@xopcai/xopc 0.0.81 → 0.0.83

package/dist/src/gateway/hono/routes/auth-registry-extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-registry-extensions.js","names":["extensionMarketplace.searchExtensions","extensionMarketplace.listExtensions","extensionMarketplace.fetchRegistry"],"sources":["../../../../../src/gateway/hono/routes/auth-registry-extensions.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { relative, resolve } from 'node:path';\n\nimport type { Config as SurfaceConfig } from '../../../config/config-surface.js';\nimport type { GatewayService } from '../../service.js';\nimport { buildWhenContextSnapshot } from '../../../extensions/when-context.js';\nimport * as extensionMarketplace from '../../../extensions/marketplace.js';\nimport { mergeActivationContext } from '../../../extensions/activation-context.js';\nimport { ActivationPlanner } from '../../../extensions/activation-planner.js';\nimport { getAllModels, getAvailableModels, type Model, type Api } from '../../../providers/index.js';\nimport { createOAuthHandler, loadOAuthCredentialsToCache } from '../oauth.js';\nimport { createOAuthAsyncHandler } from '../oauth-async.js';\nimport { extensionAssetMimeType } from '../lib/extension-assets.js';\nimport { loadExtensionStore, saveExtensionStore } from '../lib/extension-store.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst EXTENSION_ASSET_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self' 'unsafe-inline'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"connect-src 'none'; \" +\n  \"frame-ancestors 'self'; \" +\n  \"frame-src 'none'; \" +\n  \"base-uri 'none'; \" +\n  \"object-src 'none'; \" +\n  \"form-action 'none'\";\n\n/** Sandboxed extension iframes send `Origin: null`; echo it (and real origins) so every status includes ACAO. */\nfunction extensionUiAssetCorsAllowOrigin(c: { req: { header: (name: string) => string | undefined } }): string {\n  const origin = c.req.header('origin');\n  if (origin === 'null') return 'null';\n  if (origin) return origin;\n  return '*';\n}\n\nfunction rewriteExtensionAssetHtml(html: string, extensionId: string, assetPath: string): string {\n  const assetDir = assetPath.includes('/') ? assetPath.slice(0, assetPath.lastIndexOf('/') + 1) : '';\n  const assetBase = `/api/extensions/${extensionId}/assets/${assetDir}`;\n\n  return html\n    .replace(/(<script\\b[^>]*?\\ssrc=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedSrc = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedSrc}${quote} crossorigin=\"anonymous\"`;\n    })\n    .replace(/(<link\\b[^>]*?\\shref=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedHref = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedHref}${quote}`;\n    });\n}\n\nfunction hasNonEmptyConfigSchema(schema: unknown): boolean {\n  if (!schema || typeof schema !== 'object') return false;\n  const properties = (schema as { properties?: unknown }).properties;\n  return Boolean(properties && typeof properties === 'object' && Object.keys(properties).length > 0);\n}\n\n/**\n * Register extension UI asset routes on the public (unauthenticated) app.\n *\n * Sandboxed iframes (`sandbox=\"allow-scripts …\"` without `allow-same-origin`) have an\n * opaque origin of `null`, so sub-resource requests from inside the iframe cannot\n * carry the `?token=` query parameter that was on the parent HTML URL. Putting these\n * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.\n *\n * Security is maintained by the strict Content-Security-Policy returned with every\n * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway\n * console itself from embedding the extension iframes.\n */\nexport function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/extensions/:id/assets/*', async (c) => {\n    const acao = extensionUiAssetCorsAllowOrigin(c);\n    const corsHdr = { 'Access-Control-Allow-Origin': acao } as const;\n\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503, corsHdr);\n    }\n\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext || !ext.manifest.ui) {\n      return c.json({ error: 'Extension not found or has no UI' }, 404, corsHdr);\n    }\n\n    const prefix = `/api/extensions/${extensionId}/assets/`;\n    const assetPathEncoded = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : '';\n    let assetPath = assetPathEncoded;\n    try {\n      assetPath = decodeURIComponent(assetPathEncoded);\n    } catch {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    if (!assetPath || assetPath.includes('..')) {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    const root = resolve(ext.path);\n    const fullPath = resolve(root, assetPath);\n    const rel = relative(root, fullPath);\n    if (rel.startsWith('..') || rel === '') {\n      return c.json({ error: 'Path traversal denied' }, 403, corsHdr);\n    }\n\n    if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n      return c.json({ error: 'Not found' }, 404, corsHdr);\n    }\n\n    const rawContent = readFileSync(fullPath);\n    const mimeType = extensionAssetMimeType(assetPath);\n\n    const body: string | Uint8Array = mimeType.startsWith('text/html')\n      ? rewriteExtensionAssetHtml(rawContent.toString('utf-8'), extensionId, assetPath)\n      : new Uint8Array(rawContent);\n\n    return new Response(body, {\n      status: 200,\n      headers: {\n        'Content-Type': mimeType,\n        'Content-Security-Policy': EXTENSION_ASSET_CSP,\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n        'Access-Control-Allow-Origin': acao,\n      },\n    });\n  });\n}\n\nexport function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  // ========== Auth API (/api/auth) ==========\n\n  // GET /api/auth/token - Get current gateway token\n  authenticated.get('/api/auth/token', (c) => {\n    const authToken = service.getAuthToken();\n    return c.json({ \n      ok: true, \n      payload: { \n        token: authToken,\n        mode: service.getAuthMode(),\n      } \n    });\n  });\n\n  // POST /api/auth/token/refresh - Generate new gateway token\n  authenticated.post('/api/auth/token/refresh', async (c) => {\n    try {\n      const newToken = await service.refreshAuthToken();\n      return c.json({ \n        ok: true, \n        payload: { \n          token: newToken,\n          message: 'Token refreshed successfully. Please update your client configuration.'