@xopcai/xopc 0.0.270 → 0.0.272

package/dist/src/gateway/hono/routes/devices.js

@@ -1,13 +1,15 @@
-import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
-import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES } from "../../security/gateway-scopes.js";
-import { createDevice, issueDeviceTokenPair, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
+import { devicePairingTargetKindSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
-import { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
+import { createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
 import { resolveSecureDeviceRoutes } from "../../device-routes.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import "../../rate-limit/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
+import { bodyLimit } from "hono/body-limit";
 //#region src/gateway/hono/routes/devices.ts
 const refreshRequestSchema = z.strictObject({
 	refreshToken: z.string().min(1).max(256),
@@ -17,40 +19,33 @@ const refreshRequestSchema = z.strictObject({
 	nextRefreshToken: z.string().min(80).max(256),
 	signature: z.string().min(1).max(256)
 });
-const pairingExchangeSchema = z.strictObject({
-	pairingToken: z.string().min(1).max(256),
-	device: z.strictObject({
-		displayName: z.string().trim().min(1).max(80),
-		platform: z.enum([
-			"ios",
-			"android",
-			"chrome"
-		]),
-		extensionId: z.string().regex(/^[a-p]{32}$/).optional(),
-		publicKeyJwk: z.strictObject({
-			kty: z.literal("EC"),
-			crv: z.literal("P-256"),
-			x: z.string().min(40).max(64),
-			y: z.string().min(40).max(64)
-		})
-	})
-}).superRefine((value, context) => {
-	if (value.device.platform === "chrome" && !value.device.extensionId) context.addIssue({
-		code: "custom",
-		path: ["device", "extensionId"],
-		message: "Chrome devices require an extension id"
-	});
-	if (value.device.platform !== "chrome" && value.device.extensionId) context.addIssue({
-		code: "custom",
-		path: ["device", "extensionId"],
-		message: "Only Chrome devices may set an extension id"
-	});
-});
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
+const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
 function pairingLinkPayload(input) {
 	return Buffer.from(JSON.stringify(input)).toString("base64url");
 }
 function registerDeviceAuthPublicRoutes(app) {
+	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
+		const budget = buckets.identityChallenge().consume("gateway");
+		if (!budget.allowed) {
+			c.header("Retry-After", String(Math.ceil(budget.retryAfterMs / 1e3)));
+			return c.json({ error: "Too many identity challenges" }, 429);
+		}
+		const parsed = z.strictObject({ nonce: z.string().regex(/^[A-Za-z0-9_-]{32,64}$/) }).safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({ error: "Invalid identity challenge" }, 400);
+		const identity = getOrCreateGatewayIdentity();
+		const signedPayload = Buffer.from(JSON.stringify({
+			purpose: "gateway-route-v1",
+			gatewayId: identity.id,
+			nonce: parsed.data.nonce,
+			expiresAt: Date.now() + 3e4
+		})).toString("base64url");
+		c.header("Cache-Control", "no-store");
+		return c.json({
+			signedPayload,
+			signature: signGatewayPayload(signedPayload)
+		});
+	});
 	registerPairingApprovalPublicRoutes(app);
 	app.post("/api/device-auth/refresh", async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -62,9 +57,19 @@ function registerDeviceAuthPublicRoutes(app) {
 			}
 		}, 400);
 		try {
+			const tokens = rotateDeviceRefreshToken(parsed.data);
+			const signedPayload = Buffer.from(JSON.stringify({
+				purpose: "device-refresh-v3",
+				gatewayId: getOrCreateGatewayIdentity().id,
+				requestId: parsed.data.requestId,
+				nonce: parsed.data.nonce,
+				expiresAt: Date.now() + 3e4,
+				tokens
+			})).toString("base64url");
 			return c.json({
 				ok: true,
-				payload: rotateDeviceRefreshToken(parsed.data)
+				signedPayload,
+				signature: signGatewayPayload(signedPayload)
 			});
 		} catch (error) {
 			return c.json({
@@ -97,61 +102,6 @@ function registerDeviceAuthPublicRoutes(app) {
 			signature: signGatewayPayload(payload)
 		});
 	});
-	app.post("/api/device-pairing/exchange", async (c) => {
-		const parsed = pairingExchangeSchema.safeParse(await c.req.json().catch(() => null));
