@xopcai/xopc 0.0.269 → 0.0.272

package/dist/src/gateway/hono/routes/browser-session.js

@@ -0,0 +1,43 @@
+import { BrowserSessionLimitError, createBrowserSession, deleteBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
+import { browserCookieRequestAllowed, clearBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+//#region src/gateway/hono/routes/browser-session.ts
+function registerBrowserSessionRoutes(app, deps) {
+	app.get("/api/browser-session", (c) => {
+		c.header("Cache-Control", "no-store");
+		const principal = getGatewayPrincipal(c);
+		return c.json({ sessionKey: principal.principalId });
+	});
+	app.post("/api/browser-session", deps.strictRateLimitMiddleware, (c) => {
+		const principal = getGatewayPrincipal(c);
+		if (principal.kind !== "owner" || !browserCookieRequestAllowed(c)) return c.json({ error: "Forbidden" }, 403);
+		let session;
+		try {
+			session = createBrowserSession(deps.service.getResolvedAuth(), principal.browserSessionId);
+		} catch (error) {
+			if (error instanceof BrowserSessionLimitError) return c.json({ error: "Browser session limit reached" }, 409);
+			throw error;
+		}
+		if (principal.browserSessionId) {
+			deps.service.realtime.disconnectPrincipal(principal.principalId);
+			deps.service.voiceRealtime.disconnectPrincipal(principal.principalId);
+		}
+		writeBrowserSessionCookie(c, session.token, session.expiresAt);
+		c.header("Cache-Control", "no-store");
+		return c.json({ sessionKey: `browser:${session.sessionId}` });
+	});
+	app.delete("/api/browser-session", (c) => {
+		if (!browserCookieRequestAllowed(c)) return c.json({ error: "Forbidden" }, 403);
+		const principal = getGatewayPrincipal(c);
+		if (principal.browserSessionId) {
+			deleteBrowserSession(principal.browserSessionId);
+			deps.service.realtime.disconnectPrincipal(principal.principalId);
+			deps.service.voiceRealtime.disconnectPrincipal(principal.principalId);
+		}
+		clearBrowserSessionCookie(c);
+		c.header("Cache-Control", "no-store");
+		return c.json({ ok: true });
+	});
+}
+//#endregion
+export { registerBrowserSessionRoutes };

package/dist/src/gateway/hono/routes/capabilities.js

@@ -1,5 +1,5 @@
-import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { getStoreConnectorInstallPlan, installStoreConnector, listStoreConnectors } from "../../../capabilities/store-connector.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 //#region src/gateway/hono/routes/capabilities.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);

package/dist/src/gateway/hono/routes/connectors.js

@@ -12,10 +12,10 @@ import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from ".
 import { configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, inspectComposioConnectorHealth, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, setComposioToolkitScope, updateComposioConnection, updateComposioInstallationPolicy } from "../../../connectors/composio.js";
 import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
-import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";

