@xopcai/xopc 0.0.373 → 0.0.374

package/dist/src/daemon/service-audit.js

@@ -1,5 +1,5 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
-import { SERVICE_VERSION_ENV_KEY } from "./constants.js";
+import { SERVICE_VERSION_ENV_KEY, init_constants } from "./constants.js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 //#region src/daemon/service-audit.ts
@@ -14,6 +14,7 @@ import { readFile } from "node:fs/promises";
 * - Platform-specific configuration issues
 */
 init_package_version();
+init_constants();
 /** Audit installed service configuration against current config and version */
 async function auditGatewayServiceConfig(params) {
 	const { service, env = process.env, expectedToken, expectedPort, currentVersion = PACKAGE_VERSION } = params;

package/dist/src/daemon/service.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { SERVICE_VERSION_ENV_KEY } from "./constants.js";
+import { SERVICE_VERSION_ENV_KEY, init_constants } from "./constants.js";
 import { existsSync } from "node:fs";
 //#region src/daemon/service.ts
 /**
@@ -14,6 +14,7 @@ import { existsSync } from "node:fs";
 */
 init_logger();
 init_package_version();
+init_constants();
 const log = createLogger("DaemonService");
 let _isDaemonAvailable = null;
 async function resolveGatewayService() {

package/dist/src/daemon/systemd.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveGatewaySystemdServiceName, resolveSystemdUnitPath } from "./constants.js";
+import { init_constants, resolveGatewaySystemdServiceName, resolveSystemdUnitPath } from "./constants.js";
 import os from "node:os";
 import path from "node:path";
 import { existsSync } from "node:fs";
@@ -17,6 +17,7 @@ import { access, constants as constants$1, mkdir, readFile, rm, writeFile } from
 * - network-online.target dependency
 */
 init_logger();
+init_constants();
 const log = createLogger("SystemdService");
 function resolveProfileFromEnv(env) {
 	return env?.XOPC_PROFILE?.trim() || void 0;

package/dist/src/extensions/activation-context.js

@@ -1,5 +1,5 @@
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, isProviderConfiguredSync } from "../providers/index.js";
 import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";

package/dist/src/gateway/client-ip.js

@@ -1,6 +1,7 @@
-import { isLoopbackHost } from "./host.js";
+import { init_host, isLoopbackHost } from "./host.js";
 import net from "node:net";
 //#region src/gateway/client-ip.ts
+init_host();
 function stripIpv6Brackets(value) {
 	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
 	return value;

package/dist/src/gateway/hono/app.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_host, resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { init_device_access_repository, listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
-import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
@@ -34,6 +34,7 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/app.ts
 init_src();
 init_logger();
+init_host();
 init_device_access_repository();
 const log = createLogger("Gateway:App");
 /**

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
+import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { resolveShareConfig } from "../../../share/share-config.js";

package/dist/src/gateway/hono/middleware/auth.d.ts

@@ -13,12 +13,10 @@ export interface AuthConfig {
 export declare function auth(config?: AuthConfig): import("hono").MiddlewareHandler<any, string, {}, (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-    message: string;
-    retryAfter: number;
-}, 429, "json">) | (Response & import("hono").TypedResponse<{
+}, 401, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-}, 401, "json">) | (Response & import("hono").TypedResponse<{
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-}, 403, "json">)>;
+}, 429, "json">)>;

