@xopcai/xopc 0.0.231 → 0.0.233

package/dist/src/gateway/hono/routes/files.js

@@ -35,6 +35,10 @@ function errorResponse(c, error) {
 	if (error instanceof FileServiceError) return c.json({ error: { message: error.message } }, error.status);
 	throw error;
 }
+function contentDisposition(disposition, fileName) {
+	const sanitized = fileName.replace(/[\u0000-\u001f\u007f]/g, "_");
+	return `${disposition}; filename="${sanitized.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(sanitized).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`)}`;
+}
 async function collectFiles(files, spaceId, query, max) {
 	const output = [];
 	const directories = [""];
@@ -115,6 +119,13 @@ function registerFilesRoutes(authenticated, deps) {
 			return errorResponse(c, error);
 		}
 	});
+	authenticated.get("/api/files/:id/host-path", async (c) => {
+		try {
+			return c.json({ absolutePath: (await files.resource(c.req.param("id"))).absolutePath });
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
 	authenticated.get("/api/files/:id/content", async (c) => {
 		try {
 			const { resource, absolutePath } = await files.resource(c.req.param("id"));
@@ -122,7 +133,7 @@ function registerFilesRoutes(authenticated, deps) {
 			if (c.req.header("if-none-match") === resource.revision) return c.body(null, 304);
 			c.header("Content-Type", resource.mimeType);
 			c.header("ETag", resource.revision);
-			c.header("Content-Disposition", `inline; filename="${resource.name.replace(/["\r\n]/g, "_")}"`);
+			c.header("Content-Disposition", contentDisposition("inline", resource.name));
 			return c.body(await readFile(absolutePath));
 		} catch (error) {
 			return errorResponse(c, error);

package/dist/src/gateway/hono/routes/global-defaults.js

@@ -1,17 +1,13 @@
-import { CapabilityPresetSchema, init_schema } from "../../../agent-manifest/schema.js";
+import { AgentDefaultsSchema } from "../../../agent-config/schema.js";
+import { init_agent_config } from "../../../agent-config/index.js";
 import { listGlobalDefaults, prepareUpdateGlobalDefaults } from "../../global-defaults-admin.js";
 //#region src/gateway/hono/routes/global-defaults.ts
-init_schema();
+init_agent_config();
 function parsePatchBody(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "body must be an object" };
 	const body = raw;
-	const out = {};
-	if (Object.hasOwn(body, "models")) {
-		const parsed = CapabilityPresetSchema.pick({ models: true }).safeParse({ models: body.models });
-		if (!parsed.success) return { error: `models ${parsed.error.issues[0]?.message ?? "is invalid"}` };
-		out.models = parsed.data.models;
-	}
-	return out;
+	const parsed = AgentDefaultsSchema.safeParse(body.defaults);
+	return parsed.success ? { defaults: parsed.data } : { error: `defaults ${parsed.error.issues[0]?.message ?? "is invalid"}` };
 }
 function isParseError(value) {
 	return typeof value === "object" && value !== null && "error" in value && typeof value.error === "string";

package/dist/src/gateway/hono/routes/index.js

@@ -7,12 +7,13 @@ import { registerStatusRoutes } from "./status.js";
 import { registerProjectsRoutes } from "./projects.js";
 import { registerProjectSkillRoutes } from "./project-skills.js";
 import { registerSearchRoutes } from "./search.js";
-import { registerMobileRoutes } from "./mobile.js";
+import { registerDevicePushRoutes } from "./device-push.js";
 import { registerNotificationRoutes } from "./notifications.js";
 import { registerInteractionStateRoutes } from "./interaction-state.js";
 import { registerComposerHistoryRoutes } from "./composer-history.js";
 import { registerEndpointToolRoutes } from "./endpoint-tools.js";
 import { registerRealtimeRoutes } from "./realtime.js";
+import { registerDeviceRoutes } from "./devices.js";
 import { registerLocalAppsRoutes } from "./local-apps.js";
 import { registerWorkDiscoveryRoutes } from "./work-discovery.js";
 import { registerUnderstandingSourceRoutes } from "./understanding-sources.js";
@@ -35,12 +36,13 @@ function registerCoreAuthenticatedRoutes(authenticated, deps) {
 	registerTaskRoutes(authenticated, deps);
 	registerProactiveRoutes(authenticated, deps);
 	registerSearchRoutes(authenticated, deps);
-	registerMobileRoutes(authenticated, deps);
+	registerDevicePushRoutes(authenticated);
 	registerNotificationRoutes(authenticated, deps);
 	registerInteractionStateRoutes(authenticated, deps);
 	registerComposerHistoryRoutes(authenticated, deps);
 	registerEndpointToolRoutes(authenticated, deps);
 	registerRealtimeRoutes(authenticated, deps);
+	registerDeviceRoutes(authenticated, deps);
 }
 function registerAuthenticatedRoutes(app, authenticated, deps) {
 	registerCoreAuthenticatedRoutes(authenticated, deps);

