@xopcai/xopc 0.0.416 → 0.0.418

package/dist/src/gateway/rate-limit/buckets.js

@@ -1,8 +1,30 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { RateLimiter } from "../../infra/rate-limit/rate-limiter.js";
 import { FailureLimiter } from "../../infra/rate-limit/failure-limiter.js";
-import { init_rate_limit } from "../../infra/rate-limit/index.js";
 //#region src/gateway/rate-limit/buckets.ts
+/**
+* Named rate-limit buckets used across the gateway. Each is a thin wrapper
+* over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})
+* that hard-codes its config and exposes a small surface.
+*
+* All buckets are owned by a process-level singleton {@link BucketRegistry}
+* so that:
+*   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,
+*   - tests get one obvious reset entry point (`resetAllForTests`),
+*   - new buckets are added in exactly one place.
+*
+* Tuning policy:
+*   - `auth_failure` is read from runtime config because users tune it per
+*     deployment. Other buckets keep static defaults until a real need
+*     emerges to expose them. (YAGNI > premature configurability.)
+*/
+const DEFAULT_AUTH_RATE_LIMIT = {
+	enabled: true,
+	maxFailures: 5,
+	windowMs: 900 * 1e3,
+	blockDurationMs: 300 * 1e3,
+	burstCoalesceMs: 1e3,
+	exemptLoopback: true
+};
 function resolveAuthRateLimit(input) {
 	if (!input) return { ...DEFAULT_AUTH_RATE_LIMIT };
 	const blockDurationMs = input.blockDurationMs ?? input.lockoutMs ?? DEFAULT_AUTH_RATE_LIMIT.blockDurationMs;
@@ -21,214 +43,201 @@ function authPolicyConfig(cfg) {
 		exemptLoopback: cfg.exemptLoopback
 	};
 }
-var DEFAULT_AUTH_RATE_LIMIT, BucketRegistry, buckets;
-var init_buckets = __esmMin((() => {
-	init_rate_limit();
-	DEFAULT_AUTH_RATE_LIMIT = {
-		enabled: true,
-		maxFailures: 5,
-		windowMs: 900 * 1e3,
-		blockDurationMs: 300 * 1e3,
-		burstCoalesceMs: 1e3,
-		exemptLoopback: true
-	};
-	BucketRegistry = class {
-		authFailureLimiter;
-		authFailureSignature;
-		identityChallengeLimiter;
-		publicDeviceGlobalLimiter;
-		publicDeviceSourceLimiter;
-		deviceRefreshLimiter;
-		strictApiLimiter;
-		chatApiLimiter;
-		mediaApiLimiter;
-		taskApiLimiter;
-		xopcCloudPollLimiter;
-		channelApiLimiter;
-		tunnelMutateLimiter;
-		pairingExchangeLimiter;
-		sharePublicShortLimiter;
-		sharePublicLongLimiter;
-		/**
-		* Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
-		* compares a stable signature to avoid swapping out a hot bucket on every
-		* config read.
-		*/
-		authFailure(cfg) {
-			const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;
-			if (!this.authFailureLimiter || this.authFailureSignature !== sig) {
-				this.authFailureLimiter?.destroy();
-				this.authFailureLimiter = new FailureLimiter({
-					maxFailures: cfg.maxFailures,
-					windowMs: cfg.windowMs,
-					blockDurationMs: cfg.blockDurationMs,
-					burstCoalesceMs: cfg.burstCoalesceMs
-				});
-				this.authFailureSignature = sig;
-			}
-			return this.authFailureLimiter;
-		}
-		publicDeviceGlobal() {
-			return this.publicDeviceGlobalLimiter ??= new RateLimiter({
-				maxRequests: 1200,
-				windowMs: 6e4
-			});
-		}
-		publicDeviceSource() {
-			return this.publicDeviceSourceLimiter ??= new RateLimiter({
-				maxRequests: 300,
-				windowMs: 6e4
-			});
-		}
-		deviceRefresh() {
-			return this.deviceRefreshLimiter ??= new RateLimiter({
-				maxRequests: 30,
-				windowMs: 6e4
-			});
-		}
-		/** Global pre-authentication signing budget; independent of authenticated traffic. */
-		identityChallenge() {
-			return this.identityChallengeLimiter ??= new RateLimiter({
-				maxRequests: 300,
-				windowMs: 6e4
-			});