-		if (!parsed.success) return c.json({
-			ok: false,
-			error: {
-				code: "BAD_REQUEST",
-				message: "Invalid pairing request"
-			}
-		}, 400);
-		const completed = runSqliteWriteTransaction(() => {
-			const pairing = consumeDevicePairingToken(parsed.data.pairingToken);
-			if (!pairing.ok && "reason" in pairing) return {
-				success: false,
-				reason: pairing.reason
-			};
-			const device = createDevice({
-				displayName: parsed.data.device.displayName,
-				platform: parsed.data.device.platform,
-				publicKeyJwk: parsed.data.device.publicKeyJwk,
-				extensionId: parsed.data.device.extensionId,
-				scopes: parsed.data.device.platform === "chrome" ? DEFAULT_BROWSER_EXTENSION_SCOPES : DEFAULT_MOBILE_SCOPES
-			});
-			return {
-				success: true,
-				device,
-				routes: pairing.routes,
-				tokens: issueDeviceTokenPair(device.id)
-			};
-		});
-		if ("reason" in completed) return c.json({
-			ok: false,
-			error: {
-				code: "PAIRING_DENIED",
-				message: `Pairing ${completed.reason}`
-			}
-		}, 401);
-		const identity = getOrCreateGatewayIdentity();
-		const payload = Buffer.from(JSON.stringify({
-			gateway: {
-				id: identity.id,
-				name: os.hostname()
-			},
-			device: {
-				id: completed.device.id,
-				scopes: completed.device.scopes
-			},
-			routes: completed.routes,
-			tokens: completed.tokens
-		})).toString("base64url");
-		return c.json({
-			ok: true,
-			signedPayload: payload,
-			signature: signGatewayPayload(payload)
-		}, 201);
-	});
 }
 function registerDeviceRoutes(authenticated, deps) {
 	registerPairingApprovalAdminRoutes(authenticated);
@@ -161,14 +111,21 @@ function registerDeviceRoutes(authenticated, deps) {
 			ok: true,
 			ready: routes.length > 0,
 			routes,
-			protocolVersions: [2, 3],
+			protocolVersion: 3,
 			routeState: routes.length > 0 ? "configured" : "missing",
 			nextAction: routes.length > 0 ? "scan" : "configure-route",
 			serverTime: Date.now()
 		});
 	});
 	authenticated.post("/api/device-pairing/setups", async (c) => {
-		const version = (await c.req.json().catch(() => ({}))).protocolVersion === 3 ? 3 : 2;
+		const parsed = pairingSetupSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Choose a device type"
+			}
+		}, 400);
 		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
 		if (routes.length === 0) return c.json({
 			ok: false,
@@ -177,15 +134,16 @@ function registerDeviceRoutes(authenticated, deps) {
 				message: "Configure XOPC Secure Link, Tailscale Serve, or an HTTPS public URL first"
 			}
 		}, 409);
-		const setup = createDevicePairingSetup(routes, Date.now(), version);
+		const setup = createDevicePairingSetup(routes, Date.now(), { targetKind: parsed.data.targetKind });
 		const identity = getOrCreateGatewayIdentity();
 		const encoded = pairingLinkPayload({
-			version,
+			version: 3,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
 			gatewayName: os.hostname(),
 			gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
 			routes,
+			targetKind: setup.targetKind,
 			expiresAt: setup.expiresAt
 		});
 		return c.json({
@@ -195,7 +153,8 @@ function registerDeviceRoutes(authenticated, deps) {
 				universalLink: `https://link.xopc.ai/connect#p=${encoded}`,
 				expiresAt: setup.expiresAt,
 				routes,
-				protocolVersion: version
+				protocolVersion: 3,
+				targetKind: setup.targetKind
 			}
 		}, 201);
 	});
@@ -234,7 +193,10 @@ function registerDeviceRoutes(authenticated, deps) {
 			}
 		}, 403);
 		const revoked = revokeDevice(principal.deviceId);
-		if (revoked) deps.service.realtime.disconnectPrincipal(principal.deviceId);
+		if (revoked) {
+			deps.service.realtime.disconnectPrincipal(principal.deviceId);
+			deps.service.voiceRealtime.disconnectPrincipal(principal.deviceId);
+		}
 		return c.json({
 			ok: true,
 			revoked
@@ -243,7 +205,10 @@ function registerDeviceRoutes(authenticated, deps) {
 	authenticated.delete("/api/devices/:deviceId", (c) => {
 		const deviceId = c.req.param("deviceId");
 		const revoked = revokeDevice(deviceId);
-		if (revoked) deps.service.realtime.disconnectPrincipal(deviceId);
+		if (revoked) {
+			deps.service.realtime.disconnectPrincipal(deviceId);
+			deps.service.voiceRealtime.disconnectPrincipal(deviceId);
+		}
 		return c.json({
 			ok: true,
 			revoked

