@xopcai/xopc 0.0.265 → 0.0.267

package/dist/browser-ext/dist/assets/{auth-CknJ00ae.js → auth-D_IL6naL.js}

@@ -5099,6 +5099,562 @@ function superRefine(fn, params) {
     return _superRefine(fn, params);
 }
 
+const ENDPOINT_PROTOCOL_VERSION = 2;
+const endpointKindSchema = _enum(["web", "desktop", "mobile", "browser"]);
+const endpointAvailabilitySchema = _enum(["foreground", "background"]);
+const endpointEffectSchema = _enum(["read", "write", "destructive"]);
+const endpointConfirmationSchema = _enum(["never", "always"]);
+const endpointResultKindSchema = _enum(["text", "json", "file"]);
+const endpointSensitivitySchema = _enum(["public", "personal"]);
+const identifierSchema = string().min(1).max(160);
+const turnTokenSchema = string().min(32).max(160).regex(/^[A-Za-z0-9_-]+$/);
+const turnOriginSchema = discriminatedUnion("type", [
+  strictObject({ type: literal("endpoint"), endpointId: identifierSchema }),
+  strictObject({ type: literal("channel"), channel: string().min(1).max(64) }),
+  strictObject({
+    type: literal("system"),
+    source: _enum(["cli", "automation", "heartbeat", "workflow", "internal"])
+  })
+]);
+const endpointTurnOriginSchema = turnOriginSchema.options[0];
+endpointTurnOriginSchema.extend({ token: turnTokenSchema });
+const messageIdSchema$1 = uuid();
+const timestampSchema$1 = number().int().nonnegative();
+const jsonObjectSchema = record(string(), unknown());
+const endpointToolDescriptorSchema = strictObject({
+  name: string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/).max(120),
+  title: string().min(1).max(120),
+  description: string().min(1).max(2e3),
+  inputSchema: jsonObjectSchema,
+  outputSchema: jsonObjectSchema,
+  policyId: string().regex(/^[a-z][a-z0-9_.-]+$/).max(120),
+  sensitivity: endpointSensitivitySchema,
+  effect: endpointEffectSchema,
+  confirmation: endpointConfirmationSchema,
+  requiresForeground: boolean(),
+  requiredPermissions: array(string().min(1).max(120)).max(20),
+  timeoutMs: number().int().min(1e3).max(3e5),
+  maxConcurrency: number().int().min(1).max(4),
+  supportsCancellation: boolean(),
+  idempotent: boolean(),
+  resultKinds: array(endpointResultKindSchema).min(1).max(3)
+});
+strictObject({
+  principalId: identifierSchema,
+  displayName: string().min(1).max(120),
+  kind: endpointKindSchema,
+  platform: string().min(1).max(80),
+  publicKey: string().min(32).max(2048)
+});
+strictObject({
+  endpointId: identifierSchema
+});
+const backgroundCapabilitySchema = string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/).max(120);
+strictObject({
+  jobId: uuid(),
+  endpointId: identifierSchema,
+  capability: backgroundCapabilitySchema,
+  input: jsonObjectSchema,
+  idempotencyKey: identifierSchema,
+  consentGrantId: identifierSchema,
+  createdAt: timestampSchema$1,
+  expiresAt: timestampSchema$1
+});
+strictObject({
+  jobId: uuid(),
+  status: _enum(["queued", "running", "succeeded", "failed", "cancelled"]),
+  updatedAt: timestampSchema$1,
+  output: jsonObjectSchema.optional(),
+  error: strictObject({
+    code: identifierSchema,
+    message: string().min(1).max(2e3)
+  }).optional()
+});
+strictObject({
+  eventId: uuid(),
+  endpointId: identifierSchema,
+  subscriptionId: identifierSchema,
+  eventType: backgroundCapabilitySchema,
+  data: jsonObjectSchema,
+  occurredAt: timestampSchema$1
+});
+const endpointHelloPayloadSchema = strictObject({
+  principalId: identifierSchema,
+  endpointId: identifierSchema,
+  connectionInstanceId: uuid(),
+  displayName: string().min(1).max(120),
+  kind: endpointKindSchema,
+  platform: string().min(1).max(80),
+  appVersion: string().min(1).max(80),
+  availability: endpointAvailabilitySchema,
+  nonce: identifierSchema,
+  signedAt: timestampSchema$1,
+  signature: string().min(16).max(1024),
+  tools: array(endpointToolDescriptorSchema).max(100)
+});
+const toolInvokePayloadSchema = strictObject({
+  invocationId: uuid(),
+  toolCallId: identifierSchema,
+  toolName: endpointToolDescriptorSchema.shape.name,
+  arguments: jsonObjectSchema,
+  descriptorRevision: string().min(1).max(128),
+  confirmationRequired: boolean(),
