@xopcai/xopc 0.0.270 → 0.0.272

package/dist/src/gateway/image-generation-setup.js

@@ -59,12 +59,10 @@ function getAgentImageGenerationConfig(config, agentIdRaw) {
 		model: resolveEffectiveAgentConfigForAgent(config, agentId).config.models.imageGeneration ?? null
 	};
 }
-function prepareImageGenerationSetup(config, agentIdRaw, input) {
-	const agentId = normalizeAgentId(agentIdRaw);
-	if (!config.agents.list.some((entry) => entry.enabled !== false && normalizeAgentId(entry.id) === agentId)) return {
-		ok: false,
-		error: `Agent not found: ${agentId}`
-	};
+function getDefaultImageGenerationConfig(config) {
+	return { model: config.agents.defaults.models.imageGeneration ?? null };
+}
+function prepareImageGenerationConfig(config, input, applyModel) {
 	const providerId = input.providerId.trim();
 	const provider = getImageGenerationProvider(providerId);
 	if (!provider) return {
@@ -82,11 +80,6 @@ function prepareImageGenerationSetup(config, agentIdRaw, input) {
 		error: parsedProviderConfig.error
 	};
 	const next = structuredClone(config);
-	const index = next.agents.list.findIndex((entry) => entry.enabled !== false && normalizeAgentId(entry.id) === agentId);
-	if (index < 0) return {
-		ok: false,
-		error: `Agent not found: ${agentId}`
-	};
 	next.providers = {
 		...next.providers ?? {},
 		[providerId]: {
@@ -94,15 +87,11 @@ function prepareImageGenerationSetup(config, agentIdRaw, input) {
 			...parsedProviderConfig.value
 		}
 	};
-	const entry = next.agents.list[index];
-	entry.models = {
-		...entry.models ?? {},
-		imageGeneration: {
-			primary: `${providerId}/${modelId}`,
-			fallbacks: [],
-			autoProviderFallback: false
-		}
-	};
+	applyModel(next, {
+		primary: `${providerId}/${modelId}`,
+		fallbacks: [],
+		autoProviderFallback: false
+	});
 	const parsed = ConfigSchema.safeParse(next);
 	if (!parsed.success) return {
 		ok: false,
@@ -115,6 +104,26 @@ function prepareImageGenerationSetup(config, agentIdRaw, input) {
 		modelId
 	};
 }
+function prepareDefaultImageGenerationSetup(config, input) {
+	return prepareImageGenerationConfig(config, input, (next, model) => {
+		next.agents.defaults.models.imageGeneration = model;
+	});
+}
+function prepareImageGenerationSetup(config, agentIdRaw, input) {
+	const agentId = normalizeAgentId(agentIdRaw);
+	if (!config.agents.list.some((entry) => entry.enabled !== false && normalizeAgentId(entry.id) === agentId)) return {
+		ok: false,
+		error: `Agent not found: ${agentId}`
+	};
+	return prepareImageGenerationConfig(config, input, (next, model) => {
+		const index = next.agents.list.findIndex((entry) => entry.enabled !== false && normalizeAgentId(entry.id) === agentId);
+		const entry = next.agents.list[index];
+		entry.models = {
+			...entry.models ?? {},
+			imageGeneration: model
+		};
+	});
+}
 async function verifyImageGenerationCredential(input) {
 	const apiKey = input.apiKey.trim();
 	if (!apiKey) return {
@@ -165,4 +174,4 @@ async function verifyImageGenerationCredential(input) {
 	}
 }
 //#endregion
-export { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential };
+export { getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -34,6 +34,7 @@ export declare function authPolicyConfig(cfg: ResolvedAuthRateLimitConfig): Auth
 declare class BucketRegistry {
     private authFailureLimiter?;
     private authFailureSignature?;
+    private identityChallengeLimiter?;
     private strictApiLimiter?;
     private chatApiLimiter?;
     private mediaApiLimiter?;
@@ -50,6 +51,8 @@ declare class BucketRegistry {
      * config read.
      */
     authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter;
+    /** Global pre-authentication signing budget; independent of authenticated traffic. */
+    identityChallenge(): RateLimiter;
     /** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -46,6 +46,7 @@ function authPolicyConfig(cfg) {
 var BucketRegistry = class {
 	authFailureLimiter;
 	authFailureSignature;
+	identityChallengeLimiter;
 	strictApiLimiter;
 	chatApiLimiter;
 	mediaApiLimiter;
@@ -75,6 +76,13 @@ var BucketRegistry = class {
 		}
 		return this.authFailureLimiter;
 	}
+	/** Global pre-authentication signing budget; independent of authenticated traffic. */
+	identityChallenge() {
+		return this.identityChallengeLimiter ??= new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+	}
 	/** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
 	strictApi() {
 		if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
@@ -158,6 +166,7 @@ var BucketRegistry = class {
 	}
 	destroyAll() {
 		this.authFailureLimiter?.destroy();
+		this.identityChallengeLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
 		this.mediaApiLimiter?.destroy();
@@ -169,6 +178,7 @@ var BucketRegistry = class {
 		this.sharePublicShortLimiter?.destroy();
 		this.sharePublicLongLimiter?.destroy();
 		this.authFailureLimiter = void 0;
+		this.identityChallengeLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
 		this.mediaApiLimiter = void 0;

