-			error: { message: "description is not supported; edit IDENTITY.md" }
-		}, 400);
-		const skillsPatch = body.skills === null ? null : Array.isArray(body.skills) ? body.skills.map((x) => String(x).trim()).filter(Boolean) : void 0;
-		const extendsPatch = Object.hasOwn(body, "extends") ? Array.isArray(body.extends) ? body.extends.map((x) => String(x).trim()).filter(Boolean) : void 0 : void 0;
-		if (Object.hasOwn(body, "extends") && extendsPatch === void 0) return c.json({
-			ok: false,
-			error: { message: "extends must be an array" }
+			error: { message: `skills ${skillsPatch.error.issues[0]?.message ?? "is invalid"}` }
 		}, 400);
 		let toolsPatch;
 		if (Object.hasOwn(body, "tools")) if (body.tools === null) toolsPatch = null;
 		else if (typeof body.tools === "object" && !Array.isArray(body.tools)) {
-			const parsedTools = ToolPolicySetSchema.safeParse(body.tools);
+			const parsedTools = ToolPoliciesSchema.safeParse(body.tools);
 			if (!parsedTools.success) return c.json({
 				ok: false,
 				error: { message: `tools ${parsedTools.error.issues[0]?.message ?? "is invalid"}` }
@@ -204,17 +148,37 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: modelsPatch.error }
 		}, 400);
-		if (Object.hasOwn(body, "memory")) return c.json({
+		const profilePatch = body.profile === null ? null : Object.hasOwn(body, "profile") ? AgentProfileSchema.safeParse(body.profile) : void 0;
+		if (profilePatch && profilePatch !== null && !profilePatch.success) return c.json({
+			ok: false,
+			error: { message: `profile ${profilePatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		const workflowsPatch = body.workflows === null ? null : Object.hasOwn(body, "workflows") ? WorkflowPolicySchema.safeParse(body.workflows) : void 0;
+		if (workflowsPatch && workflowsPatch !== null && !workflowsPatch.success) return c.json({
+			ok: false,
+			error: { message: `workflows ${workflowsPatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		const runtimePatch = body.runtime === null ? null : Object.hasOwn(body, "runtime") ? RuntimePolicySchema.safeParse(body.runtime) : void 0;
+		if (runtimePatch && runtimePatch !== null && !runtimePatch.success) return c.json({
+			ok: false,
+			error: { message: `runtime ${runtimePatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		let workspacePatch;
+		if (Object.hasOwn(body, "workspace")) if (body.workspace === null) workspacePatch = null;
+		else if (typeof body.workspace === "string") workspacePatch = body.workspace;
+		else return c.json({
 			ok: false,
-			error: { message: "Agent memory configuration is not supported; use userContext" }
+			error: { message: "workspace must be a string or null" }
 		}, 400);
 		const prep = prepareUpdateAgent(service.currentConfig, id, {
-			workspace: typeof body.workspace === "string" ? body.workspace : void 0,
-			...extendsPatch !== void 0 ? { extends: extendsPatch } : {},
+			...workspacePatch !== void 0 ? { workspace: workspacePatch } : {},
+			...profilePatch !== void 0 ? { profile: profilePatch === null ? null : profilePatch.data } : {},
 			...modelsPatch !== void 0 ? { models: modelsPatch } : {},
 			setDefault: body.setDefault === true,
-			...skillsPatch !== void 0 ? { skills: skillsPatch } : {},
-			...toolsPatch !== void 0 ? { tools: toolsPatch } : {}
+			...skillsPatch !== void 0 ? { skills: skillsPatch === null ? null : skillsPatch.data } : {},
+			...toolsPatch !== void 0 ? { tools: toolsPatch } : {},
+			...workflowsPatch !== void 0 ? { workflows: workflowsPatch === null ? null : workflowsPatch.data } : {},
+			...runtimePatch !== void 0 ? { runtime: runtimePatch === null ? null : runtimePatch.data } : {}
 		});
 		if (prep.ok === false) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/connectors.js

