@xopcai/xopc 0.0.373 → 0.0.374

package/dist/src/infra/rate-limit/rate-limiter.js

@@ -1,63 +1,60 @@
-import { KeyedStore } from "./keyed-store.js";
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { KeyedStore, init_keyed_store } from "./keyed-store.js";
 //#region src/infra/rate-limit/rate-limiter.ts
-/**
-* Per-key fixed-window request-rate limiter. Every `consume()` counts toward
-* the limit; once the window's count hits `maxRequests`, subsequent consumes
-* return `allowed: false` until the window rolls over.
-*
-* Use this for *throughput* limiting (e.g. "15 req/min on /admin"). For
-* *failure-rate* limiting with lockout (e.g. brute-force protection), use
-* {@link FailureLimiter} instead.
-*/
-var RateLimiter = class {
-	store;
-	clock;
-	maxRequests;
-	windowMs;
-	constructor(cfg) {
-		this.maxRequests = Math.max(1, Math.floor(cfg.maxRequests));
-		this.windowMs = Math.max(1, Math.floor(cfg.windowMs));
-		this.clock = cfg.clock ?? Date.now;
-		this.store = new KeyedStore({
-			staleAfterMs: cfg.staleAfterMs ?? this.windowMs * 4,
-			clock: this.clock
-		});
-	}
-	consume(key) {
-		const now = this.clock();
-		let state = this.store.get(key);
-		if (!state) {
-			state = {
-				windowStart: now,
-				count: 0,
-				lastTouchedMs: now
+var RateLimiter;
+var init_rate_limiter = __esmMin((() => {
+	init_keyed_store();
+	RateLimiter = class {
+		store;
+		clock;
+		maxRequests;
+		windowMs;
+		constructor(cfg) {
+			this.maxRequests = Math.max(1, Math.floor(cfg.maxRequests));
+			this.windowMs = Math.max(1, Math.floor(cfg.windowMs));
+			this.clock = cfg.clock ?? Date.now;
+			this.store = new KeyedStore({
+				staleAfterMs: cfg.staleAfterMs ?? this.windowMs * 4,
+				clock: this.clock
+			});
+		}
+		consume(key) {
+			const now = this.clock();
+			let state = this.store.get(key);
+			if (!state) {
+				state = {
+					windowStart: now,
+					count: 0,
+					lastTouchedMs: now
+				};
+				this.store.set(key, state);
+			}
+			if (now - state.windowStart >= this.windowMs) {
+				state.windowStart = now;
+				state.count = 0;
+			}
+			state.lastTouchedMs = now;
+			if (state.count >= this.maxRequests) return {
+				allowed: false,
+				remaining: 0,
+				retryAfterMs: Math.max(0, state.windowStart + this.windowMs - now)
+			};
+			state.count += 1;
+			return {
+				allowed: true,
+				remaining: this.maxRequests - state.count,
+				retryAfterMs: 0
 			};
-			this.store.set(key, state);
 		}
-		if (now - state.windowStart >= this.windowMs) {
-			state.windowStart = now;
-			state.count = 0;
+		/** @internal Test hook. */
+		resetForTests() {
+			this.store.clear();
+		}
+		destroy() {
+			this.store.destroy();
 		}
-		state.lastTouchedMs = now;
-		if (state.count >= this.maxRequests) return {
-			allowed: false,
-			remaining: 0,
-			retryAfterMs: Math.max(0, state.windowStart + this.windowMs - now)
-		};
-		state.count += 1;
-		return {
-			allowed: true,
-			remaining: this.maxRequests - state.count,
-			retryAfterMs: 0
-		};
-	}
-	/** @internal Test hook. */
-	resetForTests() {
-		this.store.clear();
-	}
-	destroy() {
-		this.store.destroy();
-	}
-};
+	};
+}));
 //#endregion
-export { RateLimiter };
+init_rate_limiter();
+export { RateLimiter, init_rate_limiter };

