@xopcai/xopc 0.0.83 → 0.0.85

package/dist/src/daemon/schtasks.js.map

@@ -1 +1 @@
-{"version":3,"file":"schtasks.js","names":[],"sources":["../../../src/daemon/schtasks.ts"],"sourcesContent":["/**\n * Scheduled Task Service - Windows service management via schtasks\n *\n * Aligned with OpenClaw Windows implementation:\n * - Task with ONLOGON trigger for persistence\n * - RepetitionInterval for keep-alive behavior\n * - Proper start/stop/restart lifecycle\n */\n\nimport { spawn, spawnSync } from 'node:child_process';\nimport { createLogger } from '../utils/logger.js';\nimport { resolveGatewayWindowsTaskName } from './constants.js';\nimport type {\n  GatewayService,\n  GatewayServiceInstallArgs,\n  GatewayServiceControlArgs,\n  GatewayServiceEnvArgs,\n  GatewayServiceRuntime,\n  GatewayServiceCommandConfig,\n  GatewayServiceEnv,\n  GatewayServiceRestartResult,\n} from './types.js';\n\nconst log = createLogger('SchtasksService');\n\n// ─── Resolution ───\n\nfunction resolveProfileFromEnv(env?: GatewayServiceEnv): string | undefined {\n  return env?.XOPC_PROFILE?.trim() || undefined;\n}\n\nfunction resolveTaskName(env?: GatewayServiceEnv): string {\n  return resolveGatewayWindowsTaskName(resolveProfileFromEnv(env));\n}\n\n// ─── Command Execution ───\n\ninterface SchtasksResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number | null;\n}\n\nasync function schtasks(args: string[]): Promise<SchtasksResult> {\n  return new Promise<SchtasksResult>((resolve, reject) => {\n    const child = spawn('schtasks', args, {\n      stdio: ['ignore', 'pipe', 'pipe'],\n      shell: true,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    child.stdout?.on('data', (data) => { stdout += data.toString(); });\n    child.stderr?.on('data', (data) => { stderr += data.toString(); });\n\n    child.on('close', (code) => {\n      resolve({ stdout, stderr, exitCode: code });\n    });\n    child.on('error', (err) => {\n      reject(new Error(`schtasks spawn failed: ${err.message}`));\n    });\n  });\n}\n\nasync function schtasksExec(args: string[]): Promise<string> {\n  const result = await schtasks(args);\n  if (result.exitCode !== 0) {\n    const detail = result.stderr.trim() || result.stdout.trim();\n    throw new Error(`schtasks failed (exit ${result.exitCode}): ${detail}`);\n  }\n  return result.stdout;\n}\n\n// ─── Availability Check ───\n\nexport function isSchtasksAvailable(): boolean {\n  if (process.platform !== 'win32') return false;\n  try {\n    const result = spawnSync('schtasks', ['/query', '/?'], {\n      stdio: ['ignore', 'ignore', 'ignore'],\n      shell: true,\n      timeout: 3000,\n    });\n    return result.status === 0;\n  } catch {\n    return false;\n  }\n}\n\n// ─── Service Implementation ───\n\nexport const schtasksService: GatewayService = {\n  label: resolveGatewayWindowsTaskName(),\n  loadedText: 'Scheduled Task (installed)',\n  notLoadedText: 'Scheduled Task (not installed)',\n\n  async install(args: GatewayServiceInstallArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n    const program = args.programArguments[0];\n    const programArgs = args.programArguments.slice(1).join(' ');\n\n    // Delete existing task first (ignore errors)\n    try {\n      await schtasks(['/delete', '/tn', taskName, '/f']);\n    } catch {\n      // Ignore\n    }\n\n    // Create task with ONLOGON trigger\n    const createArgs = [\n      '/create',\n      '/tn', taskName,\n      '/tr', `\"${program}\" ${programArgs}`,\n      '/sc', 'ONLOGON',\n      '/rl', 'LIMITED',\n      '/f',\n    ];\n\n    await schtasksExec(createArgs);\n\n    args.stdout?.write(`Created scheduled task: ${taskName}\\n`);\n    args.stdout?.write(`  Program: ${program}\\n`);\n    args.stdout?.write(`  Args: ${programArgs}\\n`);\n\n    log.info({ taskName }, 'Scheduled task installed');\n  },\n\n  async uninstall(args: GatewayServiceControlArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n\n    // Stop if running\n    try {\n      await schtasks(['/end', '/tn', taskName]);\n    } catch {\n      // Ignore\n    }\n\n    // Delete task\n    try {\n      await schtasksExec(['/delete', '/tn', taskName, '/f']);\n      args.stdout?.write(`Deleted scheduled task: ${taskName}\\n`);\n    } catch (err) {\n      log.debug({ err }, 'Uninstall task not found');\n    }\n\n    log.info({ taskName }, 'Scheduled task uninstalled');\n  },\n\n  async stop(args: GatewayServiceControlArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n\n    try {\n      await schtasksExec(['/end', '/tn', taskName]);\n    } catch {\n      log.debug('Task not running');\n    }\n\n    if (args.disable) {\n      try {\n        await schtasksExec(['/change', '/tn', taskName, '/disable']);\n      } catch {\n        // Ignore\n      }\n    }\n\n    log.info('Scheduled task stopped');\n  },\n\n  async restart(args: GatewayServiceControlArgs): Promise<GatewayServiceRestartResult> {\n    const taskName = resolveTaskName(args.env);\n\n    // End current run\n    try {\n      await schtasks(['/end', '/tn', taskName]);\n    } catch {\n      // Ignore\n    }\n\n    // Small delay for process cleanup\n    await new Promise((resolve) => setTimeout(resolve, 500));\n\n    // Start new run\n    await schtasksExec(['/run', '/tn', taskName]);\n\n    log.info('Scheduled task restarted');\n    return { outcome: 'restarted' };\n  },\n\n  async isLoaded(args: GatewayServiceEnvArgs): Promise<boolean> {\n    const taskName = resolveTaskName(args.env);\n    const result = await schtasks(['/query', '/tn', taskName]);\n    return result.exitCode === 0;\n  },\n\n  async readRuntime(env?: GatewayServiceEnv): Promise<GatewayServiceRuntime> {\n    const taskName = resolveTaskName(env);\n\n    try {\n      const result = await schtasks(['/query', '/tn', taskName, '/fo', 'list', '/v']);\n      if (result.exitCode !== 0) {\n        return { status: 'unknown' };\n      }\n\n      const output = result.stdout;\n      let status: 'running' | 'stopped' | 'unknown' = 'unknown';\n\n      const statusMatch = output.match(/Status:\\s*(\\w+)/i);\n      if (statusMatch) {\n        const statusStr = statusMatch[1].toLowerCase();\n        if (statusStr === 'running') {\n          status = 'running';\n        } else if (statusStr === 'ready' || statusStr === 'disabled') {\n          status = 'stopped';\n        }\n      }\n\n      // Parse last result code\n      let lastExitStatus: number | undefined;\n      const resultMatch = output.match(/Last Result:\\s*(\\d+)/i);\n      if (resultMatch) {\n        lastExitStatus = parseInt(resultMatch[1], 10);\n      }\n\n      return { status, lastExitStatus };\n    } catch {\n      return { status: 'unknown' };\n    }\n  },\n\n  async readCommand(env?: GatewayServiceEnv): Promise<GatewayServiceCommandConfig | null> {\n    const taskName = resolveTaskName(env);\n\n    try {\n      const result = await schtasks(['/query', '/tn', taskName, '/fo', 'list', '/v']);\n      if (result.exitCode !== 0) return null;\n\n      const output = result.stdout;\n      const taskRunMatch = output.match(/Task To Run:\\s*(.+)/i);\n      const workDirMatch = output.match(/Start In:\\s*(.+)/i);\n\n      if (!taskRunMatch) return null;\n\n      const taskRun = taskRunMatch[1].trim();\n      // Handle quoted program path\n      let programArguments: string[];\n      if (taskRun.startsWith('\"')) {\n        const closeQuote = taskRun.indexOf('\"', 1);\n        if (closeQuote > 0) {\n          const program = taskRun.slice(1, closeQuote);\n          const rest = taskRun.slice(closeQuote + 1).trim();\n          programArguments = [program, ...rest.split(/\\s+/).filter(Boolean)];\n        } else {\n          programArguments = taskRun.split(/\\s+/);\n        }\n      } else {\n        programArguments = taskRun.split(/\\s+/);\n      }\n\n      return {\n        programArguments,\n        workingDirectory: workDirMatch?.