@@ -514,7 +514,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			const policy = getComposioInstallationPolicy(config, c.req.param("toolkit"));
 			const agents = config.agents.list.filter((agent) => agent.enabled).map((agent) => ({
 				id: agent.id,
-				name: agent.identity?.name ?? agent.id
+				name: agent.id
 			}));
 			return c.json({
 				ok: true,

package/dist/src/gateway/hono/routes/device-push.d.ts

@@ -0,0 +1,2 @@
+import type { Hono } from 'hono';
+export declare function registerDevicePushRoutes(authenticated: Hono): void;

package/dist/src/gateway/hono/routes/{mobile.js → device-push.js}

@@ -1,5 +1,6 @@
 import { registerNotificationDevice, removeNotificationDevice, updateNotificationDevicePreferences } from "../../../notifications/device-store.js";
-//#region src/gateway/hono/routes/mobile.ts
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+//#region src/gateway/hono/routes/device-push.ts
 function stringField(value, maxLength) {
 	return typeof value === "string" && value.trim().length > 0 && value.trim().length <= maxLength ? value.trim() : null;
 }
@@ -34,22 +35,34 @@ function parsePermission(value) {
 function parseLocale(value) {
 	return value === "en" || value === "zh" ? value : null;
 }
-function registerMobileRoutes(authenticated, _deps) {
-	authenticated.post("/api/mobile/devices/register", async (c) => {
+function currentDeviceId(c) {
+	const principal = getGatewayPrincipal(c);
+	return principal.kind === "device" && principal.deviceId ? principal.deviceId : null;
+}
+function registerDevicePushRoutes(authenticated) {
+	authenticated.put("/api/devices/me/push", async (c) => {
+		const deviceId = currentDeviceId(c);
+		if (!deviceId) return c.json({
+			ok: false,
+			error: "Device access required"
+		}, 403);
 		const body = await c.req.json().catch(() => null);
-		const id = stringField(body?.id, 160);
+		if (body && ("id" in body || "deviceId" in body)) return c.json({
+			ok: false,
+			error: "Device identity must come from authentication"
+		}, 400);
 		const pushToken = stringField(body?.pushToken, 1024);
 		const platform = parsePlatform(body?.platform);
 		const permissions = parsePermission(body?.permissions);
 		const preferences = parsePreferences(body?.preferences);
 		const locale = parseLocale(body?.locale);
 		const appVersion = body?.appVersion === void 0 ? void 0 : stringField(body.appVersion, 128);
-		if (!id || !pushToken || !platform || !permissions || !locale || preferences === null || appVersion === null) return c.json({
+		if (!pushToken || !platform || !permissions || !locale || preferences === null || appVersion === null) return c.json({
 			ok: false,
-			error: "Invalid mobile device registration"
+			error: "Invalid push registration"
 		}, 400);
 		const device = registerNotificationDevice({
-			id,
+			deviceId,
 			pushToken,
 			platform,
 			permissions,
@@ -62,28 +75,37 @@ function registerMobileRoutes(authenticated, _deps) {
 			device
 		}, 201);
 	});
-	authenticated.patch("/api/mobile/devices/:id/preferences", async (c) => {
+	authenticated.patch("/api/devices/me/push/preferences", async (c) => {
+		const deviceId = currentDeviceId(c);
+		if (!deviceId) return c.json({
+			ok: false,
+			error: "Device access required"
+		}, 403);
 		const preferences = parsePreferences(await c.req.json().catch(() => null));
 		if (preferences === null || preferences === void 0) return c.json({
 			ok: false,
 			error: "Invalid notification preferences"
 		}, 400);
-		const device = updateNotificationDevicePreferences(c.req.param("id"), preferences);
-		if (!device) return c.json({
-			ok: false,
-			error: "Mobile device not found"
-		}, 404);
-		return c.json({
+		const device = updateNotificationDevicePreferences(deviceId, preferences);
+		return device ? c.json({
 			ok: true,
 			device
-		});
+		}) : c.json({
+			ok: false,
+			error: "Push registration not found"
+		}, 404);
 	});
-	authenticated.delete("/api/mobile/devices/:id", (c) => {
+	authenticated.delete("/api/devices/me/push", (c) => {
+		const deviceId = currentDeviceId(c);
+		if (!deviceId) return c.json({
+			ok: false,
+			error: "Device access required"
+		}, 403);
 		return c.json({
 			ok: true,
-			removed: removeNotificationDevice(c.req.param("id"))
+			removed: removeNotificationDevice(deviceId)
 		});
 	});
 }
 //#endregion
-export { registerMobileRoutes };
+export { registerDevicePushRoutes };

package/dist/src/gateway/hono/routes/devices.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerDeviceAuthPublicRoutes(app: Hono): void;
+export declare function registerDeviceRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/devices.js

