@xopcai/xopc 0.0.77 → 0.0.78

package/dist/src/gateway/hono/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createFixedWindowRateLimiter } from '../../infra/rate-limit.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveGatewayCorsOrigins } from '../host.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\n\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = service.currentConfig.gateway.port ?? 18790;\n  const corsOrigin = resolveGatewayCorsOrigins({\n    configuredOrigins: service.currentConfig.gateway.corsOrigins,\n    port: gatewayPort,\n    bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n  });\n\n  const CORS_OPTIONS = {\n    origin: corsOrigin,\n    allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n    allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n    credentials: true,\n    maxAge: 86400,\n  };\n\n  app.use(logContextMiddleware());\n  app.use(logger());\n  app.use(cors(CORS_OPTIONS));\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowedOrigins = Array.isArray(corsOrigin) ? corsOrigin : [corsOrigin];\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin) {\n      // Non-browser request (CLI, server-to-server) — skip origin check\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins,\n      allowHostHeaderOriginFallback,\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        { origin, reason: 'reason' in result ? result.reason : 'unknown', path: c.req.path },\n        'Browser origin check failed',\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) =>\n        ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413),\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimiter = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\n  const RATE_LIMIT_CLEANUP_INTERVAL = 5 * 60 * 1000;\n  setInterval(() => {\n    for (const [ip, limiter] of strictRateLimiter.entries()) {\n      const result = limiter.consume();\n      if (result.remaining === 9) {\n        strictRateLimiter.delete(ip);\n      }\n    }\n  }, RATE_LIMIT_CLEANUP_INTERVAL);\n\n  const strictRateLimitMiddleware = createMiddleware(async (c, next) => {\n    const clientIp = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()\n      ?? c.req.header('x-real-ip')\n      ?? 'unknown';\n\n    let limiter = strictRateLimiter.get(clientIp);\n    if (!limiter) {\n      limiter = createFixedWindowRateLimiter({ maxRequests: 10, windowMs: 60_000 });\n      strictRateLimiter.set(clientIp, limiter);\n    }\n\n    const result = limiter.consume();\n    if (!result.allowed) {\n      log.warn({ clientIp, retryAfterMs: result.retryAfterMs }, 'Rate limit exceeded');\n      c.header('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));\n      return c.json({ error: 'Too many requests' }, 429);\n    }\n\n    c.header('X-RateLimit-Remaining', String(result.remaining));\n    await next();\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error({ err }, 'Hono error');\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;aAOqD;AAcrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;CACzD,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,QAAQ,cAAc,QAAQ,QAAQ;CAC1D,MAAM,aAAa,0BAA0B;EAC3C,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC7D,CAAC;CAEF,MAAM,eAAe;EACnB,QAAQ;EACR,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT;AAED,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,QAAQ,CAAC;AACjB,KAAI,IAAI,KAAK,aAAa,CAAC;CAG3B,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,iBAAiB,MAAM,QAAQ,WAAW,GAAG,aAAa,CAAC,WAAW;CAC5E,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,OAEH,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA;GACA;GACA,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IAAE;IAAQ,QAAQ,YAAY,SAAS,OAAO,SAAS;IAAW,MAAM,EAAE,IAAI;IAAM,EACpF,8BACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QACR,IAAI,KAAK;IAAE,OAAO;IAA0B,SAAS,GAAG,UAAU;IAAK,EAAE,IAAI;GAChF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;CAEnC,MAAM,oCAAoB,IAAI,KAA8D;AAG5F,mBAAkB;AAChB,OAAK,MAAM,CAAC,IAAI,YAAY,kBAAkB,SAAS,CAErD,KADe,QAAQ,SACb,CAAC,cAAc,EACvB,mBAAkB,OAAO,GAAG;IALE,MAAS,IAQd;AA6B/B,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BA7BgC,iBAAiB,OAAO,GAAG,SAAS;GACpE,MAAM,WAAW,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAClE,EAAE,IAAI,OAAO,YAAY,IACzB;GAEL,IAAI,UAAU,kBAAkB,IAAI,SAAS;AAC7C,OAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B;KAAE,aAAa;KAAI,UAAU;KAAQ,CAAC;AAC7E,sBAAkB,IAAI,UAAU,QAAQ;;GAG1C,MAAM,SAAS,QAAQ,SAAS;AAChC,OAAI,CAAC,OAAO,SAAS;AACnB,QAAI,KAAK;KAAE;KAAU,cAAc,OAAO;KAAc,EAAE,sBAAsB;AAChF,MAAE,OAAO,eAAe,OAAO,KAAK,KAAK,OAAO,eAAe,IAAK,CAAC,CAAC;AACtE,WAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;AAGpD,KAAE,OAAO,yBAAyB,OAAO,OAAO,UAAU,CAAC;AAC3D,SAAM,MAAM;IAUa;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;AAEF,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;AAClB,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MAAM,EAAE,KAAK,EAAE,aAAa;AAChC,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}
+{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createFixedWindowRateLimiter } from '../../infra/rate-limit.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n    });\n\n  app.use(logContextMiddleware());\n  app.use(logger());\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        { origin, reason: 'reason' in result ? result.reason : 'unknown', path: c.req.path },\n        'Browser origin check failed',\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) =>\n        ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413),\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimiter = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\n  const RATE_LIMIT_CLEANUP_INTERVAL = 5 * 60 * 1000;\n  setInterval(() => {\n    for (const [ip, limiter] of strictRateLimiter.entries()) {\n      const result = limiter.consume();\n      if (result.remaining === 9) {\n        strictRateLimiter.delete(ip);\n      }\n    }\n  }, RATE_LIMIT_CLEANUP_INTERVAL);\n\n  const strictRateLimitMiddleware = createMiddleware(async (c, next) => {\n    const clientIp = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()\n      ?? c.req.header('x-real-ip')\n      ?? 'unknown';\n\n    let limiter = strictRateLimiter.get(clientIp);\n    if (!limiter) {\n      limiter = createFixedWindowRateLimiter({ maxRequests: 10, windowMs: 60_000 });\n      strictRateLimiter.set(clientIp, limiter);\n    }\n\n    const result = limiter.consume();\n    if (!result.allowed) {\n      log.warn({ clientIp, retryAfterMs: result.retryAfterMs }, 'Rate limit exceeded');\n      c.header('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));\n      return c.json({ error: 'Too many requests' }, 429);\n    }\n\n    c.header('X-RateLimit-Remaining', String(result.remaining));\n    await next();\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error({ err }, 'Hono error');\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;aAOqD;AAcrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;CACzD,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACrC,CAAC;AAEJ,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,QAAQ,CAAC;AACjB,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IAAE;IAAQ,QAAQ,YAAY,SAAS,OAAO,SAAS;IAAW,MAAM,EAAE,IAAI;IAAM,EACpF,8BACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QACR,IAAI,KAAK;IAAE,OAAO;IAA0B,SAAS,GAAG,UAAU;IAAK,EAAE,IAAI;GAChF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;CAEnC,MAAM,oCAAoB,IAAI,KAA8D;AAG5F,mBAAkB;AAChB,OAAK,MAAM,CAAC,IAAI,YAAY,kBAAkB,SAAS,CAErD,KADe,QAAQ,SACb,CAAC,cAAc,EACvB,mBAAkB,OAAO,GAAG;IALE,MAAS,IAQd;AA6B/B,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BA7BgC,iBAAiB,OAAO,GAAG,SAAS;GACpE,MAAM,WAAW,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAClE,EAAE,IAAI,OAAO,YAAY,IACzB;GAEL,IAAI,UAAU,kBAAkB,IAAI,SAAS;AAC7C,OAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B;KAAE,aAAa;KAAI,UAAU;KAAQ,CAAC;AAC7E,sBAAkB,IAAI,UAAU,QAAQ;;GAG1C,MAAM,SAAS,QAAQ,SAAS;AAChC,OAAI,CAAC,OAAO,SAAS;AACnB,QAAI,KAAK;KAAE;KAAU,cAAc,OAAO;KAAc,EAAE,sBAAsB;AAChF,MAAE,OAAO,eAAe,OAAO,KAAK,KAAK,OAAO,eAAe,IAAK,CAAC,CAAC;AACtE,WAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;AAGpD,KAAE,OAAO,yBAAyB,OAAO,OAAO,UAAU,CAAC;AAC3D,SAAM,MAAM;IAUa;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;AAEF,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;AAClB,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MAAM,EAAE,KAAK,EAAE,aAAa;AAChC,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -270,7 +270,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService): Prom
             version: string;
             acceptedAt: string;
         };
-        e2e: import("../../../tunnel/tunnel-e2e-config.js").ResolvedTunnelE2eConfig;
+        transport: {
+            tls: "broker_terminated";
+        };
     };
     update: {
         checkOnStart: boolean;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -6,7 +6,6 @@ import { listChannelPlugins, syncChannelPluginsFromManager } from "../../../chan
 import { resolveCronConfigForWeb, resolveGoalsConfigForWeb, resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { resolveTunnelE2eConfig } from "../../../tunnel/tunnel-e2e-config.js";
 import { agentImageGenerationModelAutoProviderFallback, agentImageGenerationModelTimeoutMs, agentModelFallbacksToArray, agentModelRefToString } from "./agent-model.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
@@ -182,7 +181,7 @@ async function buildSafeWebConfigPayload(service) {
 				version: config.tunnel.consent.version,
 				acceptedAt: config.tunnel.consent.acceptedAt
 			} : void 0,
-			e2e: resolveTunnelE2eConfig(config.tunnel, config.gateway?.port ?? 18790)
+			transport: { tls: "broker_terminated" }
 		},
 		update: { ...resolveUpdateConfigForWeb(config) },
 		stt: maskSttConfigForWeb(config.tools?.media?.audio),