package/dist/src/gateway/hono/routes/devices.js

@@ -1,13 +1,15 @@
-import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
-import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES } from "../../security/gateway-scopes.js";
-import { createDevice, issueDeviceTokenPair, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
+import { devicePairingTargetKindSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
-import { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
+import { createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
 import { resolveSecureDeviceRoutes } from "../../device-routes.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import "../../rate-limit/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
+import { bodyLimit } from "hono/body-limit";
 //#region src/gateway/hono/routes/devices.ts
 const refreshRequestSchema = z.strictObject({
 	refreshToken: z.string().min(1).max(256),
@@ -17,40 +19,33 @@ const refreshRequestSchema = z.strictObject({
 	nextRefreshToken: z.string().min(80).max(256),
 	signature: z.string().min(1).max(256)
 });
-const pairingExchangeSchema = z.strictObject({
-	pairingToken: z.string().min(1).max(256),
-	device: z.strictObject({
-		displayName: z.string().trim().min(1).max(80),
-		platform: z.enum([
-			"ios",
-			"android",
-			"chrome"
-		]),
-		extensionId: z.string().regex(/^[a-p]{32}$/).optional(),
-		publicKeyJwk: z.strictObject({
-			kty: z.literal("EC"),
-			crv: z.literal("P-256"),
-			x: z.string().min(40).max(64),
-			y: z.string().min(40).max(64)
-		})
-	})
-}).superRefine((value, context) => {
-	if (value.device.platform === "chrome" && !value.device.extensionId) context.addIssue({
-		code: "custom",
-		path: ["device", "extensionId"],
-		message: "Chrome devices require an extension id"
-	});
-	if (value.device.platform !== "chrome" && value.device.extensionId) context.addIssue({
-		code: "custom",
-		path: ["device", "extensionId"],
-		message: "Only Chrome devices may set an extension id"
-	});
-});
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
+const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
 function pairingLinkPayload(input) {
 	return Buffer.from(JSON.stringify(input)).toString("base64url");
 }
 function registerDeviceAuthPublicRoutes(app) {
+	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
+		const budget = buckets.identityChallenge().consume("gateway");
+		if (!budget.allowed) {
+			c.header("Retry-After", String(Math.ceil(budget.retryAfterMs / 1e3)));
+			return c.json({ error: "Too many identity challenges" }, 429);
+		}
+		const parsed = z.strictObject({ nonce: z.string().regex(/^[A-Za-z0-9_-]{32,64}$/) }).safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({ error: "Invalid identity challenge" }, 400);
+		const identity = getOrCreateGatewayIdentity();
+		const signedPayload = Buffer.from(JSON.stringify({
+			purpose: "gateway-route-v1",
+			gatewayId: identity.id,
+			nonce: parsed.data.nonce,
+			expiresAt: Date.now() + 3e4
+		})).toString("base64url");
+		c.header("Cache-Control", "no-store");
+		return c.json({
+			signedPayload,
+			signature: signGatewayPayload(signedPayload)
+		});
+	});
 	registerPairingApprovalPublicRoutes(app);
 	app.post("/api/device-auth/refresh", async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -62,9 +57,19 @@ function registerDeviceAuthPublicRoutes(app) {
 			}
 		}, 400);
 		try {
+			const tokens = rotateDeviceRefreshToken(parsed.data);
+			const signedPayload = Buffer.from(JSON.stringify({
+				purpose: "device-refresh-v3",
+				gatewayId: getOrCreateGatewayIdentity().id,
+				requestId: parsed.data.requestId,
+				nonce: parsed.data.nonce,
+				expiresAt: Date.now() + 3e4,
+				tokens
+			})).toString("base64url");
 			return c.json({
 				ok: true,
-				payload: rotateDeviceRefreshToken(parsed.data)
+				signedPayload,
+				signature: signGatewayPayload(signedPayload)
 			});
 		} catch (error) {
 			return c.json({
@@ -97,61 +102,6 @@ function registerDeviceAuthPublicRoutes(app) {
 			signature: signGatewayPayload(payload)
 		});
 	});
-	app.post("/api/device-pairing/exchange", async (c) => {
-		const parsed = pairingExchangeSchema.safeParse(await c.req.json().catch(() => null));