[1]?.trim() || undefined,\n      };\n    } catch {\n      return null;\n    }\n  },\n};\n"],"mappings":";;;;;;;;;;;;;aAUkD;AAalD,MAAM,MAAM,aAAa,kBAAkB;AAI3C,SAAS,sBAAsB,KAA6C;AAC1E,QAAO,KAAK,cAAc,MAAM,IAAI,KAAA;;AAGtC,SAAS,gBAAgB,KAAiC;AACxD,QAAO,8BAA8B,sBAAsB,IAAI,CAAC;;AAWlE,eAAe,SAAS,MAAyC;AAC/D,QAAO,IAAI,SAAyB,SAAS,WAAW;EACtD,MAAM,QAAQ,MAAM,YAAY,MAAM;GACpC,OAAO;IAAC;IAAU;IAAQ;IAAO;GACjC,OAAO;GACR,CAAC;EAEF,IAAI,SAAS;EACb,IAAI,SAAS;AAEb,QAAM,QAAQ,GAAG,SAAS,SAAS;AAAE,aAAU,KAAK,UAAU;IAAI;AAClE,QAAM,QAAQ,GAAG,SAAS,SAAS;AAAE,aAAU,KAAK,UAAU;IAAI;AAElE,QAAM,GAAG,UAAU,SAAS;AAC1B,WAAQ;IAAE;IAAQ;IAAQ,UAAU;IAAM,CAAC;IAC3C;AACF,QAAM,GAAG,UAAU,QAAQ;AACzB,0BAAO,IAAI,MAAM,0BAA0B,IAAI,UAAU,CAAC;IAC1D;GACF;;AAGJ,eAAe,aAAa,MAAiC;CAC3D,MAAM,SAAS,MAAM,SAAS,KAAK;AACnC,KAAI,OAAO,aAAa,GAAG;EACzB,MAAM,SAAS,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM;AAC3D,QAAM,IAAI,MAAM,yBAAyB,OAAO,SAAS,KAAK,SAAS;;AAEzE,QAAO,OAAO;;AAKhB,SAAgB,sBAA+B;AAC7C,KAAI,QAAQ,aAAa,QAAS,QAAO;AACzC,KAAI;AAMF,SALe,UAAU,YAAY,CAAC,UAAU,KAAK,EAAE;GACrD,OAAO;IAAC;IAAU;IAAU;IAAS;GACrC,OAAO;GACP,SAAS;GACV,CACY,CAAC,WAAW;SACnB;AACN,SAAO;;;AAMX,MAAa,kBAAkC;CAC7C,OAAO,+BAA+B;CACtC,YAAY;CACZ,eAAe;CAEf,MAAM,QAAQ,MAAgD;EAC5D,MAAM,WAAW,gBAAgB,KAAK,IAAI;EAC1C,MAAM,UAAU,KAAK,iBAAiB;EACtC,MAAM,cAAc,KAAK,iBAAiB,MAAM,EAAE,CAAC,KAAK,IAAI;AAG5D,MAAI;AACF,SAAM,SAAS;IAAC;IAAW;IAAO;IAAU;IAAK,CAAC;UAC5C;AAcR,QAAM,aAAa;GARjB;GACA;GAAO;GACP;GAAO,IAAI,QAAQ,IAAI;GACvB;GAAO;GACP;GAAO;GACP;GAG2B,CAAC;AAE9B,OAAK,QAAQ,MAAM,2BAA2B,SAAS,IAAI;AAC3D,OAAK,QAAQ,MAAM,cAAc,QAAQ,IAAI;AAC7C,OAAK,QAAQ,MAAM,WAAW,YAAY,IAAI;AAE9C,MAAI,KAAK,EAAE,UAAU,EAAE,2BAA2B;;CAGpD,MAAM,UAAU,MAAgD;EAC9D,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAG1C,MAAI;AACF,SAAM,SAAS;IAAC;IAAQ;IAAO;IAAS,CAAC;UACnC;AAKR,MAAI;AACF,SAAM,aAAa;IAAC;IAAW;IAAO;IAAU;IAAK,CAAC;AACtD,QAAK,QAAQ,MAAM,2BAA2B,SAAS,IAAI;WACpD,KAAK;AACZ,OAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;;AAGhD,MAAI,KAAK,EAAE,UAAU,EAAE,6BAA6B;;CAGtD,MAAM,KAAK,MAAgD;EACzD,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAE1C,MAAI;AACF,SAAM,aAAa;IAAC;IAAQ;IAAO;IAAS,CAAC;UACvC;AACN,OAAI,MAAM,mBAAmB;;AAG/B,MAAI,KAAK,QACP,KAAI;AACF,SAAM,aAAa;IAAC;IAAW;IAAO;IAAU;IAAW,CAAC;UACtD;AAKV,MAAI,KAAK,yBAAyB;;CAGpC,MAAM,QAAQ,MAAuE;EACnF,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAG1C,MAAI;AACF,SAAM,SAAS;IAAC;IAAQ;IAAO;IAAS,CAAC;UACnC;AAKR,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAI,CAAC;AAGxD,QAAM,aAAa;GAAC;GAAQ;GAAO;GAAS,CAAC;AAE7C,MAAI,KAAK,2BAA2B;AACpC,SAAO,EAAE,SAAS,aAAa;;CAGjC,MAAM,SAAS,MAA+C;AAG5D,UAAO,MADc,SAAS;GAAC;GAAU;GADxB,gBAAgB,KAAK,IACkB;GAAC,CAAC,EAC5C,aAAa;;CAG7B,MAAM,YAAY,KAAyD;EACzE,MAAM,WAAW,gBAAgB,IAAI;AAErC,MAAI;GACF,MAAM,SAAS,MAAM,SAAS;IAAC;IAAU;IAAO;IAAU;IAAO;IAAQ;IAAK,CAAC;AAC/E,OAAI,OAAO,aAAa,EACtB,QAAO,EAAE,QAAQ,WAAW;GAG9B,MAAM,SAAS,OAAO;GACtB,IAAI,SAA4C;GAEhD,MAAM,cAAc,OAAO,MAAM,mBAAmB;AACpD,OAAI,aAAa;IACf,MAAM,YAAY,YAAY,GAAG,aAAa;AAC9C,QAAI,cAAc,UAChB,UAAS;aACA,cAAc,WAAW,cAAc,WAChD,UAAS;;GAKb,IAAI;GACJ,MAAM,cAAc,OAAO,MAAM,wBAAwB;AACzD,OAAI,YACF,kBAAiB,SAAS,YAAY,IAAI,GAAG;AAG/C,UAAO;IAAE;IAAQ;IAAgB;UAC3B;AACN,UAAO,EAAE,QAAQ,WAAW;;;CAIhC,MAAM,YAAY,KAAsE;EACtF,MAAM,WAAW,gBAAgB,IAAI;AAErC,MAAI;GACF,MAAM,SAAS,MAAM,SAAS;IAAC;IAAU;IAAO;IAAU;IAAO;IAAQ;IAAK,CAAC;AAC/E,OAAI,OAAO,aAAa,EAAG,QAAO;GAElC,MAAM,SAAS,OAAO;GACtB,MAAM,eAAe,OAAO,MAAM,uBAAuB;GACzD,MAAM,eAAe,OAAO,MAAM,oBAAoB;AAEtD,OAAI,CAAC,aAAc,QAAO;GAE1B,MAAM,UAAU,aAAa,GAAG,MAAM;GAEtC,IAAI;AACJ,OAAI,QAAQ,WAAW,KAAI,EAAE;IAC3B,MAAM,aAAa,QAAQ,QAAQ,MAAK,EAAE;AAC1C,QAAI,aAAa,EAGf,oBAAmB,CAFH,QAAQ,MAAM,GAAG,WAEN,EAAE,GADhB,QAAQ,MAAM,aAAa,EAAE,CAAC,MACP,CAAC,MAAM,MAAM,CAAC,OAAO,QAAQ,CAAC;QAElE,oBAAmB,QAAQ,MAAM,MAAM;SAGzC,oBAAmB,QAAQ,MAAM,MAAM;AAGzC,UAAO;IACL;IACA,kBAAkB,eAAe,IAAI,MAAM,IAAI,KAAA;IAChD;UACK;AACN,UAAO;;;CAGZ"}
+{"version":3,"file":"schtasks.js","names":[],"sources":["../../../src/daemon/schtasks.ts"],"sourcesContent":["/**\n * Scheduled Task Service - Windows service management via schtasks\n *\n * Aligned with OpenClaw Windows implementation:\n * - Task with ONLOGON trigger for persistence\n * - RepetitionInterval for keep-alive behavior\n * - Proper start/stop/restart lifecycle\n */\n\nimport { spawn, spawnSync } from 'node:child_process';\nimport { mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { createLogger } from '../utils/logger.js';\nimport { resolveGatewayWindowsTaskName } from './constants.js';\nimport type {\n  GatewayService,\n  GatewayServiceInstallArgs,\n  GatewayServiceControlArgs,\n  GatewayServiceEnvArgs,\n  GatewayServiceRuntime,\n  GatewayServiceCommandConfig,\n  GatewayServiceEnv,\n  GatewayServiceRestartResult,\n} from './types.js';\n\nconst log = createLogger('SchtasksService');\n\n// ─── Resolution ───\n\nfunction resolveProfileFromEnv(env?: GatewayServiceEnv): string | undefined {\n  return env?.XOPC_PROFILE?.trim() || undefined;\n}\n\nfunction resolveTaskName(env?: GatewayServiceEnv): string {\n  return resolveGatewayWindowsTaskName(resolveProfileFromEnv(env));\n}\n\n// ─── Command Execution ───\n\ninterface SchtasksResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number | null;\n}\n\nasync function schtasks(args: string[]): Promise<SchtasksResult> {\n  return new Promise<SchtasksResult>((resolve, reject) => {\n    const child = spawn('schtasks', args, {\n      stdio: ['ignore', 'pipe', 'pipe'],\n      shell: true,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    child.stdout?.on('data', (data) => { stdout += data.toString(); });\n    child.stderr?.on('data', (data) => { stderr += data.toString(); });\n\n    child.on('close', (code) => {\n      resolve({ stdout, stderr, exitCode: code });\n    });\n    child.on('error', (err) => {\n      reject(new Error(`schtasks spawn failed: ${err.message}`));\n    });\n  });\n}\n\nasync function schtasksExec(args: string[]): Promise<string> {\n  const result = await schtasks(args);\n  if (result.exitCode !== 0) {\n    const detail = result.stderr.trim() || result.stdout.trim();\n    throw new Error(`schtasks failed (exit ${result.exitCode}): ${detail}`);\n  }\n  return result.stdout;\n}\n\n// ─── Environment Sidecar ───\n// schtasks does not natively support per-task environment variables.\n// We persist them in a JSON sidecar so readCommand can return them\n// for version-mismatch detection and other diagnostics.\n\nfunction resolveTaskEnvSidecarPath(taskName: string): string {\n  const configDir = path.join(os.homedir(), '.xopc', 'daemon');\n  return path.join(configDir, `${taskName}.env.json`);\n}\n\nfunction writeTaskEnvSidecar(taskName: string, environment: Record<string, string>): void {\n  const sidecarPath = resolveTaskEnvSidecarPath(taskName);\n  try {\n    mkdirSync(path.dirname(sidecarPath), { recursive: true });\n    writeFileSync(sidecarPath, JSON.stringify(environment, null, 2), 'utf8');\n  } catch (err) {\n    log.warn({ err, sidecarPath }, 'Failed to write task environment sidecar');\n  }\n}\n\nfunction readTaskEnvSidecar(taskName: string): Record<string, string> | undefined {\n  const sidecarPath = resolveTaskEnvSidecarPath(taskName);\n  try {\n    const raw = readFileSync(sidecarPath, 'utf8');\n    const parsed = JSON.parse(raw);\n    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n      return parsed as Record<string, string>;\n    }\n  } catch {\n    // Sidecar missing or corrupt — not fatal\n  }\n  return undefined;\n}\n\nfunction removeTaskEnvSidecar(taskName: string): void {\n  const sidecarPath = resolveTaskEnvSidecarPath(taskName);\n  try {\n    rmSync(sidecarPath, { force: true });\n  } catch {\n    // Best-effort\n  }\n}\n\n// ─── Availability Check ───\n\nexport function isSchtasksAvailable(): boolean {\n  if (process.platform !== 'win32') return false;\n  try {\n    const result = spawnSync('schtasks', ['/query', '/?'], {\n      stdio: ['ignore', 'ignore', 'ignore'],\n      shell: true,\n      timeout: 3000,\n    });\n    return result.status === 0;\n  } catch {\n    return false;\n  }\n}\n\n// ─── Service Implementation ───\n\nexport const schtasksService: GatewayService = {\n  label: resolveGatewayWindowsTaskName(),\n  loadedText: 'Scheduled Task (installed)',\n  notLoadedText: 'Scheduled Task (not installed)',\n\n  async install(args: GatewayServiceInstallArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n    const program = args.programArguments[0];\n    const programArgs = args.programArguments.slice(1).join(' ');\n\n    // Delete existing task first (ignore errors)\n    try {\n      await schtasks(['/delete', '/tn', taskName, '/f']);\n    } catch {\n      // Ignore\n    }\n\n    // Create task with ONLOGON trigger\n    const createArgs = [\n      '/create',\n      '/tn', taskName,\n      '/tr', `\"${program}\" ${programArgs}`,\n      '/sc', 'ONLOGON',\n      '/rl', 'LIMITED',\n      '/f',\n    ];\n\n    await schtasksExec(createArgs);\n\n    // Persist environment variables in a sidecar file\n    // (schtasks does not support per-task env vars natively)\n    if (args.environment && Object.keys(args.environment).length > 0) {\n      writeTaskEnvSidecar(taskName, args.environment);\n    }\n\n    args.stdout?.write(`Created scheduled task: ${taskName}\\n`);\n    args.stdout?.write(`  Program: ${program}\\n`);\n    args.stdout?.write(`  Args: ${programArgs}\\n`);\n\n    log.info({ taskName }, 'Scheduled task installed');\n  },\n\n  async uninstall(args: GatewayServiceControlArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n\n    // Stop if running\n    