package/dist/src/infra/update-service-refresh.js

@@ -1,9 +1,10 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { SERVICE_VERSION_ENV_KEY, formatGatewayServiceDescription } from "../daemon/constants.js";
+import { SERVICE_VERSION_ENV_KEY, formatGatewayServiceDescription, init_constants } from "../daemon/constants.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region src/infra/update-service-refresh.ts
+init_constants();
 init_logger();
 const log = createLogger("UpdateServiceRefresh");
 function resolveBinPath(bin) {

package/dist/src/notes/service.js

@@ -7,8 +7,8 @@ import { init_note_markdown, parseNoteMarkdown } from "./note-markdown.js";
 import { init_notes_repository, listNoteProjectSummaries } from "../storage/sqlite/notes-repository.js";
 import { changedFieldsFromPatch, emitActivity, previewText, systemActivityActor, systemActivitySource } from "../activity/emitter.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
-import { completeWithResolvedCredentials } from "../providers/model-call.js";
 import { DomainOutboxDispatcher } from "../infra/domain-outbox-dispatcher.js";
+import { completeWithResolvedCredentials } from "../providers/model-call.js";
 import { partitionAttachmentsByReference } from "./note-attachment-sync.js";
 import { buildNoteAgentContextArtifact, getCachedNoteAgentContextArtifact } from "./agent-context.js";
 import { revokeNoteShareRecords } from "../share/note-share-revocation.js";

package/dist/src/observability/runtime.js

@@ -1,8 +1,8 @@
 import { init_context, runWithLogContext } from "../utils/logger/context.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { TracingConfigSchema, defaultTracingConfig, init_config } from "./config.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { TracingConfigSchema, defaultTracingConfig, init_config } from "./config.js";
 import { LangfuseTarget } from "./langfuse.js";
 import { boundedJson, redactString } from "./sanitize.js";
 import { LocalTraceStore } from "./store.js";

package/dist/src/personal-agent/proactivity/service.js

@@ -6,13 +6,13 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_session_instance_repository, readCurrentTranscriptId } from "../../storage/sqlite/session-instance-repository.js";
 import { appendTranscriptEntry, init_transcript_repository } from "../../storage/sqlite/transcript-repository.js";
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
-import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
-import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { getPersonalAgent } from "../repository.js";
 import { DurableState } from "../../storage/sqlite/durable-state.js";
 import { enqueueDue, enqueueWakeup, getAttention, getAttentionSources, getProactivitySettings, isQuiet, listAttention, localDay, preparationStrategy, recordFeedback, reserveModelCall, saveAttention, sourceFingerprint, userText } from "./repository.js";
+import { completeWithResolvedCredentials } from "../../providers/model-call.js";
+import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 import { emitSessionTranscriptUpdate } from "../../session/transcript-events.js";
 import { PERSONAL_PERSONA_GUIDANCE } from "../persona.js";
 import { personalConversationState } from "../conversation-state.js";

package/dist/src/personal-agent/reply-composer.js

@@ -9,12 +9,12 @@ import { appendTranscriptEntry, init_transcript_repository, loadLlmMessagesForSe
 import { getSessionConfig, init_config_repository } from "../storage/sqlite/config-repository.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { init_providers, resolveModel } from "../providers/index.js";
-import { completeWithResolvedCredentials } from "../providers/model-call.js";
 import { getPersonalAgentByConversation } from "./repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { loadProfileBootstrapFiles } from "../agent/bootstrap/load-bootstrap-files.js";
+import { completeWithResolvedCredentials } from "../providers/model-call.js";
+import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { emitSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { PERSONAL_PERSONA_GUIDANCE } from "./persona.js";
 import { PERSONAL_REPLY_EXAMPLES, PERSONAL_REPLY_STYLE_RULES } from "./reply-style.js";