package/dist/src/gateway/run-loop.js

@@ -1,6 +1,6 @@
 import { loadConfig } from "../config/loader.js";
-import { isRestartEnabled } from "../config/commands.flags.js";
 import "../config/index.js";
+import { isRestartEnabled } from "../config/commands.flags.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { acquireGatewayLock } from "./lock.js";

package/dist/src/gateway/runtime-config.js

@@ -1,6 +1,7 @@
 import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
+import { requireTunnelGatewayToken } from "../tunnel/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
 import "./rate-limit/index.js";
 //#region src/gateway/runtime-config.ts
@@ -15,6 +16,7 @@ function hasSharedSecret(auth) {
 * Throws when bind/auth/origin combinations are unsafe for network exposure.
 */
 function assertGatewayRuntimeConfig(params) {
+	if (params.cfg.tunnel?.enabled) requireTunnelGatewayToken(params.auth);
 	const { bindMode, bindHost, customBindHost } = resolveGatewayListenPlan({
 		cfg: params.cfg,
 		bindOverride: params.bindOverride

package/dist/src/gateway/security/browser-session.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+export declare function readBrowserSessionCookie(c: Context): string | undefined;
+export declare function browserCookieRequestAllowed(c: Context): boolean;
+export declare function writeBrowserSessionCookie(c: Context, token: string, expiresAt: number): void;
+export declare function clearBrowserSessionCookie(c: Context): void;

package/dist/src/gateway/security/browser-session.js

@@ -0,0 +1,45 @@
+import { isLoopbackHost } from "../host.js";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+//#region src/gateway/security/browser-session.ts
+function origin(c) {
+	return new URL(`http://${c.req.header("host") ?? new URL(c.req.url).host}`);
+}
+function secure(c) {
+	return !isLoopbackHost(origin(c).hostname.replace(/^\[|\]$/g, ""));
+}
+function name(c) {
+	return secure(c) ? "__Host-xopc-session" : "xopc-local-session";
+}
+function readBrowserSessionCookie(c) {
+	return getCookie(c, name(c));
+}
+function browserCookieRequestAllowed(c) {
+	const requestOrigin = c.req.header("origin");
+	if (requestOrigin) try {
+		const parsed = new URL(requestOrigin);
+		const localOrigin = isLoopbackHost(parsed.hostname.replace(/^\[|\]$/g, ""));
+		return (parsed.host === origin(c).host || !secure(c) && localOrigin) && (parsed.protocol === "https:" || !secure(c) && parsed.protocol === "http:");
+	} catch {
+		return false;
+	}
+	return ["GET", "HEAD"].includes(c.req.method) && c.req.header("sec-fetch-site") !== "cross-site";
+}
+function writeBrowserSessionCookie(c, token, expiresAt) {
+	setCookie(c, name(c), token, {
+		httpOnly: true,
+		secure: secure(c),
+		sameSite: "Strict",
+		path: "/",
+		expires: new Date(expiresAt)
+	});
+}
+function clearBrowserSessionCookie(c) {
+	deleteCookie(c, name(c), {
+		httpOnly: true,
+		secure: secure(c),
+		sameSite: "Strict",
+		path: "/"
+	});
+}
+//#endregion
+export { browserCookieRequestAllowed, clearBrowserSessionCookie, readBrowserSessionCookie, writeBrowserSessionCookie };