try {\n      await schtasks(['/end', '/tn', taskName]);\n    } catch {\n      // Ignore\n    }\n\n    // Delete task\n    try {\n      await schtasksExec(['/delete', '/tn', taskName, '/f']);\n      args.stdout?.write(`Deleted scheduled task: ${taskName}\\n`);\n    } catch (err) {\n      log.debug({ err }, 'Uninstall task not found');\n    }\n\n    // Clean up environment sidecar\n    removeTaskEnvSidecar(taskName);\n\n    log.info({ taskName }, 'Scheduled task uninstalled');\n  },\n\n  async stop(args: GatewayServiceControlArgs): Promise<void> {\n    const taskName = resolveTaskName(args.env);\n\n    try {\n      await schtasksExec(['/end', '/tn', taskName]);\n    } catch {\n      log.debug('Task not running');\n    }\n\n    if (args.disable) {\n      try {\n        await schtasksExec(['/change', '/tn', taskName, '/disable']);\n      } catch {\n        // Ignore\n      }\n    }\n\n    log.info('Scheduled task stopped');\n  },\n\n  async restart(args: GatewayServiceControlArgs): Promise<GatewayServiceRestartResult> {\n    const taskName = resolveTaskName(args.env);\n\n    // End current run\n    try {\n      await schtasks(['/end', '/tn', taskName]);\n    } catch {\n      // Ignore\n    }\n\n    // Small delay for process cleanup\n    await new Promise((resolve) => setTimeout(resolve, 500));\n\n    // Start new run\n    await schtasksExec(['/run', '/tn', taskName]);\n\n    log.info('Scheduled task restarted');\n    return { outcome: 'restarted' };\n  },\n\n  async isLoaded(args: GatewayServiceEnvArgs): Promise<boolean> {\n    const taskName = resolveTaskName(args.env);\n    const result = await schtasks(['/query', '/tn', taskName]);\n    return result.exitCode === 0;\n  },\n\n  async readRuntime(env?: GatewayServiceEnv): Promise<GatewayServiceRuntime> {\n    const taskName = resolveTaskName(env);\n\n    try {\n      const result = await schtasks(['/query', '/tn', taskName, '/fo', 'list', '/v']);\n      if (result.exitCode !== 0) {\n        return { status: 'unknown' };\n      }\n\n      const output = result.stdout;\n      let status: 'running' | 'stopped' | 'unknown' = 'unknown';\n\n      const statusMatch = output.match(/Status:\\s*(\\w+)/i);\n      if (statusMatch) {\n        const statusStr = statusMatch[1].toLowerCase();\n        if (statusStr === 'running') {\n          status = 'running';\n        } else if (statusStr === 'ready' || statusStr === 'disabled') {\n          status = 'stopped';\n        }\n      }\n\n      // Parse last result code\n      let lastExitStatus: number | undefined;\n      const resultMatch = output.match(/Last Result:\\s*(\\d+)/i);\n      if (resultMatch) {\n        lastExitStatus = parseInt(resultMatch[1], 10);\n      }\n\n      return { status, lastExitStatus };\n    } catch {\n      return { status: 'unknown' };\n    }\n  },\n\n  async readCommand(env?: GatewayServiceEnv): Promise<GatewayServiceCommandConfig | null> {\n    const taskName = resolveTaskName(env);\n\n    try {\n      const result = await schtasks(['/query', '/tn', taskName, '/fo', 'list', '/v']);\n      if (result.exitCode !== 0) return null;\n\n      const output = result.stdout;\n      const taskRunMatch = output.match(/Task To Run:\\s*(.+)/i);\n      const workDirMatch = output.match(/Start In:\\s*(.+)/i);\n\n      if (!taskRunMatch) return null;\n\n      const taskRun = taskRunMatch[1].trim();\n      // Handle quoted program path\n      let programArguments: string[];\n      if (taskRun.startsWith('\"')) {\n        const closeQuote = taskRun.indexOf('\"', 1);\n        if (closeQuote > 0) {\n          const program = taskRun.slice(1, closeQuote);\n          const rest = taskRun.slice(closeQuote + 1).trim();\n          programArguments = [program, ...rest.split(/\\s+/).filter(Boolean)];\n        } else {\n          programArguments = taskRun.split(/\\s+/);\n        }\n      } else {\n        programArguments = taskRun.split(/\\s+/);\n      }\n\n      // Read environment from sidecar file (schtasks has no native env support)\n      const environment = readTaskEnvSidecar(taskName);\n\n      return {\n        programArguments,\n        workingDirectory: workDirMatch?.[1]?.trim() || undefined,\n        environment,\n      };\n    } catch {\n      return null;\n    }\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;aAakD;AAalD,MAAM,MAAM,aAAa,kBAAkB;AAI3C,SAAS,sBAAsB,KAA6C;AAC1E,QAAO,KAAK,cAAc,MAAM,IAAI,KAAA;;AAGtC,SAAS,gBAAgB,KAAiC;AACxD,QAAO,8BAA8B,sBAAsB,IAAI,CAAC;;AAWlE,eAAe,SAAS,MAAyC;AAC/D,QAAO,IAAI,SAAyB,SAAS,WAAW;EACtD,MAAM,QAAQ,MAAM,YAAY,MAAM;GACpC,OAAO;IAAC;IAAU;IAAQ;IAAO;GACjC,OAAO;GACR,CAAC;EAEF,IAAI,SAAS;EACb,IAAI,SAAS;AAEb,QAAM,QAAQ,GAAG,SAAS,SAAS;AAAE,aAAU,KAAK,UAAU;IAAI;AAClE,QAAM,QAAQ,GAAG,SAAS,SAAS;AAAE,aAAU,KAAK,UAAU;IAAI;AAElE,QAAM,GAAG,UAAU,SAAS;AAC1B,WAAQ;IAAE;IAAQ;IAAQ,UAAU;IAAM,CAAC;IAC3C;AACF,QAAM,GAAG,UAAU,QAAQ;AACzB,0BAAO,IAAI,MAAM,0BAA0B,IAAI,UAAU,CAAC;IAC1D;GACF;;AAGJ,eAAe,aAAa,MAAiC;CAC3D,MAAM,SAAS,MAAM,SAAS,KAAK;AACnC,KAAI,OAAO,aAAa,GAAG;EACzB,MAAM,SAAS,OAAO,OAAO,MAAM,IAAI,OAAO,OAAO,MAAM;AAC3D,QAAM,IAAI,MAAM,yBAAyB,OAAO,SAAS,KAAK,SAAS;;AAEzE,QAAO,OAAO;;AAQhB,SAAS,0BAA0B,UAA0B;CAC3D,MAAM,YAAY,KAAK,KAAK,GAAG,SAAS,EAAE,SAAS,SAAS;AAC5D,QAAO,KAAK,KAAK,WAAW,GAAG,SAAS,WAAW;;AAGrD,SAAS,oBAAoB,UAAkB,aAA2C;CACxF,MAAM,cAAc,0BAA0B,SAAS;AACvD,KAAI;AACF,YAAU,KAAK,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;AACzD,gBAAc,aAAa,KAAK,UAAU,aAAa,MAAM,EAAE,EAAE,OAAO;UACjE,KAAK;AACZ,MAAI,KAAK;GAAE;GAAK;GAAa,EAAE,2CAA2C;;;AAI9E,SAAS,mBAAmB,UAAsD;CAChF,MAAM,cAAc,0BAA0B,SAAS;AACvD,KAAI;EACF,MAAM,MAAM,aAAa,aAAa,OAAO;EAC7C,MAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,OAAO,CAChE,QAAO;SAEH;;AAMV,SAAS,qBAAqB,UAAwB;CACpD,MAAM,cAAc,0BAA0B,SAAS;AACvD,KAAI;AACF,SAAO,aAAa,EAAE,OAAO,MAAM,CAAC;SAC9B;;AAOV,SAAgB,sBAA+B;AAC7C,KAAI,QAAQ,aAAa,QAAS,QAAO;AACzC,KAAI;AAMF,SALe,UAAU,YAAY,CAAC,UAAU,KAAK,EAAE;GACrD,OAAO;IAAC;IAAU;IAAU;IAAS;GACrC,OAAO;GACP,SAAS;GACV,CACY,CAAC,WAAW;SACnB;AACN,SAAO;;;AAMX,MAAa,kBAAkC;CAC7C,OAAO,+BAA+B;CACtC,YAAY;CACZ,eAAe;CAEf,MAAM,QAAQ,MAAgD;EAC5D,MAAM,WAAW,gBAAgB,KAAK,IAAI;EAC1C,MAAM,UAAU,KAAK,iBAAiB;EACtC,MAAM,cAAc,KAAK,iBAAiB,MAAM,EAAE,CAAC,KAAK,IAAI;AAG5D,MAAI;AACF,SAAM,SAAS;IAAC;IAAW;IAAO;IAAU;IAAK,CAAC;UAC5C;AAcR,QAAM,aAAa;GARjB;GACA;GAAO;GACP;GAAO,IAAI,QAAQ,IAAI;GACvB;GAAO;GACP;GAAO;GACP;GAG2B,CAAC;AAI9B,MAAI,KAAK,eAAe,OAAO,KAAK,KAAK,YAAY,CAAC,SAAS,EAC7D,qBAAoB,UAAU,KAAK,YAAY;AAGjD,OAAK,QAAQ,MAAM,2BAA2B,SAAS,IAAI;AAC3D,OAAK,QAAQ,MAAM,cAAc,QAAQ,IAAI;AAC7C,OAAK,QAAQ,MAAM,WAAW,YAAY,IAAI;AAE9C,MAAI,KAAK,EAAE,UAAU,EAAE,2BAA2B;;CAGpD,MAAM,UAAU,MAAgD;EAC9D,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAG1C,MAAI;AACF,SAAM,SAAS;IAAC;IAAQ;IAAO;IAAS,CAAC;UACnC;AAKR,MAAI;AACF,SAAM,aAAa;IAAC;IAAW;IAAO;IAAU;IAAK,CAAC;AACtD,QAAK,QAAQ,MAAM,2BAA2B,SAAS,IAAI;WACpD,KAAK;AACZ,OAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;;AAIhD,uBAAqB,SAAS;AAE9B,MAAI,KAAK,EAAE,UAAU,EAAE,6BAA6B;;CAGtD,MAAM,KAAK,MAAgD;EACzD,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAE1C,MAAI;AACF,SAAM,aAAa;IAAC;IAAQ;IAAO;IAAS,CAAC;UACvC;AACN,OAAI,MAAM,mBAAmB;;AAG/B,MAAI,KAAK,QACP,KAAI;AACF,SAAM,aAAa;IAAC;IAAW;IAAO;IAAU;IAAW,CAAC;UACtD;AAKV,MAAI,KAAK,yBAAyB;;CAGpC,MAAM,QAAQ,MAAuE;EACnF,MAAM,WAAW,gBAAgB,KAAK,IAAI;AAG1C,MAAI;AACF,SAAM,SAAS;IAAC;IAAQ;IAAO;IAAS,CAAC;UACnC;AAKR,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAI,CAAC;AAGxD,QAAM,aAAa;GAAC;GAAQ;GAAO;GAAS,CAAC;AAE7C,MAAI,KAAK,2BAA2B;AACpC,SAAO,EAAE,SAAS,aAAa;;CAGjC,MAAM,SAAS,MAA+C;AAG5D,UAAO,MADc,SAAS;GAAC;GAAU;GADxB,gBAAgB,KAAK,IACkB;GAAC,CAAC,EAC5C,aAAa;;CAG7B,MAAM,YAAY,KAAyD;EACzE,MAAM,WAAW,gBAAgB,IAAI;AAErC,MAAI;GACF,MAAM,SAAS,MAAM,SAAS;IAAC;IAAU;IAAO;IAAU;IAAO;IAAQ;IAAK,CAAC;AAC/E,OAAI,OAAO,aAAa,EACtB,QAAO,EAAE,QAAQ,WAAW;GAG9B,MAAM,SAAS,OAAO;GACtB,IAAI,SAA4C;GAEhD,MAAM,cAAc,OAAO,MAAM,mBAAmB;AACpD,OAAI,aAAa;IACf,MAAM,YAAY,YAAY,GAAG,aAAa;AAC9C,QAAI,cAAc,UAChB,UAAS;aACA,cAAc,WAAW,cAAc,WAChD,UAAS;;GAKb,IAAI;GACJ,MAAM,cAAc,OAAO,MAAM,wBAAwB;AACzD,OAAI,YACF,kBAAiB,SAAS,YAAY,IAAI,GAAG;AAG/C,UAAO;IAAE;IAAQ;IAAgB;UAC3B;AACN,UAAO,EAAE,QAAQ,WAAW;;;CAIhC,MAAM,YAAY,KAAsE;EACtF,MAAM,WAAW,gBAAgB,IAAI;AAErC,MAAI;GACF,MAAM,SAAS,MAAM,SAAS;IAAC;IAAU;IAAO;IAAU;IAAO;IAAQ;IAAK,CAAC;AAC/E,OAAI,OAAO,aAAa,EAAG,QAAO;GAElC,MAAM,SAAS,OAAO;GACtB,MAAM,eAAe,OAAO,MAAM,uBAAuB;GACzD,MAAM,eAAe,OAAO,MAAM,oBAAoB;AAEtD,OAAI,CAAC,aAAc,QAAO;GAE1B,MAAM,UAAU,aAAa,GAAG,MAAM;GAEtC,IAAI;AACJ,OAAI,QAAQ,WAAW,KAAI,EAAE;IAC3B,MAAM,aAAa,QAAQ,QAAQ,MAAK,EAAE;AAC1C,QAAI,aAAa,EAGf,oBAAmB,CAFH,QAAQ,MAAM,GAAG,WAEN,EAAE,GADhB,QAAQ,MAAM,aAAa,EAAE,CAAC,MACP,CAAC,MAAM,MAAM,CAAC,OAAO,QAAQ,CAAC;QAElE,oBAAmB,QAAQ,MAAM,MAAM;SAGzC,oBAAmB,QAAQ,MAAM,MAAM;GAIzC,MAAM,cAAc,mBAAmB,SAAS;AAEhD,UAAO;IACL;IACA,kBAAkB,eAAe,IAAI,MAAM,IAAI,KAAA;IAC/C;IACD;UACK;AACN,UAAO;;;CAGZ"}