-		if (!parsed.success) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: "Invalid pairing request"
-			}
-		}, 400);
-		const completed = runSqliteWriteTransaction(() => {
-			const pairing = consumeDevicePairingToken(parsed.data.pairingToken);
-			if (!pairing.ok && "reason" in pairing) return {
-				success: false,
-				reason: pairing.reason
-			};
-			const device = createDevice({
-				displayName: parsed.data.device.displayName,
-				platform: parsed.data.device.platform,
-				publicKeyJwk: parsed.data.device.publicKeyJwk,
-				extensionId: parsed.data.device.extensionId,
-				scopes: parsed.data.device.platform === "chrome" ? DEFAULT_BROWSER_EXTENSION_SCOPES : DEFAULT_MOBILE_SCOPES
-			});
-			return {
-				success: true,
-				device,
-				routes: pairing.routes,
-				tokens: issueDeviceTokenPair(device.id)
-			};
-		});
-		if ("reason" in completed) return c.json({
-			ok: false,
-			error: {
-				code: "PAIRING_DENIED",
-				message: `Pairing ${completed.reason}`
-			}
-		}, 401);
-		const identity = getOrCreateGatewayIdentity();
-		const payload = Buffer.from(JSON.stringify({
-			gateway: {
-				id: identity.id,
-				name: os.hostname()
-			},
-			device: {
-				id: completed.device.id,
-				scopes: completed.device.scopes
-			},
-			routes: completed.routes,
-			tokens: completed.tokens
-		})).toString("base64url");
-		return c.json({
-			ok: true,
-			signedPayload: payload,
-			signature: signGatewayPayload(payload)
-		}, 201);
-	});
 }
 function registerDeviceRoutes(authenticated, deps) {
 	registerPairingApprovalAdminRoutes(authenticated);
@@ -161,14 +111,21 @@ function registerDeviceRoutes(authenticated, deps) {
 			ok: true,
 			ready: routes.length > 0,
 			routes,
-			protocolVersions: [2, 3],
+			protocolVersion: 3,
 			routeState: routes.length > 0 ? "configured" : "missing",
 			nextAction: routes.length > 0 ? "scan" : "configure-route",
 			serverTime: Date.now()
 		});
 	});
 	authenticated.post("/api/device-pairing/setups", async (c) => {
-		const version = (await c.req.json().catch(() => ({}))).protocolVersion === 3 ? 3 : 2;
+		const parsed = pairingSetupSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Choose a device type"
+			}
+		}, 400);
 		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
 		if (routes.length === 0) return c.json({
 			ok: false,
@@ -177,15 +134,16 @@ function registerDeviceRoutes(authenticated, deps) {
 				message: "Configure XOPC Secure Link, Tailscale Serve, or an HTTPS public URL first"
 			}
 		}, 409);
-		const setup = createDevicePairingSetup(routes, Date.now(), version);
+		const setup = createDevicePairingSetup(routes, Date.now(), { targetKind: parsed.data.targetKind });
 		const identity = getOrCreateGatewayIdentity();
 		const encoded = pairingLinkPayload({
-			version,
+			version: 3,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
 			gatewayName: os.hostname(),
 			gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
 			routes,
+			targetKind: setup.targetKind,
 			expiresAt: setup.expiresAt
 		});
 		return c.json({
@@ -195,7 +153,8 @@ function registerDeviceRoutes(authenticated, deps) {
 				universalLink: `https://link.xopc.ai/connect#p=${encoded}`,
 				expiresAt: setup.expiresAt,
 				routes,
-				protocolVersion: version
+				protocolVersion: 3,
+				targetKind: setup.targetKind
 			}
 		}, 201);
 	});
@@ -234,7 +193,10 @@ function registerDeviceRoutes(authenticated, deps) {
 			}
 		}, 403);
 		const revoked = revokeDevice(principal.deviceId);
-		if (revoked) deps.service.realtime.disconnectPrincipal(principal.deviceId);
+		if (revoked) {
+			deps.service.realtime.disconnectPrincipal(principal.deviceId);
+			deps.service.voiceRealtime.disconnectPrincipal(principal.deviceId);
+		}
 		return c.json({
 			ok: true,
 			revoked
@@ -243,7 +205,10 @@ function registerDeviceRoutes(authenticated, deps) {
 	authenticated.delete("/api/devices/:deviceId", (c) => {
 		const deviceId = c.req.param("deviceId");
 		const revoked = revokeDevice(deviceId);
-		if (revoked) deps.service.realtime.disconnectPrincipal(deviceId);
+		if (revoked) {
+			deps.service.realtime.disconnectPrincipal(deviceId);
+			deps.service.voiceRealtime.disconnectPrincipal(deviceId);
+		}
 		return c.json({
 			ok: true,
 			revoked

