@xopcai/xopc 0.0.81 → 0.0.83

package/dist/src/extensions/sdk/index.js

@@ -1,11 +1,12 @@
 import { ProviderPluginRegistry, getProviderRegistry, init_plugin_registry } from "../../providers/plugin-registry.js";
 import { HOOK_EXECUTION_MODES } from "../types/hooks.js";
 import { TypedEventBus } from "../typed-event-bus.js";
+import { ExtensionRegistryImpl } from "../extension-registry-impl.js";
 import { defineChannelPluginEntry } from "./channel-entry.js";
 import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSafety, isExtensionAllowed, logSecurityIssue, provenanceTracker } from "../security.js";
 import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
-import { ExtensionRegistryImpl } from "../loader.js";
+import "../loader.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
 import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";

package/dist/src/extensions/sdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/extensions/sdk/index.ts"],"sourcesContent":["/**\n * xopc Extension SDK\n * \n * Official SDK for developing xopc extensions.\n * Import types and utilities from this module:\n * \n * @example\n * import type { ExtensionApi, ExtensionDefinition } from 'xopc/extension-sdk';\n */\n\n// ============================================================================\n// Core extension types\n// ============================================================================\n\nexport type {\n  ExtensionDefinition,\n  ExtensionModule,\n  ExtensionKind,\n  ExtensionApi,\n  ExtensionLogger,\n  ExtensionManifest,\n  ExtensionRecord,\n  ExtensionRegistry,\n  ResolvedExtensionConfig,\n  ExtensionRuntime,\n  ExtensionCliRegistration,\n} from '../types/index.js';\n\n// ============================================================================\n// Tools (re-exported from @earendil-works/pi-agent-core)\n// ============================================================================\n\nexport type {\n  AgentTool,\n  AgentToolResult,\n  AgentToolUpdateCallback,\n  ToolExecutionStartEvent,\n  ToolExecutionUpdateEvent,\n  ToolExecutionEndEvent,\n} from '../types/index.js';\n\n// ============================================================================\n// Hooks ( Strongly Typed)\n// ============================================================================\n\nexport type {\n  ExtensionHookEvent,\n  ExtensionHookHandler,\n  HookOptions,\n  HookAgentContext,\n  AgentMessage,\n  ContextEvent,\n  ContextResult,\n  InputEvent,\n  InputResult,\n  TurnEvent,\n  TurnResult,\n  //  New hook types\n  HookHandlerMap,\n  HookExecutionMode,\n  // Note: HOOK_EXECUTION_MODES is exported as value below\n  //  LLM observation hooks\n  HookBeforeModelResolveEvent,\n  HookBeforeModelResolveResult,\n  HookBeforePromptBuildEvent,\n  HookBeforePromptBuildResult,\n  HookLlmInputEvent,\n  HookLlmOutputEvent,\n  //  Inbound claim\n  HookInboundClaimEvent,\n  HookInboundClaimResult,\n  //  Reset hook\n  HookBeforeResetEvent,\n  HookBeforeResetResult,\n  //  Message write hook\n  HookBeforeMessageWriteEvent,\n  HookBeforeMessageWriteResult,\n  //  Turn hooks\n  HookTurnStartEvent,\n  HookTurnEndEvent,\n  //  Tool execution hooks\n  HookToolExecutionStartEvent,\n  HookToolExecutionUpdateEvent,\n  HookToolExecutionEndEvent,\n  // Existing context types\n  HookContext,\n  BeforeAgentStartContext,\n  BeforeAgentStartResult,\n  AgentEndContext,\n  WebchatTurnCompleteEvent,\n  BeforeCompactionContext,\n  AfterCompactionContext,\n  MessageReceivedContext,\n  MessageSendingContext,\n  MessageSendingResult,\n  MessageSentContext,\n  BeforeToolCallContext,\n  BeforeToolCallResult,\n  AfterToolCallContext,\n  SessionStartContext,\n  SessionEndContext,\n  GatewayStartContext,\n  GatewayStopContext,\n} from '../types/index.js';\n\n// ============================================================================\n//  Typed Event Bus\n// ============================================================================\n\nexport type {\n  EventMap,\n  RequestMap,\n  EventHandler,\n  EventHandlerMeta,\n  RequestHandler,\n  RequestHandlerMeta,\n  WildcardEventHandler,\n  WildcardHandlerMeta,\n  TypedEventBusOptions,\n  RequestOptions,\n} from '../types/index.js';\n\n// ============================================================================\n//  Provider Types\n// ============================================================================\n\nexport type {\n  ProviderPlugin,\n  ProviderModelDefinition,\n  ProviderCapabilities,\n  ProviderStreamParams,\n  ProviderStreamChunk,\n  ProviderCompleteParams,\n  ProviderResponse,\n  ProviderRegistry,\n  BUILTIN_PROVIDERS,\n  BuiltinProviderId,\n} from '../types/index.js';\n\n// ============================================================================\n//  Advanced Features\n// ============================================================================\n\nexport type {\n  ProviderConfig,\n  ModelConfig,\n  OAuthConfig,\n  OAuthCallbacks,\n  OAuthCredentials,\n  FlagConfig,\n  FlagValue,\n  ShortcutConfig,\n  ShortcutHandler,\n} from '../types/index.js';\n\nexport type {\n  TuiExtensionHostContract,\n  TuiExtensionRegistrar,\n  TuiAutocompleteProvider,\n  TuiAutocompleteSuggestion,\n  TuiToolRenderer,\n  TuiToolRenderContext,\n  TuiSlashCommandHandler,\n  TuiNotifyLevel,\n} from '../types/index.js';\n\n// ============================================================================\n//  Security Types\n// ============================================================================\n\nexport type {\n  SafetyCheckResult,\n  SecurityConfig,\n  ExtensionSourceOrigin,\n  ProvenanceInfo,\n} from '../security.js';\n\n// ============================================================================\n//  Slot Types\n// ============================================================================\n\nexport type {\n  SlotKey,\n  SlotClaim,\n  SlotConfig,\n} from '../slots.js';\n\n// ============================================================================\n//  Diagnostics Types\n// ============================================================================\n\nexport type {\n  DiagnosticLevel,\n  ExtensionDiagnostic,\n  ExtensionLoaderCache,\n} from '../diagnostics.js';\n\n// ============================================================================\n// Channels (ChannelPlugin registry)\n// ============================================================================\n\nexport type {\n  ChannelPlugin,\n  ChannelPluginInitOptions,\n  ChannelPluginStartOptions,\n} from '../../channels/plugin-types.js';\n\n// ============================================================================\n// HTTP\n// ============================================================================\n\nexport type {\n  HttpRequestHandler,\n  HttpRequest,\n  HttpResponse,\n} from '../types/index.js';\n\n// ============================================================================\n// Commands\n// ============================================================================\n\nexport type {\n  ExtensionCommand,\n  ExtensionCommandHandler,\n  ExtensionCommandContext,\n  ExtensionCommandResult,\n  ExtensionReloadHandler,\n  ExtensionReloadResult,\n  ExtensionReloadRegistration,\n} from '../types/index.js';\n\n// ============================================================================\n// Services\n// ============================================================================\n\nexport type {\n  ExtensionService,\n} from '../types/index.js';\n\n// ============================================================================\n// Gateway\n// ============================================================================\n\nexport type {\n  GatewayMethodHandler,\n} from '../types/index.js';\n\n// ============================================================================\n// Export Classes\n// ============================================================================\n\nexport { TypedEventBus } from '../typed-event-bus.js';\nexport { ExtensionRegistryImpl } from '../loader.js';\nexport { ProviderPluginRegistry, getProviderRegistry } from '../../providers/plugin-registry.js';\nexport { SlotRegistry, getSlotRegistry, registerSlotType } from '../slots.js';\nexport { HOOK_EXECUTION_MODES } from '../types/hooks.js';\n\nexport { defineChannelPluginEntry } from './channel-entry.js';\nexport { registerExtensionCliProgram } from './channel-helpers.js';\n\n// ============================================================================\n// Export Hook Runner and Utilities\n// ============================================================================\n\nexport { \n  ExtensionHookRunner, \n  createHookContext, \n  isHookEvent \n} from '../hooks.js';\n\n// ============================================================================\n//  Security Utilities\n// ============================================================================\n\nexport {\n  checkExtensionPathSafety,\n  checkExtensionDirSafety,\n  isExtensionAllowed,\n  provenanceTracker,\n  logSecurityIssue,\n  DEFAULT_SECURITY_CONFIG,\n} from '../security.js';\n\n// ============================================================================\n//  Diagnostics Utilities\n// ============================================================================\n\nexport {\n  getExtensionCache,\n  getExtensionDiagnostics,\n  ExtensionLoaderCacheImpl,\n  ExtensionDiagnostics,\n} from '../diagnostics.js';\n\n// ============================================================================\n// Config\n// ============================================================================\n\nexport type { Config } from '../../config/config-surface.js';\n\n// Subpath barrels (also available as `xopc/extension-sdk/<name>`)\nexport { lazyModule, lazyFunction } from './lazy.js';\n\nexport { createMockExtensionApi, createTestGateway } from './testing.js';\nexport type {\n  MockExtensionApi,\n  MockExtensionApiOptions,\n  TestGateway,\n} from './testing.js';\n"],"mappings":";;;;;;;;;;;;;sBA6PiG"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/extensions/sdk/index.ts"],"sourcesContent":["/**\n * xopc Extension SDK\n * \n * Official SDK for developing xopc extensions.