\n        } \n      });\n    } catch (err) {\n      return c.json({ \n        ok: false, \n        error: err instanceof Error ? err.message : 'Failed to refresh token' \n      }, 500);\n    }\n  });\n\n  // ========== OAuth API (/api/auth/oauth) ==========\n  authenticated.route('/api/auth/oauth', createOAuthHandler(service));\n\n  // ========== Async OAuth API (/api/auth/oauth-async) ==========\n  authenticated.route('/api/auth/oauth-async', createOAuthAsyncHandler(service));\n\n  // Load OAuth credentials from config into cache on startup\n  loadOAuthCredentialsToCache(service);\n\n  // ========== Registry API ==========\n  \n  // GET /api/registry - Full registry for frontend\n  authenticated.get('/api/registry', async (c) => {\n    const allModels = getAllModels();\n    const availableModels = await getAvailableModels();\n    const configured = new Set(availableModels.map(m => `${m.provider}/${m.id}`));\n    \n    // Group models by provider\n    const providerMap = new Map<string, Model<Api>[]>();\n    for (const model of allModels) {\n      const list = providerMap.get(model.provider) ?? [];\n      list.push(model);\n      providerMap.set(model.provider, list);\n    }\n    \n    return c.json({\n      ok: true,\n      payload: {\n        version: 'pi-ai',\n        providers: Array.from(providerMap.entries()).map(([id, models]) => ({\n          id,\n          name: id.charAt(0).toUpperCase() + id.slice(1),\n          configured: models.some(m => configured.has(`${m.provider}/${m.id}`)),\n          models: models.map(m => ({\n            ref: `${m.provider}/${m.id}`,\n            id: m.id,\n            name: m.name,\n            provider: m.provider,\n            reasoning: m.reasoning ?? false,\n            input: m.input ?? ['text'],\n            contextWindow: m.contextWindow ?? 128000,\n            maxTokens: m.maxTokens ?? 4096,\n            cost: {\n              input: m.cost?.input ?? 0,\n              output: m.cost?.output ?? 0,\n            },\n            available: configured.has(`${m.provider}/${m.id}`),\n          })),\n        })),\n      },\n    });\n  });\n\n  // ========== Extension UI (manifest discovery + static assets) ==========\n\n  authenticated.get('/api/extensions', async (c) => {\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ extensions: [] });\n    }\n\n    const registry = loader.getRegistry();\n    const discovered = loader.discoverExtensions();\n    const activeIds = new Set<string>();\n    for (const [id] of registry.extensions) {\n      activeIds.add(id);\n    }\n\n    loader.setConfig(service.currentConfig as unknown as SurfaceConfig);\n    let activationEligibleIds: Set<string> = new Set();\n    try {\n      const planner = new ActivationPlanner(loader.buildManifestRegistry());\n      activationEligibleIds = new Set(\n        planner.getActivatedIds(mergeActivationContext(service.currentConfig as unknown as SurfaceConfig)),\n      );\n    } catch {\n      activationEligibleIds = new Set();\n    }\n\n    const extensions = discovered.map((ext) => ({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      active: activeIds.has(ext.id),\n      activationEligible: activationEligibleIds.has(ext.id),\n      hasUi: Boolean(ext.manifest.ui),\n      hasConfigSchema: hasNonEmptyConfigSchema(ext.manifest.configSchema),\n      ui: ext.manifest.ui\n        ? {\n            icon: ext.manifest.ui.icon,\n            permissions: ext.manifest.ui.permissions,\n            contributions: ext.manifest.ui.contributions,\n          }\n        : undefined,\n    }));\n    return c.json({ extensions });\n  });\n\n  /**\n   * Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.\n   * Body: `{ extensionId: string, enabled: boolean }`\n   */\n  authenticated.post('/api/extensions/bundled/activation', strictRateLimitMiddleware, async (c) => {\n    const body = (await c.req.json().catch(() => null)) as\n      | { extensionId?: unknown; enabled?: unknown }\n      | null;\n    const extensionId =\n      typeof body?.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: { message: 'extensionId is required' } }, 400);\n    }\n    if (typeof body?.enabled !== 'boolean') {\n      return c.json({ ok: false, error: { message: 'enabled must be a boolean' } }, 400);\n    }\n    const result = await service.setBundledExtensionActivationTarget(extensionId, body.enabled);\n    if (!result.ok) {\n      return c.json({ ok: false, error: { message: result.error ?? 'Request failed' } }, 400);\n    }\n    return c.json({\n      ok: true,\n      payload: { requiresGatewayRestart: result.requiresGatewayRestart },\n    });\n  });\n\n  authenticated.get('/api/extensions/:id', async (c) => {\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503);\n    }\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext) {\n      return c.json({ error: 'Extension not found' }, 404);\n    }\n    const registry = loader.getRegistry();\n    return c.json({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      path: ext.path,\n      active: registry.extensions.has(ext.id),\n      manifest: ext.manifest,\n    });\n  });\n\n  authenticated.get('/api/extensions/:id/storage', async (c) => {\n    const extensionId = c.req.param('id');\n    const store = await loadExtensionStore(extensionId);\n    return c.json({ keys: Object.keys(store) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    if (!(key in store)) {\n      return c.json({ error: 'Key not found' }, 404);\n    }\n    return c.json({ value: store[key] });\n  });\n\n  authenticated.put('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null;\n    if (body === null || !