@xopcai/xopc 0.0.373 → 0.0.374

package/dist/src/gateway/hono/routes/shares.js

@@ -1,3 +1,4 @@
+import { getClientIpFromHeaders, init_loopback } from "../../security/loopback.js";
 import { loadCompactionSourceSnapshot } from "../../../storage/sqlite/transcript-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { FileServiceError } from "../../../files/file-service.js";
@@ -16,7 +17,6 @@ import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { audienceDefaults, cleanupStagedSite, decideShareKind, forgetStagedSite, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../../share/share-auto.js";
 import { deleteThumbnail, placeholderSvg, readThumbnail, scheduleThumbnail, thumbnailContentType, thumbnailExists } from "../../../share/share-thumbnail.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { SHARED_HTML_CSP } from "../../security/csp.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage, renderSnapshotShareLandingPage } from "../../../share/share-landing.js";
@@ -31,6 +31,7 @@ import { createHash } from "node:crypto";
 import { stat } from "node:fs/promises";
 import { Readable } from "node:stream";
 //#region src/gateway/hono/routes/shares.ts
+init_loopback();
 init_sqlite();
 function getShareUrlContext(service) {
 	const gateway = service.currentConfig.gateway;

package/dist/src/gateway/hono/routes/voice.js

@@ -1,8 +1,8 @@
 import { voiceSelectionSchema } from "../../../../packages/realtime-protocol/src/voice-catalog.js";
 import { VOICE_TIMING_METRICS, createVoiceSessionRequestSchema, init_voice } from "../../../../packages/realtime-protocol/src/voice.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../../../providers/index.js";
-import { completeWithResolvedCredentials } from "../../../providers/model-call.js";
 import { isPersonalConversation } from "../../../personal-agent/repository.js";
+import { completeWithResolvedCredentials } from "../../../providers/model-call.js";
 import { resolveSttProviderConfigSlice } from "../../../voice/stt/config-slice.js";
 import { STTTranscriptionError, transcribe } from "../../../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../../../voice/stt/availability.js";
@@ -184,6 +184,7 @@ function registerVoiceRoutes(authenticated, deps) {
 			ok: true,
 			payload: {
 				enabled,
+				openingGreeting: true,
 				capabilities: {
 					dictation: availability(Boolean(stt)),
 					assistant: availability(Boolean(stt && tts)),

package/dist/src/gateway/host.js

@@ -1,4 +1,5 @@
-import "../daemon/constants.js";
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_constants } from "../daemon/constants.js";
 import { networkInterfaces } from "node:os";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
@@ -13,8 +14,6 @@ function isAllInterfacesHost(host) {
 	const normalized = host.trim();
 	return normalized === "0.0.0.0" || normalized === "::" || normalized === "*";
 }
-/** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
-const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
 /** Non-internal IPv4 addresses that can serve this gateway on the local network. */
 function enumerateLanGatewayCandidates(port) {
 	const seen = /* @__PURE__ */ new Set();
@@ -86,5 +85,11 @@ function resolveAllowedBrowserOrigins(params) {
 	if (reverseProxyOrigin && !origins.includes(reverseProxyOrigin)) origins.push(reverseProxyOrigin);
 	return origins;
 }
+var GATEWAY_DEV_CONSOLE_ORIGINS;
+var init_host = __esmMin((() => {
+	init_constants();
+	GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
+}));
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+init_host();
+export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, init_host, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/index.js

@@ -1,11 +1,11 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
+import { buckets } from "./rate-limit/buckets.js";
+import { buildDefaultCorsOrigins, init_host, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
+import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import { init_rate_limit } from "./rate-limit/index.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
 import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
-import { buckets } from "./rate-limit/buckets.js";
-import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
-import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";
@@ -16,4 +16,8 @@ import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofO
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
+//#region src/gateway/index.ts
+init_host();
+init_rate_limit();
+//#endregion
 export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buckets, buildDefaultCorsOrigins, checkPortAvailable, createHonoApp, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/listen.js