+  deadlineAt: timestampSchema$1,
+  uploadGrant: strictObject({
+    path: string().startsWith("/").max(500),
+    token: identifierSchema,
+    maxBytes: number().int().positive(),
+    maxFiles: number().int().min(1).max(20),
+    expiresAt: timestampSchema$1
+  }).optional()
+});
+const toolCancelPayloadSchema = strictObject({
+  invocationId: uuid(),
+  reason: string().min(1).max(500)
+});
+const invocationPayloadSchema = strictObject({ invocationId: uuid() });
+const endpointToolContentSchema = discriminatedUnion("type", [
+  strictObject({ type: literal("text"), text: string().max(256 * 1024) }),
+  strictObject({ type: literal("json"), value: unknown() }),
+  strictObject({
+    type: literal("file"),
+    fileId: identifierSchema,
+    name: string().min(1).max(255),
+    mimeType: string().min(1).max(255),
+    size: number().int().nonnegative(),
+    sha256: string().regex(/^[a-f0-9]{64}$/)
+  })
+]);
+const endpointToolErrorCodeSchema = _enum([
+  "ENDPOINT_OFFLINE",
+  "ENDPOINT_NOT_FOREGROUND",
+  "ENDPOINT_DISCONNECTED",
+  "TOOL_NOT_FOUND",
+  "TOOL_REVISION_MISMATCH",
+  "INVALID_ARGUMENTS",
+  "PERMISSION_DENIED",
+  "USER_DENIED",
+  "TOOL_BUSY",
+  "TOOL_TIMEOUT",
+  "TOOL_CANCELLED",
+  "RESULT_TOO_LARGE",
+  "PROTOCOL_ERROR"
+]);
+const envelope$1 = (type, payload) => strictObject({
+  protocolVersion: literal(ENDPOINT_PROTOCOL_VERSION),
+  messageId: messageIdSchema$1,
+  type: literal(type),
+  sentAt: timestampSchema$1,
+  payload
+});
+const clientEndpointMessageSchema = discriminatedUnion("type", [
+  envelope$1("endpoint.availability_changed", strictObject({ availability: endpointAvailabilitySchema })),
+  envelope$1("tool.received", invocationPayloadSchema),
+  envelope$1("tool.progress", strictObject({
+    invocationId: uuid(),
+    message: string().max(500).optional(),
+    percent: number().min(0).max(100).optional()
+  })),
+  envelope$1("tool.result", strictObject({
+    invocationId: uuid(),
+    content: array(endpointToolContentSchema).min(1).max(20),
+    details: jsonObjectSchema.optional()
+  })),
+  envelope$1("tool.error", strictObject({
+    invocationId: uuid(),
+    code: endpointToolErrorCodeSchema,
+    message: string().min(1).max(2e3)
+  })),
+  envelope$1("tool.cancelled", invocationPayloadSchema)
+]);
+const serverEndpointMessageSchema = discriminatedUnion("type", [
+  envelope$1("tool.invoke", toolInvokePayloadSchema),
+  envelope$1("tool.cancel", toolCancelPayloadSchema)
+]);
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Canonical JSON only supports finite numbers");
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object") throw new Error(`Canonical JSON does not support ${typeof value}`);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error("Canonical JSON only supports plain objects");
+  }
+  const record = value;
+  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+function endpointHelloSigningPayload(payload) {
+  const { signature: _signature, ...unsigned } = payload;
+  return canonicalJson(unsigned);
+}
+
+const REALTIME_PROTOCOL_VERSION = 1;
+const REALTIME_HEARTBEAT_INTERVAL_MS = 15e3;
+const REALTIME_HEARTBEAT_TIMEOUT_MS = 45e3;
+const realtimeClientKindSchema = _enum([
+  "web",
+  "desktop",
+  "mobile",
+  "browser_extension",
+  "tui",
+  "mcp"
+]);
+const realtimeTopicSchema = string().min(1).max(512);
+const realtimeEventNameSchema = string().regex(/^[a-z][a-z0-9_.-]*$/).max(160);
+const messageIdSchema = uuid();
+const timestampSchema = number().int().nonnegative();
+const sequenceSchema = number().int().positive();
+const envelope = (kind, payload) => strictObject({
+  protocolVersion: literal(REALTIME_PROTOCOL_VERSION),
+  messageId: messageIdSchema,
+  kind: literal(kind),
+  sentAt: timestampSchema,
+  payload
+});
+const realtimeSubscriptionSchema = strictObject({
+  topic: realtimeTopicSchema,
+  afterSeq: number().int().nonnegative().optional()
+});
+discriminatedUnion("kind", [
+  envelope("realtime.hello", strictObject({
+    ticket: string().min(32).max(512),
+    clientId: string().min(1).max(160),
+    clientKind: realtimeClientKindSchema,