package/dist/src/daemon/systemd.js

@@ -1,10 +1,10 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { resolveGatewaySystemdServiceName, resolveSystemdUnitPath } from "./constants.js";
+import os from "node:os";
+import path from "node:path";
 import { existsSync } from "node:fs";
 import { access, constants as constants$1, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import os from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 //#region src/daemon/systemd.ts
 /**

package/dist/src/extensions/bundle-mcp.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
 import { isRecord } from "../utils/is-record.js";
 import { normalizeConfiguredMcpServers } from "../config/mcp-config-normalize.js";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 //#region src/extensions/bundle-mcp.ts
 init_paths();
 function extractMcpServerMap(raw) {

package/dist/src/extensions/discover-extensions.js

@@ -1,6 +1,6 @@
+import { init_agent_scope, resolveDefaultAgentId } from "../agent/agent-scope.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../agent/agent-scope.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir, resolveWorkspaceExtensionsDir } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
 import { normalizeExtensionManifest } from "./normalize-manifest.js";

package/dist/src/extensions/health.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveExtensionsDir } from "../config/paths.js";
 import { getExtensionLockfileManager } from "./lockfile.js";
-import { readFile, readdir } from "fs/promises";
 import { join } from "path";
 import { existsSync } from "fs";
+import { readFile, readdir } from "fs/promises";
 //#region src/extensions/health.ts
 init_paths();
 var ExtensionHealthChecker = class {

package/dist/src/extensions/loader.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
+import { init_agent_scope, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
 import { createLogger, createServiceLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_agent_scope, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveWorkspaceExtensionsDir } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";

package/dist/src/extensions/lockfile.js

@@ -1,10 +1,10 @@
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
-import { mkdir, readFile } from "fs/promises";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
+import { mkdir, readFile } from "fs/promises";
 import { createHash } from "crypto";
 //#region src/extensions/lockfile.ts
 init_write_file_atomic();

package/dist/src/gateway/agents-admin.js

@@ -1,13 +1,13 @@
 import { DEFAULT_AGENT_ID, init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { applyAgentConfig, findAgentEntryIndex, pruneAgentConfig, removeAgentDirsFromDisk } from "../commands/agents.config.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";
-import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts
 /**
 * Gateway REST helpers for multi-agent management.

package/dist/src/gateway/file-path-classifier.js

@@ -1,11 +1,11 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSessionsDir, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSessionsDir, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
-import { stat } from "node:fs/promises";
 import { basename, isAbsolute, resolve } from "node:path";
+import { stat } from "node:fs/promises";
 //#region src/gateway/file-path-classifier.ts
 init_agent_scope();
 init_paths();

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/app.js

@@ -2,10 +2,12 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
-import { maxWebchatAgentRequestBodyBytes } from "../chat-limits.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
+import { maxWebchatAgentRequestBodyBytes } from "../chat-limits.js";
+import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
+import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
 import { createStrictRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
@@ -16,10 +18,12 @@ import { resetLazyRouteBundlesForTests } from "./routes/lazy-fallback.js";
 import { registerAuthenticatedRoutes } from "./routes/index.js";
 import { prewarmStaticUiCache } from "./lib/static-ui.js";
 import { registerPublicGatewayRoutes } from "./routes/public-gateway.js";
+import { registerSiteShareMiddleware } from "../../share/site-share-router.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { createMiddleware } from "hono/factory";
 import { bodyLimit } from "hono/body-limit";
+import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/app.ts
 init_logger();
 const log = createLogger("HonoApp");
@@ -40,13 +44,39 @@ function createHonoApp(config) {
 		configuredOrigins: service.currentConfig.gateway.corsOrigins,
 		port: gatewayPort,
 		bindHost: resolveGatewayEffectiveHost(service.currentConfig),
-		tunnelPublicUrl: loadTunnelState()?.publicUrl
+		tunnelPublicUrl: loadTunnelState()?.publicUrl,
+		reverseProxyPublicUrl: resolveReverseProxyPublicUrl(service.currentConfig)
 	});
+	/**
+	* TCP source for the in-flight request, normalized for trusted-proxy checks.
+	* Returns undefined when the runtime doesn't expose conninfo (tests, mocks).
+	*/
+	const resolveRequestRemoteAddress = (c) => {
+		try {
+			return getConnInfo(c).remote.address;
+		} catch {
+			return;
+		}
+	};
+	/**
+	* A request's TCP source qualifies as a "trusted proxy hop" when it's
+	* loopback (the user's own machine, where any reverse proxy lives) or
+	* listed in `gateway.trustedProxies`. We use this signal to safely
+	* auto-allow same-host Origins through CSRF without requiring a manual
+	* `corsOrigins` entry for every reverse-proxy hostname.
+	*/
+	const isRequestFromTrustedProxy = (c) => {
+		const remote = resolveRequestRemoteAddress(c);
+		if (!remote) return false;
+		if (isLoopbackIpAddress(remote)) return true;
+		return isTrustedProxyAddress(remote, service.currentConfig.gateway?.trustedProxies);
+	};
 	app.use(logContextMiddleware());
 	app.use(logger({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 	}));
+	registerSiteShareMiddleware(app, service);
 	app.use(cors({
 		origin: (origin) => {
 			const allowed = resolveBrowserOrigins();
@@ -93,6 +123,7 @@ function createHonoApp(config) {
 			origin,
 			allowedOrigins: resolveBrowserOrigins(),
 			allowHostHeaderOriginFallback,
+			autoAllowSameHostFromTrustedProxy: isRequestFromTrustedProxy(c),
 			isLocalClient: false
 		});
 		if (!result.ok) {

