@xopcai/xopc 0.0.82 → 0.0.84

package/dist/src/gateway/hono/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport {\n  getClientIpFromHeaders,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimitConfig,\n  resolveAuthRateLimitTracking,\n} from '../../auth-rate-limit.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\n/**\n * Validate token using constant-time comparison to prevent timing attacks.\n */\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\n/**\n * Extract token from Authorization header\n * Supports: \"Bearer <token>\", \"<token>\"\n */\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') {\n    return parts[1];\n  }\n  return authHeader;\n}\n\n/**\n * Extract token from query parameter.\n *\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only for SSE/WebSocket connections where\n * the `Authorization` header cannot be set by `EventSource`. For normal REST\n * requests prefer the `Authorization: Bearer <token>` header.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  const parsed = new URL(url);\n  return parsed.searchParams.get('token');\n}\n\n/** Paths where query-string token auth is acceptable (SSE / WebSocket). */\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nfunction isQueryTokenAllowedPath(path: string): boolean {\n  return QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events');\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\n/**\n * Create auth middleware for HTTP routes\n */\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const rlInput = getGatewayAuth?.()?.rateLimit;\n      const rlCfg = resolveAuthRateLimitConfig(rlInput);\n      const rateLimitActive = rlCfg.enabled && !isAuthRateLimitGloballyDisabled();\n      const clientIp = resolveMiddlewareClientIp(\n        c,\n        trustedProxies,\n        proxyContext?.allowRealIpFallback,\n      );\n      const origin = c.req.header('origin');\n      const tracking = resolveAuthRateLimitTracking({ clientIp, origin, cfg: rlCfg });\n      const { limiter, key: rateLimitKey, cfg: activeRlCfg } = tracking;\n\n      if (!trustedProxyConfig) {\n        if (rateLimitActive) {\n          limiter.recordFailure(rateLimitKey, activeRlCfg);\n        }\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json({ error: 'Unauthorized', message: 'Trusted-proxy auth is not configured' }, 401);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok) {\n        if (rateLimitActive) {\n          limiter.recordSuccess(rateLimitKey);\n        }\n        await next();\n        return;\n      }\n\n      if (result.ok === false) {\n        if (rateLimitActive) {\n          const blocked = limiter.checkBlocked(rateLimitKey, activeRlCfg);\n          if (blocked.blocked) {\n            log.warn(\n              {\n                clientIp,\n                origin: origin ?? undefined,\n                path: c.req.path,\n                method: c.req.method,\n                attemptCount: activeRlCfg.maxAttempts,\n                windowSec: Math.round(activeRlCfg.windowMs / 1000),\n                blockDurationSec: Math.round(activeRlCfg.blockDurationMs / 1000),\n                retryAfterSec: blocked.retryAfterSec,\n                reason: 'auth_failure_rate_limit',\n              },\n              `Auth rate limit blocked: ${activeRlCfg.maxAttempts} failures in ${activeRlCfg.windowMs / 1000}s, blocking for ${activeRlCfg.blockDurationMs / 1000}s`,\n            );\n            c.header('Retry-After', String(blocked.retryAfterSec));\n            return c.json(\n              {\n                error: 'Too Many Requests',\n                message: 'Too many authentication attempts',\n                retryAfter: blocked.retryAfterSec,\n              },\n              429,\n            );\n          }\n          limiter.recordFailure(rateLimitKey, activeRlCfg);\n        }\n\n        log.warn(\n          {\n            path: c.req.path,\n            method: c.req.method,\n            clientIp,\n            reason: result.reason,\n          },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json({ error: 'Unauthorized', message: 'Trusted-proxy authentication failed' }, 401);\n      }\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const rlInput = getGatewayAuth?.()?.rateLimit;\n    const rlCfg = resolveAuthRateLimitConfig(rlInput);\n    const rateLimitActive = rlCfg.enabled && !isAuthRateLimitGloballyDisabled();\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(\n      c,\n      proxyContext?.trustedProxies,\n      proxyContext?.allowRealIpFallback,\n    );\n    const origin = c.req.header('origin');\n    const tracking = resolveAuthRateLimitTracking({ clientIp, origin, cfg: rlCfg });\n    const { limiter, key: rateLimitKey, cfg: activeRlCfg } = tracking;\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      if (rateLimitActive) {\n        limiter.recordSuccess(rateLimitKey);\n      }\n      await next();\n      return;\n    }\n\n    if (rateLimitActive) {\n      const blocked = limiter.checkBlocked(rateLimitKey, activeRlCfg);\n      if (blocked.blocked) {\n        log.warn(\n          {\n            clientIp,\n            origin: origin ?? undefined,\n            path: requestPath,\n            method: c.req.method,\n            attemptCount: activeRlCfg.maxAttempts,\n            windowSec: Math.round(activeRlCfg.windowMs / 1000),\n            blockDurationSec: Math.round(activeRlCfg.blockDurationMs / 1000),\n            retryAfterSec: blocked.retryAfterSec,\n            reason: 'auth_failure_rate_limit',\n          },\n          `Auth rate limit blocked: ${activeRlCfg.maxAttempts} failures in ${activeRlCfg.windowMs / 1000}s, blocking for ${activeRlCfg.blockDurationMs / 1000}s`,\n        );\n        c.header('Retry-After', String(blocked.retryAfterSec));\n        return c.json(\n          {\n            error: 'Too Many Requests',\n            message: 'Too many authentication attempts',\n            retryAfter: blocked.retryAfterSec,\n          },\n          429,\n        );\n      }\n    }\n\n    if (!providedToken) {\n      if (rateLimitActive) {\n        limiter.recordFailure(rateLimitKey, activeRlCfg);\n      }\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json({ error: 'Unauthorized', message: 'Missing authentication token' }, 401);\n    }\n\n    if (!validateToken(providedToken, token)) {\n      if (rateLimitActive) {\n        limiter.recordFailure(rateLimitKey, activeRlCfg);\n      }\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n        'HTTP auth rejected: token mismatch',\n      );\n      return c.json({ error: 'Unauthorized', message: 'Invalid authentication token' }, 401);\n    }\n  });\n}\n\nexport interface WebSocketAuthResult {\n  valid: boolean;\n  error?: string;\n}\n\n/**\n * Validate WebSocket connection token\n */\nexport function validateWebSocketAuth(\n  url: URL,\n  authHeader: string | null,\n  expectedToken?: string\n): WebSocketAuthResult {\n  if (!expectedToken) {\n    return { valid: true };\n  }\n\n  const queryToken = url.searchParams.get('token');\n  const headerToken = extractTokenFromHeader(authHeader);\n\n  const providedToken = queryToken || headerToken;\n\n  if (!providedToken) {\n    log.warn(\n      { path: url.pathname, reason: 'missing_token', hasHeaderToken: Boolean(headerToken) },\n      'WebSocket auth rejected: no token in query or Authorization',\n    );\n    return { valid: false, error: 'Missing authentication token' };\n  }\n\n  if (!safeEqualSecret(providedToken, expectedToken)) {\n    log.warn({ path: url.pathname, reason: 'invalid_token' }, 'WebSocket auth rejected: token mismatch');\n    return { valid: false, error: 'Invalid authentication token' };\n  }\n\n  return { valid: true };\n}\n"],"mappings":";;;;;;;;;aAcwD;AAExD,MAAM,MAAM,aAAa,YAAY;;;;AAgBrC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;;;;;AAOtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CAExB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SACnD,QAAO,MAAM;AAEf,QAAO;;;;;;;;;;AAWT,SAAS,sBAAsB,KAA4B;AAEzD,QAAO,IADY,IAAI,IACV,CAAC,aAAa,IAAI,QAAQ;;;AAIzC,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,SAAS,wBAAwB,MAAuB;AACtD,QAAO,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc;;AAG9E,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;;;;AAMJ,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,UAAU,kBAAkB,EAAE;GACpC,MAAM,QAAQ,2BAA2B,QAAQ;GACjD,MAAM,kBAAkB,MAAM,WAAW,CAAC,iCAAiC;GAC3E,MAAM,WAAW,0BACf,GACA,gBACA,cAAc,oBACf;GACD,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GAErC,MAAM,EAAE,SAAS,KAAK,cAAc,KAAK,gBADxB,6BAA6B;IAAE;IAAU;IAAQ,KAAK;IAAO,CACb;AAEjE,OAAI,CAAC,oBAAoB;AACvB,QAAI,gBACF,SAAQ,cAAc,cAAc,YAAY;AAElD,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;KAAwC,EAAE,IAAI;;GAGhG,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,IAAI;AACb,QAAI,gBACF,SAAQ,cAAc,aAAa;AAErC,UAAM,MAAM;AACZ;;AAGF,OAAI,OAAO,OAAO,OAAO;AACvB,QAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,aAAa,cAAc,YAAY;AAC/D,SAAI,QAAQ,SAAS;AACnB,UAAI,KACF;OACE;OACA,QAAQ,UAAU,KAAA;OAClB,MAAM,EAAE,IAAI;OACZ,QAAQ,EAAE,IAAI;OACd,cAAc,YAAY;OAC1B,WAAW,KAAK,MAAM,YAAY,WAAW,IAAK;OAClD,kBAAkB,KAAK,MAAM,YAAY,kBAAkB,IAAK;OAChE,eAAe,QAAQ;OACvB,QAAQ;OACT,EACD,4BAA4B,YAAY,YAAY,eAAe,YAAY,WAAW,IAAK,kBAAkB,YAAY,kBAAkB,IAAK,GACrJ;AACD,QAAE,OAAO,eAAe,OAAO,QAAQ,cAAc,CAAC;AACtD,aAAO,EAAE,KACP;OACE,OAAO;OACP,SAAS;OACT,YAAY,QAAQ;OACrB,EACD,IACD;;AAEH,aAAQ,cAAc,cAAc,YAAY;;AAGlD,QAAI,KACF;KACE,MAAM,EAAE,IAAI;KACZ,QAAQ,EAAE,IAAI;KACd;KACA,QAAQ,OAAO;KAChB,EACD,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KAAK;KAAE,OAAO;KAAgB,SAAS;KAAuC,EAAE,IAAI;;;AAIjG,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,UAAU,kBAAkB,EAAE;EACpC,MAAM,QAAQ,2BAA2B,QAAQ;EACjD,MAAM,kBAAkB,MAAM,WAAW,CAAC,iCAAiC;EAE3E,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BACf,GACA,cAAc,gBACd,cAAc,oBACf;EACD,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EAErC,MAAM,EAAE,SAAS,KAAK,cAAc,KAAK,gBADxB,6BAA6B;GAAE;GAAU;GAAQ,KAAK;GAAO,CACb;EAEjE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,YAAY,GACnD,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,OAAI,gBACF,SAAQ,cAAc,aAAa;AAErC,SAAM,MAAM;AACZ;;AAGF,MAAI,iBAAiB;GACnB,MAAM,UAAU,QAAQ,aAAa,cAAc,YAAY;AAC/D,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KACE;KACA,QAAQ,UAAU,KAAA;KAClB,MAAM;KACN,QAAQ,EAAE,IAAI;KACd,cAAc,YAAY;KAC1B,WAAW,KAAK,MAAM,YAAY,WAAW,IAAK;KAClD,kBAAkB,KAAK,MAAM,YAAY,kBAAkB,IAAK;KAChE,eAAe,QAAQ;KACvB,QAAQ;KACT,EACD,4BAA4B,YAAY,YAAY,eAAe,YAAY,WAAW,IAAK,kBAAkB,YAAY,kBAAkB,IAAK,GACrJ;AACD,MAAE,OAAO,eAAe,OAAO,QAAQ,cAAc,CAAC;AACtD,WAAO,EAAE,KACP;KACE,OAAO;KACP,SAAS;KACT,YAAY,QAAQ;KACrB,EACD,IACD;;;AAIL,MAAI,CAAC,eAAe;AAClB,OAAI,gBACF,SAAQ,cAAc,cAAc,YAAY;AAElD,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,SAAS;IAAgC,EAAE,IAAI;;AAGxF,MAAI,CAAC,cAAc,eAAe,MAAM,EAAE;AACxC,OAAI,gBACF,SAAQ,cAAc,cAAc,YAAY;AAElD,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,qCACD;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,SAAS;IAAgC,EAAE,IAAI;;GAExF;;;;;AAWJ,SAAgB,sBACd,KACA,YACA,eACqB;AACrB,KAAI,CAAC,cACH,QAAO,EAAE,OAAO,MAAM;CAGxB,MAAM,aAAa,IAAI,aAAa,IAAI,QAAQ;CAChD,MAAM,cAAc,uBAAuB,WAAW;CAEtD,MAAM,gBAAgB,cAAc;AAEpC,KAAI,CAAC,eAAe;AAClB,MAAI,KACF;GAAE,MAAM,IAAI;GAAU,QAAQ;GAAiB,gBAAgB,QAAQ,YAAY;GAAE,EACrF,8DACD;AACD,SAAO;GAAE,OAAO;GAAO,OAAO;GAAgC;;AAGhE,KAAI,CAAC,gBAAgB,eAAe,cAAc,EAAE;AAClD,MAAI,KAAK;GAAE,MAAM,IAAI;GAAU,QAAQ;GAAiB,EAAE,0CAA0C;AACpG,SAAO;GAAE,OAAO;GAAO,OAAO;GAAgC;;AAGhE,QAAO,EAAE,OAAO,MAAM"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only