package/dist/src/gateway/security/gateway-principal.d.ts

@@ -5,6 +5,7 @@ export type GatewayPrincipal = {
     principalId: string;
     deviceId?: string;
     accessSessionId?: string;
+    browserSessionId?: string;
     scopes: readonly GatewayScope[];
 };
 export declare function setGatewayPrincipal(c: Context, principal: GatewayPrincipal): void;

package/dist/src/gateway/server.js

@@ -1,6 +1,6 @@
 import { resolveGatewayBindHost, resolveGatewayListenHosts } from "../config/gateway-bind.js";
-import { resolveGatewayListenPlan } from "./listen.js";
 import { ensureXopcCliOnPath } from "../infra/path-env.js";
+import { resolveGatewayListenPlan } from "./listen.js";
 import { GatewayService } from "./service.js";
 import { handleSiteShareUpgrade } from "../share/site-share-router.js";
 import { createHonoApp } from "./hono/app.js";

package/dist/src/gateway/service.d.ts

@@ -48,6 +48,7 @@ export declare class GatewayService {
     private readonly modelCatalogSync;
     private auth;
     readonly endpointTools: EndpointToolRuntime;
+    private isRealtimePrincipalActive;
     readonly realtime: RealtimeRuntime;
     readonly voiceRealtime: VoiceRealtimeRuntime;
     getConfig(): Config;

package/dist/src/gateway/service.js

@@ -122,6 +122,7 @@ import { GatewaySessionsApi } from "./service/sessions-api.js";
 import { GatewayMarketplaceService } from "./service/marketplace-service.js";
 import { GatewayConfigCoordinator } from "./service/config-coordinator.js";
 import { GatewayAgentRunner } from "./service/agent-runner.js";
+import { isBrowserSessionActive } from "../storage/sqlite/browser-session-repository.js";
 import { RealtimeRuntime } from "../realtime/runtime.js";
 import { VoiceRealtimeRuntime } from "../voice/realtime/runtime.js";
 import { DurableVoiceAgentBroker } from "../voice/realtime/agentBroker.js";
@@ -165,8 +166,17 @@ var GatewayService = class {
 	});
 	auth;
 	endpointTools = new EndpointToolRuntime();
-	realtime = new RealtimeRuntime(this.endpointTools);
+	isRealtimePrincipalActive = (principalId) => {
+		if (!principalId.startsWith("browser:")) return true;
+		try {
+			return isBrowserSessionActive(principalId.slice(8), this.auth);
+		} catch {
+			return false;
+		}
+	};
+	realtime = new RealtimeRuntime(this.endpointTools, this.isRealtimePrincipalActive);
 	voiceRealtime = new VoiceRealtimeRuntime({
+		isPrincipalActive: this.isRealtimePrincipalActive,
 		getConversationContext: async (sessionKey, expectedSessionId) => {
 			if ((await this.sessionIndex.getSessionMetadata(sessionKey))?.sessionId !== expectedSessionId) throw new Error("Conversation changed before voice connection");
 			const messages = await this.sessionIndex.loadMessages(sessionKey);

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/infra/rate-limit/keyed-store.d.ts

@@ -11,6 +11,7 @@ export type Clock = () => number;
 export type KeyedStoreOptions = {
     /** Drop entries whose `lastTouchedMs` is older than this. */
     staleAfterMs: number;
+    maxEntries?: number;
     /** How often the sweep runs. Defaults to `staleAfterMs / 4` (capped at 10min). */
     cleanupIntervalMs?: number;
     /** Injected clock for deterministic tests. */
@@ -20,6 +21,8 @@ export declare class KeyedStore<V extends {
     lastTouchedMs: number;
 }> {
     private readonly map;
+    private readonly maxEntries;
+    private overflow?;
     private readonly clock;
     private readonly staleAfterMs;
     private cleanupTimer?;