('value' in body)) {\n      return c.json({ error: 'Request body must contain a \"value\" field' }, 400);\n    }\n    const store = await loadExtensionStore(extensionId);\n    store[key] = body.value;\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.delete('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    delete store[key];\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    return c.json(await loadExtensionStore(`__config__${extensionId}`));\n  });\n\n  authenticated.patch('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    const patch = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;\n    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {\n      return c.json({ error: 'Request body must be a JSON object' }, 400);\n    }\n    const namespace = `__config__${extensionId}`;\n    const config = await loadExtensionStore(namespace);\n    Object.assign(config, patch);\n    await saveExtensionStore(namespace, config);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/context', (c) => {\n    const loader = service.getExtensionLoader();\n    const snapshot = buildWhenContextSnapshot(\n      service.currentConfig as unknown as SurfaceConfig,\n      loader,\n    );\n    return c.json(snapshot);\n  });\n\n  authenticated.get('/api/marketplace', async (c) => {\n    const q = c.req.query('q');\n    const category = c.req.query('category');\n    try {\n      let extensions;\n      if (typeof q === 'string' && q.trim()) {\n        extensions = await extensionMarketplace.searchExtensions(q.trim());\n      } else if (typeof category === 'string' && category.trim()) {\n        extensions = await extensionMarketplace.listExtensions(category.trim());\n      } else {\n        const reg = await extensionMarketplace.fetchRegistry();\n        extensions = reg.extensions;\n      }\n      return c.json({ ok: true, extensions });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          extensions: [],\n          error: err instanceof Error ? err.message : 'marketplace fetch failed',\n        },\n        500,\n      );\n    }\n  });\n\n  authenticated.get('/api/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const payload = await service.fetchExtensionMarketplacePackageDetail(pkgName);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/install', strictRateLimitMiddleware, async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true || body.overwrite === 'true' || body.overwrite === '1';\n    if (!name) {\n      return c.json(\n        { ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' },\n        400,\n      );\n    }\n    try {\n      const payload = await service.installExtensionFromMarketplace({ name, version, overwrite });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/uninstall', strictRateLimitMiddleware, async (c) => {\n    let body: { extensionId?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const extensionId = typeof body.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: 'Expected { extensionId: string }' }, 400);\n    }\n    try {\n      const payload = await service.uninstallUserExtension(extensionId);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Uninstall failed' },\n        400,\n      );\n    }\n  });\n\n  // POST /api/registry/reload — reload gateway config and refresh model list for clients\n  authenticated.post('/api/registry/reload', async (c) => {\n    try {\n      // Reload config\n      await service.reloadConfig();\n      \n      // Reload OAuth credentials from new config\n      loadOAuthCredentialsToCache(service);\n      \n      const models = getAllModels();\n      \n      // Emit SSE event to all connected clients\n      service.emit('registry.updated', { modelCount: models.length });\n      \n      return c.json({\n        ok: true,\n        payload: {\n          message: 'Registry reloaded',\n          modelCount: models.length,\n        },\n      });\n    } catch (err) {\n      return c.json({\n        error: err instanceof Error ? err.message : 'Failed to reload registry',\n      }, 500);\n    }\n  });\n\n}\n"],"mappings":";;;;;;;;;;;;gBAUqG;AAOrG,MAAM,sBACJ;;AAYF,SAAS,gCAAgC,GAAsE;CAC7G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,KAAI,WAAW,OAAQ,QAAO;AAC9B,KAAI,OAAQ,QAAO;AACnB,QAAO;;AAGT,SAAS,0BAA0B,MAAc,aAAqB,WAA2B;CAE/F,MAAM,YAAY,mBAAmB,YAAY,UADhC,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,UAAU,YAAY,IAAI,GAAG,EAAE,GAAG;AAGhG,QAAO,KACJ,QAAQ,qDAAqD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI/F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GAClD,OAAO,GAAG,YAAY,SACjB,MAAM;GAC5C,CACD,QAAQ,oDAAoD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI9F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GACjD,OAAO,GAAG,YAAY,SACjB;GACvC;;AAGN,SAAS,wBAAwB,QAA0B;AACzD,KAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;CAClD,MAAM,aAAc,OAAoC;AACxD,QAAO,QAAQ,cAAc,OAAO,eAAe,YAAY,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE;;;;;;;;;;;;;;AAepG,SAAgB,mCAAmC,KAAW,SAA+B;AAC3F,KAAI,IAAI,gCAAgC,OAAO,MAAM;EACnD,MAAM,OAAO,gCAAgC,EAAE;EAC/C,MAAM,UAAU,EAAE,+BAA+B,MAAM;EAEvD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,KAAK,QAAQ;EAIlE,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,OAAO,CAAC,IAAI,SAAS,GACxB,QAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,EAAE,KAAK,QAAQ;EAG5E,MAAM,SAAS,mBAAmB,YAAY;EAC9C,MAAM,mBAAmB,EAAE,IAAI,KAAK,WAAW,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,OAAO,OAAO,GAAG;EAC3F,IAAI,YAAY;AAChB,MAAI;AACF,eAAY,mBAAmB,iBAAiB;UAC1C;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;;AAG9D,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,CACxC,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;EAG9D,MAAM,OAAO,QAAQ,IAAI,KAAK;EAC9B,MAAM,WAAW,QAAQ,MAAM,UAAU;EACzC,MAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,IAAI,WAAW,KAAK,IAAI,QAAQ,GAClC,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,KAAK,QAAQ;AAGjE,MAAI,CAAC,WAAW,SAAS,IAAI,CAAC,SAAS,SAAS,CAAC,QAAQ,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,KAAK,QAAQ;EAGrD,MAAM,aAAa,aAAa,SAAS;EACzC,MAAM,WAAW,uBAAuB,UAAU;EAElD,MAAM,OAA4B,SAAS,WAAW,YAAY,GAC9D,0BAA0B,WAAW,SAAS,QAAQ,EAAE,aAAa,UAAU,GAC/E,IAAI,WAAW,WAAW;AAE9B,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,2BAA2B;IAC3B,iBAAiB;IACjB,0BAA0B;IAC1B,+BAA+B;IAChC;GACF,CAAC;GACF;;AAGJ,SAAgB,qCAAqC,eAAqB,MAAoC;CAC5G,MAAM,EAAE,SAAS,8BAA8B;AAK/C,eAAc,IAAI,oBAAoB,MAAM;EAC1C,MAAM,YAAY,QAAQ,cAAc;AACxC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,OAAO;IACP,MAAM,QAAQ,aAAa;IAC5B;GACF,CAAC;GACF;AAGF,eAAc,KAAK,2BAA2B,OAAO,MAAM;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,kBAAkB;AACjD,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,OAAO;KACP,SAAS;KACV;