@@ -1,6 +1,7 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { buildDefaultCorsOrigins, init_host, isAllInterfacesHost, isLoopbackHost } from "./host.js";
 import { resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayCustomBindHost } from "../config/gateway-bind.js";
 //#region src/gateway/listen.ts
+init_host();
 /** Resolve the effective HTTP listen host (CLI bind override > config bind). */
 function resolveGatewayListenHost(params) {
 	return resolveGatewayBindHostSync({

package/dist/src/gateway/rate-limit/auth-policy.js

@@ -1,15 +1,7 @@
-import { isLoopbackClientIp, isLoopbackEmbeddedBrowserClient } from "../security/loopback.js";
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { init_loopback, isLoopbackClientIp, isLoopbackEmbeddedBrowserClient } from "../security/loopback.js";
 //#region src/gateway/rate-limit/auth-policy.ts
 /**
-* Auth-failure rate-limit policy: how to derive a tracking key from a request,
-* and whether a given client should be exempted before counting.
-*
-* The {@link FailureLimiter} primitive is intentionally policy-free — this
-* module is the only place that knows about IPs, browser origins, and the
-* loopback exemption. Adding a new exemption rule (e.g. private CIDRs) means
-* editing this file alone; the limiter primitive does not change.
-*/
-/**
 * Decide whether to track this client and, if so, what key identifies them.
 * Browser clients are tracked separately (origin + IP) so a rogue `<iframe>`
 * cannot piggyback on a CLI client's bucket and DoS it.
@@ -43,5 +35,9 @@ function resolveAuthTracking(params) {
 function buildBrowserOriginKey(origin, clientIp) {
 	return `browser-origin:${origin.trim().toLowerCase()}|${clientIp.trim()}`;
 }
+var init_auth_policy = __esmMin((() => {
+	init_loopback();
+}));
 //#endregion
-export { buildBrowserOriginKey, resolveAuthTracking };
+init_auth_policy();
+export { buildBrowserOriginKey, init_auth_policy, resolveAuthTracking };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -35,6 +35,9 @@ declare class BucketRegistry {
     private authFailureLimiter?;
     private authFailureSignature?;
     private identityChallengeLimiter?;
+    private publicDeviceGlobalLimiter?;
+    private publicDeviceSourceLimiter?;
+    private deviceRefreshLimiter?;
     private strictApiLimiter?;
     private chatApiLimiter?;
     private mediaApiLimiter?;
@@ -51,6 +54,9 @@ declare class BucketRegistry {
      * config read.
      */
     authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter;
+    publicDeviceGlobal(): RateLimiter;
+    publicDeviceSource(): RateLimiter;
+    deviceRefresh(): RateLimiter;
     /** Global pre-authentication signing budget; independent of authenticated traffic. */
     identityChallenge(): RateLimiter;
     /** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -1,30 +1,8 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { RateLimiter } from "../../infra/rate-limit/rate-limiter.js";
 import { FailureLimiter } from "../../infra/rate-limit/failure-limiter.js";
+import { init_rate_limit } from "../../infra/rate-limit/index.js";
 //#region src/gateway/rate-limit/buckets.ts
-/**
-* Named rate-limit buckets used across the gateway. Each is a thin wrapper
-* over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})
-* that hard-codes its config and exposes a small surface.
-*
-* All buckets are owned by a process-level singleton {@link BucketRegistry}
-* so that:
-*   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,
-*   - tests get one obvious reset entry point (`resetAllForTests`),
-*   - new buckets are added in exactly one place.
-*
-* Tuning policy:
-*   - `auth_failure` is read from runtime config because users tune it per
-*     deployment. Other buckets keep static defaults until a real need
-*     emerges to expose them. (YAGNI > premature configurability.)
-*/
-const DEFAULT_AUTH_RATE_LIMIT = {
-	enabled: true,
-	maxFailures: 5,
-	windowMs: 900 * 1e3,
-	blockDurationMs: 300 * 1e3,
-	burstCoalesceMs: 1e3,
-	exemptLoopback: true
-};
 function resolveAuthRateLimit(input) {