package/dist/src/infra/rate-limit/keyed-store.js

@@ -1,10 +1,13 @@
 //#region src/infra/rate-limit/keyed-store.ts
 var KeyedStore = class {
 	map = /* @__PURE__ */ new Map();
+	maxEntries;
+	overflow;
 	clock;
 	staleAfterMs;
 	cleanupTimer;
 	constructor(opts) {
+		this.maxEntries = Math.max(1, opts.maxEntries ?? 1e4);
 		this.clock = opts.clock ?? Date.now;
 		this.staleAfterMs = Math.max(1e3, opts.staleAfterMs);
 		const interval = Math.min(600 * 1e3, Math.max(1e3, opts.cleanupIntervalMs ?? Math.floor(this.staleAfterMs / 4)));
@@ -12,10 +15,11 @@ var KeyedStore = class {
 		this.cleanupTimer.unref?.();
 	}
 	get(key) {
-		return this.map.get(key);
+		return this.map.get(key) ?? (this.map.size >= this.maxEntries ? this.overflow : void 0);
 	}
 	set(key, value) {
-		this.map.set(key, value);
+		if (this.map.has(key) || this.map.size < this.maxEntries) this.map.set(key, value);
+		else this.overflow ??= value;
 	}
 	delete(key) {
 		this.map.delete(key);
@@ -25,6 +29,7 @@ var KeyedStore = class {
 	}
 	clear() {
 		this.map.clear();
+		this.overflow = void 0;
 	}
 	destroy() {
 		if (this.cleanupTimer) {
@@ -32,9 +37,11 @@ var KeyedStore = class {
 			this.cleanupTimer = void 0;
 		}
 		this.map.clear();
+		this.overflow = void 0;
 	}
 	sweep() {
 		const now = this.clock();
+		if (this.overflow && now - this.overflow.lastTouchedMs > this.staleAfterMs) this.overflow = void 0;
 		for (const [k, v] of this.map.entries()) if (now - v.lastTouchedMs > this.staleAfterMs) this.map.delete(k);
 	}
 };

package/dist/src/proactive/policy/service.d.ts

@@ -31,7 +31,7 @@ export declare function effectiveProactivePolicy(subscriptionId: string, now?: D
         digestEnabled: boolean;
         digestHour: number;
         digestMinute: number;
-        preferredChannel: "mobile" | "all" | "auto" | "browser" | "telegram";
+        preferredChannel: "mobile" | "telegram" | "browser" | "all" | "auto";
         suppressWhileViewing: boolean;
         telegram: {
             chatId: string;

package/dist/src/realtime/runtime.d.ts

@@ -5,6 +5,7 @@ import { RealtimeBroker } from './broker.js';
 import { RealtimeTicketStore } from './tickets.js';
 export declare class RealtimeRuntime {
     private readonly endpointTools?;
+    private readonly isPrincipalActive;
     readonly broker: RealtimeBroker;
     readonly tickets: RealtimeTicketStore;
     private readonly preauthBudget;
@@ -12,7 +13,7 @@ export declare class RealtimeRuntime {
     private readonly topicCleanupTimers;
     private readonly socketsByPrincipal;
     private closed;
-    constructor(endpointTools?: EndpointToolRuntime);
+    constructor(endpointTools?: EndpointToolRuntime, isPrincipalActive?: (id: string) => boolean);
     handleUpgrade(req: IncomingMessage, socket: Socket, head: Buffer): boolean;
     close(): void;
     disconnectPrincipal(principalId: string): void;

