@xopcai/xopc 0.0.88 → 0.0.89

package/dist/src/gateway/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":["writeConfigToDisk"],"sources":["../../../src/gateway/service.ts"],"sourcesContent":["import crypto from 'crypto';\nimport { AgentService } from '../agent/service.js';\nimport { ChannelManager } from '../channels/manager.js';\nimport { CHAT_CHANNEL_ORDER, getChatChannelMeta } from '../channels/registry.js';\nimport { setPairingBroadcastSink } from '../channels/pairing/pairing-events.js';\nimport { MessageBus, MessageBusShutdownError } from '../infra/bus/index.js';\nimport { loadConfig, saveConfig as writeConfigToDisk } from '../config/index.js';\nimport { getWorkspacePath } from '../config/workspace-path-helpers.js';\nimport { CronService } from '../cron/index.js';\nimport { ExtensionLoader, areExtensionsGloballyDisabled, buildExtensionMetadataSnapshot } from '../extensions/index.js';\nimport { HeartbeatService, heartbeatRunnerConfigFromConfig } from './heartbeat/index.js';\nimport { SessionIndex } from '../session/index.js';\nimport type { Config } from '../config/schema.js';\nimport { wireTunnelEventsToGateway } from '../tunnel/gateway-lifecycle.js';\nimport {\n  stopTailscaleExposure,\n} from './tailscale-lifecycle.js';\nimport { getExposureManager } from '../remote-access/exposure-manager.js';\nimport { sanitizeTunnelConfig } from '../tunnel/tunnel-config.js';\nimport { resolveGatewayAuth, assertGatewayAuthConfigured, validateToken, extractToken, type ResolvedGatewayAuth } from './auth.js';\nimport { assertGatewayAuthNotKnownWeak } from './security/known-weak-secrets.js';\nimport { auditGatewayConfig } from './security/audit.js';\nimport { assertGatewayRuntimeConfig } from './runtime-config.js';\nimport { resolveEffectiveGatewayPort } from './host.js';\nimport { buckets, isGatewayStrictSecurityEnabled } from './rate-limit/index.js';\nimport { prewarmModelRegistry } from '../providers/index.js';\nimport { createLogger, getLogDir, getLogStats } from '../utils/logger.js';\nimport {\n  resolveConfigPath,\n  resolveCronJobsPath,\n  resolveAgentDir,\n  resolveExtensionsDir,\n} from '../config/paths.js';\nimport { AgentRunRelay, type RelayEvent } from './agent-run-relay.js';\nimport { registerClarifyBridge } from './clarify-runtime.js';\nimport { PACKAGE_VERSION } from '../package-version.js';\n\nimport { disposeAllSessionMcpRuntimes } from '../agent/mcp/bundle-mcp-tools.js';\nimport { getDefaultAgentId } from '../routing/resolve-route.js';\nimport { scheduleGatewayUpdateCheck } from '../infra/update-startup.js';\nimport { resolveChannelConnectDeferSet } from './resolve-channel-connect-defer.js';\nimport { restartGatewayProcessWithFreshPid } from './respawn.js';\nimport { GatewaySessionsApi } from './service/sessions-api.js';\nimport { GatewayMarketplaceService } from './service/marketplace-service.js';\nimport { GatewayConfigCoordinator } from './service/config-coordinator.js';\nimport { GatewayAgentRunner } from './service/agent-runner.js';\nimport { GatewaySseHub } from './service/sse-hub.js';\nimport type {\n  GatewayChannelStartupPhase1Metrics,\n  GatewayChannelStartupPhase2Metrics,\n  GatewayServiceConfig,\n  ServiceEvent,\n} from './service/types.js';\nimport {\n  GatewayReadiness,\n  type GatewayReadinessSnapshot,\n} from './startup-readiness.js';\nimport { createGatewayStartupTrace, type GatewayStartupTrace } from './startup-trace.js';\n\nexport type {\n  GatewayChannelStartupPhase1Metrics,\n  GatewayChannelStartupPhase2Metrics,\n  GatewayServiceConfig,\n  ServiceEvent,\n} from './service/types.js';\n\nconst log = createLogger('GatewayService');\n\nexport class GatewayService {\n  private bus: MessageBus;\n  private config: Config;\n  private configPath: string;\n  private _agentService: AgentService | null = null;\n  private channelManager: ChannelManager;\n  private cronService: CronService;\n  private extensionLoader: ExtensionLoader | null = null;\n  private extensionMetadataSnapshot: import('../extensions/extension-metadata-snapshot.js').ExtensionMetadataSnapshot | null = null;\n  private browserExtensionProvider: import('../browser/providers/extension.js').ExtensionBrowserProvider | null = null;\n  private browserExtensionRelease: (() => Promise<void>) | null = null;\n  /** `${host}:${port}` when the gateway holds the extension bridge listener. */\n  private browserExtensionBindKey: string | null = null;\n  private heartbeatService: HeartbeatService | null = null;\n  private sessionIndex: SessionIndex;\n  private running = false;\n  private startTime = Date.now();\n  private workspacePath: string;\n  private readonly configCoordinator: GatewayConfigCoordinator;\n\n  // Authentication\n  private auth: ResolvedGatewayAuth;\n\n  private readonly sse = new GatewaySseHub();\n\n  private stopGatewayUpdateCheck: (() => void) | null = null;\n\n  /** When set (e.g. by `GatewayServer`), `triggerGatewayProcessRestart` can stop HTTP then exit. */\n  private gatewayShutdownForRestart: (() => Promise<void>) | null = null;\n\n  /** Snapshot for phase-2 metrics / logs (ids deferred at phase-1 `start()`). */\n  private lastDeferredChannelConnectIds: string[] = [];\n  private lastChannelConnectDeferMode: 'auto' | 'off' | 'explicit' = 'auto';\n  private lastChannelConnectDeferSource: 'off' | 'explicit' | 'meta' = 'off';\n\n  private readonly readiness = new GatewayReadiness();\n  private startupTrace: GatewayStartupTrace | null = null;\n\n  /**\n   * Webchat agent invocation surface (`runAgent`, `abortAgentRun`, `steer*`,\n   * `submitClarifyResponse`, clarify-bridge dispatch). Owns the\n   * `activeWebchatRunBySession` + `runAbortControllers` maps.\n   */\n  readonly agentRunner: GatewayAgentRunner;\n\n  /** Read-only alias re-exported from `agentRunner.runRelay` for legacy callers. */\n  get runRelay(): AgentRunRelay { return this.agentRunner.runRelay; }\n\n  /**\n   * Session CRUD / search / compaction / tag-archive-pin / stats — the gateway\n   * REST surface for sessions. Routes should depend on this narrow service\n   * rather than the full GatewayService composition root.\n   */\n  readonly sessions: GatewaySessionsApi;\n\n  /**\n   * Skills + extensions marketplace surface (browse / install / uninstall) plus\n   * local-only managed-skill ops. Routes depend on this narrow service.\n   */\n  readonly marketplace: GatewayMarketplaceService;\n\n  constructor(private serviceConfig: GatewayServiceConfig = {}) {\n    this.bus = new MessageBus();\n    this.configPath = serviceConfig.configPath || resolveConfigPath();\n    this.config = loadConfig(this.configPath);\n    if (sanitizeTunnelConfig(this.config)) {\n      void writeConfigToDisk(this.config, this.configPath).catch((err) => {\n        const em = err instanceof Error ? err.message : String(err);\n        log.warn({ err, phase: 'tunnel_sanitize', errorMessage: em }, `Tunnel config sanitize persist failed: ${em}`);\n      });\n    }\n\n    // Initialize authentication\n    this.auth = resolveGatewayAuth({\n      authConfig: this.config.gateway?.auth,\n    });\n\n    // Validate auth configuration\n    assertGatewayAuthConfigured(this.auth);\n\n    // Reject known weak / placeholder credentials at startup\n    assertGatewayAuthNotKnownWeak(this.auth);\n\n    const gatewayPort = this.getEffectiveListenPort();\n    const runtimeConfig = assertGatewayRuntimeConfig({\n      cfg: this.config,\n      auth: this.auth,\n      bindOverride: serviceConfig.listenBind,\n      port: gatewayPort,\n    });\n\n    // Security audit: non-blocking warnings for remaining risk signals\n    auditGatewayConfig({\n      auth: this.auth,\n      bindHost: runtimeConfig.bindHost,\n      corsOrigins: runtimeConfig.corsOrigins,\n      rateLimitEnabled: runtimeConfig.rateLimitEnabled,\n      tlsEnabled: runtimeConfig.tlsEnabled,\n      trustedProxies: this.config.gateway?.trustedProxies,\n      allowRealIpFallback: this.config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback: runtimeConfig.dangerouslyAllowHostHeaderOriginFallback,\n      strictSecurityEnabled: isGatewayStrictSecurityEnabled(this.config),\n      rateLimitConfigured: this.config.gateway?.auth?.rateLimit !== undefined,\n    });\n\n    // Log token info (not the token itself)\n    if (this.auth.mode === 'token') {\n      const tokenPreview = this.auth.token ? `${this.auth.token.slice(0, 4)}***` : 'none';\n      log.info({ mode: this.auth.mode, token: tokenPreview }, 'Authentication configured');\n    } else if (this.auth.mode === 'trusted-proxy') {\n      log.info(\n        {\n          mode: this.auth.mode,\n          userHeader: this.auth.trustedProxy?.userHeader,\n          trustedProxyCount: this.config.gateway?.trustedProxies?.length ?? 0,\n        },\n        'Trusted-proxy authentication configured',\n      );\n    } else {\n      log.info({ mode: this.auth.mode }, 'Authentication configured');\n    }\n\n    // Initialize channel manager\n    this.channelManager = new ChannelManager(this.config, this.bus);\n\n    // Initialize extension loader (manifest snapshot only — code load in start()).\n    this.workspacePath = getWorkspacePath(this.config) || './workspace';\n    this.initializeExtensionLoader();\n\n    // Session index + files shared with AgentService (webchat `/goal` metadata must match GET /api/goals/webchat).\n    this.sessionIndex = new SessionIndex({\n      config: this.config,\n    });\n\n    this.cronService = new CronService({\n      filePath: resolveCronJobsPath(),\n    });\n\n    this.agentRunner = new GatewayAgentRunner({\n      bus: this.bus,\n      sessionIndex: this.sessionIndex,\n      getAgentService: () => this.ensureAgentService(),\n      getChannelManager: () => this.channelManager,\n      getConfig: () => this.config,\n      emit: (type, payload) => this.sse.emit(type, payload),\n    });\n\n    this.sessions = new GatewaySessionsApi({\n      sessionIndex: this.sessionIndex,\n      getAgentService: () => this.ensureAgentService(),\n      getActiveWebchatRunId: (sk) => this.agentRunner.getActiveRunId(sk),\n    });\n\n    this.marketplace = new GatewayMarketplaceService({\n      getConfig: () => this.config,\n      getAgentService: () => this.ensureAgentService(),\n      getExtensionLoader: () => this.extensionLoader,\n      getChannelManager: () => this.channelManager,\n      saveConfig: (cfg) => this.saveConfig(cfg),\n      emit: (type, payload) => this.emit(type, payload),\n    });\n\n    this.configCoordinator = new GatewayConfigCoordinator({\n      configPath: this.configPath,\n      bus: this.bus,\n      enableHotReload: this.serviceConfig.enableHotReload !== false,\n      getConfig: () => this.config,\n      setConfig: (next) => { this.config = next; },\n      getAgentService: () => this.ensureAgentService(),\n      getChannelManager: () => this.channelManager,\n      getCronService: () => this.cronService,\n      getHeartbeatService: () => this.heartbeatService,\n      getExtensionLoader: () => this.extensionLoader,\n      reconcileBrowserExtensionServer: () => this.reconcileBrowserExtensionServer(),\n      getChannelsStatus: () => this.getChannelsStatus(),\n      emit: (type, payload) => this.emit(type, payload),\n    });\n  }\n\n  /** Lazy AgentService — constructed on first use or during `start()`. */\n  get agentService(): AgentService {\n    return this.ensureAgentService();\n  }\n\n  private ensureAgentService(): AgentService {\n    if (this._agentService) {\n      return this._agentService;\n    }\n\n    const cronRef: { service?: CronService } = { service: this.cronService };\n    this._agentService = new AgentService(this.bus, {\n      workspace: this.workspacePath,\n      model: this.config.agents?.defaults?.model?.primary,\n      config: this.config,\n      sessionStore: this.sessionIndex.getStore(),\n      onSessionMetadataUpdated: (sessionKey) => {\n        this.sessionIndex.emit('sessionUpdated', { key: sessionKey });\n      },\n      onSessionTranscriptUpdated: (sessionKey) => {\n        this.emit('session.transcript_updated', { key: sessionKey });\n      },\n      extensionRegistry: this.extensionLoader?.getRegistry(),\n      getCronService: () => cronRef.service,\n      gatewayClarify: {\n        requestClarification: (sessionKey, request) =>\n          this.agentRunner.requestClarification({\n            sessionKey,\n            request,\n            publishSseFor: (_runId) => (e: RelayEvent) => {\n              this._agentService!.turnDispatcher.enqueueWebchatSseEvent(sessionKey, e);\n            },\n          }),\n      },\n    });\n\n    this._agentService.setChannelManager(this.channelManager);\n    this.channelManager.setSessionModelHooks({\n      getModelForSession: (sk) => this._agentService!.getModelForSession(sk),\n      switchModelForSession: (sk, id) => this._agentService!.switchModelForSession(sk, id),\n    });\n\n    this.cronService.setDeps({\n      agentService: this._agentService,\n      messageBus: this.bus,\n      heartbeatService: this.ensureHeartbeatService(),\n      sessionStore: this.sessionIndex.getStore(),\n      getDefaultCronAgentId: () => getDefaultAgentId(this.config),\n    });\n    cronRef.service = this.cronService;\n\n    this._agentService.persistentGoals.setWebchatContinuationScheduler((sessionKey, message) => {\n      const scheduleWhenIdle = () => {\n        if (this._agentService!.getInboundTurnDepth(sessionKey) > 0) {\n          setTimeout(scheduleWhenIdle, 50);\n          return;\n        }\n        if (this.agentRunner.hasActiveRun(sessionKey)) {\n          setTimeout(scheduleWhenIdle, 50);\n          return;\n        }\n        void this.agentRunner.drainScheduledWebchatContinuation(sessionKey, message);\n      };\n      queueMicrotask(scheduleWhenIdle);\n    });\n\n    return this._agentService;\n  }\n\n  private ensureHeartbeatService(): HeartbeatService {\n    if (this.heartbeatService) {\n      return this.heartbeatService;\n    }\n    this.heartbeatService = new HeartbeatService({\n      agentService: this.ensureAgentService(),\n      messageBus: this.bus,\n      cronService: this.cronService,\n      sessionStore: this.sessionIndex.getStore(),\n      getConfig: () => this.config,\n    });\n    return this.heartbeatService;\n  }\n\n  // ── Webchat agent runner (delegated to GatewayAgentRunner) ────────────\n\n  enqueueWebchatPersistentGoalKickoff(sessionKey: string, goalText: string): void {\n    this.agentRunner.enqueueWebchatPersistentGoalKickoff(sessionKey, goalText);\n  }\n\n  runAgent(\n    ...args: Parameters<GatewayAgentRunner['runAgent']>\n  ): ReturnType<GatewayAgentRunner['runAgent']> {\n    return this.agentRunner.runAgent(...args);\n  }\n\n  abortAgentRun(runId: string): boolean {\n    return this.agentRunner.abortAgentRun(runId);\n  }\n\n  steerWebchatAgent(\n    chatId: string,\n    message: string,\n  ): ReturnType<GatewayAgentRunner['steerWebchatAgent']> {\n    return this.agentRunner.steerWebchatAgent(chatId, message);\n  }\n\n  submitClarifyResponse(requestId: string, answer: string): boolean {\n    return this.agentRunner.submitClarifyResponse(requestId, answer);\n  }\n\n  private initializeExtensionLoader(): void {\n    try {\n      if (areExtensionsGloballyDisabled(this.config)) {\n        log.info('Extensions globally disabled — skipping loader initialization');\n        return;\n      }\n\n      const loaderOptions = {\n        workspaceDir: this.workspacePath,\n        extensionsDir: resolveExtensionsDir(),\n      };\n      this.extensionMetadataSnapshot = buildExtensionMetadataSnapshot(loaderOptions, this.config);\n      this.extensionLoader = new ExtensionLoader(loaderOptions);\n      this.extensionLoader.setManifestSnapshot(this.extensionMetadataSnapshot);\n      this.extensionLoader.setConfig(this.config as Parameters<ExtensionLoader['setConfig']>[0]);\n    } catch (error) {\n      log.warn({ error }, 'Failed to initialize extension loader');\n    }\n  }\n\n  private registerExtensionChannelPlugins(): void {\n    if (!this.extensionLoader) {\n      return;\n    }\n    const reg = this.extensionLoader.getRegistry();\n    for (const plugin of reg.channelPlugins) {\n      this.channelManager.registerPlugin(plugin);\n    }\n  }\n\n  /**\n   * Load extensions and register SDK / full ChannelPlugin instances with ChannelManager.\n   */\n  private async loadExtensionsAndRegisterChannels(): Promise<void> {\n    if (!this.extensionLoader) {\n      return;\n    }\n    try {\n      await this.extensionLoader.loadByActivationPlan({ phase: 'startup' });\n      this.registerExtensionChannelPlugins();\n      const reg = this.extensionLoader.getRegistry();\n      log.debug(\n        {\n          extensionRecords: reg.extensions.size,\n          channelPlugins: reg.channelPlugins.length,\n        },\n        'Startup-phase extensions loaded and channel plugins registered',\n      );\n    } catch (err) {\n      log.warn({ err }, 'Failed to load startup-phase extensions');\n    }\n  }\n\n  private async loadDeferredExtensions(): Promise<void> {\n    if (!this.extensionLoader) {\n      return;\n    }\n    try {\n      await this.extensionLoader.loadByActivationPlan({ phase: 'deferred' });\n      this.registerExtensionChannelPlugins();\n      log.debug('Deferred-phase extensions loaded');\n    } catch (err) {\n      log.warn({ err }, 'Failed to load deferred extensions');\n    }\n  }\n\n  private schedulePostReadySidecars(): void {\n    queueMicrotask(() => {\n      void this.runPostReadySidecars();\n    });\n  }\n\n  private async runPostReadySidecars(): Promise<void> {\n    const trace = this.startupTrace;\n    try {\n      if (trace) {\n        await trace.measure('sidecars.model-prewarm', () => prewarmModelRegistry());\n      } else {\n        await prewarmModelRegistry();\n      }\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, errorMessage: em, phase: 'sidecars.model_prewarm' }, `Model registry prewarm failed: ${em}`);\n    }\n\n    if (!this.extensionLoader || areExtensionsGloballyDisabled(this.config)) {\n      return;\n    }\n\n    try {\n      if (trace) {\n        await trace.measure('extensions.deferred-load', () => this.loadDeferredExtensions());\n      } else {\n        await this.loadDeferredExtensions();\n      }\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, errorMessage: em, phase: 'extensions.deferred_load' }, `Deferred extension load failed: ${em}`);\n    }\n  }\n\n  async start(): Promise<void> {\n    if (this.running) return;\n\n    setPairingBroadcastSink((type, payload) => {\n      this.emit(type, payload);\n    });\n\n    log.debug('Starting gateway service...');\n    this.startTime = Date.now();\n    this.running = true;\n    this.startupTrace = createGatewayStartupTrace();\n    this.readiness.markStarting(this.startTime);\n    const trace = this.startupTrace;\n\n    registerClarifyBridge(this.agentRunner.getClarifyBridge());\n\n    this.ensureAgentService();\n\n    this.channelManager.setOutboundHooks({\n      runMessageSending: (to, content, channel) =>\n        this.agentService.outboundCoordinator.invokeOutboundMessageSending(to, content, channel),\n      runMessageSent: (to, content, success, error, channel) =>\n        this.agentService.outboundCoordinator.invokeOutboundMessageSent(to, content, success, error, channel),\n    });\n    this.channelManager.enableOutboundPersistence(resolveAgentDir(this.config, getDefaultAgentId(this.config)));\n\n    if (this.extensionLoader) {\n      this.extensionLoader.setRuntimeContext({\n        bus: this.bus,\n        sessionManager: this.sessionIndex,\n        scheduleWebchatContinuation: (sessionKey: string, continuationMessage: string) => {\n          queueMicrotask(() => {\n            void this.agentRunner.drainScheduledWebchatContinuation(sessionKey, continuationMessage);\n          });\n        },\n      });\n    }\n\n    await trace.measure('extensions.load', () => this.loadExtensionsAndRegisterChannels());\n\n    const skipChannels =\n      process.env.XOPC_SKIP_CHANNELS === '1' ||\n      process.env.XOPC_SKIP_CHANNELS === 'true' ||\n      process.env.XOPC_SKIP_PROVIDERS === '1' ||\n      process.env.XOPC_SKIP_PROVIDERS === 'true';\n\n    // Start channels: init all; optional defer for meta.deferConnectUntilAfterListen (GatewayServer)\n    const phase1StartedAt = performance.now();\n    let channelInitMs = 0;\n    let deferPlanMs = 0;\n    let channelPhase1StartMs = 0;\n    let replayOutboundMs: number | null = null;\n    let deferConnect = new Set<string>();\n\n    if (skipChannels) {\n      log.info('Skipping channel startup (XOPC_SKIP_CHANNELS or XOPC_SKIP_PROVIDERS)');\n    } else {\n      const t0 = performance.now();\n      await trace.measure('channels.initialize', () => this.channelManager.initialize());\n      channelInitMs = performance.now() - t0;\n\n      const t1 = performance.now();\n      const deferResolution = resolveChannelConnectDeferSet({\n        config: this.config,\n        channelManager: this.channelManager,\n        deferChannelConnectUntilAfterHttp: this.serviceConfig.deferChannelConnectUntilAfterHttp === true,\n      });\n      deferConnect = deferResolution.deferPluginIds;\n      deferPlanMs = performance.now() - t1;\n      this.lastDeferredChannelConnectIds = [...deferConnect];\n      this.lastChannelConnectDeferMode = deferResolution.mode;\n      this.lastChannelConnectDeferSource = deferResolution.source;\n\n      if (deferConnect.size > 0) {\n        log.info({ channels: [...deferConnect] }, 'Deferring channel outbound connect until HTTP listen');\n      }\n\n      const t2 = performance.now();\n      await trace.measure('channels.start', () =>\n        this.channelManager.start(\n          deferConnect.size > 0 ? { deferConnectPluginIds: deferConnect } : undefined,\n        ),\n      );\n      channelPhase1StartMs = performance.now() - t2;\n\n      if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n        const tr = performance.now();\n        await trace.measure('channels.replay-outbound', () =>\n          this.channelManager.replayPendingOutboundMessages(),\n        );\n        replayOutboundMs = performance.now() - tr;\n      }\n    }\n\n    const channelStartupPhase1TotalMs = performance.now() - phase1StartedAt;\n    const gwDeferMode = this.config.gateway?.channelConnectDeferMode ?? 'auto';\n    const phase1Metrics: GatewayChannelStartupPhase1Metrics = {\n      deferChannelConnectUntilAfterHttp: this.serviceConfig.deferChannelConnectUntilAfterHttp === true,\n      channelConnectDeferMode: this.serviceConfig.deferChannelConnectUntilAfterHttp\n        ? this.lastChannelConnectDeferMode\n        : gwDeferMode,\n      channelConnectDeferSource: this.lastChannelConnectDeferSource,\n      deferredChannelIds: this.lastDeferredChannelConnectIds,\n      deferredChannelCount: this.lastDeferredChannelConnectIds.length,\n      channelInitMs: Math.round(channelInitMs),\n      deferPlanMs: Math.round(deferPlanMs),\n      channelPhase1StartMs: Math.round(channelPhase1StartMs),\n      replayOutboundMs: replayOutboundMs === null ? null : Math.round(replayOutboundMs),\n      channelStartupPhase1TotalMs: Math.round(channelStartupPhase1TotalMs),\n    };\n    log.info(\n      { phase: 'gateway.channel_startup', stage: 'phase1', ...phase1Metrics },\n      'Gateway channel startup phase-1 complete',\n    );\n\n    // Initialize session manager\n    await trace.measure('sessions.initialize', () => this.sessionIndex.initialize());\n    log.debug('Session manager initialized');\n\n    this.cronService.setDeps({\n      agentService: this.agentService,\n      messageBus: this.bus,\n      heartbeatService: this.ensureHeartbeatService(),\n      sessionStore: this.sessionIndex.getStore(),\n      getDefaultCronAgentId: () => getDefaultAgentId(this.config),\n    });\n\n    this.sessionIndex.on('sessionUpdated', (data: { key: string; name?: string; tags?: string[] }) => {\n      this.emit('session.updated', { key: data.key, name: data.name, tags: data.tags });\n    });\n\n    // Start cron service\n    if (this.config.cron?.enabled !== false) {\n      await trace.measure('cron.initialize', () => this.cronService.initialize());\n    }\n\n    this.ensureHeartbeatService().start(heartbeatRunnerConfigFromConfig(this.config));\n\n    void import('../browser/providers/browser-ext-install.js')\n      .then(({ ensureBrowserExtensionOnStartup }) => ensureBrowserExtensionOnStartup(this.config))\n      .catch((err) => log.warn({ err }, 'Browser extension artifact ensure failed'));\n\n    // Start browser extension WS server if configured\n    await trace.measure('browser-extension.start', () => this.startBrowserExtensionServerIfNeeded());\n\n    // Start agent service (runs in background)\n    this.agentService.start().catch((err) => {\n      log.error({ err }, 'Agent service error');\n    });\n\n    // Outbound drain: after deferred channel connects when using HTTP lifecycle (avoid racing Telegram).\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      this.startOutboundProcessor().catch((err) => {\n        log.error({ err }, 'Outbound processor error');\n      });\n    }\n\n    // Setup config hot reload\n    if (this.serviceConfig.enableHotReload !== false) {\n      this.configCoordinator.startHotReloader();\n    }\n\n    this.stopGatewayUpdateCheck = scheduleGatewayUpdateCheck({\n      config: this.config,\n      onUpdateAvailableChange: (update) => {\n        this.emit('update.available', update);\n      },\n    });\n\n    wireTunnelEventsToGateway(this);\n\n    // Drop orphan single-HTML site-share staging dirs left behind by a\n    // process death between create and cleanup. Re-registers live ones into\n    // the in-process map so post-restart revoke/expire still cleans them.