 	if (!input) return { ...DEFAULT_AUTH_RATE_LIMIT };
 	const blockDurationMs = input.blockDurationMs ?? input.lockoutMs ?? DEFAULT_AUTH_RATE_LIMIT.blockDurationMs;
@@ -43,170 +21,214 @@ function authPolicyConfig(cfg) {
 		exemptLoopback: cfg.exemptLoopback
 	};
 }
-var BucketRegistry = class {
-	authFailureLimiter;
-	authFailureSignature;
-	identityChallengeLimiter;
-	strictApiLimiter;
-	chatApiLimiter;
-	mediaApiLimiter;
-	taskApiLimiter;
-	xopcCloudPollLimiter;
-	channelApiLimiter;
-	tunnelMutateLimiter;
-	pairingExchangeLimiter;
-	sharePublicShortLimiter;
-	sharePublicLongLimiter;
-	/**
-	* Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
-	* compares a stable signature to avoid swapping out a hot bucket on every
-	* config read.
-	*/
-	authFailure(cfg) {
-		const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;
-		if (!this.authFailureLimiter || this.authFailureSignature !== sig) {
-			this.authFailureLimiter?.destroy();
-			this.authFailureLimiter = new FailureLimiter({
-				maxFailures: cfg.maxFailures,
-				windowMs: cfg.windowMs,
-				blockDurationMs: cfg.blockDurationMs,
-				burstCoalesceMs: cfg.burstCoalesceMs
+var DEFAULT_AUTH_RATE_LIMIT, BucketRegistry, buckets;
+var init_buckets = __esmMin((() => {
+	init_rate_limit();
+	DEFAULT_AUTH_RATE_LIMIT = {
+		enabled: true,
+		maxFailures: 5,
+		windowMs: 900 * 1e3,
+		blockDurationMs: 300 * 1e3,
+		burstCoalesceMs: 1e3,
+		exemptLoopback: true
+	};
+	BucketRegistry = class {
+		authFailureLimiter;
+		authFailureSignature;
+		identityChallengeLimiter;
+		publicDeviceGlobalLimiter;
+		publicDeviceSourceLimiter;
+		deviceRefreshLimiter;
+		strictApiLimiter;
+		chatApiLimiter;
+		mediaApiLimiter;
+		taskApiLimiter;
+		xopcCloudPollLimiter;
+		channelApiLimiter;
+		tunnelMutateLimiter;
+		pairingExchangeLimiter;
+		sharePublicShortLimiter;
+		sharePublicLongLimiter;
+		/**
+		* Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
+		* compares a stable signature to avoid swapping out a hot bucket on every
+		* config read.
+		*/
+		authFailure(cfg) {
+			const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;
+			if (!this.authFailureLimiter || this.authFailureSignature !== sig) {
+				this.authFailureLimiter?.destroy();
+				this.authFailureLimiter = new FailureLimiter({
+					maxFailures: cfg.maxFailures,
+					windowMs: cfg.windowMs,
+					blockDurationMs: cfg.blockDurationMs,
+					burstCoalesceMs: cfg.burstCoalesceMs
+				});
+				this.authFailureSignature = sig;
+			}
+			return this.authFailureLimiter;
+		}
+		publicDeviceGlobal() {
+			return this.publicDeviceGlobalLimiter ??= new RateLimiter({
+				maxRequests: 1200,
+				windowMs: 6e4
+			});
+		}
+		publicDeviceSource() {
+			return this.publicDeviceSourceLimiter ??= new RateLimiter({
+				maxRequests: 300,
+				windowMs: 6e4
+			});
+		}
+		deviceRefresh() {
+			return this.deviceRefreshLimiter ??= new RateLimiter({
+				maxRequests: 30,
+				windowMs: 6e4
+			});
+		}
+		/** Global pre-authentication signing budget; independent of authenticated traffic. */
+		identityChallenge() {
+			return this.identityChallengeLimiter ??= new RateLimiter({
+				maxRequests: 300,
+				windowMs: 6e4
+			});
+		}
+		/** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
+		strictApi() {
+			if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
+				maxRequests: 150,
+				windowMs: 6e4
+			});
+			return this.strictApiLimiter;
+		}
+		/** Interactive chat actions — 180 req / 60 s per client IP. */
+		chatApi() {
+			if (!this.chatApiLimiter) this.chatApiLimiter = new RateLimiter({
+				maxRequests: 180,
+				windowMs: 6e4
+			});
+			return this.chatApiLimiter;
+		}
+		/** Durable media chunk uploads — 300 req / 60 s per client IP. */
+		mediaApi() {
+			if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
+				maxRequests: 300,
+				windowMs: 6e4
+			});
+			return this.mediaApiLimiter;
+		}
+		/** Interactive task and board mutations — 300 req / 60 s per client IP. */
+		taskApi() {
+			if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
+				maxRequests: 300,
+				windowMs: 6e4
 			});
-			this.authFailureSignature = sig;