package/dist/src/gateway/hono/routes/exposure.js

@@ -1,15 +1,11 @@
-import { extractToken } from "../../auth.js";
 import { getExposureManager } from "../../../remote-access/exposure-manager.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 //#region src/gateway/hono/routes/exposure.ts
-function requireGatewayToken(c) {
-	return extractToken({ authorization: c.req.header("authorization") ?? void 0 }) ?? null;
-}
 function createExposureMutationRateLimitMiddleware() {
 	return async (c, next) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const result = consumeTunnelMutationLimit(token);
+		const principalId = getGatewayPrincipal(c).principalId;
+		const result = consumeTunnelMutationLimit(principalId);
 		if (!result.allowed) {
 			const retryAfterSec = Math.ceil(result.retryAfterMs / 1e3);
 			c.header("Retry-After", String(retryAfterSec));

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,14 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "browser-session",
+		match: (path) => path === "/api/browser-session",
+		load: async () => {
+			const { registerBrowserSessionRoutes } = await import("./browser-session.js");
+			return { register: registerBrowserSessionRoutes };
+		}
+	},
 	{
 		id: "proactive",
 		match: (path) => startsWithAny(path, [

package/dist/src/gateway/hono/routes/models.js

@@ -13,7 +13,7 @@ import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImag
 import { SessionConfigStore } from "../../../session/config-store.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
-import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
+import { getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
@@ -505,6 +505,65 @@ function registerModelsRoutes(authenticated, deps) {
 			}, 502);
 		}
 	});
+	authenticated.get("/api/image-generation/default", (c) => c.json({
+		ok: true,
+		payload: getDefaultImageGenerationConfig(service.currentConfig)
+	}));
+	authenticated.post("/api/image-generation/default/setup", strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.providerId !== "string") return c.json({
+			ok: false,
+			error: { message: "providerId is required" }
+		}, 400);
+		const prepared = prepareDefaultImageGenerationSetup(service.currentConfig, {
+			providerId: body.providerId,
+			...typeof body.modelId === "string" ? { modelId: body.modelId } : {},
+			...body.providerConfig && typeof body.providerConfig === "object" && !Array.isArray(body.providerConfig) ? { providerConfig: body.providerConfig } : {}
+		});
+		if (prepared.ok === false) return c.json({
+			ok: false,
+			error: { message: prepared.error }
+		}, 400);
+		const resolver = new CredentialResolver();
+		const usesApiKey = resolveImageGenerationCredentialMode(getImageGenerationProvider(prepared.providerId)) === "api-key";
+		const previousKey = usesApiKey ? await resolver.revealGatewayStoredApiKey(prepared.providerId) : void 0;
+		const suppliedKey = typeof body.apiKey === "string" ? body.apiKey.trim() : "";
+		const effectiveKey = usesApiKey ? suppliedKey || await resolver.resolveApiKey(prepared.providerId) : void 0;
+		if (usesApiKey && !effectiveKey) return c.json({
+			ok: false,
+			error: { message: "API key is required" }
+		}, 400);
+		const verification = usesApiKey && suppliedKey ? await verifyImageGenerationCredential({
+			providerId: prepared.providerId,
+			apiKey: suppliedKey,
+			baseUrl: typeof body.providerConfig?.baseUrl === "string" ? body.providerConfig.baseUrl : void 0
+		}) : {
+			verified: false,
+			supported: false
+		};
+		if (verification.supported && !verification.verified) return c.json({
+			ok: false,
+			error: { message: verification.message ?? "Credential verification failed" }
+		}, 400);
+		if (usesApiKey && suppliedKey) await resolver.saveApiKey(prepared.providerId, suppliedKey, { profileName: "default" });
+		const saved = await service.saveConfig(prepared.config);
+		if (!saved.saved) {
+			if (usesApiKey && suppliedKey) if (previousKey) await resolver.saveApiKey(prepared.providerId, previousKey, { profileName: "default" });
+			else await resolver.deleteProfile(`${prepared.providerId}:default`);
+			return c.json({
+				ok: false,
+				error: { message: saved.error ?? "Failed to save configuration" }
+			}, 500);
+		}
+		return c.json({
+			ok: true,
+			payload: {
+				default: getDefaultImageGenerationConfig(service.currentConfig),
+				providers: getImageGenerationCatalog(service.currentConfig),
+				verification
+			}
+		});
+	});
 	authenticated.get("/api/agents/:agentId/image-generation", (c) => {
 		try {
 			return c.json({

