@xopcai/xopc 0.0.82 → 0.0.83

package/dist/src/infra/rate-limit/failure-limiter.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Per-key brute-force protection limiter.
+ *
+ * Semantics:
+ *   - `fail(key)` records a failed attempt; reaching `maxFailures` within
+ *     `windowMs` triggers a `blockDurationMs` lockout.
+ *   - `succeed(key)` clears all state for the key (a successful auth wipes the
+ *     bucket so legitimate users aren't punished for prior typos).
+ *   - `check(key)` is read-only — returns the current block status.
+ *   - Failures from the same key within `burstCoalesceMs` collapse to a single
+ *     attempt. This absorbs SPA fan-out / SDK auto-retry storms without
+ *     weakening protection: a deliberate attacker is rate-limited to ~1
+ *     attempt/s per key, still astronomically slow against any token of
+ *     meaningful entropy.
+ *
+ * Pure counter — no policy knowledge (loopback exemption, key formatting,
+ * etc. all live in the policy layer that calls into this limiter).
+ */
+import { type Clock } from './keyed-store.js';
+export type FailureLimiterConfig = {
+    maxFailures: number;
+    windowMs: number;
+    blockDurationMs: number;
+    /** @default 1000 */
+    burstCoalesceMs?: number;
+    /** Retain idle keys for this long. @default `windowMs + blockDurationMs` */
+    staleAfterMs?: number;
+    clock?: Clock;
+};
+export type FailureCheck = {
+    blocked: false;
+} | {
+    blocked: true;
+    retryAfterSec: number;
+};
+export declare class FailureLimiter {
+    private readonly store;
+    private readonly clock;
+    private readonly maxFailures;
+    private readonly windowMs;
+    private readonly blockDurationMs;
+    private readonly burstCoalesceMs;
+    constructor(cfg: FailureLimiterConfig);
+    check(key: string): FailureCheck;
+    fail(key: string): void;
+    succeed(key: string): void;
+    /** @internal Test hook. */
+    resetForTests(): void;
+    destroy(): void;
+}

package/dist/src/infra/rate-limit/failure-limiter.js

@@ -0,0 +1,100 @@
+import { KeyedStore } from "./keyed-store.js";
+//#region src/infra/rate-limit/failure-limiter.ts
+/**
+* Per-key brute-force protection limiter.
+*
+* Semantics:
+*   - `fail(key)` records a failed attempt; reaching `maxFailures` within
+*     `windowMs` triggers a `blockDurationMs` lockout.
+*   - `succeed(key)` clears all state for the key (a successful auth wipes the
+*     bucket so legitimate users aren't punished for prior typos).
+*   - `check(key)` is read-only — returns the current block status.
+*   - Failures from the same key within `burstCoalesceMs` collapse to a single
+*     attempt. This absorbs SPA fan-out / SDK auto-retry storms without
+*     weakening protection: a deliberate attacker is rate-limited to ~1
+*     attempt/s per key, still astronomically slow against any token of
+*     meaningful entropy.
+*
+* Pure counter — no policy knowledge (loopback exemption, key formatting,
+* etc. all live in the policy layer that calls into this limiter).
+*/
+const DEFAULT_BURST_COALESCE_MS = 1e3;
+var FailureLimiter = class {
+	store;
+	clock;
+	maxFailures;
+	windowMs;
+	blockDurationMs;
+	burstCoalesceMs;
+	constructor(cfg) {
+		this.maxFailures = Math.max(1, Math.floor(cfg.maxFailures));
+		this.windowMs = Math.max(1e3, Math.floor(cfg.windowMs));
+		this.blockDurationMs = Math.max(1e3, Math.floor(cfg.blockDurationMs));
+		this.burstCoalesceMs = Math.max(0, Math.floor(cfg.burstCoalesceMs ?? DEFAULT_BURST_COALESCE_MS));
+		this.clock = cfg.clock ?? Date.now;
+		this.store = new KeyedStore({
+			staleAfterMs: cfg.staleAfterMs ?? this.windowMs + this.blockDurationMs,
+			clock: this.clock
+		});
+	}
+	check(key) {
+		const now = this.clock();
+		const state = this.store.get(key);
+		if (!state?.blockedUntil) return { blocked: false };
+		if (now >= state.blockedUntil) {
+			state.blockedUntil = void 0;
+			state.count = 0;
+			state.windowStart = now;
+			state.lastTouchedMs = now;
+			return { blocked: false };
+		}
+		return {
+			blocked: true,
+			retryAfterSec: Math.max(1, Math.ceil((state.blockedUntil - now) / 1e3))
+		};
+	}
+	fail(key) {
+		const now = this.clock();
+		let state = this.store.get(key);
+		if (!state) {
+			state = {
+				windowStart: now,
+				count: 0,
+				lastTouchedMs: now
+			};
+			this.store.set(key, state);
+		}
+		state.lastTouchedMs = now;
+		if (state.blockedUntil && now < state.blockedUntil) return;
+		if (state.blockedUntil && now >= state.blockedUntil) {
+			state.blockedUntil = void 0;
+			state.count = 0;
+			state.windowStart = now;
+		}
+		if (now - state.windowStart > this.windowMs) {
+			state.count = 0;
+			state.windowStart = now;
+		}
+		if (state.lastFailureAtMs !== void 0 && now - state.lastFailureAtMs < this.burstCoalesceMs) {
+			state.lastFailureAtMs = now;
+			return;
+		}
+		state.lastFailureAtMs = now;
+		state.count += 1;
+		if (state.count >= this.maxFailures) state.blockedUntil = now + this.blockDurationMs;
+	}
+	succeed(key) {
+		this.store.delete(key);
+	}
+	/** @internal Test hook. */
+	resetForTests() {
+		this.store.clear();
+	}
+	destroy() {
+		this.store.destroy();
+	}
+};
+//#endregion
+export { FailureLimiter };
+
+//# sourceMappingURL=failure-limiter.js.map