-		}
-		/** Authenticated admin / mutation endpoints — 600 req / 60 s per client IP. */
-		strictApi() {
-			if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
-				maxRequests: 600,
-				windowMs: 6e4
-			});
-			return this.strictApiLimiter;
-		}
-		/** Interactive chat actions — 180 req / 60 s per client IP. */
-		chatApi() {
-			if (!this.chatApiLimiter) this.chatApiLimiter = new RateLimiter({
-				maxRequests: 180,
-				windowMs: 6e4
-			});
-			return this.chatApiLimiter;
-		}
-		/** Durable media chunk uploads — 300 req / 60 s per client IP. */
-		mediaApi() {
-			if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
-				maxRequests: 300,
-				windowMs: 6e4
-			});
-			return this.mediaApiLimiter;
-		}
-		/** Interactive task and board mutations — 300 req / 60 s per client IP. */
-		taskApi() {
-			if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
-				maxRequests: 300,
-				windowMs: 6e4
-			});
-			return this.taskApiLimiter;
-		}
-		/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
-		xopcCloudPoll() {
-			if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
-				maxRequests: 60,
-				windowMs: 6e4
-			});
-			return this.xopcCloudPollLimiter;
-		}
-		/** Channel mutation/action endpoints — 20 req / 60 s per client IP. */
-		channelApi() {
-			if (!this.channelApiLimiter) this.channelApiLimiter = new RateLimiter({
-				maxRequests: 20,
-				windowMs: 6e4
-			});
-			return this.channelApiLimiter;
-		}
-		/** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
-		tunnelMutate() {
-			if (!this.tunnelMutateLimiter) this.tunnelMutateLimiter = new RateLimiter({
-				maxRequests: 12,
-				windowMs: 5 * 6e4
-			});
-			return this.tunnelMutateLimiter;
-		}
-		/** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
-		pairingExchange() {
-			if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
-				maxFailures: 30,
-				windowMs: 5 * 6e4,
-				blockDurationMs: 5 * 6e4,
-				burstCoalesceMs: 0
-			});
-			return this.pairingExchangeLimiter;
-		}
-		/** Public share download short window — 60 req / min per client IP. */
-		sharePublicShort() {
-			if (!this.sharePublicShortLimiter) this.sharePublicShortLimiter = new RateLimiter({
-				maxRequests: 60,
-				windowMs: 6e4
-			});
-			return this.sharePublicShortLimiter;
-		}
-		/** Public share download long window — 300 req / 15 min per client IP. */
-		sharePublicLong() {
-			if (!this.sharePublicLongLimiter) this.sharePublicLongLimiter = new RateLimiter({
-				maxRequests: 300,
-				windowMs: 15 * 6e4
-			});
-			return this.sharePublicLongLimiter;
-		}
-		destroyAll() {
+var BucketRegistry = class {
+	authFailureLimiter;
+	authFailureSignature;
+	identityChallengeLimiter;
+	publicDeviceGlobalLimiter;
+	publicDeviceSourceLimiter;
+	deviceRefreshLimiter;
+	strictApiLimiter;
+	chatApiLimiter;
+	mediaApiLimiter;
+	taskApiLimiter;
+	xopcCloudPollLimiter;
+	channelApiLimiter;
+	tunnelMutateLimiter;
+	pairingExchangeLimiter;
+	sharePublicShortLimiter;
+	sharePublicLongLimiter;
+	/**
+	* Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
+	* compares a stable signature to avoid swapping out a hot bucket on every
+	* config read.
+	*/
+	authFailure(cfg) {
+		const sig = `${cfg.maxFailures}|${cfg.windowMs}|${cfg.blockDurationMs}|${cfg.burstCoalesceMs}`;
+		if (!this.authFailureLimiter || this.authFailureSignature !== sig) {
 			this.authFailureLimiter?.destroy();
-			this.identityChallengeLimiter?.destroy();
-			this.publicDeviceGlobalLimiter?.destroy();
-			this.publicDeviceSourceLimiter?.destroy();
-			this.deviceRefreshLimiter?.destroy();
-			this.strictApiLimiter?.destroy();