for SSE/WebSocket connections where\n * the `Authorization` header cannot be set by `EventSource`. For normal REST\n * requests prefer the `Authorization: Bearer <token>` header.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nfunction isQueryTokenAllowedPath(path: string): boolean {\n  return QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events');\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath) ? extractTokenFromQuery(c.req.url) : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n      'HTTP auth rejected: token mismatch',\n    );\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAkBwD;AAExD,MAAM,MAAM,aAAa,YAAY;AAarC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,SAAS,wBAAwB,MAAuB;AACtD,QAAO,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc;;AAG9E,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,YAAY,GAAG,sBAAsB,EAAE,IAAI,IAAI,GAAG;AAE7F,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,EAC7E,qCACD;AACD,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}

package/dist/src/gateway/hono/middleware/logger.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { getClientIpFromHeaders } from "../../auth-rate-limit.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/logger.ts

package/dist/src/gateway/hono/middleware/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/logger.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { getClientIpFromHeaders } from '../../auth-rate-limit.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Request');\n\nexport interface LoggerMiddlewareConfig {\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveRequestClientIp(c: Context, config?: LoggerMiddlewareConfig): string {\n  const trustedProxies = config?.trustedProxies;\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback: config?.allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name) => c.req.header(name) ?? undefined,\n  });\n}\n\nexport function logger(config?: LoggerMiddlewareConfig) {\n  return createMiddleware(async (c, next) => {\n    const start = Date.now();\n\n    const clientIp = resolveRequestClientIp(c, config);\n    const userAgent = c.req.header('user-agent') ?? undefined;\n    const contentLength = c.req.header('content-length');\n    const referer = c.req.header('referer') ?? undefined;\n\n    await next();\n\n    const duration = Date.now() - start;\n    const status = c.res.status;\n    const isServerError = status >= 500;\n    const isClientError = status >= 400 && status < 500;\n    const isSlow = duration > 1000;\n\n    const logData = {\n      method: c.req.method,\n      path: c.req.path,\n      status,\n      durationMs: duration,\n      clientIp,\n      ...(userAgent ? { userAgent } : {}),\n      ...(contentLength ? { contentLength: Number(contentLength) } : {}),\n      ...(referer ? { referer } : {}),\n    };\n\n    const msg = `HTTP ${c.req.method} ${c.req.path} → ${status} (${duration}ms)`;\n\n    if (isServerError || isSlow) {\n      log.warn(logData, msg);\n    } else if (isClientError) {\n      // 4xx: info avoids doubling warn noise from auth / rate-limit handlers\n      log.info(logData, msg);\n    } else {\n      log.debug(logData, msg);\n    }\n  });\n}\n"],"mappings":";;;;;;;aAMwD;AAExD,MAAM,MAAM,aAAa,eAAe;AAOxC,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,uBAAuB,GAAY,QAAyC;CACnF,MAAM,iBAAiB,QAAQ;AAC/B,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA,qBAAqB,QAAQ;EAC9B,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAS,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GACtC,CAAC;;AAGJ,SAAgB,OAAO,QAAiC;AACtD,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,QAAQ,KAAK,KAAK;EAExB,MAAM,WAAW,uBAAuB,GAAG,OAAO;EAClD,MAAM,YAAY,EAAE,IAAI,OAAO,aAAa,IAAI,KAAA;EAChD,MAAM,gBAAgB,EAAE,IAAI,OAAO,iBAAiB;EACpD,MAAM,UAAU,EAAE,IAAI,OAAO,UAAU,IAAI,KAAA;AAE3C,QAAM,MAAM;EAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;EAC9B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,gBAAgB,UAAU;EAChC,MAAM,gBAAgB,UAAU,OAAO,SAAS;EAChD,MAAM,SAAS,WAAW;EAE1B,MAAM,UAAU;GACd,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA,YAAY;GACZ;GACA,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;GAClC,GAAI,gBAAgB,EAAE,eAAe,OAAO,cAAc,EAAE,GAAG,EAAE;GACjE,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;GAC/B;EAED,MAAM,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,OAAO,IAAI,SAAS;AAExE,MAAI,iBAAiB,OACnB,KAAI,KAAK,SAAS,IAAI;WACb,cAET,KAAI,KAAK,SAAS,IAAI;MAEtB,KAAI,MAAM,SAAS,IAAI;GAEzB"}
+{"version":3,"file":"logger.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/logger.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Request');\n\nexport interface LoggerMiddlewareConfig {\n  trustedProxies?: string[];\n  allowRealIpFallback?: boolean;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveRequestClientIp(c: Context, config?: LoggerMiddlewareConfig): string {\n  const trustedProxies = config?.trustedProxies;\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback: config?.allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name) => c.req.header(name) ?? undefined,\n  });\n}\n\nexport function logger(config?: LoggerMiddlewareConfig) {\n  return createMiddleware(async (c, next) => {\n    const start = Date.now();\n\n    const clientIp = resolveRequestClientIp(c, config);\n    const userAgent = c.req.header('user-agent') ?? undefined;\n    const contentLength = c.req.header('content-length');\n    const referer = c.req.header('referer') ?? undefined;\n\n    await next();\n\n    const duration = Date.now() - start;\n    const status = c.res.status;\n    const isServerError = status >= 500;\n    const isClientError = status >= 400 && status < 500;\n    const isSlow = duration > 1000;\n\n    const logData = {\n      method: c.req.method,\n      path: c.req.path,\n      status,\n      durationMs: duration,\n      clientIp,\n      ...(userAgent ? { userAgent } : {}),\n      ...(contentLength ? { contentLength: Number(contentLength) } : {}),\n      ...(referer ? { referer } : {}),\n    };\n\n    const msg = `HTTP ${c.req.method} ${c.req.path} → ${status} (${duration}ms)`;\n\n    if (isServerError || isSlow) {\n      log.warn(logData, msg);\n    } else if (isClientError) {\n      // 4xx: info avoids doubling warn noise from auth / rate-limit handlers\n      log.info(logData, msg);\n    } else {\n      log.debug(logData, msg);\n    }\n  });\n}\n"],"mappings":";;;;;;;aAMwD;AAExD,MAAM,MAAM,aAAa,eAAe;AAOxC,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,uBAAuB,GAAY,QAAyC;CACnF,MAAM,iBAAiB,QAAQ;AAC/B,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA,qBAAqB,QAAQ;EAC9B,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAS,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GACtC,CAAC;;AAGJ,SAAgB,OAAO,QAAiC;AACtD,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,QAAQ,KAAK,KAAK;EAExB,MAAM,WAAW,uBAAuB,GAAG,OAAO;EAClD,MAAM,YAAY,EAAE,IAAI,OAAO,aAAa,IAAI,KAAA;EAChD,MAAM,gBAAgB,EAAE,IAAI,OAAO,iBAAiB;EACpD,MAAM,UAAU,EAAE,IAAI,OAAO,UAAU,IAAI,KAAA;AAE3C,QAAM,MAAM;EAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;EAC9B,MAAM,SAAS,EAAE,IAAI;EACrB,MAAM,gBAAgB,UAAU;EAChC,MAAM,gBAAgB,UAAU,OAAO,SAAS;EAChD,MAAM,SAAS,WAAW;EAE1B,MAAM,UAAU;GACd,QAAQ,EAAE,IAAI;GACd,MAAM,EAAE,IAAI;GACZ;GACA,YAAY;GACZ;GACA,GAAI,YAAY,EAAE,WAAW,GAAG,EAAE;GAClC,GAAI,gBAAgB,EAAE,eAAe,OAAO,cAAc,EAAE,GAAG,EAAE;GACjE,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;GAC/B;EAED,MAAM,MAAM,QAAQ,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,OAAO,IAAI,SAAS;AAExE,MAAI,iBAAiB,OACnB,KAAI,KAAK,SAAS,IAAI;WACb,cAET,KAAI,KAAK,SAAS,IAAI;MAEtB,KAAI,MAAM,SAAS,IAAI;GAEzB"}

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Per-client request-rate gate for sensitive admin/mutation endpoints.
+ * Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.
+ */
+export type StrictRateLimitDeps = {
+    getTrustedProxyContext: () => {
+        trustedProxies?: string[];
+        allowRealIpFallback?: boolean;
+    };
+};
+export declare function createStrictRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono/dist/types/types.js").MiddlewareHandler<any, string, {}, Response & import("hono/dist/types/types.js").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -0,0 +1,62 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import { getClientIpFromHeaders } from "../../security/loopback.js";
+import "../../rate-limit/index.js";
+import { createMiddleware } from "hono/factory";
+import { getConnInfo } from "@hono/node-server/conninfo";
+//#region src/gateway/hono/middleware/strict-rate-limit.ts
+/**
+* Per-client request-rate gate for sensitive admin/mutation endpoints.
+* Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.
+*/
+init_logger();
+const log = createLogger("Hono:StrictRateLimit");
+function resolveClientIp(c, deps) {
+	const { trustedProxies, allowRealIpFallback } = deps.getTrustedProxyContext();
+	if (trustedProxies?.length) {
+		let remoteAddress;
+		try {
+			remoteAddress = getConnInfo(c).remote.address;
+		} catch {
+			remoteAddress = void 0;
+		}
+		return resolveClientIpFromRequest({
+			remoteAddress,
+			getHeader: (name) => c.req.header(name),
+			trustedProxies,
+			allowRealIpFallback
+		});
+	}
+	return getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 });
+}
+function createStrictRateLimitMiddleware(deps) {
+	return createMiddleware(async (c, next) => {
+		const limiter = buckets.strictApi();
+		const clientIp = resolveClientIp(c, deps);
+		const result = limiter.consume(clientIp);
+		if (!result.allowed) {
+			const retryAfterSec = Math.ceil(result.retryAfterMs / 1e3);
+			log.warn({
+				clientIp,
+				path: c.req.path,
+				method: c.req.method,
+				retryAfterSec,
+				reason: "strict_rate_limit_exceeded"
+			}, "Strict API rate limit exceeded");
+			c.header("Retry-After", String(retryAfterSec));
+			c.header("X-RateLimit-Remaining", "0");
+			return c.json({
+				error: "Too many requests",
+				code: "rate_limited"
+			}, 429);
+		}
+		c.header("X-RateLimit-Remaining", String(result.remaining));
+		await next();
+	});
+}
+//#endregion
+export { createStrictRateLimitMiddleware };
+
+//# sourceMappingURL=strict-rate-limit.js.map

package/dist/src/gateway/hono/middleware/strict-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-rate-limit.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/strict-rate-limit.ts"],"sourcesContent":["/**\n * Per-client request-rate gate for sensitive admin/mutation endpoints.\n * Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.\n */\n\nimport { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { buckets } from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:StrictRateLimit');\n\nexport type StrictRateLimitDeps = {\n  getTrustedProxyContext: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n};\n\nfunction resolveClientIp(c: Context, deps: StrictRateLimitDeps): string {\n  const { trustedProxies, allowRealIpFallback } = deps.getTrustedProxyContext();\n  if (trustedProxies?.length) {\n    let remoteAddress: string | undefined;\n    try {\n      remoteAddress = getConnInfo(c).remote.address;\n    } catch {\n      remoteAddress = undefined;\n    }\n    return resolveClientIpFromRequest({\n      remoteAddress,\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? undefined });\n}\n\nexport function createStrictRateLimitMiddleware(deps: StrictRateLimitDeps) {\n  return createMiddleware(async (c, next) => {\n    const limiter = buckets.strictApi();\n    const clientIp = resolveClientIp(c, deps);\n    const result = limiter.consume(clientIp);\n\n    if (!result.allowed) {\n      const retryAfterSec = Math.ceil(result.retryAfterMs / 1000);\n      log.warn(\n        {\n          clientIp,\n          path: c.req.path,\n          method: c.req.method,\n          retryAfterSec,\n          reason: 'strict_rate_limit_exceeded',\n        },\n        'Strict API rate limit exceeded',\n      );\n      c.header('Retry-After', String(retryAfterSec));\n      c.header('X-RateLimit-Remaining', '0');\n      return c.json({ error: 'Too many requests', code: 'rate_limited' }, 429);\n    }\n\n    c.header('X-RateLimit-Remaining', String(result.remaining));\n    await next();\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAYwD;AAExD,MAAM,MAAM,aAAa,uBAAuB;AAShD,SAAS,gBAAgB,GAAY,MAAmC;CACtE,MAAM,EAAE,gBAAgB,wBAAwB,KAAK,wBAAwB;AAC7E,KAAI,gBAAgB,QAAQ;EAC1B,IAAI;AACJ,MAAI;AACF,mBAAgB,YAAY,EAAE,CAAC,OAAO;UAChC;AACN,mBAAgB,KAAA;;AAElB,SAAO,2BAA2B;GAChC;GACA,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;GACvC;GACA;GACD,CAAC;;AAEJ,QAAO,uBAAuB,EAAE,MAAM,SAAS,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAAW,CAAC;;AAGnF,SAAgB,gCAAgC,MAA2B;AACzE,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,UAAU,QAAQ,WAAW;EACnC,MAAM,WAAW,gBAAgB,GAAG,KAAK;EACzC,MAAM,SAAS,QAAQ,QAAQ,SAAS;AAExC,MAAI,CAAC,OAAO,SAAS;GACnB,MAAM,gBAAgB,KAAK,KAAK,OAAO,eAAe,IAAK;AAC3D,OAAI,KACF;IACE;IACA,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd;IACA,QAAQ;IACT,EACD,iCACD;AACD,KAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,KAAE,OAAO,yBAAyB,IAAI;AACtC,UAAO,EAAE,KAAK;IAAE,OAAO;IAAqB,MAAM;IAAgB,EAAE,IAAI;;AAG1E,IAAE,OAAO,yBAAyB,OAAO,OAAO,UAAU,CAAC;AAC3D,QAAM,MAAM;GACZ"}

package/dist/src/gateway/hono/oauth.js

@@ -1,6 +1,6 @@
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { init_providers, isProviderConfigured } from "../../providers/index.js";
 import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
+import { init_providers, isProviderConfigured } from "../../providers/index.js";
 import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
 import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
 import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -7,8 +7,8 @@ import { createOAuthHandler } from "../oauth.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
-import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { relative, resolve } from "node:path";
 //#region src/gateway/hono/routes/auth-registry-extensions.ts
 init_providers();
 const EXTENSION_ASSET_CSP = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'none'; frame-ancestors 'self'; frame-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'";
@@ -312,7 +312,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 			}, 400);
 		}
 		try {
-			const payload = await service.fetchExtensionMarketplacePackageDetail(pkgName);
+			const payload = await service.marketplace.fetchExtensionPackageDetail(pkgName);
 			return c.json({
 				ok: true,
 				payload
@@ -342,7 +342,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 			error: "Expected { name: string, version?: string, overwrite?: boolean }"
 		}, 400);
 		try {
-			const payload = await service.installExtensionFromMarketplace({
+			const payload = await service.marketplace.installExtension({
 				name,
 				version,
 				overwrite
@@ -374,7 +374,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 			error: "Expected { extensionId: string }"
 		}, 400);
 		try {
-			const payload = await service.uninstallUserExtension(extensionId);
+			const payload = await service.marketplace.uninstallExtension(extensionId);
 			return c.json({
 				ok: true,
 				payload

package/dist/src/gateway/hono/routes/auth-registry-extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-registry-extensions.js","names":["extensionMarketplace.searchExtensions","extensionMarketplace.listExtensions","extensionMarketplace.fetchRegistry"],"sources":["../../../../../src/gateway/hono/routes/auth-registry-extensions.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { relative, resolve } from 'node:path';\n\nimport type { Config as SurfaceConfig } from '../../../config/config-surface.js';\nimport type { GatewayService } from '../../service.js';\nimport { buildWhenContextSnapshot } from '../../../extensions/when-context.js';\nimport * as extensionMarketplace from '../../../extensions/marketplace.js';\nimport { mergeActivationContext } from '../../../extensions/activation-context.js';\nimport { ActivationPlanner } from '../../../extensions/activation-planner.js';\nimport { getAllModels, getAvailableModels, type Model, type Api } from '../../../providers/index.js';\nimport { createOAuthHandler, loadOAuthCredentialsToCache } from '../oauth.js';\nimport { createOAuthAsyncHandler } from '../oauth-async.js';\nimport { extensionAssetMimeType } from '../lib/extension-assets.js';\nimport { loadExtensionStore, saveExtensionStore } from '../lib/extension-store.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst EXTENSION_ASSET_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self' 'unsafe-inline'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"connect-src 'none'; \" +\n  \"frame-ancestors 'self'; \" +\n  \"frame-src 'none'; \" +\n  \"base-uri 'none'; \" +\n  \"object-src 'none'; \" +\n  \"form-action 'none'\";\n\n/** Sandboxed extension iframes send `Origin: null`; echo it (and real origins) so every status includes ACAO. */\nfunction extensionUiAssetCorsAllowOrigin(c: { req: { header: (name: string) => string | undefined } }): string {\n  const origin = c.req.header('origin');\n  if (origin === 'null') return 'null';\n  if (origin) return origin;\n  return '*';\n}\n\nfunction rewriteExtensionAssetHtml(html: string, extensionId: string, assetPath: string): string {\n  const assetDir = assetPath.includes('/') ? assetPath.slice(0, assetPath.lastIndexOf('/') + 1) : '';\n  const assetBase = `/api/extensions/${extensionId}/assets/${assetDir}`;\n\n  return html\n    .replace(/(<script\\b[^>]*?\\ssrc=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedSrc = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedSrc}${quote} crossorigin=\"anonymous\"`;\n    })\n    .replace(/(<link\\b[^>]*?\\shref=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedHref = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedHref}${quote}`;\n    });\n}\n\nfunction hasNonEmptyConfigSchema(schema: unknown): boolean {\n  if (!schema || typeof schema !== 'object') return false;\n  const properties = (schema as { properties?: unknown }).properties;\n  return Boolean(properties && typeof properties === 'object' && Object.keys(properties).length > 0);\n}\n\n/**\n * Register extension UI asset routes on the public (unauthenticated) app.\n *\n * Sandboxed iframes (`sandbox=\"allow-scripts …\"` without `allow-same-origin`) have an\n * opaque origin of `null`, so sub-resource requests from inside the iframe cannot\n * carry the `?token=` query parameter that was on the parent HTML URL. Putting these\n * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.