package/dist/src/personal-agent/repository.d.ts

@@ -13,6 +13,9 @@ export interface PersonalAgentRecord {
         model: string;
         voice: string;
     } | null;
+    voiceCallPreferences: {
+        openingGreetingEnabled: boolean;
+    };
     preferences: Record<string, unknown>;
     revision: number;
     errorMessage: string | null;

package/dist/src/personal-agent/repository.js

@@ -48,6 +48,7 @@ function toRecord(ownerId, agent, session) {
 		userCallName: getUserProfileSnapshot().callName ?? null,
 		appearance: appearanceFrom(agent),
 		voicePreference: agent.profile?.voicePreference ?? null,
+		voiceCallPreferences: agent.profile?.voiceCallPreferences ?? { openingGreetingEnabled: true },
 		preferences: agent.profile?.responsePreferences ?? DEFAULT_PERSONAL_PREFERENCES,
 		revision: agent.revision,
 		errorMessage: agent.provisioningError ?? null

package/dist/src/personal-agent/service.d.ts

@@ -63,9 +63,13 @@ export declare function patchPersonalProfile(service: PersonalAgentHost, ownerId
     provider: string;
     model: string;
     voice: string;
-} | null): Promise<PersonalAgentRecord | null>;
+} | null, voiceCallPreferences?: {
+    openingGreetingEnabled: boolean;
+}): Promise<PersonalAgentRecord | null>;
 export declare function updatePersonalProfileRecord(ownerId: string, revision: number, displayName: string, preferences: PersonalPreferences, appearance: PersonalAppearance, voicePreference?: {
     provider: string;
     model: string;
     voice: string;
-} | null): Promise<PersonalAgentRecord | null>;
+} | null, voiceCallPreferences?: {
+    openingGreetingEnabled: boolean;
+}): Promise<PersonalAgentRecord | null>;

package/dist/src/personal-agent/service.js

@@ -159,14 +159,14 @@ async function provisionPersonalAgent(service, ownerId, requestedModel, availabl
 	completePersonalOnboarding(ownerId);
 	return getPersonalAgent(ownerId) ?? record;
 }
-async function patchPersonalProfile(service, ownerId, revision, displayName, preferences, appearance, voicePreference) {
-	const updated = await updatePersonalProfileRecord(ownerId, revision, displayName, preferences, appearance, voicePreference);
+async function patchPersonalProfile(service, ownerId, revision, displayName, preferences, appearance, voicePreference, voiceCallPreferences) {
+	const updated = await updatePersonalProfileRecord(ownerId, revision, displayName, preferences, appearance, voicePreference, voiceCallPreferences);
 	if (!updated) return null;
 	service.refreshAgentCatalog();
 	service.agentService.evictSessionAgent(updated.conversationId);
 	return updated;
 }
-async function updatePersonalProfileRecord(ownerId, revision, displayName, preferences, appearance, voicePreference) {
+async function updatePersonalProfileRecord(ownerId, revision, displayName, preferences, appearance, voicePreference, voiceCallPreferences) {
 	const current = new AgentCatalogRepository().get(personalAgentId(ownerId));
 	if (!current || current.provisioningState !== "ready" || current.revision !== revision || getPersonalAgent(ownerId)?.state !== "ready") return null;
 	const profile = {
@@ -175,6 +175,7 @@ async function updatePersonalProfileRecord(ownerId, revision, displayName, prefe
 		emoji: appearanceEmoji(appearance),
 		avatar: appearanceAvatar(appearance),
 		...voicePreference !== void 0 ? { voicePreference: voicePreference ?? void 0 } : {},
+		...voiceCallPreferences ? { voiceCallPreferences } : {},
 		responsePreferences: preferences,
 		instructions: personalInstructions(preferences)
 	};

package/dist/src/platform/client.d.ts

@@ -67,9 +67,9 @@ export declare const RuntimeCommandSchema: z.ZodObject<{
                     write: "write";
                     execute: "execute";
                     purchase: "purchase";
-                    admin: "admin";
                     send: "send";
                     publish: "publish";
+                    admin: "admin";
                 }>>;
             }, z.core.$strict>;
             data: z.ZodObject<{