-			this.chatApiLimiter?.destroy();
-			this.mediaApiLimiter?.destroy();
-			this.taskApiLimiter?.destroy();
-			this.xopcCloudPollLimiter?.destroy();
-			this.channelApiLimiter?.destroy();
-			this.tunnelMutateLimiter?.destroy();
-			this.pairingExchangeLimiter?.destroy();
-			this.sharePublicShortLimiter?.destroy();
-			this.sharePublicLongLimiter?.destroy();
-			this.authFailureLimiter = void 0;
-			this.identityChallengeLimiter = void 0;
-			this.publicDeviceGlobalLimiter = void 0;
-			this.publicDeviceSourceLimiter = void 0;
-			this.deviceRefreshLimiter = void 0;
-			this.strictApiLimiter = void 0;
-			this.chatApiLimiter = void 0;
-			this.mediaApiLimiter = void 0;
-			this.taskApiLimiter = void 0;
-			this.xopcCloudPollLimiter = void 0;
-			this.channelApiLimiter = void 0;
-			this.tunnelMutateLimiter = void 0;
-			this.pairingExchangeLimiter = void 0;
-			this.sharePublicShortLimiter = void 0;
-			this.sharePublicLongLimiter = void 0;
-			this.authFailureSignature = void 0;
-		}
-		/** @internal */
-		resetAllForTests() {
-			this.authFailureLimiter?.resetForTests();
-			this.identityChallengeLimiter?.resetForTests();
-			this.publicDeviceGlobalLimiter?.resetForTests();
-			this.publicDeviceSourceLimiter?.resetForTests();
-			this.deviceRefreshLimiter?.resetForTests();
-			this.strictApiLimiter?.resetForTests();
-			this.chatApiLimiter?.resetForTests();
-			this.mediaApiLimiter?.resetForTests();
-			this.taskApiLimiter?.resetForTests();
-			this.xopcCloudPollLimiter?.resetForTests();
-			this.channelApiLimiter?.resetForTests();
-			this.tunnelMutateLimiter?.resetForTests();
-			this.pairingExchangeLimiter?.resetForTests();
-			this.sharePublicShortLimiter?.resetForTests();
-			this.sharePublicLongLimiter?.resetForTests();
-		}
-	};
-	buckets = new BucketRegistry();
-}));
+			this.authFailureLimiter = new FailureLimiter({
+				maxFailures: cfg.maxFailures,
+				windowMs: cfg.windowMs,
+				blockDurationMs: cfg.blockDurationMs,
+				burstCoalesceMs: cfg.burstCoalesceMs
+			});
+			this.authFailureSignature = sig;
+		}
+		return this.authFailureLimiter;
+	}
+	publicDeviceGlobal() {
+		return this.publicDeviceGlobalLimiter ??= new RateLimiter({
+			maxRequests: 1200,
+			windowMs: 6e4
+		});
+	}
+	publicDeviceSource() {
+		return this.publicDeviceSourceLimiter ??= new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+	}
+	deviceRefresh() {
+		return this.deviceRefreshLimiter ??= new RateLimiter({
+			maxRequests: 30,
+			windowMs: 6e4
+		});
+	}
+	/** Global pre-authentication signing budget; independent of authenticated traffic. */
+	identityChallenge() {
+		return this.identityChallengeLimiter ??= new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+	}
+	/** Authenticated admin / mutation endpoints — 600 req / 60 s per client IP. */
+	strictApi() {
+		if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
+			maxRequests: 600,
+			windowMs: 6e4
+		});
+		return this.strictApiLimiter;
+	}
+	/** Interactive chat actions — 180 req / 60 s per client IP. */
+	chatApi() {
+		if (!this.chatApiLimiter) this.chatApiLimiter = new RateLimiter({
+			maxRequests: 180,
+			windowMs: 6e4
+		});
+		return this.chatApiLimiter;
+	}
+	/** Durable media chunk uploads — 300 req / 60 s per client IP. */
+	mediaApi() {
+		if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.mediaApiLimiter;
+	}
+	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
+	taskApi() {
+		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.taskApiLimiter;
+	}
+	/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
+	xopcCloudPoll() {
+		if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