package/dist/src/gateway/hono/routes/exposure.js

@@ -1,15 +1,11 @@
-import { extractToken } from "../../auth.js";
 import { getExposureManager } from "../../../remote-access/exposure-manager.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 //#region src/gateway/hono/routes/exposure.ts
-function requireGatewayToken(c) {
-	return extractToken({ authorization: c.req.header("authorization") ?? void 0 }) ?? null;
-}
 function createExposureMutationRateLimitMiddleware() {
 	return async (c, next) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const result = consumeTunnelMutationLimit(token);
+		const principalId = getGatewayPrincipal(c).principalId;
+		const result = consumeTunnelMutationLimit(principalId);
 		if (!result.allowed) {
 			const retryAfterSec = Math.ceil(result.retryAfterMs / 1e3);
 			c.header("Retry-After", String(retryAfterSec));

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,14 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "browser-session",
+		match: (path) => path === "/api/browser-session",
+		load: async () => {
+			const { registerBrowserSessionRoutes } = await import("./browser-session.js");
+			return { register: registerBrowserSessionRoutes };
+		}
+	},
 	{
 		id: "proactive",
 		match: (path) => startsWithAny(path, [

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,7 +1,7 @@
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
-import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
+import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts

package/dist/src/gateway/hono/routes/models.js

@@ -13,7 +13,7 @@ import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImag
 import { SessionConfigStore } from "../../../session/config-store.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
-import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
+import { getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
@@ -505,6 +505,65 @@ function registerModelsRoutes(authenticated, deps) {
 			}, 502);
 		}
 	});
+	authenticated.get("/api/image-generation/default", (c) => c.json({
+		ok: true,
+		payload: getDefaultImageGenerationConfig(service.currentConfig)
+	}));
+	authenticated.post("/api/image-generation/default/setup", strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.providerId !== "string") return c.json({
+			ok: false,
+			error: { message: "providerId is required" }
+		}, 400);
+		const prepared = prepareDefaultImageGenerationSetup(service.currentConfig, {
+			providerId: body.providerId,
+			...typeof body.modelId === "string" ? { modelId: body.modelId } : {},
+			...body.providerConfig && typeof body.providerConfig === "object" && !Array.isArray(body.providerConfig) ? { providerConfig: body.providerConfig } : {}
+		});
+		if (prepared.ok === false) return c.json({
+			ok: false,
+			error: { message: prepared.error }
+		}, 400);
+		const resolver = new CredentialResolver();
+		const usesApiKey = resolveImageGenerationCredentialMode(getImageGenerationProvider(prepared.providerId)) === "api-key";
+		const previousKey = usesApiKey ? await resolver.revealGatewayStoredApiKey(prepared.providerId) : void 0;
+		const suppliedKey = typeof body.apiKey === "string" ? body.apiKey.trim() : "";
+		const effectiveKey = usesApiKey ? suppliedKey || await resolver.resolveApiKey(prepared.providerId) : void 0;
+		if (usesApiKey && !effectiveKey) return c.json({
+			ok: false,
+			error: { message: "API key is required" }
+		}, 400);
+		const verification = usesApiKey && suppliedKey ? await verifyImageGenerationCredential({
+			providerId: prepared.providerId,
+			apiKey: suppliedKey,
+			baseUrl: typeof body.providerConfig?.baseUrl === "string" ? body.providerConfig.baseUrl : void 0
+		}) : {
+			verified: false,
+			supported: false
+		};
+		if (verification.supported && !verification.verified) return c.json({
+			ok: false,
+			error: { message: verification.message ?? "Credential verification failed" }
+		}, 400);
+		if (usesApiKey && suppliedKey) await resolver.saveApiKey(prepared.providerId, suppliedKey, { profileName: "default" });
+		const saved = await service.saveConfig(prepared.config);
+		if (!saved.saved) {
+			if (usesApiKey && suppliedKey) if (previousKey) await resolver.saveApiKey(prepared.providerId, previousKey, { profileName: "default" });
+			else await resolver.deleteProfile(`${prepared.providerId}:default`);
+			return c.json({
+				ok: false,
+				error: { message: saved.error ?? "Failed to save configuration" }
+			}, 500);
+		}
+		return c.json({
+			ok: true,
+			payload: {
+				default: getDefaultImageGenerationConfig(service.currentConfig),
+				providers: getImageGenerationCatalog(service.currentConfig),
+				verification
+			}
+		});
+	});
 	authenticated.get("/api/agents/:agentId/image-generation", (c) => {
 		try {
 			return c.json({