package/dist/src/gateway/hono/routes/notes.js

@@ -5,7 +5,7 @@ import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
 import { getShareStore } from "../../../share/share-store.js";
 import { resolveShareUrl } from "../../../share/share-url.js";
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
-import { extractToken } from "../../auth.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { NoteShareService, NoteShareVersionConflictError } from "../../../share/note-share-service.js";
 import { createReadStream } from "node:fs";
 import { createHash } from "node:crypto";
@@ -412,11 +412,7 @@ function registerNotesRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/notes/:id/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		const body = await c.req.json().catch(() => ({}));
 		const shares = noteShares();
 		try {
@@ -426,7 +422,7 @@ function registerNotesRoutes(authenticated, deps) {
 				ttlMs: typeof body.ttlMs === "number" ? body.ttlMs : void 0,
 				maxViews: body.maxViews === null ? null : typeof body.maxViews === "number" ? body.maxViews : void 0,
 				description: typeof body.description === "string" ? body.description.trim() || void 0 : void 0,
-				gatewayTokenHash: createHash("sha256").update(gatewayToken, "utf8").digest("hex").slice(0, 12)
+				gatewayTokenHash: createHash("sha256").update(principalId, "utf8").digest("hex").slice(0, 12)
 			});
 			const resolved = resolveShareUrl(record.token, shareUrlContext());
 			return c.json({

package/dist/src/gateway/hono/routes/sessions.js

@@ -1,4 +1,5 @@
 import { deleteBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
+import { SessionDiscoveryQuerySchema } from "../../../../packages/gateway-contract/src/session-identity.js";
 import { buildSessionKey, init_session_key } from "../../../routing/session-key.js";
 import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import "../../../projects/index.js";
@@ -259,8 +260,18 @@ function registerSessionsRoutes(authenticated, deps) {
 		const blocked = ensureGatewayReadyForSessions(c, service, "sessions.list");
 		if (blocked) return blocked;
 		const query = c.req.query();
+		const discovery = SessionDiscoveryQuerySchema.safeParse({
+			sources: query.sources?.split(","),
+			purposes: query.purposes?.split(","),
+			activity: query.activity,
+			agentId: query.agentId,
+			excludeArchived: query.excludeArchived === "true"
+		});
+		if (!discovery.success) return c.json({ error: "Invalid session filters" }, 400);
+		if (query.updatedAfter && !Number.isFinite(Number(query.updatedAfter))) return c.json({ error: "Invalid session time filter" }, 400);
 		const sessionTypes = query.types?.split(",").map((value) => value.trim()).filter(isSessionType);
 		const result = await service.sessions.listSessions({
+			...discovery.data,
 			status: query.status,
 			search: query.search,
 			channel: query.channel,