\n    void import('../share/share-auto.js')\n      .then(({ runStagingSweep }) => runStagingSweep())\n      .catch((err) => log.warn({ err }, 'Share staging sweep failed'));\n\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      this.markGatewayReady();\n    } else {\n      trace.mark('service.started-awaiting-http');\n    }\n\n    log.debug('Gateway service started');\n  }\n\n  /** Called when the HTTP listener is bound (before deferred channel work). */\n  markHttpListening(): void {\n    this.readiness.markHttpListening();\n    this.startupTrace?.mark('http.listening');\n  }\n\n  isGatewayReady(): boolean {\n    return this.readiness.isReady();\n  }\n\n  getGatewayReadiness(): GatewayReadinessSnapshot {\n    return this.readiness.getSnapshot();\n  }\n\n  private async applyStartupReadyDelayForTesting(): Promise<void> {\n    const raw = process.env.XOPC_GATEWAY_STARTUP_SLOW_MS?.trim();\n    if (!raw) {\n      return;\n    }\n    const delayMs = Number.parseInt(raw, 10);\n    if (!Number.isFinite(delayMs) || delayMs <= 0) {\n      return;\n    }\n    await new Promise((resolve) => setTimeout(resolve, delayMs));\n  }\n\n  private markGatewayReady(): void {\n    this.readiness.markReady();\n    this.startupTrace?.mark('ready');\n    this.schedulePostReadySidecars();\n  }\n\n  /** After HTTP is listening: exposure auto-start (Tailscale, then FRP tunnel). */\n  private async runExposureAutoStartIfConfigured(): Promise<void> {\n    const port = this.getEffectiveListenPort();\n    await getExposureManager().autoStart(this.config, port, this.getAuthToken());\n  }\n\n  /**\n   * Called by `GatewayServer` when the HTTP listener is bound. Starts channels that\n   * opted into `meta.deferConnectUntilAfterListen`, then replays outbound queue.\n   */\n  async onHttpListening(): Promise<void> {\n    await this.runExposureAutoStartIfConfigured();\n\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      return;\n    }\n    const listenStartedAt = performance.now();\n    const trace = this.startupTrace;\n    try {\n      await this.applyStartupReadyDelayForTesting();\n\n      const tDef = performance.now();\n      if (trace) {\n        await trace.measure('channels.deferred-connect', () => this.channelManager.startDeferredConnects());\n      } else {\n        await this.channelManager.startDeferredConnects();\n      }\n      const channelPhase2DeferredMs = performance.now() - tDef;\n\n      const tr = performance.now();\n      if (trace) {\n        await trace.measure('channels.replay-outbound', () =>\n          this.channelManager.replayPendingOutboundMessages(),\n        );\n      } else {\n        await this.channelManager.replayPendingOutboundMessages();\n      }\n      const replayOutboundMs = performance.now() - tr;\n\n      this.startOutboundProcessor().catch((err) => {\n        log.error({ err }, 'Outbound processor error');\n      });\n      this.emit('channels.status', { channels: this.getChannelsStatus() });\n\n      const onHttpListeningTotalMs = performance.now() - listenStartedAt;\n      const phase2Metrics: GatewayChannelStartupPhase2Metrics = {\n        channelConnectDeferMode: this.lastChannelConnectDeferMode,\n        channelConnectDeferSource: this.lastChannelConnectDeferSource,\n        deferredChannelIds: this.lastDeferredChannelConnectIds,\n        channelPhase2DeferredMs: Math.round(channelPhase2DeferredMs),\n        replayOutboundMs: Math.round(replayOutboundMs),\n        onHttpListeningTotalMs: Math.round(onHttpListeningTotalMs),\n      };\n      log.info(\n        { phase: 'gateway.channel_startup', stage: 'phase2', ...phase2Metrics },\n        'Gateway channel startup phase-2 complete (HTTP listening)',\n      );\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.error(\n        {\n          err,\n          errorMessage: em,\n          phase: 'gateway.channel_startup',\n          stage: 'phase2',\n          deferredChannelIds: this.lastDeferredChannelConnectIds,\n          elapsedMs: Math.round(performance.now() - listenStartedAt),\n        },\n        `Deferred channel startup after HTTP listen failed: ${em}`,\n      );\n    } finally {\n      this.markGatewayReady();\n    }\n  }\n\n  async stop(): Promise<void> {\n    if (!this.running) return;\n\n    setPairingBroadcastSink(null);\n\n    log.debug('Stopping gateway service...');\n    this.readiness.markStarting();\n\n    await stopTailscaleExposure().catch((err) => {\n      log.warn({ err }, 'Tailscale exposure shutdown failed');\n    });\n\n    if (this.stopGatewayUpdateCheck) {\n      this.stopGatewayUpdateCheck();\n      this.stopGatewayUpdateCheck = null;\n    }\n\n    await this.configCoordinator.stopHotReloader();\n\n    // Stop heartbeat service\n    this.heartbeatService?.stop();\n\n    // Stop browser extension WS server (shared acquire/release with BrowserManager)\n    if (this.browserExtensionRelease) {\n      await this.browserExtensionRelease();\n      this.browserExtensionRelease = null;\n    }\n    this.browserExtensionProvider = null;\n    this.browserExtensionBindKey = null;\n\n    registerClarifyBridge(null);\n    this.agentRunner.disposeClarifyBridge();\n    await disposeAllSessionMcpRuntimes().catch((err) => {\n      log.warn({ err }, 'MCP runtime shutdown failed');\n    });\n    this._agentService?.stop();\n\n    // Unblock `consumeOutbound()` / `consumeInbound()` waiters before stopping channels (CLI agent does the same).\n    this.running = false;\n    this.bus.shutdown();\n\n    this.lastDeferredChannelConnectIds = [];\n    this.lastChannelConnectDeferMode = 'auto';\n    this.lastChannelConnectDeferSource = 'off';\n\n    await this.channelManager.stop();\n\n    // Stop cron service\n    await this.cronService.stop();\n\n    // Tear down rate-limit cleanup timers so the process can exit cleanly.\n    buckets.destroyAll();\n\n    log.debug('Gateway service stopped');\n  }\n\n  /** Start the browser extension WS server when backend is 'extension'. */\n  private async startBrowserExtensionServerIfNeeded(): Promise<void> {\n    await this.reconcileBrowserExtensionServer();\n  }\n\n  /** Release the gateway's hold on the shared extension bridge (does not restart). */\n  async releaseBrowserExtensionBridge(): Promise<void> {\n    if (!this.browserExtensionRelease) return;\n    await this.browserExtensionRelease();\n    this.browserExtensionRelease = null;\n    this.browserExtensionProvider = null;\n    this.browserExtensionBindKey = null;\n    log.debug('Browser extension WS server released');\n  }\n\n  /**\n   * Start/stop/rebind the Chrome extension bridge when `agents.defaults.browser` changes.\n   * PATCH saves update config in memory without re-running gateway startup, so this must run on save too.\n   */\n  async reconcileBrowserExtensionServer(): Promise<void> {\n    const { shouldRunExtensionBridgeServer } = await import('../browser/backend-from-config.js');\n    const wantsExtension = shouldRunExtensionBridgeServer(this.config);\n\n    if (!wantsExtension) {\n      if (this.browserExtensionRelease) {\n        await this.browserExtensionRelease();\n        this.browserExtensionRelease = null;\n        this.browserExtensionProvider = null;\n        this.browserExtensionBindKey = null;\n        log.debug('Browser extension WS server stopped (backend is not extension)');\n      }\n      return;\n    }\n\n    const browser = (this.config.agents?.defaults as Record<string, unknown> | undefined)?.browser as\n      | Record<string, unknown>\n      | undefined;\n    const ext = browser?.extension as Record<string, unknown> | undefined;\n    const port = typeof ext?.port === 'number' ? ext.port : 19820;\n    const host = typeof ext?.host === 'string' && ext.host ? ext.host : '127.0.0.1';\n    const connectionTimeout =\n      typeof ext?.connectionTimeout === 'number' && ext.connectionTimeout >= 1000\n        ? Math.floor(ext.connectionTimeout)\n        : undefined;\n    const cmdSec = browser?.commandTimeout;\n    const commandTimeout =\n      typeof cmdSec === 'number' && Number.isFinite(cmdSec) && cmdSec > 0\n        ? Math.floor(cmdSec * 1000)\n        : undefined;\n    const bindKey = `${host}:${port}`;\n\n    if (this.browserExtensionRelease && this.browserExtensionBindKey === bindKey) {\n      return;\n    }\n\n    if (this.browserExtensionRelease) {\n      await this.browserExtensionRelease();\n      this.browserExtensionRelease = null;\n      this.browserExtensionProvider = null;\n      this.browserExtensionBindKey = null;\n    }\n\n    try {\n      const { acquireExtensionBrowserServer } = await import('../browser/providers/extension-ws-acquire.js');\n      const { provider, release } = await acquireExtensionBrowserServer({\n        port,\n        host,\n        connectionTimeout,\n        commandTimeout,\n      });\n      this.browserExtensionProvider = provider;\n      this.browserExtensionRelease = release;\n      this.browserExtensionBindKey = bindKey;\n      log.info({ port, host }, 'Browser extension WS server started');\n    } catch (err) {\n      const code = err && typeof err === 'object' && 'code' in err ? (err as { code: unknown }).code : undefined;\n      log.error(\n        {\n          err,\n          phase: 'browser_extension_ws',\n          ...(code === 'EADDRINUSE'\n            ? {\n                bindPort: port,\n                bindHost: host,\n                hint: 'Another process holds this port (default 19820). Stop it or set agents.defaults.browser.extension.port.',\n              }\n            : {}),\n        },\n        `Failed to start browser extension WS server: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  /**\n   * Start processing outbound messages and send through channels\n   */\n  private async startOutboundProcessor(): Promise<void> {\n    log.debug('Starting outbound message processor');\n    while (this.running) {\n      try {\n        const msg = await this.bus.consumeOutbound();\n        await this.channelManager.send(msg);\n      } catch (error) {\n        if (error instanceof MessageBusShutdownError) {\n          break;\n        }\n        const em = error instanceof Error ? error.message : String(error);\n        log.error(\n          { err: error, errorMessage: em, phase: 'outbound_consume' },\n          `Outbound pipeline failed (will retry in 1s): ${em}`,\n        );\n        await new Promise((resolve) => setTimeout(resolve, 1000));\n      }\n    }\n  }\n\n  // ── Config persistence / hot reload (delegated to GatewayConfigCoordinator) ──\n\n  reloadHeartbeatFromCurrentConfig(): void {\n    this.configCoordinator.reloadHeartbeatFromCurrentConfig();\n  }\n\n  reloadConfig(): Promise<{ reloaded: boolean; error?: string }> {\n    return this.configCoordinator.reloadConfig();\n  }\n\n  afterWeixinCredentialsPersisted(): Promise<void> {\n    return this.configCoordinator.afterWeixinCredentialsPersisted();\n  }\n\n  afterFeishuCredentialsPersisted(): Promise<void> {\n    return this.configCoordinator.afterFeishuCredentialsPersisted();\n  }\n\n  saveConfig(config: Config): Promise<{ saved: boolean; error?: string }> {\n    return this.configCoordinator.saveConfig(config);\n  }\n\n  setBundledExtensionActivationTarget(\n    extensionId: string,\n    wanted: boolean,\n  ): Promise<{ ok: boolean; error?: string; requiresGatewayRestart: boolean }> {\n    return this.configCoordinator.setBundledExtensionActivationTarget(extensionId, wanted);\n  }\n\n  updateConfig(updates: Partial<Config>): Promise<{ updated: boolean; error?: string }> {\n    return this.configCoordinator.updateConfig(updates);\n  }\n\n  /**\n   * Send message through a channel\n   */\n  async sendMessage(\n    channel: string,\n    chatId: string,\n    content: string\n  ): Promise<{ sent: boolean; messageId?: string }> {\n    try {\n      await this.channelManager.send({\n        channel,\n        chat_id: chatId,\n        content,\n      });\n      const messageId = `msg_${Date.now()}`;\n      this.emit('message.sent', { channel, chatId, messageId });\n      return { sent: true, messageId };\n    } catch (error) {\n      log.error({ channel, chatId, error }, 'Failed to send message');\n      throw error;\n    }\n  }\n\n  /**\n   * Get channel statuses\n   */\n  getChannelsStatus(): Array<{\n    name: string;\n    enabled: boolean;\n    connected: boolean;\n  }> {\n    const runningChannels = new Set(this.channelManager.getRunningChannels());\n    const channels = this.config.channels as Record<string, { enabled?: boolean } | undefined> | undefined;\n    const builtinOrder = CHAT_CHANNEL_ORDER as readonly string[];\n\n    const rows: Array<{ name: string; enabled: boolean; connected: boolean }> = CHAT_CHANNEL_ORDER.map(\n      (name) => ({\n        name,\n        enabled: !!channels?.[name]?.enabled,\n        connected: runningChannels.has(name),\n      }),\n    );\n\n    const extReg = this.extensionLoader?.getRegistry();\n    const extraIds = extReg?.channelPlugins.map((p) => p.id).filter((id) => !builtinOrder.includes(id)) ?? [];\n    if (extraIds.length === 0) {\n      return rows;\n    }\n\n    const seen = new Set(builtinOrder);\n    for (const name of extraIds) {\n      if (seen.has(name)) continue;\n      seen.add(name);\n      rows.push({\n        name,\n        enabled: channels?.