package/dist/src/infra/rate-limit/failure-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-limiter.js","names":[],"sources":["../../../../src/infra/rate-limit/failure-limiter.ts"],"sourcesContent":["/**\n * Per-key brute-force protection limiter.\n *\n * Semantics:\n *   - `fail(key)` records a failed attempt; reaching `maxFailures` within\n *     `windowMs` triggers a `blockDurationMs` lockout.\n *   - `succeed(key)` clears all state for the key (a successful auth wipes the\n *     bucket so legitimate users aren't punished for prior typos).\n *   - `check(key)` is read-only — returns the current block status.\n *   - Failures from the same key within `burstCoalesceMs` collapse to a single\n *     attempt. This absorbs SPA fan-out / SDK auto-retry storms without\n *     weakening protection: a deliberate attacker is rate-limited to ~1\n *     attempt/s per key, still astronomically slow against any token of\n *     meaningful entropy.\n *\n * Pure counter — no policy knowledge (loopback exemption, key formatting,\n * etc. all live in the policy layer that calls into this limiter).\n */\n\nimport { KeyedStore, type Clock } from './keyed-store.js';\n\nexport type FailureLimiterConfig = {\n  maxFailures: number;\n  windowMs: number;\n  blockDurationMs: number;\n  /** @default 1000 */\n  burstCoalesceMs?: number;\n  /** Retain idle keys for this long. @default `windowMs + blockDurationMs` */\n  staleAfterMs?: number;\n  clock?: Clock;\n};\n\nexport type FailureCheck =\n  | { blocked: false }\n  | { blocked: true; retryAfterSec: number };\n\ntype State = {\n  windowStart: number;\n  count: number;\n  blockedUntil?: number;\n  lastFailureAtMs?: number;\n  lastTouchedMs: number;\n};\n\nconst DEFAULT_BURST_COALESCE_MS = 1000;\n\nexport class FailureLimiter {\n  private readonly store: KeyedStore<State>;\n  private readonly clock: Clock;\n  private readonly maxFailures: number;\n  private readonly windowMs: number;\n  private readonly blockDurationMs: number;\n  private readonly burstCoalesceMs: number;\n\n  constructor(cfg: FailureLimiterConfig) {\n    this.maxFailures = Math.max(1, Math.floor(cfg.maxFailures));\n    this.windowMs = Math.max(1000, Math.floor(cfg.windowMs));\n    this.blockDurationMs = Math.max(1000, Math.floor(cfg.blockDurationMs));\n    this.burstCoalesceMs = Math.max(0, Math.floor(cfg.burstCoalesceMs ?? DEFAULT_BURST_COALESCE_MS));\n    this.clock = cfg.clock ?? Date.now;\n    this.store = new KeyedStore<State>({\n      staleAfterMs: cfg.staleAfterMs ?? this.windowMs + this.blockDurationMs,\n      clock: this.clock,\n    });\n  }\n\n  check(key: string): FailureCheck {\n    const now = this.clock();\n    const state = this.store.get(key);\n    if (!state?.blockedUntil) return { blocked: false };\n    if (now >= state.blockedUntil) {\n      state.blockedUntil = undefined;\n      state.count = 0;\n      state.windowStart = now;\n      state.lastTouchedMs = now;\n      return { blocked: false };\n    }\n    return {\n      blocked: true,\n      retryAfterSec: Math.max(1, Math.ceil((state.blockedUntil - now) / 1000)),\n    };\n  }\n\n  fail(key: string): void {\n    const now = this.clock();\n    let state = this.store.get(key);\n    if (!state) {\n      state = { windowStart: now, count: 0, lastTouchedMs: now };\n      this.store.set(key, state);\n    }\n\n    state.lastTouchedMs = now;\n\n    if (state.blockedUntil && now < state.blockedUntil) return;\n    if (state.blockedUntil && now >= state.blockedUntil) {\n      state.blockedUntil = undefined;\n      state.count = 0;\n      state.windowStart = now;\n    }\n\n    if (now - state.windowStart > this.windowMs) {\n      state.count = 0;\n      state.windowStart = now;\n    }\n\n    if (\n      state.lastFailureAtMs !== undefined &&\n      now - state.lastFailureAtMs < this.burstCoalesceMs\n    ) {\n      state.lastFailureAtMs = now;\n      return;\n    }\n\n    state.lastFailureAtMs = now;\n    state.count += 1;\n    if (state.count >= this.maxFailures) {\n      state.blockedUntil = now + this.blockDurationMs;\n    }\n  }\n\n  succeed(key: string): void {\n    this.store.delete(key);\n  }\n\n  /** @internal Test hook. */\n  resetForTests(): void {\n    this.store.clear();\n  }\n\n  destroy(): void {\n    this.store.destroy();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4CA,MAAM,4BAA4B;AAElC,IAAa,iBAAb,MAA4B;CAC1B;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,KAA2B;AACrC,OAAK,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,YAAY,CAAC;AAC3D,OAAK,WAAW,KAAK,IAAI,KAAM,KAAK,MAAM,IAAI,SAAS,CAAC;AACxD,OAAK,kBAAkB,KAAK,IAAI,KAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC;AACtE,OAAK,kBAAkB,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,mBAAmB,0BAA0B,CAAC;AAChG,OAAK,QAAQ,IAAI,SAAS,KAAK;AAC/B,OAAK,QAAQ,IAAI,WAAkB;GACjC,cAAc,IAAI,gBAAgB,KAAK,WAAW,KAAK;GACvD,OAAO,KAAK;GACb,CAAC;;CAGJ,MAAM,KAA2B;EAC/B,MAAM,MAAM,KAAK,OAAO;EACxB,MAAM,QAAQ,KAAK,MAAM,IAAI,IAAI;AACjC,MAAI,CAAC,OAAO,aAAc,QAAO,EAAE,SAAS,OAAO;AACnD,MAAI,OAAO,MAAM,cAAc;AAC7B,SAAM,eAAe,KAAA;AACrB,SAAM,QAAQ;AACd,SAAM,cAAc;AACpB,SAAM,gBAAgB;AACtB,UAAO,EAAE,SAAS,OAAO;;AAE3B,SAAO;GACL,SAAS;GACT,eAAe,KAAK,IAAI,GAAG,KAAK,MAAM,MAAM,eAAe,OAAO,IAAK,CAAC;GACzE;;CAGH,KAAK,KAAmB;EACtB,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,IAAI;AAC/B,MAAI,CAAC,OAAO;AACV,WAAQ;IAAE,aAAa;IAAK,OAAO;IAAG,eAAe;IAAK;AAC1D,QAAK,MAAM,IAAI,KAAK,MAAM;;AAG5B,QAAM,gBAAgB;AAEtB,MAAI,MAAM,gBAAgB,MAAM,MAAM,aAAc;AACpD,MAAI,MAAM,gBAAgB,OAAO,MAAM,cAAc;AACnD,SAAM,eAAe,KAAA;AACrB,SAAM,QAAQ;AACd,SAAM,cAAc;;AAGtB,MAAI,MAAM,MAAM,cAAc,KAAK,UAAU;AAC3C,SAAM,QAAQ;AACd,SAAM,cAAc;;AAGtB,MACE,MAAM,oBAAoB,KAAA,KAC1B,MAAM,MAAM,kBAAkB,KAAK,iBACnC;AACA,SAAM,kBAAkB;AACxB;;AAGF,QAAM,kBAAkB;AACxB,QAAM,SAAS;AACf,MAAI,MAAM,SAAS,KAAK,YACtB,OAAM,eAAe,MAAM,KAAK;;CAIpC,QAAQ,KAAmB;AACzB,OAAK,MAAM,OAAO,IAAI;;;CAIxB,gBAAsB;AACpB,OAAK,MAAM,OAAO;;CAGpB,UAAgB;AACd,OAAK,MAAM,SAAS"}