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -100,6 +100,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			} };
 		}
 	},
+	{
+		id: "support",
+		match: (path) => startsWithAny(path, ["/api/support"]),
+		load: async () => {
+			const { registerSupportRoutes } = await import("./support.js");
+			return { register: registerSupportRoutes };
+		}
+	},
 	{
 		id: "image-generation",
 		match: (path) => startsWithAny(path, ["/api/image-generation"]) || /^\/api\/agents\/[^/]+\/image-generation(?:\/setup)?$/.test(path),
@@ -117,15 +125,11 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 		}
 	},
 	{
-		id: "capability-presets",
-		match: (path) => startsWithAny(path, ["/api/capability-presets", "/api/global-defaults"]),
+		id: "global-defaults",
+		match: (path) => startsWithAny(path, ["/api/global-defaults"]),
 		load: async () => {
-			const { registerCapabilityPresetsRoutes } = await import("./capability-presets.js");
 			const { registerGlobalDefaultsRoutes } = await import("./global-defaults.js");
-			return { register: (authenticated, deps) => {
-				registerCapabilityPresetsRoutes(authenticated, deps);
-				registerGlobalDefaultsRoutes(authenticated, deps);
-			} };
+			return { register: registerGlobalDefaultsRoutes };
 		}
 	},
 	{
@@ -220,7 +224,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 	},
 	{
 		id: "shares",
-		match: (path) => startsWithAny(path, ["/api/shares"]),
+		match: (path) => startsWithAny(path, ["/api/shares"]) || /^\/api\/sessions\/[^/]+\/(?:share-preview|shares|hosted-shares)(?:\/.*)?$/.test(path),
 		load: async () => {
 			const { registerShareRoutes } = await import("./shares.js");
 			return { register: registerShareRoutes };
@@ -323,18 +327,6 @@ const APP_LAZY_ROUTE_BUNDLES = [{
 		const { registerSharePublicRoutes } = await import("./shares.js");
 		return { registerOnApp: registerSharePublicRoutes };
 	}
-}, {
-	id: "tunnel-public",
-	prefixes: [
-		"/api/tunnel/pair/ping",
-		"/api/tunnel/pair/validate-url",
-		"/api/tunnel/exchange-token"
-	],
-	match: (path) => path === "/api/tunnel/exchange-token" || path === "/api/tunnel/pair/ping" || path === "/api/tunnel/pair/validate-url",
-	load: async () => {
-		const { registerTunnelPublicRoutes } = await import("./tunnel.js");
-		return { registerOnApp: registerTunnelPublicRoutes };
-	}
 }];
 function findAuthenticatedLazyRouteBundle(path) {
 	return AUTHENTICATED_LAZY_ROUTE_BUNDLES.find((bundle) => bundle.match(path));