[name]?.enabled !== false,\n        connected: runningChannels.has(name),\n      });\n    }\n\n    return rows;\n  }\n\n  /**\n   * Hub metadata for gateway console (built-in registry + registered channel plugins).\n   */\n  getChannelsHubMeta(): Array<{\n    id: string;\n    label: string;\n    description: string;\n    manageable: boolean;\n    order: number;\n  }> {\n    const manageableIds = new Set<string>(['telegram', 'weixin', 'feishu']);\n    const byId = new Map<\n      string,\n      { id: string; label: string; description: string; manageable: boolean; order: number }\n    >();\n\n    for (const plugin of this.channelManager.getAllPlugins()) {\n      byId.set(plugin.id, {\n        id: plugin.id,\n        label: plugin.meta.label,\n        description: plugin.meta.blurb,\n        manageable: manageableIds.has(plugin.id),\n        order: plugin.meta.order ?? 999,\n      });\n    }\n\n    CHAT_CHANNEL_ORDER.forEach((id, index) => {\n      if (byId.has(id)) return;\n      const meta = getChatChannelMeta(id);\n      byId.set(id, {\n        id,\n        label: meta.label,\n        description: meta.description,\n        manageable: true,\n        order: index,\n      });\n    });\n\n    return Array.from(byId.values()).toSorted((a, b) => {\n      if (a.order !== b.order) return a.order - b.order;\n      return a.id.localeCompare(b.id);\n    });\n  }\n\n  /**\n   * Request an immediate heartbeat run (coalesced like interval/cron wakes).\n   */\n  requestHeartbeatNow(opts?: { reason?: string }): void {\n    this.heartbeatService?.requestNow({ reason: opts?.reason ?? 'manual' });\n  }\n\n  /**\n   * Register graceful shutdown used after spawning a replacement gateway process (foreground CLI server).\n   */\n  registerGatewayShutdownForRestart(handler: () => Promise<void>): void {\n    this.gatewayShutdownForRestart = handler;\n  }\n\n  /**\n   * Respawn the gateway process when supported (spawn + exit, supervisor exit, or disabled when XOPC_NO_RESPAWN).\n   */\n  triggerGatewayProcessRestart(): { ok: boolean; mode: string; message?: string } {\n    const result = restartGatewayProcessWithFreshPid();\n    if (result.mode === 'failed') {\n      return { ok: false, mode: result.mode, message: result.detail ?? 'spawn failed' };\n    }\n    if (result.mode === 'disabled') {\n      return {\n        ok: false,\n        mode: 'disabled',\n        message:\n          'Process respawn is disabled (XOPC_NO_RESPAWN). Restart the gateway manually (e.g. xopc gateway restart).',\n      };\n    }\n    const shutdown = this.gatewayShutdownForRestart;\n    if (!shutdown) {\n      return {\n        ok: false,\n        mode: result.mode,\n        message: 'Gateway restart is not available in this process.',\n      };\n    }\n    setImmediate(() => {\n      void shutdown().finally(() => {\n        process.exit(0);\n      });\n    });\n    return { ok: true, mode: result.mode };\n  }\n\n  /**\n   * Get health status\n   */\n  getHealth(): {\n    status: string;\n    service: string;\n    version: string;\n    uptime: number;\n    ready: boolean;\n    httpListening: boolean;\n    startupDurationMs: number | null;\n    channels: { running: number; total: number };\n    configPath: string;\n    logs?: {\n      dir: string;\n      errors24h: number;\n      stats: Record<string, number>;\n    };\n  } {\n    const runningChannels = this.channelManager.getRunningChannels();\n    const allChannels = this.channelManager.getAllChannels();\n    const logStats = getLogStats();\n    const readiness = this.readiness.getSnapshot();\n\n    return {\n      status: 'ok',\n      service: 'xopc-gateway',\n      version: PACKAGE_VERSION,\n      uptime: Math.floor((Date.now() - this.startTime) / 1000),\n      ready: readiness.ready,\n      httpListening: readiness.httpListening,\n      startupDurationMs: readiness.startupDurationMs,\n      channels: {\n        running: runningChannels.length,\n        total: allChannels.length,\n      },\n      configPath: this.configPath,\n      logs: {\n        dir: getLogDir(),\n        errors24h: logStats.errorsLast24h,\n        stats: logStats.byLevel,\n      },\n    };\n  }\n\n  get isRunning(): boolean {\n    return this.running;\n  }\n\n  /**\n   * Get extension registry for external access (HTTP routes, gateway methods)\n   */\n  getExtensionRegistry() {\n    return this.extensionLoader?.getRegistry();\n  }\n\n  /** Extension loader for discovery and frontend asset APIs (may be null if extensions failed to init). */\n  getExtensionLoader(): ExtensionLoader | null {\n    return this.extensionLoader;\n  }\n\n  /**\n   * Get model registry for external access (HTTP routes)\n   */\n  getModelRegistry() {\n    const { getModelRegistry } = require('../providers/index.js');\n    return getModelRegistry();\n  }\n\n  /**\n   * Invoke a gateway method registered by extensions\n   */\n  async invokeGatewayMethod(method: string, params: Record<string, unknown>): Promise<unknown> {\n    const registry = this.getExtensionRegistry();\n    if (!registry) {\n      throw new Error('Extension registry not available');\n    }\n\n    const handler = registry.getGatewayMethod(method);\n    if (!handler) {\n      throw new Error(`Gateway method not found: ${method}`);\n    }\n\n    return await handler(params);\n  }\n\n  get currentConfig(): Config {\n    return this.config;\n  }\n\n  get currentWorkspacePath(): string {\n    return this.workspacePath;\n  }\n\n  get messageBusInstance(): MessageBus {\n    return this.bus;\n  }\n\n  /** Effective HTTP listen port (CLI `--port` override or config default). */\n  getEffectiveListenPort(): number {\n    return resolveEffectiveGatewayPort(this.config, this.serviceConfig.listenPort);\n  }\n\n\n  get cronServiceInstance(): CronService {\n    return this.cronService;\n  }\n\n  get sessionIndexInstance(): SessionIndex {\n    return this.sessionIndex;\n  }\n\n  /** Process a message directly through the agent (for CLI mode). */\n  async processDirect(content: string, sessionKey = 'agent:main:main'): Promise<string> {\n    return this.agentService.turnDispatcher.processDirect(content, sessionKey);\n  }\n\n  // ========== SSE Event System ==========\n\n  subscribe(\n    sessionId: string,\n    listener: (event: ServiceEvent) => Promise<void> | void,\n  ): () => void {\n    return this.sse.subscribe(sessionId, listener);\n  }\n\n  emit(type: string, payload: unknown): void {\n    this.sse.emit(type, payload);\n  }\n\n  /** Replay events since `lastEventId` for SSE reconnection. */\n  getEventsSince(sessionId: string, lastEventId: string): ServiceEvent[] {\n    return this.sse.getEventsSince(sessionId, lastEventId);\n  }\n\n  /**\n   * Validate authentication token from request headers.\n   * Returns true if auth is disabled (mode: 'none') or token is valid.\n   */\n  validateAuth(headers?: Record<string, string | string[] | undefined>): boolean {\n    const token = extractToken(headers);\n    return validateToken(this.auth, token);\n  }\n\n  /**\n   * Get current auth mode.\n   */\n  getAuthMode(): 'none' | 'token' | 'password' | 'trusted-proxy' {\n    return this.auth.mode;\n  }\n\n  /** Resolved gateway auth (mode, credentials, trusted-proxy config). */\n  getResolvedAuth(): ResolvedGatewayAuth {\n    return this.auth;\n  }\n\n  /**\n   * Get current auth token (for CLI server integration).\n   * Returns undefined if mode is not token.\n   */\n  getAuthToken(): string | undefined {\n    return this.auth.mode === 'token' ? this.auth.token : undefined;\n  }\n\n  /**\n   * Refresh (regenerate) the gateway auth token.\n   * Returns the new token.\n   */\n  async refreshAuthToken(): Promise<string> {\n    if (this.auth.mode !== 'token') {\n      throw new Error('Cannot refresh token: auth mode is not token');\n    }\n\n    // Generate new token\n    const newToken = crypto.randomBytes(24).toString('hex');\n    \n    // Update in-memory auth\n    this.auth.token = newToken;\n    \n    // Update config\n    this.config = {\n      ...this.config,\n      gateway: {\n        ...this.config.gateway,\n        auth: {\n          ...this.config.gateway?.auth,\n          mode: 'token',\n          token: newToken,\n        },\n      },\n    };\n    \n    await this.saveConfig(this.config);\n\n    log.info({ tokenPreview: `${newToken.slice(0, 8)}...` }, 'Gateway token refreshed');\n    \n    return newToken;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAyB6D;aACa;YAM9C;sBAG4B;oBAGQ;AA4BhE,MAAM,MAAM,aAAa,iBAAiB;AAE1C,IAAa,iBAAb,MAA4B;CAC1B;CACA;CACA;CACA,gBAA6C;CAC7C;CACA;CACA,kBAAkD;CAClD,4BAA6H;CAC7H,2BAAgH;CAChH,0BAAgE;;CAEhE,0BAAiD;CACjD,mBAAoD;CACpD;CACA,UAAkB;CAClB,YAAoB,KAAK,KAAK;CAC9B;CACA;CAGA;CAEA,MAAuB,IAAI,eAAe;CAE1C,yBAAsD;;CAGtD,4BAAkE;;CAGlE,gCAAkD,EAAE;CACpD,8BAAmE;CACnE,gCAAqE;CAErE,YAA6B,IAAI,kBAAkB;CACnD,eAAmD;;;;;;CAOnD;;CAGA,IAAI,WAA0B;AAAE,SAAO,KAAK,YAAY;;;;;;;CAOxD;;;;;CAMA;CAEA,YAAY,gBAA8C,EAAE,EAAE;AAA1C,OAAA,gBAAA;AAClB,OAAK,MAAM,IAAI,YAAY;AAC3B,OAAK,aAAa,cAAc,cAAc,mBAAmB;AACjE,OAAK,SAAS,WAAW,KAAK,WAAW;AACzC,MAAI,qBAAqB,KAAK,OAAO,CAC9BA,YAAkB,KAAK,QAAQ,KAAK,WAAW,CAAC,OAAO,QAAQ;GAClE,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,OAAO;IAAmB,cAAc;IAAI,EAAE,0CAA0C,KAAK;IAC7G;AAIJ,OAAK,OAAO,mBAAmB,EAC7B,YAAY,KAAK,OAAO,SAAS,MAClC,CAAC;AAGF,8BAA4B,KAAK,KAAK;AAGtC,gCAA8B,KAAK,KAAK;EAExC,MAAM,cAAc,KAAK,wBAAwB;EACjD,MAAM,gBAAgB,2BAA2B;GAC/C,KAAK,KAAK;GACV,MAAM,KAAK;GACX,cAAc,cAAc;GAC5B,MAAM;GACP,CAAC;AAGF,qBAAmB;GACjB,MAAM,KAAK;GACX,UAAU,cAAc;GACxB,aAAa,cAAc;GAC3B,kBAAkB,cAAc;GAChC,YAAY,cAAc;GAC1B,gBAAgB,KAAK,OAAO,SAAS;GACrC,qBAAqB,KAAK,OAAO,SAAS,wBAAwB;GAClE,0CAA0C,cAAc;GACxD,uBAAuB,+BAA+B,KAAK,OAAO;GAClE,qBAAqB,KAAK,OAAO,SAAS,MAAM,cAAc,KAAA;GAC/D,CAAC;AAGF,MAAI,KAAK,KAAK,SAAS,SAAS;GAC9B,MAAM,eAAe,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO;AAC7E,OAAI,KAAK;IAAE,MAAM,KAAK,KAAK;IAAM,OAAO;IAAc,EAAE,4BAA4B;aAC3E,KAAK,KAAK,SAAS,gBAC5B,KAAI,KACF;GACE,MAAM,KAAK,KAAK;GAChB,YAAY,KAAK,KAAK,cAAc;GACpC,mBAAmB,KAAK,OAAO,SAAS,gBAAgB,UAAU;GACnE,EACD,0CACD;MAED,KAAI,KAAK,EAAE,MAAM,KAAK,KAAK,MAAM,EAAE,4BAA4B;AAIjE,OAAK,iBAAiB,IAAI,eAAe,KAAK,QAAQ,KAAK,IAAI;AAG/D,OAAK,gBAAgB,iBAAiB,KAAK,OAAO,IAAI;AACtD,OAAK,2BAA2B;AAGhC,OAAK,eAAe,IAAI,aAAa,EACnC,QAAQ,KAAK,QACd,CAAC;AAEF,OAAK,cAAc,IAAI,YAAY,EACjC,UAAU,qBAAqB,EAChC,CAAC;AAEF,OAAK,cAAc,IAAI,mBAAmB;GACxC,KAAK,KAAK;GACV,cAAc,KAAK;GACnB,uBAAuB,KAAK,oBAAoB;GAChD,yBAAyB,KAAK;GAC9B,iBAAiB,KAAK;GACtB,OAAO,MAAM,YAAY,KAAK,IAAI,KAAK,MAAM,QAAQ;GACtD,CAAC;AAEF,OAAK,WAAW,IAAI,mBAAmB;GACrC,cAAc,KAAK;GACnB,uBAAuB,KAAK,oBAAoB;GAChD,wBAAwB,OAAO,KAAK,YAAY,eAAe,GAAG;GACnE,CAAC;AAEF,OAAK,cAAc,IAAI,0BAA0B;GAC/C,iBAAiB,KAAK;GACtB,uBAAuB,KAAK,oBAAoB;GAChD,0BAA0B,KAAK;GAC/B,yBAAyB,KAAK;GAC9B,aAAa,QAAQ,KAAK,WAAW,IAAI;GACzC,OAAO,MAAM,YAAY,KAAK,KAAK,MAAM,QAAQ;GAClD,CAAC;AAEF,OAAK,oBAAoB,IAAI,yBAAyB;GACpD,YAAY,KAAK;GACjB,KAAK,KAAK;GACV,iBAAiB,KAAK,cAAc,oBAAoB;GACxD,iBAAiB,KAAK;GACtB,YAAY,SAAS;AAAE,SAAK,SAAS;;GACrC,uBAAuB,KAAK,oBAAoB;GAChD,yBAAyB,KAAK;GAC9B,sBAAsB,KAAK;GAC3B,2BAA2B,KAAK;GAChC,0BAA0B,KAAK;GAC/B,uCAAuC,KAAK,iCAAiC;GAC7E,yBAAyB,KAAK,mBAAmB;GACjD,OAAO,MAAM,YAAY,KAAK,KAAK,MAAM,QAAQ;GAClD,CAAC;;;CAIJ,IAAI,eAA6B;AAC/B,SAAO,KAAK,oBAAoB;;CAGlC,qBAA2C;AACzC,MAAI,KAAK,cACP,QAAO,KAAK;EAGd,MAAM,UAAqC,EAAE,SAAS,KAAK,aAAa;AACxE,OAAK,gBAAgB,IAAI,aAAa,KAAK,KAAK;GAC9C,WAAW,KAAK;GAChB,OAAO,KAAK,OAAO,QAAQ,UAAU,OAAO;GAC5C,QAAQ,KAAK;GACb,cAAc,KAAK,aAAa,UAAU;GAC1C,2BAA2B,eAAe;AACxC,SAAK,aAAa,KAAK,kBAAkB,EAAE,KAAK,YAAY,CAAC;;GAE/D,6BAA6B,eAAe;AAC1C,SAAK,KAAK,8BAA8B,EAAE,KAAK,YAAY,CAAC;;GAE9D,mBAAmB,KAAK,iBAAiB,aAAa;GACtD,sBAAsB,QAAQ;GAC9B,gBAAgB,EACd,uBAAuB,YAAY,YACjC,KAAK,YAAY,qBAAqB;IACpC;IACA;IACA,gBAAgB,YAAY,MAAkB;AAC5C,UAAK,cAAe,eAAe,uBAAuB,YAAY,EAAE;;IAE3E,CAAC,EACL;GACF,CAAC;AAEF,OAAK,cAAc,kBAAkB,KAAK,eAAe;AACzD,OAAK,eAAe,qBAAqB;GACvC,qBAAqB,OAAO,KAAK,cAAe,mBAAmB,GAAG;GACtE,wBAAwB,IAAI,OAAO,KAAK,cAAe,sBAAsB,IAAI,GAAG;GACrF,CAAC;AAEF,OAAK,YAAY,QAAQ;GACvB,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,kBAAkB,KAAK,wBAAwB;GAC/C,cAAc,KAAK,aAAa,UAAU;GAC1C,6BAA6B,kBAAkB,KAAK,OAAO;GAC5D,CAAC;AACF,UAAQ,UAAU,KAAK;AAEvB,OAAK,cAAc,gBAAgB,iCAAiC,YAAY,YAAY;GAC1F,MAAM,yBAAyB;AAC7B,QAAI,KAAK,cAAe,oBAAoB,WAAW,GAAG,GAAG;AAC3D,gBAAW,kBAAkB,GAAG;AAChC;;AAEF,QAAI,KAAK,YAAY,aAAa,WAAW,EAAE;AAC7C,gBAAW,kBAAkB,GAAG;AAChC;;AAEG,SAAK,YAAY,kCAAkC,YAAY,QAAQ;;AAE9E,kBAAe,iBAAiB;IAChC;AAEF,SAAO,KAAK;;CAGd,yBAAmD;AACjD,MAAI,KAAK,iBACP,QAAO,KAAK;AAEd,OAAK,mBAAmB,IAAI,iBAAiB;GAC3C,cAAc,KAAK,oBAAoB;GACvC,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,cAAc,KAAK,aAAa,UAAU;GAC1C,iBAAiB,KAAK;GACvB,CAAC;AACF,SAAO,KAAK;;CAKd,oCAAoC,YAAoB,UAAwB;AAC9E,OAAK,YAAY,oCAAoC,YAAY,SAAS;;CAG5E,SACE,GAAG,MACyC;AAC5C,SAAO,KAAK,YAAY,SAAS,GAAG,KAAK;;CAG3C,cAAc,OAAwB;AACpC,SAAO,KAAK,YAAY,cAAc,MAAM;;CAG9C,kBACE,QACA,SACqD;AACrD,SAAO,KAAK,YAAY,kBAAkB,QAAQ,QAAQ;;CAG5D,sBAAsB,WAAmB,QAAyB;AAChE,SAAO,KAAK,YAAY,sBAAsB,WAAW,OAAO;;CAGlE,4BAA0C;AACxC,MAAI;AACF,OAAI,8BAA8B,KAAK,OAAO,EAAE;AAC9C,QAAI,KAAK,gEAAgE;AACzE;;GAGF,MAAM,gBAAgB;