+    subscriptions: array(realtimeSubscriptionSchema).max(100).default([]),
+    endpoint: endpointHelloPayloadSchema.optional()
+  })),
+  envelope("realtime.subscribe", strictObject({
+    subscriptions: array(realtimeSubscriptionSchema).min(1).max(100)
+  })),
+  envelope("realtime.unsubscribe", strictObject({
+    topics: array(realtimeTopicSchema).min(1).max(100)
+  })),
+  envelope("realtime.ping", strictObject({})),
+  envelope("endpoint.message", clientEndpointMessageSchema)
+]);
+const realtimeEventPayloadSchema = strictObject({
+  topic: realtimeTopicSchema,
+  seq: sequenceSchema,
+  event: realtimeEventNameSchema,
+  data: unknown()
+});
+const serverRealtimeMessageSchema = discriminatedUnion("kind", [
+  envelope("realtime.ready", strictObject({
+    connectionId: uuid(),
+    heartbeatIntervalMs: literal(REALTIME_HEARTBEAT_INTERVAL_MS),
+    heartbeatTimeoutMs: literal(REALTIME_HEARTBEAT_TIMEOUT_MS),
+    endpoint: strictObject({
+      endpointId: string().min(1).max(160),
+      turnToken: string().min(32).max(160)
+    }).optional()
+  })),
+  envelope("realtime.event", realtimeEventPayloadSchema),
+  envelope("realtime.subscribed", strictObject({
+    topic: realtimeTopicSchema,
+    cursor: number().int().nonnegative()
+  })),
+  envelope("realtime.gap", strictObject({
+    topic: realtimeTopicSchema,
+    requestedSeq: number().int().nonnegative(),
+    earliestSeq: sequenceSchema,
+    recoverable: boolean()
+  })),
+  envelope("realtime.pong", strictObject({})),
+  envelope("realtime.error", strictObject({
+    code: string().min(1).max(80),
+    message: string().min(1).max(500)
+  })),
+  envelope("endpoint.message", serverEndpointMessageSchema)
+]);
+function parseServerRealtimeMessage(value) {
+  return serverRealtimeMessageSchema.parse(value);
+}
+
+function frameText(data) {
+  if (typeof data === "string") return data;
+  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
+  if (ArrayBuffer.isView(data)) {
+    const bytes = Uint8Array.from(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+    return new TextDecoder().decode(bytes);
+  }
+  throw new Error("Realtime server sent a non-text frame");
+}
+function isNonRetryableCloseCode(code) {
+  return code === 1009 || code === 4400 || code === 4401 || code === 4413;
+}
+class RealtimeClient {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  desiredSubscriptions = /* @__PURE__ */ new Map();
+  cursors = /* @__PURE__ */ new Map();
+  socket;
+  reconnectTimer;
+  heartbeatTimer;
+  connectionTimer;
+  ticketAbort;
+  generation = 0;
+  reconnectAttempts = 0;
+  shouldReconnect = false;
+  ready = false;
+  lastServerMessageAt = 0;
+  endpointBinding;
+  reconnectWhenSocketOpens = false;
+  connect() {
+    if (this.shouldReconnect) return;
+    this.shouldReconnect = true;
+    void this.open(false);
+  }
+  disconnect() {
+    this.shouldReconnect = false;
+    this.reconnectWhenSocketOpens = false;
+    this.generation += 1;
+    this.clearTimers();
+    this.ready = false;
+    this.endpointBinding?.onDisconnected?.();
+    this.socket?.close(1e3, "Client disconnected");
+    this.socket = void 0;
+    this.options.onStateChange?.("disconnected");
+  }
+  reconnect() {
+    this.reconnectWhenSocketOpens = false;
+    this.generation += 1;
+    this.clearTimers();
+    this.ready = false;
+    this.endpointBinding?.onDisconnected?.();
+    this.socket?.close(1e3, "Client reconnecting");
+    this.socket = void 0;
+    this.reconnectAttempts = 0;
+    this.shouldReconnect = true;
+    void this.open(true);
+  }
+  subscribe(topic, afterSeq) {
+    this.desiredSubscriptions.set(topic, afterSeq);
+    if (afterSeq !== void 0) this.cursors.set(topic, afterSeq);
+    if (this.ready) {
+      this.sendSubscriptions([{ topic, afterSeq: this.cursors.get(topic) ?? afterSeq }]);
+    }
+  }
+  unsubscribe(topic) {
+    this.desiredSubscriptions.delete(topic);
+    if (this.ready) this.send(this.clientMessage("realtime.unsubscribe", { topics: [topic] }));
+  }
+  sendEndpointMessage(message) {
+    if (!this.ready) throw new Error("Realtime connection is not ready");