-		}
-		return this.authFailureLimiter;
-	}
-	/** Global pre-authentication signing budget; independent of authenticated traffic. */
-	identityChallenge() {
-		return this.identityChallengeLimiter ??= new RateLimiter({
-			maxRequests: 300,
-			windowMs: 6e4
-		});
-	}
-	/** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
-	strictApi() {
-		if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
-			maxRequests: 150,
-			windowMs: 6e4
-		});
-		return this.strictApiLimiter;
-	}
-	/** Interactive chat actions — 180 req / 60 s per client IP. */
-	chatApi() {
-		if (!this.chatApiLimiter) this.chatApiLimiter = new RateLimiter({
-			maxRequests: 180,
-			windowMs: 6e4
-		});
-		return this.chatApiLimiter;
-	}
-	/** Durable media chunk uploads — 300 req / 60 s per client IP. */
-	mediaApi() {
-		if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
-			maxRequests: 300,
-			windowMs: 6e4
-		});
-		return this.mediaApiLimiter;
-	}
-	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
-	taskApi() {
-		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
-			maxRequests: 300,
-			windowMs: 6e4
-		});
-		return this.taskApiLimiter;
-	}
-	/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
-	xopcCloudPoll() {
-		if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
-			maxRequests: 60,
-			windowMs: 6e4
-		});
-		return this.xopcCloudPollLimiter;
-	}
-	/** Channel mutation/action endpoints — 20 req / 60 s per client IP. */
-	channelApi() {
-		if (!this.channelApiLimiter) this.channelApiLimiter = new RateLimiter({
-			maxRequests: 20,
-			windowMs: 6e4
-		});
-		return this.channelApiLimiter;
-	}
-	/** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
-	tunnelMutate() {
-		if (!this.tunnelMutateLimiter) this.tunnelMutateLimiter = new RateLimiter({
-			maxRequests: 12,
-			windowMs: 5 * 6e4
-		});
-		return this.tunnelMutateLimiter;
-	}
-	/** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
-	pairingExchange() {
-		if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
-			maxFailures: 30,
-			windowMs: 5 * 6e4,
-			blockDurationMs: 5 * 6e4,
-			burstCoalesceMs: 0
-		});
-		return this.pairingExchangeLimiter;
-	}
-	/** Public share download short window — 60 req / min per client IP. */
-	sharePublicShort() {
-		if (!this.sharePublicShortLimiter) this.sharePublicShortLimiter = new RateLimiter({
-			maxRequests: 60,
-			windowMs: 6e4
-		});
-		return this.sharePublicShortLimiter;
-	}
-	/** Public share download long window — 300 req / 15 min per client IP. */
-	sharePublicLong() {
-		if (!this.sharePublicLongLimiter) this.sharePublicLongLimiter = new RateLimiter({
-			maxRequests: 300,
-			windowMs: 15 * 6e4
-		});
-		return this.sharePublicLongLimiter;
-	}
-	destroyAll() {
-		this.authFailureLimiter?.destroy();
-		this.identityChallengeLimiter?.destroy();
-		this.strictApiLimiter?.destroy();
-		this.chatApiLimiter?.destroy();
-		this.mediaApiLimiter?.destroy();
-		this.taskApiLimiter?.destroy();
-		this.xopcCloudPollLimiter?.destroy();
-		this.channelApiLimiter?.destroy();
-		this.tunnelMutateLimiter?.destroy();
-		this.pairingExchangeLimiter?.destroy();
-		this.sharePublicShortLimiter?.destroy();
-		this.sharePublicLongLimiter?.destroy();
-		this.authFailureLimiter = void 0;
-		this.identityChallengeLimiter = void 0;
-		this.strictApiLimiter = void 0;
-		this.chatApiLimiter = void 0;
-		this.mediaApiLimiter = void 0;
-		this.taskApiLimiter = void 0;
-		this.xopcCloudPollLimiter = void 0;
-		this.channelApiLimiter = void 0;
-		this.tunnelMutateLimiter = void 0;
-		this.pairingExchangeLimiter = void 0;
-		this.sharePublicShortLimiter = void 0;
-		this.sharePublicLongLimiter = void 0;
-		this.authFailureSignature = void 0;
-	}
-	/** @internal */
-	resetAllForTests() {
-		this.authFailureLimiter?.resetForTests();
-		this.strictApiLimiter?.resetForTests();
-		this.chatApiLimiter?.resetForTests();
-		this.mediaApiLimiter?.resetForTests();
-		this.taskApiLimiter?.resetForTests();
-		this.xopcCloudPollLimiter?.resetForTests();
-		this.channelApiLimiter?.resetForTests();
-		this.tunnelMutateLimiter?.resetForTests();