\n *\n * Security is maintained by the strict Content-Security-Policy returned with every\n * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway\n * console itself from embedding the extension iframes.\n */\nexport function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/extensions/:id/assets/*', async (c) => {\n    const acao = extensionUiAssetCorsAllowOrigin(c);\n    const corsHdr = { 'Access-Control-Allow-Origin': acao } as const;\n\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503, corsHdr);\n    }\n\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext || !ext.manifest.ui) {\n      return c.json({ error: 'Extension not found or has no UI' }, 404, corsHdr);\n    }\n\n    const prefix = `/api/extensions/${extensionId}/assets/`;\n    const assetPathEncoded = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : '';\n    let assetPath = assetPathEncoded;\n    try {\n      assetPath = decodeURIComponent(assetPathEncoded);\n    } catch {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    if (!assetPath || assetPath.includes('..')) {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    const root = resolve(ext.path);\n    const fullPath = resolve(root, assetPath);\n    const rel = relative(root, fullPath);\n    if (rel.startsWith('..') || rel === '') {\n      return c.json({ error: 'Path traversal denied' }, 403, corsHdr);\n    }\n\n    if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n      return c.json({ error: 'Not found' }, 404, corsHdr);\n    }\n\n    const rawContent = readFileSync(fullPath);\n    const mimeType = extensionAssetMimeType(assetPath);\n\n    const body: string | Uint8Array = mimeType.startsWith('text/html')\n      ? rewriteExtensionAssetHtml(rawContent.toString('utf-8'), extensionId, assetPath)\n      : new Uint8Array(rawContent);\n\n    return new Response(body, {\n      status: 200,\n      headers: {\n        'Content-Type': mimeType,\n        'Content-Security-Policy': EXTENSION_ASSET_CSP,\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n        'Access-Control-Allow-Origin': acao,\n      },\n    });\n  });\n}\n\nexport function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  // ========== Auth API (/api/auth) ==========\n\n  // GET /api/auth/token - Get current gateway token\n  authenticated.get('/api/auth/token', (c) => {\n    const authToken = service.getAuthToken();\n    return c.json({ \n      ok: true, \n      payload: { \n        token: authToken,\n        mode: service.getAuthMode(),\n      } \n    });\n  });\n\n  // POST /api/auth/token/refresh - Generate new gateway token\n  authenticated.post('/api/auth/token/refresh', async (c) => {\n    try {\n      const newToken = await service.refreshAuthToken();\n      return c.json({ \n        ok: true, \n        payload: { \n          token: newToken,\n          message: 'Token refreshed successfully. Please update your client configuration.'\n        } \n      });\n    } catch (err) {\n      return c.json({ \n        ok: false, \n        error: err instanceof Error ? err.message : 'Failed to refresh token' \n      }, 500);\n    }\n  });\n\n  // ========== OAuth API (/api/auth/oauth) ==========\n  authenticated.route('/api/auth/oauth', createOAuthHandler(service));\n\n  // ========== Async OAuth API (/api/auth/oauth-async) ==========\n  authenticated.route('/api/auth/oauth-async', createOAuthAsyncHandler(service));\n\n  // Load OAuth credentials from config into cache on startup\n  loadOAuthCredentialsToCache(service);\n\n  // ========== Registry API ==========\n  \n  // GET /api/registry - Full registry for frontend\n  authenticated.get('/api/registry', async (c) => {\n    const allModels = getAllModels();\n    const availableModels = await getAvailableModels();\n    const configured = new Set(availableModels.map(m => `${m.provider}/${m.id}`));\n    \n    // Group models by provider\n    const providerMap = new Map<string, Model<Api>[]>();\n    for (const model of allModels) {\n      const list = providerMap.get(model.provider) ?? [];\n      list.push(model);\n      providerMap.set(model.provider, list);\n    }\n    \n    return c.json({\n      ok: true,\n      payload: {\n        version: 'pi-ai',\n        providers: Array.from(providerMap.entries()).map(([id, models]) => ({\n          id,\n          name: id.charAt(0).toUpperCase() + id.slice(1),\n          configured: models.some(m => configured.has(`${m.provider}/${m.id}`)),\n          models: models.map(m => ({\n            ref: `${m.provider}/${m.id}`,\n            id: m.id,\n            name: m.name,\n            provider: m.provider,\n            reasoning: m.reasoning ?? false,\n            input: m.input ?? ['text'],\n            contextWindow: m.contextWindow ?? 128000,\n            maxTokens: m.maxTokens ?? 4096,\n            cost: {\n              input: m.cost?.input ?? 0,\n              output: m.cost?.output ?? 0,\n            },\n            available: configured.has(`${m.provider}/${m.id}`),\n          })),\n        })),\n      },\n    });\n  });\n\n  // ========== Extension UI (manifest discovery + static assets) ==========\n\n  authenticated.get('/api/extensions', async (c) => {\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ extensions: [] });\n    }\n\n    const registry = loader.getRegistry();\n    const discovered = loader.discoverExtensions();\n    const activeIds = new Set<string>();\n    for (const [id] of registry.extensions) {\n      activeIds.add(id);\n    }\n\n    loader.setConfig(service.currentConfig as unknown as SurfaceConfig);\n    let activationEligibleIds: Set<string> = new Set();\n    try {\n      const planner = new ActivationPlanner(loader.buildManifestRegistry());\n      activationEligibleIds = new Set(\n        planner.getActivatedIds(mergeActivationContext(service.currentConfig as unknown as SurfaceConfig)),\n      );\n    } catch {\n      activationEligibleIds = new Set();\n    }\n\n    const extensions = discovered.map((ext) => ({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      active: activeIds.has(ext.id),\n      activationEligible: activationEligibleIds.has(ext.id),\n      hasUi: Boolean(ext.manifest.ui),\n      hasConfigSchema: hasNonEmptyConfigSchema(ext.manifest.configSchema),\n      ui: ext.manifest.ui\n        ? {\n            icon: ext.manifest.ui.icon,\n            permissions: ext.manifest.ui.permissions,\n            contributions: ext.manifest.ui.contributions,\n          }\n        : undefined,\n    }));\n    return c.json({ extensions });\n  });\n\n  /**\n   * Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.\n   * Body: `{ extensionId: string, enabled: boolean }`\n   */\n  authenticated.post('/api/extensions/bundled/activation', strictRateLimitMiddleware, async (c) => {\n    const body = (await c.req.json().catch(() => null)) as\n      | { extensionId?: unknown; enabled?: unknown }\n      | null;\n    const extensionId =\n      typeof body?.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: { message: 'extensionId is required' } }, 400);\n    }\n    if (typeof body?.enabled !== 'boolean') {\n      return c.json({ ok: false, error: { message: 'enabled must be a boolean' } }, 400);\n    }\n    const result = await service.setBundledExtensionActivationTarget(extensionId, body.enabled);\n    if (!result.ok) {\n      return c.json({ ok: false, error: { message: result.error ?? 'Request failed' } }, 400);\n    }\n    return c.json({\n      ok: true,\n      payload: { requiresGatewayRestart: result.requiresGatewayRestart },\n    });\n  });\n\n  authenticated.get('/api/extensions/:id', async (c) => {\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503);\n    }\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext) {\n      return c.json({ error: 'Extension not found' }, 404);\n    }\n    const registry = loader.getRegistry();\n    return c.json({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      path: ext.path,\n      active: registry.extensions.has(ext.id),\n      manifest: ext.manifest,\n    });\n  });\n\n  authenticated.get('/api/extensions/:id/storage', async (c) => {\n    const extensionId = c.req.param('id');\n    const store = await loadExtensionStore(extensionId);\n    return c.json({ keys: Object.keys(store) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    if (!(key in store)) {\n      return c.json({ error: 'Key not found' }, 404);\n    }\n    return c.json({ value: store[key] });\n  });\n\n  authenticated.put('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null;\n    if (body === null || !('value' in body)) {\n      return c.json({ error: 'Request body must contain a \"value\" field' }, 400);\n    }\n    const store = await loadExtensionStore(extensionId);\n    store[key] = body.value;\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.delete('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    delete store[key];\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    return c.json(await loadExtensionStore(`__config__${extensionId}`));\n  });\n\n  authenticated.patch('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    const patch = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;\n    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {\n      return c.json({ error: 'Request body must be a JSON object' }, 400);\n    }\n    const namespace = `__config__${extensionId}`;\n    const config = await loadExtensionStore(namespace);\n    Object.assign(config, patch);\n    await saveExtensionStore(namespace, config);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/context', (c) => {\n    const loader = service.getExtensionLoader();\n    const snapshot = buildWhenContextSnapshot(\n      service.currentConfig as unknown as SurfaceConfig,\n      loader,\n    );\n    return c.json(snapshot);\n  });\n\n  authenticated.get('/api/marketplace', async (c) => {\n    const q = c.req.query('q');\n    const category = c.req.query('category');\n    try {\n      let extensions;\n      if (typeof q === 'string' && q.trim()) {\n        extensions = await extensionMarketplace.searchExtensions(q.trim());\n      } else if (typeof category === 'string' && category.trim()) {\n        extensions = await extensionMarketplace.listExtensions(category.trim());\n      } else {\n        const reg = await extensionMarketplace.fetchRegistry();\n        extensions = reg.extensions;\n      }\n      return c.json({ ok: true, extensions });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          extensions: [],\n          error: err instanceof Error ? err.message : 'marketplace fetch failed',\n        },\n        500,\n      );\n    }\n  });\n\n  authenticated.get('/api/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const payload = await service.fetchExtensionMarketplacePackageDetail(pkgName);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/install', strictRateLimitMiddleware, async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true || body.overwrite === 'true' || body.overwrite === '1';\n    if (!name) {\n      return c.json(\n        { ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' },\n        400,\n      );\n    }\n    try {\n      const payload = await service.installExtensionFromMarketplace({ name, version, overwrite });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/uninstall', strictRateLimitMiddleware, async (c) => {\n    let body: { extensionId?