\n * Import types and utilities from this module:\n * \n * @example\n * import type { ExtensionApi, ExtensionDefinition } from 'xopc/extension-sdk';\n */\n\n// ============================================================================\n// Core extension types\n// ============================================================================\n\nexport type {\n  ExtensionDefinition,\n  ExtensionModule,\n  ExtensionKind,\n  ExtensionApi,\n  ExtensionLogger,\n  ExtensionManifest,\n  ExtensionRecord,\n  ExtensionRegistry,\n  ResolvedExtensionConfig,\n  ExtensionRuntime,\n  ExtensionCliRegistration,\n} from '../types/index.js';\n\n// ============================================================================\n// Tools (re-exported from @earendil-works/pi-agent-core)\n// ============================================================================\n\nexport type {\n  AgentTool,\n  AgentToolResult,\n  AgentToolUpdateCallback,\n  ToolExecutionStartEvent,\n  ToolExecutionUpdateEvent,\n  ToolExecutionEndEvent,\n} from '../types/index.js';\n\n// ============================================================================\n// Hooks ( Strongly Typed)\n// ============================================================================\n\nexport type {\n  ExtensionHookEvent,\n  ExtensionHookHandler,\n  HookOptions,\n  HookAgentContext,\n  AgentMessage,\n  ContextEvent,\n  ContextResult,\n  InputEvent,\n  InputResult,\n  TurnEvent,\n  TurnResult,\n  //  New hook types\n  HookHandlerMap,\n  HookExecutionMode,\n  // Note: HOOK_EXECUTION_MODES is exported as value below\n  //  LLM observation hooks\n  HookBeforeModelResolveEvent,\n  HookBeforeModelResolveResult,\n  HookBeforePromptBuildEvent,\n  HookBeforePromptBuildResult,\n  HookLlmInputEvent,\n  HookLlmOutputEvent,\n  //  Inbound claim\n  HookInboundClaimEvent,\n  HookInboundClaimResult,\n  //  Reset hook\n  HookBeforeResetEvent,\n  HookBeforeResetResult,\n  //  Message write hook\n  HookBeforeMessageWriteEvent,\n  HookBeforeMessageWriteResult,\n  //  Turn hooks\n  HookTurnStartEvent,\n  HookTurnEndEvent,\n  //  Tool execution hooks\n  HookToolExecutionStartEvent,\n  HookToolExecutionUpdateEvent,\n  HookToolExecutionEndEvent,\n  // Existing context types\n  HookContext,\n  BeforeAgentStartContext,\n  BeforeAgentStartResult,\n  AgentEndContext,\n  WebchatTurnCompleteEvent,\n  BeforeCompactionContext,\n  AfterCompactionContext,\n  MessageReceivedContext,\n  MessageSendingContext,\n  MessageSendingResult,\n  MessageSentContext,\n  BeforeToolCallContext,\n  BeforeToolCallResult,\n  AfterToolCallContext,\n  SessionStartContext,\n  SessionEndContext,\n  GatewayStartContext,\n  GatewayStopContext,\n} from '../types/index.js';\n\n// ============================================================================\n//  Typed Event Bus\n// ============================================================================\n\nexport type {\n  EventMap,\n  RequestMap,\n  EventHandler,\n  EventHandlerMeta,\n  RequestHandler,\n  RequestHandlerMeta,\n  WildcardEventHandler,\n  WildcardHandlerMeta,\n  TypedEventBusOptions,\n  RequestOptions,\n} from '../types/index.js';\n\n// ============================================================================\n//  Provider Types\n// ============================================================================\n\nexport type {\n  ProviderPlugin,\n  ProviderModelDefinition,\n  ProviderCapabilities,\n  ProviderStreamParams,\n  ProviderStreamChunk,\n  ProviderCompleteParams,\n  ProviderResponse,\n  ProviderRegistry,\n  BUILTIN_PROVIDERS,\n  BuiltinProviderId,\n} from '../types/index.js';\n\n// ============================================================================\n//  Advanced Features\n// ============================================================================\n\nexport type {\n  ProviderConfig,\n  ModelConfig,\n  OAuthConfig,\n  OAuthCallbacks,\n  OAuthCredentials,\n  FlagConfig,\n  FlagValue,\n  ShortcutConfig,\n  ShortcutHandler,\n} from '../types/index.js';\n\nexport type {\n  TuiExtensionHostContract,\n  TuiExtensionRegistrar,\n  TuiAutocompleteProvider,\n  TuiAutocompleteSuggestion,\n  TuiToolRenderer,\n  TuiToolRenderContext,\n  TuiSlashCommandHandler,\n  TuiNotifyLevel,\n} from '../types/index.js';\n\n// ============================================================================\n//  Security Types\n// ============================================================================\n\nexport type {\n  SafetyCheckResult,\n  SecurityConfig,\n  ExtensionSourceOrigin,\n  ProvenanceInfo,\n} from '../security.js';\n\n// ============================================================================\n//  Slot Types\n// ============================================================================\n\nexport type {\n  SlotKey,\n  SlotClaim,\n  SlotConfig,\n} from '../slots.js';\n\n// ============================================================================\n//  Diagnostics Types\n// ============================================================================\n\nexport type {\n  DiagnosticLevel,\n  ExtensionDiagnostic,\n  ExtensionLoaderCache,\n} from '../diagnostics.js';\n\n// ============================================================================\n// Channels (ChannelPlugin registry)\n// ============================================================================\n\nexport type {\n  ChannelPlugin,\n  ChannelPluginInitOptions,\n  ChannelPluginStartOptions,\n} from '../../channels/plugin-types.js';\n\n// ============================================================================\n// HTTP\n// ============================================================================\n\nexport type {\n  HttpRequestHandler,\n  HttpRequest,\n  HttpResponse,\n} from '../types/index.js';\n\n// ============================================================================\n// Commands\n// ============================================================================\n\nexport type {\n  ExtensionCommand,\n  ExtensionCommandHandler,\n  ExtensionCommandContext,\n  ExtensionCommandResult,\n  ExtensionReloadHandler,\n  ExtensionReloadResult,\n  ExtensionReloadRegistration,\n} from '../types/index.js';\n\n// ============================================================================\n// Services\n// ============================================================================\n\nexport type {\n  ExtensionService,\n} from '../types/index.js';\n\n// ============================================================================\n// Gateway\n// ============================================================================\n\nexport type {\n  GatewayMethodHandler,\n} from '../types/index.js';\n\n// ============================================================================\n// Export Classes\n// ============================================================================\n\nexport { TypedEventBus } from '../typed-event-bus.js';\nexport { ExtensionRegistryImpl } from '../loader.js';\nexport { ProviderPluginRegistry, getProviderRegistry } from '../../providers/plugin-registry.js';\nexport { SlotRegistry, getSlotRegistry, registerSlotType } from '../slots.js';\nexport { HOOK_EXECUTION_MODES } from '../types/hooks.js';\n\nexport { defineChannelPluginEntry } from './channel-entry.js';\nexport { registerExtensionCliProgram } from './channel-helpers.js';\n\n// ============================================================================\n// Export Hook Runner and Utilities\n// ============================================================================\n\nexport { \n  ExtensionHookRunner, \n  createHookContext, \n  isHookEvent \n} from '../hooks.js';\n\n// ============================================================================\n//  Security Utilities\n// ============================================================================\n\nexport {\n  checkExtensionPathSafety,\n  checkExtensionDirSafety,\n  isExtensionAllowed,\n  provenanceTracker,\n  logSecurityIssue,\n  DEFAULT_SECURITY_CONFIG,\n} from '../security.js';\n\n// ============================================================================\n//  Diagnostics Utilities\n// ============================================================================\n\nexport {\n  getExtensionCache,\n  getExtensionDiagnostics,\n  ExtensionLoaderCacheImpl,\n  ExtensionDiagnostics,\n} from '../diagnostics.js';\n\n// ============================================================================\n// Config\n// ============================================================================\n\nexport type { Config } from '../../config/config-surface.js';\n\n// Subpath barrels (also available as `xopc/extension-sdk/<name>`)\nexport { lazyModule, lazyFunction } from './lazy.js';\n\nexport { createMockExtensionApi, createTestGateway } from './testing.js';\nexport type {\n  MockExtensionApi,\n  MockExtensionApiOptions,\n  TestGateway,\n} from './testing.js';\n"],"mappings":";;;;;;;;;;;;;;sBA6PiG"}