package/dist/src/platform/contracts.d.ts

@@ -153,9 +153,9 @@ export declare const AgentManifestSchema: z.ZodObject<{
             write: "write";
             execute: "execute";
             purchase: "purchase";
-            admin: "admin";
             send: "send";
             publish: "publish";
+            admin: "admin";
         }>>;
     }, z.core.$strict>;
     data: z.ZodObject<{

package/dist/src/platform/index.js

@@ -1,5 +1,5 @@
-import { AgentManifestSchema, PlatformCapabilitySchema, PlatformConfigSchema, PlatformDiscoverySchema, PlatformEventSchema, init_contracts } from "./contracts.js";
 import { init_resolution, resolveConnectedPlatformDiscovery, resolveConnectedPlatformEndpoint, setActivePlatformDiscovery } from "./resolution.js";
+import { AgentManifestSchema, PlatformCapabilitySchema, PlatformConfigSchema, PlatformDiscoverySchema, PlatformEventSchema, init_contracts } from "./contracts.js";
 import { PLATFORM_RUNTIME_PROFILE, PLATFORM_RUNTIME_PROVIDER, PlatformRuntimeClient, RuntimeCommandSchema, discoverPlatform } from "./client.js";
 import { processRuntimeCommand } from "./worker.js";
 //#region src/platform/index.ts

package/dist/src/providers/index.js

@@ -1,12 +1,12 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { assertCurrentModelProvider, init_provider_policy, isRetiredModelProvider } from "./provider-policy.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
-import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
-import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
 import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { assertCurrentModelProvider, init_provider_policy, isRetiredModelProvider } from "./provider-policy.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
+import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
+import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-registry.js

@@ -1,11 +1,11 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
+import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
 import { init_provider_policy, isRetiredModelProvider } from "./provider-policy.js";
+import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
-import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { existsSync, readFileSync } from "fs";

package/dist/src/providers/provider-auth-service.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_paths, resolveModelsJsonPath } from "../config/paths.js";
-import { assertCurrentModelProvider, init_provider_policy } from "./provider-policy.js";
 import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "./register-bundled-oauth-flows.js";
+import { assertCurrentModelProvider, init_provider_policy } from "./provider-policy.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
 import { XopcModelCredentialStore, init_model_credential_store } from "../auth/model-credential-store.js";
 import { init_register_runtime_providers, registerRuntimeProviders } from "./register-runtime-providers.js";

package/dist/src/providers/provider-disconnect-core.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { getModelRegistry, init_model_registry } from "./model-registry.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "../auth/oauth-provider-lock.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { getModelRegistry, init_model_registry } from "./model-registry.js";
 import { getProviderAuthService, init_provider_auth_service } from "./provider-auth-service.js";
 import { evictAllEmbeddedSessionRunners } from "../agent/embedded/session-runner.js";
 //#region src/providers/provider-disconnect-core.ts

package/dist/src/providers/register-runtime-providers.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { init_provider_policy, isRetiredModelProvider } from "./provider-policy.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
-import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/providers/xopc-cloud-catalog-coordinator.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { init_oauth_provider_lock, withOAuthProviderLock } from "../auth/oauth-provider-lock.js";
 import { ModelCatalogPersistence, init_model_catalog_persistence } from "./model-catalog-persistence.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getModelRegistry, init_model_registry } from "./model-registry.js";
-import { init_oauth_provider_lock, withOAuthProviderLock } from "../auth/oauth-provider-lock.js";
 import { reloadImageGenerationProviders } from "../agent/image/generation/provider-registry.js";
 import { disconnectProviderCore } from "./provider-disconnect-core.js";
 import { XopcCloudModelSource } from "./xopc-cloud-model-source.js";