IACpB,cAAc,KAAK;IACnB,eAAe,sBAAsB;IACtC;AACD,QAAK,4BAA4B,+BAA+B,eAAe,KAAK,OAAO;AAC3F,QAAK,kBAAkB,IAAI,gBAAgB,cAAc;AACzD,QAAK,gBAAgB,oBAAoB,KAAK,0BAA0B;AACxE,QAAK,gBAAgB,UAAU,KAAK,OAAsD;WACnF,OAAO;AACd,OAAI,KAAK,EAAE,OAAO,EAAE,wCAAwC;;;CAIhE,kCAAgD;AAC9C,MAAI,CAAC,KAAK,gBACR;EAEF,MAAM,MAAM,KAAK,gBAAgB,aAAa;AAC9C,OAAK,MAAM,UAAU,IAAI,eACvB,MAAK,eAAe,eAAe,OAAO;;;;;CAO9C,MAAc,oCAAmD;AAC/D,MAAI,CAAC,KAAK,gBACR;AAEF,MAAI;AACF,SAAM,KAAK,gBAAgB,qBAAqB,EAAE,OAAO,WAAW,CAAC;AACrE,QAAK,iCAAiC;GACtC,MAAM,MAAM,KAAK,gBAAgB,aAAa;AAC9C,OAAI,MACF;IACE,kBAAkB,IAAI,WAAW;IACjC,gBAAgB,IAAI,eAAe;IACpC,EACD,iEACD;WACM,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,0CAA0C;;;CAIhE,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,gBACR;AAEF,MAAI;AACF,SAAM,KAAK,gBAAgB,qBAAqB,EAAE,OAAO,YAAY,CAAC;AACtE,QAAK,iCAAiC;AACtC,OAAI,MAAM,mCAAmC;WACtC,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,qCAAqC;;;CAI3D,4BAA0C;AACxC,uBAAqB;AACd,QAAK,sBAAsB;IAChC;;CAGJ,MAAc,uBAAsC;EAClD,MAAM,QAAQ,KAAK;AACnB,MAAI;AACF,OAAI,MACF,OAAM,MAAM,QAAQ,gCAAgC,sBAAsB,CAAC;OAE3E,OAAM,sBAAsB;WAEvB,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,cAAc;IAAI,OAAO;IAA0B,EAAE,kCAAkC,KAAK;;AAG9G,MAAI,CAAC,KAAK,mBAAmB,8BAA8B,KAAK,OAAO,CACrE;AAGF,MAAI;AACF,OAAI,MACF,OAAM,MAAM,QAAQ,kCAAkC,KAAK,wBAAwB,CAAC;OAEpF,OAAM,KAAK,wBAAwB;WAE9B,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,cAAc;IAAI,OAAO;IAA4B,EAAE,mCAAmC,KAAK;;;CAInH,MAAM,QAAuB;AAC3B,MAAI,KAAK,QAAS;AAElB,2BAAyB,MAAM,YAAY;AACzC,QAAK,KAAK,MAAM,QAAQ;IACxB;AAEF,MAAI,MAAM,8BAA8B;AACxC,OAAK,YAAY,KAAK,KAAK;AAC3B,OAAK,UAAU;AACf,OAAK,eAAe,2BAA2B;AAC/C,OAAK,UAAU,aAAa,KAAK,UAAU;EAC3C,MAAM,QAAQ,KAAK;AAEnB,wBAAsB,KAAK,YAAY,kBAAkB,CAAC;AAE1D,OAAK,oBAAoB;AAEzB,OAAK,eAAe,iBAAiB;GACnC,oBAAoB,IAAI,SAAS,YAC/B,KAAK,aAAa,oBAAoB,6BAA6B,IAAI,SAAS,QAAQ;GAC1F,iBAAiB,IAAI,SAAS,SAAS,OAAO,YAC5C,KAAK,aAAa,oBAAoB,0BAA0B,IAAI,SAAS,SAAS,OAAO,QAAQ;GACxG,CAAC;AACF,OAAK,eAAe,0BAA0B,gBAAgB,KAAK,QAAQ,kBAAkB,KAAK,OAAO,CAAC,CAAC;AAE3G,MAAI,KAAK,gBACP,MAAK,gBAAgB,kBAAkB;GACrC,KAAK,KAAK;GACV,gBAAgB,KAAK;GACrB,8BAA8B,YAAoB,wBAAgC;AAChF,yBAAqB;AACd,UAAK,YAAY,kCAAkC,YAAY,oBAAoB;MACxF;;GAEL,CAAC;AAGJ,QAAM,MAAM,QAAQ,yBAAyB,KAAK,mCAAmC,CAAC;EAEtF,MAAM,eACJ,QAAQ,IAAI,uBAAuB,OACnC,QAAQ,IAAI,uBAAuB,UACnC,QAAQ,IAAI,wBAAwB,OACpC,QAAQ,IAAI,wBAAwB;EAGtC,MAAM,kBAAkB,YAAY,KAAK;EACzC,IAAI,gBAAgB;EACpB,IAAI,cAAc;EAClB,IAAI,uBAAuB;EAC3B,IAAI,mBAAkC;EACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,MAAI,aACF,KAAI,KAAK,uEAAuE;OAC3E;GACL,MAAM,KAAK,YAAY,KAAK;AAC5B,SAAM,MAAM,QAAQ,6BAA6B,KAAK,eAAe,YAAY,CAAC;AAClF,mBAAgB,YAAY,KAAK,GAAG;GAEpC,MAAM,KAAK,YAAY,KAAK;GAC5B,MAAM,kBAAkB,8BAA8B;IACpD,QAAQ,KAAK;IACb,gBAAgB,KAAK;IACrB,mCAAmC,KAAK,cAAc,sCAAsC;IAC7F,CAAC;AACF,kBAAe,gBAAgB;AAC/B,iBAAc,YAAY,KAAK,GAAG;AAClC,QAAK,gCAAgC,CAAC,GAAG,aAAa;AACtD,QAAK,8BAA8B,gBAAgB;AACnD,QAAK,gCAAgC,gBAAgB;AAErD,OAAI,aAAa,OAAO,EACtB,KAAI,KAAK,EAAE,UAAU,CAAC,GAAG,aAAa,EAAE,EAAE,uDAAuD;GAGnG,MAAM,KAAK,YAAY,KAAK;AAC5B,SAAM,MAAM,QAAQ,wBAClB,KAAK,eAAe,MAClB,aAAa,OAAO,IAAI,EAAE,uBAAuB,cAAc,GAAG,KAAA,EACnE,CACF;AACD,0BAAuB,YAAY,KAAK,GAAG;AAE3C,OAAI,KAAK,cAAc,sCAAsC,MAAM;IACjE,MAAM,KAAK,YAAY,KAAK;AAC5B,UAAM,MAAM,QAAQ,kCAClB,KAAK,eAAe,+BAA+B,CACpD;AACD,uBAAmB,YAAY,KAAK,GAAG;;;EAI3C,MAAM,8BAA8B,YAAY,KAAK,GAAG;EACxD,MAAM,cAAc,KAAK,OAAO,SAAS,2BAA2B;EACpE,MAAM,gBAAoD;GACxD,mCAAmC,KAAK,cAAc,sCAAsC;GAC5F,yBAAyB,KAAK,cAAc,oCACxC,KAAK,8BACL;GACJ,2BAA2B,KAAK;GAChC,oBAAoB,KAAK;GACzB,sBAAsB,KAAK,8BAA8B;GACzD,eAAe,KAAK,MAAM,cAAc;GACxC,aAAa,KAAK,MAAM,YAAY;GACpC,sBAAsB,KAAK,MAAM,qBAAqB;GACtD,kBAAkB,qBAAqB,OAAO,OAAO,KAAK,MAAM,iBAAiB;GACjF,6BAA6B,KAAK,MAAM,4BAA4B;GACrE;AACD,MAAI,KACF;GAAE,OAAO;GAA2B,OAAO;GAAU,GAAG;GAAe,EACvE,2CACD;AAGD,QAAM,MAAM,QAAQ,6BAA6B,KAAK,aAAa,YAAY,CAAC;AAChF,MAAI,MAAM,8BAA8B;AAExC,OAAK,YAAY,QAAQ;GACvB,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,kBAAkB,KAAK,wBAAwB;GAC/C,cAAc,KAAK,aAAa,UAAU;GAC1C,6BAA6B,kBAAkB,KAAK,OAAO;GAC5D,CAAC;AAEF,OAAK,aAAa,GAAG,mBAAmB,SAA0D;AAChG,QAAK,KAAK,mBAAmB;IAAE,KAAK,KAAK;IAAK,MAAM,KAAK;IAAM,MAAM,KAAK;IAAM,CAAC;IACjF;AAGF,MAAI,KAAK,OAAO,MAAM,YAAY,MAChC,OAAM,MAAM,QAAQ,yBAAyB,KAAK,YAAY,YAAY,CAAC;AAG7E,OAAK,wBAAwB,CAAC,MAAM,gCAAgC,KAAK,OAAO,CAAC;AAE5E,SAAO,+CACT,MAAM,EAAE,sCAAsC,gCAAgC,KAAK,OAAO,CAAC,CAC3F,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,EAAE,2CAA2C,CAAC;AAGhF,QAAM,MAAM,QAAQ,iCAAiC,KAAK,qCAAqC,CAAC;AAGhG,OAAK,aAAa,OAAO,CAAC,OAAO,QAAQ;AACvC,OAAI,MAAM,EAAE,KAAK,EAAE,sBAAsB;IACzC;AAGF,MAAI,KAAK,cAAc,sCAAsC,KAC3D,MAAK,wBAAwB,CAAC,OAAO,QAAQ;AAC3C,OAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;IAC9C;AAIJ,MAAI,KAAK,cAAc,oBAAoB,MACzC,MAAK,kBAAkB,kBAAkB;AAG3C,OAAK,yBAAyB,2BAA2B;GACvD,QAAQ,KAAK;GACb,0BAA0B,WAAW;AACnC,SAAK,KAAK,oBAAoB,OAAO;;GAExC,CAAC;AAEF,4BAA0B,KAAK;AAK1B,SAAO,0BACT,MAAM,EAAE,sBAAsB,iBAAiB,CAAC,CAChD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,EAAE,6BAA6B,CAAC;AAElE,MAAI,KAAK,cAAc,sCAAsC,KAC3D,MAAK,kBAAkB;MAEvB,OAAM,KAAK,gCAAgC;AAG7C,MAAI,MAAM,0BAA0B;;;CAItC,oBAA0B;AACxB,OAAK,UAAU,mBAAmB;AAClC,OAAK,cAAc,KAAK,iBAAiB;;CAG3C,iBAA0B;AACxB,SAAO,KAAK,UAAU,SAAS;;CAGjC,sBAAgD;AAC9C,SAAO,KAAK,UAAU,aAAa;;CAGrC,MAAc,mCAAkD;EAC9D,MAAM,MAAM,QAAQ,IAAI,8BAA8B,MAAM;AAC5D,MAAI,CAAC,IACH;EAEF,MAAM,UAAU,OAAO,SAAS,KAAK,GAAG;AACxC,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC1C;AAEF,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;;CAG9D,mBAAiC;AAC/B,OAAK,UAAU,WAAW;AAC1B,OAAK,cAAc,KAAK,QAAQ;AAChC,OAAK,2BAA2B;;;CAIlC,MAAc,mCAAkD;EAC9D,MAAM,OAAO,KAAK,wBAAwB;AAC1C,QAAM,oBAAoB,CAAC,UAAU,KAAK,QAAQ,MAAM,KAAK,cAAc,CAAC;;;;;;CAO9E,MAAM,kBAAiC;AACrC,QAAM,KAAK,kCAAkC;AAE7C,MAAI,KAAK,cAAc,sCAAsC,KAC3D;EAEF,MAAM,kBAAkB,YAAY,KAAK;EACzC,MAAM,QAAQ,KAAK;AACnB,MAAI;AACF,SAAM,KAAK,kCAAkC;GAE7C,MAAM,OAAO,YAAY,KAAK;AAC9B,OAAI,MACF,OAAM,MAAM,QAAQ,mCAAmC,KAAK,eAAe,uBAAuB,CAAC;OAEnG,OAAM,KAAK,eAAe,uBAAuB;GAEnD,MAAM,0BAA0B,YAAY,KAAK,GAAG;GAEpD,MAAM,KAAK,YAAY,KAAK;AAC5B,OAAI,MACF,OAAM,MAAM,QAAQ,kCAClB,KAAK,eAAe,+BAA+B,CACpD;OAED,OAAM,KAAK,eAAe,+BAA+B;GAE3D,MAAM,mBAAmB,YAAY,KAAK,GAAG;AAE7C,QAAK,wBAAwB,CAAC,OAAO,QAAQ;AAC3C,QAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;KAC9C;AACF,QAAK,KAAK,mBAAmB,EAAE,UAAU,KAAK,mBAAmB,EAAE,CAAC;GAEpE,MAAM,yBAAyB,YAAY,KAAK,GAAG;GACnD,MAAM,gBAAoD;IACxD,yBAAyB,KAAK;IAC9B,2BAA2B,KAAK;IAChC,oBAAoB,KAAK;IACzB,yBAAyB,KAAK,MAAM,wBAAwB;IAC5D,kBAAkB,KAAK,MAAM,iBAAiB;IAC9C,wBAAwB,KAAK,MAAM,uBAAuB;IAC3D;AACD,OAAI,KACF;IAAE,OAAO;IAA2B,OAAO;IAAU,GAAG;IAAe,EACvE,4DACD;WACM,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,MACF;IACE;IACA,cAAc;IACd,OAAO;IACP,OAAO;IACP,oBAAoB,KAAK;IACzB,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,gBAAgB;IAC3D,EACD,sDAAsD,KACvD;YACO;AACR,QAAK,kBAAkB;;;CAI3B,MAAM,OAAsB;AAC1B,MAAI,CAAC,KAAK,QAAS;AAEnB,0BAAwB,KAAK;AAE7B,MAAI,MAAM,8BAA8B;AACxC,OAAK,UAAU,cAAc;AAE7B,QAAM,uBAAuB,CAAC,OAAO,QAAQ;AAC3C,OAAI,KAAK,EAAE,KAAK,EAAE,qCAAqC;IACvD;AAEF,MAAI,KAAK,wBAAwB;AAC/B,QAAK,wBAAwB;AAC7B,QAAK,yBAAyB;;AAGhC,QAAM,KAAK,kBAAkB,iBAAiB;AAG9C,OAAK,kBAAkB,MAAM;AAG7B,MAAI,KAAK,yBAAyB;AAChC,SAAM,KAAK,yBAAyB;AACpC,QAAK,0BAA0B;;AAEjC,OAAK,2BAA2B;AAChC,OAAK,0BAA0B;AAE/B,wBAAsB,KAAK;AAC3B,OAAK,YAAY,sBAAsB;AACvC,QAAM,8BAA8B,CAAC,OAAO,QAAQ;AAClD,OAAI,KAAK,EAAE,KAAK,EAAE,8BAA8B;IAChD;AACF,OAAK,eAAe,MAAM;AAG1B,OAAK,UAAU;AACf,OAAK,IAAI,UAAU;AAEnB,OAAK,gCAAgC,EAAE;AACvC,OAAK,8BAA8B;AACnC,OAAK,gCAAgC;AAErC,QAAM,KAAK,eAAe,MAAM;AAGhC,QAAM,KAAK,YAAY,MAAM;AAG7B,UAAQ,YAAY;AAEpB,MAAI,MAAM,0BAA0B;;;CAItC,MAAc,sCAAqD;AACjE,QAAM,KAAK,iCAAiC;;;CAI9C,MAAM,gCAA+C;AACnD,MAAI,CAAC,KAAK,wBAAyB;AACnC,QAAM,KAAK,yBAAyB;AACpC,OAAK,0BAA0B;AAC/B,OAAK,2BAA2B;AAChC,OAAK,0BAA0B;AAC/B,MAAI,MAAM,uCAAuC;;;;;;CAOnD,MAAM,kCAAiD;EACrD,MAAM,EAAE,mCAAmC,MAAM,OAAO;AAGxD,MAAI,CAFmB,+BAA+B,KAAK,OAExC,EAAE;AACnB,OAAI,KAAK,yBAAyB;AAChC,UAAM,KAAK,yBAAyB;AACpC,SAAK,0BAA0B;AAC/B,SAAK,2BAA2B;AAChC,SAAK,0BAA0B;AAC/B,QAAI,MAAM,iEAAiE;;AAE7E;;EAGF,MAAM,WAAW,KAAK,OAAO,QAAQ,WAAkD;EAGvF,MAAM,MAAM,SAAS;EACrB,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,IAAI,OAAO;EACxD,MAAM,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,IAAI,OAAO;EACpE,MAAM,oBACJ,OAAO,KAAK,sBAAsB,YAAY,IAAI,qBAAqB,MACnE,KAAK,MAAM,IAAI,kBAAkB,GACjC,KAAA;EACN,MAAM,SAAS,SAAS;EACxB,MAAM,iBACJ,OAAO,WAAW,YAAY,OAAO,SAAS,OAAO,IAAI,SAAS,IAC9D,KAAK,MAAM,SAAS,IAAK,GACzB,KAAA;EACN,MAAM,UAAU,GAAG,KAAK,GAAG;AAE3B,MAAI,KAAK,2BAA2B,KAAK,4BAA4B,QACnE;AAGF,MAAI,KAAK,yBAAyB;AAChC,SAAM,KAAK,yBAAyB;AACpC,QAAK,0BAA0B;AAC/B,QAAK,2BAA2B;AAChC,QAAK,0BAA0B;;AAGjC,MAAI;GACF,MAAM,EAAE,kCAAkC,MAAM,OAAO;GACvD,MAAM,EAAE,UAAU,YAAY,MAAM,8BAA8B;IAChE;IACA;IACA;IACA;IACD,CAAC;AACF,QAAK,2BAA2B;AAChC,QAAK,0BAA0B;AAC/B,QAAK,0BAA0B;AAC/B,OAAI,KAAK;IAAE;IAAM;IAAM,EAAE,sCAAsC;WACxD,KAAK;GACZ,MAAM,OAAO,OAAO,OAAO,QAAQ,YAAY,UAAU,MAAO,IAA0B,OAAO,KAAA;AACjG,OAAI,MACF;IACE;IACA,OAAO;IACP,GAAI,SAAS,eACT;KACE,UAAU;KACV,UAAU;KACV,MAAM;KACP,GACD,EAAE;IACP,EACD,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;;;;;;CAOL,MAAc,yBAAwC;AACpD,MAAI,MAAM,sCAAsC;AAChD,SAAO,KAAK,QACV,KAAI;GACF,MAAM,MAAM,MAAM,KAAK,IAAI,iBAAiB;AAC5C,SAAM,KAAK,eAAe,KAAK,IAAI;WAC5B,OAAO;AACd,OAAI,iBAAiB,wBACnB;GAEF,MAAM,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACjE,OAAI,MACF;IAAE,KAAK;IAAO,cAAc;IAAI,OAAO;IAAoB,EAC3D,gDAAgD,KACjD;AACD,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAK,CAAC;;;CAO/D,mCAAyC;AACvC,OAAK,kBAAkB,kCAAkC;;CAG3D,eAA+D;AAC7D,SAAO,KAAK,kBAAkB,cAAc;;CAG9C,kCAAiD;AAC/C,SAAO,KAAK,kBAAkB,iCAAiC;;CAGjE,kCAAiD;AAC/C,SAAO,KAAK,kBAAkB,iCAAiC;;CAGjE,WAAW,QAA6D;AACtE,SAAO,KAAK,kBAAkB,WAAW,OAAO;;CAGlD,oCACE,aACA,QAC2E;AAC3E,SAAO,KAAK,kBAAkB,oCAAoC,aAAa,OAAO;;CAGxF,aAAa,SAAyE;AACpF,SAAO,KAAK,kBAAkB,aAAa,QAAQ;;;;;CAMrD,MAAM,YACJ,SACA,QACA,SACgD;AAChD,MAAI;AACF,SAAM,KAAK,eAAe,KAAK;IAC7B;IACA,SAAS;IACT;IACD,CAAC;GACF,MAAM,YAAY,OAAO,KAAK,KAAK;AACnC,QAAK,KAAK,gBAAgB;IAAE;IAAS;IAAQ;IAAW,CAAC;AACzD,UAAO;IAAE,MAAM;IAAM;IAAW;WACzB,OAAO;AACd,OAAI,MAAM;IAAE;IAAS;IAAQ;IAAO,EAAE,yBAAyB;AAC/D,SAAM;;;;;;CAOV,oBAIG;EACD,MAAM,kBAAkB,IAAI,IAAI,KAAK,eAAe,oBAAoB,CAAC;EACzE,MAAM,WAAW,KAAK,OAAO;EAC7B,MAAM,eAAe;EAErB,MAAM,OAAsE,mBAAmB,KAC5F,UAAU;GACT;GACA,SAAS,CAAC,CAAC,WAAW,OAAO;GAC7B,WAAW,gBAAgB,IAAI,KAAK;GACrC,EACF;EAGD,MAAM,YADS,KAAK,iBAAiB,aAAa,GACzB,eAAe,KAAK,MAAM,EAAE,GAAG,CAAC,QAAQ,OAAO,CAAC,aAAa,SAAS,GAAG,CAAC,IAAI,EAAE;AACzG,MAAI,SAAS,WAAW,EACtB,QAAO;EAGT,MAAM,OAAO,IAAI,IAAI,aAAa;AAClC,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,KAAK,IAAI,KAAK,CAAE;AACpB,QAAK,IAAI,KAAK;AACd,QAAK,KAAK;IACR;IACA,SAAS,WAAW,OAAO,YAAY;IACvC,WAAW,gBAAgB,IAAI,KAAK;IACrC,CAAC;;AAGJ,SAAO;;;;;CAMT,qBAMG;EACD,MAAM,gBAAgB,IAAI,IAAY;GAAC;GAAY;GAAU;GAAS,CAAC;EACvE,MAAM,uBAAO,IAAI,KAGd;AAEH,OAAK,MAAM,UAAU,KAAK,eAAe,eAAe,CACtD,MAAK,IAAI,OAAO,IAAI;GAClB,IAAI,OAAO;GACX,OAAO,OAAO,KAAK;GACnB,aAAa,OAAO,KAAK;GACzB,YAAY,cAAc,IAAI,OAAO,GAAG;GACxC,OAAO,OAAO,KAAK,SAAS;GAC7B,CAAC;AAGJ,qBAAmB,SAAS,IAAI,UAAU;AACxC,OAAI,KAAK,IAAI,GAAG,CAAE;GAClB,MAAM,OAAO,mBAAmB,GAAG;AACnC,QAAK,IAAI,IAAI;IACX;IACA,OAAO,KAAK;IACZ,aAAa,KAAK;IAClB,YAAY;IACZ,OAAO;IACR,CAAC;IACF;AAEF,SAAO,MAAM,KAAK,KAAK,QAAQ,CAAC,CAAC,UAAU,GAAG,MAAM;AAClD,OAAI,EAAE,UAAU,EAAE,MAAO,QAAO,EAAE,QAAQ,EAAE;AAC5C,UAAO,EAAE,GAAG,cAAc,EAAE,GAAG;IAC/B;;;;;CAMJ,oBAAoB,MAAkC;AACpD,OAAK,kBAAkB,WAAW,EAAE,QAAQ,MAAM,UAAU,UAAU,CAAC;;;;;CAMzE,kCAAkC,SAAoC;AACpE,OAAK,4BAA4B;;;;;CAMnC,+BAAgF;EAC9E,MAAM,SAAS,mCAAmC;AAClD,MAAI,OAAO,SAAS,SAClB,QAAO;GAAE,IAAI;GAAO,MAAM,OAAO;GAAM,SAAS,OAAO,UAAU;GAAgB;AAEnF,MAAI,OAAO,SAAS,WAClB,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SACE;GACH;EAEH,MAAM,WAAW,KAAK;AACtB,MAAI,CAAC,SACH,QAAO;GACL,IAAI;GACJ,MAAM,OAAO;GACb,SAAS;GACV;AAEH,qBAAmB;AACZ,aAAU,CAAC,cAAc;AAC5B,YAAQ,KAAK,EAAE;KACf;IACF;AACF,SAAO;GAAE,IAAI;GAAM,MAAM,OAAO;GAAM;;;;;CAMxC,YAeE;EACA,MAAM,kBAAkB,KAAK,eAAe,oBAAoB;EAChE,MAAM,cAAc,KAAK,eAAe,gBAAgB;EACxD,MAAM,WAAW,aAAa;EAC9B,MAAM,YAAY,KAAK,UAAU,aAAa;AAE9C,SAAO;GACL,QAAQ;GACR,SAAS;GACT,SAAS;GACT,QAAQ,KAAK,OAAO,KAAK,KAAK,GAAG,KAAK,aAAa,IAAK;GACxD,OAAO,UAAU;GACjB,eAAe,UAAU;GACzB,mBAAmB,UAAU;GAC7B,UAAU;IACR,SAAS,gBAAgB;IACzB,OAAO,YAAY;IACpB;GACD,YAAY,KAAK;GACjB,MAAM;IACJ,KAAK,WAAW;IAChB,WAAW,SAAS;IACpB,OAAO,SAAS;IACjB;GACF;;CAGH,IAAI,YAAqB;AACvB,SAAO,KAAK;;;;;CAMd,uBAAuB;AACrB,SAAO,KAAK,iBAAiB,aAAa;;;CAI5C,qBAA6C;AAC3C,SAAO,KAAK;;;;;CAMd,mBAAmB;EACjB,MAAM,EAAE,sBAAA,gBAAA,EAAA,aAAA,kBAAA;AACR,SAAO,kBAAkB;;;;;CAM3B,MAAM,oBAAoB,QAAgB,QAAmD;EAC3F,MAAM,WAAW,KAAK,sBAAsB;AAC5C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,mCAAmC;EAGrD,MAAM,UAAU,SAAS,iBAAiB,OAAO;AACjD,MAAI,CAAC,QACH,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAGxD,SAAO,MAAM,QAAQ,OAAO;;CAG9B,IAAI,gBAAwB;AAC1B,SAAO,KAAK;;CAGd,IAAI,uBAA+B;AACjC,SAAO,KAAK;;CAGd,IAAI,qBAAiC;AACnC,SAAO,KAAK;;;CAId,yBAAiC;AAC/B,SAAO,4BAA4B,KAAK,QAAQ,KAAK,cAAc,WAAW;;CAIhF,IAAI,sBAAmC;AACrC,SAAO,KAAK;;CAGd,IAAI,uBAAqC;AACvC,SAAO,KAAK;;;CAId,MAAM,cAAc,SAAiB,aAAa,mBAAoC;AACpF,SAAO,KAAK,aAAa,eAAe,cAAc,SAAS,WAAW;;CAK5E,UACE,WACA,UACY;AACZ,SAAO,KAAK,IAAI,UAAU,WAAW,SAAS;;CAGhD,KAAK,MAAc,SAAwB;AACzC,OAAK,IAAI,KAAK,MAAM,QAAQ;;;CAI9B,eAAe,WAAmB,aAAqC;AACrE,SAAO,KAAK,IAAI,eAAe,WAAW,YAAY;;;;;;CAOxD,aAAa,SAAkE;EAC7E,MAAM,QAAQ,aAAa,QAAQ;AACnC,SAAO,cAAc,KAAK,MAAM,MAAM;;;;;CAMxC,cAA+D;AAC7D,SAAO,KAAK,KAAK;;;CAInB,kBAAuC;AACrC,SAAO,KAAK;;;;;;CAOd,eAAmC;AACjC,SAAO,KAAK,KAAK,SAAS,UAAU,KAAK,KAAK,QAAQ,KAAA;;;;;;CAOxD,MAAM,mBAAoC;AACxC,MAAI,KAAK,KAAK,SAAS,QACrB,OAAM,IAAI,MAAM,+CAA+C;EAIjE,MAAM,WAAW,OAAO,YAAY,GAAG,CAAC,SAAS,MAAM;AAGvD,OAAK,KAAK,QAAQ;AAGlB,OAAK,SAAS;GACZ,GAAG,KAAK;GACR,SAAS;IACP,GAAG,KAAK,OAAO;IACf,MAAM;KACJ,GAAG,KAAK,OAAO,SAAS;KACxB,MAAM;KACN,OAAO;KACR;IACF;GACF;AAED,QAAM,KAAK,WAAW,KAAK,OAAO;AAElC,MAAI,KAAK,EAAE,cAAc,GAAG,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,0BAA0B;AAEnF,SAAO"}