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,14 +1,16 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
-import { safeEqualSecret } from "../../security/secret-equal.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
 import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { safeEqualSecret } from "../../security/secret-equal.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authenticateBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
+import { PROOF_HEADER, acquireProofBodyBudget, consumeRequestNonce, parseRequestProof, proofDigest, requestProofMessage, verifyRequestProofSignature } from "../../security/device-request-proof.js";
 import { isChromeExtensionOrigin } from "../../security/origin-check.js";
 import { browserCookieRequestAllowed, readBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
@@ -16,6 +18,8 @@ import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
+init_gateway_identity_repository();
+init_rate_limit();
 init_device_access_repository();
 init_logger();
 const log = createLogger("Gateway:Auth");
@@ -250,16 +254,54 @@ function auth(config) {
 				error: "Forbidden",
 				code: "extension_origin_mismatch"
 			}, 403);
-			recordSuccess(rl);
-			setGatewayPrincipal(c, {
-				kind: "device",
-				principalId: deviceIdentity.deviceId,
-				deviceId: deviceIdentity.deviceId,
-				accessSessionId: deviceIdentity.accessSessionId,
-				scopes: deviceIdentity.scopes
-			});
-			await next();
-			return;
+			let releaseBodyBudget = () => {};
+			try {
+				const proofHeader = c.req.header(PROOF_HEADER);
+				if (device?.requestProofVersion || proofHeader) {
+					const proof = parseRequestProof(proofHeader);
+					const url = new URL(c.req.url);
+					if (!device || !proof || Math.abs(Date.now() - proof.timestamp) > 12e4 || !verifyRequestProofSignature(device, proof, requestProofMessage({
+						gatewayId: getOrCreateGatewayIdentity().id,
+						credential: providedCredential,
+						method: c.req.method,
+						target: url.pathname + url.search,
+						headers: (name) => c.req.header(name),
+						proof
+					}))) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_PROOF_INVALID"
+					}, 401);
+					const release = /^(multipart\/form-data|application\/octet-stream)/i.test(c.req.header("content-type") ?? "") || Number(c.req.header("content-length") ?? 0) > 65536 ? acquireProofBodyBudget(device.id) : () => {};
+					if (!release) {
+						c.header("Retry-After", "1");
+						return c.json({
+							error: "Too Many Requests",
+							code: "REQUEST_CONCURRENCY_LIMIT"
+						}, 429);
+					}
+					releaseBodyBudget = release;
+					if (proofDigest(Buffer.from(await c.req.raw.clone().arrayBuffer())) !== proof.digest) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_BODY_MISMATCH"
+					}, 401);
+					if (!consumeRequestNonce(device.id, proof)) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_REPLAYED"
+					}, 401);
+				}
+				recordSuccess(rl);
+				setGatewayPrincipal(c, {
+					kind: "device",
+					principalId: deviceIdentity.deviceId,
+					deviceId: deviceIdentity.deviceId,
+					accessSessionId: deviceIdentity.accessSessionId,
+					scopes: deviceIdentity.scopes
+				});
+				await next();
+				return;
+			} finally {
+				releaseBodyBudget();
+			}
 		}
 		const blocked = checkBlocked(rl);
 		if (blocked.blocked) {

package/dist/src/gateway/hono/middleware/logger.js

@@ -1,10 +1,11 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { getClientIpFromHeaders, init_loopback } from "../../security/loopback.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/logger.ts
+init_loopback();
 init_logger();
 const log = createLogger("Gateway:HTTP");
 function resolveRemoteAddress(c) {

package/dist/src/gateway/hono/middleware/public-device-rate-limit.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from 'hono';
+export type PairingPublicRouteOptions = {
+    getTrustedProxyContext?: () => {
+        trustedProxies?: string[];
+        allowRealIpFallback?: boolean;
+    };
+};
+export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+/** Shared local-hop budgets allow normal mobile polling while bounding pre-auth work. */
+export declare function publicDeviceRateLimit(family: string, options?: PairingPublicRouteOptions): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 429, "json">>;

package/dist/src/gateway/hono/middleware/public-device-rate-limit.js

@@ -0,0 +1,43 @@
+import { buckets } from "../../rate-limit/buckets.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { createMiddleware } from "hono/factory";
+import { getConnInfo } from "@hono/node-server/conninfo";
+//#region src/gateway/hono/middleware/public-device-rate-limit.ts
+init_rate_limit();
+function pairingClientKey(c, options) {
+	let remoteAddress;
+	try {
+		remoteAddress = getConnInfo(c).remote.address;
+	} catch {
+		remoteAddress = void 0;
+	}
+	const proxy = options?.getTrustedProxyContext?.();
+	return resolveClientIpFromRequest({
+		remoteAddress,
+		getHeader: (name) => c.req.header(name),
+		trustedProxies: proxy?.trustedProxies,
+		allowRealIpFallback: proxy?.allowRealIpFallback
+	});
+}
+/** Shared local-hop budgets allow normal mobile polling while bounding pre-auth work. */
+function publicDeviceRateLimit(family, options) {
+	return createMiddleware(async (c, next) => {
+		const source = buckets.publicDeviceSource().consume(`${family}:${pairingClientKey(c, options)}`);
+		const total = buckets.publicDeviceGlobal().consume(family);
+		if (!source.allowed || !total.allowed) {
+			const retry = Math.max(source.retryAfterMs, total.retryAfterMs);
+			c.header("Retry-After", String(Math.max(1, Math.ceil(retry / 1e3))));
+			return c.json({
+				ok: false,
+				error: {
+					code: "RATE_LIMITED",
+					message: "Too many requests"
+				}
+			}, 429);
+		}
+		return next();
+	});
+}
+//#endregion
+export { pairingClientKey, publicDeviceRateLimit };