package/dist/src/gateway/hono/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { createStrictRateLimitMiddleware } from './middleware/strict-rate-limit.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nimport { resetLazyRouteBundlesForTests } from './routes/lazy-fallback.js';\nimport { prewarmStaticUiCache } from './lib/static-ui.js';\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  if (process.env.VITEST) {\n    resetLazyRouteBundlesForTests();\n  }\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n    });\n\n  app.use(logContextMiddleware());\n  app.use(logger({\n    trustedProxies: service.currentConfig.gateway?.trustedProxies,\n    allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n  }));\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        {\n          origin,\n          requestHost: c.req.header('host'),\n          reason: 'reason' in result ? result.reason : 'unknown',\n          path: c.req.path,\n          method: c.req.method,\n        },\n        `Browser origin check failed: ${origin} not in allowed list`,\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      log.warn({ path: c.req.path, maxSizeMb: 10 }, 'Request body too large: skills upload exceeds 10MB limit');\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) => {\n        log.warn({ path: ctx.req.path, maxSizeMb }, `Request body too large: exceeds ${maxSizeMb}MB limit`);\n        return ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413);\n      },\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimitMiddleware = createStrictRateLimitMiddleware({\n    getTrustedProxyContext: () => ({\n      trustedProxies: service.currentConfig.gateway?.trustedProxies,\n      allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n    }),\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  const prewarm = prewarmStaticUiCache();\n  if (prewarm.loaded > 0) {\n    log.debug({ loaded: prewarm.loaded, missing: prewarm.missing }, 'Static UI cache prewarmed');\n  }\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    const isApiRoute = c.req.path.startsWith('/api/');\n    const fields = { path: c.req.path, method: c.req.method };\n    if (isApiRoute) {\n      log.warn(fields, 'Route not found');\n    } else {\n      log.debug(fields, 'Route not found');\n    }\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error(\n      {\n        err,\n        path: c.req.path,\n        method: c.req.method,\n        userAgent: c.req.header('user-agent'),\n      },\n      `Hono error on ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;aAMqD;AAiBrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;AACzD,KAAI,QAAQ,IAAI,OACd,gCAA+B;CAEjC,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACrC,CAAC;AAEJ,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,OAAO;EACb,gBAAgB,QAAQ,cAAc,SAAS;EAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;EAC7E,CAAC,CAAC;AACH,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IACE;IACA,aAAa,EAAE,IAAI,OAAO,OAAO;IACjC,QAAQ,YAAY,SAAS,OAAO,SAAS;IAC7C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACf,EACD,gCAAgC,OAAO,sBACxC;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,OAAI,KAAK;IAAE,MAAM,EAAE,IAAI;IAAM,WAAW;IAAI,EAAE,2DAA2D;AACzG,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QAAQ;AAChB,QAAI,KAAK;KAAE,MAAM,IAAI,IAAI;KAAM;KAAW,EAAE,mCAAmC,UAAU,UAAU;AACnG,WAAO,IAAI,KAAK;KAAE,OAAO;KAA0B,SAAS,GAAG,UAAU;KAAK,EAAE,IAAI;;GAEvF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;AAcnC,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BAdgC,gCAAgC,EAChE,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E,GACF,CAS0B;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;CAEF,MAAM,UAAU,sBAAsB;AACtC,KAAI,QAAQ,SAAS,EACnB,KAAI,MAAM;EAAE,QAAQ,QAAQ;EAAQ,SAAS,QAAQ;EAAS,EAAE,4BAA4B;AAG9F,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;EAClB,MAAM,aAAa,EAAE,IAAI,KAAK,WAAW,QAAQ;EACjD,MAAM,SAAS;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;AACzD,MAAI,WACF,KAAI,KAAK,QAAQ,kBAAkB;MAEnC,KAAI,MAAM,QAAQ,kBAAkB;AAEtC,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MACF;GACE;GACA,MAAM,EAAE,IAAI;GACZ,QAAQ,EAAE,IAAI;GACd,WAAW,EAAE,IAAI,OAAO,aAAa;GACtC,EACD,iBAAiB,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;AACD,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}
+{"version":3,"file":"app.js","names":[],"sources":["../../../../src/gateway/hono/app.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport type { Context } from 'hono';\nimport { cors } from 'hono/cors';\nimport { createMiddleware } from 'hono/factory';\nimport { bodyLimit } from 'hono/body-limit';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport { resolveGatewayEffectiveHost } from '../../config/gateway-bind.js';\nimport { createLogger } from '../../utils/logger.js';\nimport type { GatewayService } from '../service.js';\nimport { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from '../host.js';\nimport { loadTunnelState } from '../../tunnel/tunnel-state.js';\nimport { maxWebchatAgentRequestBodyBytes } from '../chat-limits.js';\nimport { buildGatewayConsoleCspHeader } from '../security/csp.js';\nimport { checkBrowserOrigin } from '../security/origin-check.js';\nimport { isLoopbackIpAddress, isTrustedProxyAddress } from '../client-ip.js';\nimport { resolveReverseProxyPublicUrl } from '../public-url.js';\nimport { auth } from './middleware/auth.js';\nimport { operatorScopes } from './middleware/scopes.js';\nimport { createStrictRateLimitMiddleware } from './middleware/strict-rate-limit.js';\nimport { logContextMiddleware } from './middleware/log-context.js';\nimport { logger } from './middleware/logger.js';\nimport { registerPublicExtensionAssetRoutes } from './routes/auth-registry-extensions.js';\nimport { registerAuthenticatedRoutes } from './routes/index.js';\nimport { registerPublicGatewayRoutes } from './routes/public-gateway.js';\nimport { resetLazyRouteBundlesForTests } from './routes/lazy-fallback.js';\nimport { prewarmStaticUiCache } from './lib/static-ui.js';\nimport { registerSiteShareMiddleware } from '../../share/site-share-router.js';\nconst log = createLogger('HonoApp');\n\nexport interface HonoAppConfig {\n  service: GatewayService;\n  token?: string;\n}\n\n/**\n * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP\n * (`frame-ancestors 'self'`). The global gateway middleware must not overwrite it\n * with `frame-ancestors 'none'` / `X-Frame-Options: DENY`, or the console cannot embed iframes.\n */\nexport function isExtensionGatewayUiAssetPath(path: string): boolean {\n  return /^\\/api\\/extensions\\/[^/]+\\/assets\\//.test(path);\n}\n\nexport function createHonoApp(config: HonoAppConfig): Hono {\n  if (process.env.VITEST) {\n    resetLazyRouteBundlesForTests();\n  }\n  const { service, token } = config;\n  const app = new Hono();\n\n  const gatewayPort = resolveGatewayServiceListenPort(service);\n\n  const resolveBrowserOrigins = (): string[] =>\n    resolveAllowedBrowserOrigins({\n      configuredOrigins: service.currentConfig.gateway.corsOrigins,\n      port: gatewayPort,\n      bindHost: resolveGatewayEffectiveHost(service.currentConfig),\n      tunnelPublicUrl: loadTunnelState()?.publicUrl,\n      reverseProxyPublicUrl: resolveReverseProxyPublicUrl(service.currentConfig),\n    });\n\n  /**\n   * TCP source for the in-flight request, normalized for trusted-proxy checks.\n   * Returns undefined when the runtime doesn't expose conninfo (tests, mocks).\n   */\n  const resolveRequestRemoteAddress = (c: Context): string | undefined => {\n    try {\n      return getConnInfo(c).remote.address;\n    } catch {\n      return undefined;\n    }\n  };\n\n  /**\n   * A request's TCP source qualifies as a \"trusted proxy hop\" when it's\n   * loopback (the user's own machine, where any reverse proxy lives) or\n   * listed in `gateway.trustedProxies`. We use this signal to safely\n   * auto-allow same-host Origins through CSRF without requiring a manual\n   * `corsOrigins` entry for every reverse-proxy hostname.\n   */\n  const isRequestFromTrustedProxy = (c: Context): boolean => {\n    const remote = resolveRequestRemoteAddress(c);\n    if (!remote) return false;\n    if (isLoopbackIpAddress(remote)) return true;\n    return isTrustedProxyAddress(remote, service.currentConfig.gateway?.trustedProxies);\n  };\n\n  app.use(logContextMiddleware());\n  app.use(logger({\n    trustedProxies: service.currentConfig.gateway?.trustedProxies,\n    allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n  }));\n\n  // Site-share middleware runs BEFORE CORS/CSP — it owns the request when the\n  // Host header matches `*.<publicHostSuffix>` (default `*.share.xopc.ai`) or\n  // the path starts with `/site/:token/`. Otherwise it falls through.\n  registerSiteShareMiddleware(app, service);\n  app.use(\n    cors({\n      origin: (origin) => {\n        const allowed = resolveBrowserOrigins();\n        if (!origin) {\n          return allowed[0] ?? `http://127.0.0.1:${gatewayPort}`;\n        }\n        const normalized = origin.toLowerCase();\n        const hit = allowed.find((entry) => entry.toLowerCase() === normalized);\n        if (hit) return origin;\n        return allowed.includes('*') ? '*' : '';\n      },\n      allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],\n      allowHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Session-Id', 'Last-Event-ID'],\n      credentials: true,\n      maxAge: 86400,\n    }),\n  );\n\n  // Build CSP header once at startup (no inline script hashes needed for SPA)\n  const gatewayConsoleCsp = buildGatewayConsoleCspHeader();\n\n  // Security headers middleware\n  app.use(createMiddleware(async (c, next) => {\n    await next();\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return;\n    }\n    c.header('X-Frame-Options', 'DENY');\n    c.header('X-Content-Type-Options', 'nosniff');\n    c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n    c.header('X-XSS-Protection', '1; mode=block');\n    // microphone=(self): allow same-origin chat voice (composer). microphone=() breaks packaged Electron loading the gateway SPA.\n    c.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=()');\n    c.header('Content-Security-Policy', gatewayConsoleCsp);\n  }));\n\n  // Browser Origin check middleware for API routes (CSRF protection).\n  // Non-browser requests (no Origin header) pass through — they are\n  // authenticated by the token middleware instead.\n  const allowHostHeaderOriginFallback =\n    service.currentConfig.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;\n  app.use('/api/*', createMiddleware(async (c, next) => {\n    // Sandboxed extension iframes (no allow-same-origin) send `Origin: null`.\n    // `checkBrowserOrigin` rejects that; these routes rely on CSP instead\n    // (`registerPublicExtensionAssetRoutes`).\n    if (isExtensionGatewayUiAssetPath(c.req.path)) {\n      return next();\n    }\n\n    const origin = c.req.header('origin');\n    if (!origin || origin.trim().toLowerCase() === 'null') {\n      // Native apps / opaque origins — authenticated via Bearer token\n      return next();\n    }\n\n    const result = checkBrowserOrigin({\n      requestHost: c.req.header('host'),\n      origin,\n      allowedOrigins: resolveBrowserOrigins(),\n      allowHostHeaderOriginFallback,\n      autoAllowSameHostFromTrustedProxy: isRequestFromTrustedProxy(c),\n      isLocalClient: false,\n    });\n\n    if (!result.ok) {\n      log.warn(\n        {\n          origin,\n          requestHost: c.req.header('host'),\n          reason: 'reason' in result ? result.reason : 'unknown',\n          path: c.req.path,\n          method: c.req.method,\n        },\n        `Browser origin check failed: ${origin} not in allowed list`,\n      );\n      return c.json({ error: 'Forbidden', message: 'Origin not allowed' }, 403);\n    }\n\n    return next();\n  }));\n\n  app.use('/api/skills/upload', bodyLimit({\n    maxSize: 10 * 1024 * 1024,\n    onError: (c) => {\n      log.warn({ path: c.req.path, maxSizeMb: 10 }, 'Request body too large: skills upload exceeds 10MB limit');\n      return c.json({ error: 'Skill package too large', maxSize: '10MB' }, 413);\n    },\n  }));\n\n  const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;\n  const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();\n\n  app.use('/api/*', async (c, next) => {\n    const maxSize = c.req.path === '/api/agent' ? WEBCHAT_AGENT_BODY_MAX : DEFAULT_API_BODY_MAX;\n    const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));\n    return bodyLimit({\n      maxSize,\n      onError: (ctx) => {\n        log.warn({ path: ctx.req.path, maxSizeMb }, `Request body too large: exceeds ${maxSizeMb}MB limit`);\n        return ctx.json({ error: 'Request body too large', maxSize: `${maxSizeMb}MB` }, 413);\n      },\n    })(c, next);\n  });\n\n  registerPublicGatewayRoutes(app, service);\n\n  // Extension UI assets are served without auth: sandboxed iframes (no allow-same-origin)\n  // have an opaque origin of `null` and cannot forward the ?token= from the parent HTML URL.\n  // Security is enforced by the strict CSP (frame-ancestors 'self') on every response.\n  registerPublicExtensionAssetRoutes(app, service);\n\n  const authenticated = new Hono();\n  authenticated.use(\n    auth({\n      token,\n      getGatewayAuth: () => service.currentConfig.gateway?.auth,\n      getResolvedAuth: () => {\n        if (typeof service.getResolvedAuth === 'function') {\n          return service.getResolvedAuth();\n        }\n        return token ? { mode: 'token', token } : { mode: 'none' };\n      },\n      getTrustedProxyContext: () => ({\n        trustedProxies: service.currentConfig.gateway?.trustedProxies,\n        allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n      }),\n    }),\n  );\n  authenticated.use(operatorScopes());\n\n  const strictRateLimitMiddleware = createStrictRateLimitMiddleware({\n    getTrustedProxyContext: () => ({\n      trustedProxies: service.currentConfig.gateway?.trustedProxies,\n      allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true,\n    }),\n  });\n\n  const sseConfig = {\n    service,\n    maxSseConnections: service.currentConfig.gateway.maxSseConnections,\n  };\n\n  registerAuthenticatedRoutes(app, authenticated, {\n    service,\n    strictRateLimitMiddleware,\n    sseConfig,\n  });\n\n  const prewarm = prewarmStaticUiCache();\n  if (prewarm.loaded > 0) {\n    log.debug({ loaded: prewarm.loaded, missing: prewarm.missing }, 'Static UI cache prewarmed');\n  }\n\n  app.route('/', authenticated);\n\n  app.notFound((c) => {\n    const isApiRoute = c.req.path.startsWith('/api/');\n    const fields = { path: c.req.path, method: c.req.method };\n    if (isApiRoute) {\n      log.warn(fields, 'Route not found');\n    } else {\n      log.debug(fields, 'Route not found');\n    }\n    return c.json({ error: 'Not found' }, 404);\n  });\n\n  app.onError((err, c) => {\n    log.error(\n      {\n        err,\n        path: c.req.path,\n        method: c.req.method,\n        userAgent: c.req.header('user-agent'),\n      },\n      `Hono error on ${c.req.method} ${c.req.path}: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    return c.json({ error: 'Internal server error' }, 500);\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;aAQqD;AAoBrD,MAAM,MAAM,aAAa,UAAU;;;;;;AAYnC,SAAgB,8BAA8B,MAAuB;AACnE,QAAO,sCAAsC,KAAK,KAAK;;AAGzD,SAAgB,cAAc,QAA6B;AACzD,KAAI,QAAQ,IAAI,OACd,gCAA+B;CAEjC,MAAM,EAAE,SAAS,UAAU;CAC3B,MAAM,MAAM,IAAI,MAAM;CAEtB,MAAM,cAAc,gCAAgC,QAAQ;CAE5D,MAAM,8BACJ,6BAA6B;EAC3B,mBAAmB,QAAQ,cAAc,QAAQ;EACjD,MAAM;EACN,UAAU,4BAA4B,QAAQ,cAAc;EAC5D,iBAAiB,iBAAiB,EAAE;EACpC,uBAAuB,6BAA6B,QAAQ,cAAc;EAC3E,CAAC;;;;;CAMJ,MAAM,+BAA+B,MAAmC;AACtE,MAAI;AACF,UAAO,YAAY,EAAE,CAAC,OAAO;UACvB;AACN;;;;;;;;;;CAWJ,MAAM,6BAA6B,MAAwB;EACzD,MAAM,SAAS,4BAA4B,EAAE;AAC7C,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,oBAAoB,OAAO,CAAE,QAAO;AACxC,SAAO,sBAAsB,QAAQ,QAAQ,cAAc,SAAS,eAAe;;AAGrF,KAAI,IAAI,sBAAsB,CAAC;AAC/B,KAAI,IAAI,OAAO;EACb,gBAAgB,QAAQ,cAAc,SAAS;EAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;EAC7E,CAAC,CAAC;AAKH,6BAA4B,KAAK,QAAQ;AACzC,KAAI,IACF,KAAK;EACH,SAAS,WAAW;GAClB,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,OACH,QAAO,QAAQ,MAAM,oBAAoB;GAE3C,MAAM,aAAa,OAAO,aAAa;AAEvC,OADY,QAAQ,MAAM,UAAU,MAAM,aAAa,KAAK,WACrD,CAAE,QAAO;AAChB,UAAO,QAAQ,SAAS,IAAI,GAAG,MAAM;;EAEvC,cAAc;GAAC;GAAO;GAAQ;GAAS;GAAU;GAAU;EAC3D,cAAc;GAAC;GAAgB;GAAiB;GAAU;GAAgB;GAAgB;EAC1F,aAAa;EACb,QAAQ;EACT,CAAC,CACH;CAGD,MAAM,oBAAoB,8BAA8B;AAGxD,KAAI,IAAI,iBAAiB,OAAO,GAAG,SAAS;AAC1C,QAAM,MAAM;AACZ,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C;AAEF,IAAE,OAAO,mBAAmB,OAAO;AACnC,IAAE,OAAO,0BAA0B,UAAU;AAC7C,IAAE,OAAO,mBAAmB,kCAAkC;AAC9D,IAAE,OAAO,oBAAoB,gBAAgB;AAE7C,IAAE,OAAO,sBAAsB,+CAA+C;AAC9E,IAAE,OAAO,2BAA2B,kBAAkB;GACtD,CAAC;CAKH,MAAM,gCACJ,QAAQ,cAAc,SAAS,6CAA6C;AAC9E,KAAI,IAAI,UAAU,iBAAiB,OAAO,GAAG,SAAS;AAIpD,MAAI,8BAA8B,EAAE,IAAI,KAAK,CAC3C,QAAO,MAAM;EAGf,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;AACrC,MAAI,CAAC,UAAU,OAAO,MAAM,CAAC,aAAa,KAAK,OAE7C,QAAO,MAAM;EAGf,MAAM,SAAS,mBAAmB;GAChC,aAAa,EAAE,IAAI,OAAO,OAAO;GACjC;GACA,gBAAgB,uBAAuB;GACvC;GACA,mCAAmC,0BAA0B,EAAE;GAC/D,eAAe;GAChB,CAAC;AAEF,MAAI,CAAC,OAAO,IAAI;AACd,OAAI,KACF;IACE;IACA,aAAa,EAAE,IAAI,OAAO,OAAO;IACjC,QAAQ,YAAY,SAAS,OAAO,SAAS;IAC7C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACf,EACD,gCAAgC,OAAO,sBACxC;AACD,UAAO,EAAE,KAAK;IAAE,OAAO;IAAa,SAAS;IAAsB,EAAE,IAAI;;AAG3E,SAAO,MAAM;GACb,CAAC;AAEH,KAAI,IAAI,sBAAsB,UAAU;EACtC,SAAS,KAAK,OAAO;EACrB,UAAU,MAAM;AACd,OAAI,KAAK;IAAE,MAAM,EAAE,IAAI;IAAM,WAAW;IAAI,EAAE,2DAA2D;AACzG,UAAO,EAAE,KAAK;IAAE,OAAO;IAA2B,SAAS;IAAQ,EAAE,IAAI;;EAE5E,CAAC,CAAC;CAEH,MAAM,uBAAuB,IAAI,OAAO;CACxC,MAAM,yBAAyB,iCAAiC;AAEhE,KAAI,IAAI,UAAU,OAAO,GAAG,SAAS;EACnC,MAAM,UAAU,EAAE,IAAI,SAAS,eAAe,yBAAyB;EACvE,MAAM,YAAY,KAAK,KAAK,WAAW,OAAO,MAAM;AACpD,SAAO,UAAU;GACf;GACA,UAAU,QAAQ;AAChB,QAAI,KAAK;KAAE,MAAM,IAAI,IAAI;KAAM;KAAW,EAAE,mCAAmC,UAAU,UAAU;AACnG,WAAO,IAAI,KAAK;KAAE,OAAO;KAA0B,SAAS,GAAG,UAAU;KAAK,EAAE,IAAI;;GAEvF,CAAC,CAAC,GAAG,KAAK;GACX;AAEF,6BAA4B,KAAK,QAAQ;AAKzC,oCAAmC,KAAK,QAAQ;CAEhD,MAAM,gBAAgB,IAAI,MAAM;AAChC,eAAc,IACZ,KAAK;EACH;EACA,sBAAsB,QAAQ,cAAc,SAAS;EACrD,uBAAuB;AACrB,OAAI,OAAO,QAAQ,oBAAoB,WACrC,QAAO,QAAQ,iBAAiB;AAElC,UAAO,QAAQ;IAAE,MAAM;IAAS;IAAO,GAAG,EAAE,MAAM,QAAQ;;EAE5D,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E;EACF,CAAC,CACH;AACD,eAAc,IAAI,gBAAgB,CAAC;AAcnC,6BAA4B,KAAK,eAAe;EAC9C;EACA,2BAdgC,gCAAgC,EAChE,+BAA+B;GAC7B,gBAAgB,QAAQ,cAAc,SAAS;GAC/C,qBAAqB,QAAQ,cAAc,SAAS,wBAAwB;GAC7E,GACF,CAS0B;EACzB,WAAA;GAPA;GACA,mBAAmB,QAAQ,cAAc,QAAQ;GAMxC;EACV,CAAC;CAEF,MAAM,UAAU,sBAAsB;AACtC,KAAI,QAAQ,SAAS,EACnB,KAAI,MAAM;EAAE,QAAQ,QAAQ;EAAQ,SAAS,QAAQ;EAAS,EAAE,4BAA4B;AAG9F,KAAI,MAAM,KAAK,cAAc;AAE7B,KAAI,UAAU,MAAM;EAClB,MAAM,aAAa,EAAE,IAAI,KAAK,WAAW,QAAQ;EACjD,MAAM,SAAS;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;AACzD,MAAI,WACF,KAAI,KAAK,QAAQ,kBAAkB;MAEnC,KAAI,MAAM,QAAQ,kBAAkB;AAEtC,SAAO,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,IAAI;GAC1C;AAEF,KAAI,SAAS,KAAK,MAAM;AACtB,MAAI,MACF;GACE;GACA,MAAM,EAAE,IAAI;GACZ,QAAQ,EAAE,IAAI;GACd,WAAW,EAAE,IAAI,OAAO,aAAa;GACtC,EACD,iBAAiB,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;AACD,SAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;GACtD;AAEF,QAAO"}