+{"version":3,"file":"service.js","names":["writeConfigToDisk"],"sources":["../../../src/gateway/service.ts"],"sourcesContent":["import crypto from 'crypto';\nimport { AgentService } from '../agent/service.js';\nimport { ChannelManager } from '../channels/manager.js';\nimport { CHAT_CHANNEL_ORDER, getChatChannelMeta } from '../channels/registry.js';\nimport { setPairingBroadcastSink } from '../channels/pairing/pairing-events.js';\nimport { MessageBus, MessageBusShutdownError } from '../infra/bus/index.js';\nimport { loadConfig, saveConfig as writeConfigToDisk } from '../config/index.js';\nimport { getWorkspacePath } from '../config/workspace-path-helpers.js';\nimport { CronService } from '../cron/index.js';\nimport { buildWorkflowChildTools } from '../agent/workflow/workflow-child-tools.js';\nimport { WorkflowRunService } from '../workflows/service/workflow-run-service.js';\nimport { WorkflowSessionBridge } from '../workflows/service/workflow-session-bridge.js';\nimport { ExtensionLoader, areExtensionsGloballyDisabled, buildExtensionMetadataSnapshot } from '../extensions/index.js';\nimport { HeartbeatService, heartbeatRunnerConfigFromConfig } from './heartbeat/index.js';\nimport { SessionIndex } from '../session/index.js';\nimport type { Config } from '../config/schema.js';\nimport { wireTunnelEventsToGateway } from '../tunnel/gateway-lifecycle.js';\nimport {\n  stopTailscaleExposure,\n} from './tailscale-lifecycle.js';\nimport { getExposureManager } from '../remote-access/exposure-manager.js';\nimport { sanitizeTunnelConfig } from '../tunnel/tunnel-config.js';\nimport { resolveGatewayAuth, assertGatewayAuthConfigured, validateToken, extractToken, type ResolvedGatewayAuth } from './auth.js';\nimport { assertGatewayAuthNotKnownWeak } from './security/known-weak-secrets.js';\nimport { auditGatewayConfig } from './security/audit.js';\nimport { assertGatewayRuntimeConfig } from './runtime-config.js';\nimport { resolveEffectiveGatewayPort } from './host.js';\nimport { buckets, isGatewayStrictSecurityEnabled } from './rate-limit/index.js';\nimport { prewarmModelRegistry } from '../providers/index.js';\nimport { createLogger, getLogDir, getLogStats } from '../utils/logger.js';\nimport {\n  resolveConfigPath,\n  resolveCronJobsPath,\n  resolveAgentDir,\n  resolveExtensionsDir,\n} from '../config/paths.js';\nimport { AgentRunRelay, type RelayEvent } from './agent-run-relay.js';\nimport { registerClarifyBridge } from './clarify-runtime.js';\nimport { PACKAGE_VERSION } from '../package-version.js';\n\nimport { disposeAllSessionMcpRuntimes } from '../agent/mcp/bundle-mcp-tools.js';\nimport { getDefaultAgentId } from '../routing/resolve-route.js';\nimport { scheduleGatewayUpdateCheck } from '../infra/update-startup.js';\nimport { resolveChannelConnectDeferSet } from './resolve-channel-connect-defer.js';\nimport { restartGatewayProcessWithFreshPid } from './respawn.js';\nimport { GatewaySessionsApi } from './service/sessions-api.js';\nimport { GatewayMarketplaceService } from './service/marketplace-service.js';\nimport { GatewayConfigCoordinator } from './service/config-coordinator.js';\nimport { GatewayAgentRunner } from './service/agent-runner.js';\nimport { GatewaySseHub } from './service/sse-hub.js';\nimport type {\n  GatewayChannelStartupPhase1Metrics,\n  GatewayChannelStartupPhase2Metrics,\n  GatewayServiceConfig,\n  ServiceEvent,\n} from './service/types.js';\nimport {\n  GatewayReadiness,\n  type GatewayReadinessSnapshot,\n} from './startup-readiness.js';\nimport { createGatewayStartupTrace, type GatewayStartupTrace } from './startup-trace.js';\n\nexport type {\n  GatewayChannelStartupPhase1Metrics,\n  GatewayChannelStartupPhase2Metrics,\n  GatewayServiceConfig,\n  ServiceEvent,\n} from './service/types.js';\n\nconst log = createLogger('GatewayService');\n\nexport class GatewayService {\n  private bus: MessageBus;\n  private config: Config;\n  private configPath: string;\n  private _agentService: AgentService | null = null;\n  private channelManager: ChannelManager;\n  private cronService: CronService;\n  private extensionLoader: ExtensionLoader | null = null;\n  private extensionMetadataSnapshot: import('../extensions/extension-metadata-snapshot.js').ExtensionMetadataSnapshot | null = null;\n  private browserExtensionProvider: import('../browser/providers/extension.js').ExtensionBrowserProvider | null = null;\n  private browserExtensionRelease: (() => Promise<void>) | null = null;\n  /** `${host}:${port}` when the gateway holds the extension bridge listener. */\n  private browserExtensionBindKey: string | null = null;\n  private heartbeatService: HeartbeatService | null = null;\n  private sessionIndex: SessionIndex;\n  private running = false;\n  private startTime = Date.now();\n  private workspacePath: string;\n  private readonly configCoordinator: GatewayConfigCoordinator;\n\n  // Authentication\n  private auth: ResolvedGatewayAuth;\n\n  private readonly sse = new GatewaySseHub();\n\n  private stopGatewayUpdateCheck: (() => void) | null = null;\n\n  /** When set (e.g. by `GatewayServer`), `triggerGatewayProcessRestart` can stop HTTP then exit. */\n  private gatewayShutdownForRestart: (() => Promise<void>) | null = null;\n\n  /** Snapshot for phase-2 metrics / logs (ids deferred at phase-1 `start()`). */\n  private lastDeferredChannelConnectIds: string[] = [];\n  private lastChannelConnectDeferMode: 'auto' | 'off' | 'explicit' = 'auto';\n  private lastChannelConnectDeferSource: 'off' | 'explicit' | 'meta' = 'off';\n\n  private readonly readiness = new GatewayReadiness();\n  private startupTrace: GatewayStartupTrace | null = null;\n  private workflowSessionBridge: WorkflowSessionBridge | null = null;\n  private workflowRunServiceInstance: WorkflowRunService | null = null;\n\n  /**\n   * Webchat agent invocation surface (`runAgent`, `abortAgentRun`, `steer*`,\n   * `submitClarifyResponse`, clarify-bridge dispatch). Owns the\n   * `activeWebchatRunBySession` + `runAbortControllers` maps.\n   */\n  readonly agentRunner: GatewayAgentRunner;\n\n  /** Read-only alias re-exported from `agentRunner.runRelay` for legacy callers. */\n  get runRelay(): AgentRunRelay { return this.agentRunner.runRelay; }\n\n  /**\n   * Session CRUD / search / compaction / tag-archive-pin / stats — the gateway\n   * REST surface for sessions. Routes should depend on this narrow service\n   * rather than the full GatewayService composition root.\n   */\n  readonly sessions: GatewaySessionsApi;\n\n  /**\n   * Skills + extensions marketplace surface (browse / install / uninstall) plus\n   * local-only managed-skill ops. Routes depend on this narrow service.\n   */\n  readonly marketplace: GatewayMarketplaceService;\n\n  constructor(private serviceConfig: GatewayServiceConfig = {}) {\n    this.bus = new MessageBus();\n    this.configPath = serviceConfig.configPath || resolveConfigPath();\n    this.config = loadConfig(this.configPath);\n    if (sanitizeTunnelConfig(this.config)) {\n      void writeConfigToDisk(this.config, this.configPath).catch((err) => {\n        const em = err instanceof Error ? err.message : String(err);\n        log.warn({ err, phase: 'tunnel_sanitize', errorMessage: em }, `Tunnel config sanitize persist failed: ${em}`);\n      });\n    }\n\n    // Initialize authentication\n    this.auth = resolveGatewayAuth({\n      authConfig: this.config.gateway?.auth,\n    });\n\n    // Validate auth configuration\n    assertGatewayAuthConfigured(this.auth);\n\n    // Reject known weak / placeholder credentials at startup\n    assertGatewayAuthNotKnownWeak(this.auth);\n\n    const gatewayPort = this.getEffectiveListenPort();\n    const runtimeConfig = assertGatewayRuntimeConfig({\n      cfg: this.config,\n      auth: this.auth,\n      bindOverride: serviceConfig.listenBind,\n      port: gatewayPort,\n    });\n\n    // Security audit: non-blocking warnings for remaining risk signals\n    auditGatewayConfig({\n      auth: this.auth,\n      bindHost: runtimeConfig.bindHost,\n      corsOrigins: runtimeConfig.corsOrigins,\n      rateLimitEnabled: runtimeConfig.rateLimitEnabled,\n      tlsEnabled: runtimeConfig.tlsEnabled,\n      trustedProxies: this.config.gateway?.trustedProxies,\n      allowRealIpFallback: this.config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback: runtimeConfig.dangerouslyAllowHostHeaderOriginFallback,\n      strictSecurityEnabled: isGatewayStrictSecurityEnabled(this.config),\n      rateLimitConfigured: this.config.gateway?.auth?.rateLimit !== undefined,\n    });\n\n    // Log token info (not the token itself)\n    if (this.auth.mode === 'token') {\n      const tokenPreview = this.auth.token ? `${this.auth.token.slice(0, 4)}***` : 'none';\n      log.info({ mode: this.auth.mode, token: tokenPreview }, 'Authentication configured');\n    } else if (this.auth.mode === 'trusted-proxy') {\n      log.info(\n        {\n          mode: this.auth.mode,\n          userHeader: this.auth.trustedProxy?.userHeader,\n          trustedProxyCount: this.config.gateway?.trustedProxies?.length ?? 0,\n        },\n        'Trusted-proxy authentication configured',\n      );\n    } else {\n      log.info({ mode: this.auth.mode }, 'Authentication configured');\n    }\n\n    // Initialize channel manager\n    this.channelManager = new ChannelManager(this.config, this.bus);\n\n    // Initialize extension loader (manifest snapshot only — code load in start()).\n    this.workspacePath = getWorkspacePath(this.config) || './workspace';\n    this.initializeExtensionLoader();\n\n    // Session index + files shared with AgentService (webchat `/goal` metadata must match GET /api/goals/webchat).\n    this.sessionIndex = new SessionIndex({\n      config: this.config,\n    });\n\n    this.cronService = new CronService({\n      filePath: resolveCronJobsPath(),\n    });\n\n    this.agentRunner = new GatewayAgentRunner({\n      bus: this.bus,\n      sessionIndex: this.sessionIndex,\n      getAgentService: () => this.ensureAgentService(),\n      getChannelManager: () => this.channelManager,\n      getConfig: () => this.config,\n      emit: (type, payload) => this.sse.emit(type, payload),\n    });\n\n    this.sessions = new GatewaySessionsApi({\n      sessionIndex: this.sessionIndex,\n      getAgentService: () => this.ensureAgentService(),\n      getActiveWebchatRunId: (sk) => this.agentRunner.getActiveRunId(sk),\n    });\n\n    this.marketplace = new GatewayMarketplaceService({\n      getConfig: () => this.config,\n      getAgentService: () => this.ensureAgentService(),\n      getExtensionLoader: () => this.extensionLoader,\n      getChannelManager: () => this.channelManager,\n      saveConfig: (cfg) => this.saveConfig(cfg),\n      emit: (type, payload) => this.emit(type, payload),\n    });\n\n    this.configCoordinator = new GatewayConfigCoordinator({\n      configPath: this.configPath,\n      bus: this.bus,\n      enableHotReload: this.serviceConfig.enableHotReload !