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/strict-rate-limit.ts
@@ -10,6 +10,7 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 * Per-client request-rate gate for sensitive admin/mutation endpoints.
 * Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.
 */
+init_rate_limit();
 init_logger();
 const log = createLogger("Hono:StrictRateLimit");
 function resolveClientIp(c, deps) {

package/dist/src/gateway/hono/oauth-async.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_host, isLoopbackHost } from "../host.js";
 import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";
@@ -18,6 +18,7 @@ import { Hono } from "hono";
 */
 init_registry();
 init_credentials();
+init_host();
 init_logger();
 const log = createLogger("OAuthAsync");
 function buildOAuthCompletionReadiness(config, catalog) {

package/dist/src/gateway/hono/routes/browser.js

@@ -1,16 +1,17 @@
 import { deleteBrowserTabBinding, getBrowserTabBinding, init_browser_tab_binding_repository, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { init_loopback, isLoopbackClientIp } from "../../security/loopback.js";
 import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import "../../../../packages/browser-control-contract/src/index.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
-import { isLoopbackClientIp } from "../../security/loopback.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
 /** Browser Control status and driver diagnostics. */
 init_src();
+init_loopback();
 init_device_access_repository();
 init_browser_tab_binding_repository();
 async function extensionStatus(service, includeLocalArtifacts) {

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,9 +1,9 @@
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
 import { AgentCatalogService } from "../../../../agent-catalog/service.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
-import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";

package/dist/src/gateway/hono/routes/config.js

@@ -1,4 +1,4 @@
-import { enumerateLanGatewayCandidates } from "../../host.js";
+import { enumerateLanGatewayCandidates, init_host } from "../../host.js";
 import { getTunnelService } from "../../../tunnel/tunnel-service.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
@@ -6,6 +6,7 @@ import { applyGatewayPatch } from "./config-patch/gateway.js";
 import { applyMiscPatch, validateGatewayAfterPatch } from "./config-patch/misc.js";
 import "./config-patch/index.js";
 //#region src/gateway/hono/routes/config.ts
+init_host();
 function localeFromRequest(c) {
 	return c.req.query("locale") ?? c.req.header("X-XOPC-Locale") ?? c.req.header("Accept-Language")?.split(",")[0];
 }

package/dist/src/gateway/hono/routes/device-pairing-approval.d.ts

@@ -1,10 +1,5 @@
-import type { Context, Hono } from 'hono';
-export type PairingPublicRouteOptions = {
-    getTrustedProxyContext?: () => {
-        trustedProxies?: string[];
-        allowRealIpFallback?: boolean;
-    };
-};
-export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+import type { Hono } from 'hono';
+import { type PairingPublicRouteOptions } from '../middleware/public-device-rate-limit.js';
+export { pairingClientKey, type PairingPublicRouteOptions } from '../middleware/public-device-rate-limit.js';
 export declare function registerPairingApprovalPublicRoutes(app: Hono, options?: PairingPublicRouteOptions): void;
 export declare function registerPairingApprovalAdminRoutes(app: Hono): void;