package/dist/src/gateway/hono/routes/media.js

@@ -9,6 +9,26 @@ import { messagesReferenceMediaUri } from "../../../media/session-references.js"
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 //#region src/gateway/hono/routes/media.ts
 const log = createGatewayRouteLogger("Media");
+function parseByteRange(header, size) {
+	if (!header) return null;
+	const match = /^bytes=(\d*)-(\d*)$/i.exec(header.trim());
+	if (!match || !match[1] && !match[2] || size <= 0) return "invalid";
+	if (!match[1]) {
+		const suffixLength = Number(match[2]);
+		if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0) return "invalid";
+		return {
+			start: Math.max(0, size - suffixLength),
+			end: size - 1
+		};
+	}
+	const start = Number(match[1]);
+	const requestedEnd = match[2] ? Number(match[2]) : size - 1;
+	if (!Number.isSafeInteger(start) || !Number.isSafeInteger(requestedEnd) || start < 0 || start >= size || requestedEnd < start) return "invalid";
+	return {
+		start,
+		end: Math.min(requestedEnd, size - 1)
+	};
+}
 function registerMediaRoutes(authenticated, deps) {
 	const tasks = new TaskRepository();
 	authenticated.post("/api/media", deps.strictRateLimitMiddleware, async (c) => {
@@ -64,9 +84,33 @@ function registerMediaRoutes(authenticated, deps) {
 			}, 404);
 			const { buffer, path } = await readMediaReference(parsed.uri);
 			const contentType = mimeTypeFromMediaPath(path);
+			const range = parseByteRange(c.req.header("Range"), buffer.byteLength);
+			const commonHeaders = {
+				"Accept-Ranges": "bytes",
+				"Cache-Control": "private, max-age=3600",
+				"Content-Type": contentType
+			};
+			if (range === "invalid") return new Response(null, {
+				status: 416,
+				headers: {
+					...commonHeaders,
+					"Content-Range": `bytes */${buffer.byteLength}`
+				}
+			});
+			if (range) {
+				const body = buffer.subarray(range.start, range.end + 1);
+				return new Response(body, {
+					status: 206,
+					headers: {
+						...commonHeaders,
+						"Content-Length": String(body.byteLength),
+						"Content-Range": `bytes ${range.start}-${range.end}/${buffer.byteLength}`
+					}
+				});
+			}
 			return new Response(buffer, { headers: {
-				"Content-Type": contentType,
-				"Cache-Control": "private, max-age=3600"
+				...commonHeaders,
+				"Content-Length": String(buffer.byteLength)
 			} });
 		} catch (err) {
 			const em = err instanceof Error ? err.message : String(err);

package/dist/src/gateway/hono/routes/models.js

@@ -12,13 +12,13 @@ import "../../../capabilities/readiness/index.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
-import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../../providers/domestic-presets.js";
-import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
 import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
+import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../../providers/domestic-presets.js";
 import { auditModelReferences } from "../../../providers/model-reference-auditor.js";
+import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
 import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
 //#region src/gateway/hono/routes/models.ts
 init_models_json();

package/dist/src/gateway/hono/routes/realtime.js

@@ -1,4 +1,5 @@
 import { realtimeClientKindSchema } from "../../../../packages/realtime-protocol/src/index.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/realtime.ts
 const ticketRequestSchema = z.strictObject({
@@ -16,9 +17,15 @@ function registerRealtimeRoutes(authenticated, deps) {
 			}
 		}, 400);
 		try {
+			const principal = getGatewayPrincipal(c);
 			return c.json({
 				ok: true,
-				payload: deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind)
+				payload: deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind, {
+					principalId: principal.principalId,
+					...principal.deviceId ? { deviceId: principal.deviceId } : {},
+					...principal.accessSessionId ? { accessSessionId: principal.accessSessionId } : {},
+					scopes: principal.scopes
+				})
 			});
 		} catch (error) {
 			return c.json({

package/dist/src/gateway/hono/routes/status.js

@@ -1,5 +1,5 @@
 import { getDefaultModelSync, init_providers, resolveModel } from "../../../providers/index.js";
-import { getGatewayAgentEffectiveManifest } from "../../agents-admin.js";
+import { getGatewayAgentEffectiveConfig } from "../../agents-admin.js";
 import { isSTTAvailable } from "../../../voice/stt/availability.js";
 import { mergeSttConfigFromAppConfig } from "../../../voice/stt/config.js";
 import "../../../voice/stt/index.js";
@@ -14,9 +14,6 @@ function stableValue(value) {
 function contentHash(value) {
 	return createHash("sha256").update(JSON.stringify(stableValue(value))).digest("hex");
 }
-function asRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
 function buildEvalRuntimeIdentity(service, agentId) {
 	const config = service.currentConfig;
 	if (!config) return {
@@ -24,16 +21,13 @@ function buildEvalRuntimeIdentity(service, agentId) {
 		error: "Gateway configuration is unavailable",
 		status: 503
 	};
-	const effective = getGatewayAgentEffectiveManifest(config, agentId);
+	const effective = getGatewayAgentEffectiveConfig(config, agentId);
 	if ("error" in effective) return {
 		ok: false,
 		error: effective.error,
 		status: effective.status ?? 400
 	};
-	const manifest = asRecord(effective.data.manifest);
-	const models = asRecord(manifest.models);
-	const tools = asRecord(manifest.tools);
-	const skills = manifest.skills ?? [];
+	const agentConfig = effective.data.config;
 	return {
 		ok: true,
 		payload: {
@@ -41,13 +35,12 @@ function buildEvalRuntimeIdentity(service, agentId) {
 			version: service.getHealth().version,
 			buildCommit: process.env.XOPC_BUILD_COMMIT?.trim() || process.env.GITHUB_SHA?.trim() || null,
 			agentId,
-			modelRef: models.primary ?? null,
-			thinkingLevel: manifest.thinkingDefault ?? null,
-			manifestHash: contentHash(effective.data.manifest),
-			systemPromptConfigHash: contentHash(manifest.systemPrompt ?? null),
-			toolPolicyHash: contentHash(tools),
-			skillPolicyHash: contentHash(skills),
-			presetChain: effective.data.sources
+			modelRef: agentConfig.models.chat.primary,
+			thinkingLevel: null,
+			configHash: contentHash(agentConfig),
+			toolPolicyHash: contentHash(agentConfig.tools),
+			skillPolicyHash: contentHash(agentConfig.skills),
+			sources: effective.data.sources
 		}
 	};
 }