package/dist/src/extensions/types/events.d.ts

@@ -3,7 +3,12 @@
  *
  * Type-safe event bus for inter-extension communication.
  */
-import type { ExtensionLogger } from './core.js';
+interface ExtensionLogger {
+    debug(msg: string): void;
+    info(msg: string): void;
+    warn(msg: string): void;
+    error(msg: string): void;
+}
 export interface EventMap extends Record<string, unknown> {
 }
 export interface RequestMap extends Record<string, unknown> {
@@ -54,3 +59,4 @@ export interface TypedEventBus {
     cleanup(extensionId: string): void;
     cleanupAll(): void;
 }
+export {};

package/dist/src/gateway/agents-admin.js

@@ -1,13 +1,13 @@
 import { DEFAULT_AGENT_ID, init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { applyAgentConfig, findAgentEntryIndex, pruneAgentConfig, removeAgentDirsFromDisk } from "../commands/agents.config.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";
-import { join, resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
 //#region src/gateway/agents-admin.ts
 /**
 * Gateway REST helpers for multi-agent management.

package/dist/src/gateway/file-path-classifier.js

@@ -1,11 +1,11 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSessionsDir, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
-import { basename, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";
+import { basename, isAbsolute, resolve } from "node:path";
 //#region src/gateway/file-path-classifier.ts
 init_agent_scope();
 init_paths();

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";
@@ -133,7 +133,7 @@ var HeartbeatService = class {
 		}
 		let reply;
 		try {
-			reply = await this.deps.agentService.processDirect(prompt, sessionKey);
+			reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey);
 		} catch (error) {
 			log.error({ err: error }, "Heartbeat: agent call failed");
 			return;