package/dist/src/infra/rate-limit/index.d.ts

@@ -0,0 +1,5 @@
+export { RateLimiter } from './rate-limiter.js';
+export type { RateLimiterConfig, RateLimitDecision } from './rate-limiter.js';
+export { FailureLimiter } from './failure-limiter.js';
+export type { FailureLimiterConfig, FailureCheck } from './failure-limiter.js';
+export type { Clock } from './keyed-store.js';

package/dist/src/infra/rate-limit/index.js

@@ -0,0 +1,3 @@
+import { RateLimiter } from "./rate-limiter.js";
+import { FailureLimiter } from "./failure-limiter.js";
+export { FailureLimiter, RateLimiter };

package/dist/src/infra/rate-limit/keyed-store.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Keyed in-memory store with periodic stale-entry sweep. Internal helper for
+ * the rate-limit primitives — keep it package-private (re-export only via
+ * `infra/rate-limit/index.ts` if a real consumer appears).
+ *
+ * Lifecycle: `new` → use → `destroy()`. Buckets created from this store are
+ * registered in the gateway's bucket registry, which calls `destroy()` on
+ * graceful shutdown so the cleanup timer doesn't leak.
+ */
+export type Clock = () => number;
+export type KeyedStoreOptions = {
+    /** Drop entries whose `lastTouchedMs` is older than this. */
+    staleAfterMs: number;
+    /** How often the sweep runs. Defaults to `staleAfterMs / 4` (capped at 10min). */
+    cleanupIntervalMs?: number;
+    /** Injected clock for deterministic tests. */
+    clock?: Clock;
+};
+export declare class KeyedStore<V extends {
+    lastTouchedMs: number;
+}> {
+    private readonly map;
+    private readonly clock;
+    private readonly staleAfterMs;
+    private cleanupTimer?;
+    constructor(opts: KeyedStoreOptions);
+    get(key: string): V | undefined;
+    set(key: string, value: V): void;
+    delete(key: string): void;
+    size(): number;
+    clear(): void;
+    destroy(): void;
+    private sweep;
+}

package/dist/src/infra/rate-limit/keyed-store.js

@@ -0,0 +1,44 @@
+//#region src/infra/rate-limit/keyed-store.ts
+var KeyedStore = class {
+	map = /* @__PURE__ */ new Map();
+	clock;
+	staleAfterMs;
+	cleanupTimer;
+	constructor(opts) {
+		this.clock = opts.clock ?? Date.now;
+		this.staleAfterMs = Math.max(1e3, opts.staleAfterMs);
+		const interval = Math.min(600 * 1e3, Math.max(1e3, opts.cleanupIntervalMs ?? Math.floor(this.staleAfterMs / 4)));
+		this.cleanupTimer = setInterval(() => this.sweep(), interval);
+		this.cleanupTimer.unref?.();
+	}
+	get(key) {
+		return this.map.get(key);
+	}
+	set(key, value) {
+		this.map.set(key, value);
+	}
+	delete(key) {
+		this.map.delete(key);
+	}
+	size() {
+		return this.map.size;
+	}
+	clear() {
+		this.map.clear();
+	}
+	destroy() {
+		if (this.cleanupTimer) {
+			clearInterval(this.cleanupTimer);
+			this.cleanupTimer = void 0;
+		}
+		this.map.clear();
+	}
+	sweep() {
+		const now = this.clock();
+		for (const [k, v] of this.map.entries()) if (now - v.lastTouchedMs > this.staleAfterMs) this.map.delete(k);
+	}
+};
+//#endregion
+export { KeyedStore };
+
+//# sourceMappingURL=keyed-store.js.map