package/dist/src/gateway/hono/lib/config-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-payload.js","names":[],"sources":["../../../../../src/gateway/hono/lib/config-payload.ts"],"sourcesContent":["import {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport {\n  listChannelPlugins,\n  syncChannelPluginsFromManager,\n} from '../../../channels/plugins/registry.js';\nimport { normalizeConfiguredMcpServers } from '../../../config/mcp-config-normalize.js';\nimport type { Config } from '../../../config/schema.js';\nimport { maskTunnelSecretForWeb } from '../../../tunnel/env.js';\nimport { resolveTunnelE2eConfig } from '../../../tunnel/tunnel-e2e-config.js';\nimport { resolveShareConfig } from '../../../share/share-config.js';\nimport {\n  resolveCronConfigForWeb,\n  resolveGoalsConfigForWeb,\n  resolveSessionConfigForWeb,\n  resolveUpdateConfigForWeb,\n} from '../../../config/web-patch.js';\nimport { bundledChannelPlugins } from '../../../generated/bundled-channel-plugins.js';\nimport { getAllProviders, isProviderConfigured } from '../../../providers/index.js';\nimport type { GatewayService } from '../../service.js';\nimport { safeToolsWebForGet } from '../../config-tools-web.js';\nimport {\n  agentImageGenerationModelAutoProviderFallback,\n  agentImageGenerationModelTimeoutMs,\n  agentModelFallbacksToArray,\n  agentModelRefToString,\n} from './agent-model.js';\nimport { buildSafeProvidersConfigForWeb } from './safe-providers-config.js';\nimport { maskSttConfigForWeb, maskTtsConfigForWeb } from './safe-voice-config.js';\n\n/** MCP block for GET/PATCH `/api/config` (authenticated console editing). */\nexport function buildSafeMcpConfigForWeb(config: Config) {\n  const mcp = config.mcp;\n  if (!mcp) {\n    return { servers: {} as Record<string, Record<string, unknown>> };\n  }\n  return {\n    ...(mcp.sessionIdleTtlMs !== undefined ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {}),\n    servers: normalizeConfiguredMcpServers(mcp.servers),\n  };\n}\n\nfunction maskBrowserCloudConfigForWeb(cloud: unknown): Record<string, unknown> | null {\n  if (!cloud || typeof cloud !== 'object' || Array.isArray(cloud)) {\n    return null;\n  }\n  const raw = cloud as Record<string, unknown>;\n  const safe: Record<string, unknown> = {};\n  if (typeof raw.apiKey === 'string' && raw.apiKey.trim()) {\n    safe.apiKey = '***';\n  }\n  if (typeof raw.projectId === 'string' && raw.projectId.trim()) {\n    safe.projectId = raw.projectId.trim();\n  }\n  if (typeof raw.region === 'string' && raw.region.trim()) {\n    safe.region = raw.region.trim();\n  }\n  return Object.keys(safe).length > 0 ? safe : null;\n}\n\nexport function buildSafeBrowserConfigForWeb(browser: Config['agents']['defaults']['browser'] | undefined) {\n  if (!browser || typeof browser !== 'object') {\n    return {\n      enabled: false,\n      headless: false,\n      allowPrivateUrls: false,\n      commandTimeout: null,\n      backend: null,\n      cloudProvider: null,\n      cloud: null,\n      cdpUrl: null,\n      extension: null,\n      cloakbrowser: null,\n      humanize: null,\n      humanPreset: null,\n      dialogPolicy: null,\n      dialogTimeoutSeconds: null,\n    };\n  }\n\n  return {\n    enabled: browser.enabled === true,\n    headless: browser.headless === true,\n    allowPrivateUrls: browser.allowPrivateUrls === true,\n    commandTimeout:\n      typeof browser.commandTimeout === 'number' && Number.isFinite(browser.commandTimeout)\n        ? Math.floor(browser.commandTimeout)\n        : null,\n    backend:\n      browser.backend === 'cdp' ||\n      browser.backend === 'cloud' ||\n      browser.backend === 'extension' ||\n      browser.backend === 'cloakbrowser'\n        ? browser.backend\n        : null,\n    cloudProvider:\n      browser.cloudProvider === 'browserbase' || browser.cloudProvider === 'browser-use'\n        ? browser.cloudProvider\n        : null,\n    cloud: maskBrowserCloudConfigForWeb(browser.cloud),\n    cdpUrl: typeof browser.cdpUrl === 'string' && browser.cdpUrl.trim() ? browser.cdpUrl.trim() : null,\n    extension: browser.extension && typeof browser.extension === 'object' && !Array.isArray(browser.extension)\n      ? browser.extension\n      : null,\n    cloakbrowser:\n      browser.cloakbrowser && typeof browser.cloakbrowser === 'object' && !Array.isArray(browser.cloakbrowser)\n        ? browser.cloakbrowser\n        : null,\n    humanize: typeof browser.humanize === 'boolean' ? browser.humanize : null,\n    humanPreset: browser.humanPreset === 'default' || browser.humanPreset === 'careful' ? browser.humanPreset : null,\n    dialogPolicy:\n      browser.dialogPolicy === 'must_respond' ||\n      browser.dialogPolicy === 'auto_accept' ||\n      browser.dialogPolicy === 'auto_dismiss'\n        ? browser.dialogPolicy\n        : null,\n    dialogTimeoutSeconds:\n      typeof browser.dialogTimeoutSeconds === 'number' && Number.isFinite(browser.dialogTimeoutSeconds)\n        ? Math.floor(browser.dialogTimeoutSeconds)\n        : null,\n  };\n}\n\n/** Sanitized config snapshot for GET/PATCH `/api/config` (matches persisted `service.currentConfig`). */\nexport async function buildSafeWebConfigPayload(service: GatewayService) {\n  const config = service.currentConfig;\n  if (listChannelPlugins().length === 0) {\n    syncChannelPluginsFromManager(bundledChannelPlugins);\n  }\n  const channelsPayload = Object.fromEntries(\n    listChannelPlugins().map((plugin) => {\n      if (plugin.configSurface) {\n        return [plugin.id, plugin.configSurface.buildConfigSurface(config)];\n      }\n      const channelCfg = config.channels?.[plugin.id] as Record<string, unknown> | undefined;\n      return [\n        plugin.id,\n        {\n          enabled: channelCfg?.enabled ?? false,\n          configured: plugin.config.listAccountIds(config).length > 0,\n        },\n      ];\n    }),\n  );\n  return {\n    agents: {\n      defaultId: resolveDefaultAgentId(config),\n      list: listAgentEntries(config)\n        .filter((e) => e.enabled !== false)\n        .map((e) => ({\n          id: normalizeAgentId(e.id),\n          ...(typeof e.name === 'string' && e.name.trim() ? { name: e.name.trim() } : {}),\n        })),\n      defaults: {\n        model: agentModelRefToString(config.agents?.defaults?.model) ?? '',\n        modelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.model),\n        imageModel: agentModelRefToString(config.agents?.defaults?.imageModel) ?? null,\n        imageModelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.imageModel),\n        imageGenerationModel: agentModelRefToString(config.agents?.defaults?.imageGenerationModel) ?? null,\n        imageGenerationModelFallbacks: agentModelFallbacksToArray(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelTimeoutMs: agentImageGenerationModelTimeoutMs(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelAutoProviderFallback: agentImageGenerationModelAutoProviderFallback(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        mediaMaxMb: config.agents?.defaults?.mediaMaxMb,\n        maxTokens: config.agents?.defaults?.maxTokens,\n        temperature: config.agents?.defaults?.temperature,\n        maxToolIterations: config.agents?.defaults?.maxToolIterations,\n        workspace: config.agents?.defaults?.workspace,\n        thinkingDefault: config.agents?.defaults?.thinkingDefault,\n        reasoningDefault: config.agents?.defaults?.reasoningDefault,\n        verboseDefault: config.agents?.defaults?.verboseDefault,\n        browser: buildSafeBrowserConfigForWeb(config.agents?.defaults?.browser),\n        maxTaskDurationMs: config.agents?.defaults?.maxTaskDurationMs,\n        maxRequestsPerTurn: config.agents?.defaults?.maxRequestsPerTurn,\n        maxToolFailuresPerTurn: config.agents?.defaults?.maxToolFailuresPerTurn,\n        compaction: config.agents?.defaults?.compaction,\n        pruning: config.agents?.defaults?.pruning,\n        memory: config.agents?.defaults?.memory,\n        sessionSearch: config.agents?.defaults?.sessionSearch,\n        backgroundReview: config.agents?.defaults?.backgroundReview,\n        webExtract: config.agents?.defaults?.webExtract,\n        delegate: config.agents?.defaults?.delegate,\n        executeCode: config.agents?.defaults?.executeCode,\n        systemPromptOverride: config.agents?.defaults?.systemPromptOverride,\n        skills: config.agents?.defaults?.skills,\n        tools: config.agents?.defaults?.tools,\n        params: config.agents?.defaults?.params,\n      },\n    },\n    channels: channelsPayload,\n    providers: Object.fromEntries(\n      await Promise.all(\n        getAllProviders().map(async (provider) => [\n          provider,\n          (await isProviderConfigured(provider)) ? '***' : '',\n        ]),\n      ),\n    ),\n    /** Masked `cfg.providers` for capability keys (image / STT / etc.). */\n    providersConfig: buildSafeProvidersConfigForWeb(config.providers),\n    gateway: {\n      bind: config.gateway?.bind ?? 'loopback',\n      customBindHost: config.gateway?.customBindHost,\n      port: config.gateway?.port,\n      corsOrigins: Array.isArray(config.gateway?.corsOrigins) ? config.gateway.corsOrigins : [],\n      trustedProxies: Array.isArray(config.gateway?.trustedProxies)\n        ? config.gateway.trustedProxies\n        : [],\n      allowRealIpFallback: config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback:\n        config.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n      security: {\n        strict: config.gateway?.security?.strict === true,\n      },\n      auth: {\n        mode: config.gateway?.auth?.mode || 'token',\n        token: config.gateway?.auth?.token || '',\n        password: config.gateway?.auth?.password ? '••••••••••••' : '',\n        trustedProxy: config.gateway?.auth?.trustedProxy\n          ? {\n              userHeader: config.gateway.auth.trustedProxy.userHeader,\n              requiredHeaders: config.gateway.auth.trustedProxy.requiredHeaders ?? [],\n              allowUsers: config.gateway.auth.trustedProxy.allowUsers ?? [],\n              allowLoopback: config.gateway.auth.trustedProxy.allowLoopback === true,\n            }\n          : undefined,\n        rateLimit: {\n          enabled: config.gateway?.auth?.rateLimit?.enabled !== false,\n          maxAttempts:\n            typeof config.gateway?.auth?.rateLimit?.maxAttempts === 'number'\n              ? config.gateway.auth.rateLimit.maxAttempts\n              : 5,\n          windowMs:\n            typeof config.gateway?.auth?.rateLimit?.windowMs === 'number'\n              ? config.gateway.auth.rateLimit.windowMs\n              : 900_000,\n          blockDurationMs:\n            typeof config.gateway?.auth?.rateLimit?.blockDurationMs === 'number'\n              ? config.gateway.auth.rateLimit.blockDurationMs\n              : typeof config.gateway?.auth?.rateLimit?.lockoutMs === 'number'\n                ? config.gateway.auth.rateLimit.lockoutMs\n                : 300_000,\n          exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false,\n        },\n      },\n      heartbeat: {\n        enabled: config.gateway?.heartbeat?.enabled,\n        intervalMs: config.gateway?.heartbeat?.intervalMs,\n        includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,\n        target: config.gateway?.heartbeat?.target,\n        targetChatId: config.gateway?.heartbeat?.targetChatId,\n        prompt: config.gateway?.heartbeat?.prompt,\n        ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,\n        isolatedSession: config.gateway?.heartbeat?.isolatedSession,\n        activeHours: config.gateway?.heartbeat?.activeHours,\n      },\n      maxSseConnections:\n        typeof config.gateway?.maxSseConnections === 'number'\n          ? config.gateway.maxSseConnections\n          : 100,\n      channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? 'auto',\n      channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds)\n        ? config.gateway.channelConnectDeferIds\n        : [],\n      channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds)\n        ? config.gateway.channelConnectDeferSkipIds\n        : [],\n      share: resolveShareConfig(config.gateway?.share),\n      skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? 'skillhub',\n      skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? 'https://store.xopc.ai',\n    },\n    cron: resolveCronConfigForWeb(config),\n    goals: resolveGoalsConfigForWeb(config),\n    session: resolveSessionConfigForWeb(config),\n    tunnel: {\n      enabled: config.tunnel?.enabled === true,\n      autoStart: config.tunnel?.autoStart === true,\n      brokerUrl: config.tunnel?.brokerUrl ?? 'https://frp.xopc.ai/api',\n      registrationSecret: config.tunnel?.registrationSecret\n        ? maskTunnelSecretForWeb(config.tunnel.registrationSecret)\n        : '',\n      consent: config.tunnel?.consent\n        ? {\n            version: config.tunnel.consent.version,\n            acceptedAt: config.tunnel.consent.acceptedAt,\n          }\n        : undefined,\n      e2e: resolveTunnelE2eConfig(config.tunnel, config.gateway?.port ?? 18790),\n    },\n    update: {\n      ...resolveUpdateConfigForWeb(config),\n    },\n    stt: maskSttConfigForWeb(config.tools?.media?.audio),\n    tts: maskTtsConfigForWeb(config.messages?.tts),\n    tools: safeToolsWebForGet(config),\n    bindings: Array.isArray(config.bindings) ? config.bindings : [],\n    mcp: buildSafeMcpConfigForWeb(config),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;kBAIuC;gBAiB6C;;AAapF,SAAgB,yBAAyB,QAAgB;CACvD,MAAM,MAAM,OAAO;AACnB,KAAI,CAAC,IACH,QAAO,EAAE,SAAS,EAAE,EAA6C;AAEnE,QAAO;EACL,GAAI,IAAI,qBAAqB,KAAA,IAAY,EAAE,kBAAkB,IAAI,kBAAkB,GAAG,EAAE;EACxF,SAAS,8BAA8B,IAAI,QAAQ;EACpD;;AAGH,SAAS,6BAA6B,OAAgD;AACpF,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;CAET,MAAM,MAAM;CACZ,MAAM,OAAgC,EAAE;AACxC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS;AAEhB,KAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,MAAM,CAC3D,MAAK,YAAY,IAAI,UAAU,MAAM;AAEvC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,IAAI,OAAO,MAAM;AAEjC,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;;AAG/C,SAAgB,6BAA6B,SAA8D;AACzG,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO;EACL,SAAS;EACT,UAAU;EACV,kBAAkB;EAClB,gBAAgB;EAChB,SAAS;EACT,eAAe;EACf,OAAO;EACP,QAAQ;EACR,WAAW;EACX,cAAc;EACd,UAAU;EACV,aAAa;EACb,cAAc;EACd,sBAAsB;EACvB;AAGH,QAAO;EACL,SAAS,QAAQ,YAAY;EAC7B,UAAU,QAAQ,aAAa;EAC/B,kBAAkB,QAAQ,qBAAqB;EAC/C,gBACE,OAAO,QAAQ,mBAAmB,YAAY,OAAO,SAAS,QAAQ,eAAe,GACjF,KAAK,MAAM,QAAQ,eAAe,GAClC;EACN,SACE,QAAQ,YAAY,SACpB,QAAQ,YAAY,WACpB,QAAQ,YAAY,eACpB,QAAQ,YAAY,iBAChB,QAAQ,UACR;EACN,eACE,QAAQ,kBAAkB,iBAAiB,QAAQ,kBAAkB,gBACjE,QAAQ,gBACR;EACN,OAAO,6BAA6B,QAAQ,MAAM;EAClD,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,GAAG;EAC9F,WAAW,QAAQ,aAAa,OAAO,QAAQ,cAAc,YAAY,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACtG,QAAQ,YACR;EACJ,cACE,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,YAAY,CAAC,MAAM,QAAQ,QAAQ,aAAa,GACpG,QAAQ,eACR;EACN,UAAU,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW;EACrE,aAAa,QAAQ,gBAAgB,aAAa,QAAQ,gBAAgB,YAAY,QAAQ,cAAc;EAC5G,cACE,QAAQ,iBAAiB,kBACzB,QAAQ,iBAAiB,iBACzB,QAAQ,iBAAiB,iBACrB,QAAQ,eACR;EACN,sBACE,OAAO,QAAQ,yBAAyB,YAAY,OAAO,SAAS,QAAQ,qBAAqB,GAC7F,KAAK,MAAM,QAAQ,qBAAqB,GACxC;EACP;;;AAIH,eAAsB,0BAA0B,SAAyB;CACvE,MAAM,SAAS,QAAQ;AACvB,KAAI,oBAAoB,CAAC,WAAW,EAClC,+BAA8B,sBAAsB;CAEtD,MAAM,kBAAkB,OAAO,YAC7B,oBAAoB,CAAC,KAAK,WAAW;AACnC,MAAI,OAAO,cACT,QAAO,CAAC,OAAO,IAAI,OAAO,cAAc,mBAAmB,OAAO,CAAC;EAErE,MAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,SAAO,CACL,OAAO,IACP;GACE,SAAS,YAAY,WAAW;GAChC,YAAY,OAAO,OAAO,eAAe,OAAO,CAAC,SAAS;GAC3D,CACF;GACD,CACH;AACD,QAAO;EACL,QAAQ;GACN,WAAW,sBAAsB,OAAO;GACxC,MAAM,iBAAiB,OAAO,CAC3B,QAAQ,MAAM,EAAE,YAAY,MAAM,CAClC,KAAK,OAAO;IACX,IAAI,iBAAiB,EAAE,GAAG;IAC1B,GAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,EAAE;IAC/E,EAAE;GACL,UAAU;IACR,OAAO,sBAAsB,OAAO,QAAQ,UAAU,MAAM,IAAI;IAChE,gBAAgB,2BAA2B,OAAO,QAAQ,UAAU,MAAM;IAC1E,YAAY,sBAAsB,OAAO,QAAQ,UAAU,WAAW,IAAI;IAC1E,qBAAqB,2BAA2B,OAAO,QAAQ,UAAU,WAAW;IACpF,sBAAsB,sBAAsB,OAAO,QAAQ,UAAU,qBAAqB,IAAI;IAC9F,+BAA+B,2BAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,+BAA+B,mCAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,0CAA0C,8CACxC,OAAO,QAAQ,UAAU,qBAC1B;IACD,YAAY,OAAO,QAAQ,UAAU;IACrC,WAAW,OAAO,QAAQ,UAAU;IACpC,aAAa,OAAO,QAAQ,UAAU;IACtC,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,WAAW,OAAO,QAAQ,UAAU;IACpC,iBAAiB,OAAO,QAAQ,UAAU;IAC1C,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,gBAAgB,OAAO,QAAQ,UAAU;IACzC,SAAS,6BAA6B,OAAO,QAAQ,UAAU,QAAQ;IACvE,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,oBAAoB,OAAO,QAAQ,UAAU;IAC7C,wBAAwB,OAAO,QAAQ,UAAU;IACjD,YAAY,OAAO,QAAQ,UAAU;IACrC,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,QAAQ,UAAU;IACjC,eAAe,OAAO,QAAQ,UAAU;IACxC,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,YAAY,OAAO,QAAQ,UAAU;IACrC,UAAU,OAAO,QAAQ,UAAU;IACnC,aAAa,OAAO,QAAQ,UAAU;IACtC,sBAAsB,OAAO,QAAQ,UAAU;IAC/C,QAAQ,OAAO,QAAQ,UAAU;IACjC,OAAO,OAAO,QAAQ,UAAU;IAChC,QAAQ,OAAO,QAAQ,UAAU;IAClC;GACF;EACD,UAAU;EACV,WAAW,OAAO,YAChB,MAAM,QAAQ,IACZ,iBAAiB,CAAC,IAAI,OAAO,aAAa,CACxC,UACC,MAAM,qBAAqB,SAAS,GAAI,QAAQ,GAClD,CAAC,CACH,CACF;;EAED,iBAAiB,+BAA+B,OAAO,UAAU;EACjE,SAAS;GACP,MAAM,OAAO,SAAS,QAAQ;GAC9B,gBAAgB,OAAO,SAAS;GAChC,MAAM,OAAO,SAAS;GACtB,aAAa,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,OAAO,QAAQ,cAAc,EAAE;GACzF,gBAAgB,MAAM,QAAQ,OAAO,SAAS,eAAe,GACzD,OAAO,QAAQ,iBACf,EAAE;GACN,qBAAqB,OAAO,SAAS,wBAAwB;GAC7D,0CACE,OAAO,SAAS,6CAA6C;GAC/D,UAAU,EACR,QAAQ,OAAO,SAAS,UAAU,WAAW,MAC9C;GACD,MAAM;IACJ,MAAM,OAAO,SAAS,MAAM,QAAQ;IACpC,OAAO,OAAO,SAAS,MAAM,SAAS;IACtC,UAAU,OAAO,SAAS,MAAM,WAAW,iBAAiB;IAC5D,cAAc,OAAO,SAAS,MAAM,eAChC;KACE,YAAY,OAAO,QAAQ,KAAK,aAAa;KAC7C,iBAAiB,OAAO,QAAQ,KAAK,aAAa,mBAAmB,EAAE;KACvE,YAAY,OAAO,QAAQ,KAAK,aAAa,cAAc,EAAE;KAC7D,eAAe,OAAO,QAAQ,KAAK,aAAa,kBAAkB;KACnE,GACD,KAAA;IACJ,WAAW;KACT,SAAS,OAAO,SAAS,MAAM,WAAW,YAAY;KACtD,aACE,OAAO,OAAO,SAAS,MAAM,WAAW,gBAAgB,WACpD,OAAO,QAAQ,KAAK,UAAU,cAC9B;KACN,UACE,OAAO,OAAO,SAAS,MAAM,WAAW,aAAa,WACjD,OAAO,QAAQ,KAAK,UAAU,WAC9B;KACN,iBACE,OAAO,OAAO,SAAS,MAAM,WAAW,oBAAoB,WACxD,OAAO,QAAQ,KAAK,UAAU,kBAC9B,OAAO,OAAO,SAAS,MAAM,WAAW,cAAc,WACpD,OAAO,QAAQ,KAAK,UAAU,YAC9B;KACR,gBAAgB,OAAO,SAAS,MAAM,WAAW,mBAAmB;KACrE;IACF;GACD,WAAW;IACT,SAAS,OAAO,SAAS,WAAW;IACpC,YAAY,OAAO,SAAS,WAAW;IACvC,4BAA4B,OAAO,SAAS,WAAW,+BAA+B;IACtF,QAAQ,OAAO,SAAS,WAAW;IACnC,cAAc,OAAO,SAAS,WAAW;IACzC,QAAQ,OAAO,SAAS,WAAW;IACnC,aAAa,OAAO,SAAS,WAAW;IACxC,iBAAiB,OAAO,SAAS,WAAW;IAC5C,aAAa,OAAO,SAAS,WAAW;IACzC;GACD,mBACE,OAAO,OAAO,SAAS,sBAAsB,WACzC,OAAO,QAAQ,oBACf;GACN,yBAAyB,OAAO,SAAS,2BAA2B;GACpE,wBAAwB,MAAM,QAAQ,OAAO,SAAS,uBAAuB,GACzE,OAAO,QAAQ,yBACf,EAAE;GACN,4BAA4B,MAAM,QAAQ,OAAO,SAAS,2BAA2B,GACjF,OAAO,QAAQ,6BACf,EAAE;GACN,OAAO,mBAAmB,OAAO,SAAS,MAAM;GAChD,2BAA2B,OAAO,SAAS,6BAA6B;GACxE,oBAAoB,OAAO,SAAS,sBAAsB;GAC3D;EACD,MAAM,wBAAwB,OAAO;EACrC,OAAO,yBAAyB,OAAO;EACvC,SAAS,2BAA2B,OAAO;EAC3C,QAAQ;GACN,SAAS,OAAO,QAAQ,YAAY;GACpC,WAAW,OAAO,QAAQ,cAAc;GACxC,WAAW,OAAO,QAAQ,aAAa;GACvC,oBAAoB,OAAO,QAAQ,qBAC/B,uBAAuB,OAAO,OAAO,mBAAmB,GACxD;GACJ,SAAS,OAAO,QAAQ,UACpB;IACE,SAAS,OAAO,OAAO,QAAQ;IAC/B,YAAY,OAAO,OAAO,QAAQ;IACnC,GACD,KAAA;GACJ,KAAK,uBAAuB,OAAO,QAAQ,OAAO,SAAS,QAAQ,MAAM;GAC1E;EACD,QAAQ,EACN,GAAG,0BAA0B,OAAO,EACrC;EACD,KAAK,oBAAoB,OAAO,OAAO,OAAO,MAAM;EACpD,KAAK,oBAAoB,OAAO,UAAU,IAAI;EAC9C,OAAO,mBAAmB,OAAO;EACjC,UAAU,MAAM,QAAQ,OAAO,SAAS,GAAG,OAAO,WAAW,EAAE;EAC/D,KAAK,yBAAyB,OAAO;EACtC"}