+			maxRequests: 60,
+			windowMs: 6e4
+		});
+		return this.xopcCloudPollLimiter;
+	}
+	/** Channel mutation/action endpoints — 20 req / 60 s per client IP. */
+	channelApi() {
+		if (!this.channelApiLimiter) this.channelApiLimiter = new RateLimiter({
+			maxRequests: 20,
+			windowMs: 6e4
+		});
+		return this.channelApiLimiter;
+	}
+	/** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
+	tunnelMutate() {
+		if (!this.tunnelMutateLimiter) this.tunnelMutateLimiter = new RateLimiter({
+			maxRequests: 12,
+			windowMs: 5 * 6e4
+		});
+		return this.tunnelMutateLimiter;
+	}
+	/** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
+	pairingExchange() {
+		if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
+			maxFailures: 30,
+			windowMs: 5 * 6e4,
+			blockDurationMs: 5 * 6e4,
+			burstCoalesceMs: 0
+		});
+		return this.pairingExchangeLimiter;
+	}
+	/** Public share download short window — 60 req / min per client IP. */
+	sharePublicShort() {
+		if (!this.sharePublicShortLimiter) this.sharePublicShortLimiter = new RateLimiter({
+			maxRequests: 60,
+			windowMs: 6e4
+		});
+		return this.sharePublicShortLimiter;
+	}
+	/** Public share download long window — 300 req / 15 min per client IP. */
+	sharePublicLong() {
+		if (!this.sharePublicLongLimiter) this.sharePublicLongLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 15 * 6e4
+		});
+		return this.sharePublicLongLimiter;
+	}
+	destroyAll() {
+		this.authFailureLimiter?.destroy();
+		this.identityChallengeLimiter?.destroy();
+		this.publicDeviceGlobalLimiter?.destroy();
+		this.publicDeviceSourceLimiter?.destroy();
+		this.deviceRefreshLimiter?.destroy();
+		this.strictApiLimiter?.destroy();
+		this.chatApiLimiter?.destroy();
+		this.mediaApiLimiter?.destroy();
+		this.taskApiLimiter?.destroy();
+		this.xopcCloudPollLimiter?.destroy();
+		this.channelApiLimiter?.destroy();
+		this.tunnelMutateLimiter?.destroy();
+		this.pairingExchangeLimiter?.destroy();
+		this.sharePublicShortLimiter?.destroy();
+		this.sharePublicLongLimiter?.destroy();
+		this.authFailureLimiter = void 0;
+		this.identityChallengeLimiter = void 0;
+		this.publicDeviceGlobalLimiter = void 0;
+		this.publicDeviceSourceLimiter = void 0;
+		this.deviceRefreshLimiter = void 0;
+		this.strictApiLimiter = void 0;
+		this.chatApiLimiter = void 0;
+		this.mediaApiLimiter = void 0;
+		this.taskApiLimiter = void 0;
+		this.xopcCloudPollLimiter = void 0;
+		this.channelApiLimiter = void 0;
+		this.tunnelMutateLimiter = void 0;
+		this.pairingExchangeLimiter = void 0;
+		this.sharePublicShortLimiter = void 0;
+		this.sharePublicLongLimiter = void 0;
+		this.authFailureSignature = void 0;
+	}
+	/** @internal */
+	resetAllForTests() {
+		this.authFailureLimiter?.resetForTests();
+		this.identityChallengeLimiter?.resetForTests();
+		this.publicDeviceGlobalLimiter?.resetForTests();
+		this.publicDeviceSourceLimiter?.resetForTests();
+		this.deviceRefreshLimiter?.resetForTests();
+		this.strictApiLimiter?.resetForTests();
+		this.chatApiLimiter?.resetForTests();
+		this.mediaApiLimiter?.resetForTests();
+		this.taskApiLimiter?.resetForTests();
+		this.xopcCloudPollLimiter?.resetForTests();
+		this.channelApiLimiter?.resetForTests();
+		this.tunnelMutateLimiter?.resetForTests();
+		this.pairingExchangeLimiter?.resetForTests();
+		this.sharePublicShortLimiter?.resetForTests();
+		this.sharePublicLongLimiter?.resetForTests();
+	}
+};
+const buckets = new BucketRegistry();
 //#endregion
-init_buckets();
-export { authPolicyConfig, buckets, init_buckets, resolveAuthRateLimit };
+export { authPolicyConfig, buckets, resolveAuthRateLimit };