package/dist/src/gateway/heartbeat/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../../../src/gateway/heartbeat/service.ts"],"sourcesContent":["import { readFile } from 'fs/promises';\n\nimport type { AgentService } from '../../agent/service.js';\nimport type { Config } from '../../config/schema.js';\nimport { CronService } from '../../cron/service.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport type { SessionStore } from '../../session/store.js';\nimport { appendCronEventLines } from '../../heartbeat/event-prompt.js';\nimport { isWithinActiveHours } from '../../heartbeat/active-hours.js';\nimport { isHeartbeatContentEmpty } from '../../heartbeat/content-check.js';\nimport {\n  DEFAULT_ACK_MAX_CHARS,\n  stripHeartbeatToken,\n  shouldSilence,\n} from '../../heartbeat/tokens.js';\nimport { createHeartbeatWake } from '../../heartbeat/wake.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { resolveHeartbeatMdPath } from '../workspace-heartbeat-path.js';\n\nconst log = createLogger('HeartbeatService');\n\nconst DEFAULT_PROMPT =\n  'Read HEARTBEAT.md if it exists. Follow it strictly. If nothing needs attention, reply HEARTBEAT_OK.';\n\nexport interface HeartbeatRunnerConfig {\n  enabled: boolean;\n  intervalMs: number;\n  target?: string;\n  targetChatId?: string;\n  prompt?: string;\n  ackMaxChars?: number;\n  isolatedSession?: boolean;\n  activeHours?: {\n    start: string;\n    end: string;\n    timezone?: string;\n  };\n}\n\nfunction mapConfigToRunner(cfg: Config | undefined): HeartbeatRunnerConfig {\n  const h = cfg?.gateway?.heartbeat;\n  return {\n    enabled: h?.enabled ?? true,\n    intervalMs: h?.intervalMs ?? 1_800_000,\n    target: h?.target,\n    targetChatId: h?.targetChatId,\n    prompt: h?.prompt,\n    ackMaxChars: h?.ackMaxChars,\n    isolatedSession: h?.isolatedSession,\n    activeHours: h?.activeHours,\n  };\n}\n\n/** Map persisted gateway config to runner options (gateway start / reload). */\nexport function heartbeatRunnerConfigFromConfig(cfg: Config): HeartbeatRunnerConfig {\n  return mapConfigToRunner(cfg);\n}\n\nexport interface HeartbeatServiceDeps {\n  agentService: AgentService;\n  messageBus: MessageBus;\n  cronService: CronService;\n  sessionStore: SessionStore;\n  /** Current app config (for HEARTBEAT.md path under the default agent `profile/` directory). */\n  getConfig: () => Config;\n}\n\nexport class HeartbeatService {\n  private intervalId: ReturnType<typeof setInterval> | null = null;\n  private wake: ReturnType<typeof createHeartbeatWake>;\n  private lastHeartbeatText = '';\n  private lastHeartbeatAt = 0;\n  private runnerConfig: HeartbeatRunnerConfig | null = null;\n\n  constructor(private deps: HeartbeatServiceDeps) {\n    this.wake = createHeartbeatWake((reasons) => this.runHeartbeatOnce(reasons));\n  }\n\n  start(config: HeartbeatRunnerConfig): void {\n    if (!config.enabled) {\n      log.info('Heartbeat disabled');\n      this.runnerConfig = null;\n      return;\n    }\n\n    this.runnerConfig = config;\n    log.info({ intervalMs: config.intervalMs }, 'Heartbeat timer started (interval wake)');\n\n    this.intervalId = setInterval(() => {\n      this.wake.request({ reason: 'interval' });\n    }, config.intervalMs);\n    this.intervalId.unref?.();\n  }\n\n  /** Cron, exec completion, manual triggers, etc. */\n  requestNow(opts?: { reason?: string }): void {\n    this.wake.request({ reason: opts?.reason ?? 'manual' });\n  }\n\n  stop(): void {\n    if (this.intervalId) {\n      clearInterval(this.intervalId);\n      this.intervalId = null;\n    }\n    this.wake.stop();\n    this.runnerConfig = null;\n    log.info('Heartbeat stopped');\n  }\n\n  updateConfig(config: Config): void {\n    const mapped = mapConfigToRunner(config);\n    this.stop();\n    if (mapped.enabled) {\n      this.start(mapped);\n    }\n    log.info('Heartbeat config updated');\n  }\n\n  isRunning(): boolean {\n    return this.intervalId !== null;\n  }\n\n  private async runHeartbeatOnce(reasons: string[]): Promise<void> {\n    const reasonSummary = [...new Set(reasons)].join(', ') || 'unknown';\n\n    const cfg = this.runnerConfig;\n    if (!cfg?.enabled) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (disabled)');\n      return;\n    }\n\n    try {\n      const metrics = await this.deps.cronService.getMetrics();\n      log.trace(\n        { runningJobs: metrics.runningJobs, enabledJobs: metrics.enabledJobs },\n        'Heartbeat: cron metrics',\n      );\n    } catch {\n      /* optional */\n    }\n\n    if (cfg.activeHours && !isWithinActiveHours(cfg.activeHours)) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (outside active hours)');\n      return;\n    }\n\n    const heartbeatPath = resolveHeartbeatMdPath(this.deps.getConfig());\n    if (!heartbeatPath) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (no HEARTBEAT path)');\n      return;\n    }\n    let heartbeatContent: string | undefined;\n    try {\n      const raw = await readFile(heartbeatPath, 'utf-8');\n      if (isHeartbeatContentEmpty(raw)) {\n        log.debug({ path: heartbeatPath, reasons: reasonSummary }, 'Heartbeat: skip (HEARTBEAT.md empty)');\n        return;\n      }\n      heartbeatContent = raw.trim();\n    } catch {\n      log.debug({ path: heartbeatPath, reasons: reasonSummary }, 'Heartbeat: HEARTBEAT.md missing; continuing');\n    }\n\n    const sessionKey = cfg.isolatedSession\n      ? `heartbeat:isolated:${Date.now()}`\n      : 'heartbeat:main';\n\n    let basePrompt = (cfg.prompt?.trim() || DEFAULT_PROMPT).trim();\n    if (heartbeatContent) {\n      basePrompt = `${basePrompt}\\n\\n---\\nHEARTBEAT.md:\\n${heartbeatContent}\\n---`;\n    }\n    basePrompt = appendCronEventLines(basePrompt, reasons);\n    const prompt = `${basePrompt}\\n\\nCurrent time: ${new Date().toISOString()}`;\n\n    const ackMax = cfg.ackMaxChars ?? DEFAULT_ACK_MAX_CHARS;\n\n    log.debug({ sessionKey, reasons: reasonSummary }, 'Heartbeat: invoking agent');\n\n    // `heartbeat:main` reuses one session key; each run would otherwise append to the transcript\n    // until the model rejects the request (context window exceeded). Heartbeat prompts are\n    // self-contained (HEARTBEAT.md + this turn's text), so we start from an empty history.\n    if (sessionKey === 'heartbeat:main') {\n      try {\n        await this.deps.sessionStore.save(sessionKey, []);\n      } catch (err) {\n        log.warn({ err, sessionKey }, 'Heartbeat: failed to reset main session transcript');\n      }\n    }\n\n    let reply: string;\n    try {\n      reply = await this.deps.agentService.processDirect(prompt, sessionKey);\n    } catch (error) {\n      log.error({ err: error }, 'Heartbeat: agent call failed');\n      return;\n    }\n\n    if (!reply?.trim()) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (empty model reply)');\n      return;\n    }\n\n    if (shouldSilence(reply, ackMax)) {\n      log.info(\n        { ackMax, replyChars: reply.length, reasons: reasonSummary },\n        'Heartbeat: not sent — silent (HEARTBEAT_OK / short ack)',\n      );\n      return;\n    }\n\n    const { stripped } = stripHeartbeatToken(reply);\n    const finalText = stripped || reply.trim();\n\n    if (this.isDuplicate(finalText)) {\n      log.info(\n        { finalTextChars: finalText.length, reasons: reasonSummary },\n        'Heartbeat: not sent — duplicate within 24h',\n      );\n      return;\n    }\n\n    const target = cfg.target?.trim();\n    const targetChatId = cfg.targetChatId?.trim();\n    const hasDeliveryTarget = Boolean(target && targetChatId);\n\n    if (hasDeliveryTarget) {\n      await this.deps.messageBus.publishOutbound({\n        channel: target!,\n        chat_id: targetChatId!,\n        content: finalText,\n        type: 'message',\n      });\n      log.info(\n        {\n          reasons: reasonSummary,\n          channel: target,\n          chatId: targetChatId,\n          contentChars: finalText.length,\n        },\n        'Heartbeat: sent — outbound queued',\n      );\n    } else {\n      log.info(\n        { reasons: reasonSummary, finalTextChars: finalText.length },\n        'Heartbeat: not sent — no delivery target (set gateway.heartbeat.target + targetChatId)',\n      );\n    }\n\n    this.lastHeartbeatText = finalText;\n    this.lastHeartbeatAt = Date.now();\n  }\n\n  private isDuplicate(text: string): boolean {\n    const DEDUP_WINDOW_MS = 24 * 60 * 60 * 1000;\n    return (\n      text.trim() === this.lastHeartbeatText.trim() &&\n      Date.now() - this.lastHeartbeatAt < DEDUP_WINDOW_MS\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;aAgBqD;AAGrD,MAAM,MAAM,aAAa,mBAAmB;AAE5C,MAAM,iBACJ;AAiBF,SAAS,kBAAkB,KAAgD;CACzE,MAAM,IAAI,KAAK,SAAS;AACxB,QAAO;EACL,SAAS,GAAG,WAAW;EACvB,YAAY,GAAG,cAAc;EAC7B,QAAQ,GAAG;EACX,cAAc,GAAG;EACjB,QAAQ,GAAG;EACX,aAAa,GAAG;EAChB,iBAAiB,GAAG;EACpB,aAAa,GAAG;EACjB;;;AAIH,SAAgB,gCAAgC,KAAoC;AAClF,QAAO,kBAAkB,IAAI;;AAY/B,IAAa,mBAAb,MAA8B;CAC5B,aAA4D;CAC5D;CACA,oBAA4B;CAC5B,kBAA0B;CAC1B,eAAqD;CAErD,YAAY,MAAoC;AAA5B,OAAA,OAAA;AAClB,OAAK,OAAO,qBAAqB,YAAY,KAAK,iBAAiB,QAAQ,CAAC;;CAG9E,MAAM,QAAqC;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,OAAI,KAAK,qBAAqB;AAC9B,QAAK,eAAe;AACpB;;AAGF,OAAK,eAAe;AACpB,MAAI,KAAK,EAAE,YAAY,OAAO,YAAY,EAAE,0CAA0C;AAEtF,OAAK,aAAa,kBAAkB;AAClC,QAAK,KAAK,QAAQ,EAAE,QAAQ,YAAY,CAAC;KACxC,OAAO,WAAW;AACrB,OAAK,WAAW,SAAS;;;CAI3B,WAAW,MAAkC;AAC3C,OAAK,KAAK,QAAQ,EAAE,QAAQ,MAAM,UAAU,UAAU,CAAC;;CAGzD,OAAa;AACX,MAAI,KAAK,YAAY;AACnB,iBAAc,KAAK,WAAW;AAC9B,QAAK,aAAa;;AAEpB,OAAK,KAAK,MAAM;AAChB,OAAK,eAAe;AACpB,MAAI,KAAK,oBAAoB;;CAG/B,aAAa,QAAsB;EACjC,MAAM,SAAS,kBAAkB,OAAO;AACxC,OAAK,MAAM;AACX,MAAI,OAAO,QACT,MAAK,MAAM,OAAO;AAEpB,MAAI,KAAK,2BAA2B;;CAGtC,YAAqB;AACnB,SAAO,KAAK,eAAe;;CAG7B,MAAc,iBAAiB,SAAkC;EAC/D,MAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,IAAI;EAE1D,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,KAAK,SAAS;AACjB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,6BAA6B;AACnE;;AAGF,MAAI;GACF,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,YAAY;AACxD,OAAI,MACF;IAAE,aAAa,QAAQ;IAAa,aAAa,QAAQ;IAAa,EACtE,0BACD;UACK;AAIR,MAAI,IAAI,eAAe,CAAC,oBAAoB,IAAI,YAAY,EAAE;AAC5D,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,yCAAyC;AAC/E;;EAGF,MAAM,gBAAgB,uBAAuB,KAAK,KAAK,WAAW,CAAC;AACnE,MAAI,CAAC,eAAe;AAClB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,sCAAsC;AAC5E;;EAEF,IAAI;AACJ,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,eAAe,QAAQ;AAClD,OAAI,wBAAwB,IAAI,EAAE;AAChC,QAAI,MAAM;KAAE,MAAM;KAAe,SAAS;KAAe,EAAE,uCAAuC;AAClG;;AAEF,sBAAmB,IAAI,MAAM;UACvB;AACN,OAAI,MAAM;IAAE,MAAM;IAAe,SAAS;IAAe,EAAE,8CAA8C;;EAG3G,MAAM,aAAa,IAAI,kBACnB,sBAAsB,KAAK,KAAK,KAChC;EAEJ,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,gBAAgB,MAAM;AAC9D,MAAI,iBACF,cAAa,GAAG,WAAW,0BAA0B,iBAAiB;AAExE,eAAa,qBAAqB,YAAY,QAAQ;EACtD,MAAM,SAAS,GAAG,WAAW,qCAAoB,IAAI,MAAM,EAAC,aAAa;EAEzE,MAAM,SAAS,IAAI,eAAA;AAEnB,MAAI,MAAM;GAAE;GAAY,SAAS;GAAe,EAAE,4BAA4B;AAK9E,MAAI,eAAe,iBACjB,KAAI;AACF,SAAM,KAAK,KAAK,aAAa,KAAK,YAAY,EAAE,CAAC;WAC1C,KAAK;AACZ,OAAI,KAAK;IAAE;IAAK;IAAY,EAAE,qDAAqD;;EAIvF,IAAI;AACJ,MAAI;AACF,WAAQ,MAAM,KAAK,KAAK,aAAa,cAAc,QAAQ,WAAW;WAC/D,OAAO;AACd,OAAI,MAAM,EAAE,KAAK,OAAO,EAAE,+BAA+B;AACzD;;AAGF,MAAI,CAAC,OAAO,MAAM,EAAE;AAClB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,sCAAsC;AAC5E;;AAGF,MAAI,cAAc,OAAO,OAAO,EAAE;AAChC,OAAI,KACF;IAAE;IAAQ,YAAY,MAAM;IAAQ,SAAS;IAAe,EAC5D,0DACD;AACD;;EAGF,MAAM,EAAE,aAAa,oBAAoB,MAAM;EAC/C,MAAM,YAAY,YAAY,MAAM,MAAM;AAE1C,MAAI,KAAK,YAAY,UAAU,EAAE;AAC/B,OAAI,KACF;IAAE,gBAAgB,UAAU;IAAQ,SAAS;IAAe,EAC5D,6CACD;AACD;;EAGF,MAAM,SAAS,IAAI,QAAQ,MAAM;EACjC,MAAM,eAAe,IAAI,cAAc,MAAM;AAG7C,MAF0B,QAAQ,UAAU,aAEvB,EAAE;AACrB,SAAM,KAAK,KAAK,WAAW,gBAAgB;IACzC,SAAS;IACT,SAAS;IACT,SAAS;IACT,MAAM;IACP,CAAC;AACF,OAAI,KACF;IACE,SAAS;IACT,SAAS;IACT,QAAQ;IACR,cAAc,UAAU;IACzB,EACD,oCACD;QAED,KAAI,KACF;GAAE,SAAS;GAAe,gBAAgB,UAAU;GAAQ,EAC5D,yFACD;AAGH,OAAK,oBAAoB;AACzB,OAAK,kBAAkB,KAAK,KAAK;;CAGnC,YAAoB,MAAuB;AAEzC,SACE,KAAK,MAAM,KAAK,KAAK,kBAAkB,MAAM,IAC7C,KAAK,KAAK,GAAG,KAAK,kBAHI,OAAU,KAAK"}
+{"version":3,"file":"service.js","names":[],"sources":["../../../../src/gateway/heartbeat/service.ts"],"sourcesContent":["import { readFile } from 'fs/promises';\n\nimport type { AgentService } from '../../agent/service.js';\nimport type { Config } from '../../config/schema.js';\nimport { CronService } from '../../cron/service.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport type { SessionStore } from '../../session/store.js';\nimport { appendCronEventLines } from '../../heartbeat/event-prompt.js';\nimport { isWithinActiveHours } from '../../heartbeat/active-hours.js';\nimport { isHeartbeatContentEmpty } from '../../heartbeat/content-check.js';\nimport {\n  DEFAULT_ACK_MAX_CHARS,\n  stripHeartbeatToken,\n  shouldSilence,\n} from '../../heartbeat/tokens.js';\nimport { createHeartbeatWake } from '../../heartbeat/wake.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { resolveHeartbeatMdPath } from '../workspace-heartbeat-path.js';\n\nconst log = createLogger('HeartbeatService');\n\nconst DEFAULT_PROMPT =\n  'Read HEARTBEAT.md if it exists. Follow it strictly. If nothing needs attention, reply HEARTBEAT_OK.';\n\nexport interface HeartbeatRunnerConfig {\n  enabled: boolean;\n  intervalMs: number;\n  target?: string;\n  targetChatId?: string;\n  prompt?: string;\n  ackMaxChars?: number;\n  isolatedSession?: boolean;\n  activeHours?: {\n    start: string;\n    end: string;\n    timezone?: string;\n  };\n}\n\nfunction mapConfigToRunner(cfg: Config | undefined): HeartbeatRunnerConfig {\n  const h = cfg?.gateway?.heartbeat;\n  return {\n    enabled: h?.enabled ?? true,\n    intervalMs: h?.intervalMs ?? 1_800_000,\n    target: h?.target,\n    targetChatId: h?.targetChatId,\n    prompt: h?.prompt,\n    ackMaxChars: h?.ackMaxChars,\n    isolatedSession: h?.isolatedSession,\n    activeHours: h?.activeHours,\n  };\n}\n\n/** Map persisted gateway config to runner options (gateway start / reload). */\nexport function heartbeatRunnerConfigFromConfig(cfg: Config): HeartbeatRunnerConfig {\n  return mapConfigToRunner(cfg);\n}\n\nexport interface HeartbeatServiceDeps {\n  agentService: AgentService;\n  messageBus: MessageBus;\n  cronService: CronService;\n  sessionStore: SessionStore;\n  /** Current app config (for HEARTBEAT.md path under the default agent `profile/` directory). */\n  getConfig: () => Config;\n}\n\nexport class HeartbeatService {\n  private intervalId: ReturnType<typeof setInterval> | null = null;\n  private wake: ReturnType<typeof createHeartbeatWake>;\n  private lastHeartbeatText = '';\n  private lastHeartbeatAt = 0;\n  private runnerConfig: HeartbeatRunnerConfig | null = null;\n\n  constructor(private deps: HeartbeatServiceDeps) {\n    this.wake = createHeartbeatWake((reasons) => this.runHeartbeatOnce(reasons));\n  }\n\n  start(config: HeartbeatRunnerConfig): void {\n    if (!config.enabled) {\n      log.info('Heartbeat disabled');\n      this.runnerConfig = null;\n      return;\n    }\n\n    this.runnerConfig = config;\n    log.info({ intervalMs: config.intervalMs }, 'Heartbeat timer started (interval wake)');\n\n    this.intervalId = setInterval(() => {\n      this.wake.request({ reason: 'interval' });\n    }, config.intervalMs);\n    this.intervalId.unref?.();\n  }\n\n  /** Cron, exec completion, manual triggers, etc. */\n  requestNow(opts?: { reason?: string }): void {\n    this.wake.request({ reason: opts?.reason ?? 'manual' });\n  }\n\n  stop(): void {\n    if (this.intervalId) {\n      clearInterval(this.intervalId);\n      this.intervalId = null;\n    }\n    this.wake.stop();\n    this.runnerConfig = null;\n    log.info('Heartbeat stopped');\n  }\n\n  updateConfig(config: Config): void {\n    const mapped = mapConfigToRunner(config);\n    this.stop();\n    if (mapped.enabled) {\n      this.start(mapped);\n    }\n    log.info('Heartbeat config updated');\n  }\n\n  isRunning(): boolean {\n    return this.intervalId !