+{"version":3,"file":"config-payload.js","names":[],"sources":["../../../../../src/gateway/hono/lib/config-payload.ts"],"sourcesContent":["import {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport {\n  listChannelPlugins,\n  syncChannelPluginsFromManager,\n} from '../../../channels/plugins/registry.js';\nimport { normalizeConfiguredMcpServers } from '../../../config/mcp-config-normalize.js';\nimport type { Config } from '../../../config/schema.js';\nimport { maskTunnelSecretForWeb } from '../../../tunnel/env.js';\nimport { resolveShareConfig } from '../../../share/share-config.js';\nimport {\n  resolveCronConfigForWeb,\n  resolveGoalsConfigForWeb,\n  resolveSessionConfigForWeb,\n  resolveUpdateConfigForWeb,\n} from '../../../config/web-patch.js';\nimport { bundledChannelPlugins } from '../../../generated/bundled-channel-plugins.js';\nimport { getAllProviders, isProviderConfigured } from '../../../providers/index.js';\nimport type { GatewayService } from '../../service.js';\nimport { safeToolsWebForGet } from '../../config-tools-web.js';\nimport {\n  agentImageGenerationModelAutoProviderFallback,\n  agentImageGenerationModelTimeoutMs,\n  agentModelFallbacksToArray,\n  agentModelRefToString,\n} from './agent-model.js';\nimport { buildSafeProvidersConfigForWeb } from './safe-providers-config.js';\nimport { maskSttConfigForWeb, maskTtsConfigForWeb } from './safe-voice-config.js';\n\n/** MCP block for GET/PATCH `/api/config` (authenticated console editing). */\nexport function buildSafeMcpConfigForWeb(config: Config) {\n  const mcp = config.mcp;\n  if (!mcp) {\n    return { servers: {} as Record<string, Record<string, unknown>> };\n  }\n  return {\n    ...(mcp.sessionIdleTtlMs !== undefined ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {}),\n    servers: normalizeConfiguredMcpServers(mcp.servers),\n  };\n}\n\nfunction maskBrowserCloudConfigForWeb(cloud: unknown): Record<string, unknown> | null {\n  if (!cloud || typeof cloud !== 'object' || Array.isArray(cloud)) {\n    return null;\n  }\n  const raw = cloud as Record<string, unknown>;\n  const safe: Record<string, unknown> = {};\n  if (typeof raw.apiKey === 'string' && raw.apiKey.trim()) {\n    safe.apiKey = '***';\n  }\n  if (typeof raw.projectId === 'string' && raw.projectId.trim()) {\n    safe.projectId = raw.projectId.trim();\n  }\n  if (typeof raw.region === 'string' && raw.region.trim()) {\n    safe.region = raw.region.trim();\n  }\n  return Object.keys(safe).length > 0 ? safe : null;\n}\n\nexport function buildSafeBrowserConfigForWeb(browser: Config['agents']['defaults']['browser'] | undefined) {\n  if (!browser || typeof browser !== 'object') {\n    return {\n      enabled: false,\n      headless: false,\n      allowPrivateUrls: false,\n      commandTimeout: null,\n      backend: null,\n      cloudProvider: null,\n      cloud: null,\n      cdpUrl: null,\n      extension: null,\n      cloakbrowser: null,\n      humanize: null,\n      humanPreset: null,\n      dialogPolicy: null,\n      dialogTimeoutSeconds: null,\n    };\n  }\n\n  return {\n    enabled: browser.enabled === true,\n    headless: browser.headless === true,\n    allowPrivateUrls: browser.allowPrivateUrls === true,\n    commandTimeout:\n      typeof browser.commandTimeout === 'number' && Number.isFinite(browser.commandTimeout)\n        ? Math.floor(browser.commandTimeout)\n        : null,\n    backend:\n      browser.backend === 'cdp' ||\n      browser.backend === 'cloud' ||\n      browser.backend === 'extension' ||\n      browser.backend === 'cloakbrowser'\n        ? browser.backend\n        : null,\n    cloudProvider:\n      browser.cloudProvider === 'browserbase' || browser.cloudProvider === 'browser-use'\n        ? browser.cloudProvider\n        : null,\n    cloud: maskBrowserCloudConfigForWeb(browser.cloud),\n    cdpUrl: typeof browser.cdpUrl === 'string' && browser.cdpUrl.trim() ? browser.cdpUrl.trim() : null,\n    extension: browser.extension && typeof browser.extension === 'object' && !Array.isArray(browser.extension)\n      ? browser.extension\n      : null,\n    cloakbrowser:\n      browser.cloakbrowser && typeof browser.cloakbrowser === 'object' && !Array.isArray(browser.cloakbrowser)\n        ? browser.cloakbrowser\n        : null,\n    humanize: typeof browser.humanize === 'boolean' ? browser.humanize : null,\n    humanPreset: browser.humanPreset === 'default' || browser.humanPreset === 'careful' ? browser.humanPreset : null,\n    dialogPolicy:\n      browser.dialogPolicy === 'must_respond' ||\n      browser.dialogPolicy === 'auto_accept' ||\n      browser.dialogPolicy === 'auto_dismiss'\n        ? browser.dialogPolicy\n        : null,\n    dialogTimeoutSeconds:\n      typeof browser.dialogTimeoutSeconds === 'number' && Number.isFinite(browser.dialogTimeoutSeconds)\n        ? Math.floor(browser.dialogTimeoutSeconds)\n        : null,\n  };\n}\n\n/** Sanitized config snapshot for GET/PATCH `/api/config` (matches persisted `service.currentConfig`). */\nexport async function buildSafeWebConfigPayload(service: GatewayService) {\n  const config = service.currentConfig;\n  if (listChannelPlugins().length === 0) {\n    syncChannelPluginsFromManager(bundledChannelPlugins);\n  }\n  const channelsPayload = Object.fromEntries(\n    listChannelPlugins().map((plugin) => {\n      if (plugin.configSurface) {\n        return [plugin.id, plugin.configSurface.buildConfigSurface(config)];\n      }\n      const channelCfg = config.channels?.[plugin.id] as Record<string, unknown> | undefined;\n      return [\n        plugin.id,\n        {\n          enabled: channelCfg?.enabled ?? false,\n          configured: plugin.config.listAccountIds(config).length > 0,\n        },\n      ];\n    }),\n  );\n  return {\n    agents: {\n      defaultId: resolveDefaultAgentId(config),\n      list: listAgentEntries(config)\n        .filter((e) => e.enabled !== false)\n        .map((e) => ({\n          id: normalizeAgentId(e.id),\n          ...(typeof e.name === 'string' && e.name.trim() ? { name: e.name.trim() } : {}),\n        })),\n      defaults: {\n        model: agentModelRefToString(config.agents?.defaults?.model) ?? '',\n        modelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.model),\n        imageModel: agentModelRefToString(config.agents?.defaults?.imageModel) ?? null,\n        imageModelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.imageModel),\n        imageGenerationModel: agentModelRefToString(config.agents?.defaults?.imageGenerationModel) ?? null,\n        imageGenerationModelFallbacks: agentModelFallbacksToArray(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelTimeoutMs: agentImageGenerationModelTimeoutMs(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelAutoProviderFallback: agentImageGenerationModelAutoProviderFallback(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        mediaMaxMb: config.agents?.defaults?.mediaMaxMb,\n        maxTokens: config.agents?.defaults?.maxTokens,\n        temperature: config.agents?.defaults?.temperature,\n        maxToolIterations: config.agents?.defaults?.maxToolIterations,\n        workspace: config.agents?.defaults?.workspace,\n        thinkingDefault: config.agents?.defaults?.thinkingDefault,\n        reasoningDefault: config.agents?.defaults?.reasoningDefault,\n        verboseDefault: config.agents?.defaults?.verboseDefault,\n        browser: buildSafeBrowserConfigForWeb(config.agents?.defaults?.browser),\n        maxTaskDurationMs: config.agents?.defaults?.maxTaskDurationMs,\n        maxRequestsPerTurn: config.agents?.defaults?.maxRequestsPerTurn,\n        maxToolFailuresPerTurn: config.agents?.defaults?.maxToolFailuresPerTurn,\n        compaction: config.agents?.defaults?.compaction,\n        pruning: config.agents?.defaults?.pruning,\n        memory: config.agents?.defaults?.memory,\n        sessionSearch: config.agents?.defaults?.sessionSearch,\n        backgroundReview: config.agents?.defaults?.backgroundReview,\n        webExtract: config.agents?.defaults?.webExtract,\n        delegate: config.agents?.defaults?.delegate,\n        executeCode: config.agents?.defaults?.executeCode,\n        systemPromptOverride: config.agents?.defaults?.systemPromptOverride,\n        skills: config.agents?.defaults?.skills,\n        tools: config.agents?.defaults?.tools,\n        params: config.agents?.defaults?.params,\n      },\n    },\n    channels: channelsPayload,\n    providers: Object.fromEntries(\n      await Promise.all(\n        getAllProviders().map(async (provider) => [\n          provider,\n          (await isProviderConfigured(provider)) ? '***' : '',\n        ]),\n      ),\n    ),\n    /** Masked `cfg.providers` for capability keys (image / STT / etc.). */\n    providersConfig: buildSafeProvidersConfigForWeb(config.providers),\n    gateway: {\n      bind: config.gateway?.bind ?? 'loopback',\n      customBindHost: config.gateway?.customBindHost,\n      port: config.gateway?.port,\n      corsOrigins: Array.isArray(config.gateway?.corsOrigins) ? config.gateway.corsOrigins : [],\n      trustedProxies: Array.isArray(config.gateway?.trustedProxies)\n        ? config.gateway.trustedProxies\n        : [],\n      allowRealIpFallback: config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback:\n        config.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n      security: {\n        strict: config.gateway?.security?.strict === true,\n      },\n      auth: {\n        mode: config.gateway?.auth?.mode || 'token',\n        token: config.gateway?.auth?.token || '',\n        password: config.gateway?.auth?.password ? '••••••••••••' : '',\n        trustedProxy: config.gateway?.auth?.trustedProxy\n          ? {\n              userHeader: config.gateway.auth.trustedProxy.userHeader,\n              requiredHeaders: config.gateway.auth.trustedProxy.requiredHeaders ?? [],\n              allowUsers: config.gateway.auth.trustedProxy.allowUsers ?? [],\n              allowLoopback: config.gateway.auth.trustedProxy.allowLoopback === true,\n            }\n          : undefined,\n        rateLimit: {\n          enabled: config.gateway?.auth?.rateLimit?.enabled !== false,\n          maxAttempts:\n            typeof config.gateway?.auth?.rateLimit?.maxAttempts === 'number'\n              ? config.gateway.auth.rateLimit.maxAttempts\n              : 5,\n          windowMs:\n            typeof config.gateway?.auth?.rateLimit?.windowMs === 'number'\n              ? config.gateway.auth.rateLimit.windowMs\n              : 900_000,\n          blockDurationMs:\n            typeof config.gateway?.auth?.rateLimit?.blockDurationMs === 'number'\n              ? config.gateway.auth.rateLimit.blockDurationMs\n              : typeof config.gateway?.auth?.rateLimit?.lockoutMs === 'number'\n                ? config.gateway.auth.rateLimit.lockoutMs\n                : 300_000,\n          exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false,\n        },\n      },\n      heartbeat: {\n        enabled: config.gateway?.heartbeat?.enabled,\n        intervalMs: config.gateway?.heartbeat?.intervalMs,\n        includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,\n        target: config.gateway?.heartbeat?.target,\n        targetChatId: config.gateway?.heartbeat?.targetChatId,\n        prompt: config.gateway?.heartbeat?.prompt,\n        ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,\n        isolatedSession: config.gateway?.heartbeat?.isolatedSession,\n        activeHours: config.gateway?.heartbeat?.activeHours,\n      },\n      maxSseConnections:\n        typeof config.gateway?.maxSseConnections === 'number'\n          ? config.gateway.maxSseConnections\n          : 100,\n      channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? 'auto',\n      channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds)\n        ? config.gateway.channelConnectDeferIds\n        : [],\n      channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds)\n        ? config.gateway.channelConnectDeferSkipIds\n        : [],\n      share: resolveShareConfig(config.gateway?.share),\n      skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? 'skillhub',\n      skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? 'https://store.xopc.ai',\n    },\n    cron: resolveCronConfigForWeb(config),\n    goals: resolveGoalsConfigForWeb(config),\n    session: resolveSessionConfigForWeb(config),\n    tunnel: {\n      enabled: config.tunnel?.enabled === true,\n      autoStart: config.tunnel?.autoStart === true,\n      brokerUrl: config.tunnel?.brokerUrl ?? 'https://frp.xopc.ai/api',\n      registrationSecret: config.tunnel?.registrationSecret\n        ? maskTunnelSecretForWeb(config.tunnel.registrationSecret)\n        : '',\n      consent: config.tunnel?.consent\n        ? {\n            version: config.tunnel.consent.version,\n            acceptedAt: config.tunnel.consent.acceptedAt,\n          }\n        : undefined,\n      transport: { tls: 'broker_terminated' as const },\n    },\n    update: {\n      ...resolveUpdateConfigForWeb(config),\n    },\n    stt: maskSttConfigForWeb(config.tools?.media?.audio),\n    tts: maskTtsConfigForWeb(config.messages?.tts),\n    tools: safeToolsWebForGet(config),\n    bindings: Array.isArray(config.bindings) ? config.bindings : [],\n    mcp: buildSafeMcpConfigForWeb(config),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;kBAIuC;gBAgB6C;;AAapF,SAAgB,yBAAyB,QAAgB;CACvD,MAAM,MAAM,OAAO;AACnB,KAAI,CAAC,IACH,QAAO,EAAE,SAAS,EAAE,EAA6C;AAEnE,QAAO;EACL,GAAI,IAAI,qBAAqB,KAAA,IAAY,EAAE,kBAAkB,IAAI,kBAAkB,GAAG,EAAE;EACxF,SAAS,8BAA8B,IAAI,QAAQ;EACpD;;AAGH,SAAS,6BAA6B,OAAgD;AACpF,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;CAET,MAAM,MAAM;CACZ,MAAM,OAAgC,EAAE;AACxC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS;AAEhB,KAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,MAAM,CAC3D,MAAK,YAAY,IAAI,UAAU,MAAM;AAEvC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,IAAI,OAAO,MAAM;AAEjC,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;;AAG/C,SAAgB,6BAA6B,SAA8D;AACzG,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO;EACL,SAAS;EACT,UAAU;EACV,kBAAkB;EAClB,gBAAgB;EAChB,SAAS;EACT,eAAe;EACf,OAAO;EACP,QAAQ;EACR,WAAW;EACX,cAAc;EACd,UAAU;EACV,aAAa;EACb,cAAc;EACd,sBAAsB;EACvB;AAGH,QAAO;EACL,SAAS,QAAQ,YAAY;EAC7B,UAAU,QAAQ,aAAa;EAC/B,kBAAkB,QAAQ,qBAAqB;EAC/C,gBACE,OAAO,QAAQ,mBAAmB,YAAY,OAAO,SAAS,QAAQ,eAAe,GACjF,KAAK,MAAM,QAAQ,eAAe,GAClC;EACN,SACE,QAAQ,YAAY,SACpB,QAAQ,YAAY,WACpB,QAAQ,YAAY,eACpB,QAAQ,YAAY,iBAChB,QAAQ,UACR;EACN,eACE,QAAQ,kBAAkB,iBAAiB,QAAQ,kBAAkB,gBACjE,QAAQ,gBACR;EACN,OAAO,6BAA6B,QAAQ,MAAM;EAClD,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,GAAG;EAC9F,WAAW,QAAQ,aAAa,OAAO,QAAQ,cAAc,YAAY,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACtG,QAAQ,YACR;EACJ,cACE,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,YAAY,CAAC,MAAM,QAAQ,QAAQ,aAAa,GACpG,QAAQ,eACR;EACN,UAAU,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW;EACrE,aAAa,QAAQ,gBAAgB,aAAa,QAAQ,gBAAgB,YAAY,QAAQ,cAAc;EAC5G,cACE,QAAQ,iBAAiB,kBACzB,QAAQ,iBAAiB,iBACzB,QAAQ,iBAAiB,iBACrB,QAAQ,eACR;EACN,sBACE,OAAO,QAAQ,yBAAyB,YAAY,OAAO,SAAS,QAAQ,qBAAqB,GAC7F,KAAK,MAAM,QAAQ,qBAAqB,GACxC;EACP;;;AAIH,eAAsB,0BAA0B,SAAyB;CACvE,MAAM,SAAS,QAAQ;AACvB,KAAI,oBAAoB,CAAC,WAAW,EAClC,+BAA8B,sBAAsB;CAEtD,MAAM,kBAAkB,OAAO,YAC7B,oBAAoB,CAAC,KAAK,WAAW;AACnC,MAAI,OAAO,cACT,QAAO,CAAC,OAAO,IAAI,OAAO,cAAc,mBAAmB,OAAO,CAAC;EAErE,MAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,SAAO,CACL,OAAO,IACP;GACE,SAAS,YAAY,WAAW;GAChC,YAAY,OAAO,OAAO,eAAe,OAAO,CAAC,SAAS;GAC3D,CACF;GACD,CACH;AACD,QAAO;EACL,QAAQ;GACN,WAAW,sBAAsB,OAAO;GACxC,MAAM,iBAAiB,OAAO,CAC3B,QAAQ,MAAM,EAAE,YAAY,MAAM,CAClC,KAAK,OAAO;IACX,IAAI,iBAAiB,EAAE,GAAG;IAC1B,GAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,EAAE;IAC/E,EAAE;GACL,UAAU;IACR,OAAO,sBAAsB,OAAO,QAAQ,UAAU,MAAM,IAAI;IAChE,gBAAgB,2BAA2B,OAAO,QAAQ,UAAU,MAAM;IAC1E,YAAY,sBAAsB,OAAO,QAAQ,UAAU,WAAW,IAAI;IAC1E,qBAAqB,2BAA2B,OAAO,QAAQ,UAAU,WAAW;IACpF,sBAAsB,sBAAsB,OAAO,QAAQ,UAAU,qBAAqB,IAAI;IAC9F,+BAA+B,2BAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,+BAA+B,mCAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,0CAA0C,8CACxC,OAAO,QAAQ,UAAU,qBAC1B;IACD,YAAY,OAAO,QAAQ,UAAU;IACrC,WAAW,OAAO,QAAQ,UAAU;IACpC,aAAa,OAAO,QAAQ,UAAU;IACtC,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,WAAW,OAAO,QAAQ,UAAU;IACpC,iBAAiB,OAAO,QAAQ,UAAU;IAC1C,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,gBAAgB,OAAO,QAAQ,UAAU;IACzC,SAAS,6BAA6B,OAAO,QAAQ,UAAU,QAAQ;IACvE,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,oBAAoB,OAAO,QAAQ,UAAU;IAC7C,wBAAwB,OAAO,QAAQ,UAAU;IACjD,YAAY,OAAO,QAAQ,UAAU;IACrC,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,QAAQ,UAAU;IACjC,eAAe,OAAO,QAAQ,UAAU;IACxC,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,YAAY,OAAO,QAAQ,UAAU;IACrC,UAAU,OAAO,QAAQ,UAAU;IACnC,aAAa,OAAO,QAAQ,UAAU;IACtC,sBAAsB,OAAO,QAAQ,UAAU;IAC/C,QAAQ,OAAO,QAAQ,UAAU;IACjC,OAAO,OAAO,QAAQ,UAAU;IAChC,QAAQ,OAAO,QAAQ,UAAU;IAClC;GACF;EACD,UAAU;EACV,WAAW,OAAO,YAChB,MAAM,QAAQ,IACZ,iBAAiB,CAAC,IAAI,OAAO,aAAa,CACxC,UACC,MAAM,qBAAqB,SAAS,GAAI,QAAQ,GAClD,CAAC,CACH,CACF;;EAED,iBAAiB,+BAA+B,OAAO,UAAU;EACjE,SAAS;GACP,MAAM,OAAO,SAAS,QAAQ;GAC9B,gBAAgB,OAAO,SAAS;GAChC,MAAM,OAAO,SAAS;GACtB,aAAa,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,OAAO,QAAQ,cAAc,EAAE;GACzF,gBAAgB,MAAM,QAAQ,OAAO,SAAS,eAAe,GACzD,OAAO,QAAQ,iBACf,EAAE;GACN,qBAAqB,OAAO,SAAS,wBAAwB;GAC7D,0CACE,OAAO,SAAS,6CAA6C;GAC/D,UAAU,EACR,QAAQ,OAAO,SAAS,UAAU,WAAW,MAC9C;GACD,MAAM;IACJ,MAAM,OAAO,SAAS,MAAM,QAAQ;IACpC,OAAO,OAAO,SAAS,MAAM,SAAS;IACtC,UAAU,OAAO,SAAS,MAAM,WAAW,iBAAiB;IAC5D,cAAc,OAAO,SAAS,MAAM,eAChC;KACE,YAAY,OAAO,QAAQ,KAAK,aAAa;KAC7C,iBAAiB,OAAO,QAAQ,KAAK,aAAa,mBAAmB,EAAE;KACvE,YAAY,OAAO,QAAQ,KAAK,aAAa,cAAc,EAAE;KAC7D,eAAe,OAAO,QAAQ,KAAK,aAAa,kBAAkB;KACnE,GACD,KAAA;IACJ,WAAW;KACT,SAAS,OAAO,SAAS,MAAM,WAAW,YAAY;KACtD,aACE,OAAO,OAAO,SAAS,MAAM,WAAW,gBAAgB,WACpD,OAAO,QAAQ,KAAK,UAAU,cAC9B;KACN,UACE,OAAO,OAAO,SAAS,MAAM,WAAW,aAAa,WACjD,OAAO,QAAQ,KAAK,UAAU,WAC9B;KACN,iBACE,OAAO,OAAO,SAAS,MAAM,WAAW,oBAAoB,WACxD,OAAO,QAAQ,KAAK,UAAU,kBAC9B,OAAO,OAAO,SAAS,MAAM,WAAW,cAAc,WACpD,OAAO,QAAQ,KAAK,UAAU,YAC9B;KACR,gBAAgB,OAAO,SAAS,MAAM,WAAW,mBAAmB;KACrE;IACF;GACD,WAAW;IACT,SAAS,OAAO,SAAS,WAAW;IACpC,YAAY,OAAO,SAAS,WAAW;IACvC,4BAA4B,OAAO,SAAS,WAAW,+BAA+B;IACtF,QAAQ,OAAO,SAAS,WAAW;IACnC,cAAc,OAAO,SAAS,WAAW;IACzC,QAAQ,OAAO,SAAS,WAAW;IACnC,aAAa,OAAO,SAAS,WAAW;IACxC,iBAAiB,OAAO,SAAS,WAAW;IAC5C,aAAa,OAAO,SAAS,WAAW;IACzC;GACD,mBACE,OAAO,OAAO,SAAS,sBAAsB,WACzC,OAAO,QAAQ,oBACf;GACN,yBAAyB,OAAO,SAAS,2BAA2B;GACpE,wBAAwB,MAAM,QAAQ,OAAO,SAAS,uBAAuB,GACzE,OAAO,QAAQ,yBACf,EAAE;GACN,4BAA4B,MAAM,QAAQ,OAAO,SAAS,2BAA2B,GACjF,OAAO,QAAQ,6BACf,EAAE;GACN,OAAO,mBAAmB,OAAO,SAAS,MAAM;GAChD,2BAA2B,OAAO,SAAS,6BAA6B;GACxE,oBAAoB,OAAO,SAAS,sBAAsB;GAC3D;EACD,MAAM,wBAAwB,OAAO;EACrC,OAAO,yBAAyB,OAAO;EACvC,SAAS,2BAA2B,OAAO;EAC3C,QAAQ;GACN,SAAS,OAAO,QAAQ,YAAY;GACpC,WAAW,OAAO,QAAQ,cAAc;GACxC,WAAW,OAAO,QAAQ,aAAa;GACvC,oBAAoB,OAAO,QAAQ,qBAC/B,uBAAuB,OAAO,OAAO,mBAAmB,GACxD;GACJ,SAAS,OAAO,QAAQ,UACpB;IACE,SAAS,OAAO,OAAO,QAAQ;IAC/B,YAAY,OAAO,OAAO,QAAQ;IACnC,GACD,KAAA;GACJ,WAAW,EAAE,KAAK,qBAA8B;GACjD;EACD,QAAQ,EACN,GAAG,0BAA0B,OAAO,EACrC;EACD,KAAK,oBAAoB,OAAO,OAAO,OAAO,MAAM;EACpD,KAAK,oBAAoB,OAAO,UAAU,IAAI;EAC9C,OAAO,mBAAmB,OAAO;EACjC,UAAU,MAAM,QAAQ,OAAO,SAAS,GAAG,OAAO,WAAW,EAAE;EAC/D,KAAK,yBAAyB,OAAO;EACtC"}