package/dist/src/gateway/rate-limit/env-flags.js

@@ -1,4 +1,3 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 //#region src/gateway/rate-limit/env-flags.ts
 /**
 * Process-level env-var feature flags that influence rate-limit and gateway
@@ -11,7 +10,5 @@ function isAuthRateLimitGloballyDisabled() {
 function isGatewayStrictSecurityEnabled(cfg) {
 	return cfg?.gateway?.security?.strict === true || process.env.XOPC_GATEWAY_STRICT_SECURITY === "1";
 }
-var init_env_flags = __esmMin((() => {}));
 //#endregion
-init_env_flags();
-export { init_env_flags, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled };
+export { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled };

package/dist/src/gateway/rate-limit/index.js

@@ -1,13 +1,4 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { authPolicyConfig, buckets, init_buckets, resolveAuthRateLimit } from "./buckets.js";
-import { buildBrowserOriginKey, init_auth_policy, resolveAuthTracking } from "./auth-policy.js";
-import { init_env_flags, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./env-flags.js";
-//#region src/gateway/rate-limit/index.ts
-var init_rate_limit = __esmMin((() => {
-	init_buckets();
-	init_auth_policy();
-	init_env_flags();
-}));
-//#endregion
-init_rate_limit();
-export { authPolicyConfig, buckets, buildBrowserOriginKey, init_rate_limit, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, resolveAuthRateLimit, resolveAuthTracking };
+import { authPolicyConfig, buckets, resolveAuthRateLimit } from "./buckets.js";
+import { buildBrowserOriginKey, resolveAuthTracking } from "./auth-policy.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./env-flags.js";
+export { authPolicyConfig, buckets, buildBrowserOriginKey, isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled, resolveAuthRateLimit, resolveAuthTracking };

package/dist/src/gateway/runtime-config.js

@@ -1,12 +1,10 @@
-import { init_host, isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
+import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
-import { init_rate_limit } from "./rate-limit/index.js";
+import "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
 import { requireTunnelGatewayToken } from "../tunnel/auth-policy.js";
 //#region src/gateway/runtime-config.ts
-init_rate_limit();
-init_host();
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;
 	if (auth.mode === "token") return typeof auth.token === "string" && auth.token.trim().length > 0;

package/dist/src/gateway/security/audit.js

@@ -1,13 +1,12 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
-import { init_rate_limit } from "../rate-limit/index.js";
+import "../rate-limit/index.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../auth.js";
 import { resolveGatewayListenPlan } from "../listen.js";
 import { collectExposureConflicts, isRemoteGatewayInsecure, isTailnetBindUnavailable } from "../../remote-access/exposure-guards.js";
 import { assertGatewayRuntimeConfig } from "../runtime-config.js";
 //#region src/gateway/security/audit.ts
-init_rate_limit();
 init_logger();
 const log = createLogger("SecurityAudit");
 /** Minimum token length to resist brute-force even with rate limiting. */

package/dist/src/gateway/security/browser-session.js

@@ -1,7 +1,6 @@
-import { init_host, isLoopbackHost } from "../host.js";
+import { isLoopbackHost } from "../host.js";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 //#region src/gateway/security/browser-session.ts
-init_host();
 function origin(c) {
 	return new URL(`http://${c.req.header("host") ?? new URL(c.req.url).host}`);
 }