package/dist/src/realtime/runtime.js

@@ -3,6 +3,7 @@ import { init_logger } from "../utils/logger.js";
 import { hasGatewayScope, init_gateway_scopes } from "../gateway/security/gateway-scopes.js";
 import { EndpointToolPolicyError } from "../endpoint-tools/policy.js";
 import { REALTIME_CAPABILITIES, REALTIME_HEARTBEAT_INTERVAL_MS, REALTIME_HEARTBEAT_TIMEOUT_MS, REALTIME_HELLO_TIMEOUT_MS, REALTIME_MAX_CLIENT_FRAME_BYTES, parseClientRealtimeJsonFrame, parseClientRealtimeMessage } from "../../packages/realtime-protocol/src/index.js";
+import { verifyDeviceConnectionProof } from "../gateway/security/device-request-proof.js";
 import { compactRunEvent } from "./compact-run-event.js";
 import { createPreauthConnectionBudget } from "../gateway/security/preauth-connection-budget.js";
 import { RealtimeBroker } from "./broker.js";
@@ -221,6 +222,11 @@ var RealtimeRuntime = class {
 					socket.close(4401, "First realtime message must be hello");
 					return;
 				}
+				const pendingClaim = this.tickets.peek(message.payload.ticket);
+				if (!pendingClaim || pendingClaim.deviceId && !verifyDeviceConnectionProof(pendingClaim.deviceId, message.payload.ticket, new URL(request.url, "http://localhost").pathname + new URL(request.url, "http://localhost").search, typeof request.headers["x-xopc-proof"] === "string" ? request.headers["x-xopc-proof"] : void 0)) {
+					socket.close(4401, "Realtime authentication failed");
+					return;
+				}
 				const claim = this.tickets.consume(message.payload.ticket, message.payload.clientId, message.payload.clientKind);
 				if (!claim || !this.isPrincipalActive(claim.principalId)) {
 					socket.close(4401, "Realtime authentication failed");

package/dist/src/realtime/tickets.d.ts

@@ -15,6 +15,7 @@ export interface IssuedRealtimeTicket extends RealtimeTicketClaim {
 export declare class RealtimeTicketStore {
     private readonly claims;
     issue(clientId: string, clientKind: RealtimeClientKind, principal: Omit<RealtimeTicketClaim, 'clientId' | 'clientKind' | 'expiresAt'>, now?: number): IssuedRealtimeTicket;
+    peek(ticket: string, now?: number): RealtimeTicketClaim | undefined;
     consume(ticket: string, clientId: string, clientKind: RealtimeClientKind, now?: number): RealtimeTicketClaim | undefined;
     revokePrincipal(principalId: string): void;
     private prune;

package/dist/src/realtime/tickets.js

@@ -23,6 +23,10 @@ var RealtimeTicketStore = class {
 			...claim
 		};
 	}
+	peek(ticket, now = Date.now()) {
+		const claim = this.claims.get(ticketKey(ticket));
+		return claim && claim.expiresAt >= now ? claim : void 0;
+	}
 	consume(ticket, clientId, clientKind, now = Date.now()) {
 		const key = ticketKey(ticket);
 		const claim = this.claims.get(key);

package/dist/src/remote-access/exposure-guards.js

@@ -1,7 +1,8 @@
-import { isLoopbackHost } from "../gateway/host.js";
+import { init_host, isLoopbackHost } from "../gateway/host.js";
 import { resolveGatewayBindMode } from "../config/gateway-bind.js";
 import { resolveGatewayListenPlan } from "../gateway/listen.js";
 //#region src/remote-access/exposure-guards.ts
+init_host();
 function collectExposureConflicts(cfg) {
 	const conflicts = [];
 	const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";

package/dist/src/share/share-rate-limit.js

@@ -1,8 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { buckets } from "../gateway/rate-limit/buckets.js";
-import "../gateway/rate-limit/index.js";
+import { init_rate_limit } from "../gateway/rate-limit/index.js";
 //#region src/share/share-rate-limit.ts
+init_rate_limit();
 init_logger();
 const log = createLogger("ShareRateLimit");
 /**