+    this.send(this.clientMessage("endpoint.message", message));
+  }
+  setEndpoint(binding) {
+    this.endpointBinding = binding;
+    this.refreshEndpointConnection();
+  }
+  clearEndpoint(binding) {
+    if (binding && this.endpointBinding !== binding) return;
+    const previous = this.endpointBinding;
+    this.endpointBinding = void 0;
+    previous?.onDisconnected?.();
+    this.refreshEndpointConnection();
+  }
+  refreshEndpointConnection() {
+    if (!this.shouldReconnect) return;
+    if (this.socket?.readyState === 0) {
+      this.reconnectWhenSocketOpens = true;
+      return;
+    }
+    this.reconnect();
+  }
+  async open(reconnecting) {
+    const generation = ++this.generation;
+    const timeoutMs = this.options.connectionTimeoutMs ?? 15e3;
+    const ticketAbort = new AbortController();
+    this.ticketAbort?.abort();
+    this.ticketAbort = ticketAbort;
+    let socket;
+    let closed = false;
+    let messageQueue;
+    const failAttempt = (error, retry = true) => {
+      if (closed || generation !== this.generation) return;
+      closed = true;
+      this.clearConnectionTimer();
+      ticketAbort.abort();
+      if (this.ticketAbort === ticketAbort) this.ticketAbort = void 0;
+      this.ready = false;
+      this.endpointBinding?.onDisconnected?.();
+      this.clearHeartbeat();
+      if (this.socket === socket) this.socket = void 0;
+      if (socket) {
+        socket.onopen = null;
+        socket.onmessage = null;
+        socket.onerror = null;
+        socket.onclose = null;
+        socket.close(4e3, error.slice(0, 120));
+      }
+      if (this.shouldReconnect && retry) this.scheduleReconnect(error);
+      else if (this.shouldReconnect) {
+        this.shouldReconnect = false;
+        this.options.onStateChange?.("error", error);
+      } else this.options.onStateChange?.("disconnected");
+    };
+    this.connectionTimer = setTimeout(() => failAttempt("Realtime connection timed out"), timeoutMs);
+    this.options.onStateChange?.(reconnecting ? "reconnecting" : "connecting");
+    try {
+      const [ticket, endpoint] = await Promise.all([
+        this.options.issueTicket(ticketAbort.signal),
+        this.endpointBinding?.createHello()
+      ]);
+      if (closed || !this.shouldReconnect || generation !== this.generation) return;
+      socket = this.options.createWebSocket(this.options.getWebSocketUrl());
+      this.socket = socket;
+      socket.onopen = () => {
+        if (generation !== this.generation) return;
+        if (this.reconnectWhenSocketOpens) {
+          this.reconnect();
+          return;
+        }
+        const subscriptions = [...this.desiredSubscriptions].map(([topic, afterSeq]) => ({
+          topic,
+          afterSeq: this.cursors.get(topic) ?? afterSeq
+        }));
+        this.send(this.clientMessage("realtime.hello", {
+          ticket,
+          clientId: this.options.clientId,
+          clientKind: this.options.clientKind,
+          subscriptions,
+          ...endpoint ? { endpoint } : {}
+        }));
+      };
+      socket.onmessage = (event) => {
+        if (generation !== this.generation) return;
+        const process = () => {
+          if (closed || generation !== this.generation) return;
+          return this.handleServerMessage(frameText(event.data));
+        };
+        if (!messageQueue) {
+          try {
+            const pending = process();
+            if (!pending) return;
+            const current2 = pending.catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
+            messageQueue = current2;
+            void current2.finally(() => {
+              if (messageQueue === current2) messageQueue = void 0;
+            });
+          } catch (error) {
+            failAttempt(error instanceof Error ? error.message : "Invalid realtime server message");
+          }
+          return;
+        }
+        const current = messageQueue.then(process).catch((error) => failAttempt(error instanceof Error ? error.message : "Invalid realtime server message")).then(() => void 0);
+        messageQueue = current;
+        void current.finally(() => {