package/dist/src/gateway/security/device-request-proof.d.ts

@@ -1,11 +1,10 @@
-import crypto from 'node:crypto';
 import type { DeviceRecord } from '../../storage/sqlite/device-access-repository.js';
 export declare const REQUEST_PROOF_WINDOW_MS = 120000;
 export declare const PROOF_HEADER = "X-Xopc-Proof";
 export declare const SIGNED_REQUEST_HEADERS: readonly ["content-type", "idempotency-key", "x-xopc-expected-session-key", "x-endpoint-id", "x-endpoint-upload-token"];
 /** Bounds buffered uploads through route completion, after signature verification. */
 export declare function acquireProofBodyBudget(deviceId: string): (() => void) | undefined;
-export declare function proofDigest(bytes: crypto.BinaryLike): string;
+export declare function proofDigest(bytes: string | NodeJS.ArrayBufferView): string;
 export interface RequestProof {
     timestamp: number;
     nonce: string;

package/dist/src/gateway/security/device-request-proof.js

@@ -1,10 +1,8 @@
 import { init_transaction, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
-import { getDevice, init_device_access_repository } from "../../storage/sqlite/device-access-repository.js";
-import { getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../../storage/sqlite/gateway-identity-repository.js";
+import { getDevice } from "../../storage/sqlite/device-access-repository.js";
+import { getOrCreateGatewayIdentity } from "../../storage/sqlite/gateway-identity-repository.js";
 import crypto from "node:crypto";
 //#region src/gateway/security/device-request-proof.ts
-init_device_access_repository();
-init_gateway_identity_repository();
 init_transaction();
 const REQUEST_PROOF_WINDOW_MS = 12e4;
 const PROOF_HEADER = "X-Xopc-Proof";

package/dist/src/gateway/security/gateway-scopes.js

@@ -1,7 +1,7 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 //#region src/gateway/security/gateway-scopes.ts
+init_src();
 function parseGatewayScopes(value) {
 	const parsed = JSON.parse(value);
 	if (!Array.isArray(parsed) || !parsed.every(isGatewayScope)) throw new Error("Stored device scopes are invalid");
@@ -48,9 +48,5 @@ function requiredGatewayScope(method, path) {
 function hasGatewayScope(granted, required) {
 	return granted.includes("gateway.admin") || granted.includes(required);
 }
-var init_gateway_scopes = __esmMin((() => {
-	init_src();
-}));
 //#endregion
-init_gateway_scopes();
-export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, init_gateway_scopes, isGatewayScope, parseGatewayScopes, requiredGatewayScope };
+export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope };

package/dist/src/gateway/security/index.js

@@ -1,5 +1,5 @@
 import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
-import { hasGatewayScope, init_gateway_scopes, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
+import { hasGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
 import { safeEqualSecret } from "./secret-equal.js";
 import { KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak } from "./known-weak-secrets.js";
 import { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings } from "./audit.js";
@@ -9,7 +9,4 @@ import { checkBrowserOrigin } from "./origin-check.js";
 import { getGatewayPrincipal, setGatewayPrincipal } from "./gateway-principal.js";
 import { DEFAULT_GATEWAY_HTTP_TOOL_DENY, filterDangerousHttpTools, isDangerousHttpTool } from "./dangerous-tools.js";
 import { detectSuspiciousPatterns, wrapExternalContent, wrapWebContent } from "./external-content.js";
-//#region src/gateway/security/index.ts
-init_gateway_scopes();
-//#endregion
 export { DEFAULT_GATEWAY_HTTP_TOOL_DENY, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak, auditGatewayConfig, buildGatewayConsoleCspHeader, checkBrowserOrigin, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings, computeInlineScriptHashes, createPreauthConnectionBudget, detectSuspiciousPatterns, filterDangerousHttpTools, getGatewayPrincipal, getMaxPreauthConnectionsPerIp, hasGatewayScope, isDangerousHttpTool, isGatewayScope, parseGatewayScopes, requiredGatewayScope, safeEqualSecret, setGatewayPrincipal, wrapExternalContent, wrapWebContent };