package/dist/src/share/share-url.js

@@ -1,6 +1,7 @@
-import { enumerateLanGatewayCandidates } from "../gateway/host.js";
+import { enumerateLanGatewayCandidates, init_host } from "../gateway/host.js";
 import { getTunnelService } from "../tunnel/tunnel-service.js";
 //#region src/share/share-url.ts
+init_host();
 function resolveShareUrl(token, ctx) {
 	const tunnelPublicUrl = activeTunnelPublicUrl();
 	const { gatewayHost, gatewayPort, reverseProxyPublicUrl } = ctx;

package/dist/src/share/site-share-router.js

@@ -1,13 +1,14 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getClientIpFromHeaders, init_loopback } from "../gateway/security/loopback.js";
 import { resolveSiteShareConfig } from "./site-share-config.js";
 import "./share-store.js";
 import { getSiteShareStore } from "./site-share-store.js";
-import { getClientIpFromHeaders } from "../gateway/security/loopback.js";
 import { serveStaticSiteRequest } from "./site-static-serve.js";
 import { forwardHttpRequest, handleProxyWebSocketUpgrade } from "./site-proxy.js";
 import { renderShareExpiredPage } from "./share-landing.js";
 //#region src/share/site-share-router.ts
+init_loopback();
 init_logger();
 const log = createLogger("SiteShareRouter");
 const SITE_SUBPATH_PREFIX = "/site/";

package/dist/src/storage/sqlite/device-access-repository.d.ts

@@ -8,6 +8,7 @@ export type DeviceRecord = {
     platform: DevicePlatform;
     extensionId?: string;
     publicKeyJwk: DevicePublicKeyJwk;
+    requestProofVersion: number;
     scopes: GatewayScope[];
     createdAt: number;
     lastSeenAt?: number;
@@ -45,7 +46,12 @@ export declare function buildRefreshProofMessage(input: {
     nonce: string;
     requestId: string;
     nextRefreshToken: string;
+    requestProofVersion?: number;
 }): string;
+export declare class DeviceRefreshRateLimitError extends Error {
+    readonly retryAfterMs: number;
+    constructor(retryAfterMs: number);
+}
 export declare function rotateDeviceRefreshToken(input: {
     refreshToken: string;
     timestamp: number;
@@ -53,6 +59,7 @@ export declare function rotateDeviceRefreshToken(input: {
     requestId: string;
     nextRefreshToken: string;
     signature: string;
+    requestProofVersion?: number;
     now?: number;
 }): DeviceTokenPair;
 export declare function revokeDevice(deviceId: string, now?: number): boolean;