package/dist/src/gateway/hono/routes/tunnel.js

@@ -2,13 +2,11 @@ import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
 import { getClientIpFromHeaders } from "../../auth-rate-limit.js";
 import { extractToken } from "../../auth.js";
 import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
-import { getCertStatusSummary } from "../../../tunnel/acme-cert-store.js";
 import { getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
-import { consumePairingSecret, createPairingSecret } from "../../../tunnel/pairing.js";
+import { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from "../../../tunnel/pairing.js";
 import { loadTunnelState } from "../../../tunnel/tunnel-state.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
-import { resolveTunnelE2eConfig } from "../../../tunnel/tunnel-e2e-config.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
 import { applyTunnelConsentToConfig, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
@@ -58,7 +56,7 @@ function createTunnelMutationRateLimitMiddleware() {
 	};
 }
 function registerTunnelPublicRoutes(app, service) {
-	app.get("/api/tunnel/pair/ping", (c) => {
+	app.get("/api/tunnel/pair/ping", async (c) => {
 		const config = service.currentConfig;
 		const status = getTunnelService().getStatus();
 		const context = buildMobilePairContext({
@@ -109,18 +107,15 @@ function registerTunnelPublicRoutes(app, service) {
 		}
 		const pairingSecret = typeof body.pairingSecret === "string" ? body.pairingSecret.trim() : "";
 		if (!pairingSecret) return c.json({ error: "pairingSecret required" }, 400);
-		if (!consumePairingSecret(pairingSecret)) {
-			const limited = consumePairingExchangeFailLimit(clientIp);
-			if (!limited.allowed) c.header("Retry-After", String(Math.ceil(limited.retryAfterMs / 1e3)));
+		const cached = getCachedPairingExchange(pairingSecret);
+		if (cached) {
 			logTunnelAudit("tunnel.exchange_token", {
-				ok: false,
+				ok: true,
 				clientIp,
-				phase: "pairing_exchange"
-			}, "Pairing exchange denied: invalid or expired secret");
-			return c.json({
-				error: "Invalid or expired pairing secret",
-				code: "PAIRING_INVALID"
-			}, 401);
+				phase: "pairing_exchange",
+				replay: true
+			}, "Pairing secret replayed (duplicate mobile exchange)");
+			return c.json(cached);
 		}
 		const token = service.getAuthToken();
 		if (!token) return c.json({ error: "Gateway token not configured" }, 500);
@@ -132,18 +127,32 @@ function registerTunnelPublicRoutes(app, service) {
 			baseUrl: publicUrl,
 			lanUrl
 		});
+		const payload = await exchangePairingSecretOnce(pairingSecret, () => ({
+			token,
+			baseUrl: publicUrl,
+			lanUrl,
+			connectUrls
+		}));
+		if (!payload) {
+			const limited = consumePairingExchangeFailLimit(clientIp);
+			if (!limited.allowed) c.header("Retry-After", String(Math.ceil(limited.retryAfterMs / 1e3)));
+			logTunnelAudit("tunnel.exchange_token", {
+				ok: false,
+				clientIp,
+				phase: "pairing_exchange"
+			}, "Pairing exchange denied: invalid or expired secret");
+			return c.json({
+				error: "Invalid or expired pairing secret",
+				code: "PAIRING_INVALID"
+			}, 401);
+		}
 		logTunnelAudit("tunnel.exchange_token", {
 			ok: true,
 			clientIp,
 			subdomain: persisted?.subdomain ?? null,
 			phase: "pairing_exchange"
 		}, "Pairing secret exchanged for gateway token");
-		return c.json({
-			token,
-			baseUrl: publicUrl,
-			lanUrl,
-			connectUrls
-		});
+		return c.json(payload);
 	});
 }
 function registerTunnelRoutes(authenticated, deps) {
@@ -304,19 +313,12 @@ function registerTunnelRoutes(authenticated, deps) {
 		const port = deps.service.currentConfig.gateway.port ?? 18790;
 		const host = resolveGatewayEffectiveHost(deps.service.currentConfig);
 		if (!requireGatewayToken(c)) return c.json({ error: "Gateway token required" }, 401);
-		const qr = tunnel.buildQr(port, host);
+		const qr = await tunnel.buildQr(port, host);
 		return c.json(qr);
 	});
-	authenticated.get("/api/tunnel/cert-status", async (c) => {
+	authenticated.get("/api/tunnel/transport-status", async (c) => {
 		await configureTunnelFromService(deps);
-		const config = deps.service.currentConfig;
-		const cert = getCertStatusSummary();
-		const gatewayPort = config.gateway?.port ?? 18790;
-		const e2e = resolveTunnelE2eConfig(config.tunnel, gatewayPort);
-		return c.json({
-			...cert,
-			e2e
-		});
+		return c.json({ transport: { tls: "broker_terminated" } });
 	});
 	/**
 	* POST /api/tunnel/reveal-registration-secret — plaintext only when stored in config file.