package/dist/src/gateway/security/loopback.js

@@ -1,6 +1,9 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { init_host, isLoopbackHost } from "../host.js";
+import { isLoopbackHost } from "../host.js";
 //#region src/gateway/security/loopback.ts
+/**
+* Loopback / browser-origin classification helpers used by rate-limit policy
+* and other security middleware. Pure functions, no I/O.
+*/
 function isLoopbackClientIp(clientIp) {
 	if (!clientIp || clientIp === "unknown") return false;
 	const trimmed = clientIp.trim();
@@ -36,9 +39,5 @@ function getClientIpFromHeaders(headers) {
 	if (cf) return cf;
 	return "unknown";
 }
-var init_loopback = __esmMin((() => {
-	init_host();
-}));
 //#endregion
-init_loopback();
-export { getClientIpFromHeaders, init_loopback, isLoopbackBrowserOrigin, isLoopbackClientIp, isLoopbackEmbeddedBrowserClient };
+export { getClientIpFromHeaders, isLoopbackBrowserOrigin, isLoopbackClientIp, isLoopbackEmbeddedBrowserClient };

package/dist/src/gateway/service/agent-runner.js

@@ -5,9 +5,9 @@ import { readClarificationPresentation } from "../../../packages/gateway-contrac
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { listActiveSessionInputExecutions, listActiveSessionInputRuns } from "../../storage/sqlite/session-input-repository.js";
 import { TaskRepository, init_task_repository } from "../../tasks/task-repository.js";
-import { createClarificationWait, getClarification, getClarificationSnapshot, init_clarification_wait_repository, resolveClarification, supersedeActiveClarification } from "../../storage/sqlite/clarification-wait-repository.js";
+import { createClarificationWait, getClarification, getClarificationSnapshot, resolveClarification, supersedeActiveClarification } from "../../storage/sqlite/clarification-wait-repository.js";
 import { init_connection_wait_repository, onConnectionWaitChanged } from "../../storage/sqlite/connection-wait-repository.js";
-import { init_sqlite } from "../../storage/sqlite/index.js";
+import "../../storage/sqlite/index.js";
 import { AgentRunCancelledError } from "../../agent/orchestration/run-termination.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
@@ -24,9 +24,7 @@ import crypto from "node:crypto";
 //#region src/gateway/service/agent-runner.ts
 init_src();
 init_connection_wait_repository();
-init_clarification_wait_repository();
 init_logger();
-init_sqlite();
 init_transaction();
 init_task_repository();
 /**

package/dist/src/gateway/service/app-context-access.js

@@ -1,6 +1,6 @@
 import { parseAppContextEnvelope } from "../../../packages/gateway-contract/src/app-context.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
-import { getDevice, init_device_access_repository } from "../../storage/sqlite/device-access-repository.js";
+import { getDevice } from "../../storage/sqlite/device-access-repository.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
 import { isBrowserSessionActive } from "../../storage/sqlite/browser-session-repository.js";
@@ -8,7 +8,6 @@ import { appContextToAgentContext } from "../../agent/source-context/app-context
 import { createHmac, randomBytes } from "node:crypto";
 //#region src/gateway/service/app-context-access.ts
 init_src();
-init_device_access_repository();
 const authorizationEpochKey = randomBytes(32);
 function authRevision(auth) {
 	return createHmac("sha256", authorizationEpochKey).update(canonicalCapabilityJson(JSON.parse(JSON.stringify(auth)))).digest("hex");

package/dist/src/gateway/service/config-coordinator.d.ts

@@ -325,12 +325,14 @@ export declare class GatewayConfigCoordinator {
         };
         phone: {
             enabled: boolean;
+            executionMode: "collaborative" | "direct";
             semanticControls: boolean;
             hierarchicalPlanning: boolean;
             maxActionsPerSession: number;
             maxModelRequests: number;
             maxOperationDurationMs: number;
             maxSessionDurationMs: number;
+            idleDisconnectMs: number;
             adbPath?: string;
         };
         tools: {