+          if (messageQueue === current) messageQueue = void 0;
+        });
+      };
+      socket.onerror = () => {
+      };
+      socket.onclose = (event) => {
+        failAttempt(
+          event.reason || `WebSocket closed (${event.code ?? 0})`,
+          !isNonRetryableCloseCode(event.code)
+        );
+      };
+    } catch (error) {
+      failAttempt(error instanceof Error ? error.message : "Realtime connection failed");
+    }
+  }
+  handleServerMessage(text) {
+    const message = parseServerRealtimeMessage(JSON.parse(text));
+    this.lastServerMessageAt = Date.now();
+    if (message.kind === "realtime.ready") {
+      this.ready = true;
+      this.reconnectAttempts = 0;
+      this.clearConnectionTimer();
+      this.ticketAbort = void 0;
+      this.options.onStateChange?.("connected");
+      if (message.payload.endpoint) this.endpointBinding?.onReady(message.payload.endpoint);
+      this.clearHeartbeat();
+      this.heartbeatTimer = setInterval(() => {
+        if (!this.ready) return;
+        if (Date.now() - this.lastServerMessageAt >= message.payload.heartbeatTimeoutMs) {
+          this.reconnect();
+          return;
+        }
+        this.send(this.clientMessage("realtime.ping", {}));
+      }, message.payload.heartbeatIntervalMs);
+    } else if (message.kind === "realtime.event") {
+      const cursor = this.cursors.get(message.payload.topic);
+      if (cursor !== void 0 && message.payload.seq <= cursor) return;
+      this.options.onEvent?.(message.payload);
+      this.cursors.set(message.payload.topic, message.payload.seq);
+    } else if (message.kind === "realtime.subscribed") {
+      this.cursors.set(message.payload.topic, message.payload.cursor);
+    } else if (message.kind === "realtime.gap") {
+      this.cursors.set(message.payload.topic, message.payload.earliestSeq - 1);
+      return this.options.onGap?.(message.payload);
+    } else if (message.kind === "realtime.error") {
+      this.options.onStateChange?.("error", message.payload.message);
+    } else if (message.kind === "endpoint.message") {
+      this.endpointBinding?.onMessage(message.payload);
+      this.options.onEndpointMessage?.(message.payload);
+    }
+  }
+  sendSubscriptions(subscriptions) {
+    this.send(this.clientMessage("realtime.subscribe", { subscriptions }));
+  }
+  clientMessage(kind, payload) {
+    const messageId = this.options.createMessageId?.() ?? globalThis.crypto?.randomUUID?.();
+    if (!messageId) throw new Error("RealtimeClient requires createMessageId when crypto.randomUUID is unavailable");
+    return {
+      protocolVersion: REALTIME_PROTOCOL_VERSION,
+      messageId,
+      kind,
+      sentAt: Date.now(),
+      payload
+    };
+  }
+  send(message) {
+    if (!this.socket || this.socket.readyState !== 1) return;
+    this.socket.send(JSON.stringify(message));
+  }
+  scheduleReconnect(error) {
+    if (!this.shouldReconnect) return;
+    this.reconnectAttempts += 1;
+    const max = this.options.maxReconnectAttempts;
+    if (max !== void 0 && this.reconnectAttempts > max) {
+      this.shouldReconnect = false;
+      this.options.onStateChange?.("error", error);
+      return;
+    }
+    this.options.onStateChange?.("reconnecting", error);
+    const cap = Math.min(3e4, 1e3 * 2 ** Math.min(this.reconnectAttempts - 1, 5));
+    const delay = Math.round(cap * (0.5 + Math.random() * 0.5));
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = void 0;
+      void this.open(true);
+    }, delay);
+  }
+  clearHeartbeat() {
+    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
+    this.heartbeatTimer = void 0;
+  }
+  clearTimers() {
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = void 0;
+    this.clearConnectionTimer();
+    this.ticketAbort?.abort();
+    this.ticketAbort = void 0;
+    this.clearHeartbeat();
+  }
+  clearConnectionTimer() {
+    if (this.connectionTimer) clearTimeout(this.connectionTimer);
+    this.connectionTimer = void 0;
+  }
+}
+
 const devicePairingKeySchema = strictObject({
   kty: literal("EC"),
   crv: literal("P-256"),
@@ -5312,212 +5868,45 @@ ${marker.timeOrigin}`),
   };
 }
 