package/dist/src/infra/rate-limit/keyed-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyed-store.js","names":[],"sources":["../../../../src/infra/rate-limit/keyed-store.ts"],"sourcesContent":["/**\n * Keyed in-memory store with periodic stale-entry sweep. Internal helper for\n * the rate-limit primitives — keep it package-private (re-export only via\n * `infra/rate-limit/index.ts` if a real consumer appears).\n *\n * Lifecycle: `new` → use → `destroy()`. Buckets created from this store are\n * registered in the gateway's bucket registry, which calls `destroy()` on\n * graceful shutdown so the cleanup timer doesn't leak.\n */\n\nexport type Clock = () => number;\n\nexport type KeyedStoreOptions = {\n  /** Drop entries whose `lastTouchedMs` is older than this. */\n  staleAfterMs: number;\n  /** How often the sweep runs. Defaults to `staleAfterMs / 4` (capped at 10min). */\n  cleanupIntervalMs?: number;\n  /** Injected clock for deterministic tests. */\n  clock?: Clock;\n};\n\nexport class KeyedStore<V extends { lastTouchedMs: number }> {\n  private readonly map = new Map<string, V>();\n  private readonly clock: Clock;\n  private readonly staleAfterMs: number;\n  private cleanupTimer?: NodeJS.Timeout;\n\n  constructor(opts: KeyedStoreOptions) {\n    this.clock = opts.clock ?? Date.now;\n    this.staleAfterMs = Math.max(1000, opts.staleAfterMs);\n    const interval = Math.min(\n      10 * 60 * 1000,\n      Math.max(1000, opts.cleanupIntervalMs ?? Math.floor(this.staleAfterMs / 4)),\n    );\n    this.cleanupTimer = setInterval(() => this.sweep(), interval);\n    this.cleanupTimer.unref?.();\n  }\n\n  get(key: string): V | undefined {\n    return this.map.get(key);\n  }\n\n  set(key: string, value: V): void {\n    this.map.set(key, value);\n  }\n\n  delete(key: string): void {\n    this.map.delete(key);\n  }\n\n  size(): number {\n    return this.map.size;\n  }\n\n  clear(): void {\n    this.map.clear();\n  }\n\n  destroy(): void {\n    if (this.cleanupTimer) {\n      clearInterval(this.cleanupTimer);\n      this.cleanupTimer = undefined;\n    }\n    this.map.clear();\n  }\n\n  private sweep(): void {\n    const now = this.clock();\n    for (const [k, v] of this.map.entries()) {\n      if (now - v.lastTouchedMs > this.staleAfterMs) {\n        this.map.delete(k);\n      }\n    }\n  }\n}\n"],"mappings":";AAqBA,IAAa,aAAb,MAA6D;CAC3D,sBAAuB,IAAI,KAAgB;CAC3C;CACA;CACA;CAEA,YAAY,MAAyB;AACnC,OAAK,QAAQ,KAAK,SAAS,KAAK;AAChC,OAAK,eAAe,KAAK,IAAI,KAAM,KAAK,aAAa;EACrD,MAAM,WAAW,KAAK,IACpB,MAAU,KACV,KAAK,IAAI,KAAM,KAAK,qBAAqB,KAAK,MAAM,KAAK,eAAe,EAAE,CAAC,CAC5E;AACD,OAAK,eAAe,kBAAkB,KAAK,OAAO,EAAE,SAAS;AAC7D,OAAK,aAAa,SAAS;;CAG7B,IAAI,KAA4B;AAC9B,SAAO,KAAK,IAAI,IAAI,IAAI;;CAG1B,IAAI,KAAa,OAAgB;AAC/B,OAAK,IAAI,IAAI,KAAK,MAAM;;CAG1B,OAAO,KAAmB;AACxB,OAAK,IAAI,OAAO,IAAI;;CAGtB,OAAe;AACb,SAAO,KAAK,IAAI;;CAGlB,QAAc;AACZ,OAAK,IAAI,OAAO;;CAGlB,UAAgB;AACd,MAAI,KAAK,cAAc;AACrB,iBAAc,KAAK,aAAa;AAChC,QAAK,eAAe,KAAA;;AAEtB,OAAK,IAAI,OAAO;;CAGlB,QAAsB;EACpB,MAAM,MAAM,KAAK,OAAO;AACxB,OAAK,MAAM,CAAC,GAAG,MAAM,KAAK,IAAI,SAAS,CACrC,KAAI,MAAM,EAAE,gBAAgB,KAAK,aAC/B,MAAK,IAAI,OAAO,EAAE"}

package/dist/src/infra/rate-limit/rate-limiter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Per-key fixed-window request-rate limiter. Every `consume()` counts toward
+ * the limit; once the window's count hits `maxRequests`, subsequent consumes
+ * return `allowed: false` until the window rolls over.
+ *
+ * Use this for *throughput* limiting (e.g. "15 req/min on /admin"). For
+ * *failure-rate* limiting with lockout (e.g. brute-force protection), use
+ * {@link FailureLimiter} instead.
+ */
+import { type Clock } from './keyed-store.js';
+export type RateLimiterConfig = {
+    maxRequests: number;
+    windowMs: number;
+    /** How long to retain idle keys before sweep. Defaults to 4× windowMs. */
+    staleAfterMs?: number;
+    clock?: Clock;
+};
+/**
+ * Flat rather than tagged-union: project's tsconfig has `strict: false`, which
+ * disables boolean discriminator narrowing through `if (!x.allowed)`. Both
+ * fields are always populated — `retryAfterMs` is 0 on success, `remaining`
+ * is 0 on block.
+ */
+export type RateLimitDecision = {
+    allowed: boolean;
+    remaining: number;
+    retryAfterMs: number;
+};
+export declare class RateLimiter {
+    private readonly store;
+    private readonly clock;
+    private readonly maxRequests;
+    private readonly windowMs;
+    constructor(cfg: RateLimiterConfig);
+    consume(key: string): RateLimitDecision;
+    /** @internal Test hook. */
+    resetForTests(): void;
+    destroy(): void;
+}

package/dist/src/infra/rate-limit/rate-limiter.js

@@ -0,0 +1,65 @@
+import { KeyedStore } from "./keyed-store.js";
+//#region src/infra/rate-limit/rate-limiter.ts
+/**
+* Per-key fixed-window request-rate limiter. Every `consume()` counts toward
+* the limit; once the window's count hits `maxRequests`, subsequent consumes
+* return `allowed: false` until the window rolls over.
+*
+* Use this for *throughput* limiting (e.g. "15 req/min on /admin"). For
+* *failure-rate* limiting with lockout (e.g. brute-force protection), use
+* {@link FailureLimiter} instead.
+*/
+var RateLimiter = class {
+	store;
+	clock;
+	maxRequests;
+	windowMs;
+	constructor(cfg) {
+		this.maxRequests = Math.max(1, Math.floor(cfg.maxRequests));
+		this.windowMs = Math.max(1, Math.floor(cfg.windowMs));
+		this.clock = cfg.clock ?? Date.now;
+		this.store = new KeyedStore({
+			staleAfterMs: cfg.staleAfterMs ?? this.windowMs * 4,
+			clock: this.clock
+		});
+	}
+	consume(key) {
+		const now = this.clock();
+		let state = this.store.get(key);
+		if (!state) {
+			state = {
+				windowStart: now,
+				count: 0,
+				lastTouchedMs: now
+			};
+			this.store.set(key, state);
+		}
+		if (now - state.windowStart >= this.windowMs) {
+			state.windowStart = now;
+			state.count = 0;
+		}
+		state.lastTouchedMs = now;
+		if (state.count >= this.maxRequests) return {
+			allowed: false,
+			remaining: 0,
+			retryAfterMs: Math.max(0, state.windowStart + this.windowMs - now)
+		};
+		state.count += 1;
+		return {
+			allowed: true,
+			remaining: this.maxRequests - state.count,
+			retryAfterMs: 0
+		};
+	}
+	/** @internal Test hook. */
+	resetForTests() {
+		this.store.clear();
+	}
+	destroy() {
+		this.store.destroy();
+	}
+};
+//#endregion
+export { RateLimiter };
+
+//# sourceMappingURL=rate-limiter.js.map