package/dist/src/gateway/hono/routes/tunnel.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.js","names":[],"sources":["../../../../../src/gateway/hono/routes/tunnel.ts"],"sourcesContent":["import type { Hono, MiddlewareHandler } from 'hono';\n\nimport { resolveTunnelE2eConfig } from '../../../tunnel/tunnel-e2e-config.js';\nimport type { Config } from '../../../config/schema.js';\nimport { resolveGatewayEffectiveHost } from '../../../config/gateway-bind.js';\nimport { extractToken } from '../../auth.js';\nimport {\n  assertTunnelMayStart,\n  getTunnelConsentState,\n  TUNNEL_CONSENT_REQUIRED_CODE,\n  TunnelConsentError,\n} from '../../../tunnel/consent.js';\nimport { hashGatewayToken } from '../../../tunnel/tunnel-service.js';\nimport { configureTunnelFromGatewayConfig } from '../../../tunnel/gateway-lifecycle.js';\nimport {\n  getTunnelRegistrationSecretMeta,\n  readTunnelRegistrationSecretFromConfigOnly,\n  resolveTunnelBrokerUrl,\n} from '../../../tunnel/env.js';\nimport { getTunnelService } from '../../../tunnel/index.js';\nimport { getCertStatusSummary } from '../../../tunnel/acme-cert-store.js';\nimport { createPairingSecret, consumePairingSecret } from '../../../tunnel/pairing.js';\nimport { buildMobilePairContext } from '../../../tunnel/pair-context.js';\nimport { applyLanPairingGatewayPatch } from '../../../tunnel/enable-lan-pairing.js';\nimport {\n  buildMobileConnectUrlOrder,\n  resolveMobilePairLanUrl,\n  validateMobilePairBaseUrl,\n} from '../../../tunnel/pair-url.js';\nimport { consumePairingExchangeFailLimit } from '../../../tunnel/pairing-rate-limit.js';\nimport { loadTunnelState } from '../../../tunnel/tunnel-state.js';\nimport { logTunnelAudit } from '../../../tunnel/tunnel-audit.js';\nimport {\n  applyTunnelConsentToConfig,\n  setTunnelEnabledInConfig,\n} from '../../../tunnel/tunnel-config.js';\nimport { consumeTunnelMutationLimit } from '../../../tunnel/tunnel-rate-limit.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport type { GatewayService } from '../../service.js';\nimport { getClientIpFromHeaders } from '../../auth-rate-limit.js';\n\nasync function configureTunnelFromService(\n  deps: AuthenticatedRouteDeps,\n  opts?: { force?: boolean },\n): Promise<void> {\n  await configureTunnelFromGatewayConfig(deps.service.currentConfig, opts);\n}\n\nfunction enrichTunnelStatus(config: Config, status: ReturnType<ReturnType<typeof getTunnelService>['getStatus']>) {\n  const consent = getTunnelConsentState(config);\n  const brokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);\n  const registrationSecret = getTunnelRegistrationSecretMeta(config, process.env, brokerUrl);\n  return {\n    ...status,\n    consentRequired: consent.consentRequired,\n    consent: {\n      currentVersion: consent.currentVersion,\n      acceptedVersion: consent.acceptedVersion,\n      acceptedAt: consent.acceptedAt,\n      valid: consent.valid,\n    },\n    canAutoStart: consent.canAutoStart,\n    registrationSecret,\n  };\n}\n\nfunction requireGatewayToken(c: { req: { header: (name: string) => string | undefined } }): string | null {\n  return (\n    extractToken({\n      authorization: c.req.header('authorization') ?? undefined,\n    }) ?? null\n  );\n}\n\nfunction createTunnelMutationRateLimitMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const token = requireGatewayToken(c);\n    if (!token) {\n      return c.json({ error: 'Gateway token required' }, 401);\n    }\n    const result = consumeTunnelMutationLimit(token);\n    if (!result.allowed) {\n      c.header('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));\n      return c.json(\n        {\n          error: 'Too many tunnel operations. Try again later.',\n          code: 'TUNNEL_RATE_LIMITED',\n          retryAfterMs: result.retryAfterMs,\n        },\n        429,\n      );\n    }\n    await next();\n  };\n}\n\nexport function registerTunnelPublicRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/tunnel/pair/ping', (c) => {\n    const config = service.currentConfig as Config;\n    const tunnel = getTunnelService();\n    const status = tunnel.getStatus();\n    const context = buildMobilePairContext({\n      config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n    return c.json({\n      ok: true,\n      service: 'xopc-gateway',\n      mobilePairing: true,\n      port: context.port,\n      bindMode: context.bindMode,\n      listenHost: context.listenHost,\n      pairingReady: context.pairingReady,\n      blockReason: context.blockReason ?? null,\n      tunnelConnected: status.state === 'connected',\n      connectUrls: context.connectUrls,\n    });\n  });\n\n  app.post('/api/tunnel/pair/validate-url', async (c) => {\n    let body: { baseUrl?: unknown };\n    try {\n      body = (await c.req.json()) as { baseUrl?: unknown };\n    } catch {\n      return c.json({ error: 'Invalid JSON body' }, 400);\n    }\n    const baseUrl = typeof body.baseUrl === 'string' ? body.baseUrl : '';\n    const result = validateMobilePairBaseUrl(baseUrl);\n    if (result.ok === false) {\n      return c.json({\n        ok: false,\n        code: result.code,\n        message: result.message,\n      });\n    }\n    return c.json({\n      ok: true,\n      url: result.url,\n      loopback: false,\n      probePath: '/api/tunnel/pair/ping',\n    });\n  });\n\n  app.post('/api/tunnel/exchange-token', async (c) => {\n    const clientIp =\n      getClientIpFromHeaders({\n        get: (name: string) => c.req.header(name) ?? undefined,\n      }) ?? 'unknown';\n\n    let body: { pairingSecret?: unknown };\n    try {\n      body = (await c.req.json()) as { pairingSecret?: unknown };\n    } catch {\n      return c.json({ error: 'Invalid JSON body' }, 400);\n    }\n\n    const pairingSecret = typeof body.pairingSecret === 'string' ? body.pairingSecret.trim() : '';\n    if (!pairingSecret) {\n      return c.json({ error: 'pairingSecret required' }, 400);\n    }\n\n    if (!consumePairingSecret(pairingSecret)) {\n      const limited = consumePairingExchangeFailLimit(clientIp);\n      if (!limited.allowed) {\n        c.header('Retry-After', String(Math.ceil(limited.retryAfterMs / 1000)));\n      }\n      logTunnelAudit(\n        'tunnel.exchange_token',\n        { ok: false, clientIp, phase: 'pairing_exchange' },\n        'Pairing exchange denied: invalid or expired secret',\n      );\n      return c.json({ error: 'Invalid or expired pairing secret', code: 'PAIRING_INVALID' }, 401);\n    }\n\n    const token = service.getAuthToken();\n    if (!token) {\n      return c.json({ error: 'Gateway token not configured' }, 500);\n    }\n\n    const persisted = loadTunnelState();\n    const config = service.currentConfig as Config;\n    const publicUrl = persisted?.publicUrl?.trim() || null;\n    const lanUrl = resolveMobilePairLanUrl(config);\n    const connectUrls = buildMobileConnectUrlOrder({ baseUrl: publicUrl, lanUrl });\n\n    logTunnelAudit(\n      'tunnel.exchange_token',\n      { ok: true, clientIp, subdomain: persisted?.subdomain ?? null, phase: 'pairing_exchange' },\n      'Pairing secret exchanged for gateway token',\n    );\n\n    return c.json({\n      token,\n      baseUrl: publicUrl,\n      lanUrl,\n      connectUrls,\n    });\n  });\n}\n\nexport function registerTunnelRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { strictRateLimitMiddleware } = deps;\n  const tunnel = getTunnelService();\n  const tunnelMutationLimit = createTunnelMutationRateLimitMiddleware();\n\n  authenticated.get('/api/tunnel/pair/context', async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    const status = tunnel.getStatus();\n    const context = buildMobilePairContext({\n      config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n    return c.json(context);\n  });\n\n  authenticated.post('/api/tunnel/pair/enable-lan', tunnelMutationLimit, async (c) => {\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const config = deps.service.currentConfig as Config;\n    const patchResult = applyLanPairingGatewayPatch(config);\n    if (patchResult.ok === false) {\n      return c.json({ ok: false, error: { message: patchResult.message, code: 'LAN_PAIRING_CONFIG' } }, 400);\n    }\n\n    if (patchResult.changed) {\n      const saveResult = await deps.service.saveConfig(config);\n      if (!saveResult.saved) {\n        return c.json(\n          { ok: false, error: { message: saveResult.error ?? 'Failed to save config', code: 'SAVE_FAILED' } },\n          500,\n        );\n      }\n      logTunnelAudit(\n        'tunnel.enable_lan_pairing',\n        { gatewayTokenHash: hashGatewayToken(token).slice(0, 12) },\n        'Gateway bind switched to LAN for mobile pairing',\n      );\n    }\n\n    const status = tunnel.getStatus();\n    let context = buildMobilePairContext({\n      config: deps.service.currentConfig as Config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n\n    if (patchResult.changed) {\n      context = {\n        ...context,\n        pairingReady: false,\n        blockReason: 'GATEWAY_LOOPBACK_ONLY',\n      };\n    }\n\n    return c.json({\n      ok: true,\n      requiresRestart: patchResult.changed,\n      context,\n    });\n  });\n\n  authenticated.post('/api/tunnel/pair', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps);\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const { secret, expiresAt } = createPairingSecret();\n    logTunnelAudit(\n      'tunnel.pair',\n      {\n        expiresAt: expiresAt.toISOString(),\n        gatewayTokenHash: hashGatewayToken(token).slice(0, 12),\n      },\n      'Mobile pairing session created',\n    );\n    return c.json({ pairingSecret: secret, expiresAt: expiresAt.toISOString() });\n  });\n\n  authenticated.get('/api/tunnel/status', async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    return c.json(enrichTunnelStatus(config, tunnel.getStatus()));\n  });\n\n  authenticated.post('/api/tunnel/consent', tunnelMutationLimit, async (c) => {\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const config = deps.service.currentConfig as Config;\n    applyTunnelConsentToConfig(config);\n    const result = await deps.service.saveConfig(config);\n    if (!result.saved) {\n      return c.json({ ok: false, error: result.error ?? 'Failed to save config' }, 500);\n    }\n    const consent = getTunnelConsentState(config);\n    logTunnelAudit(\n      'tunnel.consent',\n      {\n        consentVersion: consent.currentVersion,\n        gatewayTokenHash: hashGatewayToken(token).slice(0, 12),\n      },\n      'Remote access security consent recorded',\n    );\n    return c.json({\n      ok: true,\n      consent: {\n        currentVersion: consent.currentVersion,\n        acceptedVersion: consent.acceptedVersion,\n        acceptedAt: consent.acceptedAt,\n        valid: consent.valid,\n      },\n    });\n  });\n\n  authenticated.post('/api/tunnel/start', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps, { force: true });\n    const config = deps.service.currentConfig as Config;\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    try {\n      assertTunnelMayStart(config);\n    } catch (err) {\n      if (err instanceof TunnelConsentError) {\n        logTunnelAudit(\n          'tunnel.start_denied',\n          { reason: TUNNEL_CONSENT_REQUIRED_CODE, gatewayTokenHash: hashGatewayToken(token).slice(0, 12) },\n          'Tunnel start denied: consent required',\n        );\n        return c.json({ error: err.message, code: TUNNEL_CONSENT_REQUIRED_CODE }, 403);\n      }\n      throw err;\n    }\n\n    const gateway = config.gateway;\n    const port = gateway.port ?? 18790;\n    try {\n      const qr = await tunnel.start(port, token);\n      setTunnelEnabledInConfig(config, true);\n      await deps.service.saveConfig(config);\n      const status = tunnel.getStatus();\n      return c.json({\n        publicUrl: qr.publicUrl,\n        subdomain: status.subdomain,\n        qrPayload: qr.qrPayload,\n        lanUrl: qr.lanUrl,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return c.json({ error: message }, 500);\n    }\n  });\n\n  authenticated.post('/api/tunnel/stop', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    let release = false;\n    try {\n      const body = (await c.req.json().catch(() => ({}))) as { release?: unknown };\n      release = body.release === true;\n    } catch {\n      release = false;\n    }\n    const { released } = await tunnel.stop({ release });\n    setTunnelEnabledInConfig(config, false);\n    await deps.service.saveConfig(config);\n    return c.json({ ok: true, released });\n  });\n\n  authenticated.get('/api/tunnel/qr', async (c) => {\n    await configureTunnelFromService(deps);\n    const gateway = deps.service.currentConfig.gateway;\n    const port = gateway.port ?? 18790;\n    const host = resolveGatewayEffectiveHost(deps.service.currentConfig);\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n    const qr = tunnel.buildQr(port, host);\n    return c.json(qr);\n  });\n\n  authenticated.get('/api/tunnel/cert-status', async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    const cert = getCertStatusSummary();\n    const gatewayPort = config.gateway?.port ?? 18790;\n    const e2e = resolveTunnelE2eConfig(config.tunnel, gatewayPort);\n    return c.json({\n      ...cert,\n      e2e,\n    });\n  });\n\n  /**\n   * POST /api/tunnel/reveal-registration-secret — plaintext only when stored in config file.\n   */\n  authenticated.post('/api/tunnel/reveal-registration-secret', strictRateLimitMiddleware, async (c) => {\n    const config = deps.service.currentConfig as Config;\n    const registrationSecret = readTunnelRegistrationSecretFromConfigOnly(config);\n    return c.json({\n      ok: true,\n      payload: {\n        registrationSecret,\n        source: registrationSecret ? ('config' as const) : ('none' as const),\n      },\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyCA,eAAe,2BACb,MACA,MACe;AACf,OAAM,iCAAiC,KAAK,QAAQ,eAAe,KAAK;;AAG1E,SAAS,mBAAmB,QAAgB,QAAsE;CAChH,MAAM,UAAU,sBAAsB,OAAO;CAC7C,MAAM,YAAY,uBAAuB,OAAO,QAAQ,UAAU;CAClE,MAAM,qBAAqB,gCAAgC,QAAQ,QAAQ,KAAK,UAAU;AAC1F,QAAO;EACL,GAAG;EACH,iBAAiB,QAAQ;EACzB,SAAS;GACP,gBAAgB,QAAQ;GACxB,iBAAiB,QAAQ;GACzB,YAAY,QAAQ;GACpB,OAAO,QAAQ;GAChB;EACD,cAAc,QAAQ;EACtB;EACD;;AAGH,SAAS,oBAAoB,GAA6E;AACxG,QACE,aAAa,EACX,eAAe,EAAE,IAAI,OAAO,gBAAgB,IAAI,KAAA,GACjD,CAAC,IAAI;;AAIV,SAAS,0CAA6D;AACpE,QAAO,OAAO,GAAG,SAAS;EACxB,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEzD,MAAM,SAAS,2BAA2B,MAAM;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,KAAE,OAAO,eAAe,OAAO,KAAK,KAAK,OAAO,eAAe,IAAK,CAAC,CAAC;AACtE,UAAO,EAAE,KACP;IACE,OAAO;IACP,MAAM;IACN,cAAc,OAAO;IACtB,EACD,IACD;;AAEH,QAAM,MAAM;;;AAIhB,SAAgB,2BAA2B,KAAW,SAA+B;AACnF,KAAI,IAAI,0BAA0B,MAAM;EACtC,MAAM,SAAS,QAAQ;EAEvB,MAAM,SADS,kBACM,CAAC,WAAW;EACjC,MAAM,UAAU,uBAAuB;GACrC;GACA,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AACF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;GACT,eAAe;GACf,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,cAAc,QAAQ;GACtB,aAAa,QAAQ,eAAe;GACpC,iBAAiB,OAAO,UAAU;GAClC,aAAa,QAAQ;GACtB,CAAC;GACF;AAEF,KAAI,KAAK,iCAAiC,OAAO,MAAM;EACrD,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;EAGpD,MAAM,SAAS,0BADC,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,GACjB;AACjD,MAAI,OAAO,OAAO,MAChB,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,MAAM,OAAO;GACb,SAAS,OAAO;GACjB,CAAC;AAEJ,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,KAAK,OAAO;GACZ,UAAU;GACV,WAAW;GACZ,CAAC;GACF;AAEF,KAAI,KAAK,8BAA8B,OAAO,MAAM;EAClD,MAAM,WACJ,uBAAuB,EACrB,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC,IAAI;EAER,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;EAGpD,MAAM,gBAAgB,OAAO,KAAK,kBAAkB,WAAW,KAAK,cAAc,MAAM,GAAG;AAC3F,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;AAGzD,MAAI,CAAC,qBAAqB,cAAc,EAAE;GACxC,MAAM,UAAU,gCAAgC,SAAS;AACzD,OAAI,CAAC,QAAQ,QACX,GAAE,OAAO,eAAe,OAAO,KAAK,KAAK,QAAQ,eAAe,IAAK,CAAC,CAAC;AAEzE,kBACE,yBACA;IAAE,IAAI;IAAO;IAAU,OAAO;IAAoB,EAClD,qDACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAqC,MAAM;IAAmB,EAAE,IAAI;;EAG7F,MAAM,QAAQ,QAAQ,cAAc;AACpC,MAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,EAAE,IAAI;EAG/D,MAAM,YAAY,iBAAiB;EACnC,MAAM,SAAS,QAAQ;EACvB,MAAM,YAAY,WAAW,WAAW,MAAM,IAAI;EAClD,MAAM,SAAS,wBAAwB,OAAO;EAC9C,MAAM,cAAc,2BAA2B;GAAE,SAAS;GAAW;GAAQ,CAAC;AAE9E,iBACE,yBACA;GAAE,IAAI;GAAM;GAAU,WAAW,WAAW,aAAa;GAAM,OAAO;GAAoB,EAC1F,6CACD;AAED,SAAO,EAAE,KAAK;GACZ;GACA,SAAS;GACT;GACA;GACD,CAAC;GACF;;AAGJ,SAAgB,qBAAqB,eAAqB,MAAoC;CAC5F,MAAM,EAAE,8BAA8B;CACtC,MAAM,SAAS,kBAAkB;CACjC,MAAM,sBAAsB,yCAAyC;AAErE,eAAc,IAAI,4BAA4B,OAAO,MAAM;AACzD,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,SAAS,OAAO,WAAW;EACjC,MAAM,UAAU,uBAAuB;GACrC;GACA,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AACF,SAAO,EAAE,KAAK,QAAQ;GACtB;AAEF,eAAc,KAAK,+BAA+B,qBAAqB,OAAO,MAAM;EAClF,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,cAAc,4BAA4B,OAAO;AACvD,MAAI,YAAY,OAAO,MACrB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,SAAS,YAAY;IAAS,MAAM;IAAsB;GAAE,EAAE,IAAI;AAGxG,MAAI,YAAY,SAAS;GACvB,MAAM,aAAa,MAAM,KAAK,QAAQ,WAAW,OAAO;AACxD,OAAI,CAAC,WAAW,MACd,QAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO;KAAE,SAAS,WAAW,SAAS;KAAyB,MAAM;KAAe;IAAE,EACnG,IACD;AAEH,kBACE,6BACA,EAAE,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,EAC1D,kDACD;;EAGH,MAAM,SAAS,OAAO,WAAW;EACjC,IAAI,UAAU,uBAAuB;GACnC,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AAEF,MAAI,YAAY,QACd,WAAU;GACR,GAAG;GACH,cAAc;GACd,aAAa;GACd;AAGH,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,iBAAiB,YAAY;GAC7B;GACD,CAAC;GACF;AAEF,eAAc,KAAK,oBAAoB,qBAAqB,OAAO,MAAM;AACvE,QAAM,2BAA2B,KAAK;EACtC,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,EAAE,QAAQ,cAAc,qBAAqB;AACnD,iBACE,eACA;GACE,WAAW,UAAU,aAAa;GAClC,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;GACvD,EACD,iCACD;AACD,SAAO,EAAE,KAAK;GAAE,eAAe;GAAQ,WAAW,UAAU,aAAa;GAAE,CAAC;GAC5E;AAEF,eAAc,IAAI,sBAAsB,OAAO,MAAM;AACnD,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;AAC5B,SAAO,EAAE,KAAK,mBAAmB,QAAQ,OAAO,WAAW,CAAC,CAAC;GAC7D;AAEF,eAAc,KAAK,uBAAuB,qBAAqB,OAAO,MAAM;EAC1E,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,SAAS,KAAK,QAAQ;AAC5B,6BAA2B,OAAO;EAClC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,OAAO;AACpD,MAAI,CAAC,OAAO,MACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO,SAAS;GAAyB,EAAE,IAAI;EAEnF,MAAM,UAAU,sBAAsB,OAAO;AAC7C,iBACE,kBACA;GACE,gBAAgB,QAAQ;GACxB,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;GACvD,EACD,0CACD;AACD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,gBAAgB,QAAQ;IACxB,iBAAiB,QAAQ;IACzB,YAAY,QAAQ;IACpB,OAAO,QAAQ;IAChB;GACF,CAAC;GACF;AAEF,eAAc,KAAK,qBAAqB,qBAAqB,OAAO,MAAM;AACxE,QAAM,2BAA2B,MAAM,EAAE,OAAO,MAAM,CAAC;EACvD,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;AAEnE,MAAI;AACF,wBAAqB,OAAO;WACrB,KAAK;AACZ,OAAI,eAAe,oBAAoB;AACrC,mBACE,uBACA;KAAE,QAAQ;KAA8B,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;KAAE,EAChG,wCACD;AACD,WAAO,EAAE,KAAK;KAAE,OAAO,IAAI;KAAS,MAAM;KAA8B,EAAE,IAAI;;AAEhF,SAAM;;EAIR,MAAM,OADU,OAAO,QACF,QAAQ;AAC7B,MAAI;GACF,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM;AAC1C,4BAAyB,QAAQ,KAAK;AACtC,SAAM,KAAK,QAAQ,WAAW,OAAO;GACrC,MAAM,SAAS,OAAO,WAAW;AACjC,UAAO,EAAE,KAAK;IACZ,WAAW,GAAG;IACd,WAAW,OAAO;IAClB,WAAW,GAAG;IACd,QAAQ,GAAG;IACZ,CAAC;WACK,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,UAAO,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI;;GAExC;AAEF,eAAc,KAAK,oBAAoB,qBAAqB,OAAO,MAAM;AACvE,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,UAAU;AACd,MAAI;AAEF,cAAU,MADU,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EACnC,YAAY;UACrB;AACN,aAAU;;EAEZ,MAAM,EAAE,aAAa,MAAM,OAAO,KAAK,EAAE,SAAS,CAAC;AACnD,2BAAyB,QAAQ,MAAM;AACvC,QAAM,KAAK,QAAQ,WAAW,OAAO;AACrC,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAU,CAAC;GACrC;AAEF,eAAc,IAAI,kBAAkB,OAAO,MAAM;AAC/C,QAAM,2BAA2B,KAAK;EAEtC,MAAM,OADU,KAAK,QAAQ,cAAc,QACtB,QAAQ;EAC7B,MAAM,OAAO,4BAA4B,KAAK,QAAQ,cAAc;AAEpE,MAAI,CADU,oBAAoB,EACxB,CAAE,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EACnE,MAAM,KAAK,OAAO,QAAQ,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,GAAG;GACjB;AAEF,eAAc,IAAI,2BAA2B,OAAO,MAAM;AACxD,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,OAAO,sBAAsB;EACnC,MAAM,cAAc,OAAO,SAAS,QAAQ;EAC5C,MAAM,MAAM,uBAAuB,OAAO,QAAQ,YAAY;AAC9D,SAAO,EAAE,KAAK;GACZ,GAAG;GACH;GACD,CAAC;GACF;;;;AAKF,eAAc,KAAK,0CAA0C,2BAA2B,OAAO,MAAM;EACnG,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,qBAAqB,2CAA2C,OAAO;AAC7E,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA,QAAQ,qBAAsB,WAAsB;IACrD;GACF,CAAC;GACF"}