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const extensionId = typeof body.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: 'Expected { extensionId: string }' }, 400);\n    }\n    try {\n      const payload = await service.uninstallUserExtension(extensionId);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Uninstall failed' },\n        400,\n      );\n    }\n  });\n\n  // POST /api/registry/reload — reload gateway config and refresh model list for clients\n  authenticated.post('/api/registry/reload', async (c) => {\n    try {\n      // Reload config\n      await service.reloadConfig();\n      \n      // Reload OAuth credentials from new config\n      loadOAuthCredentialsToCache(service);\n      \n      const models = getAllModels();\n      \n      // Emit SSE event to all connected clients\n      service.emit('registry.updated', { modelCount: models.length });\n      \n      return c.json({\n        ok: true,\n        payload: {\n          message: 'Registry reloaded',\n          modelCount: models.length,\n        },\n      });\n    } catch (err) {\n      return c.json({\n        error: err instanceof Error ? err.message : 'Failed to reload registry',\n      }, 500);\n    }\n  });\n\n}\n"],"mappings":";;;;;;;;;;;;gBAUqG;AAOrG,MAAM,sBACJ;;AAYF,SAAS,gCAAgC,GAAsE;CAC7G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,KAAI,WAAW,OAAQ,QAAO;AAC9B,KAAI,OAAQ,QAAO;AACnB,QAAO;;AAGT,SAAS,0BAA0B,MAAc,aAAqB,WAA2B;CAE/F,MAAM,YAAY,mBAAmB,YAAY,UADhC,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,UAAU,YAAY,IAAI,GAAG,EAAE,GAAG;AAGhG,QAAO,KACJ,QAAQ,qDAAqD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI/F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GAClD,OAAO,GAAG,YAAY,SACjB,MAAM;GAC5C,CACD,QAAQ,oDAAoD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI9F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GACjD,OAAO,GAAG,YAAY,SACjB;GACvC;;AAGN,SAAS,wBAAwB,QAA0B;AACzD,KAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;CAClD,MAAM,aAAc,OAAoC;AACxD,QAAO,QAAQ,cAAc,OAAO,eAAe,YAAY,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE;;;;;;;;;;;;;;AAepG,SAAgB,mCAAmC,KAAW,SAA+B;AAC3F,KAAI,IAAI,gCAAgC,OAAO,MAAM;EACnD,MAAM,OAAO,gCAAgC,EAAE;EAC/C,MAAM,UAAU,EAAE,+BAA+B,MAAM;EAEvD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,KAAK,QAAQ;EAIlE,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,OAAO,CAAC,IAAI,SAAS,GACxB,QAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,EAAE,KAAK,QAAQ;EAG5E,MAAM,SAAS,mBAAmB,YAAY;EAC9C,MAAM,mBAAmB,EAAE,IAAI,KAAK,WAAW,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,OAAO,OAAO,GAAG;EAC3F,IAAI,YAAY;AAChB,MAAI;AACF,eAAY,mBAAmB,iBAAiB;UAC1C;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;;AAG9D,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,CACxC,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;EAG9D,MAAM,OAAO,QAAQ,IAAI,KAAK;EAC9B,MAAM,WAAW,QAAQ,MAAM,UAAU;EACzC,MAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,IAAI,WAAW,KAAK,IAAI,QAAQ,GAClC,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,KAAK,QAAQ;AAGjE,MAAI,CAAC,WAAW,SAAS,IAAI,CAAC,SAAS,SAAS,CAAC,QAAQ,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,KAAK,QAAQ;EAGrD,MAAM,aAAa,aAAa,SAAS;EACzC,MAAM,WAAW,uBAAuB,UAAU;EAElD,MAAM,OAA4B,SAAS,WAAW,YAAY,GAC9D,0BAA0B,WAAW,SAAS,QAAQ,EAAE,aAAa,UAAU,GAC/E,IAAI,WAAW,WAAW;AAE9B,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,2BAA2B;IAC3B,iBAAiB;IACjB,0BAA0B;IAC1B,+BAA+B;IAChC;GACF,CAAC;GACF;;AAGJ,SAAgB,qCAAqC,eAAqB,MAAoC;CAC5G,MAAM,EAAE,SAAS,8BAA8B;AAK/C,eAAc,IAAI,oBAAoB,MAAM;EAC1C,MAAM,YAAY,QAAQ,cAAc;AACxC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,OAAO;IACP,MAAM,QAAQ,aAAa;IAC5B;GACF,CAAC;GACF;AAGF,eAAc,KAAK,2BAA2B,OAAO,MAAM;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,kBAAkB;AACjD,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,OAAO;KACP,SAAS;KACV;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EAAE,IAAI;;GAET;AAGF,eAAc,MAAM,mBAAmB,mBAAmB,QAAQ,CAAC;AAGnE,eAAc,MAAM,yBAAyB,wBAAwB,QAAQ,CAAC;AAQ9E,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,YAAY,cAAc;EAChC,MAAM,kBAAkB,MAAM,oBAAoB;EAClD,MAAM,aAAa,IAAI,IAAI,gBAAgB,KAAI,MAAK,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;EAG7E,MAAM,8BAAc,IAAI,KAA2B;AACnD,OAAK,MAAM,SAAS,WAAW;GAC7B,MAAM,OAAO,YAAY,IAAI,MAAM,SAAS,IAAI,EAAE;AAClD,QAAK,KAAK,MAAM;AAChB,eAAY,IAAI,MAAM,UAAU,KAAK;;AAGvC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,SAAS;IACT,WAAW,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,aAAa;KAClE;KACA,MAAM,GAAG,OAAO,EAAE,CAAC,aAAa,GAAG,GAAG,MAAM,EAAE;KAC9C,YAAY,OAAO,MAAK,MAAK,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;KACrE,QAAQ,OAAO,KAAI,OAAM;MACvB,KAAK,GAAG,EAAE,SAAS,GAAG,EAAE;MACxB,IAAI,EAAE;MACN,MAAM,EAAE;MACR,UAAU,EAAE;MACZ,WAAW,EAAE,aAAa;MAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;MAC1B,eAAe,EAAE,iBAAiB;MAClC,WAAW,EAAE,aAAa;MAC1B,MAAM;OACJ,OAAO,EAAE,MAAM,SAAS;OACxB,QAAQ,EAAE,MAAM,UAAU;OAC3B;MACD,WAAW,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK;MACnD,EAAE;KACJ,EAAE;IACJ;GACF,CAAC;GACF;AAIF,eAAc,IAAI,mBAAmB,OAAO,MAAM;EAChD,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;EAGnC,MAAM,WAAW,OAAO,aAAa;EACrC,MAAM,aAAa,OAAO,oBAAoB;EAC9C,MAAM,4BAAY,IAAI,KAAa;AACnC,OAAK,MAAM,CAAC,OAAO,SAAS,WAC1B,WAAU,IAAI,GAAG;AAGnB,SAAO,UAAU,QAAQ,cAA0C;EACnE,IAAI,wCAAqC,IAAI,KAAK;AAClD,MAAI;GACF,MAAM,UAAU,IAAI,kBAAkB,OAAO,uBAAuB,CAAC;AACrE,2BAAwB,IAAI,IAC1B,QAAQ,gBAAgB,uBAAuB,QAAQ,cAA0C,CAAC,CACnG;UACK;AACN,2CAAwB,IAAI,KAAK;;EAGnC,MAAM,aAAa,WAAW,KAAK,SAAS;GAC1C,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,QAAQ,UAAU,IAAI,IAAI,GAAG;GAC7B,oBAAoB,sBAAsB,IAAI,IAAI,GAAG;GACrD,OAAO,QAAQ,IAAI,SAAS,GAAG;GAC/B,iBAAiB,wBAAwB,IAAI,SAAS,aAAa;GACnE,IAAI,IAAI,SAAS,KACb;IACE,MAAM,IAAI,SAAS,GAAG;IACtB,aAAa,IAAI,SAAS,GAAG;IAC7B,eAAe,IAAI,SAAS,GAAG;IAChC,GACD,KAAA;GACL,EAAE;AACH,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;;;;;AAMF,eAAc,KAAK,sCAAsC,2BAA2B,OAAO,MAAM;EAC/F,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAGlD,MAAM,cACJ,OAAO,MAAM,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACpE,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2BAA2B;GAAE,EAAE,IAAI;AAElF,MAAI,OAAO,MAAM,YAAY,UAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6BAA6B;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,MAAM,QAAQ,oCAAoC,aAAa,KAAK,QAAQ;AAC3F,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,SAAS,kBAAkB;GAAE,EAAE,IAAI;AAEzF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,wBAAwB,OAAO,wBAAwB;GACnE,CAAC;GACF;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,EAAE,IAAI;EAEtD,MAAM,WAAW,OAAO,aAAa;AACrC,SAAO,EAAE,KAAK;GACZ,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,MAAM,IAAI;GACV,QAAQ,SAAS,WAAW,IAAI,IAAI,GAAG;GACvC,UAAU,IAAI;GACf,CAAC;GACF;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAE5D,MAAM,QAAQ,MAAM,mBADA,EAAE,IAAI,MAAM,KACkB,CAAC;AACnD,SAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;GAC3C;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,MAAI,EAAE,OAAO,OACX,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AAEhD,SAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,CAAC;GACpC;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAClD,MAAI,SAAS,QAAQ,EAAE,WAAW,MAChC,QAAO,EAAE,KAAK,EAAE,OAAO,+CAA6C,EAAE,IAAI;EAE5E,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,QAAM,OAAO,KAAK;AAClB,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,OAAO,oCAAoC,OAAO,MAAM;EACpE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,SAAO,MAAM;AACb,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,MAAM,mBAAmB,aAAa,cAAc,CAAC;GACnE;AAEF,eAAc,MAAM,8BAA8B,OAAO,MAAM;EAC7D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,QAAS,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACnD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,EAAE,IAAI;EAErE,MAAM,YAAY,aAAa;EAC/B,MAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,SAAO,OAAO,QAAQ,MAAM;AAC5B,QAAM,mBAAmB,WAAW,OAAO;AAC3C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,iBAAiB,MAAM;EACvC,MAAM,SAAS,QAAQ,oBAAoB;EAC3C,MAAM,WAAW,yBACf,QAAQ,eACR,OACD;AACD,SAAO,EAAE,KAAK,SAAS;GACvB;AAEF,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI;EAC1B,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AACxC,MAAI;GACF,IAAI;AACJ,OAAI,OAAO,MAAM,YAAY,EAAE,MAAM,CACnC,cAAa,MAAMA,iBAAsC,EAAE,MAAM,CAAC;YACzD,OAAO,aAAa,YAAY,SAAS,MAAM,CACxD,cAAa,MAAMC,eAAoC,SAAS,MAAM,CAAC;OAGvE,eAAa,MADKC,eAAoC,EACrC;AAEnB,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAY,CAAC;WAChC,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,YAAY,EAAE;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EACD,IACD;;GAEH;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,uCAAuC,QAAQ;AAC7E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,4BAA4B,2BAA2B,OAAO,MAAM;EACrF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,cAAc;AAC7E,MAAI,CAAC,KACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;GAAoE,EACxF,IACD;AAEH,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,gCAAgC;IAAE;IAAM;IAAS;IAAW,CAAC;AAC3F,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,8BAA8B,2BAA2B,OAAO,MAAM;EACvF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACrF,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;AAE9E,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,uBAAuB,YAAY;AACjE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAoB,EAC7E,IACD;;GAEH;AAGF,eAAc,KAAK,wBAAwB,OAAO,MAAM;AACtD,MAAI;AAEF,SAAM,QAAQ,cAAc;GAK5B,MAAM,SAAS,cAAc;AAG7B,WAAQ,KAAK,oBAAoB,EAAE,YAAY,OAAO,QAAQ,CAAC;AAE/D,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT,YAAY,OAAO;KACpB;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,6BAC7C,EAAE,IAAI;;GAET"}