package/dist/src/infra/rate-limit/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","names":[],"sources":["../../../../src/infra/rate-limit/rate-limiter.ts"],"sourcesContent":["/**\n * Per-key fixed-window request-rate limiter. Every `consume()` counts toward\n * the limit; once the window's count hits `maxRequests`, subsequent consumes\n * return `allowed: false` until the window rolls over.\n *\n * Use this for *throughput* limiting (e.g. \"15 req/min on /admin\"). For\n * *failure-rate* limiting with lockout (e.g. brute-force protection), use\n * {@link FailureLimiter} instead.\n */\n\nimport { KeyedStore, type Clock } from './keyed-store.js';\n\nexport type RateLimiterConfig = {\n  maxRequests: number;\n  windowMs: number;\n  /** How long to retain idle keys before sweep. Defaults to 4× windowMs. */\n  staleAfterMs?: number;\n  clock?: Clock;\n};\n\n/**\n * Flat rather than tagged-union: project's tsconfig has `strict: false`, which\n * disables boolean discriminator narrowing through `if (!x.allowed)`. Both\n * fields are always populated — `retryAfterMs` is 0 on success, `remaining`\n * is 0 on block.\n */\nexport type RateLimitDecision = {\n  allowed: boolean;\n  remaining: number;\n  retryAfterMs: number;\n};\n\ntype State = {\n  windowStart: number;\n  count: number;\n  lastTouchedMs: number;\n};\n\nexport class RateLimiter {\n  private readonly store: KeyedStore<State>;\n  private readonly clock: Clock;\n  private readonly maxRequests: number;\n  private readonly windowMs: number;\n\n  constructor(cfg: RateLimiterConfig) {\n    this.maxRequests = Math.max(1, Math.floor(cfg.maxRequests));\n    this.windowMs = Math.max(1, Math.floor(cfg.windowMs));\n    this.clock = cfg.clock ?? Date.now;\n    this.store = new KeyedStore<State>({\n      staleAfterMs: cfg.staleAfterMs ?? this.windowMs * 4,\n      clock: this.clock,\n    });\n  }\n\n  consume(key: string): RateLimitDecision {\n    const now = this.clock();\n    let state = this.store.get(key);\n    if (!state) {\n      state = { windowStart: now, count: 0, lastTouchedMs: now };\n      this.store.set(key, state);\n    }\n\n    if (now - state.windowStart >= this.windowMs) {\n      state.windowStart = now;\n      state.count = 0;\n    }\n\n    state.lastTouchedMs = now;\n\n    if (state.count >= this.maxRequests) {\n      return {\n        allowed: false,\n        remaining: 0,\n        retryAfterMs: Math.max(0, state.windowStart + this.windowMs - now),\n      };\n    }\n\n    state.count += 1;\n    return { allowed: true, remaining: this.maxRequests - state.count, retryAfterMs: 0 };\n  }\n\n  /** @internal Test hook. */\n  resetForTests(): void {\n    this.store.clear();\n  }\n\n  destroy(): void {\n    this.store.destroy();\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsCA,IAAa,cAAb,MAAyB;CACvB;CACA;CACA;CACA;CAEA,YAAY,KAAwB;AAClC,OAAK,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,YAAY,CAAC;AAC3D,OAAK,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,SAAS,CAAC;AACrD,OAAK,QAAQ,IAAI,SAAS,KAAK;AAC/B,OAAK,QAAQ,IAAI,WAAkB;GACjC,cAAc,IAAI,gBAAgB,KAAK,WAAW;GAClD,OAAO,KAAK;GACb,CAAC;;CAGJ,QAAQ,KAAgC;EACtC,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,IAAI;AAC/B,MAAI,CAAC,OAAO;AACV,WAAQ;IAAE,aAAa;IAAK,OAAO;IAAG,eAAe;IAAK;AAC1D,QAAK,MAAM,IAAI,KAAK,MAAM;;AAG5B,MAAI,MAAM,MAAM,eAAe,KAAK,UAAU;AAC5C,SAAM,cAAc;AACpB,SAAM,QAAQ;;AAGhB,QAAM,gBAAgB;AAEtB,MAAI,MAAM,SAAS,KAAK,YACtB,QAAO;GACL,SAAS;GACT,WAAW;GACX,cAAc,KAAK,IAAI,GAAG,MAAM,cAAc,KAAK,WAAW,IAAI;GACnE;AAGH,QAAM,SAAS;AACf,SAAO;GAAE,SAAS;GAAM,WAAW,KAAK,cAAc,MAAM;GAAO,cAAc;GAAG;;;CAItF,gBAAsB;AACpB,OAAK,MAAM,OAAO;;CAGpB,UAAgB;AACd,OAAK,MAAM,SAAS"}

package/dist/src/infra/restart.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Gateway restart coordination — OpenClaw-aligned SIGUSR1 authorization and restart intent.
+ */
+export declare function writeGatewayRestartIntentSync(opts?: {
+    env?: NodeJS.ProcessEnv;
+    targetPid?: number;
+}): boolean;
+export declare function clearGatewayRestartIntentSync(env?: NodeJS.ProcessEnv): void;
+export declare function consumeGatewayRestartIntentSync(env?: NodeJS.ProcessEnv, now?: number): boolean;
+export declare function setGatewaySigusr1RestartPolicy(opts?: {
+    allowExternal?: boolean;
+}): void;
+export declare function isGatewaySigusr1RestartExternallyAllowed(): boolean;
+export declare function authorizeGatewaySigusr1Restart(delayMs?: number): void;
+export declare function consumeGatewaySigusr1RestartAuthorization(): boolean;
+export declare function resetGatewayRestartStateForInProcessRestart(): void;
+export declare function scheduleGatewaySigusr1Restart(params: {
+    delayMs?: number;
+    reason?: string;
+    onRestart: () => void;
+}): void;