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EAAE,IAAI;;GAET;AAGF,eAAc,MAAM,mBAAmB,mBAAmB,QAAQ,CAAC;AAGnE,eAAc,MAAM,yBAAyB,wBAAwB,QAAQ,CAAC;AAQ9E,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,YAAY,cAAc;EAChC,MAAM,kBAAkB,MAAM,oBAAoB;EAClD,MAAM,aAAa,IAAI,IAAI,gBAAgB,KAAI,MAAK,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;EAG7E,MAAM,8BAAc,IAAI,KAA2B;AACnD,OAAK,MAAM,SAAS,WAAW;GAC7B,MAAM,OAAO,YAAY,IAAI,MAAM,SAAS,IAAI,EAAE;AAClD,QAAK,KAAK,MAAM;AAChB,eAAY,IAAI,MAAM,UAAU,KAAK;;AAGvC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,SAAS;IACT,WAAW,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,aAAa;KAClE;KACA,MAAM,GAAG,OAAO,EAAE,CAAC,aAAa,GAAG,GAAG,MAAM,EAAE;KAC9C,YAAY,OAAO,MAAK,MAAK,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;KACrE,QAAQ,OAAO,KAAI,OAAM;MACvB,KAAK,GAAG,EAAE,SAAS,GAAG,EAAE;MACxB,IAAI,EAAE;MACN,MAAM,EAAE;MACR,UAAU,EAAE;MACZ,WAAW,EAAE,aAAa;MAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;MAC1B,eAAe,EAAE,iBAAiB;MAClC,WAAW,EAAE,aAAa;MAC1B,MAAM;OACJ,OAAO,EAAE,MAAM,SAAS;OACxB,QAAQ,EAAE,MAAM,UAAU;OAC3B;MACD,WAAW,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK;MACnD,EAAE;KACJ,EAAE;IACJ;GACF,CAAC;GACF;AAIF,eAAc,IAAI,mBAAmB,OAAO,MAAM;EAChD,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;EAGnC,MAAM,WAAW,OAAO,aAAa;EACrC,MAAM,aAAa,OAAO,oBAAoB;EAC9C,MAAM,4BAAY,IAAI,KAAa;AACnC,OAAK,MAAM,CAAC,OAAO,SAAS,WAC1B,WAAU,IAAI,GAAG;AAGnB,SAAO,UAAU,QAAQ,cAA0C;EACnE,IAAI,wCAAqC,IAAI,KAAK;AAClD,MAAI;GACF,MAAM,UAAU,IAAI,kBAAkB,OAAO,uBAAuB,CAAC;AACrE,2BAAwB,IAAI,IAC1B,QAAQ,gBAAgB,uBAAuB,QAAQ,cAA0C,CAAC,CACnG;UACK;AACN,2CAAwB,IAAI,KAAK;;EAGnC,MAAM,aAAa,WAAW,KAAK,SAAS;GAC1C,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,QAAQ,UAAU,IAAI,IAAI,GAAG;GAC7B,oBAAoB,sBAAsB,IAAI,IAAI,GAAG;GACrD,OAAO,QAAQ,IAAI,SAAS,GAAG;GAC/B,iBAAiB,wBAAwB,IAAI,SAAS,aAAa;GACnE,IAAI,IAAI,SAAS,KACb;IACE,MAAM,IAAI,SAAS,GAAG;IACtB,aAAa,IAAI,SAAS,GAAG;IAC7B,eAAe,IAAI,SAAS,GAAG;IAChC,GACD,KAAA;GACL,EAAE;AACH,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;;;;;AAMF,eAAc,KAAK,sCAAsC,2BAA2B,OAAO,MAAM;EAC/F,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAGlD,MAAM,cACJ,OAAO,MAAM,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACpE,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2BAA2B;GAAE,EAAE,IAAI;AAElF,MAAI,OAAO,MAAM,YAAY,UAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6BAA6B;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,MAAM,QAAQ,oCAAoC,aAAa,KAAK,QAAQ;AAC3F,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,SAAS,kBAAkB;GAAE,EAAE,IAAI;AAEzF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,wBAAwB,OAAO,wBAAwB;GACnE,CAAC;GACF;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,EAAE,IAAI;EAEtD,MAAM,WAAW,OAAO,aAAa;AACrC,SAAO,EAAE,KAAK;GACZ,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,MAAM,IAAI;GACV,QAAQ,SAAS,WAAW,IAAI,IAAI,GAAG;GACvC,UAAU,IAAI;GACf,CAAC;GACF;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAE5D,MAAM,QAAQ,MAAM,mBADA,EAAE,IAAI,MAAM,KACkB,CAAC;AACnD,SAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;GAC3C;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,MAAI,EAAE,OAAO,OACX,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AAEhD,SAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,CAAC;GACpC;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAClD,MAAI,SAAS,QAAQ,EAAE,WAAW,MAChC,QAAO,EAAE,KAAK,EAAE,OAAO,+CAA6C,EAAE,IAAI;EAE5E,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,QAAM,OAAO,KAAK;AAClB,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,OAAO,oCAAoC,OAAO,MAAM;EACpE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,SAAO,MAAM;AACb,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,MAAM,mBAAmB,aAAa,cAAc,CAAC;GACnE;AAEF,eAAc,MAAM,8BAA8B,OAAO,MAAM;EAC7D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,QAAS,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACnD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,EAAE,IAAI;EAErE,MAAM,YAAY,aAAa;EAC/B,MAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,SAAO,OAAO,QAAQ,MAAM;AAC5B,QAAM,mBAAmB,WAAW,OAAO;AAC3C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,iBAAiB,MAAM;EACvC,MAAM,SAAS,QAAQ,oBAAoB;EAC3C,MAAM,WAAW,yBACf,QAAQ,eACR,OACD;AACD,SAAO,EAAE,KAAK,SAAS;GACvB;AAEF,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI;EAC1B,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AACxC,MAAI;GACF,IAAI;AACJ,OAAI,OAAO,MAAM,YAAY,EAAE,MAAM,CACnC,cAAa,MAAMA,iBAAsC,EAAE,MAAM,CAAC;YACzD,OAAO,aAAa,YAAY,SAAS,MAAM,CACxD,cAAa,MAAMC,eAAoC,SAAS,MAAM,CAAC;OAGvE,eAAa,MADKC,eAAoC,EACrC;AAEnB,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAY,CAAC;WAChC,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,YAAY,EAAE;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EACD,IACD;;GAEH;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,uCAAuC,QAAQ;AAC7E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,4BAA4B,2BAA2B,OAAO,MAAM;EACrF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,cAAc;AAC7E,MAAI,CAAC,KACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;GAAoE,EACxF,IACD;AAEH,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,gCAAgC;IAAE;IAAM;IAAS;IAAW,CAAC;AAC3F,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,8BAA8B,2BAA2B,OAAO,MAAM;EACvF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACrF,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;AAE9E,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,uBAAuB,YAAY;AACjE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAoB,EAC7E,IACD;;GAEH;AAGF,eAAc,KAAK,wBAAwB,OAAO,MAAM;AACtD,MAAI;AAEF,SAAM,QAAQ,cAAc;GAK5B,MAAM,SAAS,cAAc;AAG7B,WAAQ,KAAK,oBAAoB,EAAE,YAAY,OAAO,QAAQ,CAAC;AAE/D,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT,YAAY,OAAO;KACpB;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,6BAC7C,EAAE,IAAI;;GAET"}