package/dist/src/gateway/hono/routes/support.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerSupportRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/support.js

@@ -0,0 +1,28 @@
+import { buildSupportInvestigationPrompt } from "../../../support/build-support-investigation-prompt.js";
+import { collectSupportReport } from "../../../support/collect-support-report.js";
+import { SupportReportInputSchema } from "../../../support/types.js";
+//#region src/gateway/hono/routes/support.ts
+function registerSupportRoutes(authenticated, deps) {
+	authenticated.post("/api/support/report", deps.strictRateLimitMiddleware, async (c) => {
+		const parsed = SupportReportInputSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: "Invalid support report input"
+		}, 400);
+		const health = deps.service.getHealth();
+		const channels = Object.fromEntries(deps.service.getChannelsStatus().map((channel) => [channel.name, !channel.enabled ? "disabled" : channel.connected ? "connected" : "disconnected"]));
+		const report = await collectSupportReport(parsed.data, { runtime: {
+			gatewayStatus: health.status,
+			gatewayVersion: health.version,
+			gatewayUptimeMs: health.uptime,
+			channels
+		} });
+		return c.json({
+			ok: true,
+			report,
+			investigationPrompt: buildSupportInvestigationPrompt(report)
+		});
+	});
+}
+//#endregion
+export { registerSupportRoutes };

package/dist/src/gateway/hono/routes/tunnel.d.ts

@@ -1,5 +1,3 @@
 import type { Hono } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
-import type { GatewayService } from '../../service.js';
-export declare function registerTunnelPublicRoutes(app: Hono, service: GatewayService): void;
 export declare function registerTunnelRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/tunnel.js