@@ -0,0 +1,214 @@
+import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
+import { DEFAULT_MOBILE_SCOPES } from "../../security/gateway-scopes.js";
+import { createDevice, issueDeviceTokenPair, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
+import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
+import { resolveSecureDeviceRoutes } from "../../device-routes.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import os from "node:os";
+import { z } from "zod";
+//#region src/gateway/hono/routes/devices.ts
+const refreshRequestSchema = z.strictObject({
+	refreshToken: z.string().min(1).max(256),
+	timestamp: z.number().int().positive(),
+	nonce: z.string().min(16).max(128),
+	requestId: z.string().uuid(),
+	nextRefreshToken: z.string().min(80).max(256),
+	signature: z.string().min(1).max(256)
+});
+const pairingExchangeSchema = z.strictObject({
+	pairingToken: z.string().min(1).max(256),
+	device: z.strictObject({
+		displayName: z.string().trim().min(1).max(80),
+		platform: z.enum(["ios", "android"]),
+		publicKeyJwk: z.strictObject({
+			kty: z.literal("EC"),
+			crv: z.literal("P-256"),
+			x: z.string().min(40).max(64),
+			y: z.string().min(40).max(64)
+		})
+	})
+});
+const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
+function pairingLinkPayload(input) {
+	return Buffer.from(JSON.stringify({
+		version: 2,
+		...input
+	})).toString("base64url");
+}
+function registerDeviceAuthPublicRoutes(app) {
+	app.post("/api/device-auth/refresh", async (c) => {
+		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid refresh request"
+			}
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				payload: rotateDeviceRefreshToken(parsed.data)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: {
+					code: "REFRESH_DENIED",
+					message: error instanceof Error ? error.message : "Refresh denied"
+				}
+			}, 401);
+		}
+	});
+	app.post("/api/device-pairing/probe", async (c) => {
+		const parsed = pairingProbeSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success || !isDevicePairingSetupActive(parsed.data.pairingId)) return c.json({
+			ok: false,
+			error: {
+				code: "PAIRING_NOT_FOUND",
+				message: "Pairing setup not found"
+			}
+		}, 404);
+		const identity = getOrCreateGatewayIdentity();
+		const payload = Buffer.from(JSON.stringify({
+			gatewayId: identity.id,
+			pairingId: parsed.data.pairingId,
+			issuedAt: Date.now()
+		})).toString("base64url");
+		return c.json({
+			ok: true,
+			signedPayload: payload,
+			signature: signGatewayPayload(payload)
+		});
+	});
+	app.post("/api/device-pairing/exchange", async (c) => {
+		const parsed = pairingExchangeSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid pairing request"
+			}
+		}, 400);
+		const completed = runSqliteWriteTransaction(() => {
+			const pairing = consumeDevicePairingToken(parsed.data.pairingToken);
+			if (!pairing.ok && "reason" in pairing) return {
+				success: false,
+				reason: pairing.reason
+			};
+			const device = createDevice({
+				displayName: parsed.data.device.displayName,
+				platform: parsed.data.device.platform,
+				publicKeyJwk: parsed.data.device.publicKeyJwk,
+				scopes: DEFAULT_MOBILE_SCOPES
+			});
+			return {
+				success: true,
+				device,
+				routes: pairing.routes,
+				tokens: issueDeviceTokenPair(device.id)
+			};
+		});
+		if ("reason" in completed) return c.json({
+			ok: false,
+			error: {
+				code: "PAIRING_DENIED",
+				message: `Pairing ${completed.reason}`
+			}
+		}, 401);
+		const identity = getOrCreateGatewayIdentity();
+		const payload = Buffer.from(JSON.stringify({
+			gateway: {
+				id: identity.id,
+				name: os.hostname()
+			},
+			device: {
+				id: completed.device.id,
+				scopes: completed.device.scopes
+			},
+			routes: completed.routes,
+			tokens: completed.tokens
+		})).toString("base64url");
+		return c.json({
+			ok: true,
+			signedPayload: payload,
+			signature: signGatewayPayload(payload)
+		}, 201);
+	});
+}
+function registerDeviceRoutes(authenticated, deps) {
+	authenticated.get("/api/device-pairing/readiness", (c) => {
+		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
+		return c.json({
+			ok: true,
+			ready: routes.length > 0,
+			routes
+		});
+	});
+	authenticated.post("/api/device-pairing/setups", (c) => {
+		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
+		if (routes.length === 0) return c.json({
+			ok: false,
+			error: {
+				code: "NO_SECURE_ROUTE",
+				message: "Configure XOPC Secure Link, Tailscale Serve, or an HTTPS public URL first"
+			}
+		}, 409);
+		const setup = createDevicePairingSetup(routes);
+		const identity = getOrCreateGatewayIdentity();
+		const encoded = pairingLinkPayload({
+			pairingToken: setup.token,
+			gatewayId: identity.id,
+			gatewayName: os.hostname(),
+			gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
+			routes,
+			expiresAt: setup.expiresAt
+		});
+		return c.json({
+			ok: true,
+			setup: {
+				id: setup.id,
+				universalLink: `https://link.xopc.ai/connect#p=${encoded}`,
+				expiresAt: setup.expiresAt,
+				routes
+			}
+		}, 201);
+	});
+	authenticated.get("/api/devices", (c) => c.json({
+		ok: true,
+		devices: listDevices()
+	}));
+	authenticated.get("/api/devices/me", (c) => {
+		const principal = getGatewayPrincipal(c);
+		if (principal.kind !== "device" || !principal.deviceId) return c.json({
+			ok: false,
+			error: {
+				code: "DEVICE_REQUIRED",
+				message: "Device access required"
+			}
+		}, 403);
+		const device = listDevices().find((candidate) => candidate.id === principal.deviceId);
+		return device ? c.json({
+			ok: true,
+			device
+		}) : c.json({
+			ok: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Device not found"
+			}
+		}, 404);
+	});
+	authenticated.delete("/api/devices/:deviceId", (c) => {
+		const deviceId = c.req.param("deviceId");
+		const revoked = revokeDevice(deviceId);
+		if (revoked) deps.service.realtime.disconnectPrincipal(deviceId);
+		return c.json({
+			ok: true,
+			revoked
+		});
+	});
+}
+//#endregion
+export { registerDeviceAuthPublicRoutes, registerDeviceRoutes };