package/dist/src/infra/restart.js

@@ -0,0 +1,122 @@
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
+import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+//#region src/infra/restart.ts
+/**
+* Gateway restart coordination — OpenClaw-aligned SIGUSR1 authorization and restart intent.
+*/
+init_paths_state();
+init_logger();
+const log = createLogger("Restart");
+const SIGUSR1_AUTH_GRACE_MS = 5e3;
+const GATEWAY_RESTART_INTENT_FILENAME = "gateway-restart-intent.json";
+const GATEWAY_RESTART_INTENT_TTL_MS = 6e4;
+let sigusr1AuthorizedCount = 0;
+let sigusr1AuthorizedUntil = 0;
+let sigusr1ExternalAllowed = false;
+let pendingRestartTimer = null;
+let pendingRestartCallback = null;
+function resolveGatewayRestartIntentPath(env = process.env) {
+	const stateDir = env.XOPC_STATE_DIR?.trim() || resolveStateDir();
+	return path.join(stateDir, GATEWAY_RESTART_INTENT_FILENAME);
+}
+function normalizeRestartIntentPid(pid) {
+	return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+function writeGatewayRestartIntentSync(opts = {}) {
+	const targetPid = normalizeRestartIntentPid(opts.targetPid);
+	if (targetPid === null) return false;
+	const intentPath = resolveGatewayRestartIntentPath(opts.env ?? process.env);
+	const payload = {
+		kind: "gateway-restart",
+		pid: targetPid,
+		createdAt: Date.now()
+	};
+	try {
+		mkdirSync(path.dirname(intentPath), { recursive: true });
+		writeFileSync(intentPath, `${JSON.stringify(payload)}\n`, "utf8");
+		return true;
+	} catch (err) {
+		log.warn({ err }, "Failed to write gateway restart intent");
+		return false;
+	}
+}
+function clearGatewayRestartIntentSync(env = process.env) {
+	try {
+		rmSync(resolveGatewayRestartIntentPath(env));
+	} catch {}
+}
+function parseGatewayRestartIntent(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed.kind === "gateway-restart" && typeof parsed.pid === "number" && Number.isFinite(parsed.pid) && typeof parsed.createdAt === "number" && Number.isFinite(parsed.createdAt)) return parsed;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function consumeGatewayRestartIntentSync(env = process.env, now = Date.now()) {
+	const intentPath = resolveGatewayRestartIntentPath(env);
+	let raw;
+	try {
+		raw = readFileSync(intentPath, "utf8");
+	} catch {
+		return false;
+	} finally {
+		clearGatewayRestartIntentSync(env);
+	}
+	const payload = parseGatewayRestartIntent(raw);
+	if (!payload) return false;
+	if (payload.pid !== process.pid) return false;
+	const ageMs = now - payload.createdAt;
+	return ageMs >= 0 && ageMs <= GATEWAY_RESTART_INTENT_TTL_MS;
+}
+function setGatewaySigusr1RestartPolicy(opts) {
+	sigusr1ExternalAllowed = opts?.allowExternal === true;
+}
+function isGatewaySigusr1RestartExternallyAllowed() {
+	return sigusr1ExternalAllowed;
+}
+function resetSigusr1AuthorizationIfExpired(now = Date.now()) {
+	if (sigusr1AuthorizedCount <= 0) return;
+	if (now <= sigusr1AuthorizedUntil) return;
+	sigusr1AuthorizedCount = 0;
+	sigusr1AuthorizedUntil = 0;
+}
+function authorizeGatewaySigusr1Restart(delayMs = 0) {
+	const delay = Math.max(0, Math.floor(delayMs));
+	const expiresAt = Date.now() + delay + SIGUSR1_AUTH_GRACE_MS;
+	sigusr1AuthorizedCount += 1;
+	if (expiresAt > sigusr1AuthorizedUntil) sigusr1AuthorizedUntil = expiresAt;
+}
+function consumeGatewaySigusr1RestartAuthorization() {
+	resetSigusr1AuthorizationIfExpired();
+	if (sigusr1AuthorizedCount <= 0) return false;
+	sigusr1AuthorizedCount -= 1;
+	if (sigusr1AuthorizedCount <= 0) sigusr1AuthorizedUntil = 0;
+	return true;
+}
+function resetGatewayRestartStateForInProcessRestart() {
+	if (pendingRestartTimer) {
+		clearTimeout(pendingRestartTimer);
+		pendingRestartTimer = null;
+	}
+	pendingRestartCallback = null;
+}
+function scheduleGatewaySigusr1Restart(params) {
+	if (pendingRestartTimer) clearTimeout(pendingRestartTimer);
+	pendingRestartCallback = params.onRestart;
+	const delayMs = Math.max(0, params.delayMs ?? 0);
+	pendingRestartTimer = setTimeout(() => {
+		pendingRestartTimer = null;
+		const callback = pendingRestartCallback;
+		pendingRestartCallback = null;
+		callback?.();
+	}, delayMs);
+}
+//#endregion
+export { authorizeGatewaySigusr1Restart, clearGatewayRestartIntentSync, consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy, writeGatewayRestartIntentSync };
+
+//# sourceMappingURL=restart.js.map