+{"version":3,"file":"auth-registry-extensions.js","names":["extensionMarketplace.searchExtensions","extensionMarketplace.listExtensions","extensionMarketplace.fetchRegistry"],"sources":["../../../../../src/gateway/hono/routes/auth-registry-extensions.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { relative, resolve } from 'node:path';\n\nimport type { Config as SurfaceConfig } from '../../../config/config-surface.js';\nimport type { GatewayService } from '../../service.js';\nimport { buildWhenContextSnapshot } from '../../../extensions/when-context.js';\nimport * as extensionMarketplace from '../../../extensions/marketplace.js';\nimport { mergeActivationContext } from '../../../extensions/activation-context.js';\nimport { ActivationPlanner } from '../../../extensions/activation-planner.js';\nimport { getAllModels, getAvailableModels, type Model, type Api } from '../../../providers/index.js';\nimport { createOAuthHandler, loadOAuthCredentialsToCache } from '../oauth.js';\nimport { createOAuthAsyncHandler } from '../oauth-async.js';\nimport { extensionAssetMimeType } from '../lib/extension-assets.js';\nimport { loadExtensionStore, saveExtensionStore } from '../lib/extension-store.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst EXTENSION_ASSET_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self' 'unsafe-inline'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"connect-src 'none'; \" +\n  \"frame-ancestors 'self'; \" +\n  \"frame-src 'none'; \" +\n  \"base-uri 'none'; \" +\n  \"object-src 'none'; \" +\n  \"form-action 'none'\";\n\n/** Sandboxed extension iframes send `Origin: null`; echo it (and real origins) so every status includes ACAO. */\nfunction extensionUiAssetCorsAllowOrigin(c: { req: { header: (name: string) => string | undefined } }): string {\n  const origin = c.req.header('origin');\n  if (origin === 'null') return 'null';\n  if (origin) return origin;\n  return '*';\n}\n\nfunction rewriteExtensionAssetHtml(html: string, extensionId: string, assetPath: string): string {\n  const assetDir = assetPath.includes('/') ? assetPath.slice(0, assetPath.lastIndexOf('/') + 1) : '';\n  const assetBase = `/api/extensions/${extensionId}/assets/${assetDir}`;\n\n  return html\n    .replace(/(<script\\b[^>]*?\\ssrc=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedSrc = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedSrc}${quote} crossorigin=\"anonymous\"`;\n    })\n    .replace(/(<link\\b[^>]*?\\shref=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedHref = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedHref}${quote}`;\n    });\n}\n\nfunction hasNonEmptyConfigSchema(schema: unknown): boolean {\n  if (!schema || typeof schema !== 'object') return false;\n  const properties = (schema as { properties?: unknown }).properties;\n  return Boolean(properties && typeof properties === 'object' && Object.keys(properties).length > 0);\n}\n\n/**\n * Register extension UI asset routes on the public (unauthenticated) app.\n *\n * Sandboxed iframes (`sandbox=\"allow-scripts …\"` without `allow-same-origin`) have an\n * opaque origin of `null`, so sub-resource requests from inside the iframe cannot\n * carry the `?token=` query parameter that was on the parent HTML URL. Putting these\n * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.\n *\n * Security is maintained by the strict Content-Security-Policy returned with every\n * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway\n * console itself from embedding the extension iframes.\n */\nexport function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/extensions/:id/assets/*', async (c) => {\n    const acao = extensionUiAssetCorsAllowOrigin(c);\n    const corsHdr = { 'Access-Control-Allow-Origin': acao } as const;\n\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503, corsHdr);\n    }\n\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext || !ext.manifest.ui) {\n      return c.json({ error: 'Extension not found or has no UI' }, 404, corsHdr);\n    }\n\n    const prefix = `/api/extensions/${extensionId}/assets/`;\n    const assetPathEncoded = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : '';\n    let assetPath = assetPathEncoded;\n    try {\n      assetPath = decodeURIComponent(assetPathEncoded);\n    } catch {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    if (!assetPath || assetPath.includes('..')) {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    const root = resolve(ext.path);\n    const fullPath = resolve(root, assetPath);\n    const rel = relative(root, fullPath);\n    if (rel.startsWith('..') || rel === '') {\n      return c.json({ error: 'Path traversal denied' }, 403, corsHdr);\n    }\n\n    if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n      return c.json({ error: 'Not found' }, 404, corsHdr);\n    }\n\n    const rawContent = readFileSync(fullPath);\n    const mimeType = extensionAssetMimeType(assetPath);\n\n    const body: string | Uint8Array = mimeType.startsWith('text/html')\n      ? rewriteExtensionAssetHtml(rawContent.toString('utf-8'), extensionId, assetPath)\n      : new Uint8Array(rawContent);\n\n    return new Response(body, {\n      status: 200,\n      headers: {\n        'Content-Type': mimeType,\n        'Content-Security-Policy': EXTENSION_ASSET_CSP,\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n        'Access-Control-Allow-Origin': acao,\n      },\n    });\n  });\n}\n\nexport function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  // ========== Auth API (/api/auth) ==========\n\n  // GET /api/auth/token - Get current gateway token\n  authenticated.get('/api/auth/token', (c) => {\n    const authToken = service.getAuthToken();\n    return c.json({ \n      ok: true, \n      payload: { \n        token: authToken,\n        mode: service.getAuthMode(),\n      } \n    });\n  });\n\n  // POST /api/auth/token/refresh - Generate new gateway token\n  authenticated.post('/api/auth/token/refresh', async (c) => {\n    try {\n      const newToken = await service.refreshAuthToken();\n      return c.json({ \n        ok: true, \n        payload: { \n          token: newToken,\n          message: 'Token refreshed successfully. Please update your client configuration.'