+{"version":3,"file":"auth-registry-extensions.js","names":["extensionMarketplace.searchExtensions","extensionMarketplace.listExtensions","extensionMarketplace.fetchRegistry"],"sources":["../../../../../src/gateway/hono/routes/auth-registry-extensions.ts"],"sourcesContent":["import type { Hono } from 'hono';\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { relative, resolve } from 'node:path';\n\nimport type { Config as SurfaceConfig } from '../../../config/config-surface.js';\nimport type { GatewayService } from '../../service.js';\nimport { buildWhenContextSnapshot } from '../../../extensions/when-context.js';\nimport * as extensionMarketplace from '../../../extensions/marketplace.js';\nimport { mergeActivationContext } from '../../../extensions/activation-context.js';\nimport { ActivationPlanner } from '../../../extensions/activation-planner.js';\nimport { getAllModels, getAvailableModels, type Model, type Api } from '../../../providers/index.js';\nimport { createOAuthHandler, loadOAuthCredentialsToCache } from '../oauth.js';\nimport { createOAuthAsyncHandler } from '../oauth-async.js';\nimport { extensionAssetMimeType } from '../lib/extension-assets.js';\nimport { loadExtensionStore, saveExtensionStore } from '../lib/extension-store.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nconst EXTENSION_ASSET_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self' 'unsafe-inline'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: blob:; \" +\n  \"connect-src 'none'; \" +\n  \"frame-ancestors 'self'; \" +\n  \"frame-src 'none'; \" +\n  \"base-uri 'none'; \" +\n  \"object-src 'none'; \" +\n  \"form-action 'none'\";\n\n/** Sandboxed extension iframes send `Origin: null`; echo it (and real origins) so every status includes ACAO. */\nfunction extensionUiAssetCorsAllowOrigin(c: { req: { header: (name: string) => string | undefined } }): string {\n  const origin = c.req.header('origin');\n  if (origin === 'null') return 'null';\n  if (origin) return origin;\n  return '*';\n}\n\nfunction rewriteExtensionAssetHtml(html: string, extensionId: string, assetPath: string): string {\n  const assetDir = assetPath.includes('/') ? assetPath.slice(0, assetPath.lastIndexOf('/') + 1) : '';\n  const assetBase = `/api/extensions/${extensionId}/assets/${assetDir}`;\n\n  return html\n    .replace(/(<script\\b[^>]*?\\ssrc=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedSrc = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedSrc}${quote} crossorigin=\"anonymous\"`;\n    })\n    .replace(/(<link\\b[^>]*?\\shref=)([\"'])(\\.\\/)?([^\"']+)\\2/gi, (_match, tag, quote, _dot, file) => {\n      const isAbsolute =\n        file.startsWith('/') || file.startsWith('http://') || file.startsWith('https://');\n      const resolvedHref = isAbsolute ? file : `${assetBase}${file}`;\n      return `${tag}${quote}${resolvedHref}${quote}`;\n    });\n}\n\nfunction hasNonEmptyConfigSchema(schema: unknown): boolean {\n  if (!schema || typeof schema !== 'object') return false;\n  const properties = (schema as { properties?: unknown }).properties;\n  return Boolean(properties && typeof properties === 'object' && Object.keys(properties).length > 0);\n}\n\n/**\n * Register extension UI asset routes on the public (unauthenticated) app.\n *\n * Sandboxed iframes (`sandbox=\"allow-scripts …\"` without `allow-same-origin`) have an\n * opaque origin of `null`, so sub-resource requests from inside the iframe cannot\n * carry the `?token=` query parameter that was on the parent HTML URL. Putting these\n * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.\n *\n * Security is maintained by the strict Content-Security-Policy returned with every\n * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway\n * console itself from embedding the extension iframes.\n */\nexport function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void {\n  app.get('/api/extensions/:id/assets/*', async (c) => {\n    const acao = extensionUiAssetCorsAllowOrigin(c);\n    const corsHdr = { 'Access-Control-Allow-Origin': acao } as const;\n\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503, corsHdr);\n    }\n\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext || !ext.manifest.ui) {\n      return c.json({ error: 'Extension not found or has no UI' }, 404, corsHdr);\n    }\n\n    const prefix = `/api/extensions/${extensionId}/assets/`;\n    const assetPathEncoded = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : '';\n    let assetPath = assetPathEncoded;\n    try {\n      assetPath = decodeURIComponent(assetPathEncoded);\n    } catch {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    if (!assetPath || assetPath.includes('..')) {\n      return c.json({ error: 'Invalid asset path' }, 400, corsHdr);\n    }\n\n    const root = resolve(ext.path);\n    const fullPath = resolve(root, assetPath);\n    const rel = relative(root, fullPath);\n    if (rel.startsWith('..') || rel === '') {\n      return c.json({ error: 'Path traversal denied' }, 403, corsHdr);\n    }\n\n    if (!existsSync(fullPath) || !statSync(fullPath).isFile()) {\n      return c.json({ error: 'Not found' }, 404, corsHdr);\n    }\n\n    const rawContent = readFileSync(fullPath);\n    const mimeType = extensionAssetMimeType(assetPath);\n\n    const body: string | Uint8Array = mimeType.startsWith('text/html')\n      ? rewriteExtensionAssetHtml(rawContent.toString('utf-8'), extensionId, assetPath)\n      : new Uint8Array(rawContent);\n\n    return new Response(body, {\n      status: 200,\n      headers: {\n        'Content-Type': mimeType,\n        'Content-Security-Policy': EXTENSION_ASSET_CSP,\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n        'Access-Control-Allow-Origin': acao,\n      },\n    });\n  });\n}\n\nexport function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service, strictRateLimitMiddleware } = deps;\n\n  // ========== Auth API (/api/auth) ==========\n\n  // GET /api/auth/token - Get current gateway token\n  authenticated.get('/api/auth/token', (c) => {\n    const authToken = service.getAuthToken();\n    return c.json({ \n      ok: true, \n      payload: { \n        token: authToken,\n        mode: service.getAuthMode(),\n      } \n    });\n  });\n\n  // POST /api/auth/token/refresh - Generate new gateway token\n  authenticated.post('/api/auth/token/refresh', async (c) => {\n    try {\n      const newToken = await service.refreshAuthToken();\n      return c.json({ \n        ok: true, \n        payload: { \n          token: newToken,\n          message: 'Token refreshed successfully. Please update your client configuration.'\n        } \n      });\n    } catch (err) {\n      return c.json({ \n        ok: false, \n        error: err instanceof Error ? err.message : 'Failed to refresh token' \n      }, 500);\n    }\n  });\n\n  // ========== OAuth API (/api/auth/oauth) ==========\n  authenticated.route('/api/auth/oauth', createOAuthHandler(service));\n\n  // ========== Async OAuth API (/api/auth/oauth-async) ==========\n  authenticated.route('/api/auth/oauth-async', createOAuthAsyncHandler(service));\n\n  // Load OAuth credentials from config into cache on startup\n  loadOAuthCredentialsToCache(service);\n\n  // ========== Registry API ==========\n  \n  // GET /api/registry - Full registry for frontend\n  authenticated.get('/api/registry', async (c) => {\n    const allModels = getAllModels();\n    const availableModels = await getAvailableModels();\n    const configured = new Set(availableModels.map(m => `${m.provider}/${m.id}`));\n    \n    // Group models by provider\n    const providerMap = new Map<string, Model<Api>[]>();\n    for (const model of allModels) {\n      const list = providerMap.get(model.provider) ?? [];\n      list.push(model);\n      providerMap.set(model.provider, list);\n    }\n    \n    return c.json({\n      ok: true,\n      payload: {\n        version: 'pi-ai',\n        providers: Array.from(providerMap.entries()).map(([id, models]) => ({\n          id,\n          name: id.charAt(0).toUpperCase() + id.slice(1),\n          configured: models.some(m => configured.has(`${m.provider}/${m.id}`)),\n          models: models.map(m => ({\n            ref: `${m.provider}/${m.id}`,\n            id: m.id,\n            name: m.name,\n            provider: m.provider,\n            reasoning: m.reasoning ?? false,\n            input: m.input ?? ['text'],\n            contextWindow: m.contextWindow ?? 128000,\n            maxTokens: m.maxTokens ?? 4096,\n            cost: {\n              input: m.cost?.input ?? 0,\n              output: m.cost?.output ?? 