-const ENDPOINT_PROTOCOL_VERSION = 2;
-const endpointKindSchema = _enum(["web", "desktop", "mobile", "browser"]);
-const endpointAvailabilitySchema = _enum(["foreground", "background"]);
-const endpointEffectSchema = _enum(["read", "write", "destructive"]);
-const endpointConfirmationSchema = _enum(["never", "always"]);
-const endpointResultKindSchema = _enum(["text", "json", "file"]);
-const endpointSensitivitySchema = _enum(["public", "personal"]);
-const identifierSchema = string().min(1).max(160);
-const turnTokenSchema = string().min(32).max(160).regex(/^[A-Za-z0-9_-]+$/);
-const turnOriginSchema = discriminatedUnion("type", [
-  strictObject({ type: literal("endpoint"), endpointId: identifierSchema }),
-  strictObject({ type: literal("channel"), channel: string().min(1).max(64) }),
-  strictObject({
-    type: literal("system"),
-    source: _enum(["cli", "automation", "heartbeat", "workflow", "internal"])
-  })
-]);
-const endpointTurnOriginSchema = turnOriginSchema.options[0];
-endpointTurnOriginSchema.extend({ token: turnTokenSchema });
-const messageIdSchema = uuid();
-const timestampSchema = number().int().nonnegative();
-const jsonObjectSchema = record(string(), unknown());
-const endpointToolDescriptorSchema = strictObject({
-  name: string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/).max(120),
-  title: string().min(1).max(120),
-  description: string().min(1).max(2e3),
-  inputSchema: jsonObjectSchema,
-  outputSchema: jsonObjectSchema,
-  policyId: string().regex(/^[a-z][a-z0-9_.-]+$/).max(120),
-  sensitivity: endpointSensitivitySchema,
-  effect: endpointEffectSchema,
-  confirmation: endpointConfirmationSchema,
-  requiresForeground: boolean(),
-  requiredPermissions: array(string().min(1).max(120)).max(20),
-  timeoutMs: number().int().min(1e3).max(3e5),
-  maxConcurrency: number().int().min(1).max(4),
-  supportsCancellation: boolean(),
-  idempotent: boolean(),
-  resultKinds: array(endpointResultKindSchema).min(1).max(3)
-});
-strictObject({
-  principalId: identifierSchema,
-  displayName: string().min(1).max(120),
-  kind: endpointKindSchema,
-  platform: string().min(1).max(80),
-  publicKey: string().min(32).max(2048)
-});
-strictObject({
-  endpointId: identifierSchema
-});
-const backgroundCapabilitySchema = string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/).max(120);
-strictObject({
-  jobId: uuid(),
-  endpointId: identifierSchema,
-  capability: backgroundCapabilitySchema,
-  input: jsonObjectSchema,
-  idempotencyKey: identifierSchema,
-  consentGrantId: identifierSchema,
-  createdAt: timestampSchema,
-  expiresAt: timestampSchema
-});
-strictObject({
-  jobId: uuid(),
-  status: _enum(["queued", "running", "succeeded", "failed", "cancelled"]),
-  updatedAt: timestampSchema,
-  output: jsonObjectSchema.optional(),
-  error: strictObject({
-    code: identifierSchema,
-    message: string().min(1).max(2e3)
-  }).optional()
-});
-strictObject({
-  eventId: uuid(),
-  endpointId: identifierSchema,
-  subscriptionId: identifierSchema,
-  eventType: backgroundCapabilitySchema,
-  data: jsonObjectSchema,
-  occurredAt: timestampSchema
-});
-const endpointHelloPayloadSchema = strictObject({
-  principalId: identifierSchema,
-  endpointId: identifierSchema,
-  connectionInstanceId: uuid(),
-  displayName: string().min(1).max(120),
-  kind: endpointKindSchema,
-  platform: string().min(1).max(80),
-  appVersion: string().min(1).max(80),
-  availability: endpointAvailabilitySchema,
-  nonce: identifierSchema,
-  signedAt: timestampSchema,
-  signature: string().min(16).max(1024),
-  tools: array(endpointToolDescriptorSchema).max(100)
-});
-const toolInvokePayloadSchema = strictObject({
-  invocationId: uuid(),
-  toolCallId: identifierSchema,
-  toolName: endpointToolDescriptorSchema.shape.name,
-  arguments: jsonObjectSchema,
-  descriptorRevision: string().min(1).max(128),
-  confirmationRequired: boolean(),
-  deadlineAt: timestampSchema,
-  uploadGrant: strictObject({
-    path: string().startsWith("/").max(500),
-    token: identifierSchema,
-    maxBytes: number().int().positive(),
-    maxFiles: number().int().min(1).max(20),