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -1,4 +1,4 @@
-import { endpointPrincipalRegistrationSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
 import { listEndpointToolInvocationAudits } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import "../../../storage/sqlite/index.js";
@@ -130,6 +130,73 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			payload: listEndpointToolInvocationAudits(Number.isFinite(limit) ? limit : 100)
 		});
 	});
+	authenticated.get("/api/endpoint-tools/bindings/:sessionKey", (c) => {
+		try {
+			const binding = deps.service.endpointTools.bindings.get(c.req.param("sessionKey"));
+			return binding ? c.json({
+				ok: true,
+				payload: binding
+			}) : c.json({
+				ok: false,
+				error: {
+					code: "NOT_FOUND",
+					message: "Endpoint binding not found"
+				}
+			}, 404);
+		} catch {
+			return c.json({
+				ok: false,
+				error: {
+					code: "BAD_REQUEST",
+					message: "Invalid session key"
+				}
+			}, 400);
+		}
+	});
+	authenticated.put("/api/endpoint-tools/bindings/:sessionKey", async (c) => {
+		const parsed = endpointSessionBindingRequestSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid endpoint binding"
+			}
+		}, 400);
+		try {
+			const binding = deps.service.endpointTools.bindings.bind(c.req.param("sessionKey"), parsed.data.endpointId);
+			return c.json({
+				ok: true,
+				payload: binding
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const status = message === "Endpoint is offline" ? 409 : 400;
+			return c.json({
+				ok: false,
+				error: {
+					code: "BINDING_FAILED",
+					message
+				}
+			}, status);
+		}
+	});
+	authenticated.delete("/api/endpoint-tools/bindings/:sessionKey", (c) => {
+		try {
+			const removed = deps.service.endpointTools.bindings.unbind(c.req.param("sessionKey"));
+			return c.json({
+				ok: true,
+				payload: { removed }
+			});
+		} catch {
+			return c.json({
+				ok: false,
+				error: {
+					code: "BAD_REQUEST",
+					message: "Invalid session key"
+				}
+			}, 400);
+		}
+	});
 	authenticated.post("/api/endpoint-tools/invocations/:invocationId/files", async (c) => {
 		const invocationId = c.req.param("invocationId");
 		const endpointId = c.req.header("x-endpoint-id") ?? "";