@@ -1,22 +1,13 @@
 import { init_public_url, validatePublicUrl } from "../../../config/public-url.js";
-import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
-import { loadTunnelState } from "../../../tunnel/tunnel-state.js";
-import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { extractToken } from "../../auth.js";
-import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
-import { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from "../../../tunnel/pairing.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
+import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
-import { applyLanPairingGatewayPatch } from "../../../tunnel/enable-lan-pairing.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
-import { buildMobileConnectUrlOrder, resolveMobilePairLanUrl, validateMobilePairBaseUrl } from "../../../tunnel/pair-url.js";
-import { buildMobilePairContext } from "../../../tunnel/pair-context.js";
-import { consumePairingExchangeFailLimit } from "../../../tunnel/pairing-rate-limit.js";
 import { provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
 //#region src/gateway/hono/routes/tunnel.ts
 init_public_url();
@@ -64,188 +55,17 @@ function createTunnelMutationRateLimitMiddleware() {
 		await next();
 	};
 }
-function registerTunnelPublicRoutes(app, service) {
-	app.get("/api/tunnel/pair/ping", async (c) => {
-		const config = service.currentConfig;
-		const status = getTunnelService().getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json({
-			ok: true,
-			service: "xopc-gateway",
-			mobilePairing: true,
-			port: context.port,
-			bindMode: context.bindMode,
-			listenHost: context.listenHost,
-			pairingReady: context.pairingReady,
-			blockReason: context.blockReason ?? null,
-			tunnelConnected: status.state === "connected",
-			reverseProxyConfigured: Boolean(resolveReverseProxyPublicUrl(config)),
-			connectUrls: context.connectUrls
-		});
-	});
-	app.post("/api/tunnel/pair/validate-url", async (c) => {
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const result = validateMobilePairBaseUrl(typeof body.baseUrl === "string" ? body.baseUrl : "");
-		if (result.ok === false) return c.json({
-			ok: false,
-			code: result.code,
-			message: result.message
-		});
-		return c.json({
-			ok: true,
-			url: result.url,
-			loopback: false,
-			probePath: "/api/tunnel/pair/ping"
-		});
-	});
-	app.post("/api/tunnel/exchange-token", async (c) => {
-		const clientIp = getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 }) ?? "unknown";
-		let body;
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({ error: "Invalid JSON body" }, 400);
-		}
-		const pairingSecret = typeof body.pairingSecret === "string" ? body.pairingSecret.trim() : "";
-		if (!pairingSecret) return c.json({ error: "pairingSecret required" }, 400);
-		const cached = getCachedPairingExchange(pairingSecret);
-		if (cached) {
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: true,
-				clientIp,
-				phase: "pairing_exchange",
-				replay: true
-			}, "Pairing secret replayed (duplicate mobile exchange)");
-			return c.json(cached);
-		}
-		const token = service.getAuthToken();
-		if (!token) return c.json({ error: "Gateway token not configured" }, 500);
-		const persisted = loadTunnelState();
-		const config = service.currentConfig;
-		const tunnelUrl = persisted?.publicUrl?.trim() || null;
-		const reverseProxyUrl = resolveReverseProxyPublicUrl(config);
-		const lanUrl = resolveMobilePairLanUrl(config);
-		const connectUrls = buildMobileConnectUrlOrder({
-			reverseProxyUrl,
-			baseUrl: reverseProxyUrl ?? tunnelUrl,
-			lanUrl,
-			tunnelUrl
-		});
-		const advertisedBaseUrl = reverseProxyUrl ?? tunnelUrl;
-		const payload = await exchangePairingSecretOnce(pairingSecret, () => ({
-			token,
-			baseUrl: advertisedBaseUrl,
-			lanUrl,
-			connectUrls
-		}));
-		if (!payload) {
-			const limited = consumePairingExchangeFailLimit(clientIp);
-			if (!limited.allowed) c.header("Retry-After", String(Math.ceil(limited.retryAfterMs / 1e3)));
-			logTunnelAudit("tunnel.exchange_token", {
-				ok: false,
-				clientIp,
-				phase: "pairing_exchange"
-			}, "Pairing exchange denied: invalid or expired secret");
-			return c.json({
-				error: "Invalid or expired pairing secret",
-				code: "PAIRING_INVALID"
-			}, 401);
-		}
-		logTunnelAudit("tunnel.exchange_token", {
-			ok: true,
-			clientIp,
-			subdomain: persisted?.subdomain ?? null,
-			phase: "pairing_exchange"
-		}, "Pairing secret exchanged for gateway token");
-		return c.json(payload);
-	});
-}
 function registerTunnelRoutes(authenticated, deps) {
 	const { strictRateLimitMiddleware } = deps;
 	const tunnel = getTunnelService();
 	const tunnelMutationLimit = createTunnelMutationRateLimitMiddleware();
-	authenticated.get("/api/tunnel/pair/context", async (c) => {
-		const config = deps.service.currentConfig;
-		const status = tunnel.getStatus();
-		const context = buildMobilePairContext({