+{"version":3,"file":"tunnel.js","names":[],"sources":["../../../../../src/gateway/hono/routes/tunnel.ts"],"sourcesContent":["import type { Hono, MiddlewareHandler } from 'hono';\n\nimport type { Config } from '../../../config/schema.js';\nimport { resolveGatewayEffectiveHost } from '../../../config/gateway-bind.js';\nimport { extractToken } from '../../auth.js';\nimport {\n  assertTunnelMayStart,\n  getTunnelConsentState,\n  TUNNEL_CONSENT_REQUIRED_CODE,\n  TunnelConsentError,\n} from '../../../tunnel/consent.js';\nimport { hashGatewayToken } from '../../../tunnel/tunnel-service.js';\nimport { configureTunnelFromGatewayConfig } from '../../../tunnel/gateway-lifecycle.js';\nimport {\n  getTunnelRegistrationSecretMeta,\n  readTunnelRegistrationSecretFromConfigOnly,\n  resolveTunnelBrokerUrl,\n} from '../../../tunnel/env.js';\nimport { getTunnelService } from '../../../tunnel/index.js';\nimport { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from '../../../tunnel/pairing.js';\nimport { buildMobilePairContext } from '../../../tunnel/pair-context.js';\nimport { applyLanPairingGatewayPatch } from '../../../tunnel/enable-lan-pairing.js';\nimport {\n  buildMobileConnectUrlOrder,\n  resolveMobilePairLanUrl,\n  validateMobilePairBaseUrl,\n} from '../../../tunnel/pair-url.js';\nimport { consumePairingExchangeFailLimit } from '../../../tunnel/pairing-rate-limit.js';\nimport { loadTunnelState } from '../../../tunnel/tunnel-state.js';\nimport { logTunnelAudit } from '../../../tunnel/tunnel-audit.js';\nimport {\n  applyTunnelConsentToConfig,\n  setTunnelEnabledInConfig,\n} from '../../../tunnel/tunnel-config.js';\nimport { consumeTunnelMutationLimit } from '../../../tunnel/tunnel-rate-limit.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\nimport type { GatewayService } from '../../service.js';\nimport { getClientIpFromHeaders } from '../../auth-rate-limit.js';\n\nasync function configureTunnelFromService(\n  deps: AuthenticatedRouteDeps,\n  opts?: { force?: boolean },\n): Promise<void> {\n  await configureTunnelFromGatewayConfig(deps.service.currentConfig, opts);\n}\n\nfunction enrichTunnelStatus(config: Config, status: ReturnType<ReturnType<typeof getTunnelService>['getStatus']>) {\n  const consent = getTunnelConsentState(config);\n  const brokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);\n  const registrationSecret = getTunnelRegistrationSecretMeta(config, process.env, brokerUrl);\n  return {\n    ...status,\n    consentRequired: consent.consentRequired,\n    consent: {\n      currentVersion: consent.currentVersion,\n      acceptedVersion: consent.acceptedVersion,\n      acceptedAt: consent.acceptedAt,\n      valid: consent.valid,\n    },\n    canAutoStart: consent.canAutoStart,\n    registrationSecret,\n  };\n}\n\nfunction requireGatewayToken(c: { req: { header: (name: string) => string | undefined } }): string | null {\n  return (\n    extractToken({\n      authorization: c.req.header('authorization') ?? undefined,\n    }) ?? null\n  );\n}\n\nfunction createTunnelMutationRateLimitMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const token = requireGatewayToken(c);\n    if (!token) {\n      return c.json({ error: 'Gateway token required' }, 401);\n    }\n    const result = consumeTunnelMutationLimit(token);\n    if (!result.allowed) {\n      c.header('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));\n      return c.json(\n        {\n          error: 'Too many tunnel operations. Try again later.',\n          code: 'TUNNEL_RATE_LIMITED',\n          retryAfterMs: result.retryAfterMs,\n        },\n        429,\n      );\n    }\n    await next();\n  };\n}\n\nexport function registerTunnelPublicRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/tunnel/pair/ping', async (c) => {\n    const config = service.currentConfig as Config;\n    const tunnel = getTunnelService();\n    const status = tunnel.getStatus();\n    const context = buildMobilePairContext({\n      config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n    return c.json({\n      ok: true,\n      service: 'xopc-gateway',\n      mobilePairing: true,\n      port: context.port,\n      bindMode: context.bindMode,\n      listenHost: context.listenHost,\n      pairingReady: context.pairingReady,\n      blockReason: context.blockReason ?? null,\n      tunnelConnected: status.state === 'connected',\n      connectUrls: context.connectUrls,\n    });\n  });\n\n  app.post('/api/tunnel/pair/validate-url', async (c) => {\n    let body: { baseUrl?: unknown };\n    try {\n      body = (await c.req.json()) as { baseUrl?: unknown };\n    } catch {\n      return c.json({ error: 'Invalid JSON body' }, 400);\n    }\n    const baseUrl = typeof body.baseUrl === 'string' ? body.baseUrl : '';\n    const result = validateMobilePairBaseUrl(baseUrl);\n    if (result.ok === false) {\n      return c.json({\n        ok: false,\n        code: result.code,\n        message: result.message,\n      });\n    }\n    return c.json({\n      ok: true,\n      url: result.url,\n      loopback: false,\n      probePath: '/api/tunnel/pair/ping',\n    });\n  });\n\n  app.post('/api/tunnel/exchange-token', async (c) => {\n    const clientIp =\n      getClientIpFromHeaders({\n        get: (name: string) => c.req.header(name) ?? undefined,\n      }) ?? 'unknown';\n\n    let body: { pairingSecret?: unknown };\n    try {\n      body = (await c.req.json()) as { pairingSecret?: unknown };\n    } catch {\n      return c.json({ error: 'Invalid JSON body' }, 400);\n    }\n\n    const pairingSecret = typeof body.pairingSecret === 'string' ? body.pairingSecret.trim() : '';\n    if (!pairingSecret) {\n      return c.json({ error: 'pairingSecret required' }, 400);\n    }\n\n    const cached = getCachedPairingExchange(pairingSecret);\n    if (cached) {\n      logTunnelAudit(\n        'tunnel.exchange_token',\n        { ok: true, clientIp, phase: 'pairing_exchange', replay: true },\n        'Pairing secret replayed (duplicate mobile exchange)',\n      );\n      return c.json(cached);\n    }\n\n    const token = service.getAuthToken();\n    if (!token) {\n      return c.json({ error: 'Gateway token not configured' }, 500);\n    }\n\n    const persisted = loadTunnelState();\n    const config = service.currentConfig as Config;\n    const publicUrl = persisted?.publicUrl?.trim() || null;\n    const lanUrl = resolveMobilePairLanUrl(config);\n    const connectUrls = buildMobileConnectUrlOrder({ baseUrl: publicUrl, lanUrl });\n\n    const payload = await exchangePairingSecretOnce(pairingSecret, () => ({\n      token,\n      baseUrl: publicUrl,\n      lanUrl,\n      connectUrls,\n    }));\n\n    if (!payload) {\n      const limited = consumePairingExchangeFailLimit(clientIp);\n      if (!limited.allowed) {\n        c.header('Retry-After', String(Math.ceil(limited.retryAfterMs / 1000)));\n      }\n      logTunnelAudit(\n        'tunnel.exchange_token',\n        { ok: false, clientIp, phase: 'pairing_exchange' },\n        'Pairing exchange denied: invalid or expired secret',\n      );\n      return c.json({ error: 'Invalid or expired pairing secret', code: 'PAIRING_INVALID' }, 401);\n    }\n\n    logTunnelAudit(\n      'tunnel.exchange_token',\n      { ok: true, clientIp, subdomain: persisted?.subdomain ?? null, phase: 'pairing_exchange' },\n      'Pairing secret exchanged for gateway token',\n    );\n    return c.json(payload);\n  });\n}\n\nexport function registerTunnelRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { strictRateLimitMiddleware } = deps;\n  const tunnel = getTunnelService();\n  const tunnelMutationLimit = createTunnelMutationRateLimitMiddleware();\n\n  authenticated.get('/api/tunnel/pair/context', async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    const status = tunnel.getStatus();\n    const context = buildMobilePairContext({\n      config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n    return c.json(context);\n  });\n\n  authenticated.post('/api/tunnel/pair/enable-lan', tunnelMutationLimit, async (c) => {\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const config = deps.service.currentConfig as Config;\n    const patchResult = applyLanPairingGatewayPatch(config);\n    if (patchResult.ok === false) {\n      return c.json({ ok: false, error: { message: patchResult.message, code: 'LAN_PAIRING_CONFIG' } }, 400);\n    }\n\n    if (patchResult.changed) {\n      const saveResult = await deps.service.saveConfig(config);\n      if (!saveResult.saved) {\n        return c.json(\n          { ok: false, error: { message: saveResult.error ?? 'Failed to save config', code: 'SAVE_FAILED' } },\n          500,\n        );\n      }\n      logTunnelAudit(\n        'tunnel.enable_lan_pairing',\n        { gatewayTokenHash: hashGatewayToken(token).slice(0, 12) },\n        'Gateway bind switched to LAN for mobile pairing',\n      );\n    }\n\n    const status = tunnel.getStatus();\n    let context = buildMobilePairContext({\n      config: deps.service.currentConfig as Config,\n      tunnelPublicUrl: status.publicUrl,\n      tunnelConnected: status.state === 'connected',\n    });\n\n    if (patchResult.changed) {\n      context = {\n        ...context,\n        pairingReady: false,\n        blockReason: 'GATEWAY_LOOPBACK_ONLY',\n      };\n    }\n\n    return c.json({\n      ok: true,\n      requiresRestart: patchResult.changed,\n      context,\n    });\n  });\n\n  authenticated.post('/api/tunnel/pair', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps);\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const { secret, expiresAt } = createPairingSecret();\n    logTunnelAudit(\n      'tunnel.pair',\n      {\n        expiresAt: expiresAt.toISOString(),\n        gatewayTokenHash: hashGatewayToken(token).slice(0, 12),\n      },\n      'Mobile pairing session created',\n    );\n    return c.json({ pairingSecret: secret, expiresAt: expiresAt.toISOString() });\n  });\n\n  authenticated.get('/api/tunnel/status', async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    return c.json(enrichTunnelStatus(config, tunnel.getStatus()));\n  });\n\n  authenticated.post('/api/tunnel/consent', tunnelMutationLimit, async (c) => {\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    const config = deps.service.currentConfig as Config;\n    applyTunnelConsentToConfig(config);\n    const result = await deps.service.saveConfig(config);\n    if (!result.saved) {\n      return c.json({ ok: false, error: result.error ?? 'Failed to save config' }, 500);\n    }\n    const consent = getTunnelConsentState(config);\n    logTunnelAudit(\n      'tunnel.consent',\n      {\n        consentVersion: consent.currentVersion,\n        gatewayTokenHash: hashGatewayToken(token).slice(0, 12),\n      },\n      'Remote access security consent recorded',\n    );\n    return c.json({\n      ok: true,\n      consent: {\n        currentVersion: consent.currentVersion,\n        acceptedVersion: consent.acceptedVersion,\n        acceptedAt: consent.acceptedAt,\n        valid: consent.valid,\n      },\n    });\n  });\n\n  authenticated.post('/api/tunnel/start', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps, { force: true });\n    const config = deps.service.currentConfig as Config;\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n\n    try {\n      assertTunnelMayStart(config);\n    } catch (err) {\n      if (err instanceof TunnelConsentError) {\n        logTunnelAudit(\n          'tunnel.start_denied',\n          { reason: TUNNEL_CONSENT_REQUIRED_CODE, gatewayTokenHash: hashGatewayToken(token).slice(0, 12) },\n          'Tunnel start denied: consent required',\n        );\n        return c.json({ error: err.message, code: TUNNEL_CONSENT_REQUIRED_CODE }, 403);\n      }\n      throw err;\n    }\n\n    const gateway = config.gateway;\n    const port = gateway.port ?? 18790;\n    try {\n      const qr = await tunnel.start(port, token);\n      setTunnelEnabledInConfig(config, true);\n      await deps.service.saveConfig(config);\n      const status = tunnel.getStatus();\n      return c.json({\n        publicUrl: qr.publicUrl,\n        subdomain: status.subdomain,\n        qrPayload: qr.qrPayload,\n        lanUrl: qr.lanUrl,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return c.json({ error: message }, 500);\n    }\n  });\n\n  authenticated.post('/api/tunnel/stop', tunnelMutationLimit, async (c) => {\n    await configureTunnelFromService(deps);\n    const config = deps.service.currentConfig as Config;\n    let release = false;\n    try {\n      const body = (await c.req.json().catch(() => ({}))) as { release?: unknown };\n      release = body.release === true;\n    } catch {\n      release = false;\n    }\n    const { released } = await tunnel.stop({ release });\n    setTunnelEnabledInConfig(config, false);\n    await deps.service.saveConfig(config);\n    return c.json({ ok: true, released });\n  });\n\n  authenticated.get('/api/tunnel/qr', async (c) => {\n    await configureTunnelFromService(deps);\n    const gateway = deps.service.currentConfig.gateway;\n    const port = gateway.port ?? 18790;\n    const host = resolveGatewayEffectiveHost(deps.service.currentConfig);\n    const token = requireGatewayToken(c);\n    if (!token) return c.json({ error: 'Gateway token required' }, 401);\n    const qr = await tunnel.buildQr(port, host);\n    return c.json(qr);\n  });\n\n  authenticated.get('/api/tunnel/transport-status', async (c) => {\n    await configureTunnelFromService(deps);\n    return c.json({\n      transport: { tls: 'broker_terminated' as const },\n    });\n  });\n\n  /**\n   * POST /api/tunnel/reveal-registration-secret — plaintext only when stored in config file.\n   */\n  authenticated.post('/api/tunnel/reveal-registration-secret', strictRateLimitMiddleware, async (c) => {\n    const config = deps.service.currentConfig as Config;\n    const registrationSecret = readTunnelRegistrationSecretFromConfigOnly(config);\n    return c.json({\n      ok: true,\n      payload: {\n        registrationSecret,\n        source: registrationSecret ? ('config' as const) : ('none' as const),\n      },\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAuCA,eAAe,2BACb,MACA,MACe;AACf,OAAM,iCAAiC,KAAK,QAAQ,eAAe,KAAK;;AAG1E,SAAS,mBAAmB,QAAgB,QAAsE;CAChH,MAAM,UAAU,sBAAsB,OAAO;CAC7C,MAAM,YAAY,uBAAuB,OAAO,QAAQ,UAAU;CAClE,MAAM,qBAAqB,gCAAgC,QAAQ,QAAQ,KAAK,UAAU;AAC1F,QAAO;EACL,GAAG;EACH,iBAAiB,QAAQ;EACzB,SAAS;GACP,gBAAgB,QAAQ;GACxB,iBAAiB,QAAQ;GACzB,YAAY,QAAQ;GACpB,OAAO,QAAQ;GAChB;EACD,cAAc,QAAQ;EACtB;EACD;;AAGH,SAAS,oBAAoB,GAA6E;AACxG,QACE,aAAa,EACX,eAAe,EAAE,IAAI,OAAO,gBAAgB,IAAI,KAAA,GACjD,CAAC,IAAI;;AAIV,SAAS,0CAA6D;AACpE,QAAO,OAAO,GAAG,SAAS;EACxB,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEzD,MAAM,SAAS,2BAA2B,MAAM;AAChD,MAAI,CAAC,OAAO,SAAS;AACnB,KAAE,OAAO,eAAe,OAAO,KAAK,KAAK,OAAO,eAAe,IAAK,CAAC,CAAC;AACtE,UAAO,EAAE,KACP;IACE,OAAO;IACP,MAAM;IACN,cAAc,OAAO;IACtB,EACD,IACD;;AAEH,QAAM,MAAM;;;AAIhB,SAAgB,2BAA2B,KAAW,SAA+B;AACnF,KAAI,IAAI,yBAAyB,OAAO,MAAM;EAC5C,MAAM,SAAS,QAAQ;EAEvB,MAAM,SADS,kBACM,CAAC,WAAW;EACjC,MAAM,UAAU,uBAAuB;GACrC;GACA,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AACF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;GACT,eAAe;GACf,MAAM,QAAQ;GACd,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,cAAc,QAAQ;GACtB,aAAa,QAAQ,eAAe;GACpC,iBAAiB,OAAO,UAAU;GAClC,aAAa,QAAQ;GACtB,CAAC;GACF;AAEF,KAAI,KAAK,iCAAiC,OAAO,MAAM;EACrD,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;EAGpD,MAAM,SAAS,0BADC,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,GACjB;AACjD,MAAI,OAAO,OAAO,MAChB,QAAO,EAAE,KAAK;GACZ,IAAI;GACJ,MAAM,OAAO;GACb,SAAS,OAAO;GACjB,CAAC;AAEJ,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,KAAK,OAAO;GACZ,UAAU;GACV,WAAW;GACZ,CAAC;GACF;AAEF,KAAI,KAAK,8BAA8B,OAAO,MAAM;EAClD,MAAM,WACJ,uBAAuB,EACrB,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC,IAAI;EAER,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;EAGpD,MAAM,gBAAgB,OAAO,KAAK,kBAAkB,WAAW,KAAK,cAAc,MAAM,GAAG;AAC3F,MAAI,CAAC,cACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,SAAS,yBAAyB,cAAc;AACtD,MAAI,QAAQ;AACV,kBACE,yBACA;IAAE,IAAI;IAAM;IAAU,OAAO;IAAoB,QAAQ;IAAM,EAC/D,sDACD;AACD,UAAO,EAAE,KAAK,OAAO;;EAGvB,MAAM,QAAQ,QAAQ,cAAc;AACpC,MAAI,CAAC,MACH,QAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,EAAE,IAAI;EAG/D,MAAM,YAAY,iBAAiB;EACnC,MAAM,SAAS,QAAQ;EACvB,MAAM,YAAY,WAAW,WAAW,MAAM,IAAI;EAClD,MAAM,SAAS,wBAAwB,OAAO;EAC9C,MAAM,cAAc,2BAA2B;GAAE,SAAS;GAAW;GAAQ,CAAC;EAE9E,MAAM,UAAU,MAAM,0BAA0B,sBAAsB;GACpE;GACA,SAAS;GACT;GACA;GACD,EAAE;AAEH,MAAI,CAAC,SAAS;GACZ,MAAM,UAAU,gCAAgC,SAAS;AACzD,OAAI,CAAC,QAAQ,QACX,GAAE,OAAO,eAAe,OAAO,KAAK,KAAK,QAAQ,eAAe,IAAK,CAAC,CAAC;AAEzE,kBACE,yBACA;IAAE,IAAI;IAAO;IAAU,OAAO;IAAoB,EAClD,qDACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAqC,MAAM;IAAmB,EAAE,IAAI;;AAG7F,iBACE,yBACA;GAAE,IAAI;GAAM;GAAU,WAAW,WAAW,aAAa;GAAM,OAAO;GAAoB,EAC1F,6CACD;AACD,SAAO,EAAE,KAAK,QAAQ;GACtB;;AAGJ,SAAgB,qBAAqB,eAAqB,MAAoC;CAC5F,MAAM,EAAE,8BAA8B;CACtC,MAAM,SAAS,kBAAkB;CACjC,MAAM,sBAAsB,yCAAyC;AAErE,eAAc,IAAI,4BAA4B,OAAO,MAAM;AACzD,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,SAAS,OAAO,WAAW;EACjC,MAAM,UAAU,uBAAuB;GACrC;GACA,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AACF,SAAO,EAAE,KAAK,QAAQ;GACtB;AAEF,eAAc,KAAK,+BAA+B,qBAAqB,OAAO,MAAM;EAClF,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,cAAc,4BAA4B,OAAO;AACvD,MAAI,YAAY,OAAO,MACrB,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;IAAE,SAAS,YAAY;IAAS,MAAM;IAAsB;GAAE,EAAE,IAAI;AAGxG,MAAI,YAAY,SAAS;GACvB,MAAM,aAAa,MAAM,KAAK,QAAQ,WAAW,OAAO;AACxD,OAAI,CAAC,WAAW,MACd,QAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO;KAAE,SAAS,WAAW,SAAS;KAAyB,MAAM;KAAe;IAAE,EACnG,IACD;AAEH,kBACE,6BACA,EAAE,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,EAC1D,kDACD;;EAGH,MAAM,SAAS,OAAO,WAAW;EACjC,IAAI,UAAU,uBAAuB;GACnC,QAAQ,KAAK,QAAQ;GACrB,iBAAiB,OAAO;GACxB,iBAAiB,OAAO,UAAU;GACnC,CAAC;AAEF,MAAI,YAAY,QACd,WAAU;GACR,GAAG;GACH,cAAc;GACd,aAAa;GACd;AAGH,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,iBAAiB,YAAY;GAC7B;GACD,CAAC;GACF;AAEF,eAAc,KAAK,oBAAoB,qBAAqB,OAAO,MAAM;AACvE,QAAM,2BAA2B,KAAK;EACtC,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,EAAE,QAAQ,cAAc,qBAAqB;AACnD,iBACE,eACA;GACE,WAAW,UAAU,aAAa;GAClC,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;GACvD,EACD,iCACD;AACD,SAAO,EAAE,KAAK;GAAE,eAAe;GAAQ,WAAW,UAAU,aAAa;GAAE,CAAC;GAC5E;AAEF,eAAc,IAAI,sBAAsB,OAAO,MAAM;AACnD,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;AAC5B,SAAO,EAAE,KAAK,mBAAmB,QAAQ,OAAO,WAAW,CAAC,CAAC;GAC7D;AAEF,eAAc,KAAK,uBAAuB,qBAAqB,OAAO,MAAM;EAC1E,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAEnE,MAAM,SAAS,KAAK,QAAQ;AAC5B,6BAA2B,OAAO;EAClC,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,OAAO;AACpD,MAAI,CAAC,OAAO,MACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,OAAO,SAAS;GAAyB,EAAE,IAAI;EAEnF,MAAM,UAAU,sBAAsB,OAAO;AAC7C,iBACE,kBACA;GACE,gBAAgB,QAAQ;GACxB,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;GACvD,EACD,0CACD;AACD,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,gBAAgB,QAAQ;IACxB,iBAAiB,QAAQ;IACzB,YAAY,QAAQ;IACpB,OAAO,QAAQ;IAChB;GACF,CAAC;GACF;AAEF,eAAc,KAAK,qBAAqB,qBAAqB,OAAO,MAAM;AACxE,QAAM,2BAA2B,MAAM,EAAE,OAAO,MAAM,CAAC;EACvD,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,QAAQ,oBAAoB,EAAE;AACpC,MAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;AAEnE,MAAI;AACF,wBAAqB,OAAO;WACrB,KAAK;AACZ,OAAI,eAAe,oBAAoB;AACrC,mBACE,uBACA;KAAE,QAAQ;KAA8B,kBAAkB,iBAAiB,MAAM,CAAC,MAAM,GAAG,GAAG;KAAE,EAChG,wCACD;AACD,WAAO,EAAE,KAAK;KAAE,OAAO,IAAI;KAAS,MAAM;KAA8B,EAAE,IAAI;;AAEhF,SAAM;;EAIR,MAAM,OADU,OAAO,QACF,QAAQ;AAC7B,MAAI;GACF,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,MAAM;AAC1C,4BAAyB,QAAQ,KAAK;AACtC,SAAM,KAAK,QAAQ,WAAW,OAAO;GACrC,MAAM,SAAS,OAAO,WAAW;AACjC,UAAO,EAAE,KAAK;IACZ,WAAW,GAAG;IACd,WAAW,OAAO;IAClB,WAAW,GAAG;IACd,QAAQ,GAAG;IACZ,CAAC;WACK,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,UAAO,EAAE,KAAK,EAAE,OAAO,SAAS,EAAE,IAAI;;GAExC;AAEF,eAAc,KAAK,oBAAoB,qBAAqB,OAAO,MAAM;AACvE,QAAM,2BAA2B,KAAK;EACtC,MAAM,SAAS,KAAK,QAAQ;EAC5B,IAAI,UAAU;AACd,MAAI;AAEF,cAAU,MADU,EAAE,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EACnC,YAAY;UACrB;AACN,aAAU;;EAEZ,MAAM,EAAE,aAAa,MAAM,OAAO,KAAK,EAAE,SAAS,CAAC;AACnD,2BAAyB,QAAQ,MAAM;AACvC,QAAM,KAAK,QAAQ,WAAW,OAAO;AACrC,SAAO,EAAE,KAAK;GAAE,IAAI;GAAM;GAAU,CAAC;GACrC;AAEF,eAAc,IAAI,kBAAkB,OAAO,MAAM;AAC/C,QAAM,2BAA2B,KAAK;EAEtC,MAAM,OADU,KAAK,QAAQ,cAAc,QACtB,QAAQ;EAC7B,MAAM,OAAO,4BAA4B,KAAK,QAAQ,cAAc;AAEpE,MAAI,CADU,oBAAoB,EACxB,CAAE,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EACnE,MAAM,KAAK,MAAM,OAAO,QAAQ,MAAM,KAAK;AAC3C,SAAO,EAAE,KAAK,GAAG;GACjB;AAEF,eAAc,IAAI,gCAAgC,OAAO,MAAM;AAC7D,QAAM,2BAA2B,KAAK;AACtC,SAAO,EAAE,KAAK,EACZ,WAAW,EAAE,KAAK,qBAA8B,EACjD,CAAC;GACF;;;;AAKF,eAAc,KAAK,0CAA0C,2BAA2B,OAAO,MAAM;EACnG,MAAM,SAAS,KAAK,QAAQ;EAC5B,MAAM,qBAAqB,2CAA2C,OAAO;AAC7E,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP;IACA,QAAQ,qBAAsB,WAAsB;IACrD;GACF,CAAC;GACF"}