package/dist/src/gateway/hono/routes/notes.js

@@ -5,7 +5,7 @@ import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
 import { getShareStore } from "../../../share/share-store.js";
 import { resolveShareUrl } from "../../../share/share-url.js";
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
-import { extractToken } from "../../auth.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { NoteShareService, NoteShareVersionConflictError } from "../../../share/note-share-service.js";
 import { createReadStream } from "node:fs";
 import { createHash } from "node:crypto";
@@ -412,11 +412,7 @@ function registerNotesRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/notes/:id/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		const body = await c.req.json().catch(() => ({}));
 		const shares = noteShares();
 		try {
@@ -426,7 +422,7 @@ function registerNotesRoutes(authenticated, deps) {
 				ttlMs: typeof body.ttlMs === "number" ? body.ttlMs : void 0,
 				maxViews: body.maxViews === null ? null : typeof body.maxViews === "number" ? body.maxViews : void 0,
 				description: typeof body.description === "string" ? body.description.trim() || void 0 : void 0,
-				gatewayTokenHash: createHash("sha256").update(gatewayToken, "utf8").digest("hex").slice(0, 12)
+				gatewayTokenHash: createHash("sha256").update(principalId, "utf8").digest("hex").slice(0, 12)
 			});
 			const resolved = resolveShareUrl(record.token, shareUrlContext());
 			return c.json({