== null;\n  }\n\n  private async runHeartbeatOnce(reasons: string[]): Promise<void> {\n    const reasonSummary = [...new Set(reasons)].join(', ') || 'unknown';\n\n    const cfg = this.runnerConfig;\n    if (!cfg?.enabled) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (disabled)');\n      return;\n    }\n\n    try {\n      const metrics = await this.deps.cronService.getMetrics();\n      log.trace(\n        { runningJobs: metrics.runningJobs, enabledJobs: metrics.enabledJobs },\n        'Heartbeat: cron metrics',\n      );\n    } catch {\n      /* optional */\n    }\n\n    if (cfg.activeHours && !isWithinActiveHours(cfg.activeHours)) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (outside active hours)');\n      return;\n    }\n\n    const heartbeatPath = resolveHeartbeatMdPath(this.deps.getConfig());\n    if (!heartbeatPath) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (no HEARTBEAT path)');\n      return;\n    }\n    let heartbeatContent: string | undefined;\n    try {\n      const raw = await readFile(heartbeatPath, 'utf-8');\n      if (isHeartbeatContentEmpty(raw)) {\n        log.debug({ path: heartbeatPath, reasons: reasonSummary }, 'Heartbeat: skip (HEARTBEAT.md empty)');\n        return;\n      }\n      heartbeatContent = raw.trim();\n    } catch {\n      log.debug({ path: heartbeatPath, reasons: reasonSummary }, 'Heartbeat: HEARTBEAT.md missing; continuing');\n    }\n\n    const sessionKey = cfg.isolatedSession\n      ? `heartbeat:isolated:${Date.now()}`\n      : 'heartbeat:main';\n\n    let basePrompt = (cfg.prompt?.trim() || DEFAULT_PROMPT).trim();\n    if (heartbeatContent) {\n      basePrompt = `${basePrompt}\\n\\n---\\nHEARTBEAT.md:\\n${heartbeatContent}\\n---`;\n    }\n    basePrompt = appendCronEventLines(basePrompt, reasons);\n    const prompt = `${basePrompt}\\n\\nCurrent time: ${new Date().toISOString()}`;\n\n    const ackMax = cfg.ackMaxChars ?? DEFAULT_ACK_MAX_CHARS;\n\n    log.debug({ sessionKey, reasons: reasonSummary }, 'Heartbeat: invoking agent');\n\n    // `heartbeat:main` reuses one session key; each run would otherwise append to the transcript\n    // until the model rejects the request (context window exceeded). Heartbeat prompts are\n    // self-contained (HEARTBEAT.md + this turn's text), so we start from an empty history.\n    if (sessionKey === 'heartbeat:main') {\n      try {\n        await this.deps.sessionStore.save(sessionKey, []);\n      } catch (err) {\n        log.warn({ err, sessionKey }, 'Heartbeat: failed to reset main session transcript');\n      }\n    }\n\n    let reply: string;\n    try {\n      reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey);\n    } catch (error) {\n      log.error({ err: error }, 'Heartbeat: agent call failed');\n      return;\n    }\n\n    if (!reply?.trim()) {\n      log.debug({ reasons: reasonSummary }, 'Heartbeat: skip (empty model reply)');\n      return;\n    }\n\n    if (shouldSilence(reply, ackMax)) {\n      log.info(\n        { ackMax, replyChars: reply.length, reasons: reasonSummary },\n        'Heartbeat: not sent — silent (HEARTBEAT_OK / short ack)',\n      );\n      return;\n    }\n\n    const { stripped } = stripHeartbeatToken(reply);\n    const finalText = stripped || reply.trim();\n\n    if (this.isDuplicate(finalText)) {\n      log.info(\n        { finalTextChars: finalText.length, reasons: reasonSummary },\n        'Heartbeat: not sent — duplicate within 24h',\n      );\n      return;\n    }\n\n    const target = cfg.target?.trim();\n    const targetChatId = cfg.targetChatId?.trim();\n    const hasDeliveryTarget = Boolean(target && targetChatId);\n\n    if (hasDeliveryTarget) {\n      await this.deps.messageBus.publishOutbound({\n        channel: target!,\n        chat_id: targetChatId!,\n        content: finalText,\n        type: 'message',\n      });\n      log.info(\n        {\n          reasons: reasonSummary,\n          channel: target,\n          chatId: targetChatId,\n          contentChars: finalText.length,\n        },\n        'Heartbeat: sent — outbound queued',\n      );\n    } else {\n      log.info(\n        { reasons: reasonSummary, finalTextChars: finalText.length },\n        'Heartbeat: not sent — no delivery target (set gateway.heartbeat.target + targetChatId)',\n      );\n    }\n\n    this.lastHeartbeatText = finalText;\n    this.lastHeartbeatAt = Date.now();\n  }\n\n  private isDuplicate(text: string): boolean {\n    const DEDUP_WINDOW_MS = 24 * 60 * 60 * 1000;\n    return (\n      text.trim() === this.lastHeartbeatText.trim() &&\n      Date.now() - this.lastHeartbeatAt < DEDUP_WINDOW_MS\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;aAgBqD;AAGrD,MAAM,MAAM,aAAa,mBAAmB;AAE5C,MAAM,iBACJ;AAiBF,SAAS,kBAAkB,KAAgD;CACzE,MAAM,IAAI,KAAK,SAAS;AACxB,QAAO;EACL,SAAS,GAAG,WAAW;EACvB,YAAY,GAAG,cAAc;EAC7B,QAAQ,GAAG;EACX,cAAc,GAAG;EACjB,QAAQ,GAAG;EACX,aAAa,GAAG;EAChB,iBAAiB,GAAG;EACpB,aAAa,GAAG;EACjB;;;AAIH,SAAgB,gCAAgC,KAAoC;AAClF,QAAO,kBAAkB,IAAI;;AAY/B,IAAa,mBAAb,MAA8B;CAC5B,aAA4D;CAC5D;CACA,oBAA4B;CAC5B,kBAA0B;CAC1B,eAAqD;CAErD,YAAY,MAAoC;AAA5B,OAAA,OAAA;AAClB,OAAK,OAAO,qBAAqB,YAAY,KAAK,iBAAiB,QAAQ,CAAC;;CAG9E,MAAM,QAAqC;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,OAAI,KAAK,qBAAqB;AAC9B,QAAK,eAAe;AACpB;;AAGF,OAAK,eAAe;AACpB,MAAI,KAAK,EAAE,YAAY,OAAO,YAAY,EAAE,0CAA0C;AAEtF,OAAK,aAAa,kBAAkB;AAClC,QAAK,KAAK,QAAQ,EAAE,QAAQ,YAAY,CAAC;KACxC,OAAO,WAAW;AACrB,OAAK,WAAW,SAAS;;;CAI3B,WAAW,MAAkC;AAC3C,OAAK,KAAK,QAAQ,EAAE,QAAQ,MAAM,UAAU,UAAU,CAAC;;CAGzD,OAAa;AACX,MAAI,KAAK,YAAY;AACnB,iBAAc,KAAK,WAAW;AAC9B,QAAK,aAAa;;AAEpB,OAAK,KAAK,MAAM;AAChB,OAAK,eAAe;AACpB,MAAI,KAAK,oBAAoB;;CAG/B,aAAa,QAAsB;EACjC,MAAM,SAAS,kBAAkB,OAAO;AACxC,OAAK,MAAM;AACX,MAAI,OAAO,QACT,MAAK,MAAM,OAAO;AAEpB,MAAI,KAAK,2BAA2B;;CAGtC,YAAqB;AACnB,SAAO,KAAK,eAAe;;CAG7B,MAAc,iBAAiB,SAAkC;EAC/D,MAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,IAAI;EAE1D,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,KAAK,SAAS;AACjB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,6BAA6B;AACnE;;AAGF,MAAI;GACF,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,YAAY;AACxD,OAAI,MACF;IAAE,aAAa,QAAQ;IAAa,aAAa,QAAQ;IAAa,EACtE,0BACD;UACK;AAIR,MAAI,IAAI,eAAe,CAAC,oBAAoB,IAAI,YAAY,EAAE;AAC5D,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,yCAAyC;AAC/E;;EAGF,MAAM,gBAAgB,uBAAuB,KAAK,KAAK,WAAW,CAAC;AACnE,MAAI,CAAC,eAAe;AAClB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,sCAAsC;AAC5E;;EAEF,IAAI;AACJ,MAAI;GACF,MAAM,MAAM,MAAM,SAAS,eAAe,QAAQ;AAClD,OAAI,wBAAwB,IAAI,EAAE;AAChC,QAAI,MAAM;KAAE,MAAM;KAAe,SAAS;KAAe,EAAE,uCAAuC;AAClG;;AAEF,sBAAmB,IAAI,MAAM;UACvB;AACN,OAAI,MAAM;IAAE,MAAM;IAAe,SAAS;IAAe,EAAE,8CAA8C;;EAG3G,MAAM,aAAa,IAAI,kBACnB,sBAAsB,KAAK,KAAK,KAChC;EAEJ,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,gBAAgB,MAAM;AAC9D,MAAI,iBACF,cAAa,GAAG,WAAW,0BAA0B,iBAAiB;AAExE,eAAa,qBAAqB,YAAY,QAAQ;EACtD,MAAM,SAAS,GAAG,WAAW,qCAAoB,IAAI,MAAM,EAAC,aAAa;EAEzE,MAAM,SAAS,IAAI,eAAA;AAEnB,MAAI,MAAM;GAAE;GAAY,SAAS;GAAe,EAAE,4BAA4B;AAK9E,MAAI,eAAe,iBACjB,KAAI;AACF,SAAM,KAAK,KAAK,aAAa,KAAK,YAAY,EAAE,CAAC;WAC1C,KAAK;AACZ,OAAI,KAAK;IAAE;IAAK;IAAY,EAAE,qDAAqD;;EAIvF,IAAI;AACJ,MAAI;AACF,WAAQ,MAAM,KAAK,KAAK,aAAa,eAAe,cAAc,QAAQ,WAAW;WAC9E,OAAO;AACd,OAAI,MAAM,EAAE,KAAK,OAAO,EAAE,+BAA+B;AACzD;;AAGF,MAAI,CAAC,OAAO,MAAM,EAAE;AAClB,OAAI,MAAM,EAAE,SAAS,eAAe,EAAE,sCAAsC;AAC5E;;AAGF,MAAI,cAAc,OAAO,OAAO,EAAE;AAChC,OAAI,KACF;IAAE;IAAQ,YAAY,MAAM;IAAQ,SAAS;IAAe,EAC5D,0DACD;AACD;;EAGF,MAAM,EAAE,aAAa,oBAAoB,MAAM;EAC/C,MAAM,YAAY,YAAY,MAAM,MAAM;AAE1C,MAAI,KAAK,YAAY,UAAU,EAAE;AAC/B,OAAI,KACF;IAAE,gBAAgB,UAAU;IAAQ,SAAS;IAAe,EAC5D,6CACD;AACD;;EAGF,MAAM,SAAS,IAAI,QAAQ,MAAM;EACjC,MAAM,eAAe,IAAI,cAAc,MAAM;AAG7C,MAF0B,QAAQ,UAAU,aAEvB,EAAE;AACrB,SAAM,KAAK,KAAK,WAAW,gBAAgB;IACzC,SAAS;IACT,SAAS;IACT,SAAS;IACT,MAAM;IACP,CAAC;AACF,OAAI,KACF;IACE,SAAS;IACT,SAAS;IACT,QAAQ;IACR,cAAc,UAAU;IACzB,EACD,oCACD;QAED,KAAI,KACF;GAAE,SAAS;GAAe,gBAAgB,UAAU;GAAQ,EAC5D,yFACD;AAGH,OAAK,oBAAoB;AACzB,OAAK,kBAAkB,KAAK,KAAK;;CAGnC,YAAoB,MAAuB;AAEzC,SACE,KAAK,MAAM,KAAK,KAAK,kBAAkB,MAAM,IAC7C,KAAK,KAAK,GAAG,KAAK,kBAHI,OAAU,KAAK"}