package/dist/src/realtime/runtime.js

@@ -51,8 +51,9 @@ var RealtimeRuntime = class {
 	topicCleanupTimers = /* @__PURE__ */ new Map();
 	socketsByPrincipal = /* @__PURE__ */ new Map();
 	closed = false;
-	constructor(endpointTools) {
+	constructor(endpointTools, isPrincipalActive = () => true) {
 		this.endpointTools = endpointTools;
+		this.isPrincipalActive = isPrincipalActive;
 		this.wss.on("connection", (socket, request) => this.handleConnection(socket, request));
 		this.wss.on("error", (err) => log.error({ err }, "Realtime WebSocket server failed"));
 	}
@@ -91,7 +92,8 @@ var RealtimeRuntime = class {
 		this.socketsByPrincipal.clear();
 	}
 	disconnectPrincipal(principalId) {
-		for (const socket of this.socketsByPrincipal.get(principalId) ?? []) socket.close(4403, "Device access revoked");
+		this.tickets.revokePrincipal(principalId);
+		for (const socket of this.socketsByPrincipal.get(principalId) ?? []) socket.terminate();
 	}
 	completeTopic(topic, ttlMs = 5 * 6e4) {
 		const existing = this.topicCleanupTimers.get(topic);
@@ -119,6 +121,10 @@ var RealtimeRuntime = class {
 		};
 		const helloTimer = setTimeout(() => socket.close(4401, "Realtime hello timeout"), REALTIME_HELLO_TIMEOUT_MS);
 		const heartbeatTimer = setInterval(() => {
+			if (principalId && !this.isPrincipalActive(principalId)) {
+				socket.terminate();
+				return;
+			}
 			if (Date.now() - lastSeenAt > 45e3) socket.close(4408, "Realtime heartbeat timeout");
 		}, REALTIME_HEARTBEAT_INTERVAL_MS);
 		const sendError = (code, message) => {
@@ -181,7 +187,7 @@ var RealtimeRuntime = class {
 					return;
 				}
 				const claim = this.tickets.consume(message.payload.ticket, message.payload.clientId, message.payload.clientKind);
-				if (!claim) {
+				if (!claim || !this.isPrincipalActive(claim.principalId)) {
 					socket.close(4401, "Realtime authentication failed");
 					return;
 				}

package/dist/src/realtime/tickets.d.ts

@@ -16,5 +16,6 @@ export declare class RealtimeTicketStore {
     private readonly claims;
     issue(clientId: string, clientKind: RealtimeClientKind, principal: Omit<RealtimeTicketClaim, 'clientId' | 'clientKind' | 'expiresAt'>, now?: number): IssuedRealtimeTicket;
     consume(ticket: string, clientId: string, clientKind: RealtimeClientKind, now?: number): RealtimeTicketClaim | undefined;
+    revokePrincipal(principalId: string): void;
     private prune;
 }

package/dist/src/realtime/tickets.js

@@ -31,6 +31,9 @@ var RealtimeTicketStore = class {
 		if (claim.clientId !== clientId || claim.clientKind !== clientKind) return void 0;
 		return claim;
 	}
+	revokePrincipal(principalId) {
+		for (const [key, claim] of this.claims) if (claim.principalId === principalId) this.claims.delete(key);
+	}
 	prune(now) {
 		for (const [key, claim] of this.claims) if (claim.expiresAt < now) this.claims.delete(key);
 	}

package/dist/src/session/store.d.ts

@@ -44,6 +44,8 @@ export declare class SessionStore {
     private compactionHooks;
     private readonly compactionTails;
     constructor(options: SessionStoreOptions, windowConfig?: Partial<WindowConfig>, compactionConfig?: Partial<CompactionConfig>);
+    /** Refresh policy for subsequent compactions without changing an in-flight request. */
+    updateConfig(config: Config): void;
     setCompactionHooks(hooks: SessionCompactionHooks): void;
     private runCompactionHook;
     private resolveWorkspaceCwd;

package/dist/src/session/store.js

@@ -46,7 +46,18 @@ var SessionStore = class {
 	constructor(options, windowConfig, compactionConfig) {
 		this.options = options;
 		this.window = new SlidingWindow(windowConfig);
-		this.compactor = new SessionCompactor(compactionConfig);
+		this.compactor = new SessionCompactor({
+			...resolveCompactionPolicy(options.config),
+			...compactionConfig
+		});
+	}
+	/** Refresh policy for subsequent compactions without changing an in-flight request. */
+	updateConfig(config) {
+		this.options = {
+			...this.options,
+			config
+		};
+		this.compactor = new SessionCompactor(resolveCompactionPolicy(config));
 	}
 	setCompactionHooks(hooks) {
 		this.compactionHooks = hooks;
@@ -509,7 +520,11 @@ var SessionStore = class {
 				messageCount: messages.length,
 				tokenCount
 			});
-			const result = await this.compactor.compact(snapshot.entries, model, instructions, force, executionOptions);
+			const result = await this.compactor.compact(snapshot.entries, model, instructions, force, {
+				...executionOptions,
+				sessionKey: key
+			});
+			executionOptions?.signal?.throwIfAborted();
 			if (result.compacted) {
 				const compacted = await this.applyCompaction(key, result, snapshot);
 				await this.runCompactionHook("after", {