package/dist/src/gateway/hono/routes/shares.js

@@ -15,10 +15,10 @@ import { publishHostedStaticSite } from "../../../share/hosted-static-site-publi
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { audienceDefaults, cleanupStagedSite, decideShareKind, forgetStagedSite, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../../share/share-auto.js";
 import { deleteThumbnail, placeholderSvg, readThumbnail, scheduleThumbnail, thumbnailContentType, thumbnailExists } from "../../../share/share-thumbnail.js";
-import { extractToken } from "../../auth.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
 import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { SHARED_HTML_CSP } from "../../security/csp.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage, renderSnapshotShareLandingPage } from "../../../share/share-landing.js";
 import { resolveScopedMediaReference } from "../../media-access.js";
 import { NoteShareService } from "../../../share/note-share-service.js";
@@ -56,7 +56,7 @@ function resolveShareConfig(service) {
 	if (!raw || typeof raw !== "object") return {};
 	return raw;
 }
-function hashGatewayToken(token) {
+function hashPrincipal(token) {
 	return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 12);
 }
 const MAX_CONCURRENT_DOWNLOADS_PER_TOKEN = 5;
@@ -594,11 +594,7 @@ function registerShareRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/sessions/:key/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		const body = await c.req.json().catch(() => ({}));
 		if (typeof body.expectedSessionId !== "string" || typeof body.expectedCutoffSeq !== "number" || typeof body.expectedMetadataUpdatedAt !== "string") return c.json({
 			ok: false,
@@ -614,7 +610,7 @@ function registerShareRoutes(authenticated, deps) {
 				description: typeof body.description === "string" ? body.description.trim() || void 0 : void 0,
 				includeToolActivities: body.includeToolActivities === true,
 				attachmentIds: Array.isArray(body.attachmentIds) ? body.attachmentIds.filter((id) => typeof id === "string") : void 0,
-				gatewayTokenHash: hashGatewayToken(gatewayToken)
+				gatewayTokenHash: hashPrincipal(principalId)
 			});
 			const resolved = resolveShareUrl(record.token, getShareUrlContext(service));
 			return c.json({
@@ -1130,11 +1126,7 @@ function registerShareRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.post("/api/shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		let body;
 		try {
 			body = await c.req.json();
@@ -1201,7 +1193,7 @@ function registerShareRoutes(authenticated, deps) {
 				sessionKey,
 				agentId,
 				workspaceRoot,
-				gatewayTokenHash: hashGatewayToken(gatewayToken),
+				gatewayTokenHash: hashPrincipal(principalId),
 				kind,
 				directoryMode,
 				followSymlinks,
@@ -1242,11 +1234,7 @@ function registerShareRoutes(authenticated, deps) {
 	* reachability) in a single round-trip.
 	*/
 	authenticated.post("/api/shares/auto", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		let body;
 		try {
 			body = await c.req.json();
@@ -1309,7 +1297,7 @@ function registerShareRoutes(authenticated, deps) {
 		const defaults = audienceDefaults(audience);
 		const ttlMs = ttlOverride ?? defaults.ttlMs;
 		const maxViews = maxViewsOverride !== void 0 ? maxViewsOverride : defaults.maxViews;
-		const tokenHash = hashGatewayToken(gatewayToken);
+		const tokenHash = hashPrincipal(principalId);
 		const urlCtx = getShareUrlContext(service);
 		try {
 			if (decision.kind === "site") {

package/dist/src/gateway/hono/routes/site-shares.js

@@ -3,10 +3,10 @@ import { resolveSiteShareConfig } from "../../../share/site-share-config.js";
 import { getSiteShareStore } from "../../../share/site-share-store.js";
 import { resolveSiteShareUrl } from "../../../share/share-url.js";
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
-import { extractToken } from "../../auth.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createHash } from "node:crypto";
 //#region src/gateway/hono/routes/site-shares.ts
-function hashGatewayToken(token) {
+function hashPrincipal(token) {
 	return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 12);
 }
 function buildShareUrls(record, publicHostSuffix, service) {
@@ -42,11 +42,7 @@ function registerSiteShareRoutes(authenticated, deps) {
 		return resolveAgentWorkspaceDir(cfg, resolveDefaultAgentId(cfg));
 	}
 	authenticated.post("/api/site-shares", async (c) => {
-		const gatewayToken = extractToken({ authorization: c.req.header("authorization") ?? void 0 });
-		if (!gatewayToken) return c.json({
-			ok: false,
-			error: { message: "Token required" }
-		}, 401);
+		const principalId = getGatewayPrincipal(c).principalId;
 		let body;
 		try {
 			body = await c.req.json();
@@ -96,7 +92,7 @@ function registerSiteShareRoutes(authenticated, deps) {
 				sessionKey,
 				agentId,
 				workspaceRoot,
-				gatewayTokenHash: hashGatewayToken(gatewayToken)
+				gatewayTokenHash: hashPrincipal(principalId)
 			});
 			const urls = buildShareUrls(record, store.getConfig().publicHostSuffix, service);
 			return c.json({