package/dist/src/gateway/hono/routes/proactive-control.js

@@ -1,26 +1,51 @@
 import { getSqliteDatabase } from "../../../storage/sqlite/transaction.js";
-import { getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
-import { resolveProjectAgentId } from "../../../projects/project-agent.js";
-import "../../../projects/index.js";
 import { ProactiveConflict, proactivePreferences, updateProactivePreferences } from "../../../proactive/policy/service.js";
-import { recordProactivePresence } from "../../../proactive/policy/presence.js";
 import { controlledSubscriptions, createControlledSubscription, requireSubscription, templateCatalog, updateControlledSubscription } from "../../../proactive/scenarios/control.js";
+import { listMailFollowUps, mailFollowUpSources, startMailFollowUp, updateMailFollowUp } from "../../../proactive/follow-ups.js";
 import { cardChanges, getCard, listCards, performCardAction } from "../../../proactive/inbox/cards.js";
+import { checkDelegation, delegationOverview, startDelegation } from "../../../proactive/experience.js";
+import { recordProactivePresence } from "../../../proactive/policy/presence.js";
 import { digestCards } from "../../../proactive/inbox/digest.js";
 import { acknowledgeBrowserProbe, listBrowserProbes, prepareBrowserPush, registerBrowserPush, testBrowserPush, unregisterBrowserPush } from "../../../notifications/web-push.js";
 import { ReadonlyProactiveAgentExecutor } from "../../../proactive/execution/agent-executor.js";
 import { proactiveMetrics } from "../../../proactive/metrics.js";
-import { prepareCardWorkflow, workflowForCard } from "../../../proactive/actions/workflow.js";
 import { previewSubscription } from "../../../proactive/scenarios/preview.js";
 import { ZodError } from "zod";
 //#region src/gateway/hono/routes/proactive-control.ts
-init_resolve_route();
 function registerProactiveControlRoutes(app, deps) {
 	app.onError((error, c) => c.json({
 		ok: false,
 		error: error instanceof ZodError ? "Invalid request" : error.message
 	}, error instanceof ProactiveConflict ? 409 : 400));
 	const workspace = () => deps.service.currentWorkspacePath;
+	app.get("/api/proactive/follow-ups/sources", (c) => c.json({
+		ok: true,
+		sources: mailFollowUpSources(workspace())
+	}));
+	app.get("/api/proactive/follow-ups", (c) => c.json({
+		ok: true,
+		followUps: listMailFollowUps(workspace())
+	}));
+	app.post("/api/proactive/follow-ups", deps.strictRateLimitMiddleware, async (c) => c.json({
+		ok: true,
+		followUp: startMailFollowUp(workspace(), await c.req.json())
+	}, 201));
+	app.patch("/api/proactive/follow-ups/:id", deps.strictRateLimitMiddleware, async (c) => c.json({
+		ok: true,
+		followUp: updateMailFollowUp(workspace(), c.req.param("id"), await c.req.json())
+	}));
+	app.get("/api/proactive/overview", (c) => c.json({
+		ok: true,
+		...delegationOverview(workspace())
+	}));
+	app.post("/api/proactive/delegations", deps.strictRateLimitMiddleware, async (c) => c.json({
+		ok: true,
+		subscription: startDelegation(workspace(), await c.req.json())
+	}, 201));
+	app.post("/api/proactive/subscriptions/:id/check", deps.strictRateLimitMiddleware, (c) => c.json({
+		ok: true,
+		...checkDelegation(workspace(), c.req.param("id"))
+	}, 202));
 	for (const path of ["/api/proactive/*", "/api/inbox/judgments/*"]) app.use(path, async (c, next) => {
 		try {
 			const id = c.req.path.match(/^\/api\/inbox\/judgments\/([^/]+)/)?.[1];
@@ -57,24 +82,6 @@ function registerProactiveControlRoutes(app, deps) {
 		unregisterBrowserPush(workspace(), c.req.param("id"));
 		return c.json({ ok: true });
 	});
-	app.get("/api/inbox/judgments/:itemId/workflow", async (c) => c.json({
-		ok: true,
-		workflow: await workflowForCard(c.req.param("itemId"), workspace(), deps.service.createWorkflowRunService())
-	}));
-	app.post("/api/inbox/judgments/:itemId/prepare", deps.strictRateLimitMiddleware, async (c) => {
-		const card = getCard(c.req.param("itemId"), workspace());
-		const sub = requireSubscription(card.subscriptionId, workspace());
-		const config = deps.service.currentConfig;
-		const agentId = sub.scopeKind === "project" ? resolveProjectAgentId({
-			config,
-			projects: deps.service.projects,
-			projectId: sub.scopeId
-		}) : getDefaultAgentId(config);
-		return c.json({
-			ok: true,
-			workflow: await prepareCardWorkflow(workspace(), card.id, await c.req.json(), agentId, deps.service.createWorkflowRunService())
-		}, 202);
-	});
 	app.post("/api/proactive/presence", deps.strictRateLimitMiddleware, async (c) => {
 		recordProactivePresence(workspace(), await c.req.json());
 		return c.json({ ok: true });

package/dist/src/gateway/hono/routes/sessions.js

@@ -1,4 +1,5 @@
 import { deleteBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
+import { SessionDiscoveryQuerySchema } from "../../../../packages/gateway-contract/src/session-identity.js";
 import { buildSessionKey, init_session_key } from "../../../routing/session-key.js";
 import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import "../../../projects/index.js";
@@ -259,8 +260,18 @@ function registerSessionsRoutes(authenticated, deps) {
 		const blocked = ensureGatewayReadyForSessions(c, service, "sessions.list");
 		if (blocked) return blocked;
 		const query = c.req.query();
+		const discovery = SessionDiscoveryQuerySchema.safeParse({
+			sources: query.sources?.split(","),
+			purposes: query.purposes?.split(","),
+			activity: query.activity,
+			agentId: query.agentId,
+			excludeArchived: query.excludeArchived === "true"
+		});
+		if (!discovery.success) return c.json({ error: "Invalid session filters" }, 400);
+		if (query.updatedAfter && !Number.isFinite(Number(query.updatedAfter))) return c.json({ error: "Invalid session time filter" }, 400);
 		const sessionTypes = query.types?.split(",").map((value) => value.trim()).filter(isSessionType);
 		const result = await service.sessions.listSessions({
+			...discovery.data,
 			status: query.status,
 			search: query.search,
 			channel: query.channel,