== false,\n      getConfig: () => this.config,\n      setConfig: (next) => { this.config = next; },\n      getAgentService: () => this.ensureAgentService(),\n      getChannelManager: () => this.channelManager,\n      getCronService: () => this.cronService,\n      getHeartbeatService: () => this.heartbeatService,\n      getExtensionLoader: () => this.extensionLoader,\n      reconcileBrowserExtensionServer: () => this.reconcileBrowserExtensionServer(),\n      getChannelsStatus: () => this.getChannelsStatus(),\n      emit: (type, payload) => this.emit(type, payload),\n    });\n  }\n\n  /** Lazy AgentService — constructed on first use or during `start()`. */\n  get agentService(): AgentService {\n    return this.ensureAgentService();\n  }\n\n  private ensureAgentService(): AgentService {\n    if (this._agentService) {\n      return this._agentService;\n    }\n\n    const cronRef: { service?: CronService } = { service: this.cronService };\n    this._agentService = new AgentService(this.bus, {\n      workspace: this.workspacePath,\n      model: this.config.agents?.defaults?.model?.primary,\n      config: this.config,\n      sessionStore: this.sessionIndex.getStore(),\n      onSessionMetadataUpdated: (sessionKey) => {\n        this.sessionIndex.emit('sessionUpdated', { key: sessionKey });\n      },\n      onSessionTranscriptUpdated: (sessionKey) => {\n        this.emit('session.transcript_updated', { key: sessionKey });\n      },\n      extensionRegistry: this.extensionLoader?.getRegistry(),\n      getCronService: () => cronRef.service,\n      getWorkflowRunService: () => this.createWorkflowRunService(),\n      gatewayClarify: {\n        requestClarification: (sessionKey, request) =>\n          this.agentRunner.requestClarification({\n            sessionKey,\n            request,\n            publishSseFor: (_runId) => (e: RelayEvent) => {\n              this._agentService!.turnDispatcher.enqueueWebchatSseEvent(sessionKey, e);\n            },\n          }),\n      },\n    });\n\n    this._agentService.setChannelManager(this.channelManager);\n    this.channelManager.setSessionModelHooks({\n      getModelForSession: (sk) => this._agentService!.getModelForSession(sk),\n      switchModelForSession: (sk, id) => this._agentService!.switchModelForSession(sk, id),\n    });\n\n    this.cronService.setDeps({\n      agentService: this._agentService,\n      messageBus: this.bus,\n      heartbeatService: this.ensureHeartbeatService(),\n      sessionStore: this.sessionIndex.getStore(),\n      getDefaultCronAgentId: () => getDefaultAgentId(this.config),\n      workflowRunService: this.createWorkflowRunService(),\n    });\n    cronRef.service = this.cronService;\n\n    this._agentService.persistentGoals.setWebchatContinuationScheduler((sessionKey, message) => {\n      const scheduleWhenIdle = () => {\n        if (this._agentService!.getInboundTurnDepth(sessionKey) > 0) {\n          setTimeout(scheduleWhenIdle, 50);\n          return;\n        }\n        if (this.agentRunner.hasActiveRun(sessionKey)) {\n          setTimeout(scheduleWhenIdle, 50);\n          return;\n        }\n        void this.agentRunner.drainScheduledWebchatContinuation(sessionKey, message);\n      };\n      queueMicrotask(scheduleWhenIdle);\n    });\n\n    return this._agentService;\n  }\n\n  private ensureHeartbeatService(): HeartbeatService {\n    if (this.heartbeatService) {\n      return this.heartbeatService;\n    }\n    this.heartbeatService = new HeartbeatService({\n      agentService: this.ensureAgentService(),\n      messageBus: this.bus,\n      cronService: this.cronService,\n      sessionStore: this.sessionIndex.getStore(),\n      getConfig: () => this.config,\n    });\n    return this.heartbeatService;\n  }\n\n  // ── Webchat agent runner (delegated to GatewayAgentRunner) ────────────\n\n  enqueueWebchatPersistentGoalKickoff(sessionKey: string, goalText: string): void {\n    this.agentRunner.enqueueWebchatPersistentGoalKickoff(sessionKey, goalText);\n  }\n\n  runAgent(\n    ...args: Parameters<GatewayAgentRunner['runAgent']>\n  ): ReturnType<GatewayAgentRunner['runAgent']> {\n    return this.agentRunner.runAgent(...args);\n  }\n\n  abortAgentRun(runId: string): boolean {\n    return this.agentRunner.abortAgentRun(runId);\n  }\n\n  steerWebchatAgent(\n    chatId: string,\n    message: string,\n  ): ReturnType<GatewayAgentRunner['steerWebchatAgent']> {\n    return this.agentRunner.steerWebchatAgent(chatId, message);\n  }\n\n  submitClarifyResponse(requestId: string, answer: string): boolean {\n    return this.agentRunner.submitClarifyResponse(requestId, answer);\n  }\n\n  private initializeExtensionLoader(): void {\n    try {\n      if (areExtensionsGloballyDisabled(this.config)) {\n        log.info('Extensions globally disabled — skipping loader initialization');\n        return;\n      }\n\n      const loaderOptions = {\n        workspaceDir: this.workspacePath,\n        extensionsDir: resolveExtensionsDir(),\n      };\n      this.extensionMetadataSnapshot = buildExtensionMetadataSnapshot(loaderOptions, this.config);\n      this.extensionLoader = new ExtensionLoader(loaderOptions);\n      this.extensionLoader.setManifestSnapshot(this.extensionMetadataSnapshot);\n      this.extensionLoader.setConfig(this.config as Parameters<ExtensionLoader['setConfig']>[0]);\n    } catch (error) {\n      log.warn({ error }, 'Failed to initialize extension loader');\n    }\n  }\n\n  private registerExtensionChannelPlugins(): void {\n    if (!this.extensionLoader) {\n      return;\n    }\n    const reg = this.extensionLoader.getRegistry();\n    for (const plugin of reg.channelPlugins) {\n      this.channelManager.registerPlugin(plugin);\n    }\n  }\n\n  /**\n   * Load extensions and register SDK / full ChannelPlugin instances with ChannelManager.\n   */\n  private async loadExtensionsAndRegisterChannels(): Promise<void> {\n    if (!this.extensionLoader) {\n      return;\n    }\n    try {\n      await this.extensionLoader.loadByActivationPlan({ phase: 'startup' });\n      this.registerExtensionChannelPlugins();\n      const reg = this.extensionLoader.getRegistry();\n      log.debug(\n        {\n          extensionRecords: reg.extensions.size,\n          channelPlugins: reg.channelPlugins.length,\n        },\n        'Startup-phase extensions loaded and channel plugins registered',\n      );\n    } catch (err) {\n      log.warn({ err }, 'Failed to load startup-phase extensions');\n    }\n  }\n\n  private async loadDeferredExtensions(): Promise<void> {\n    if (!this.extensionLoader) {\n      return;\n    }\n    try {\n      await this.extensionLoader.loadByActivationPlan({ phase: 'deferred' });\n      this.registerExtensionChannelPlugins();\n      log.debug('Deferred-phase extensions loaded');\n    } catch (err) {\n      log.warn({ err }, 'Failed to load deferred extensions');\n    }\n  }\n\n  private schedulePostReadySidecars(): void {\n    queueMicrotask(() => {\n      void this.runPostReadySidecars();\n    });\n  }\n\n  private async runPostReadySidecars(): Promise<void> {\n    const trace = this.startupTrace;\n    try {\n      if (trace) {\n        await trace.measure('sidecars.model-prewarm', () => prewarmModelRegistry());\n      } else {\n        await prewarmModelRegistry();\n      }\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, errorMessage: em, phase: 'sidecars.model_prewarm' }, `Model registry prewarm failed: ${em}`);\n    }\n\n    if (!this.extensionLoader || areExtensionsGloballyDisabled(this.config)) {\n      return;\n    }\n\n    try {\n      if (trace) {\n        await trace.measure('extensions.deferred-load', () => this.loadDeferredExtensions());\n      } else {\n        await this.loadDeferredExtensions();\n      }\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.warn({ err, errorMessage: em, phase: 'extensions.deferred_load' }, `Deferred extension load failed: ${em}`);\n    }\n  }\n\n  async start(): Promise<void> {\n    if (this.running) return;\n\n    setPairingBroadcastSink((type, payload) => {\n      this.emit(type, payload);\n    });\n\n    log.debug('Starting gateway service...');\n    this.startTime = Date.now();\n    this.running = true;\n    this.startupTrace = createGatewayStartupTrace();\n    this.readiness.markStarting(this.startTime);\n    const trace = this.startupTrace;\n\n    registerClarifyBridge(this.agentRunner.getClarifyBridge());\n\n    this.ensureAgentService();\n\n    this.channelManager.setOutboundHooks({\n      runMessageSending: (to, content, channel) =>\n        this.agentService.outboundCoordinator.invokeOutboundMessageSending(to, content, channel),\n      runMessageSent: (to, content, success, error, channel) =>\n        this.agentService.outboundCoordinator.invokeOutboundMessageSent(to, content, success, error, channel),\n    });\n    this.channelManager.enableOutboundPersistence(resolveAgentDir(this.config, getDefaultAgentId(this.config)));\n\n    if (this.extensionLoader) {\n      this.extensionLoader.setRuntimeContext({\n        bus: this.bus,\n        sessionManager: this.sessionIndex,\n        scheduleWebchatContinuation: (sessionKey: string, continuationMessage: string) => {\n          queueMicrotask(() => {\n            void this.agentRunner.drainScheduledWebchatContinuation(sessionKey, continuationMessage);\n          });\n        },\n      });\n    }\n\n    await trace.measure('extensions.load', () => this.loadExtensionsAndRegisterChannels());\n\n    const skipChannels =\n      process.env.XOPC_SKIP_CHANNELS === '1' ||\n      process.env.XOPC_SKIP_CHANNELS === 'true' ||\n      process.env.XOPC_SKIP_PROVIDERS === '1' ||\n      process.env.XOPC_SKIP_PROVIDERS === 'true';\n\n    // Start channels: init all; optional defer for meta.deferConnectUntilAfterListen (GatewayServer)\n    const phase1StartedAt = performance.now();\n    let channelInitMs = 0;\n    let deferPlanMs = 0;\n    let channelPhase1StartMs = 0;\n    let replayOutboundMs: number | null = null;\n    let deferConnect = new Set<string>();\n\n    if (skipChannels) {\n      log.info('Skipping channel startup (XOPC_SKIP_CHANNELS or XOPC_SKIP_PROVIDERS)');\n    } else {\n      const t0 = performance.now();\n      await trace.measure('channels.initialize', () => this.channelManager.initialize());\n      channelInitMs = performance.now() - t0;\n\n      const t1 = performance.now();\n      const deferResolution = resolveChannelConnectDeferSet({\n        config: this.config,\n        channelManager: this.channelManager,\n        deferChannelConnectUntilAfterHttp: this.serviceConfig.deferChannelConnectUntilAfterHttp === true,\n      });\n      deferConnect = deferResolution.deferPluginIds;\n      deferPlanMs = performance.now() - t1;\n      this.lastDeferredChannelConnectIds = [...deferConnect];\n      this.lastChannelConnectDeferMode = deferResolution.mode;\n      this.lastChannelConnectDeferSource = deferResolution.source;\n\n      if (deferConnect.size > 0) {\n        log.info({ channels: [...deferConnect] }, 'Deferring channel outbound connect until HTTP listen');\n      }\n\n      const t2 = performance.now();\n      await trace.measure('channels.start', () =>\n        this.channelManager.start(\n          deferConnect.size > 0 ? { deferConnectPluginIds: deferConnect } : undefined,\n        ),\n      );\n      channelPhase1StartMs = performance.now() - t2;\n\n      if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n        const tr = performance.now();\n        await trace.measure('channels.replay-outbound', () =>\n          this.channelManager.replayPendingOutboundMessages(),\n        );\n        replayOutboundMs = performance.now() - tr;\n      }\n    }\n\n    const channelStartupPhase1TotalMs = performance.now() - phase1StartedAt;\n    const gwDeferMode = this.config.gateway?.channelConnectDeferMode ?? 'auto';\n    const phase1Metrics: GatewayChannelStartupPhase1Metrics = {\n      deferChannelConnectUntilAfterHttp: this.serviceConfig.deferChannelConnectUntilAfterHttp === true,\n      channelConnectDeferMode: this.serviceConfig.deferChannelConnectUntilAfterHttp\n        ? this.lastChannelConnectDeferMode\n        : gwDeferMode,\n      channelConnectDeferSource: this.lastChannelConnectDeferSource,\n      deferredChannelIds: this.lastDeferredChannelConnectIds,\n      deferredChannelCount: this.lastDeferredChannelConnectIds.length,\n      channelInitMs: Math.round(channelInitMs),\n      deferPlanMs: Math.round(deferPlanMs),\n      channelPhase1StartMs: Math.round(channelPhase1StartMs),\n      replayOutboundMs: replayOutboundMs === null ? null : Math.round(replayOutboundMs),\n      channelStartupPhase1TotalMs: Math.round(channelStartupPhase1TotalMs),\n    };\n    log.info(\n      { phase: 'gateway.channel_startup', stage: 'phase1', ...phase1Metrics },\n      'Gateway channel startup phase-1 complete',\n    );\n\n    // Initialize session manager\n    await trace.measure('sessions.initialize', () => this.sessionIndex.initialize());\n    log.debug('Session manager initialized');\n\n    this.cronService.setDeps({\n      agentService: this.agentService,\n      messageBus: this.bus,\n      heartbeatService: this.ensureHeartbeatService(),\n      sessionStore: this.sessionIndex.getStore(),\n      getDefaultCronAgentId: () => getDefaultAgentId(this.config),\n      workflowRunService: this.createWorkflowRunService(),\n    });\n\n    this.sessionIndex.on('sessionUpdated', (data: { key: string; name?: string; tags?: string[] }) => {\n      this.emit('session.updated', { key: data.key, name: data.name, tags: data.tags });\n    });\n\n    // Start cron service\n    if (this.config.cron?.enabled !== false) {\n      await trace.measure('cron.initialize', () => this.cronService.initialize());\n    }\n\n    this.ensureHeartbeatService().start(heartbeatRunnerConfigFromConfig(this.config));\n\n    void import('../browser/providers/browser-ext-install.js')\n      .then(({ ensureBrowserExtensionOnStartup }) => ensureBrowserExtensionOnStartup(this.config))\n      .catch((err) => log.warn({ err }, 'Browser extension artifact ensure failed'));\n\n    // Start browser extension WS server if configured\n    await trace.measure('browser-extension.start', () => this.startBrowserExtensionServerIfNeeded());\n\n    // Start agent service (runs in background)\n    this.agentService.start().catch((err) => {\n      log.error({ err }, 'Agent service error');\n    });\n\n    // Outbound drain: after deferred channel connects when using HTTP lifecycle (avoid racing Telegram).