\n        } \n      });\n    } catch (err) {\n      return c.json({ \n        ok: false, \n        error: err instanceof Error ? err.message : 'Failed to refresh token' \n      }, 500);\n    }\n  });\n\n  // ========== OAuth API (/api/auth/oauth) ==========\n  authenticated.route('/api/auth/oauth', createOAuthHandler(service));\n\n  // ========== Async OAuth API (/api/auth/oauth-async) ==========\n  authenticated.route('/api/auth/oauth-async', createOAuthAsyncHandler(service));\n\n  // Load OAuth credentials from config into cache on startup\n  loadOAuthCredentialsToCache(service);\n\n  // ========== Registry API ==========\n  \n  // GET /api/registry - Full registry for frontend\n  authenticated.get('/api/registry', async (c) => {\n    const allModels = getAllModels();\n    const availableModels = await getAvailableModels();\n    const configured = new Set(availableModels.map(m => `${m.provider}/${m.id}`));\n    \n    // Group models by provider\n    const providerMap = new Map<string, Model<Api>[]>();\n    for (const model of allModels) {\n      const list = providerMap.get(model.provider) ?? [];\n      list.push(model);\n      providerMap.set(model.provider, list);\n    }\n    \n    return c.json({\n      ok: true,\n      payload: {\n        version: 'pi-ai',\n        providers: Array.from(providerMap.entries()).map(([id, models]) => ({\n          id,\n          name: id.charAt(0).toUpperCase() + id.slice(1),\n          configured: models.some(m => configured.has(`${m.provider}/${m.id}`)),\n          models: models.map(m => ({\n            ref: `${m.provider}/${m.id}`,\n            id: m.id,\n            name: m.name,\n            provider: m.provider,\n            reasoning: m.reasoning ?? false,\n            input: m.input ?? ['text'],\n            contextWindow: m.contextWindow ?? 128000,\n            maxTokens: m.maxTokens ?? 4096,\n            cost: {\n              input: m.cost?.input ?? 0,\n              output: m.cost?.output ?? 0,\n            },\n            available: configured.has(`${m.provider}/${m.id}`),\n          })),\n        })),\n      },\n    });\n  });\n\n  // ========== Extension UI (manifest discovery + static assets) ==========\n\n  authenticated.get('/api/extensions', async (c) => {\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ extensions: [] });\n    }\n\n    const registry = loader.getRegistry();\n    const discovered = loader.discoverExtensions();\n    const activeIds = new Set<string>();\n    for (const [id] of registry.extensions) {\n      activeIds.add(id);\n    }\n\n    loader.setConfig(service.currentConfig as unknown as SurfaceConfig);\n    let activationEligibleIds: Set<string> = new Set();\n    try {\n      const planner = new ActivationPlanner(loader.buildManifestRegistry());\n      activationEligibleIds = new Set(\n        planner.getActivatedIds(mergeActivationContext(service.currentConfig as unknown as SurfaceConfig)),\n      );\n    } catch {\n      activationEligibleIds = new Set();\n    }\n\n    const extensions = discovered.map((ext) => ({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      active: activeIds.has(ext.id),\n      activationEligible: activationEligibleIds.has(ext.id),\n      hasUi: Boolean(ext.manifest.ui),\n      hasConfigSchema: hasNonEmptyConfigSchema(ext.manifest.configSchema),\n      ui: ext.manifest.ui\n        ? {\n            icon: ext.manifest.ui.icon,\n            permissions: ext.manifest.ui.permissions,\n            contributions: ext.manifest.ui.contributions,\n          }\n        : undefined,\n    }));\n    return c.json({ extensions });\n  });\n\n  /**\n   * Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.\n   * Body: `{ extensionId: string, enabled: boolean }`\n   */\n  authenticated.post('/api/extensions/bundled/activation', strictRateLimitMiddleware, async (c) => {\n    const body = (await c.req.json().catch(() => null)) as\n      | { extensionId?: unknown; enabled?: unknown }\n      | null;\n    const extensionId =\n      typeof body?.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: { message: 'extensionId is required' } }, 400);\n    }\n    if (typeof body?.enabled !== 'boolean') {\n      return c.json({ ok: false, error: { message: 'enabled must be a boolean' } }, 400);\n    }\n    const result = await service.setBundledExtensionActivationTarget(extensionId, body.enabled);\n    if (!result.ok) {\n      return c.json({ ok: false, error: { message: result.error ?? 'Request failed' } }, 400);\n    }\n    return c.json({\n      ok: true,\n      payload: { requiresGatewayRestart: result.requiresGatewayRestart },\n    });\n  });\n\n  authenticated.get('/api/extensions/:id', async (c) => {\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503);\n    }\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext) {\n      return c.json({ error: 'Extension not found' }, 404);\n    }\n    const registry = loader.getRegistry();\n    return c.json({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      path: ext.path,\n      active: registry.extensions.has(ext.id),\n      manifest: ext.manifest,\n    });\n  });\n\n  authenticated.get('/api/extensions/:id/storage', async (c) => {\n    const extensionId = c.req.param('id');\n    const store = await loadExtensionStore(extensionId);\n    return c.json({ keys: Object.keys(store) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    if (!(key in store)) {\n      return c.json({ error: 'Key not found' }, 404);\n    }\n    return c.json({ value: store[key] });\n  });\n\n  authenticated.put('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null;\n    if (body === null || !('value' in body)) {\n      return c.json({ error: 'Request body must contain a \"value\" field' }, 400);\n    }\n    const store = await loadExtensionStore(extensionId);\n    store[key] = body.value;\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.delete('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    delete store[key];\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    return c.json(await loadExtensionStore(`__config__${extensionId}`));\n  });\n\n  authenticated.patch('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    const patch = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;\n    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {\n      return c.json({ error: 'Request body must be a JSON object' }, 400);\n    }\n    const namespace = `__config__${extensionId}`;\n    const config = await loadExtensionStore(namespace);\n    Object.assign(config, patch);\n    await saveExtensionStore(namespace, config);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/context', (c) => {\n    const