package/dist/src/gateway/host.d.ts

@@ -4,6 +4,21 @@ export declare function isLoopbackHost(host: string | undefined): boolean;
 export declare function isAllInterfacesHost(host: string | undefined): boolean;
 /** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
 export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
+/** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
+export declare function resolveEffectiveGatewayPort(config: {
+    gateway?: {
+        port?: number;
+    };
+}, listenPortOverride?: number): number;
+/** Resolve listen port from a gateway service (supports partial test mocks without `getEffectiveListenPort`). */
+export declare function resolveGatewayServiceListenPort(service: {
+    currentConfig: {
+        gateway?: {
+            port?: number;
+        };
+    };
+    getEffectiveListenPort?: () => number;
+}): number;
 export declare function buildDefaultCorsOrigins(params: {
     port: number;
     bindHost?: string;
@@ -17,3 +32,12 @@ export declare function resolveGatewayCorsOrigins(params: {
     port: number;
     bindHost?: string;
 }): string[];
+/** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
+export declare function originFromGatewayPublicUrl(publicUrl: string | null | undefined): string | null;
+/** CORS + CSRF allowlist including active FRP tunnel origin when connected. */
+export declare function resolveAllowedBrowserOrigins(params: {
+    configuredOrigins?: string[];
+    port: number;
+    bindHost?: string;
+    tunnelPublicUrl?: string | null;
+}): string[];

package/dist/src/gateway/host.js

@@ -1,3 +1,4 @@
+import "../daemon/constants.js";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
 function isLoopbackHost(host) {
@@ -13,6 +14,16 @@ function isAllInterfacesHost(host) {
 }
 /** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
 const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
+/** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
+function resolveEffectiveGatewayPort(config, listenPortOverride) {
+	if (typeof listenPortOverride === "number" && Number.isFinite(listenPortOverride)) return listenPortOverride;
+	return config.gateway?.port ?? 18790;
+}
+/** Resolve listen port from a gateway service (supports partial test mocks without `getEffectiveListenPort`). */
+function resolveGatewayServiceListenPort(service) {
+	if (typeof service.getEffectiveListenPort === "function") return service.getEffectiveListenPort();
+	return resolveEffectiveGatewayPort(service.currentConfig);
+}
 function buildDefaultCorsOrigins(params) {
 	const origins = new Set([
 		`http://localhost:${params.port}`,
@@ -35,7 +46,28 @@ function resolveGatewayCorsOrigins(params) {
 	});
 	return [...new Set([...configured, ...GATEWAY_DEV_CONSOLE_ORIGINS])];
 }
+/** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
+function originFromGatewayPublicUrl(publicUrl) {
+	const trimmed = publicUrl?.trim();
+	if (!trimmed) return null;
+	try {
+		return new URL(trimmed).origin.toLowerCase();
+	} catch {
+		return null;
+	}
+}
+/** CORS + CSRF allowlist including active FRP tunnel origin when connected. */
+function resolveAllowedBrowserOrigins(params) {
+	const origins = resolveGatewayCorsOrigins({
+		configuredOrigins: params.configuredOrigins,
+		port: params.port,
+		bindHost: params.bindHost
+	});
+	const tunnelOrigin = originFromGatewayPublicUrl(params.tunnelPublicUrl);
+	if (tunnelOrigin && !origins.includes(tunnelOrigin)) origins.push(tunnelOrigin);
+	return origins;
+}
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins };
+export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
 
 //# sourceMappingURL=host.js.map

package/dist/src/gateway/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","names":[],"sources":["../../../src/gateway/host.ts"],"sourcesContent":["/** True when the bind address is local-only (127.x, localhost, ::1). */\nexport function isLoopbackHost(host: string | undefined): boolean {\n  if (!host) {\n    return true;\n  }\n  const normalized = host.trim().toLowerCase();\n  return (\n    normalized === '127.0.0.1' ||\n    normalized === 'localhost' ||\n    normalized === '::1' ||\n    normalized === '0:0:0:0:0:0:0:1'\n  );\n}\n\n/** True when the gateway listens on all interfaces. */\nexport function isAllInterfacesHost(host: string | undefined): boolean {\n  if (!host) {\n    return false;\n  }\n  const normalized = host.trim();\n  return normalized === '0.0.0.0' || normalized === '::' || normalized === '*';\n}\n\n/** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */\nexport const GATEWAY_DEV_CONSOLE_ORIGINS = [\n  'http://localhost:3000',\n  'http://127.0.0.1:3000',\n] as const;\n\nexport function buildDefaultCorsOrigins(params: { port: number; bindHost?: string }): string[] {\n  const origins = new Set<string>([\n    `http://localhost:${params.port}`,\n    `http://127.0.0.1:${params.port}`,\n    ...GATEWAY_DEV_CONSOLE_ORIGINS,\n  ]);\n  const bindHost = params.bindHost?.trim();\n  if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) {\n    origins.add(`http://${bindHost}:${params.port}`);\n  }\n  return [...origins];\n}\n\n/**\n * Effective browser origins for CORS and CSRF checks.\n * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.\n */\nexport function resolveGatewayCorsOrigins(params: {\n  configuredOrigins?: string[];\n  port: number;\n  bindHost?: string;\n}): string[] {\n  const configured = (params.configuredOrigins ?? [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  if (configured.length === 0) {\n    return buildDefaultCorsOrigins({ port: params.port, bindHost: params.bindHost });\n  }\n  return [...new Set([...configured, ...GATEWAY_DEV_CONSOLE_ORIGINS])];\n}\n"],"mappings":";;AACA,SAAgB,eAAe,MAAmC;AAChE,KAAI,CAAC,KACH,QAAO;CAET,MAAM,aAAa,KAAK,MAAM,CAAC,aAAa;AAC5C,QACE,eAAe,eACf,eAAe,eACf,eAAe,SACf,eAAe;;;AAKnB,SAAgB,oBAAoB,MAAmC;AACrE,KAAI,CAAC,KACH,QAAO;CAET,MAAM,aAAa,KAAK,MAAM;AAC9B,QAAO,eAAe,aAAa,eAAe,QAAQ,eAAe;;;AAI3E,MAAa,8BAA8B,CACzC,yBACA,wBACD;AAED,SAAgB,wBAAwB,QAAuD;CAC7F,MAAM,UAAU,IAAI,IAAY;EAC9B,oBAAoB,OAAO;EAC3B,oBAAoB,OAAO;EAC3B,GAAG;EACJ,CAAC;CACF,MAAM,WAAW,OAAO,UAAU,MAAM;AACxC,KAAI,YAAY,CAAC,eAAe,SAAS,IAAI,CAAC,oBAAoB,SAAS,CACzE,SAAQ,IAAI,UAAU,SAAS,GAAG,OAAO,OAAO;AAElD,QAAO,CAAC,GAAG,QAAQ;;;;;;AAOrB,SAAgB,0BAA0B,QAI7B;CACX,MAAM,cAAc,OAAO,qBAAqB,EAAE,EAC/C,KAAK,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ;AAClB,KAAI,WAAW,WAAW,EACxB,QAAO,wBAAwB;EAAE,MAAM,OAAO;EAAM,UAAU,OAAO;EAAU,CAAC;AAElF,QAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,YAAY,GAAG,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"host.js","names":[],"sources":["../../../src/gateway/host.ts"],"sourcesContent":["import { DEFAULT_GATEWAY_PORT } from '../daemon/constants.js';\n\n/** True when the bind address is local-only (127.x, localhost, ::1). */\nexport function isLoopbackHost(host: string | undefined): boolean {\n  if (!host) {\n    return true;\n  }\n  const normalized = host.trim().toLowerCase();\n  return (\n    normalized === '127.0.0.1' ||\n    normalized === 'localhost' ||\n    normalized === '::1' ||\n    normalized === '0:0:0:0:0:0:0:1'\n  );\n}\n\n/** True when the gateway listens on all interfaces. */\nexport function isAllInterfacesHost(host: string | undefined): boolean {\n  if (!host) {\n    return false;\n  }\n  const normalized = host.trim();\n  return normalized === '0.0.0.0' || normalized === '::' || normalized === '*';\n}\n\n/** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */\nexport const GATEWAY_DEV_CONSOLE_ORIGINS = [\n  'http://localhost:3000',\n  'http://127.0.0.1:3000',\n] as const;\n\n/** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */\nexport function resolveEffectiveGatewayPort(\n  config: { gateway?: { port?: number } },\n  listenPortOverride?: number,\n): number {\n  if (typeof listenPortOverride === 'number' && Number.isFinite(listenPortOverride)) {\n    return listenPortOverride;\n  }\n  return config.gateway?.port ?? DEFAULT_GATEWAY_PORT;\n}\n\n/** Resolve listen port from a gateway service (supports partial test mocks without `getEffectiveListenPort`). */\nexport function resolveGatewayServiceListenPort(service: {\n  currentConfig: { gateway?: { port?: number } };\n  getEffectiveListenPort?: () => number;\n}): number {\n  if (typeof service.getEffectiveListenPort === 'function') {\n    return service.getEffectiveListenPort();\n  }\n  return resolveEffectiveGatewayPort(service.currentConfig);\n}\n\nexport function buildDefaultCorsOrigins(params: { port: number; bindHost?: string }): string[] {\n  const origins = new Set<string>([\n    `http://localhost:${params.port}`,\n    `http://127.0.0.1:${params.port}`,\n    ...GATEWAY_DEV_CONSOLE_ORIGINS,\n  ]);\n  const bindHost = params.bindHost?.trim();\n  if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) {\n    origins.add(`http://${bindHost}:${params.port}`);\n  }\n  return [...origins];\n}\n\n/**\n * Effective browser origins for CORS and CSRF checks.\n * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.\n */\nexport function resolveGatewayCorsOrigins(params: {\n  configuredOrigins?: string[];\n  port: number;\n  bindHost?: string;\n}): string[] {\n  const configured = (params.configuredOrigins ?? [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n  if (configured.length === 0) {\n    return buildDefaultCorsOrigins({ port: params.port, bindHost: params.bindHost });\n  }\n  return [...new Set([...configured, ...GATEWAY_DEV_CONSOLE_ORIGINS])];\n}\n\n/** Browser origin (`https://host`) from a gateway public/tunnel root URL. */\nexport function originFromGatewayPublicUrl(publicUrl: string | null | undefined): string | null {\n  const trimmed = publicUrl?.trim();\n  if (!trimmed) return null;\n  try {\n    return new URL(trimmed).origin.toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/** CORS + CSRF allowlist including active FRP tunnel origin when connected. */\nexport function resolveAllowedBrowserOrigins(params: {\n  configuredOrigins?: string[];\n  port: number;\n  bindHost?: string;\n  tunnelPublicUrl?: string | null;\n}): string[] {\n  const origins = resolveGatewayCorsOrigins({\n    configuredOrigins: params.configuredOrigins,\n    port: params.port,\n    bindHost: params.bindHost,\n  });\n  const tunnelOrigin = originFromGatewayPublicUrl(params.tunnelPublicUrl);\n  if (tunnelOrigin && !origins.includes(tunnelOrigin)) {\n    origins.push(tunnelOrigin);\n  }\n  return origins;\n}\n"],"mappings":";;;AAGA,SAAgB,eAAe,MAAmC;AAChE,KAAI,CAAC,KACH,QAAO;CAET,MAAM,aAAa,KAAK,MAAM,CAAC,aAAa;AAC5C,QACE,eAAe,eACf,eAAe,eACf,eAAe,SACf,eAAe;;;AAKnB,SAAgB,oBAAoB,MAAmC;AACrE,KAAI,CAAC,KACH,QAAO;CAET,MAAM,aAAa,KAAK,MAAM;AAC9B,QAAO,eAAe,aAAa,eAAe,QAAQ,eAAe;;;AAI3E,MAAa,8BAA8B,CACzC,yBACA,wBACD;;AAGD,SAAgB,4BACd,QACA,oBACQ;AACR,KAAI,OAAO,uBAAuB,YAAY,OAAO,SAAS,mBAAmB,CAC/E,QAAO;AAET,QAAO,OAAO,SAAS,QAAA;;;AAIzB,SAAgB,gCAAgC,SAGrC;AACT,KAAI,OAAO,QAAQ,2BAA2B,WAC5C,QAAO,QAAQ,wBAAwB;AAEzC,QAAO,4BAA4B,QAAQ,cAAc;;AAG3D,SAAgB,wBAAwB,QAAuD;CAC7F,MAAM,UAAU,IAAI,IAAY;EAC9B,oBAAoB,OAAO;EAC3B,oBAAoB,OAAO;EAC3B,GAAG;EACJ,CAAC;CACF,MAAM,WAAW,OAAO,UAAU,MAAM;AACxC,KAAI,YAAY,CAAC,eAAe,SAAS,IAAI,CAAC,oBAAoB,SAAS,CACzE,SAAQ,IAAI,UAAU,SAAS,GAAG,OAAO,OAAO;AAElD,QAAO,CAAC,GAAG,QAAQ;;;;;;AAOrB,SAAgB,0BAA0B,QAI7B;CACX,MAAM,cAAc,OAAO,qBAAqB,EAAE,EAC/C,KAAK,WAAW,OAAO,MAAM,CAAC,CAC9B,OAAO,QAAQ;AAClB,KAAI,WAAW,WAAW,EACxB,QAAO,wBAAwB;EAAE,MAAM,OAAO;EAAM,UAAU,OAAO;EAAU,CAAC;AAElF,QAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,YAAY,GAAG,4BAA4B,CAAC,CAAC;;;AAItE,SAAgB,2BAA2B,WAAqD;CAC9F,MAAM,UAAU,WAAW,MAAM;AACjC,KAAI,CAAC,QAAS,QAAO;AACrB,KAAI;AACF,SAAO,IAAI,IAAI,QAAQ,CAAC,OAAO,aAAa;SACtC;AACN,SAAO;;;;AAKX,SAAgB,6BAA6B,QAKhC;CACX,MAAM,UAAU,0BAA0B;EACxC,mBAAmB,OAAO;EAC1B,MAAM,OAAO;EACb,UAAU,OAAO;EAClB,CAAC;CACF,MAAM,eAAe,2BAA2B,OAAO,gBAAgB;AACvE,KAAI,gBAAgB,CAAC,QAAQ,SAAS,aAAa,CACjD,SAAQ,KAAK,aAAa;AAE5B,QAAO"}

package/dist/src/gateway/index.d.ts

@@ -8,7 +8,7 @@ export * from './protocol.js';
 export * from './hono/index.js';
 export * from './auth.js';
 export { assertGatewayRuntimeConfig, type GatewayRuntimeConfig, } from './runtime-config.js';
-export { isLoopbackHost, isAllInterfacesHost, buildDefaultCorsOrigins, } from './host.js';
+export { isLoopbackHost, isAllInterfacesHost, buildDefaultCorsOrigins, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort, } from './host.js';
 export { resolveGatewayListenHost, resolveGatewayListenPlan, } from './listen.js';
 export { resolveGatewayBindMode, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayEffectiveHost, defaultGatewayBindMode, isContainerEnvironment, } from '../config/gateway-bind.js';
 export { isSecureWebSocketUrl, assertSecureWebSocketUrl, assertSecureGatewayHttpUrl, isInsecurePrivateWsAllowed, } from './ws-security.js';

package/dist/src/gateway/index.js

@@ -1,4 +1,4 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
 import { buildBrowserOriginRateLimitKey, isGatewayStrictSecurityEnabled, resetAuthRateLimitersForTests, resolveAuthRateLimitTracking } from "./auth-rate-limit.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -15,4 +15,4 @@ import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofO
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
-export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buildBrowserOriginRateLimitKey, buildDefaultCorsOrigins, checkPortAvailable, createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createHonoApp, createSendHandler, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resetAuthRateLimitersForTests, resolveAuthRateLimitTracking, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };
+export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buildBrowserOriginRateLimitKey, buildDefaultCorsOrigins, checkPortAvailable, createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createHonoApp, createSendHandler, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resetAuthRateLimitersForTests, resolveAuthRateLimitTracking, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/runtime-config.js