package/dist/src/gateway/hono/app.js

@@ -4,11 +4,11 @@ import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from ".
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { maxWebchatAgentRequestBodyBytes } from "../chat-limits.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
-import { createFixedWindowRateLimiter } from "../../infra/rate-limit.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
+import { createStrictRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { registerPublicExtensionAssetRoutes } from "./routes/auth-registry-extensions.js";
@@ -43,7 +43,10 @@ function createHonoApp(config) {
 		tunnelPublicUrl: loadTunnelState()?.publicUrl
 	});
 	app.use(logContextMiddleware());
-	app.use(logger());
+	app.use(logger({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}));
 	app.use(cors({
 		origin: (origin) => {
 			const allowed = resolveBrowserOrigins();
@@ -95,9 +98,11 @@ function createHonoApp(config) {
 		if (!result.ok) {
 			log.warn({
 				origin,
+				requestHost: c.req.header("host"),
 				reason: "reason" in result ? result.reason : "unknown",
-				path: c.req.path
-			}, "Browser origin check failed");
+				path: c.req.path,
+				method: c.req.method
+			}, `Browser origin check failed: ${origin} not in allowed list`);
 			return c.json({
 				error: "Forbidden",
 				message: "Origin not allowed"
@@ -108,6 +113,10 @@ function createHonoApp(config) {
 	app.use("/api/skills/upload", bodyLimit({
 		maxSize: 10 * 1024 * 1024,
 		onError: (c) => {
+			log.warn({
+				path: c.req.path,
+				maxSizeMb: 10
+			}, "Request body too large: skills upload exceeds 10MB limit");
 			return c.json({
 				error: "Skill package too large",
 				maxSize: "10MB"
@@ -121,10 +130,16 @@ function createHonoApp(config) {
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,
-			onError: (ctx) => ctx.json({
-				error: "Request body too large",
-				maxSize: `${maxSizeMb}MB`
-			}, 413)
+			onError: (ctx) => {
+				log.warn({
+					path: ctx.req.path,
+					maxSizeMb
+				}, `Request body too large: exceeds ${maxSizeMb}MB limit`);
+				return ctx.json({
+					error: "Request body too large",
+					maxSize: `${maxSizeMb}MB`
+				}, 413);
+			}
 		})(c, next);
 	});
 	registerPublicGatewayRoutes(app, service);
@@ -146,36 +161,12 @@ function createHonoApp(config) {
 		})
 	}));
 	authenticated.use(operatorScopes());
-	const STRICT_RATE_LIMIT_MAX = 15;
-	const STRICT_RATE_LIMIT_WINDOW_MS = 6e4;
-	const strictRateLimiter = /* @__PURE__ */ new Map();
-	setInterval(() => {
-		for (const [ip, limiter] of strictRateLimiter.entries()) if (limiter.consume().remaining === STRICT_RATE_LIMIT_MAX - 1) strictRateLimiter.delete(ip);
-	}, 300 * 1e3);
 	registerAuthenticatedRoutes(app, authenticated, {
 		service,
-		strictRateLimitMiddleware: createMiddleware(async (c, next) => {
-			const clientIp = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? c.req.header("x-real-ip") ?? "unknown";
-			let limiter = strictRateLimiter.get(clientIp);
-			if (!limiter) {
-				limiter = createFixedWindowRateLimiter({
-					maxRequests: STRICT_RATE_LIMIT_MAX,
-					windowMs: STRICT_RATE_LIMIT_WINDOW_MS
-				});
-				strictRateLimiter.set(clientIp, limiter);
-			}
-			const result = limiter.consume();
-			if (!result.allowed) {
-				log.warn({
-					clientIp,
-					retryAfterMs: result.retryAfterMs
-				}, "Rate limit exceeded");
-				c.header("Retry-After", String(Math.ceil(result.retryAfterMs / 1e3)));
-				return c.json({ error: "Too many requests" }, 429);
-			}
-			c.header("X-RateLimit-Remaining", String(result.remaining));
-			await next();
-		}),
+		strictRateLimitMiddleware: createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
+			trustedProxies: service.currentConfig.gateway?.trustedProxies,
+			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+		}) }),
 		sseConfig: {
 			service,
 			maxSseConnections: service.currentConfig.gateway.maxSseConnections
@@ -188,10 +179,22 @@ function createHonoApp(config) {
 	}, "Static UI cache prewarmed");
 	app.route("/", authenticated);
 	app.notFound((c) => {
+		const isApiRoute = c.req.path.startsWith("/api/");
+		const fields = {
+			path: c.req.path,
+			method: c.req.method
+		};
+		if (isApiRoute) log.warn(fields, "Route not found");
+		else log.debug(fields, "Route not found");
 		return c.json({ error: "Not found" }, 404);
 	});
 	app.onError((err, c) => {
-		log.error({ err }, "Hono error");
+		log.error({
+			err,
+			path: c.req.path,
+			method: c.req.method,
+			userAgent: c.req.header("user-agent")
+		}, `Hono error on ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`);
 		return c.json({ error: "Internal server error" }, 500);
 	});
 	return app;