-    expiresAt: timestampSchema
-  }).optional()
-});
-const toolCancelPayloadSchema = strictObject({
-  invocationId: uuid(),
-  reason: string().min(1).max(500)
-});
-const invocationPayloadSchema = strictObject({ invocationId: uuid() });
-const endpointToolContentSchema = discriminatedUnion("type", [
-  strictObject({ type: literal("text"), text: string().max(256 * 1024) }),
-  strictObject({ type: literal("json"), value: unknown() }),
-  strictObject({
-    type: literal("file"),
-    fileId: identifierSchema,
-    name: string().min(1).max(255),
-    mimeType: string().min(1).max(255),
-    size: number().int().nonnegative(),
-    sha256: string().regex(/^[a-f0-9]{64}$/)
-  })
-]);
-const endpointToolErrorCodeSchema = _enum([
-  "ENDPOINT_OFFLINE",
-  "ENDPOINT_NOT_FOREGROUND",
-  "ENDPOINT_DISCONNECTED",
-  "TOOL_NOT_FOUND",
-  "TOOL_REVISION_MISMATCH",
-  "INVALID_ARGUMENTS",
-  "PERMISSION_DENIED",
-  "USER_DENIED",
-  "TOOL_BUSY",
-  "TOOL_TIMEOUT",
-  "TOOL_CANCELLED",
-  "RESULT_TOO_LARGE",
-  "PROTOCOL_ERROR"
-]);
-const envelope = (type, payload) => strictObject({
-  protocolVersion: literal(ENDPOINT_PROTOCOL_VERSION),
-  messageId: messageIdSchema,
-  type: literal(type),
-  sentAt: timestampSchema,
-  payload
-});
-const clientEndpointMessageSchema = discriminatedUnion("type", [
-  envelope("endpoint.availability_changed", strictObject({ availability: endpointAvailabilitySchema })),
-  envelope("tool.received", invocationPayloadSchema),
-  envelope("tool.progress", strictObject({
-    invocationId: uuid(),
-    message: string().max(500).optional(),
-    percent: number().min(0).max(100).optional()
-  })),
-  envelope("tool.result", strictObject({
-    invocationId: uuid(),
-    content: array(endpointToolContentSchema).min(1).max(20),
-    details: jsonObjectSchema.optional()
-  })),
-  envelope("tool.error", strictObject({
-    invocationId: uuid(),
-    code: endpointToolErrorCodeSchema,
-    message: string().min(1).max(2e3)
-  })),
-  envelope("tool.cancelled", invocationPayloadSchema)
-]);
-const serverEndpointMessageSchema = discriminatedUnion("type", [
-  envelope("tool.invoke", toolInvokePayloadSchema),
-  envelope("tool.cancel", toolCancelPayloadSchema)
-]);
-function canonicalJson(value) {
-  if (value === null) return "null";
-  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error("Canonical JSON only supports finite numbers");
-    return JSON.stringify(value);
-  }
-  if (typeof value !== "object") throw new Error(`Canonical JSON does not support ${typeof value}`);
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  const prototype = Object.getPrototypeOf(value);
-  if (prototype !== Object.prototype && prototype !== null) {
-    throw new Error("Canonical JSON only supports plain objects");
-  }
-  const record = value;
-  return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
-}
-function endpointHelloSigningPayload(payload) {
-  const { signature: _signature, ...unsigned } = payload;
-  return canonicalJson(unsigned);
-}
-
 const PROFILE_KEY = "xopc.browser.profile";
+const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
 const KEY_DATABASE = "xopc-browser-identity";
 const KEY_STORE = "identity";
 const KEY_NAME = "device-key";
 const NATIVE_HOST_NAME = "ai.xopc.browser";
 let refreshTask;
-async function discoverLocalGateway() {
+async function browserPublicKeyThumbprint(jwk) {
+  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  return encodeBase64Url(new Uint8Array(await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(canonical)
+  )));
+}
+async function isAutoConnectEnabled() {
+  const stored = await chrome.storage.local.get(AUTO_CONNECT_KEY);
+  return stored[AUTO_CONNECT_KEY] !== false;
+}
+async function setAutoConnectEnabled(enabled) {
+  await chrome.storage.local.set({ [AUTO_CONNECT_KEY]: enabled });
+}
+async function discoverLocalGateway(options) {
   try {
+    if (!options?.force && !await isAutoConnectEnabled()) return void 0;
+    const pair = await getOrCreateKeyPair();
+    const key = await publicKeyJwk(pair);
+    const nonce = randomNonce();