package/dist/src/session/types.d.ts

@@ -1,4 +1,5 @@
 import type { CompactionAudit } from './compaction-types.js';
+import type { SessionDiscoveryQuery } from '@xopcai/gateway-contract';
 import type { TranscriptStoredRow } from './session-context-for-llm.js';
 export interface Message {
     role: 'system' | 'user' | 'assistant' | 'tool' | 'toolResult';
@@ -139,7 +140,7 @@ export interface SessionDetail extends SessionMetadata {
     transcriptRows?: TranscriptStoredRow[];
 }
 /** Session list query parameters */
-export interface SessionListQuery {
+export interface SessionListQuery extends SessionDiscoveryQuery {
     status?: SessionStatus | SessionStatus[];
     /** Single `sourceChannel`, or comma-separated list (e.g. `telegram,weixin`). */
     channel?: string;

package/dist/src/storage/sqlite/browser-session-repository.d.ts

@@ -0,0 +1,17 @@
+import type { ResolvedGatewayAuth } from '../../gateway/auth.js';
+export declare const BROWSER_SESSION_TTL_MS: number;
+export declare class BrowserSessionLimitError extends Error {
+    constructor();
+}
+export declare function createBrowserSession(auth: ResolvedGatewayAuth, replacedSessionId?: string): {
+    sessionId: `${string}-${string}-${string}-${string}-${string}`;
+    token: string;
+    expiresAt: number;
+};
+export declare function authenticateBrowserSession(token: string, auth: ResolvedGatewayAuth): {
+    sessionId: string;
+    expiresAt: number;
+    renewed: boolean;
+} | null;
+export declare function isBrowserSessionActive(sessionId: string, auth: ResolvedGatewayAuth): boolean;
+export declare function deleteBrowserSession(sessionId: string): void;

package/dist/src/storage/sqlite/browser-session-repository.js

@@ -0,0 +1,54 @@
+import { getSqliteDatabase, runSqliteWriteTransaction } from "./transaction.js";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+//#region src/storage/sqlite/browser-session-repository.ts
+const BROWSER_SESSION_TTL_MS = 720 * 36e5;
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+function fingerprint(auth) {
+	const credential = auth.mode === "token" ? auth.token : auth.mode === "password" ? auth.password : void 0;
+	return credential ? digest(JSON.stringify([auth.mode, credential])) : null;
+}
+var BrowserSessionLimitError = class extends Error {
+	constructor() {
+		super("Browser session limit reached");
+	}
+};
+function createBrowserSession(auth, replacedSessionId) {
+	const authFingerprint = fingerprint(auth);
+	if (!authFingerprint) throw new Error("Browser sessions require Gateway credentials");
+	const sessionId = randomUUID();
+	const token = randomBytes(32).toString("base64url");
+	const now = Date.now();
+	const expiresAt = now + BROWSER_SESSION_TTL_MS;
+	runSqliteWriteTransaction((db) => {
+		db.prepare("DELETE FROM browser_sessions WHERE expires_at <= ? OR auth_fingerprint <> ?").run(now, authFingerprint);
+		if (replacedSessionId) db.prepare("DELETE FROM browser_sessions WHERE session_id = ?").run(replacedSessionId);
+		if (db.prepare("SELECT count(*) AS count FROM browser_sessions").get().count >= 32) throw new BrowserSessionLimitError();
+		db.prepare("INSERT INTO browser_sessions (session_id, token_hash, auth_fingerprint, created_at, expires_at) VALUES (?, ?, ?, ?, ?)").run(sessionId, digest(token), authFingerprint, now, expiresAt);
+	});
+	return {
+		sessionId,
+		token,
+		expiresAt
+	};
+}
+function authenticateBrowserSession(token, auth) {
+	if (!/^[A-Za-z0-9_-]{43}$/.test(token)) return null;
+	const row = getSqliteDatabase().prepare("SELECT session_id, expires_at FROM browser_sessions WHERE token_hash = ? AND auth_fingerprint = ? AND expires_at > ?").get(digest(token), fingerprint(auth), Date.now());
+	if (!row) return null;
+	const renewed = row.expires_at < Date.now() + 168 * 36e5;
+	const expiresAt = renewed ? Date.now() + BROWSER_SESSION_TTL_MS : row.expires_at;
+	if (renewed) getSqliteDatabase().prepare("UPDATE browser_sessions SET expires_at = ? WHERE session_id = ?").run(expiresAt, row.session_id);
+	return {
+		sessionId: row.session_id,
+		expiresAt,
+		renewed
+	};
+}
+function isBrowserSessionActive(sessionId, auth) {
+	return Boolean(getSqliteDatabase().prepare("SELECT 1 FROM browser_sessions WHERE session_id = ? AND auth_fingerprint = ? AND expires_at > ?").get(sessionId, fingerprint(auth), Date.now()));
+}
+function deleteBrowserSession(sessionId) {
+	getSqliteDatabase().prepare("DELETE FROM browser_sessions WHERE session_id = ?").run(sessionId);
+}
+//#endregion
+export { BROWSER_SESSION_TTL_MS, BrowserSessionLimitError, authenticateBrowserSession, createBrowserSession, deleteBrowserSession, isBrowserSessionActive };