-		this.pairingExchangeLimiter?.resetForTests();
-		this.sharePublicShortLimiter?.resetForTests();
-		this.sharePublicLongLimiter?.resetForTests();
-	}
-};
-const buckets = new BucketRegistry();
+			return this.taskApiLimiter;
+		}
+		/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
+		xopcCloudPoll() {
+			if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
+				maxRequests: 60,
+				windowMs: 6e4
+			});
+			return this.xopcCloudPollLimiter;
+		}
+		/** Channel mutation/action endpoints — 20 req / 60 s per client IP. */
+		channelApi() {
+			if (!this.channelApiLimiter) this.channelApiLimiter = new RateLimiter({
+				maxRequests: 20,
+				windowMs: 6e4
+			});
+			return this.channelApiLimiter;
+		}
+		/** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
+		tunnelMutate() {
+			if (!this.tunnelMutateLimiter) this.tunnelMutateLimiter = new RateLimiter({
+				maxRequests: 12,
+				windowMs: 5 * 6e4
+			});
+			return this.tunnelMutateLimiter;
+		}
+		/** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
+		pairingExchange() {
+			if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
+				maxFailures: 30,
+				windowMs: 5 * 6e4,
+				blockDurationMs: 5 * 6e4,
+				burstCoalesceMs: 0
+			});
+			return this.pairingExchangeLimiter;
+		}
+		/** Public share download short window — 60 req / min per client IP. */
+		sharePublicShort() {
+			if (!this.sharePublicShortLimiter) this.sharePublicShortLimiter = new RateLimiter({
+				maxRequests: 60,
+				windowMs: 6e4
+			});
+			return this.sharePublicShortLimiter;
+		}
+		/** Public share download long window — 300 req / 15 min per client IP. */
+		sharePublicLong() {
+			if (!this.sharePublicLongLimiter) this.sharePublicLongLimiter = new RateLimiter({
+				maxRequests: 300,
+				windowMs: 15 * 6e4
+			});
+			return this.sharePublicLongLimiter;
+		}
+		destroyAll() {
+			this.authFailureLimiter?.destroy();
+			this.identityChallengeLimiter?.destroy();
+			this.publicDeviceGlobalLimiter?.destroy();
+			this.publicDeviceSourceLimiter?.destroy();
+			this.deviceRefreshLimiter?.destroy();
+			this.strictApiLimiter?.destroy();
+			this.chatApiLimiter?.destroy();
+			this.mediaApiLimiter?.destroy();
+			this.taskApiLimiter?.destroy();
+			this.xopcCloudPollLimiter?.destroy();
+			this.channelApiLimiter?.destroy();
+			this.tunnelMutateLimiter?.destroy();
+			this.pairingExchangeLimiter?.destroy();
+			this.sharePublicShortLimiter?.destroy();
+			this.sharePublicLongLimiter?.destroy();
+			this.authFailureLimiter = void 0;
+			this.identityChallengeLimiter = void 0;
+			this.publicDeviceGlobalLimiter = void 0;
+			this.publicDeviceSourceLimiter = void 0;
+			this.deviceRefreshLimiter = void 0;
+			this.strictApiLimiter = void 0;
+			this.chatApiLimiter = void 0;
+			this.mediaApiLimiter = void 0;
+			this.taskApiLimiter = void 0;
+			this.xopcCloudPollLimiter = void 0;
+			this.channelApiLimiter = void 0;
+			this.tunnelMutateLimiter = void 0;
+			this.pairingExchangeLimiter = void 0;
+			this.sharePublicShortLimiter = void 0;
+			this.sharePublicLongLimiter = void 0;
+			this.authFailureSignature = void 0;
+		}
+		/** @internal */
+		resetAllForTests() {
+			this.authFailureLimiter?.resetForTests();
+			this.identityChallengeLimiter?.resetForTests();
+			this.publicDeviceGlobalLimiter?.resetForTests();
+			this.publicDeviceSourceLimiter?.resetForTests();
+			this.deviceRefreshLimiter?.resetForTests();
+			this.strictApiLimiter?.resetForTests();
+			this.chatApiLimiter?.resetForTests();
+			this.mediaApiLimiter?.resetForTests();
+			this.taskApiLimiter?.resetForTests();
+			this.xopcCloudPollLimiter?.resetForTests();
+			this.channelApiLimiter?.resetForTests();
+			this.tunnelMutateLimiter?.resetForTests();
+			this.pairingExchangeLimiter?.resetForTests();
+			this.sharePublicShortLimiter?.resetForTests();
+			this.sharePublicLongLimiter?.resetForTests();
+		}
+	};
+	buckets = new BucketRegistry();
+}));
 //#endregion
-export { authPolicyConfig, buckets, resolveAuthRateLimit };
+init_buckets();
+export { authPolicyConfig, buckets, init_buckets, resolveAuthRateLimit };