-			config,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(config)
-		});
-		return c.json(context);
-	});
-	authenticated.post("/api/tunnel/pair/enable-lan", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const config = deps.service.currentConfig;
-		const patchResult = applyLanPairingGatewayPatch(config);
-		if (patchResult.ok === false) return c.json({
-			ok: false,
-			error: {
-				message: patchResult.message,
-				code: "LAN_PAIRING_CONFIG"
-			}
-		}, 400);
-		if (patchResult.changed) {
-			const saveResult = await deps.service.saveConfig(config);
-			if (!saveResult.saved) return c.json({
-				ok: false,
-				error: {
-					message: saveResult.error ?? "Failed to save config",
-					code: "SAVE_FAILED"
-				}
-			}, 500);
-			logTunnelAudit("tunnel.enable_lan_pairing", { gatewayTokenHash: hashGatewayToken(token).slice(0, 12) }, "Gateway bind switched to LAN for mobile pairing");
-		}
-		const status = tunnel.getStatus();
-		let context = buildMobilePairContext({
-			config: deps.service.currentConfig,
-			tunnelPublicUrl: status.publicUrl,
-			tunnelConnected: status.state === "connected",
-			reverseProxyPublicUrl: resolveReverseProxyPublicUrl(deps.service.currentConfig)
-		});
-		if (patchResult.changed) context = {
-			...context,
-			pairingReady: false,
-			blockReason: "GATEWAY_LOOPBACK_ONLY"
-		};
-		return c.json({
-			ok: true,
-			requiresRestart: patchResult.changed,
-			context
-		});
-	});
-	authenticated.post("/api/tunnel/pair", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const { secret, expiresAt } = createPairingSecret();
-		logTunnelAudit("tunnel.pair", {
-			expiresAt: expiresAt.toISOString(),
-			gatewayTokenHash: hashGatewayToken(token).slice(0, 12)
-		}, "Mobile pairing session created");
-		return c.json({
-			pairingSecret: secret,
-			expiresAt: expiresAt.toISOString()
-		});
-	});
 	/**
 	* Probe a candidate reverse-proxy URL before persisting it. The check round-trips
-	* a `GET /api/tunnel/pair/ping` and validates the response identifies as
+	* a `GET /api/health` and validates the response identifies as
 	* `service: 'xopc-gateway'`. Surface-area errors are mapped to stable codes so
 	* the UI can render targeted hints (TLS / DNS / wrong service / blocked path).
 	*/
-	authenticated.post("/api/tunnel/pair/probe-public", tunnelMutationLimit, async (c) => {
+	authenticated.post("/api/tunnel/probe-public", tunnelMutationLimit, async (c) => {
 		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
 		let body;
 		try {
@@ -263,7 +83,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			code: validation.code,
 			message: validation.message
 		});
-		const pingUrl = `${validation.url}/api/tunnel/pair/ping`;
+		const pingUrl = `${validation.url}/api/health`;
 		const startedAt = Date.now();
 		let response;
 		try {
@@ -305,7 +125,7 @@ function registerTunnelRoutes(authenticated, deps) {
 				message: "Response was not JSON"
 			});
 		}
-		if (!parsed || parsed.service !== "xopc-gateway") return c.json({
+		if (!parsed || parsed.status !== "ok" && parsed.status !== "starting") return c.json({
 			ok: false,
 			code: "NOT_XOPC_GATEWAY",
 			message: "Endpoint did not identify as an xopc gateway"
@@ -314,7 +134,7 @@ function registerTunnelRoutes(authenticated, deps) {
 			ok: true,
 			url: validation.url,
 			latencyMs: Date.now() - startedAt,
-			mobilePairing: parsed.mobilePairing === true
+			gatewayReady: true
 		});
 	});
 	authenticated.get("/api/tunnel/status", async (c) => {
@@ -391,7 +211,7 @@ function registerTunnelRoutes(authenticated, deps) {
 		}
 		const port = config.gateway.port ?? 18790;
 		try {
-			const qr = await tunnel.start(port, token);
+			await tunnel.start(port, token);
 			setTunnelEnabledInConfig(config, true);
 			const saved = await deps.service.saveConfig(config);
 			if (!saved.saved) {
@@ -401,10 +221,8 @@ function registerTunnelRoutes(authenticated, deps) {
 			}
 			const status = tunnel.getStatus();
 			return c.json({
-				publicUrl: qr.publicUrl,
-				subdomain: status.subdomain,
-				qrPayload: qr.qrPayload,
-				lanUrl: qr.lanUrl
+				publicUrl: status.publicUrl,
+				subdomain: status.subdomain
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
@@ -436,13 +254,6 @@ function registerTunnelRoutes(authenticated, deps) {
 			released
 		});
 	});
-	authenticated.get("/api/tunnel/qr", async (c) => {
-		const port = deps.service.currentConfig.gateway.port ?? 18790;
-		const host = resolveGatewayEffectiveHost(deps.service.currentConfig);
-		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
-		const qr = await tunnel.buildQr(port, host);
-		return c.json(qr);
-	});
 	authenticated.get("/api/tunnel/transport-status", async (c) => {
 		return c.json({ transport: { tls: "broker_terminated" } });
 	});
@@ -462,4 +273,4 @@ function registerTunnelRoutes(authenticated, deps) {
 	});
 }
 //#endregion
-export { registerTunnelPublicRoutes, registerTunnelRoutes };
+export { registerTunnelRoutes };