package/dist/src/gateway/hono/routes/tunnel.js

@@ -2,10 +2,11 @@ import { init_public_url, validatePublicUrl } from "../../../config/public-url.j
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
-import { extractToken } from "../../auth.js";
+import { requireTunnelGatewayToken } from "../../../tunnel/auth-policy.js";
 import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
 import { provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
@@ -36,14 +37,9 @@ function enrichTunnelStatus(config, status) {
 		registrationSecret
 	};
 }
-function requireGatewayToken(c) {
-	return extractToken({ authorization: c.req.header("authorization") ?? void 0 }) ?? null;
-}
 function createTunnelMutationRateLimitMiddleware() {
 	return async (c, next) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
-		const result = consumeTunnelMutationLimit(token);
+		const result = consumeTunnelMutationLimit(getGatewayPrincipal(c).principalId);
 		if (!result.allowed) {
 			c.header("Retry-After", String(Math.ceil(result.retryAfterMs / 1e3)));
 			return c.json({
@@ -66,7 +62,6 @@ function registerTunnelRoutes(authenticated, deps) {
 	* the UI can render targeted hints (TLS / DNS / wrong service / blocked path).
 	*/
 	authenticated.post("/api/tunnel/probe-public", tunnelMutationLimit, async (c) => {
-		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
 		let body;
 		try {
 			body = await c.req.json();
@@ -142,8 +137,6 @@ function registerTunnelRoutes(authenticated, deps) {
 		return c.json(enrichTunnelStatus(config, tunnel.getStatus()));
 	});
 	authenticated.post("/api/tunnel/consent", tunnelMutationLimit, async (c) => {
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
 		const config = deps.service.currentConfig;
 		applyTunnelConsentToConfig(config);
 		const result = await deps.service.saveConfig(config);
@@ -154,7 +147,7 @@ function registerTunnelRoutes(authenticated, deps) {
 		const consent = getTunnelConsentState(config);
 		logTunnelAudit("tunnel.consent", {
 			consentVersion: consent.currentVersion,
-			gatewayTokenHash: hashGatewayToken(token).slice(0, 12)
+			principalId: getGatewayPrincipal(c).principalId
 		}, "Remote access security consent recorded");
 		return c.json({
 			ok: true,
@@ -190,10 +183,17 @@ function registerTunnelRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.post("/api/tunnel/start", tunnelMutationLimit, async (c) => {
+		let token;
+		try {
+			token = requireTunnelGatewayToken(deps.service.getResolvedAuth());
+		} catch (error) {
+			return c.json({
+				error: error.message,
+				code: "TUNNEL_AUTH_REQUIRED"
+			}, 403);
+		}
 		await configureTunnelFromService(deps, { force: true });
 		const config = deps.service.currentConfig;
-		const token = requireGatewayToken(c);
-		if (!token) return c.json({ error: "Gateway token required" }, 401);
 		try {
 			assertTunnelMayStart(config);
 		} catch (err) {

package/dist/src/gateway/image-generation-setup.d.ts

@@ -19,6 +19,23 @@ export declare function getAgentImageGenerationConfig(config: Config, agentIdRaw
         timeoutMs?: number;
     };
 };
+export declare function getDefaultImageGenerationConfig(config: Config): {
+    model: {
+        primary: string;
+        fallbacks: string[];
+        autoProviderFallback: boolean;
+        timeoutMs?: number;
+    };
+};
+export declare function prepareDefaultImageGenerationSetup(config: Config, input: ImageGenerationSetupInput): {
+    ok: true;
+    config: Config;
+    providerId: string;
+    modelId: string;
+} | {
+    ok: false;
+    error: string;
+};
 export declare function prepareImageGenerationSetup(config: Config, agentIdRaw: string, input: ImageGenerationSetupInput): {
     ok: true;
     config: Config;