package/dist/src/gateway/rate-limit/env-flags.js

@@ -1,3 +1,4 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 //#region src/gateway/rate-limit/env-flags.ts
 /**
 * Process-level env-var feature flags that influence rate-limit and gateway
@@ -10,5 +11,7 @@ function isAuthRateLimitGloballyDisabled() {
 function isGatewayStrictSecurityEnabled(cfg) {
 	return cfg?.gateway?.security?.strict === true || process.env.XOPC_GATEWAY_STRICT_SECURITY === "1";
 }
+var init_env_flags = __esmMin((() => {}));
 //#endregion
-export { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled };
+init_env_flags();
+export { init_env_flags, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled };

package/dist/src/gateway/rate-limit/index.js

@@ -1,4 +1,13 @@
-import { authPolicyConfig, buckets, resolveAuthRateLimit } from "./buckets.js";
-import { buildBrowserOriginKey, resolveAuthTracking } from "./auth-policy.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./env-flags.js";
-export { authPolicyConfig, buckets, buildBrowserOriginKey, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, resolveAuthRateLimit, resolveAuthTracking };
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { authPolicyConfig, buckets, init_buckets, resolveAuthRateLimit } from "./buckets.js";
+import { buildBrowserOriginKey, init_auth_policy, resolveAuthTracking } from "./auth-policy.js";
+import { init_env_flags, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./env-flags.js";
+//#region src/gateway/rate-limit/index.ts
+var init_rate_limit = __esmMin((() => {
+	init_buckets();
+	init_auth_policy();
+	init_env_flags();
+}));
+//#endregion
+init_rate_limit();
+export { authPolicyConfig, buckets, buildBrowserOriginKey, init_rate_limit, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, resolveAuthRateLimit, resolveAuthTracking };

package/dist/src/gateway/runtime-config.js

@@ -1,10 +1,12 @@
-import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
+import { init_host, isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import { init_rate_limit } from "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
 import { requireTunnelGatewayToken } from "../tunnel/auth-policy.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
-import "./rate-limit/index.js";
 //#region src/gateway/runtime-config.ts
+init_rate_limit();
+init_host();
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;
 	if (auth.mode === "token") return typeof auth.token === "string" && auth.token.trim().length > 0;

package/dist/src/gateway/security/audit.js

@@ -1,12 +1,13 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
+import { init_rate_limit } from "../rate-limit/index.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../auth.js";
 import { resolveGatewayListenPlan } from "../listen.js";
 import { collectExposureConflicts, isRemoteGatewayInsecure, isTailnetBindUnavailable } from "../../remote-access/exposure-guards.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
-import "../rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "../runtime-config.js";
 //#region src/gateway/security/audit.ts
+init_rate_limit();
 init_logger();
 const log = createLogger("SecurityAudit");
 /** Minimum token length to resist brute-force even with rate limiting. */

package/dist/src/gateway/security/browser-session.js

@@ -1,6 +1,7 @@
-import { isLoopbackHost } from "../host.js";
+import { init_host, isLoopbackHost } from "../host.js";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 //#region src/gateway/security/browser-session.ts
+init_host();
 function origin(c) {
 	return new URL(`http://${c.req.header("host") ?? new URL(c.req.url).host}`);
 }