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,12 +1,12 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
+import { resolveShareConfig } from "../../../share/share-config.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { bundledChannelPlugins } from "../../../generated/bundled-channel-plugins.js";
 import { listChannelPlugins, syncChannelPluginsFromManager } from "../../../channels/plugins/registry.js";
 import { resolveCronConfigForWeb, resolveGoalsConfigForWeb, resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { resolveShareConfig } from "../../../share/share-config.js";
 import { agentImageGenerationModelAutoProviderFallback, agentImageGenerationModelTimeoutMs, agentModelFallbacksToArray, agentModelRefToString } from "./agent-model.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";

package/dist/src/gateway/hono/lib/extension-store.js

@@ -1,7 +1,7 @@
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
 import { homedir } from "node:os";
+import { join } from "node:path";
+import { readFile } from "node:fs/promises";
 //#region src/gateway/hono/lib/extension-store.ts
 init_write_file_atomic();
 /** Extension UI: write-through JSON KV per namespace under ~/.xopc/extensions/{namespace}/storage.json */

package/dist/src/gateway/hono/lib/static-ui.js

@@ -1,6 +1,6 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 //#region src/gateway/hono/lib/static-ui.ts
 const __dirname = dirname(fileURLToPath(import.meta.url));

package/dist/src/gateway/hono/oauth.js

@@ -1,6 +1,6 @@
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
 import { init_providers, isProviderConfigured } from "../../providers/index.js";
+import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
 import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
 import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
 import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";

package/dist/src/gateway/hono/routes/agents.js

@@ -1,5 +1,5 @@
-import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
 import { init_schema, parseModelRef } from "../../../config/schema.js";
+import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
 import { init_providers, isProviderConfigured, resolveModel } from "../../../providers/index.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 import { deleteAgentAvatarFile, finalizeCreateAgentDirs, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareCreateAgentsBatch, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -7,8 +7,8 @@ import { createOAuthHandler } from "../oauth.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
-import { existsSync, readFileSync, statSync } from "node:fs";
 import { relative, resolve } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/auth-registry-extensions.ts
 init_providers();
 const EXTENSION_ASSET_CSP = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'none'; frame-ancestors 'self'; frame-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'";

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,5 +1,5 @@
-import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { BindingsConfigSchema, McpConfigSchema, init_schema } from "../../../../config/schema.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { mergeCronConfigPatch, mergeGatewaySkillsMarketplacePatch, mergeGoalsConfigPatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";

package/dist/src/gateway/hono/routes/dreaming.js

@@ -5,8 +5,8 @@ import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { parseDreamingLastRunFile } from "../../../agent/memory/dreaming/last-run.js";
 import { readDreamingEvents } from "../../../agent/memory/dreaming/events.js";
 import { previewDreamingDeepPromotion } from "../../../agent/memory/dreaming/preview.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/gateway/hono/routes/dreaming.ts
 function isRecord(v) {
 	return v !== null && typeof v === "object" && !Array.isArray(v);

package/dist/src/gateway/hono/routes/host-fs.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { readdir, realpath, stat } from "node:fs/promises";
-import * as path$1 from "node:path";
 import * as os$1 from "node:os";
+import * as path$1 from "node:path";
+import { readdir, realpath, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/host-fs.ts
 init_logger();
 const log = createLogger("HostFs");

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -142,6 +142,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerShareRoutes };
 		}
 	},
+	{
+		id: "site-shares",
+		match: (path) => startsWithAny(path, ["/api/site-shares"]),
+		load: async () => {
+			const { registerSiteShareRoutes } = await import("./site-shares.js");
+			return { register: registerSiteShareRoutes };
+		}
+	},
 	{
 		id: "tunnel",
 		match: (path) => startsWithAny(path, ["/api/tunnel"]),