package/dist/src/storage/sqlite/device-access-repository.js

@@ -2,6 +2,8 @@ import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "./transaction.js";
 import { initialDeviceRefreshTokenSchema } from "../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { buckets } from "../../gateway/rate-limit/buckets.js";
+import { init_rate_limit } from "../../gateway/rate-limit/index.js";
 import { init_gateway_scopes, parseGatewayScopes } from "../../gateway/security/gateway-scopes.js";
 import crypto from "node:crypto";
 //#region src/storage/sqlite/device-access-repository.ts
@@ -23,6 +25,7 @@ function deviceFromRow(row) {
 		displayName: row.display_name,
 		platform: row.platform,
 		publicKeyJwk: JSON.parse(row.public_key_jwk),
+		requestProofVersion: row.request_proof_version,
 		...row.extension_id ? { extensionId: row.extension_id } : {},
 		scopes: parseGatewayScopes(row.scopes_json),
 		createdAt: row.created_at,
@@ -109,7 +112,7 @@ function authenticateDeviceAccessToken(token, now = Date.now()) {
 	};
 }
 function buildRefreshProofMessage(input) {
-	return `xopc-device-refresh-v2\n${input.credentialId}\n${input.timestamp}\n${input.nonce}\n${input.requestId}\n${input.nextRefreshToken}`;
+	return `xopc-device-refresh-v2\n${input.credentialId}\n${input.timestamp}\n${input.nonce}\n${input.requestId}\n${input.nextRefreshToken}${input.requestProofVersion ? `\nrequest-proof:${input.requestProofVersion}` : ""}`;
 }
 function verifyRefreshProof(publicKeyJwk, message, signature) {
 	try {
@@ -146,9 +149,17 @@ function rotateDeviceRefreshToken(input) {
 			timestamp: input.timestamp,
 			nonce: input.nonce,
 			requestId: input.requestId,
-			nextRefreshToken: input.nextRefreshToken
+			nextRefreshToken: input.nextRefreshToken,
+			requestProofVersion: input.requestProofVersion
 		});
 		if (!verifyRefreshProof(JSON.parse(deviceRow.public_key_jwk), message, input.signature)) throw new Error("Invalid refresh proof");
+		const refreshBudget = buckets.deviceRefresh().consume(credential.device_id);
+		if (!refreshBudget.allowed) throw new DeviceRefreshRateLimitError(refreshBudget.retryAfterMs);
+		if (deviceRow.request_proof_version > (input.requestProofVersion ?? 0)) throw new Error("Request proof downgrade denied");
+		if (input.requestProofVersion === 1 && deviceRow.request_proof_version === 0) {
+			db.prepare("UPDATE devices SET request_proof_version = 1 WHERE device_id = ?").run(credential.device_id);
+			db.prepare("UPDATE device_access_sessions SET revoked_at = ? WHERE device_id = ? AND revoked_at IS NULL").run(now, credential.device_id);
+		}
 		if (credential.replaced_by === nextParsed.id && credential.rotation_request_id === input.requestId) {
 			const nextCredential = db.prepare(`
         SELECT credential_id, device_id, token_hash, expires_at, replaced_by,
@@ -198,9 +209,10 @@ function revokeDevice(deviceId, now = Date.now()) {
 		return changed;
 	});
 }
-var ACCESS_TOKEN_TTL_MS, REFRESH_TOKEN_TTL_MS, REFRESH_PROOF_MAX_AGE_MS, ACCESS_TOKEN_PREFIX, REFRESH_TOKEN_PREFIX;
+var ACCESS_TOKEN_TTL_MS, REFRESH_TOKEN_TTL_MS, REFRESH_PROOF_MAX_AGE_MS, ACCESS_TOKEN_PREFIX, REFRESH_TOKEN_PREFIX, DeviceRefreshRateLimitError;
 var init_device_access_repository = __esmMin((() => {
 	init_src();
+	init_rate_limit();
 	init_gateway_scopes();
 	init_transaction();
 	ACCESS_TOKEN_TTL_MS = 900 * 1e3;
@@ -208,7 +220,13 @@ var init_device_access_repository = __esmMin((() => {
 	REFRESH_PROOF_MAX_AGE_MS = 300 * 1e3;
 	ACCESS_TOKEN_PREFIX = "xopc_at_";
 	REFRESH_TOKEN_PREFIX = "xopc_rt_";
+	DeviceRefreshRateLimitError = class extends Error {
+		constructor(retryAfterMs) {
+			super("Too many device refresh requests");
+			this.retryAfterMs = retryAfterMs;
+		}
+	};
 }));
 //#endregion
 init_device_access_repository();
-export { authenticateDeviceAccessToken, buildRefreshProofMessage, createDevice, getDevice, init_device_access_repository, issueDeviceTokenPair, listDevices, registerInitialDeviceRefreshToken, revokeDevice, rotateDeviceRefreshToken };
+export { DeviceRefreshRateLimitError, authenticateDeviceAccessToken, buildRefreshProofMessage, createDevice, getDevice, init_device_access_repository, issueDeviceTokenPair, listDevices, registerInitialDeviceRefreshToken, revokeDevice, rotateDeviceRefreshToken };