package/dist/src/gateway/hono/routes/shares.js

@@ -15,10 +15,10 @@ import { publishHostedStaticSite } from "../../../share/hosted-static-site-publi
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { audienceDefaults, cleanupStagedSite, decideShareKind, forgetStagedSite, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../../share/share-auto.js";
 import { deleteThumbnail, placeholderSvg, readThumbnail, scheduleThumbnail, thumbnailContentType, thumbnailExists } from "../../../share/share-thumbnail.js";
-import { extractToken } from "../../auth.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
 import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { SHARED_HTML_CSP } from "../../security/csp.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage, renderSnapshotShareLandingPage } from "../../../share/share-landing.js";
 import { resolveScopedMediaReference } from "../../media-access.js";
 import { NoteShareService } from "../../../share/note-share-service.js";
@@ -56,7 +56,7 @@ function resolveShareConfig(service) {
 	if (!raw || typeof raw !== "object") return {};
 	return raw;
 }
-function hashGatewayToken(token) {
+function hashPrincipal(token) {
 	return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 12);
 }
 const MAX_CONCURRENT_DOWNLOADS_PER_TOKEN = 5;
@@ -594,11 +594,7 @@ function registerShareRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/sessions/:key/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		const body = await c.req.json().catch(() => ({}));
 		if (typeof body.expectedSessionId !== "string" || typeof body.expectedCutoffSeq !== "number" || typeof body.expectedMetadataUpdatedAt !== "string") return c.json({
 			ok: false,
@@ -614,7 +610,7 @@ function registerShareRoutes(authenticated, deps) {
 				description: typeof body.description === "string" ? body.description.trim() || void 0 : void 0,
 				includeToolActivities: body.includeToolActivities === true,
 				attachmentIds: Array.isArray(body.attachmentIds) ? body.attachmentIds.filter((id) => typeof id === "string") : void 0,
-				gatewayTokenHash: hashGatewayToken(gatewayToken)
+				gatewayTokenHash: hashPrincipal(principalId)
 			});
 			const resolved = resolveShareUrl(record.token, getShareUrlContext(service));
 			return c.json({
@@ -1130,11 +1126,7 @@ function registerShareRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.post("/api/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		let body;
 		try {
 			body = await c.req.json();
@@ -1201,7 +1193,7 @@ function registerShareRoutes(authenticated, deps) {
 				sessionKey,
 				agentId,
 				workspaceRoot,
-				gatewayTokenHash: hashGatewayToken(gatewayToken),
+				gatewayTokenHash: hashPrincipal(principalId),
 				kind,
 				directoryMode,
 				followSymlinks,
@@ -1242,11 +1234,7 @@ function registerShareRoutes(authenticated, deps) {
 	* reachability) in a single round-trip.
 	*/
 	authenticated.post("/api/shares/auto", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		let body;
 		try {
 			body = await c.req.json();
@@ -1309,7 +1297,7 @@ function registerShareRoutes(authenticated, deps) {
 		const defaults = audienceDefaults(audience);
 		const ttlMs = ttlOverride ?? defaults.ttlMs;
 		const maxViews = maxViewsOverride !== void 0 ? maxViewsOverride : defaults.maxViews;
-		const tokenHash = hashGatewayToken(gatewayToken);
+		const tokenHash = hashPrincipal(principalId);
 		const urlCtx = getShareUrlContext(service);
 		try {
 			if (decision.kind === "site") {