package/dist/src/gateway/hono/routes/lazy-bundles.js.map

@@ -1 +1 @@
-{"version":3,"file":"lazy-bundles.js","names":[],"sources":["../../../../../src/gateway/hono/routes/lazy-bundles.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { GatewayService } from '../../service.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nexport type AuthenticatedLazyRouteBundle = {\n  id: string;\n  match: (path: string) => boolean;\n  load: () => Promise<{ register: (authenticated: Hono, deps: AuthenticatedRouteDeps) => void }>;\n};\n\nexport type AppLazyRouteBundle = {\n  id: string;\n  prefixes: readonly string[];\n  match: (path: string) => boolean;\n  load: () => Promise<{\n    registerOnApp: (app: Hono, service: GatewayService) => void;\n  }>;\n};\n\nfunction startsWithAny(path: string, prefixes: readonly string[]): boolean {\n  return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));\n}\n\nexport const AUTHENTICATED_LAZY_ROUTE_BUNDLES: readonly AuthenticatedLazyRouteBundle[] = [\n  {\n    id: 'workspace',\n    match: (path) => startsWithAny(path, ['/api/workspace']),\n    load: async () => {\n      const { registerWorkspaceRoutes } = await import('./workspace.js');\n      return { register: registerWorkspaceRoutes };\n    },\n  },\n  {\n    id: 'host-fs',\n    match: (path) => startsWithAny(path, ['/api/host/fs']),\n    load: async () => {\n      const { registerHostFsRoutes } = await import('./host-fs.js');\n      return { register: registerHostFsRoutes };\n    },\n  },\n  {\n    id: 'channels',\n    match: (path) => startsWithAny(path, ['/api/channels']),\n    load: async () => {\n      const { registerChannelRoutes } = await import('./channels.js');\n      return { register: registerChannelRoutes };\n    },\n  },\n  {\n    id: 'browser-install',\n    match: (path) =>\n      path === '/api/browser/playwright/install/stream' ||\n      path === '/api/browser/cloakbrowser/install/stream',\n    load: async () => {\n      const { registerBrowserInstallRoutes } = await import('./browser-install.js');\n      return { register: registerBrowserInstallRoutes };\n    },\n  },\n  {\n    id: 'browser',\n    // `browser-install` above already matched the SSE install streams; this\n    // catches the remaining /api/browser/* handlers (extension, cdp,\n    // cloakbrowser doctor/launch/install, playwright doctor/install, cloud).\n    match: (path) => startsWithAny(path, ['/api/browser']),\n    load: async () => {\n      const { registerBrowserRoutes } = await import('./browser.js');\n      return { register: registerBrowserRoutes };\n    },\n  },\n  {\n    id: 'config',\n    match: (path) =>\n      startsWithAny(path, ['/api/config', '/api/heartbeat/trigger']),\n    load: async () => {\n      const { registerConfigRoutes } = await import('./config.js');\n      return { register: registerConfigRoutes };\n    },\n  },\n  {\n    id: 'doctor',\n    match: (path) => startsWithAny(path, ['/api/doctor']),\n    load: async () => {\n      const { registerDoctorRoutes } = await import('./doctor.js');\n      return { register: registerDoctorRoutes };\n    },\n  },\n  {\n    id: 'dreaming',\n    match: (path) => startsWithAny(path, ['/api/dreaming']),\n    load: async () => {\n      const { registerDreamingRoutes } = await import('./dreaming.js');\n      return { register: registerDreamingRoutes };\n    },\n  },\n  {\n    id: 'agents',\n    match: (path) => startsWithAny(path, ['/api/agents', '/api/voice/models']),\n    load: async () => {\n      const { registerAgentsRoutes } = await import('./agents.js');\n      return { register: registerAgentsRoutes };\n    },\n  },\n  {\n    id: 'auth-registry-extensions',\n    match: (path) =>\n      startsWithAny(path, [\n        '/api/auth',\n        '/api/registry',\n        '/api/extensions',\n        '/api/context',\n        '/api/marketplace',\n      ]),\n    load: async () => {\n      const { registerAuthRegistryExtensionsRoutes } = await import('./auth-registry-extensions.js');\n      return { register: registerAuthRegistryExtensionsRoutes };\n    },\n  },\n  {\n    id: 'models',\n    match: (path) =>\n      startsWithAny(path, ['/api/models', '/api/models-json', '/api/providers', '/api/image']),\n    load: async () => {\n      const { registerModelsRoutes } = await import('./models.js');\n      return { register: registerModelsRoutes };\n    },\n  },\n  {\n    id: 'commands-skills',\n    match: (path) => startsWithAny(path, ['/api/commands', '/api/skills']),\n    load: async () => {\n      const { registerCommandsSkillsRoutes } = await import('./commands-skills.js');\n      return { register: registerCommandsSkillsRoutes };\n    },\n  },\n  {\n    id: 'cron',\n    match: (path) => startsWithAny(path, ['/api/cron']),\n    load: async () => {\n      const { registerCronRoutes } = await import('./cron.js');\n      return { register: registerCronRoutes };\n    },\n  },\n  {\n    id: 'goals',\n    match: (path) => startsWithAny(path, ['/api/goals']),\n    load: async () => {\n      const { registerGoalsRoutes } = await import('./goals.js');\n      return { register: registerGoalsRoutes };\n    },\n  },\n  {\n    id: 'logs',\n    match: (path) => startsWithAny(path, ['/api/logs']),\n    load: async () => {\n      const { registerLogsRoutes } = await import('./logs.js');\n      return { register: registerLogsRoutes };\n    },\n  },\n  {\n    id: 'shares',\n    match: (path) => startsWithAny(path, ['/api/shares']),\n    load: async () => {\n      const { registerShareRoutes } = await import('./shares.js');\n      return { register: registerShareRoutes };\n    },\n  },\n  {\n    id: 'tunnel',\n    match: (path) => startsWithAny(path, ['/api/tunnel']),\n    load: async () => {\n      const { registerTunnelRoutes } = await import('./tunnel.js');\n      return { register: registerTunnelRoutes };\n    },\n  },\n  {\n    id: 'exposure',\n    match: (path) => startsWithAny(path, ['/api/exposure']),\n    load: async () => {\n      const { registerExposureRoutes } = await import('./exposure.js');\n      return { register: registerExposureRoutes };\n    },\n  },\n  {\n    id: 'extension-gateway',\n    match: (path) => startsWithAny(path, ['/api/gateway']),\n    load: async () => {\n      const { registerExtensionGatewayRoutes } = await import('./extension-gateway.js');\n      return { register: registerExtensionGatewayRoutes };\n    },\n  },\n  {\n    id: 'update',\n    match: (path) => startsWithAny(path, ['/api/update']),\n    load: async () => {\n      const { registerUpdateRoutes } = await import('./update.js');\n      return { register: registerUpdateRoutes };\n    },\n  },\n  {\n    id: 'voice',\n    match: (path) => startsWithAny(path, ['/api/voice']) && path !== '/api/voice/models',\n    load: async () => {\n      const { registerVoiceRoutes } = await import('./voice.js');\n      return { register: registerVoiceRoutes };\n    },\n  },\n  {\n    id: 'mcp',\n    match: (path) => startsWithAny(path, ['/api/mcp']),\n    load: async () => {\n      const { registerMcpRoutes } = await import('./mcp.js');\n      return { register: registerMcpRoutes };\n    },\n  },\n];\n\nexport const APP_LAZY_ROUTE_BUNDLES: readonly AppLazyRouteBundle[] = [\n  {\n    id: 'shares-public',\n    prefixes: ['/s'],\n    match: (path) => startsWithAny(path, ['/s']),\n    load: async () => {\n      const { registerSharePublicRoutes } = await import('./shares.js');\n      return { registerOnApp: registerSharePublicRoutes };\n    },\n  },\n  {\n    id: 'tunnel-public',\n    prefixes: [\n      '/api/tunnel/pair/ping',\n      '/api/tunnel/pair/validate-url',\n      '/api/tunnel/exchange-token',\n    ],\n    match: (path) =>\n      path === '/api/tunnel/exchange-token' ||\n      path === '/api/tunnel/pair/ping' ||\n      path === '/api/tunnel/pair/validate-url',\n    load: async () => {\n      const { registerTunnelPublicRoutes } = await import('./tunnel.js');\n      return { registerOnApp: registerTunnelPublicRoutes };\n    },\n  },\n];\n\nexport function findAuthenticatedLazyRouteBundle(path: string): AuthenticatedLazyRouteBundle | undefined {\n  return AUTHENTICATED_LAZY_ROUTE_BUNDLES.find((bundle) => bundle.match(path));\n}\n"],"mappings":";AAoBA,SAAS,cAAc,MAAc,UAAsC;AACzE,QAAO,SAAS,MAAM,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,OAAO,GAAG,CAAC;;AAGpF,MAAa,mCAA4E;CACvF;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,iBAAiB,CAAC;EACxD,MAAM,YAAY;GAChB,MAAM,EAAE,4BAA4B,MAAM,OAAO;AACjD,UAAO,EAAE,UAAU,yBAAyB;;EAE/C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,0BAA0B,MAAM,OAAO;AAC/C,UAAO,EAAE,UAAU,uBAAuB;;EAE7C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,SAAS,4CACT,SAAS;EACX,MAAM,YAAY;GAChB,MAAM,EAAE,iCAAiC,MAAM,OAAO;AACtD,UAAO,EAAE,UAAU,8BAA8B;;EAEpD;CACD;EACE,IAAI;EAIJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,0BAA0B,MAAM,OAAO;AAC/C,UAAO,EAAE,UAAU,uBAAuB;;EAE7C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM,CAAC,eAAe,yBAAyB,CAAC;EAChE,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,UAAO,EAAE,UAAU,wBAAwB;;EAE9C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,oBAAoB,CAAC;EAC1E,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM;GAClB;GACA;GACA;GACA;GACA;GACD,CAAC;EACJ,MAAM,YAAY;GAChB,MAAM,EAAE,yCAAyC,MAAM,OAAO;AAC9D,UAAO,EAAE,UAAU,sCAAsC;;EAE5D;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM;GAAC;GAAe;GAAoB;GAAkB;GAAa,CAAC;EAC1F,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,iBAAiB,cAAc,CAAC;EACtE,MAAM,YAAY;GAChB,MAAM,EAAE,iCAAiC,MAAM,OAAO;AACtD,UAAO,EAAE,UAAU,8BAA8B;;EAEpD;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,YAAY,CAAC;EACnD,MAAM,YAAY;GAChB,MAAM,EAAE,uBAAuB,MAAM,OAAO;AAC5C,UAAO,EAAE,UAAU,oBAAoB;;EAE1C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,aAAa,CAAC;EACpD,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,YAAY,CAAC;EACnD,MAAM,YAAY;GAChB,MAAM,EAAE,uBAAuB,MAAM,OAAO;AAC5C,UAAO,EAAE,UAAU,oBAAoB;;EAE1C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,UAAO,EAAE,UAAU,wBAAwB;;EAE9C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,mCAAmC,MAAM,OAAO;AACxD,UAAO,EAAE,UAAU,gCAAgC;;EAEtD;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,aAAa,CAAC,IAAI,SAAS;EACjE,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,WAAW,CAAC;EAClD,MAAM,YAAY;GAChB,MAAM,EAAE,sBAAsB,MAAM,OAAO;AAC3C,UAAO,EAAE,UAAU,mBAAmB;;EAEzC;CACF;AAED,MAAa,yBAAwD,CACnE;CACE,IAAI;CACJ,UAAU,CAAC,KAAK;CAChB,QAAQ,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC;CAC5C,MAAM,YAAY;EAChB,MAAM,EAAE,8BAA8B,MAAM,OAAO;AACnD,SAAO,EAAE,eAAe,2BAA2B;;CAEtD,EACD;CACE,IAAI;CACJ,UAAU;EACR;EACA;EACA;EACD;CACD,QAAQ,SACN,SAAS,gCACT,SAAS,2BACT,SAAS;CACX,MAAM,YAAY;EAChB,MAAM,EAAE,+BAA+B,MAAM,OAAO;AACpD,SAAO,EAAE,eAAe,4BAA4B;;CAEvD,CACF;AAED,SAAgB,iCAAiC,MAAwD;AACvG,QAAO,iCAAiC,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC"}