package/dist/src/storage/sqlite/migrations/243_voice_opening_greetings.sql

@@ -0,0 +1,12 @@
+CREATE TABLE voice_opening_greetings (
+  principal_id TEXT NOT NULL,
+  conversation_id TEXT NOT NULL,
+  logical_call_id TEXT NOT NULL,
+  response_id TEXT NOT NULL,
+  state TEXT NOT NULL CHECK(state IN ('claimed', 'completed', 'skipped', 'interrupted', 'failed', 'expired')),
+  reason TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (principal_id, conversation_id, logical_call_id)
+);
+CREATE INDEX idx_voice_opening_greetings_created ON voice_opening_greetings(created_at);

package/dist/src/storage/sqlite/migrations/244_device_request_proofs.sql

@@ -0,0 +1,8 @@
+ALTER TABLE devices ADD COLUMN request_proof_version INTEGER NOT NULL DEFAULT 0;
+CREATE TABLE device_request_nonces (
+  device_id TEXT NOT NULL REFERENCES devices(device_id) ON DELETE CASCADE,
+  nonce TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  PRIMARY KEY (device_id, nonce)
+) WITHOUT ROWID;
+CREATE INDEX device_request_nonces_expiry ON device_request_nonces(expires_at);

package/dist/src/storage/sqlite/migrations/runner.d.ts

@@ -3,7 +3,7 @@ import type { ApplyMigrationsOptions } from './types.js';
 /** Baseline schema version applied from schema.sql on first open. */
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 165;
 /** Latest schema version this release supports (increment when adding migrations). */
-export declare const XOPC_DB_SCHEMA_VERSION = 242;
+export declare const XOPC_DB_SCHEMA_VERSION = 244;
 export declare function resolveMigrationsDir(override?: string): string;
 /**
  * Apply sequential SQL migrations from (currentVersion + 1) through targetVersion.

package/dist/src/storage/sqlite/migrations/runner.js

@@ -57,7 +57,7 @@ function applySingleMigration(db, migration, discardOldScenes = false) {
 */
 function applyPendingMigrations(db, options = {}) {
 	db.function("xopc_operation_id", () => currentOperationId() ?? null);
-	const targetVersion = options.targetVersion ?? 242;
+	const targetVersion = options.targetVersion ?? 244;
 	let currentVersion = readSchemaVersion(db);
 	if (currentVersion > targetVersion) throw new DatabaseSchemaTooNewError(currentVersion, targetVersion);
 	if (!options.migrationsDir && currentVersion < 165) throw new DatabaseSchemaTooOldError(currentVersion, 165);
@@ -95,7 +95,7 @@ function applyPendingMigrations(db, options = {}) {
 }
 /** Inspect schema version without mutating the database. */
 function inspectSchemaMigrationStatus(db, options = {}) {
-	const appVersion = options.targetVersion ?? 242;
+	const appVersion = options.targetVersion ?? 244;
 	const dbVersion = readSchemaVersion(db);
 	if (dbVersion > appVersion) return {
 		dbVersion,
@@ -137,7 +137,7 @@ var init_runner = __esmMin((() => {
 	init_errors();
 	log = createLogger("Sqlite:Migrations");
 	XOPC_DB_BASELINE_SCHEMA_VERSION = 165;
-	XOPC_DB_SCHEMA_VERSION = 242;
+	XOPC_DB_SCHEMA_VERSION = 244;
 }));
 //#endregion
 init_runner();

package/dist/src/storage/sqlite/schema.js

@@ -28,7 +28,7 @@ function ensureXopcDatabaseSchema(db, options = {}) {
 		currentVersion = 165;
 	}
 	applyPendingMigrations(db, {
-		targetVersion: 242,
+		targetVersion: 244,
 		databasePath: fresh ? void 0 : options.databasePath
 	});
 }