package/dist/src/infra/restart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart.js","names":[],"sources":["../../../src/infra/restart.ts"],"sourcesContent":["/**\n * Gateway restart coordination — OpenClaw-aligned SIGUSR1 authorization and restart intent.\n */\n\nimport { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { resolveStateDir } from '../config/paths-state.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('Restart');\n\nconst SIGUSR1_AUTH_GRACE_MS = 5000;\nconst GATEWAY_RESTART_INTENT_FILENAME = 'gateway-restart-intent.json';\nconst GATEWAY_RESTART_INTENT_TTL_MS = 60_000;\n\ntype GatewayRestartIntentPayload = {\n  kind: 'gateway-restart';\n  pid: number;\n  createdAt: number;\n};\n\nlet sigusr1AuthorizedCount = 0;\nlet sigusr1AuthorizedUntil = 0;\nlet sigusr1ExternalAllowed = false;\nlet pendingRestartTimer: ReturnType<typeof setTimeout> | null = null;\nlet pendingRestartCallback: (() => void) | null = null;\n\nfunction resolveGatewayRestartIntentPath(env: NodeJS.ProcessEnv = process.env): string {\n  const stateDir = env.XOPC_STATE_DIR?.trim() || resolveStateDir();\n  return path.join(stateDir, GATEWAY_RESTART_INTENT_FILENAME);\n}\n\nfunction normalizeRestartIntentPid(pid: number | undefined): number | null {\n  return typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0 ? pid : null;\n}\n\nexport function writeGatewayRestartIntentSync(opts: {\n  env?: NodeJS.ProcessEnv;\n  targetPid?: number;\n} = {}): boolean {\n  const targetPid = normalizeRestartIntentPid(opts.targetPid);\n  if (targetPid === null) {\n    return false;\n  }\n  const env = opts.env ?? process.env;\n  const intentPath = resolveGatewayRestartIntentPath(env);\n  const payload: GatewayRestartIntentPayload = {\n    kind: 'gateway-restart',\n    pid: targetPid,\n    createdAt: Date.now(),\n  };\n  try {\n    mkdirSync(path.dirname(intentPath), { recursive: true });\n    writeFileSync(intentPath, `${JSON.stringify(payload)}\\n`, 'utf8');\n    return true;\n  } catch (err) {\n    log.warn({ err }, 'Failed to write gateway restart intent');\n    return false;\n  }\n}\n\nexport function clearGatewayRestartIntentSync(env: NodeJS.ProcessEnv = process.env): void {\n  try {\n    rmSync(resolveGatewayRestartIntentPath(env));\n  } catch {\n    // File may not exist\n  }\n}\n\nfunction parseGatewayRestartIntent(raw: string): GatewayRestartIntentPayload | null {\n  try {\n    const parsed = JSON.parse(raw) as Partial<GatewayRestartIntentPayload>;\n    if (\n      parsed.kind === 'gateway-restart' &&\n      typeof parsed.pid === 'number' &&\n      Number.isFinite(parsed.pid) &&\n      typeof parsed.createdAt === 'number' &&\n      Number.isFinite(parsed.createdAt)\n    ) {\n      return parsed as GatewayRestartIntentPayload;\n    }\n  } catch {\n    return null;\n  }\n  return null;\n}\n\nexport function consumeGatewayRestartIntentSync(\n  env: NodeJS.ProcessEnv = process.env,\n  now = Date.now(),\n): boolean {\n  const intentPath = resolveGatewayRestartIntentPath(env);\n  let raw: string;\n  try {\n    raw = readFileSync(intentPath, 'utf8');\n  } catch {\n    return false;\n  } finally {\n    clearGatewayRestartIntentSync(env);\n  }\n  const payload = parseGatewayRestartIntent(raw);\n  if (!payload) {\n    return false;\n  }\n  if (payload.pid !== process.pid) {\n    return false;\n  }\n  const ageMs = now - payload.createdAt;\n  return ageMs >= 0 && ageMs <= GATEWAY_RESTART_INTENT_TTL_MS;\n}\n\nexport function setGatewaySigusr1RestartPolicy(opts?: { allowExternal?: boolean }): void {\n  sigusr1ExternalAllowed = opts?.allowExternal === true;\n}\n\nexport function isGatewaySigusr1RestartExternallyAllowed(): boolean {\n  return sigusr1ExternalAllowed;\n}\n\nfunction resetSigusr1AuthorizationIfExpired(now = Date.now()): void {\n  if (sigusr1AuthorizedCount <= 0) {\n    return;\n  }\n  if (now <= sigusr1AuthorizedUntil) {\n    return;\n  }\n  sigusr1AuthorizedCount = 0;\n  sigusr1AuthorizedUntil = 0;\n}\n\nexport function authorizeGatewaySigusr1Restart(delayMs = 0): void {\n  const delay = Math.max(0, Math.floor(delayMs));\n  const expiresAt = Date.now() + delay + SIGUSR1_AUTH_GRACE_MS;\n  sigusr1AuthorizedCount += 1;\n  if (expiresAt > sigusr1AuthorizedUntil) {\n    sigusr1AuthorizedUntil = expiresAt;\n  }\n}\n\nexport function consumeGatewaySigusr1RestartAuthorization(): boolean {\n  resetSigusr1AuthorizationIfExpired();\n  if (sigusr1AuthorizedCount <= 0) {\n    return false;\n  }\n  sigusr1AuthorizedCount -= 1;\n  if (sigusr1AuthorizedCount <= 0) {\n    sigusr1AuthorizedUntil = 0;\n  }\n  return true;\n}\n\nexport function resetGatewayRestartStateForInProcessRestart(): void {\n  if (pendingRestartTimer) {\n    clearTimeout(pendingRestartTimer);\n    pendingRestartTimer = null;\n  }\n  pendingRestartCallback = null;\n}\n\nexport function scheduleGatewaySigusr1Restart(params: {\n  delayMs?: number;\n  reason?: string;\n  onRestart: () => void;\n}): void {\n  if (pendingRestartTimer) {\n    clearTimeout(pendingRestartTimer);\n  }\n  pendingRestartCallback = params.onRestart;\n  const delayMs = Math.max(0, params.delayMs ?? 0);\n  pendingRestartTimer = setTimeout(() => {\n    pendingRestartTimer = null;\n    const callback = pendingRestartCallback;\n    pendingRestartCallback = null;\n    callback?.();\n  }, delayMs);\n}\n"],"mappings":";;;;;;;;;kBAM2D;aACT;AAElD,MAAM,MAAM,aAAa,UAAU;AAEnC,MAAM,wBAAwB;AAC9B,MAAM,kCAAkC;AACxC,MAAM,gCAAgC;AAQtC,IAAI,yBAAyB;AAC7B,IAAI,yBAAyB;AAC7B,IAAI,yBAAyB;AAC7B,IAAI,sBAA4D;AAChE,IAAI,yBAA8C;AAElD,SAAS,gCAAgC,MAAyB,QAAQ,KAAa;CACrF,MAAM,WAAW,IAAI,gBAAgB,MAAM,IAAI,iBAAiB;AAChE,QAAO,KAAK,KAAK,UAAU,gCAAgC;;AAG7D,SAAS,0BAA0B,KAAwC;AACzE,QAAO,OAAO,QAAQ,YAAY,OAAO,cAAc,IAAI,IAAI,MAAM,IAAI,MAAM;;AAGjF,SAAgB,8BAA8B,OAG1C,EAAE,EAAW;CACf,MAAM,YAAY,0BAA0B,KAAK,UAAU;AAC3D,KAAI,cAAc,KAChB,QAAO;CAGT,MAAM,aAAa,gCADP,KAAK,OAAO,QAAQ,IACuB;CACvD,MAAM,UAAuC;EAC3C,MAAM;EACN,KAAK;EACL,WAAW,KAAK,KAAK;EACtB;AACD,KAAI;AACF,YAAU,KAAK,QAAQ,WAAW,EAAE,EAAE,WAAW,MAAM,CAAC;AACxD,gBAAc,YAAY,GAAG,KAAK,UAAU,QAAQ,CAAC,KAAK,OAAO;AACjE,SAAO;UACA,KAAK;AACZ,MAAI,KAAK,EAAE,KAAK,EAAE,yCAAyC;AAC3D,SAAO;;;AAIX,SAAgB,8BAA8B,MAAyB,QAAQ,KAAW;AACxF,KAAI;AACF,SAAO,gCAAgC,IAAI,CAAC;SACtC;;AAKV,SAAS,0BAA0B,KAAiD;AAClF,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MACE,OAAO,SAAS,qBAChB,OAAO,OAAO,QAAQ,YACtB,OAAO,SAAS,OAAO,IAAI,IAC3B,OAAO,OAAO,cAAc,YAC5B,OAAO,SAAS,OAAO,UAAU,CAEjC,QAAO;SAEH;AACN,SAAO;;AAET,QAAO;;AAGT,SAAgB,gCACd,MAAyB,QAAQ,KACjC,MAAM,KAAK,KAAK,EACP;CACT,MAAM,aAAa,gCAAgC,IAAI;CACvD,IAAI;AACJ,KAAI;AACF,QAAM,aAAa,YAAY,OAAO;SAChC;AACN,SAAO;WACC;AACR,gCAA8B,IAAI;;CAEpC,MAAM,UAAU,0BAA0B,IAAI;AAC9C,KAAI,CAAC,QACH,QAAO;AAET,KAAI,QAAQ,QAAQ,QAAQ,IAC1B,QAAO;CAET,MAAM,QAAQ,MAAM,QAAQ;AAC5B,QAAO,SAAS,KAAK,SAAS;;AAGhC,SAAgB,+BAA+B,MAA0C;AACvF,0BAAyB,MAAM,kBAAkB;;AAGnD,SAAgB,2CAAoD;AAClE,QAAO;;AAGT,SAAS,mCAAmC,MAAM,KAAK,KAAK,EAAQ;AAClE,KAAI,0BAA0B,EAC5B;AAEF,KAAI,OAAO,uBACT;AAEF,0BAAyB;AACzB,0BAAyB;;AAG3B,SAAgB,+BAA+B,UAAU,GAAS;CAChE,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;CAC9C,MAAM,YAAY,KAAK,KAAK,GAAG,QAAQ;AACvC,2BAA0B;AAC1B,KAAI,YAAY,uBACd,0BAAyB;;AAI7B,SAAgB,4CAAqD;AACnE,qCAAoC;AACpC,KAAI,0BAA0B,EAC5B,QAAO;AAET,2BAA0B;AAC1B,KAAI,0BAA0B,EAC5B,0BAAyB;AAE3B,QAAO;;AAGT,SAAgB,8CAAoD;AAClE,KAAI,qBAAqB;AACvB,eAAa,oBAAoB;AACjC,wBAAsB;;AAExB,0BAAyB;;AAG3B,SAAgB,8BAA8B,QAIrC;AACP,KAAI,oBACF,cAAa,oBAAoB;AAEnC,0BAAyB,OAAO;CAChC,MAAM,UAAU,KAAK,IAAI,GAAG,OAAO,WAAW,EAAE;AAChD,uBAAsB,iBAAiB;AACrC,wBAAsB;EACtB,MAAM,WAAW;AACjB,2BAAyB;AACzB,cAAY;IACX,QAAQ"}