+{"version":3,"file":"lazy-bundles.js","names":[],"sources":["../../../../../src/gateway/hono/routes/lazy-bundles.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { GatewayService } from '../../service.js';\nimport type { AuthenticatedRouteDeps } from './deps.js';\n\nexport type AuthenticatedLazyRouteBundle = {\n  id: string;\n  match: (path: string) => boolean;\n  load: () => Promise<{ register: (authenticated: Hono, deps: AuthenticatedRouteDeps) => void }>;\n};\n\nexport type AppLazyRouteBundle = {\n  id: string;\n  prefixes: readonly string[];\n  match: (path: string) => boolean;\n  load: () => Promise<{\n    registerOnApp: (app: Hono, service: GatewayService) => void;\n  }>;\n};\n\nfunction startsWithAny(path: string, prefixes: readonly string[]): boolean {\n  return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));\n}\n\nexport const AUTHENTICATED_LAZY_ROUTE_BUNDLES: readonly AuthenticatedLazyRouteBundle[] = [\n  {\n    id: 'workspace',\n    match: (path) => startsWithAny(path, ['/api/workspace']),\n    load: async () => {\n      const { registerWorkspaceRoutes } = await import('./workspace.js');\n      return { register: registerWorkspaceRoutes };\n    },\n  },\n  {\n    id: 'host-fs',\n    match: (path) => startsWithAny(path, ['/api/host/fs']),\n    load: async () => {\n      const { registerHostFsRoutes } = await import('./host-fs.js');\n      return { register: registerHostFsRoutes };\n    },\n  },\n  {\n    id: 'channels',\n    match: (path) => startsWithAny(path, ['/api/channels']),\n    load: async () => {\n      const { registerChannelRoutes } = await import('./channels.js');\n      return { register: registerChannelRoutes };\n    },\n  },\n  {\n    id: 'browser-install',\n    match: (path) =>\n      path === '/api/browser/playwright/install/stream' ||\n      path === '/api/browser/cloakbrowser/install/stream',\n    load: async () => {\n      const { registerBrowserInstallRoutes } = await import('./browser-install.js');\n      return { register: registerBrowserInstallRoutes };\n    },\n  },\n  {\n    id: 'browser',\n    // `browser-install` above already matched the SSE install streams; this\n    // catches the remaining /api/browser/* handlers (extension, cdp,\n    // cloakbrowser doctor/launch/install, playwright doctor/install, cloud).\n    match: (path) => startsWithAny(path, ['/api/browser']),\n    load: async () => {\n      const { registerBrowserRoutes } = await import('./browser.js');\n      return { register: registerBrowserRoutes };\n    },\n  },\n  {\n    id: 'config',\n    match: (path) =>\n      startsWithAny(path, ['/api/config', '/api/heartbeat/trigger']),\n    load: async () => {\n      const { registerConfigRoutes } = await import('./config.js');\n      return { register: registerConfigRoutes };\n    },\n  },\n  {\n    id: 'doctor',\n    match: (path) => startsWithAny(path, ['/api/doctor']),\n    load: async () => {\n      const { registerDoctorRoutes } = await import('./doctor.js');\n      return { register: registerDoctorRoutes };\n    },\n  },\n  {\n    id: 'dreaming',\n    match: (path) => startsWithAny(path, ['/api/dreaming']),\n    load: async () => {\n      const { registerDreamingRoutes } = await import('./dreaming.js');\n      return { register: registerDreamingRoutes };\n    },\n  },\n  {\n    id: 'agents',\n    match: (path) => startsWithAny(path, ['/api/agents', '/api/voice/models']),\n    load: async () => {\n      const { registerAgentsRoutes } = await import('./agents.js');\n      return { register: registerAgentsRoutes };\n    },\n  },\n  {\n    id: 'auth-registry-extensions',\n    match: (path) =>\n      startsWithAny(path, [\n        '/api/auth',\n        '/api/registry',\n        '/api/extensions',\n        '/api/context',\n        '/api/marketplace',\n      ]),\n    load: async () => {\n      const { registerAuthRegistryExtensionsRoutes } = await import('./auth-registry-extensions.js');\n      return { register: registerAuthRegistryExtensionsRoutes };\n    },\n  },\n  {\n    id: 'models',\n    match: (path) =>\n      startsWithAny(path, ['/api/models', '/api/models-json', '/api/providers', '/api/image']),\n    load: async () => {\n      const { registerModelsRoutes } = await import('./models.js');\n      return { register: registerModelsRoutes };\n    },\n  },\n  {\n    id: 'commands-skills',\n    match: (path) => startsWithAny(path, ['/api/commands', '/api/skills']),\n    load: async () => {\n      const { registerCommandsSkillsRoutes } = await import('./commands-skills.js');\n      return { register: registerCommandsSkillsRoutes };\n    },\n  },\n  {\n    id: 'cron',\n    match: (path) => startsWithAny(path, ['/api/cron']),\n    load: async () => {\n      const { registerCronRoutes } = await import('./cron.js');\n      return { register: registerCronRoutes };\n    },\n  },\n  {\n    id: 'goals',\n    match: (path) => startsWithAny(path, ['/api/goals']),\n    load: async () => {\n      const { registerGoalsRoutes } = await import('./goals.js');\n      return { register: registerGoalsRoutes };\n    },\n  },\n  {\n    id: 'logs',\n    match: (path) => startsWithAny(path, ['/api/logs']),\n    load: async () => {\n      const { registerLogsRoutes } = await import('./logs.js');\n      return { register: registerLogsRoutes };\n    },\n  },\n  {\n    id: 'shares',\n    match: (path) => startsWithAny(path, ['/api/shares']),\n    load: async () => {\n      const { registerShareRoutes } = await import('./shares.js');\n      return { register: registerShareRoutes };\n    },\n  },\n  {\n    id: 'site-shares',\n    match: (path) => startsWithAny(path, ['/api/site-shares']),\n    load: async () => {\n      const { registerSiteShareRoutes } = await import('./site-shares.js');\n      return { register: registerSiteShareRoutes };\n    },\n  },\n  {\n    id: 'tunnel',\n    match: (path) => startsWithAny(path, ['/api/tunnel']),\n    load: async () => {\n      const { registerTunnelRoutes } = await import('./tunnel.js');\n      return { register: registerTunnelRoutes };\n    },\n  },\n  {\n    id: 'exposure',\n    match: (path) => startsWithAny(path, ['/api/exposure']),\n    load: async () => {\n      const { registerExposureRoutes } = await import('./exposure.js');\n      return { register: registerExposureRoutes };\n    },\n  },\n  {\n    id: 'extension-gateway',\n    match: (path) => startsWithAny(path, ['/api/gateway']),\n    load: async () => {\n      const { registerExtensionGatewayRoutes } = await import('./extension-gateway.js');\n      return { register: registerExtensionGatewayRoutes };\n    },\n  },\n  {\n    id: 'update',\n    match: (path) => startsWithAny(path, ['/api/update']),\n    load: async () => {\n      const { registerUpdateRoutes } = await import('./update.js');\n      return { register: registerUpdateRoutes };\n    },\n  },\n  {\n    id: 'voice',\n    match: (path) => startsWithAny(path, ['/api/voice']) && path !== '/api/voice/models',\n    load: async () => {\n      const { registerVoiceRoutes } = await import('./voice.js');\n      return { register: registerVoiceRoutes };\n    },\n  },\n  {\n    id: 'mcp',\n    match: (path) => startsWithAny(path, ['/api/mcp']),\n    load: async () => {\n      const { registerMcpRoutes } = await import('./mcp.js');\n      return { register: registerMcpRoutes };\n    },\n  },\n];\n\nexport const APP_LAZY_ROUTE_BUNDLES: readonly AppLazyRouteBundle[] = [\n  {\n    id: 'shares-public',\n    prefixes: ['/s'],\n    match: (path) => startsWithAny(path, ['/s']),\n    load: async () => {\n      const { registerSharePublicRoutes } = await import('./shares.js');\n      return { registerOnApp: registerSharePublicRoutes };\n    },\n  },\n  {\n    id: 'tunnel-public',\n    prefixes: [\n      '/api/tunnel/pair/ping',\n      '/api/tunnel/pair/validate-url',\n      '/api/tunnel/exchange-token',\n    ],\n    match: (path) =>\n      path === '/api/tunnel/exchange-token' ||\n      path === '/api/tunnel/pair/ping' ||\n      path === '/api/tunnel/pair/validate-url',\n    load: async () => {\n      const { registerTunnelPublicRoutes } = await import('./tunnel.js');\n      return { registerOnApp: registerTunnelPublicRoutes };\n    },\n  },\n];\n\nexport function findAuthenticatedLazyRouteBundle(path: string): AuthenticatedLazyRouteBundle | undefined {\n  return AUTHENTICATED_LAZY_ROUTE_BUNDLES.find((bundle) => bundle.match(path));\n}\n"],"mappings":";AAoBA,SAAS,cAAc,MAAc,UAAsC;AACzE,QAAO,SAAS,MAAM,WAAW,SAAS,UAAU,KAAK,WAAW,GAAG,OAAO,GAAG,CAAC;;AAGpF,MAAa,mCAA4E;CACvF;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,iBAAiB,CAAC;EACxD,MAAM,YAAY;GAChB,MAAM,EAAE,4BAA4B,MAAM,OAAO;AACjD,UAAO,EAAE,UAAU,yBAAyB;;EAE/C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,0BAA0B,MAAM,OAAO;AAC/C,UAAO,EAAE,UAAU,uBAAuB;;EAE7C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,SAAS,4CACT,SAAS;EACX,MAAM,YAAY;GAChB,MAAM,EAAE,iCAAiC,MAAM,OAAO;AACtD,UAAO,EAAE,UAAU,8BAA8B;;EAEpD;CACD;EACE,IAAI;EAIJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,0BAA0B,MAAM,OAAO;AAC/C,UAAO,EAAE,UAAU,uBAAuB;;EAE7C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM,CAAC,eAAe,yBAAyB,CAAC;EAChE,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,UAAO,EAAE,UAAU,wBAAwB;;EAE9C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,oBAAoB,CAAC;EAC1E,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM;GAClB;GACA;GACA;GACA;GACA;GACD,CAAC;EACJ,MAAM,YAAY;GAChB,MAAM,EAAE,yCAAyC,MAAM,OAAO;AAC9D,UAAO,EAAE,UAAU,sCAAsC;;EAE5D;CACD;EACE,IAAI;EACJ,QAAQ,SACN,cAAc,MAAM;GAAC;GAAe;GAAoB;GAAkB;GAAa,CAAC;EAC1F,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,iBAAiB,cAAc,CAAC;EACtE,MAAM,YAAY;GAChB,MAAM,EAAE,iCAAiC,MAAM,OAAO;AACtD,UAAO,EAAE,UAAU,8BAA8B;;EAEpD;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,YAAY,CAAC;EACnD,MAAM,YAAY;GAChB,MAAM,EAAE,uBAAuB,MAAM,OAAO;AAC5C,UAAO,EAAE,UAAU,oBAAoB;;EAE1C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,aAAa,CAAC;EACpD,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,YAAY,CAAC;EACnD,MAAM,YAAY;GAChB,MAAM,EAAE,uBAAuB,MAAM,OAAO;AAC5C,UAAO,EAAE,UAAU,oBAAoB;;EAE1C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,mBAAmB,CAAC;EAC1D,MAAM,YAAY;GAChB,MAAM,EAAE,4BAA4B,MAAM,OAAO;AACjD,UAAO,EAAE,UAAU,yBAAyB;;EAE/C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,gBAAgB,CAAC;EACvD,MAAM,YAAY;GAChB,MAAM,EAAE,2BAA2B,MAAM,OAAO;AAChD,UAAO,EAAE,UAAU,wBAAwB;;EAE9C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,eAAe,CAAC;EACtD,MAAM,YAAY;GAChB,MAAM,EAAE,mCAAmC,MAAM,OAAO;AACxD,UAAO,EAAE,UAAU,gCAAgC;;EAEtD;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,cAAc,CAAC;EACrD,MAAM,YAAY;GAChB,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAO,EAAE,UAAU,sBAAsB;;EAE5C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,aAAa,CAAC,IAAI,SAAS;EACjE,MAAM,YAAY;GAChB,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,UAAO,EAAE,UAAU,qBAAqB;;EAE3C;CACD;EACE,IAAI;EACJ,QAAQ,SAAS,cAAc,MAAM,CAAC,WAAW,CAAC;EAClD,MAAM,YAAY;GAChB,MAAM,EAAE,sBAAsB,MAAM,OAAO;AAC3C,UAAO,EAAE,UAAU,mBAAmB;;EAEzC;CACF;AAED,MAAa,yBAAwD,CACnE;CACE,IAAI;CACJ,UAAU,CAAC,KAAK;CAChB,QAAQ,SAAS,cAAc,MAAM,CAAC,KAAK,CAAC;CAC5C,MAAM,YAAY;EAChB,MAAM,EAAE,8BAA8B,MAAM,OAAO;AACnD,SAAO,EAAE,eAAe,2BAA2B;;CAEtD,EACD;CACE,IAAI;CACJ,UAAU;EACR;EACA;EACA;EACD;CACD,QAAQ,SACN,SAAS,gCACT,SAAS,2BACT,SAAS;CACX,MAAM,YAAY;EAChB,MAAM,EAAE,+BAA+B,MAAM,OAAO;AACpD,SAAO,EAAE,eAAe,4BAA4B;;CAEvD,CACF;AAED,SAAgB,iCAAiC,MAAwD;AACvG,QAAO,iCAAiC,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC"}

package/dist/src/gateway/hono/routes/models.js

@@ -1,8 +1,8 @@
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderActiveKeySource, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { getImageGenerationProvider } from "../../../agent/image/generation/provider-registry.js";