package/dist/src/storage/sqlite/device-pairing-approval.js

@@ -66,7 +66,7 @@ function verifiedSetup(token, now) {
 	const id = /^xopc_pair_([0-9a-f-]{36})_/i.exec(token)?.[1];
 	if (!id) return fail("PAIRING_DENIED", 401);
 	const row = getSqliteDatabase().prepare("SELECT * FROM device_pairing_sessions WHERE pairing_id = ?").get(id);
-	if (!row || row.protocol_version !== 3 || row.attempts_remaining <= 0) return fail("PAIRING_DENIED", 401);
+	if (!row || row.attempts_remaining <= 0) return fail("PAIRING_DENIED", 401);
 	if (!crypto.timingSafeEqual(Buffer.from(row.secret_hash, "hex"), Buffer.from(hash(token), "hex"))) {
 		getSqliteDatabase().prepare("UPDATE device_pairing_sessions SET attempts_remaining = attempts_remaining - 1 WHERE pairing_id = ?").run(id);
 		return fail("PAIRING_DENIED", 401);
@@ -93,6 +93,7 @@ function verifyProof(action, body, deviceJson, now) {
 function submitDevicePairingRequest(body, now = Date.now()) {
 	const setup = verifiedSetup(String(body.pairingToken), now);
 	const device = devicePairingDeviceSchema.parse(body.device);
+	if (!(setup.target_kind === "browser" ? device.platform === "chrome" : setup.target_kind === "mobile" && device.platform !== "chrome")) fail("PAIRING_DEVICE_MISMATCH");
 	const deviceJson = JSON.stringify(device);
 	const autoApprove = isTrustedLocalBrowserSetup(setup, deviceJson);
 	verifyProof("request", body, deviceJson, now);

package/dist/src/storage/sqlite/device-pairing-repository.d.ts

@@ -1,3 +1,4 @@
+import type { DevicePairingTargetKind } from '@xopcai/gateway-contract';
 export type DeviceRoute = {
     id: string;
     kind: 'xopc-secure-link' | 'tailscale' | 'custom-https' | 'local-browser';
@@ -8,6 +9,7 @@ export type DevicePairingSetup = {
     token: string;
     routes: DeviceRoute[];
     expiresAt: number;
+    targetKind: DevicePairingTargetKind;
 };
 export type DevicePairingEnrollment = {
     issuer: 'browser-native-host';
@@ -15,17 +17,9 @@ export type DevicePairingEnrollment = {
     publicKeyThumbprint: string;
     nonce: string;
 };
-export type PairingConsumeResult = {
-    ok: true;
-    pairingId: string;
-    routes: DeviceRoute[];
-} | {
-    ok: false;
-    reason: 'invalid' | 'expired' | 'consumed';
-};
-export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now?: number, protocolVersion?: 2 | 3, options?: {
+export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now: number, options: {
+    targetKind: DevicePairingTargetKind;
     ttlMs?: number;
     enrollment?: DevicePairingEnrollment;
 }): DevicePairingSetup;
-export declare function consumeDevicePairingToken(token: string, now?: number): PairingConsumeResult;
 export declare function isDevicePairingSetupActive(pairingId: string, now?: number): boolean;