package/dist/src/infra/update-check.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { channelToNpmTag } from "./update-channels.js";
-import { dirname, join } from "node:path";
 import { access, readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/infra/update-check.ts
 init_package_version();

package/dist/src/infra/update-lock.js

@@ -1,9 +1,9 @@
-import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
-import { dirname } from "node:path";
+import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
 import { mkdir, readFile, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
 //#region src/infra/update-lock.ts
 init_write_file_atomic();
 init_paths_state();

package/dist/src/infra/update-runner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { join } from "node:path";
 import { access, readdir, unlink } from "node:fs/promises";
+import { join } from "node:path";
 import { spawn } from "node:child_process";
 //#region src/infra/update-runner.ts
 init_logger();

package/dist/src/infra/update-startup.js

@@ -1,8 +1,8 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
-import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
+import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
 import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";

package/dist/src/infra/write-file-atomic.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import path from "node:path";
-import { chmodSync, closeSync, copyFileSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { chmod, copyFile, mkdir, open, rename, rm } from "node:fs/promises";
+import path from "node:path";
 //#region src/infra/write-file-atomic.ts
 /**
 * Durable single-file writes: temp file → fsync → rename to target.

package/dist/src/mcp/channel-bridge.d.ts

@@ -52,10 +52,4 @@ export declare class XopcChannelBridge {
         inputPreview: string;
     }): Promise<void>;
 }
-export declare function serveXopcChannelMcp(opts: {
-    gatewayUrl?: string;
-    gatewayToken?: string;
-    claudeChannelMode?: ClaudeChannelMode;
-    verbose?: boolean;
-}): Promise<void>;
 export declare function loadMcpServeConfig(): Config;

package/dist/src/mcp/channel-bridge.js

@@ -153,14 +153,10 @@ var XopcChannelBridge = class {
 	}
 	async handleClaudePermissionRequest(_params) {}
 };
-async function serveXopcChannelMcp(opts) {
-	const { serveXopcChannelMcpImpl } = await import("./channel-server.js");
-	await serveXopcChannelMcpImpl(opts);
-}
 function loadMcpServeConfig() {
 	return loadConfig();
 }
 //#endregion
-export { XopcChannelBridge, loadMcpServeConfig, serveXopcChannelMcp };
+export { XopcChannelBridge, loadMcpServeConfig };
 
 //# sourceMappingURL=channel-bridge.js.map