@@ -1,4 +1,4 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { isAllInterfacesHost, isLoopbackHost } from "./host.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./auth-rate-limit.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
@@ -36,13 +36,6 @@ function assertGatewayRuntimeConfig(params) {
 		if (params.auth.mode === "trusted-proxy") {
 			if ((params.cfg.gateway?.trustedProxies ?? []).map((entry) => entry.trim()).filter(Boolean).length === 0) throw new Error("gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP");
 		}
-		if (corsOrigins.length === 0 && !dangerouslyAllowHostHeaderOriginFallback) {
-			const suggested = buildDefaultCorsOrigins({
-				port: params.port,
-				bindHost
-			}).join(", ");
-			throw new Error(`network-accessible gateway requires gateway.corsOrigins (e.g. [${suggested}]), or set gateway.dangerouslyAllowHostHeaderOriginFallback=true for Host-header origin fallback`);
-		}
 		if (corsOrigins.some((origin) => origin === "*")) throw new Error("gateway.corsOrigins must not include \"*\" when binding to a network-accessible address");
 	}
 	if (isAllInterfacesHost(bindHost) && params.auth.mode === "none") throw new Error("refusing to bind gateway to all interfaces (0.0.0.0) without authentication");

package/dist/src/gateway/runtime-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-config.js","names":[],"sources":["../../../src/gateway/runtime-config.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport type { GatewayBindMode } from '../config/schema.js';\nimport type { ResolvedGatewayAuth } from './auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from './auth-rate-limit.js';\nimport {\n  buildDefaultCorsOrigins,\n  isAllInterfacesHost,\n  isLoopbackHost,\n} from './host.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { assertTailscaleExposureCompatible } from './tailscale-lifecycle.js';\n\nexport type GatewayRuntimeConfig = {\n  bindMode: GatewayBindMode;\n  bindHost: string;\n  customBindHost?: string;\n  loopback: boolean;\n  auth: ResolvedGatewayAuth;\n  corsOrigins: string[];\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n};\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction hasSharedSecret(auth: ResolvedGatewayAuth): boolean {\n  if (auth.mode === 'trusted-proxy') {\n    return true;\n  }\n  if (auth.mode === 'token') {\n    return typeof auth.token === 'string' && auth.token.trim().length > 0;\n  }\n  if (auth.mode === 'password') {\n    return typeof auth.password === 'string' && auth.password.trim().length > 0;\n  }\n  return false;\n}\n\n/**\n * Fail-closed gateway startup guards (OpenClaw-aligned).\n * Throws when bind/auth/origin combinations are unsafe for network exposure.\n */\nexport function assertGatewayRuntimeConfig(params: {\n  cfg: Config;\n  auth: ResolvedGatewayAuth;\n  bindOverride?: GatewayBindMode;\n  port: number;\n}): GatewayRuntimeConfig {\n  const plan = resolveGatewayListenPlan({\n    cfg: params.cfg,\n    bindOverride: params.bindOverride,\n  });\n  const { bindMode, bindHost, customBindHost } = plan;\n  const loopback = isLoopbackHost(bindHost);\n  const corsOrigins = normalizeCorsOrigins(params.cfg);\n  const dangerouslyAllowHostHeaderOriginFallback =\n    params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n\n  if (bindMode === 'loopback' && !loopback) {\n    throw new Error(\n      `gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`,\n    );\n  }\n\n  if (bindMode === 'custom') {\n    const configuredCustom = params.cfg.gateway?.customBindHost?.trim();\n    if (!configuredCustom) {\n      throw new Error('gateway.bind=custom requires gateway.customBindHost');\n    }\n    if (bindHost !== configuredCustom) {\n      throw new Error(\n        `gateway bind=custom requested ${configuredCustom} but resolved ${bindHost}`,\n      );\n    }\n  }\n\n  if (!loopback) {\n    if (params.auth.mode === 'none') {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.mode to \"token\", \"password\", or \"trusted-proxy\" and configure credentials)',\n      );\n    }\n\n    if (!hasSharedSecret(params.auth)) {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.token/password, XOPC_GATEWAY_TOKEN/XOPC_GATEWAY_PASSWORD, or trusted-proxy config)',\n      );\n    }\n\n    if (params.auth.mode === 'trusted-proxy') {\n      const trustedProxies = (params.cfg.gateway?.trustedProxies ?? [])\n        .map((entry) => entry.trim())\n        .filter(Boolean);\n      if (trustedProxies.length === 0) {\n        throw new Error(\n          'gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP',\n        );\n      }\n    }\n\n    if (corsOrigins.length === 0 && !dangerouslyAllowHostHeaderOriginFallback) {\n      const suggested = buildDefaultCorsOrigins({ port: params.port, bindHost }).join(', ');\n      throw new Error(\n        'network-accessible gateway requires gateway.corsOrigins ' +\n          `(e.g. [${suggested}]), or set ` +\n          'gateway.dangerouslyAllowHostHeaderOriginFallback=true for Host-header origin fallback',\n      );\n    }\n\n    if (corsOrigins.some((origin) => origin === '*')) {\n      throw new Error(\n        'gateway.corsOrigins must not include \"*\" when binding to a network-accessible address',\n      );\n    }\n  }\n\n  if (isAllInterfacesHost(bindHost) && params.auth.mode === 'none') {\n    throw new Error(\n      'refusing to bind gateway to all interfaces (0.0.0.0) without authentication',\n    );\n  }\n\n  assertTailscaleExposureCompatible(params.cfg);\n\n  const rateLimitConfigured = params.cfg.gateway?.auth?.rateLimit !== undefined;\n  const rateLimitEnabled =\n    params.cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tailscaleMode = params.cfg.gateway?.tailscale?.mode ?? 'off';\n  const tlsEnabled =\n    params.cfg.tunnel?.enabled === true ||\n    tailscaleMode !== 'off' ||\n    params.cfg.gateway?.tls?.enabled === true;\n\n  if (\n    !loopback &&\n    isGatewayStrictSecurityEnabled(params.cfg) &&\n    !rateLimitConfigured\n  ) {\n    throw new Error(\n      'gateway.security.strict requires gateway.auth.rateLimit on network-accessible binds ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 })',\n    );\n  }\n\n  return {\n    bindMode,\n    bindHost,\n    customBindHost,\n    loopback,\n    auth: params.auth,\n    corsOrigins,\n    dangerouslyAllowHostHeaderOriginFallback,\n    rateLimitEnabled,\n    tlsEnabled,\n  };\n}\n"],"mappings":";;;;;AAwBA,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,gBAAgB,MAAoC;AAC3D,KAAI,KAAK,SAAS,gBAChB,QAAO;AAET,KAAI,KAAK,SAAS,QAChB,QAAO,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,CAAC,SAAS;AAEtE,KAAI,KAAK,SAAS,WAChB,QAAO,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,MAAM,CAAC,SAAS;AAE5E,QAAO;;;;;;AAOT,SAAgB,2BAA2B,QAKlB;CAKvB,MAAM,EAAE,UAAU,UAAU,mBAJf,yBAAyB;EACpC,KAAK,OAAO;EACZ,cAAc,OAAO;EACtB,CACkD;CACnD,MAAM,WAAW,eAAe,SAAS;CACzC,MAAM,cAAc,qBAAqB,OAAO,IAAI;CACpD,MAAM,2CACJ,OAAO,IAAI,SAAS,6CAA6C;AAEnE,KAAI,aAAa,cAAc,CAAC,SAC9B,OAAM,IAAI,MACR,uDAAuD,SAAS,uCACjE;AAGH,KAAI,aAAa,UAAU;EACzB,MAAM,mBAAmB,OAAO,IAAI,SAAS,gBAAgB,MAAM;AACnE,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,sDAAsD;AAExE,MAAI,aAAa,iBACf,OAAM,IAAI,MACR,iCAAiC,iBAAiB,gBAAgB,WACnE;;AAIL,KAAI,CAAC,UAAU;AACb,MAAI,OAAO,KAAK,SAAS,OACvB,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,4GAExD;AAGH,MAAI,CAAC,gBAAgB,OAAO,KAAK,CAC/B,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,oHAExD;AAGH,MAAI,OAAO,KAAK,SAAS;QACC,OAAO,IAAI,SAAS,kBAAkB,EAAE,EAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QACQ,CAAC,WAAW,EAC5B,OAAM,IAAI,MACR,8GACD;;AAIL,MAAI,YAAY,WAAW,KAAK,CAAC,0CAA0C;GACzE,MAAM,YAAY,wBAAwB;IAAE,MAAM,OAAO;IAAM;IAAU,CAAC,CAAC,KAAK,KAAK;AACrF,SAAM,IAAI,MACR,kEACY,UAAU,kGAEvB;;AAGH,MAAI,YAAY,MAAM,WAAW,WAAW,IAAI,CAC9C,OAAM,IAAI,MACR,0FACD;;AAIL,KAAI,oBAAoB,SAAS,IAAI,OAAO,KAAK,SAAS,OACxD,OAAM,IAAI,MACR,8EACD;AAGH,mCAAkC,OAAO,IAAI;CAE7C,MAAM,sBAAsB,OAAO,IAAI,SAAS,MAAM,cAAc,KAAA;CACpE,MAAM,mBACJ,OAAO,IAAI,SAAS,MAAM,WAAW,YAAY,SACjD,CAAC,iCAAiC;CACpC,MAAM,gBAAgB,OAAO,IAAI,SAAS,WAAW,QAAQ;CAC7D,MAAM,aACJ,OAAO,IAAI,QAAQ,YAAY,QAC/B,kBAAkB,SAClB,OAAO,IAAI,SAAS,KAAK,YAAY;AAEvC,KACE,CAAC,YACD,+BAA+B,OAAO,IAAI,IAC1C,CAAC,oBAED,OAAM,IAAI,MACR,2JAED;AAGH,QAAO;EACL;EACA;EACA;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACD"}
+{"version":3,"file":"runtime-config.js","names":[],"sources":["../../../src/gateway/runtime-config.ts"],"sourcesContent":["import type { Config } from '../config/schema.js';\nimport type { GatewayBindMode } from '../config/schema.js';\nimport type { ResolvedGatewayAuth } from './auth.js';\nimport { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from './auth-rate-limit.js';\nimport {\n  isAllInterfacesHost,\n  isLoopbackHost,\n} from './host.js';\nimport { resolveGatewayListenPlan } from './listen.js';\nimport { assertTailscaleExposureCompatible } from './tailscale-lifecycle.js';\n\nexport type GatewayRuntimeConfig = {\n  bindMode: GatewayBindMode;\n  bindHost: string;\n  customBindHost?: string;\n  loopback: boolean;\n  auth: ResolvedGatewayAuth;\n  corsOrigins: string[];\n  dangerouslyAllowHostHeaderOriginFallback: boolean;\n  rateLimitEnabled: boolean;\n  tlsEnabled: boolean;\n};\n\nfunction normalizeCorsOrigins(cfg: Config): string[] {\n  return (cfg.gateway?.corsOrigins ?? [])\n    .map((value) => value.trim())\n    .filter(Boolean);\n}\n\nfunction hasSharedSecret(auth: ResolvedGatewayAuth): boolean {\n  if (auth.mode === 'trusted-proxy') {\n    return true;\n  }\n  if (auth.mode === 'token') {\n    return typeof auth.token === 'string' && auth.token.trim().length > 0;\n  }\n  if (auth.mode === 'password') {\n    return typeof auth.password === 'string' && auth.password.trim().length > 0;\n  }\n  return false;\n}\n\n/**\n * Fail-closed gateway startup guards (OpenClaw-aligned).\n * Throws when bind/auth/origin combinations are unsafe for network exposure.\n */\nexport function assertGatewayRuntimeConfig(params: {\n  cfg: Config;\n  auth: ResolvedGatewayAuth;\n  bindOverride?: GatewayBindMode;\n  port: number;\n}): GatewayRuntimeConfig {\n  const plan = resolveGatewayListenPlan({\n    cfg: params.cfg,\n    bindOverride: params.bindOverride,\n  });\n  const { bindMode, bindHost, customBindHost } = plan;\n  const loopback = isLoopbackHost(bindHost);\n  const corsOrigins = normalizeCorsOrigins(params.cfg);\n  const dangerouslyAllowHostHeaderOriginFallback =\n    params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n\n  if (bindMode === 'loopback' && !loopback) {\n    throw new Error(\n      `gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`,\n    );\n  }\n\n  if (bindMode === 'custom') {\n    const configuredCustom = params.cfg.gateway?.customBindHost?.trim();\n    if (!configuredCustom) {\n      throw new Error('gateway.bind=custom requires gateway.customBindHost');\n    }\n    if (bindHost !== configuredCustom) {\n      throw new Error(\n        `gateway bind=custom requested ${configuredCustom} but resolved ${bindHost}`,\n      );\n    }\n  }\n\n  if (!loopback) {\n    if (params.auth.mode === 'none') {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.mode to \"token\", \"password\", or \"trusted-proxy\" and configure credentials)',\n      );\n    }\n\n    if (!hasSharedSecret(params.auth)) {\n      throw new Error(\n        `refusing to bind gateway to ${bindHost}:${params.port} without auth ` +\n          '(set gateway.auth.token/password, XOPC_GATEWAY_TOKEN/XOPC_GATEWAY_PASSWORD, or trusted-proxy config)',\n      );\n    }\n\n    if (params.auth.mode === 'trusted-proxy') {\n      const trustedProxies = (params.cfg.gateway?.trustedProxies ?? [])\n        .map((entry) => entry.trim())\n        .filter(Boolean);\n      if (trustedProxies.length === 0) {\n        throw new Error(\n          'gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP',\n        );\n      }\n    }\n\n    // Empty corsOrigins is allowed: resolveGatewayCorsOrigins applies loopback defaults\n    // (localhost + 127.0.0.1 on the gateway port). LAN browser access still needs explicit origins.\n\n    if (corsOrigins.some((origin) => origin === '*')) {\n      throw new Error(\n        'gateway.corsOrigins must not include \"*\" when binding to a network-accessible address',\n      );\n    }\n  }\n\n  if (isAllInterfacesHost(bindHost) && params.auth.mode === 'none') {\n    throw new Error(\n      'refusing to bind gateway to all interfaces (0.0.0.0) without authentication',\n    );\n  }\n\n  assertTailscaleExposureCompatible(params.cfg);\n\n  const rateLimitConfigured = params.cfg.gateway?.auth?.rateLimit !== undefined;\n  const rateLimitEnabled =\n    params.cfg.gateway?.auth?.rateLimit?.enabled !== false &&\n    !isAuthRateLimitGloballyDisabled();\n  const tailscaleMode = params.cfg.gateway?.tailscale?.mode ?? 'off';\n  const tlsEnabled =\n    params.cfg.tunnel?.enabled === true ||\n    tailscaleMode !== 'off' ||\n    params.cfg.gateway?.tls?.enabled === true;\n\n  if (\n    !loopback &&\n    isGatewayStrictSecurityEnabled(params.cfg) &&\n    !rateLimitConfigured\n  ) {\n    throw new Error(\n      'gateway.security.strict requires gateway.auth.rateLimit on network-accessible binds ' +\n        '(e.g. { maxAttempts: 10, windowMs: 60000, blockDurationMs: 300000 })',\n    );\n  }\n\n  return {\n    bindMode,\n    bindHost,\n    customBindHost,\n    loopback,\n    auth: params.auth,\n    corsOrigins,\n    dangerouslyAllowHostHeaderOriginFallback,\n    rateLimitEnabled,\n    tlsEnabled,\n  };\n}\n"],"mappings":";;;;;AAuBA,SAAS,qBAAqB,KAAuB;AACnD,SAAQ,IAAI,SAAS,eAAe,EAAE,EACnC,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QAAQ;;AAGpB,SAAS,gBAAgB,MAAoC;AAC3D,KAAI,KAAK,SAAS,gBAChB,QAAO;AAET,KAAI,KAAK,SAAS,QAChB,QAAO,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,MAAM,CAAC,SAAS;AAEtE,KAAI,KAAK,SAAS,WAChB,QAAO,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,MAAM,CAAC,SAAS;AAE5E,QAAO;;;;;;AAOT,SAAgB,2BAA2B,QAKlB;CAKvB,MAAM,EAAE,UAAU,UAAU,mBAJf,yBAAyB;EACpC,KAAK,OAAO;EACZ,cAAc,OAAO;EACtB,CACkD;CACnD,MAAM,WAAW,eAAe,SAAS;CACzC,MAAM,cAAc,qBAAqB,OAAO,IAAI;CACpD,MAAM,2CACJ,OAAO,IAAI,SAAS,6CAA6C;AAEnE,KAAI,aAAa,cAAc,CAAC,SAC9B,OAAM,IAAI,MACR,uDAAuD,SAAS,uCACjE;AAGH,KAAI,aAAa,UAAU;EACzB,MAAM,mBAAmB,OAAO,IAAI,SAAS,gBAAgB,MAAM;AACnE,MAAI,CAAC,iBACH,OAAM,IAAI,MAAM,sDAAsD;AAExE,MAAI,aAAa,iBACf,OAAM,IAAI,MACR,iCAAiC,iBAAiB,gBAAgB,WACnE;;AAIL,KAAI,CAAC,UAAU;AACb,MAAI,OAAO,KAAK,SAAS,OACvB,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,4GAExD;AAGH,MAAI,CAAC,gBAAgB,OAAO,KAAK,CAC/B,OAAM,IAAI,MACR,+BAA+B,SAAS,GAAG,OAAO,KAAK,oHAExD;AAGH,MAAI,OAAO,KAAK,SAAS;QACC,OAAO,IAAI,SAAS,kBAAkB,EAAE,EAC7D,KAAK,UAAU,MAAM,MAAM,CAAC,CAC5B,OAAO,QACQ,CAAC,WAAW,EAC5B,OAAM,IAAI,MACR,8GACD;;AAOL,MAAI,YAAY,MAAM,WAAW,WAAW,IAAI,CAC9C,OAAM,IAAI,MACR,0FACD;;AAIL,KAAI,oBAAoB,SAAS,IAAI,OAAO,KAAK,SAAS,OACxD,OAAM,IAAI,MACR,8EACD;AAGH,mCAAkC,OAAO,IAAI;CAE7C,MAAM,sBAAsB,OAAO,IAAI,SAAS,MAAM,cAAc,KAAA;CACpE,MAAM,mBACJ,OAAO,IAAI,SAAS,MAAM,WAAW,YAAY,SACjD,CAAC,iCAAiC;CACpC,MAAM,gBAAgB,OAAO,IAAI,SAAS,WAAW,QAAQ;CAC7D,MAAM,aACJ,OAAO,IAAI,QAAQ,YAAY,QAC/B,kBAAkB,SAClB,OAAO,IAAI,SAAS,KAAK,YAAY;AAEvC,KACE,CAAC,YACD,+BAA+B,OAAO,IAAI,IAC1C,CAAC,oBAED,OAAM,IAAI,MACR,2JAED;AAGH,QAAO;EACL;EACA;EACA;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACD"}