package/dist/src/gateway/hono/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createFixedWindowRateLimiter } from '../../infra/rate-limit.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nimport { resetLazyRouteBundlesForTests } from './routes/lazy-fallback.js';\nimport { prewarmStaticUiCache } from './lib/static-ui.js';\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  if (process.env.VITEST) {\n    resetLazyRouteBundlesForTests();\n  }\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n    });\n\n  app.use(logContextMiddleware());\n  app.use(logger());\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        { origin, reason: 'reason' in result ? result.reason : 'unknown', path: c.req.path },\n        'Browser origin check failed',\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) =>\n        ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413),\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const STRICT_RATE_LIMIT_MAX = 15;\n  const STRICT_RATE_LIMIT_WINDOW_MS = 60_000;\n\n  const strictRateLimiter = new Map<string, ReturnType<typeof createFixedWindowRateLimiter>>();\n\n  const RATE_LIMIT_CLEANUP_INTERVAL = 5 * 60 * 1000;\n  setInterval(() => {\n    for (const [ip, limiter] of strictRateLimiter.entries()) {\n      const result = limiter.consume();\n      if (result.remaining === STRICT_RATE_LIMIT_MAX - 1) {\n        strictRateLimiter.delete(ip);\n      }\n    }\n  }, RATE_LIMIT_CLEANUP_INTERVAL);\n\n  const strictRateLimitMiddleware = createMiddleware(async (c, next) => {\n    const clientIp = c.req.header('x-forwarded-for')?.split(',')[0]?.trim()\n      ?? c.req.header('x-real-ip')\n      ?? 'unknown';\n\n    let limiter = strictRateLimiter.get(clientIp);\n    if (!limiter) {\n      limiter = createFixedWindowRateLimiter({\n        maxRequests: STRICT_RATE_LIMIT_MAX,\n        windowMs: STRICT_RATE_LIMIT_WINDOW_MS,\n      });\n      strictRateLimiter.set(clientIp, limiter);\n    }\n\n    const result = limiter.consume();\n    if (!result.allowed) {\n      log.warn({ clientIp, retryAfterMs: result.retryAfterMs }, 'Rate limit exceeded');\n      c.header('Retry-After', String(Math.ceil(result.retryAfterMs / 1000)));\n      return c.json({ error: 'Too many requests' }, 429);\n    }\n\n    c.header('X-RateLimit-Remaining', String(result.remaining));\n    await next();\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  const prewarm = prewarmStaticUiCache();\n  if (prewarm.loaded > 0) {\n    log.debug({ loaded: prewarm.loaded, missing: prewarm.missing }, 'Static UI cache prewarmed');\n  }\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error({ err }, 'Hono error');\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;aAOqD;AAgBrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;AACzD,KAAI,QAAQ,IAAI,OACd,gCAA+B;CAEjC,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACrC,CAAC;AAEJ,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,QAAQ,CAAC;AACjB,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IAAE;IAAQ,QAAQ,YAAY,SAAS,OAAO,SAAS;IAAW,MAAM,EAAE,IAAI;IAAM,EACpF,8BACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QACR,IAAI,KAAK;IAAE,OAAO;IAA0B,SAAS,GAAG,UAAU;IAAK,EAAE,IAAI;GAChF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;CAEnC,MAAM,wBAAwB;CAC9B,MAAM,8BAA8B;CAEpC,MAAM,oCAAoB,IAAI,KAA8D;AAG5F,mBAAkB;AAChB,OAAK,MAAM,CAAC,IAAI,YAAY,kBAAkB,SAAS,CAErD,KADe,QAAQ,SACb,CAAC,cAAc,wBAAwB,EAC/C,mBAAkB,OAAO,GAAG;IALE,MAAS,IAQd;AAgC/B,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BAhCgC,iBAAiB,OAAO,GAAG,SAAS;GACpE,MAAM,WAAW,EAAE,IAAI,OAAO,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAClE,EAAE,IAAI,OAAO,YAAY,IACzB;GAEL,IAAI,UAAU,kBAAkB,IAAI,SAAS;AAC7C,OAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B;KACrC,aAAa;KACb,UAAU;KACX,CAAC;AACF,sBAAkB,IAAI,UAAU,QAAQ;;GAG1C,MAAM,SAAS,QAAQ,SAAS;AAChC,OAAI,CAAC,OAAO,SAAS;AACnB,QAAI,KAAK;KAAE;KAAU,cAAc,OAAO;KAAc,EAAE,sBAAsB;AAChF,MAAE,OAAO,eAAe,OAAO,KAAK,KAAK,OAAO,eAAe,IAAK,CAAC,CAAC;AACtE,WAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;;AAGpD,KAAE,OAAO,yBAAyB,OAAO,OAAO,UAAU,CAAC;AAC3D,SAAM,MAAM;IAUa;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;CAEF,MAAM,UAAU,sBAAsB;AACtC,KAAI,QAAQ,SAAS,EACnB,KAAI,MAAM;EAAE,QAAQ,QAAQ;EAAQ,SAAS,QAAQ;EAAS,EAAE,4BAA4B;AAG9F,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;AAClB,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MAAM,EAAE,KAAK,EAAE,aAAa;AAChC,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}
+{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { createStrictRateLimitMiddleware } from './middleware/strict-rate-limit.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nimport { resetLazyRouteBundlesForTests } from './routes/lazy-fallback.js';\nimport { prewarmStaticUiCache } from './lib/static-ui.js';\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  if (process.env.VITEST) {\n    resetLazyRouteBundlesForTests();\n  }\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n    });\n\n  app.use(logContextMiddleware());\n  app.use(logger({\n    trustedProxies: service.currentConfig.gateway?.trustedProxies,\n    allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n  }));\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        {\n          origin,\n          requestHost: c.req.header('host'),\n          reason: 'reason' in result ? result.reason : 'unknown',\n          path: c.req.path,\n          method: c.req.method,\n        },\n        `Browser origin check failed: ${origin} not in allowed list`,\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      log.warn({ path: c.req.path, maxSizeMb: 10 }, 'Request body too large: skills upload exceeds 10MB limit');\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) => {\n        log.warn({ path: ctx.req.path, maxSizeMb }, `Request body too large: exceeds ${maxSizeMb}MB limit`);\n        return ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413);\n      },\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimitMiddleware = createStrictRateLimitMiddleware({\n    getTrustedProxyContext: () => ({\n      trustedProxies: service.currentConfig.gateway?.trustedProxies,\n      allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n    }),\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  const prewarm = prewarmStaticUiCache();\n  if (prewarm.loaded > 0) {\n    log.debug({ loaded: prewarm.loaded, missing: prewarm.missing }, 'Static UI cache prewarmed');\n  }\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    const isApiRoute = c.req.path.startsWith('/api/');\n    const fields = { path: c.req.path, method: c.req.method };\n    if (isApiRoute) {\n      log.warn(fields, 'Route not found');\n    } else {\n      log.debug(fields, 'Route not found');\n    }\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error(\n      {\n        err,\n        path: c.req.path,\n        method: c.req.method,\n        userAgent: c.req.header('user-agent'),\n      },\n      `Hono error on ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;aAMqD;AAiBrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;AACzD,KAAI,QAAQ,IAAI,OACd,gCAA+B;CAEjC,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACrC,CAAC;AAEJ,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,OAAO;EACb,gBAAgB,QAAQ,cAAc,SAAS;EAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;EAC7E,CAAC,CAAC;AACH,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IACE;IACA,aAAa,EAAE,IAAI,OAAO,OAAO;IACjC,QAAQ,YAAY,SAAS,OAAO,SAAS;IAC7C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACf,EACD,gCAAgC,OAAO,sBACxC;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,OAAI,KAAK;IAAE,MAAM,EAAE,IAAI;IAAM,WAAW;IAAI,EAAE,2DAA2D;AACzG,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QAAQ;AAChB,QAAI,KAAK;KAAE,MAAM,IAAI,IAAI;KAAM;KAAW,EAAE,mCAAmC,UAAU,UAAU;AACnG,WAAO,IAAI,KAAK;KAAE,OAAO;KAA0B,SAAS,GAAG,UAAU;KAAK,EAAE,IAAI;;GAEvF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;AAcnC,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BAdgC,gCAAgC,EAChE,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E,GACF,CAS0B;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;CAEF,MAAM,UAAU,sBAAsB;AACtC,KAAI,QAAQ,SAAS,EACnB,KAAI,MAAM;EAAE,QAAQ,QAAQ;EAAQ,SAAS,QAAQ;EAAS,EAAE,4BAA4B;AAG9F,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;EAClB,MAAM,aAAa,EAAE,IAAI,KAAK,WAAW,QAAQ;EACjD,MAAM,SAAS;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;AACzD,MAAI,WACF,KAAI,KAAK,QAAQ,kBAAkB;MAEnC,KAAI,MAAM,QAAQ,kBAAkB;AAEtC,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MACF;GACE;GACA,MAAM,EAAE,IAAI;GACZ,QAAQ,EAAE,IAAI;GACd,WAAW,EAAE,IAAI,OAAO,aAAa;GACtC,EACD,iBAAiB,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;AACD,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}

package/dist/src/gateway/hono/lib/extension-store.js

@@ -1,7 +1,7 @@
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { readFile } from "node:fs/promises";
 //#region src/gateway/hono/lib/extension-store.ts
 init_write_file_atomic();
 /** Extension UI: write-through JSON KV per namespace under ~/.xopc/extensions/{namespace}/storage.json */

package/dist/src/gateway/hono/lib/static-ui.js

@@ -1,6 +1,6 @@
-import { dirname, resolve } from "node:path";
-import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/gateway/hono/lib/static-ui.ts
 const __dirname = dirname(fileURLToPath(import.meta.url));

package/dist/src/gateway/hono/middleware/auth.d.ts

@@ -10,22 +10,13 @@ export interface AuthConfig {
         allowRealIpFallback?: boolean;
     };
 }
-/**
- * Create auth middleware for HTTP routes
- */
 export declare function auth(config?: AuthConfig): import("hono/dist/types/types.js").MiddlewareHandler<any, string, {}, (Response & import("hono/dist/types/types.js").TypedResponse<{
     error: string;
+    code: string;
     message: string;
-}, 401, "json">) | (Response & import("hono/dist/types/types.js").TypedResponse<{
+    retryAfter: number;
+}, 429, "json">) | (Response & import("hono/dist/types/types.js").TypedResponse<{
     error: string;
+    code: string;
     message: string;
-    retryAfter: number;
-}, 429, "json">)>;
-export interface WebSocketAuthResult {
-    valid: boolean;
-    error?: string;
-}
-/**
- * Validate WebSocket connection token
- */
-export declare function validateWebSocketAuth(url: URL, authHeader: string | null, expectedToken?: string): WebSocketAuthResult;
+}, 401, "json">)>;