package/dist/src/gateway/hono/routes/device-pairing-approval.js

@@ -1,32 +1,17 @@
 import { devicePairingCompleteSchema, devicePairingProofSchema, devicePairingRequestSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { pairingClientKey, publicDeviceRateLimit } from "../middleware/public-device-rate-limit.js";
 import { DevicePairingError, cancelDevicePairingSetup, decideDevicePairingRequest, operateDevicePairingRequest, readDevicePairingSetup, submitDevicePairingRequest } from "../../../storage/sqlite/device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
-import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/device-pairing-approval.ts
 init_src();
 init_gateway_identity_repository();
-function pairingClientKey(c, options) {
-	let remoteAddress;
-	try {
-		remoteAddress = getConnInfo(c).remote.address;
-	} catch {
-		remoteAddress = void 0;
-	}
-	const proxy = options?.getTrustedProxyContext?.();
-	return resolveClientIpFromRequest({
-		remoteAddress,
-		getHeader: (name) => c.req.header(name),
-		trustedProxies: proxy?.trustedProxies,
-		allowRealIpFallback: proxy?.allowRealIpFallback
-	});
-}
+init_rate_limit();
 function pairingBlocked(c, key) {
 	const blocked = buckets.pairingExchange().check(key);
 	if (!blocked.blocked) return void 0;
@@ -63,7 +48,7 @@ function registerPairingApprovalPublicRoutes(app, options) {
 		"cancel"
 	]) {
 		const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/:id/${action}`;
-		app.post(path, bodyLimit({ maxSize: 4 * 1024 }), async (c) => {
+		app.post(path, publicDeviceRateLimit("pairing", options), bodyLimit({ maxSize: 4 * 1024 }), async (c) => {
 			const clientKey = pairingClientKey(c, options);
 			const blocked = pairingBlocked(c, clientKey);
 			if (blocked) return blocked;

package/dist/src/gateway/hono/routes/devices.js

@@ -1,13 +1,14 @@
 import { browserPairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation, formatMobilePairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { init_device_access_repository, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { DeviceRefreshRateLimitError, init_device_access_repository, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup, init_device_pairing_repository, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
 import { resolveSecureDeviceRoutes } from "../../device-routes.js";
-import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
-import { pairingClientKey, registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
+import { pairingClientKey, publicDeviceRateLimit } from "../middleware/public-device-rate-limit.js";
+import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
@@ -16,18 +17,20 @@ init_src();
 init_device_access_repository();
 init_device_pairing_repository();
 init_gateway_identity_repository();
+init_rate_limit();
 const refreshRequestSchema = z.strictObject({
 	refreshToken: z.string().min(1).max(256),
 	timestamp: z.number().int().positive(),
 	nonce: z.string().min(16).max(128),
 	requestId: z.string().uuid(),
 	nextRefreshToken: z.string().min(80).max(256),
-	signature: z.string().min(1).max(256)
+	signature: z.string().min(1).max(256),
+	requestProofVersion: z.literal(1).optional()
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
 function registerDeviceAuthPublicRoutes(app, options) {
-	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
+	app.post("/api/gateway-identity/challenge", publicDeviceRateLimit("challenge", options), bodyLimit({ maxSize: 512 }), async (c) => {
 		const budget = buckets.identityChallenge().consume("gateway");
 		if (!budget.allowed) {
 			c.header("Retry-After", String(Math.ceil(budget.retryAfterMs / 1e3)));
@@ -40,6 +43,8 @@ function registerDeviceAuthPublicRoutes(app, options) {
 			purpose: "gateway-route-v1",
 			gatewayId: identity.id,
 			nonce: parsed.data.nonce,
+			serverTime: Date.now(),
+			requestProofVersion: 1,
 			expiresAt: Date.now() + 3e4
 		})).toString("base64url");
 		c.header("Cache-Control", "no-store");
@@ -49,7 +54,7 @@ function registerDeviceAuthPublicRoutes(app, options) {
 		});
 	});
 	registerPairingApprovalPublicRoutes(app, options);
-	app.post("/api/device-auth/refresh", async (c) => {
+	app.post("/api/device-auth/refresh", publicDeviceRateLimit("refresh", options), bodyLimit({ maxSize: 4096 }), async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -66,6 +71,7 @@ function registerDeviceAuthPublicRoutes(app, options) {
 				requestId: parsed.data.requestId,
 				nonce: parsed.data.nonce,
 				expiresAt: Date.now() + 3e4,
+				requestProofVersion: parsed.data.requestProofVersion ?? 0,
 				tokens
 			})).toString("base64url");
 			return c.json({
@@ -74,16 +80,26 @@ function registerDeviceAuthPublicRoutes(app, options) {
 				signature: signGatewayPayload(signedPayload)
 			});
 		} catch (error) {
+			if (error instanceof DeviceRefreshRateLimitError) {
+				c.header("Retry-After", String(Math.max(1, Math.ceil(error.retryAfterMs / 1e3))));
+				return c.json({
+					ok: false,
+					error: {
+						code: "RATE_LIMITED",
+						message: "Too many requests"
+					}
+				}, 429);
+			}
 			return c.json({
 				ok: false,
 				error: {
 					code: "REFRESH_DENIED",
-					message: error instanceof Error ? error.message : "Refresh denied"
+					message: "Refresh denied"
 				}
 			}, 401);
 		}
 	});
-	app.post("/api/device-pairing/probe", bodyLimit({ maxSize: 512 }), async (c) => {
+	app.post("/api/device-pairing/probe", publicDeviceRateLimit("pairing", options), bodyLimit({ maxSize: 512 }), async (c) => {
 		const clientKey = pairingClientKey(c, options);
 		const blocked = buckets.pairingExchange().check(clientKey);
 		if (blocked.blocked) {