0,\n            },\n            available: configured.has(`${m.provider}/${m.id}`),\n          })),\n        })),\n      },\n    });\n  });\n\n  // ========== Extension UI (manifest discovery + static assets) ==========\n\n  authenticated.get('/api/extensions', async (c) => {\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ extensions: [] });\n    }\n\n    const registry = loader.getRegistry();\n    const discovered = loader.discoverExtensions();\n    const activeIds = new Set<string>();\n    for (const [id] of registry.extensions) {\n      activeIds.add(id);\n    }\n\n    loader.setConfig(service.currentConfig as unknown as SurfaceConfig);\n    let activationEligibleIds: Set<string> = new Set();\n    try {\n      const planner = new ActivationPlanner(loader.buildManifestRegistry());\n      activationEligibleIds = new Set(\n        planner.getActivatedIds(mergeActivationContext(service.currentConfig as unknown as SurfaceConfig)),\n      );\n    } catch {\n      activationEligibleIds = new Set();\n    }\n\n    const extensions = discovered.map((ext) => ({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      active: activeIds.has(ext.id),\n      activationEligible: activationEligibleIds.has(ext.id),\n      hasUi: Boolean(ext.manifest.ui),\n      hasConfigSchema: hasNonEmptyConfigSchema(ext.manifest.configSchema),\n      ui: ext.manifest.ui\n        ? {\n            icon: ext.manifest.ui.icon,\n            permissions: ext.manifest.ui.permissions,\n            contributions: ext.manifest.ui.contributions,\n          }\n        : undefined,\n    }));\n    return c.json({ extensions });\n  });\n\n  /**\n   * Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.\n   * Body: `{ extensionId: string, enabled: boolean }`\n   */\n  authenticated.post('/api/extensions/bundled/activation', strictRateLimitMiddleware, async (c) => {\n    const body = (await c.req.json().catch(() => null)) as\n      | { extensionId?: unknown; enabled?: unknown }\n      | null;\n    const extensionId =\n      typeof body?.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: { message: 'extensionId is required' } }, 400);\n    }\n    if (typeof body?.enabled !== 'boolean') {\n      return c.json({ ok: false, error: { message: 'enabled must be a boolean' } }, 400);\n    }\n    const result = await service.setBundledExtensionActivationTarget(extensionId, body.enabled);\n    if (!result.ok) {\n      return c.json({ ok: false, error: { message: result.error ?? 'Request failed' } }, 400);\n    }\n    return c.json({\n      ok: true,\n      payload: { requiresGatewayRestart: result.requiresGatewayRestart },\n    });\n  });\n\n  authenticated.get('/api/extensions/:id', async (c) => {\n    const extensionId = c.req.param('id');\n    const loader = service.getExtensionLoader();\n    if (!loader) {\n      return c.json({ error: 'Extensions unavailable' }, 503);\n    }\n    const discovered = loader.discoverExtensions();\n    const ext = discovered.find((e) => e.id === extensionId);\n    if (!ext) {\n      return c.json({ error: 'Extension not found' }, 404);\n    }\n    const registry = loader.getRegistry();\n    return c.json({\n      id: ext.manifest.id,\n      name: ext.manifest.name,\n      description: ext.manifest.description,\n      version: ext.manifest.version,\n      kind: ext.manifest.kind,\n      source: ext.source,\n      path: ext.path,\n      active: registry.extensions.has(ext.id),\n      manifest: ext.manifest,\n    });\n  });\n\n  authenticated.get('/api/extensions/:id/storage', async (c) => {\n    const extensionId = c.req.param('id');\n    const store = await loadExtensionStore(extensionId);\n    return c.json({ keys: Object.keys(store) });\n  });\n\n  authenticated.get('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    if (!(key in store)) {\n      return c.json({ error: 'Key not found' }, 404);\n    }\n    return c.json({ value: store[key] });\n  });\n\n  authenticated.put('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const body = (await c.req.json().catch(() => null)) as { value?: unknown } | null;\n    if (body === null || !('value' in body)) {\n      return c.json({ error: 'Request body must contain a \"value\" field' }, 400);\n    }\n    const store = await loadExtensionStore(extensionId);\n    store[key] = body.value;\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.delete('/api/extensions/:id/storage/:key', async (c) => {\n    const extensionId = c.req.param('id');\n    const key = decodeURIComponent(c.req.param('key'));\n    const store = await loadExtensionStore(extensionId);\n    delete store[key];\n    await saveExtensionStore(extensionId, store);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    return c.json(await loadExtensionStore(`__config__${extensionId}`));\n  });\n\n  authenticated.patch('/api/extensions/:id/config', async (c) => {\n    const extensionId = c.req.param('id');\n    const patch = (await c.req.json().catch(() => null)) as Record<string, unknown> | null;\n    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {\n      return c.json({ error: 'Request body must be a JSON object' }, 400);\n    }\n    const namespace = `__config__${extensionId}`;\n    const config = await loadExtensionStore(namespace);\n    Object.assign(config, patch);\n    await saveExtensionStore(namespace, config);\n    return c.json({ ok: true });\n  });\n\n  authenticated.get('/api/context', (c) => {\n    const loader = service.getExtensionLoader();\n    const snapshot = buildWhenContextSnapshot(\n      service.currentConfig as unknown as SurfaceConfig,\n      loader,\n    );\n    return c.json(snapshot);\n  });\n\n  authenticated.get('/api/marketplace', async (c) => {\n    const q = c.req.query('q');\n    const category = c.req.query('category');\n    try {\n      let extensions;\n      if (typeof q === 'string' && q.trim()) {\n        extensions = await extensionMarketplace.searchExtensions(q.trim());\n      } else if (typeof category === 'string' && category.trim()) {\n        extensions = await extensionMarketplace.listExtensions(category.trim());\n      } else {\n        const reg = await extensionMarketplace.fetchRegistry();\n        extensions = reg.extensions;\n      }\n      return c.json({ ok: true, extensions });\n    } catch (err) {\n      return c.json(\n        {\n          ok: false,\n          extensions: [],\n          error: err instanceof Error ? err.message : 'marketplace fetch failed',\n        },\n        500,\n      );\n    }\n  });\n\n  authenticated.get('/api/marketplace/packages/:pkgName', async (c) => {\n    const raw = c.req.param('pkgName');\n    if (!raw) {\n      return c.json({ ok: false, error: 'Missing package name' }, 400);\n    }\n    let pkgName: string;\n    try {\n      pkgName = decodeURIComponent(raw);\n    } catch {\n      return c.json({ ok: false, error: 'Invalid package name' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.fetchExtensionPackageDetail(pkgName);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Marketplace request failed' },\n        502,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/install', strictRateLimitMiddleware, async (c) => {\n    let body: { name?: unknown; version?: unknown; overwrite?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const name = typeof body.name === 'string' ? body.name.trim() : '';\n    const version = typeof body.version === 'string' ? body.version.trim() : undefined;\n    const overwrite =\n      body.overwrite === true || body.overwrite === 'true' || body.overwrite === '1';\n    if (!name) {\n      return c.json(\n        { ok: false, error: 'Expected { name: string, version?: string, overwrite?: boolean }' },\n        400,\n      );\n    }\n    try {\n      const payload = await service.marketplace.installExtension({ name, version, overwrite });\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Install failed' },\n        400,\n      );\n    }\n  });\n\n  authenticated.post('/api/marketplace/uninstall', strictRateLimitMiddleware, async (c) => {\n    let body: { extensionId?: unknown };\n    try {\n      body = (await c.req.json()) as typeof body;\n    } catch {\n      return c.json({ ok: false, error: 'Invalid JSON' }, 400);\n    }\n    const extensionId = typeof body.extensionId === 'string' ? body.extensionId.trim() : '';\n    if (!extensionId) {\n      return c.json({ ok: false, error: 'Expected { extensionId: string }' }, 400);\n    }\n    try {\n      const payload = await service.marketplace.uninstallExtension(extensionId);\n      return c.json({ ok: true, payload });\n    } catch (err) {\n      return c.json(\n        { ok: false, error: err instanceof Error ? err.message : 'Uninstall failed' },\n        400,\n      );\n    }\n  });\n\n  // POST /api/registry/reload — reload gateway config and refresh model list for clients\n  authenticated.post('/api/registry/reload', async (c) => {\n    try {\n      // Reload config\n      await service.reloadConfig();\n      \n      // Reload OAuth credentials from new config\n      loadOAuthCredentialsToCache(service);\n      \n      const models = getAllModels();\n      \n      // Emit SSE event to all connected clients\n      service.emit('registry.updated', { modelCount: models.length });\n      \n      return c.json({\n        ok: true,\n        payload: {\n          message: 'Registry reloaded',\n          modelCount: models.length,\n        },\n      });\n    } catch (err) {\n      return c.json({\n        error: err instanceof Error ? err.message : 'Failed to reload registry',\n      }, 500);\n    }\n  });\n\n}\n"],"mappings":";;;;;;;;;;;;gBAUqG;AAOrG,MAAM,sBACJ;;AAYF,SAAS,gCAAgC,GAAsE;CAC7G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,KAAI,WAAW,OAAQ,QAAO;AAC9B,KAAI,OAAQ,QAAO;AACnB,QAAO;;AAGT,SAAS,0BAA0B,MAAc,aAAqB,WAA2B;CAE/F,MAAM,YAAY,mBAAmB,YAAY,UADhC,UAAU,SAAS,IAAI,GAAG,UAAU,MAAM,GAAG,UAAU,YAAY,IAAI,GAAG,EAAE,GAAG;AAGhG,QAAO,KACJ,QAAQ,qDAAqD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI/F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GAClD,OAAO,GAAG,YAAY,SACjB,MAAM;GAC5C,CACD,QAAQ,oDAAoD,QAAQ,KAAK,OAAO,MAAM,SAAS;AAI9F,SAAO,GAAG,MAAM,QAFd,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,UAAU,IAAI,KAAK,WAAW,WAAW,GACjD,OAAO,GAAG,YAAY,SACjB;GACvC;;AAGN,SAAS,wBAAwB,QAA0B;AACzD,KAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;CAClD,MAAM,aAAc,OAAoC;AACxD,QAAO,QAAQ,cAAc,OAAO,eAAe,YAAY,OAAO,KAAK,WAAW,CAAC,SAAS,EAAE;;;;;;;;;;;;;;AAepG,SAAgB,mCAAmC,KAAW,SAA+B;AAC3F,KAAI,IAAI,gCAAgC,OAAO,MAAM;EACnD,MAAM,OAAO,gCAAgC,EAAE;EAC/C,MAAM,UAAU,EAAE,+BAA+B,MAAM;EAEvD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,KAAK,QAAQ;EAIlE,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,OAAO,CAAC,IAAI,SAAS,GACxB,QAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,EAAE,KAAK,QAAQ;EAG5E,MAAM,SAAS,mBAAmB,YAAY;EAC9C,MAAM,mBAAmB,EAAE,IAAI,KAAK,WAAW,OAAO,GAAG,EAAE,IAAI,KAAK,MAAM,OAAO,OAAO,GAAG;EAC3F,IAAI,YAAY;AAChB,MAAI;AACF,eAAY,mBAAmB,iBAAiB;UAC1C;AACN,UAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;;AAG9D,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK,CACxC,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,KAAK,QAAQ;EAG9D,MAAM,OAAO,QAAQ,IAAI,KAAK;EAC9B,MAAM,WAAW,QAAQ,MAAM,UAAU;EACzC,MAAM,MAAM,SAAS,MAAM,SAAS;AACpC,MAAI,IAAI,WAAW,KAAK,IAAI,QAAQ,GAClC,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,KAAK,QAAQ;AAGjE,MAAI,CAAC,WAAW,SAAS,IAAI,CAAC,SAAS,SAAS,CAAC,QAAQ,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,KAAK,QAAQ;EAGrD,MAAM,aAAa,aAAa,SAAS;EACzC,MAAM,WAAW,uBAAuB,UAAU;EAElD,MAAM,OAA4B,SAAS,WAAW,YAAY,GAC9D,0BAA0B,WAAW,SAAS,QAAQ,EAAE,aAAa,UAAU,GAC/E,IAAI,WAAW,WAAW;AAE9B,SAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,2BAA2B;IAC3B,iBAAiB;IACjB,0BAA0B;IAC1B,+BAA+B;IAChC;GACF,CAAC;GACF;;AAGJ,SAAgB,qCAAqC,eAAqB,MAAoC;CAC5G,MAAM,EAAE,SAAS,8BAA8B;AAK/C,eAAc,IAAI,oBAAoB,MAAM;EAC1C,MAAM,YAAY,QAAQ,cAAc;AACxC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,OAAO;IACP,MAAM,QAAQ,aAAa;IAC5B;GACF,CAAC;GACF;AAGF,eAAc,KAAK,2BAA2B,OAAO,MAAM;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,kBAAkB;AACjD,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,OAAO;KACP,SAAS;KACV;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EAAE,IAAI;;GAET;AAGF,eAAc,MAAM,mBAAmB,mBAAmB,QAAQ,CAAC;AAGnE,eAAc,MAAM,yBAAyB,wBAAwB,QAAQ,CAAC;AAQ9E,eAAc,IAAI,iBAAiB,OAAO,MAAM;EAC9C,MAAM,YAAY,cAAc;EAChC,MAAM,kBAAkB,MAAM,oBAAoB;EAClD,MAAM,aAAa,IAAI,IAAI,gBAAgB,KAAI,MAAK,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;EAG7E,MAAM,8BAAc,IAAI,KAA2B;AACnD,OAAK,MAAM,SAAS,WAAW;GAC7B,MAAM,OAAO,YAAY,IAAI,MAAM,SAAS,IAAI,EAAE;AAClD,QAAK,KAAK,MAAM;AAChB,eAAY,IAAI,MAAM,UAAU,KAAK;;AAGvC,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS;IACP,SAAS;IACT,WAAW,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,aAAa;KAClE;KACA,MAAM,GAAG,OAAO,EAAE,CAAC,aAAa,GAAG,GAAG,MAAM,EAAE;KAC9C,YAAY,OAAO,MAAK,MAAK,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK,CAAC;KACrE,QAAQ,OAAO,KAAI,OAAM;MACvB,KAAK,GAAG,EAAE,SAAS,GAAG,EAAE;MACxB,IAAI,EAAE;MACN,MAAM,EAAE;MACR,UAAU,EAAE;MACZ,WAAW,EAAE,aAAa;MAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;MAC1B,eAAe,EAAE,iBAAiB;MAClC,WAAW,EAAE,aAAa;MAC1B,MAAM;OACJ,OAAO,EAAE,MAAM,SAAS;OACxB,QAAQ,EAAE,MAAM,UAAU;OAC3B;MACD,WAAW,WAAW,IAAI,GAAG,EAAE,SAAS,GAAG,EAAE,KAAK;MACnD,EAAE;KACJ,EAAE;IACJ;GACF,CAAC;GACF;AAIF,eAAc,IAAI,mBAAmB,OAAO,MAAM;EAChD,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;EAGnC,MAAM,WAAW,OAAO,aAAa;EACrC,MAAM,aAAa,OAAO,oBAAoB;EAC9C,MAAM,4BAAY,IAAI,KAAa;AACnC,OAAK,MAAM,CAAC,OAAO,SAAS,WAC1B,WAAU,IAAI,GAAG;AAGnB,SAAO,UAAU,QAAQ,cAA0C;EACnE,IAAI,wCAAqC,IAAI,KAAK;AAClD,MAAI;GACF,MAAM,UAAU,IAAI,kBAAkB,OAAO,uBAAuB,CAAC;AACrE,2BAAwB,IAAI,IAC1B,QAAQ,gBAAgB,uBAAuB,QAAQ,cAA0C,CAAC,CACnG;UACK;AACN,2CAAwB,IAAI,KAAK;;EAGnC,MAAM,aAAa,WAAW,KAAK,SAAS;GAC1C,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,QAAQ,UAAU,IAAI,IAAI,GAAG;GAC7B,oBAAoB,sBAAsB,IAAI,IAAI,GAAG;GACrD,OAAO,QAAQ,IAAI,SAAS,GAAG;GAC/B,iBAAiB,wBAAwB,IAAI,SAAS,aAAa;GACnE,IAAI,IAAI,SAAS,KACb;IACE,MAAM,IAAI,SAAS,GAAG;IACtB,aAAa,IAAI,SAAS,GAAG;IAC7B,eAAe,IAAI,SAAS,GAAG;IAChC,GACD,KAAA;GACL,EAAE;AACH,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;;;;;AAMF,eAAc,KAAK,sCAAsC,2BAA2B,OAAO,MAAM;EAC/F,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAGlD,MAAM,cACJ,OAAO,MAAM,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACpE,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,2BAA2B;GAAE,EAAE,IAAI;AAElF,MAAI,OAAO,MAAM,YAAY,UAC3B,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,6BAA6B;GAAE,EAAE,IAAI;EAEpF,MAAM,SAAS,MAAM,QAAQ,oCAAoC,aAAa,KAAK,QAAQ;AAC3F,MAAI,CAAC,OAAO,GACV,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO,EAAE,SAAS,OAAO,SAAS,kBAAkB;GAAE,EAAE,IAAI;AAEzF,SAAO,EAAE,KAAK;GACZ,IAAI;GACJ,SAAS,EAAE,wBAAwB,OAAO,wBAAwB;GACnE,CAAC;GACF;AAEF,eAAc,IAAI,uBAAuB,OAAO,MAAM;EACpD,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,SAAS,QAAQ,oBAAoB;AAC3C,MAAI,CAAC,OACH,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;EAGzD,MAAM,MADa,OAAO,oBACJ,CAAC,MAAM,MAAM,EAAE,OAAO,YAAY;AACxD,MAAI,CAAC,IACH,QAAO,EAAE,KAAK,EAAE,OAAO,uBAAuB,EAAE,IAAI;EAEtD,MAAM,WAAW,OAAO,aAAa;AACrC,SAAO,EAAE,KAAK;GACZ,IAAI,IAAI,SAAS;GACjB,MAAM,IAAI,SAAS;GACnB,aAAa,IAAI,SAAS;GAC1B,SAAS,IAAI,SAAS;GACtB,MAAM,IAAI,SAAS;GACnB,QAAQ,IAAI;GACZ,MAAM,IAAI;GACV,QAAQ,SAAS,WAAW,IAAI,IAAI,GAAG;GACvC,UAAU,IAAI;GACf,CAAC;GACF;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAE5D,MAAM,QAAQ,MAAM,mBADA,EAAE,IAAI,MAAM,KACkB,CAAC;AACnD,SAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,MAAM,EAAE,CAAC;GAC3C;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,MAAI,EAAE,OAAO,OACX,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AAEhD,SAAO,EAAE,KAAK,EAAE,OAAO,MAAM,MAAM,CAAC;GACpC;AAEF,eAAc,IAAI,oCAAoC,OAAO,MAAM;EACjE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,OAAQ,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AAClD,MAAI,SAAS,QAAQ,EAAE,WAAW,MAChC,QAAO,EAAE,KAAK,EAAE,OAAO,+CAA6C,EAAE,IAAI;EAE5E,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,QAAM,OAAO,KAAK;AAClB,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,OAAO,oCAAoC,OAAO,MAAM;EACpE,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,MAAM,mBAAmB,EAAE,IAAI,MAAM,MAAM,CAAC;EAClD,MAAM,QAAQ,MAAM,mBAAmB,YAAY;AACnD,SAAO,MAAM;AACb,QAAM,mBAAmB,aAAa,MAAM;AAC5C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,8BAA8B,OAAO,MAAM;EAC3D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;AACrC,SAAO,EAAE,KAAK,MAAM,mBAAmB,aAAa,cAAc,CAAC;GACnE;AAEF,eAAc,MAAM,8BAA8B,OAAO,MAAM;EAC7D,MAAM,cAAc,EAAE,IAAI,MAAM,KAAK;EACrC,MAAM,QAAS,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;AACnD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO,EAAE,KAAK,EAAE,OAAO,sCAAsC,EAAE,IAAI;EAErE,MAAM,YAAY,aAAa;EAC/B,MAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,SAAO,OAAO,QAAQ,MAAM;AAC5B,QAAM,mBAAmB,WAAW,OAAO;AAC3C,SAAO,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC;GAC3B;AAEF,eAAc,IAAI,iBAAiB,MAAM;EACvC,MAAM,SAAS,QAAQ,oBAAoB;EAC3C,MAAM,WAAW,yBACf,QAAQ,eACR,OACD;AACD,SAAO,EAAE,KAAK,SAAS;GACvB;AAEF,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI;EAC1B,MAAM,WAAW,EAAE,IAAI,MAAM,WAAW;AACxC,MAAI;GACF,IAAI;AACJ,OAAI,OAAO,MAAM,YAAY,EAAE,MAAM,CACnC,cAAa,MAAMA,iBAAsC,EAAE,MAAM,CAAC;YACzD,OAAO,aAAa,YAAY,SAAS,MAAM,CACxD,cAAa,MAAMC,eAAoC,SAAS,MAAM,CAAC;OAGvE,eAAa,MADKC,eAAoC,EACrC;AAEnB,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAY,CAAC;WAChC,KAAK;AACZ,UAAO,EAAE,KACP;IACE,IAAI;IACJ,YAAY,EAAE;IACd,OAAO,eAAe,QAAQ,IAAI,UAAU;IAC7C,EACD,IACD;;GAEH;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,MAAM,EAAE,IAAI,MAAM,UAAU;AAClC,MAAI,CAAC,IACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAwB,EAAE,IAAI;EAElE,IAAI;AACJ,MAAI;AACF,aAAU,mBAAmB,IAAI;UAC3B;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAwB,EAAE,IAAI;;AAElE,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,4BAA4B,QAAQ;AAC9E,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAA8B,EACvF,IACD;;GAEH;AAEF,eAAc,KAAK,4BAA4B,2BAA2B,OAAO,MAAM;EACrF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,MAAM,GAAG;EAChE,MAAM,UAAU,OAAO,KAAK,YAAY,WAAW,KAAK,QAAQ,MAAM,GAAG,KAAA;EACzE,MAAM,YACJ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,cAAc;AAC7E,MAAI,CAAC,KACH,QAAO,EAAE,KACP;GAAE,IAAI;GAAO,OAAO;GAAoE,EACxF,IACD;AAEH,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,iBAAiB;IAAE;IAAM;IAAS;IAAW,CAAC;AACxF,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAkB,EAC3E,IACD;;GAEH;AAEF,eAAc,KAAK,8BAA8B,2BAA2B,OAAO,MAAM;EACvF,IAAI;AACJ,MAAI;AACF,UAAQ,MAAM,EAAE,IAAI,MAAM;UACpB;AACN,UAAO,EAAE,KAAK;IAAE,IAAI;IAAO,OAAO;IAAgB,EAAE,IAAI;;EAE1D,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,YAAY,MAAM,GAAG;AACrF,MAAI,CAAC,YACH,QAAO,EAAE,KAAK;GAAE,IAAI;GAAO,OAAO;GAAoC,EAAE,IAAI;AAE9E,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,YAAY,mBAAmB,YAAY;AACzE,UAAO,EAAE,KAAK;IAAE,IAAI;IAAM;IAAS,CAAC;WAC7B,KAAK;AACZ,UAAO,EAAE,KACP;IAAE,IAAI;IAAO,OAAO,eAAe,QAAQ,IAAI,UAAU;IAAoB,EAC7E,IACD;;GAEH;AAGF,eAAc,KAAK,wBAAwB,OAAO,MAAM;AACtD,MAAI;AAEF,SAAM,QAAQ,cAAc;GAK5B,MAAM,SAAS,cAAc;AAG7B,WAAQ,KAAK,oBAAoB,EAAE,YAAY,OAAO,QAAQ,CAAC;AAE/D,UAAO,EAAE,KAAK;IACZ,IAAI;IACJ,SAAS;KACP,SAAS;KACT,YAAY,OAAO;KACpB;IACF,CAAC;WACK,KAAK;AACZ,UAAO,EAAE,KAAK,EACZ,OAAO,eAAe,QAAQ,IAAI,UAAU,6BAC7C,EAAE,IAAI;;GAET"}

package/dist/src/gateway/hono/routes/browser.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Browser/extension settings routes: `/api/browser/*` except for the
+ * long-running install streams under `/api/browser/{playwright,cloakbrowser}/install/stream`
+ * (those live in `browser-install.ts` so the SSE pump doesn't have to load
+ * with the rest of settings).
+ *
+ * Four backend families:
+ *   - **Extension WS bridge** — pair Chrome via the xopc browser extension.
+ *     Owns a module-scoped manual handle so the bridge can outlive a config
+ *     save (UI flow: Start → pair → Save).
+ *   - **CloakBrowser** — install / launch / probe runtime status.
+ *   - **Playwright Chromium** — doctor + on-demand install of bundled browser.
+ *   - **Local CDP** — launch / list / stop user-driven debug Chrome instances.
+ *   - **Cloud providers** (browserbase / browser-use) — connection test.
+ *
+ * Extracted from `config.ts` (which was 2237 lines and 80% browser routes).
+ */
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerBrowserRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;