     const response = await chrome.runtime.sendNativeMessage(
       NATIVE_HOST_NAME,
-      { type: "bootstrap" }
+      {
+        type: "bootstrap",
+        extensionId: chrome.runtime.id,
+        publicKeyJwk: key,
+        publicKeyThumbprint: await browserPublicKeyThumbprint(key),
+        nonce
+      }
     );
     if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.pairingLink !== "string" || typeof response.expiresAt !== "number") {
+      if (options?.force) throw new Error(response.error || "The local xopc enrollment host returned an invalid response");
       return void 0;
     }
     return {
@@ -5525,7 +5914,8 @@ async function discoverLocalGateway() {
       pairingLink: response.pairingLink,
       expiresAt: response.expiresAt
     };
-  } catch {
+  } catch (cause) {
+    if (options?.force) throw cause;
     return void 0;
   }
 }
@@ -5598,6 +5988,14 @@ async function getOrCreateKeyPair() {
   }).finally(() => database.close());
   return pair;
 }
+async function forgetIdentity() {
+  await new Promise((resolve, reject) => {
+    const request = indexedDB.deleteDatabase(KEY_DATABASE);
+    request.onsuccess = () => resolve();
+    request.onerror = () => reject(request.error);
+    request.onblocked = () => reject(new Error("Browser identity is still in use"));
+  });
+}
 async function publicKeyJwk(pair) {
   const exported = await crypto.subtle.exportKey("jwk", pair.publicKey);
   if (!exported.x || !exported.y) throw new Error("Browser identity key export failed");
@@ -5718,7 +6116,7 @@ async function pairGateway(link, onApproval) {
   const requestId = crypto.randomUUID();
   const initialRefreshToken = createRefreshToken();
   let result = await signedPairingRequest(pair, payload, origin, requestId, "request");
-  onApproval(result.request.confirmationCode);
+  if (result.request.status === "pending") onApproval(result.request.confirmationCode);
   while (result.request.status === "pending") {
     await wait(1500);
     result = await signedPairingRequest(pair, payload, origin, requestId, "status");
@@ -5801,7 +6199,7 @@ async function registerBrowserEndpoint() {
   });
   if (!response.ok) throw new Error(`Browser endpoint registration failed (${response.status})`);
 }
-async function createBrowserEndpointHello() {
+async function createBrowserEndpointHello(tools = []) {
   const profile = await getAccessProfile();
   const pair = await getOrCreateKeyPair();
   const unsigned = {
@@ -5816,7 +6214,7 @@ async function createBrowserEndpointHello() {
     nonce: crypto.randomUUID(),
     signedAt: Date.now(),
     signature: "pending",
-    tools: []
+    tools
   };
   return {
     ...unsigned,
@@ -5835,10 +6233,12 @@ async function revokeAndForgetProfile() {
     });
   } finally {
     await forgetProfile();
+    try {
+      await forgetIdentity();
+    } finally {
+      await setAutoConnectEnabled(false);
+    }
   }
 }
-async function signBrowserBridgeChallenge(payload) {
-  return sign(await getOrCreateKeyPair(), payload);
-}
 
-export { PENDING_CONTEXT_KEY as P, TAB_BINDING_PREFIX as T, _enum as _, activeTabId as a, array as b, boolean as c, captureTabPage as d, captureTabWithPermission as e, clientEndpointMessageSchema as f, createBrowserEndpointHello as g, currentTabDescriptor as h, discoverLocalGateway as i, discriminatedUnion as j, endpointHelloPayloadSchema as k, gatewayFetch as l, getAccessProfile as m, literal as n, number as o, pairGateway as p, registerBrowserEndpoint as q, readProfile as r, revokeAndForgetProfile as s, serverEndpointMessageSchema as t, signBrowserBridgeChallenge as u, strictObject as v, string as w, unknown as x, uuid as y };
+export { ENDPOINT_PROTOCOL_VERSION as E, PENDING_CONTEXT_KEY as P, RealtimeClient as R, TAB_BINDING_PREFIX as T, activeTabId as a, captureTabPage as b, canonicalJson as c, captureTabWithPermission as d, createBrowserEndpointHello as e, currentTabDescriptor as f, discoverLocalGateway as g, endpointToolContentSchema as h, gatewayFetch as i, getAccessProfile as j, registerBrowserEndpoint as k, revokeAndForgetProfile as l, pairGateway as p, readProfile as r, setAutoConnectEnabled as s };