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -71,6 +71,7 @@ function registerEndpointToolRoutes(authenticated, deps) {
 				...lastSeenAt ? { lastSeenAt } : {},
 				access: access ? {
 					scopes: access.scopes,
+					requestProofVersion: access.requestProofVersion,
 					createdAt: access.createdAt,
 					...access.lastSeenAt ? { lastSeenAt: access.lastSeenAt } : {},
 					...access.revokedAt ? { revokedAt: access.revokedAt } : {}

package/dist/src/gateway/hono/routes/models.js

@@ -1,15 +1,15 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
 import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
 import "../../../capabilities/readiness/index.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";

package/dist/src/gateway/hono/routes/observability.js

@@ -1,5 +1,5 @@
-import { TracingConfigSchema, init_config } from "../../../observability/config.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { TracingConfigSchema, init_config } from "../../../observability/config.js";
 import { configureTracing, localStore, testLangfuse, tracingConfig, tracingStatus } from "../../../observability/runtime.js";
 import { z } from "zod";
 import { Hono } from "hono";

package/dist/src/gateway/hono/routes/personal-agent.js

@@ -40,6 +40,7 @@ const OnboardingSchema = z.object({
 	draft: PersonalOnboardingDraftSchema
 }).strict();
 const ProfileSchema = z.object({
+	voiceCallPreferences: z.object({ openingGreetingEnabled: z.boolean() }).strict().optional(),
 	revision: z.number().int().positive(),
 	displayName: z.string().trim().min(1).max(60),
 	appearance: PersonalAppearanceSchema,
@@ -348,7 +349,7 @@ function registerPersonalAgentRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid profile"
 		}, 400);
-		const { revision, displayName, appearance, preferences, voicePreference } = parsed.data;
+		const { revision, displayName, appearance, preferences, voicePreference, voiceCallPreferences } = parsed.data;
 		if (voicePreference) {
 			const { resolveStreamingTts } = await import("../../../voice/realtime/runtime.js");
 			const route = resolveStreamingTts(deps.service.currentConfig);
@@ -364,7 +365,7 @@ function registerPersonalAgentRoutes(authenticated, deps) {
 				error: "Selected voice is unavailable"
 			}, 400);
 		}
-		const updated = await patchPersonalProfile(deps.service, ownerId, revision, displayName, preferences, appearance, voicePreference);
+		const updated = await patchPersonalProfile(deps.service, ownerId, revision, displayName, preferences, appearance, voicePreference, voiceCallPreferences);
 		return updated ? c.json({
 			ok: true,
 			payload: updated

package/dist/src/gateway/hono/routes/public-gateway.js

@@ -25,18 +25,18 @@ function secretsEqual(actual, expected) {
 }
 function registerPublicGatewayRoutes(app, service) {
 	app.get("/health", (c) => {
-		return c.json(service.getHealth());
+		const health = service.getHealth();
+		return c.json({
+			status: health.ready ? "ok" : "starting",
+			ready: health.ready
+		});
 	});
 	/** Public liveness probe (no auth) — minimal payload for CLI / load balancers. */
 	app.get("/api/health", (c) => {
 		const health = service.getHealth();
 		return c.json({
 			status: health.ready ? "ok" : "starting",
-			ready: health.ready,
-			httpListening: health.httpListening,
-			version: health.version,
-			uptime: health.uptime,
-			startupDurationMs: health.startupDurationMs
+			ready: health.ready
 		});
 	});
 	app.post("/api/connectors/composio/webhook", async (c) => {