loader = service.getExtensionLoader();\n    const snapshot = buildWhenContextSnapshot(\n      service.currentConfig as unknown as SurfaceConfig,\n      loader,\n    );\n    return c.json(snapshot);\n  });\n\n  authenticated.get('/api/marketplace', async (c) => {\n    const q = c.req.query('q');\n    const category = c.req.query('category');\n    try {\n      let extensions;\n      if (typeof q === 'string' && q.trim()) {\n        extensions = await extensionMarketplace.searchExtensions(q.trim());\n      } else if (typeof category === 'string' && category.trim()) {\n        extensions = await extensionMarketplace.listExtensions(category.trim());\n      } else {\n        const reg = await extensionMarketplace.fetchRegistry();\n        extensions = reg.extensions;\n      }\n      return c.json({ ok: true, extensions });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          extensions: [],\n          error: err instanceof Error ? err.message : 'marketplace fetch failed',\n        },\n        500,\n      );\n    }\n  });\n\n  authenticated.get('/api/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.fetchExtensionPackageDetail(pkgName);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/install', strictRateLimitMiddleware, async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true || body.overwrite === 'true' || body.overwrite === '1';\n    if (!name) {\n      return c.json(\n        { ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' },\n        400,\n      );\n    }\n    try {\n      const payload = await service.marketplace.installExtension({ name, version, overwrite });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/uninstall', strictRateLimitMiddleware, async (c) => {\n    let body: { extensionId?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const extensionId = typeof body.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: 'Expected { extensionId: string }' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.uninstallExtension(extensionId);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Uninstall failed' },\n        400,\n      );\n    }\n  });\n\n  // POST /api/registry/reload — reload gateway config and refresh model list for clients\n  authenticated.post('/api/registry/reload', async (c) => {\n    try {\n      // Reload config\n      await service.reloadConfig();\n      \n      // Reload OAuth credentials from new config\n      loadOAuthCredentialsToCache(service);\n      \n      const models = getAllModels();\n      \n      // Emit SSE event to all connected clients\n      service.emit('registry.updated', { modelCount: models.length });\n      \n      return c.json({\n        ok: true,\n        payload: {\n          message: 'Registry reloaded',\n          modelCount: models.length,\n        },\n      });\n    } catch (err) {\n      return c.json({\n        error: err instanceof Error ? err.message : 'Failed to reload registry',\n      }, 500);\n    }\n  });\n\n}\n"],"mappings":";;;;;;;;;;;;gBAUqG;AAOrG,MAAM,sBACJ;;AAYF,SAAS,gCAAgC,GAAsE;CAC7G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,KAAI,WAAW,OAAQ,QAAO;AAC9B,KAAI,OAAQ,QAAO;AACnB,QAAO;;AAGT,SAAS,0BAA0B,MAAc,aAAqB,WAA2B;CAE/F,MAAM,YAAY,mBAAmB,YAAY,UADhC,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,UAAU,YAAY,IAAI,GAAG,EAAE,GAAG;AAGhG,QAAO,KACJ,QAAQ,qDAAqD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI/F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GAClD,OAAO,GAAG,YAAY,SACjB,MAAM;GAC5C,CACD,QAAQ,oDAAoD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI9F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GACjD,OAAO,GAAG,YAAY,SACjB;GACvC;;AAGN,SAAS,wBAAwB,QAA0B;AACzD,KAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;CAClD,MAAM,aAAc,OAAoC;AACxD,QAAO,QAAQ,cAAc,OAAO,eAAe,YAAY,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE;;;;;;;;;;;;;;AAepG,SAAgB,mCAAmC,KAAW,SAA+B;AAC3F,KAAI,IAAI,gCAAgC,OAAO,MAAM;EACnD,MAAM,OAAO,gCAAgC,EAAE;EAC/C,MAAM,UAAU,EAAE,+BAA+B,MAAM;EAEvD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,KAAK,QAAQ;EAIlE,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,OAAO,CAAC,IAAI,SAAS,GACxB,QAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,EAAE,KAAK,QAAQ;EAG5E,MAAM,SAAS,mBAAmB,YAAY;EAC9C,MAAM,mBAAmB,EAAE,IAAI,KAAK,WAAW,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,OAAO,OAAO,GAAG;EAC3F,IAAI,YAAY;AAChB,MAAI;AACF,eAAY,mBAAmB,iBAAiB;UAC1C;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;;AAG9D,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,CACxC,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;EAG9D,MAAM,OAAO,QAAQ,IAAI,KAAK;EAC9B,MAAM,WAAW,QAAQ,MAAM,UAAU;EACzC,MAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,IAAI,WAAW,KAAK,IAAI,QAAQ,GAClC,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,KAAK,QAAQ;AAGjE,MAAI,CAAC,WAAW,SAAS,IAAI,CAAC,SAAS,SAAS,CAAC,QAAQ,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,KAAK,QAAQ;EAGrD,MAAM,aAAa,aAAa,SAAS;EACzC,MAAM,WAAW,uBAAuB,UAAU;EAElD,MAAM,OAA4B,SAAS,WAAW,YAAY,GAC9D,0BAA0B,WAAW,SAAS,QAAQ,EAAE,aAAa,UAAU,GAC/E,IAAI,WAAW,WAAW;AAE9B,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,2BAA2B;IAC3B,iBAAiB;IACjB,0BAA0B;IAC1B,+BAA+B;IAChC;GACF,CAAC;GACF;;AAGJ,SAAgB,qCAAqC,eAAqB,MAAoC;CAC5G,MAAM,EAAE,SAAS,8BAA8B;AAK/C,eAAc,IAAI,oBAAoB,MAAM;EAC1C,MAAM,YAAY,QAAQ,cAAc;AACxC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,OAAO;IACP,MAAM,QAAQ,aAAa;IAC5B;GACF,CAAC;GACF;AAGF,eAAc,KAAK,2BAA2B,OAAO,MAAM;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,kBAAkB;AACjD,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,OAAO;KACP,SAAS;KACV;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EAAE,IAAI;;GAET;AAGF,eAAc,MAAM,mBAAmB,mBAAmB,QAAQ,CAAC;AAGnE,eAAc,MAAM,yBAAyB,wBAAwB,QAAQ,CAAC;AAQ9E,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,YAAY,cAAc;EAChC,MAAM,kBAAkB,MAAM,oBAAoB;EAClD,MAAM,aAAa,IAAI,IAAI,gBAAgB,KAAI,MAAK,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;EAG7E,MAAM,8BAAc,IAAI,KAA2B;AACnD,OAAK,MAAM,SAAS,WAAW;GAC7B,MAAM,OAAO,YAAY,IAAI,MAAM,SAAS,IAAI,EAAE;AAClD,QAAK,KAAK,MAAM;AAChB,eAAY,IAAI,MAAM,UAAU,KAAK;;AAGvC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,SAAS;IACT,WAAW,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,aAAa;KAClE;KACA,MAAM,GAAG,OAAO,EAAE,CAAC,aAAa,GAAG,GAAG,MAAM,EAAE;KAC9C,YAAY,OAAO,MAAK,MAAK,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;KACrE,QAAQ,OAAO,KAAI,OAAM;MACvB,KAAK,GAAG,EAAE,SAAS,GAAG,EAAE;MACxB,IAAI,EAAE;MACN,MAAM,EAAE;MACR,UAAU,EAAE;MACZ,WAAW,EAAE,aAAa;MAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;MAC1B,eAAe,EAAE,iBAAiB;MAClC,WAAW,EAAE,aAAa;MAC1B,MAAM;OACJ,OAAO,EAAE,MAAM,SAAS;OACxB,QAAQ,EAAE,MAAM,UAAU;OAC3B;MACD,WAAW,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK;MACnD,EAAE;KACJ,EAAE;IACJ;GACF,CAAC;GACF;AAIF,eAAc,IAAI,mBAAmB,OAAO,MAAM;EAChD,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;EAGnC,MAAM,WAAW,OAAO,aAAa;EACrC,MAAM,aAAa,OAAO,oBAAoB;EAC9C,MAAM,4BAAY,IAAI,KAAa;AACnC,OAAK,MAAM,CAAC,OAAO,SAAS,WAC1B,WAAU,IAAI,GAAG;AAGnB,SAAO,UAAU,QAAQ,cAA0C;EACnE,IAAI,wCAAqC,IAAI,KAAK;AAClD,MAAI;GACF,MAAM,UAAU,IAAI,kBAAkB,OAAO,uBAAuB,CAAC;AACrE,2BAAwB,IAAI,IAC1B,QAAQ,gBAAgB,uBAAuB,QAAQ,cAA0C,CAAC,CACnG;UACK;AACN,2CAAwB,IAAI,KAAK;;EAGnC,MAAM,aAAa,WAAW,KAAK,SAAS;GAC1C,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,QAAQ,UAAU,IAAI,IAAI,GAAG;GAC7B,oBAAoB,sBAAsB,IAAI,IAAI,GAAG;GACrD,OAAO,QAAQ,IAAI,SAAS,GAAG;GAC/B,iBAAiB,wBAAwB,IAAI,SAAS,aAAa;GACnE,IAAI,IAAI,SAAS,KACb;IACE,MAAM,IAAI,SAAS,GAAG;IACtB,aAAa,IAAI,SAAS,GAAG;IAC7B,eAAe,IAAI,SAAS,GAAG;IAChC,GACD,KAAA;GACL,EAAE;AACH,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;;;;;AAMF,eAAc,KAAK,sCAAsC,2BAA2B,OAAO,MAAM;EAC/F,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAGlD,MAAM,cACJ,OAAO,MAAM,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACpE,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2BAA2B;GAAE,EAAE,IAAI;AAElF,MAAI,OAAO,MAAM,YAAY,UAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6BAA6B;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,MAAM,QAAQ,oCAAoC,aAAa,KAAK,QAAQ;AAC3F,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,SAAS,kBAAkB;GAAE,EAAE,IAAI;AAEzF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,wBAAwB,OAAO,wBAAwB;GACnE,CAAC;GACF;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,EAAE,IAAI;EAEtD,MAAM,WAAW,OAAO,aAAa;AACrC,SAAO,EAAE,KAAK;GACZ,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,MAAM,IAAI;GACV,QAAQ,SAAS,WAAW,IAAI,IAAI,GAAG;GACvC,UAAU,IAAI;GACf,CAAC;GACF;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAE5D,MAAM,QAAQ,MAAM,mBADA,EAAE,IAAI,MAAM,KACkB,CAAC;AACnD,SAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;GAC3C;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,MAAI,EAAE,OAAO,OACX,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AAEhD,SAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,CAAC;GACpC;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAClD,MAAI,SAAS,QAAQ,EAAE,WAAW,MAChC,QAAO,EAAE,KAAK,EAAE,OAAO,+CAA6C,EAAE,IAAI;EAE5E,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,QAAM,OAAO,KAAK;AAClB,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,OAAO,oCAAoC,OAAO,MAAM;EACpE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,SAAO,MAAM;AACb,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,MAAM,mBAAmB,aAAa,cAAc,CAAC;GACnE;AAEF,eAAc,MAAM,8BAA8B,OAAO,MAAM;EAC7D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,QAAS,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACnD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,EAAE,IAAI;EAErE,MAAM,YAAY,aAAa;EAC/B,MAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,SAAO,OAAO,QAAQ,MAAM;AAC5B,QAAM,mBAAmB,WAAW,OAAO;AAC3C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,iBAAiB,MAAM;EACvC,MAAM,SAAS,QAAQ,oBAAoB;EAC3C,MAAM,WAAW,yBACf,QAAQ,eACR,OACD;AACD,SAAO,EAAE,KAAK,SAAS;GACvB;AAEF,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI;EAC1B,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AACxC,MAAI;GACF,IAAI;AACJ,OAAI,OAAO,MAAM,YAAY,EAAE,MAAM,CACnC,cAAa,MAAMA,iBAAsC,EAAE,MAAM,CAAC;YACzD,OAAO,aAAa,YAAY,SAAS,MAAM,CACxD,cAAa,MAAMC,eAAoC,SAAS,MAAM,CAAC;OAGvE,eAAa,MADKC,eAAoC,EACrC;AAEnB,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAY,CAAC;WAChC,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,YAAY,EAAE;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EACD,IACD;;GAEH;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,4BAA4B,QAAQ;AAC9E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,4BAA4B,2BAA2B,OAAO,MAAM;EACrF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,cAAc;AAC7E,MAAI,CAAC,KACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;GAAoE,EACxF,IACD;AAEH,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,iBAAiB;IAAE;IAAM;IAAS;IAAW,CAAC;AACxF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,8BAA8B,2BAA2B,OAAO,MAAM;EACvF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACrF,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;AAE9E,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,mBAAmB,YAAY;AACzE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAoB,EAC7E,IACD;;GAEH;AAGF,eAAc,KAAK,wBAAwB,OAAO,MAAM;AACtD,MAAI;AAEF,SAAM,QAAQ,cAAc;GAK5B,MAAM,SAAS,cAAc;AAG7B,WAAQ,KAAK,oBAAoB,EAAE,YAAY,OAAO,QAAQ,CAAC;AAE/D,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT,YAAY,OAAO;KACpB;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,6BAC7C,EAAE,IAAI;;GAET"}

package/dist/src/gateway/hono/routes/browser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Browser/extension settings routes: `/api/browser/*` except for the
+ * long-running install streams under `/api/browser/{playwright,cloakbrowser}/install/stream`
+ * (those live in `browser-install.ts` so the SSE pump doesn't have to load
+ * with the rest of settings).
+ *
+ * Four backend families:
+ *   - **Extension WS bridge** — pair Chrome via the xopc browser extension.
+ *     Owns a module-scoped manual handle so the bridge can outlive a config
+ *     save (UI flow: Start → pair → Save).
+ *   - **CloakBrowser** — install / launch / probe runtime status.
+ *   - **Playwright Chromium** — doctor + on-demand install of bundled browser.
+ *   - **Local CDP** — launch / list / stop user-driven debug Chrome instances.
+ *   - **Cloud providers** (browserbase / browser-use) — connection test.
+ *
+ * Extracted from `config.ts` (which was 2237 lines and 80% browser routes).
+ */
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerBrowserRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;