\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      this.startOutboundProcessor().catch((err) => {\n        log.error({ err }, 'Outbound processor error');\n      });\n    }\n\n    // Setup config hot reload\n    if (this.serviceConfig.enableHotReload !== false) {\n      this.configCoordinator.startHotReloader();\n    }\n\n    this.stopGatewayUpdateCheck = scheduleGatewayUpdateCheck({\n      config: this.config,\n      onUpdateAvailableChange: (update) => {\n        this.emit('update.available', update);\n      },\n    });\n\n    wireTunnelEventsToGateway(this);\n\n    // Drop orphan single-HTML site-share staging dirs left behind by a\n    // process death between create and cleanup. Re-registers live ones into\n    // the in-process map so post-restart revoke/expire still cleans them.\n    void import('../share/share-auto.js')\n      .then(({ runStagingSweep }) => runStagingSweep())\n      .catch((err) => log.warn({ err }, 'Share staging sweep failed'));\n\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      this.markGatewayReady();\n    } else {\n      trace.mark('service.started-awaiting-http');\n    }\n\n    log.debug('Gateway service started');\n  }\n\n  /** Called when the HTTP listener is bound (before deferred channel work). */\n  markHttpListening(): void {\n    this.readiness.markHttpListening();\n    this.startupTrace?.mark('http.listening');\n  }\n\n  isGatewayReady(): boolean {\n    return this.readiness.isReady();\n  }\n\n  getGatewayReadiness(): GatewayReadinessSnapshot {\n    return this.readiness.getSnapshot();\n  }\n\n  private async applyStartupReadyDelayForTesting(): Promise<void> {\n    const raw = process.env.XOPC_GATEWAY_STARTUP_SLOW_MS?.trim();\n    if (!raw) {\n      return;\n    }\n    const delayMs = Number.parseInt(raw, 10);\n    if (!Number.isFinite(delayMs) || delayMs <= 0) {\n      return;\n    }\n    await new Promise((resolve) => setTimeout(resolve, delayMs));\n  }\n\n  private markGatewayReady(): void {\n    this.readiness.markReady();\n    this.startupTrace?.mark('ready');\n    this.schedulePostReadySidecars();\n  }\n\n  /** After HTTP is listening: exposure auto-start (Tailscale, then FRP tunnel). */\n  private async runExposureAutoStartIfConfigured(): Promise<void> {\n    const port = this.getEffectiveListenPort();\n    await getExposureManager().autoStart(this.config, port, this.getAuthToken());\n  }\n\n  /**\n   * Called by `GatewayServer` when the HTTP listener is bound. Starts channels that\n   * opted into `meta.deferConnectUntilAfterListen`, then replays outbound queue.\n   */\n  async onHttpListening(): Promise<void> {\n    await this.runExposureAutoStartIfConfigured();\n\n    if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) {\n      return;\n    }\n    const listenStartedAt = performance.now();\n    const trace = this.startupTrace;\n    try {\n      await this.applyStartupReadyDelayForTesting();\n\n      const tDef = performance.now();\n      if (trace) {\n        await trace.measure('channels.deferred-connect', () => this.channelManager.startDeferredConnects());\n      } else {\n        await this.channelManager.startDeferredConnects();\n      }\n      const channelPhase2DeferredMs = performance.now() - tDef;\n\n      const tr = performance.now();\n      if (trace) {\n        await trace.measure('channels.replay-outbound', () =>\n          this.channelManager.replayPendingOutboundMessages(),\n        );\n      } else {\n        await this.channelManager.replayPendingOutboundMessages();\n      }\n      const replayOutboundMs = performance.now() - tr;\n\n      this.startOutboundProcessor().catch((err) => {\n        log.error({ err }, 'Outbound processor error');\n      });\n      this.emit('channels.status', { channels: this.getChannelsStatus() });\n\n      const onHttpListeningTotalMs = performance.now() - listenStartedAt;\n      const phase2Metrics: GatewayChannelStartupPhase2Metrics = {\n        channelConnectDeferMode: this.lastChannelConnectDeferMode,\n        channelConnectDeferSource: this.lastChannelConnectDeferSource,\n        deferredChannelIds: this.lastDeferredChannelConnectIds,\n        channelPhase2DeferredMs: Math.round(channelPhase2DeferredMs),\n        replayOutboundMs: Math.round(replayOutboundMs),\n        onHttpListeningTotalMs: Math.round(onHttpListeningTotalMs),\n      };\n      log.info(\n        { phase: 'gateway.channel_startup', stage: 'phase2', ...phase2Metrics },\n        'Gateway channel startup phase-2 complete (HTTP listening)',\n      );\n    } catch (err) {\n      const em = err instanceof Error ? err.message : String(err);\n      log.error(\n        {\n          err,\n          errorMessage: em,\n          phase: 'gateway.channel_startup',\n          stage: 'phase2',\n          deferredChannelIds: this.lastDeferredChannelConnectIds,\n          elapsedMs: Math.round(performance.now() - listenStartedAt),\n        },\n        `Deferred channel startup after HTTP listen failed: ${em}`,\n      );\n    } finally {\n      this.markGatewayReady();\n    }\n  }\n\n  async stop(): Promise<void> {\n    if (!this.running) return;\n\n    setPairingBroadcastSink(null);\n\n    log.debug('Stopping gateway service...');\n    this.readiness.markStarting();\n\n    await stopTailscaleExposure().catch((err) => {\n      log.warn({ err }, 'Tailscale exposure shutdown failed');\n    });\n\n    if (this.stopGatewayUpdateCheck) {\n      this.stopGatewayUpdateCheck();\n      this.stopGatewayUpdateCheck = null;\n    }\n\n    await this.configCoordinator.stopHotReloader();\n\n    // Stop heartbeat service\n    this.heartbeatService?.stop();\n\n    // Stop browser extension WS server (shared acquire/release with BrowserManager)\n    if (this.browserExtensionRelease) {\n      await this.browserExtensionRelease();\n      this.browserExtensionRelease = null;\n    }\n    this.browserExtensionProvider = null;\n    this.browserExtensionBindKey = null;\n\n    registerClarifyBridge(null);\n    this.agentRunner.disposeClarifyBridge();\n    await disposeAllSessionMcpRuntimes().catch((err) => {\n      log.warn({ err }, 'MCP runtime shutdown failed');\n    });\n    this._agentService?.stop();\n\n    // Unblock `consumeOutbound()` / `consumeInbound()` waiters before stopping channels (CLI agent does the same).\n    this.running = false;\n    this.bus.shutdown();\n\n    this.lastDeferredChannelConnectIds = [];\n    this.lastChannelConnectDeferMode = 'auto';\n    this.lastChannelConnectDeferSource = 'off';\n\n    await this.channelManager.stop();\n\n    // Stop cron service\n    await this.cronService.stop();\n\n    // Tear down rate-limit cleanup timers so the process can exit cleanly.\n    buckets.destroyAll();\n\n    log.debug('Gateway service stopped');\n  }\n\n  /** Start the browser extension WS server when backend is 'extension'. */\n  private async startBrowserExtensionServerIfNeeded(): Promise<void> {\n    await this.reconcileBrowserExtensionServer();\n  }\n\n  /** Release the gateway's hold on the shared extension bridge (does not restart). */\n  async releaseBrowserExtensionBridge(): Promise<void> {\n    if (!this.browserExtensionRelease) return;\n    await this.browserExtensionRelease();\n    this.browserExtensionRelease = null;\n    this.browserExtensionProvider = null;\n    this.browserExtensionBindKey = null;\n    log.debug('Browser extension WS server released');\n  }\n\n  /**\n   * Start/stop/rebind the Chrome extension bridge when `agents.defaults.browser` changes.\n   * PATCH saves update config in memory without re-running gateway startup, so this must run on save too.\n   */\n  async reconcileBrowserExtensionServer(): Promise<void> {\n    const { shouldRunExtensionBridgeServer } = await import('../browser/backend-from-config.js');\n    const wantsExtension = shouldRunExtensionBridgeServer(this.config);\n\n    if (!wantsExtension) {\n      if (this.browserExtensionRelease) {\n        await this.browserExtensionRelease();\n        this.browserExtensionRelease = null;\n        this.browserExtensionProvider = null;\n        this.browserExtensionBindKey = null;\n        log.debug('Browser extension WS server stopped (backend is not extension)');\n      }\n      return;\n    }\n\n    const browser = (this.config.agents?.defaults as Record<string, unknown> | undefined)?.browser as\n      | Record<string, unknown>\n      | undefined;\n    const ext = browser?.extension as Record<string, unknown> | undefined;\n    const port = typeof ext?.port === 'number' ? ext.port : 19820;\n    const host = typeof ext?.host === 'string' && ext.host ? ext.host : '127.0.0.1';\n    const connectionTimeout =\n      typeof ext?.connectionTimeout === 'number' && ext.connectionTimeout >= 1000\n        ? Math.floor(ext.connectionTimeout)\n        : undefined;\n    const cmdSec = browser?.commandTimeout;\n    const commandTimeout =\n      typeof cmdSec === 'number' && Number.isFinite(cmdSec) && cmdSec > 0\n        ? Math.floor(cmdSec * 1000)\n        : undefined;\n    const bindKey = `${host}:${port}`;\n\n    if (this.browserExtensionRelease && this.browserExtensionBindKey === bindKey) {\n      return;\n    }\n\n    if (this.browserExtensionRelease) {\n      await this.browserExtensionRelease();\n      this.browserExtensionRelease = null;\n      this.browserExtensionProvider = null;\n      this.browserExtensionBindKey = null;\n    }\n\n    try {\n      const { acquireExtensionBrowserServer } = await import('../browser/providers/extension-ws-acquire.js');\n      const { provider, release } = await acquireExtensionBrowserServer({\n        port,\n        host,\n        connectionTimeout,\n        commandTimeout,\n      });\n      this.browserExtensionProvider = provider;\n      this.browserExtensionRelease = release;\n      this.browserExtensionBindKey = bindKey;\n      log.info({ port, host }, 'Browser extension WS server started');\n    } catch (err) {\n      const code = err && typeof err === 'object' && 'code' in err ? (err as { code: unknown }).code : undefined;\n      log.error(\n        {\n          err,\n          phase: 'browser_extension_ws',\n          ...(code === 'EADDRINUSE'\n            ? {\n                bindPort: port,\n                bindHost: host,\n                hint: 'Another process holds this port (default 19820). Stop it or set agents.defaults.browser.extension.port.',\n              }\n            : {}),\n        },\n        `Failed to start browser extension WS server: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  /**\n   * Start processing outbound messages and send through channels\n   */\n  private async startOutboundProcessor(): Promise<void> {\n    log.debug('Starting outbound message processor');\n    while (this.running) {\n      try {\n        const msg = await this.bus.consumeOutbound();\n        await this.channelManager.send(msg);\n      } catch (error) {\n        if (error instanceof MessageBusShutdownError) {\n          break;\n        }\n        const em = error instanceof Error ? error.message : String(error);\n        log.error(\n          { err: error, errorMessage: em, phase: 'outbound_consume' },\n          `Outbound pipeline failed (will retry in 1s): ${em}`,\n        );\n        await new Promise((resolve) => setTimeout(resolve, 1000));\n      }\n    }\n  }\n\n  // ── Config persistence / hot reload (delegated to GatewayConfigCoordinator) ──\n\n  reloadHeartbeatFromCurrentConfig(): void {\n    this.configCoordinator.reloadHeartbeatFromCurrentConfig();\n  }\n\n  reloadConfig(): Promise<{ reloaded: boolean; error?: string }> {\n    return this.configCoordinator.reloadConfig();\n  }\n\n  afterWeixinCredentialsPersisted(): Promise<void> {\n    return this.configCoordinator.afterWeixinCredentialsPersisted();\n  }\n\n  afterFeishuCredentialsPersisted(): Promise<void> {\n    return this.configCoordinator.afterFeishuCredentialsPersisted();\n  }\n\n  saveConfig(config: Config): Promise<{ saved: boolean; error?: string }> {\n    return this.configCoordinator.saveConfig(config);\n  }\n\n  setBundledExtensionActivationTarget(\n    extensionId: string,\n    wanted: boolean,\n  ): Promise<{ ok: boolean; error?: string; requiresGatewayRestart: boolean }> {\n    return this.configCoordinator.setBundledExtensionActivationTarget(extensionId, wanted);\n  }\n\n  updateConfig(updates: Partial<Config>): Promise<{ updated: boolean; error?: string }> {\n    return this.configCoordinator.updateConfig(updates);\n  }\n\n  /**\n   * Send message through a channel\n   */\n  async sendMessage(\n    channel: string,\n    chatId: string,\n    content: string\n  ): Promise<{ sent: boolean; messageId?: string }> {\n    try {\n      await this.channelManager.send({\n        channel,\n        chat_id: chatId,\n        content,\n      });\n      const messageId = `msg_${Date.now()}`;\n      this.emit('message.sent', { channel, chatId, messageId });\n      return { sent: true, messageId };\n    } catch (error) {\n      log.error({ channel, chatId, error }, 'Failed to send message');\n      throw error;\n    }\n  }\n\n  /**\n   * Get channel statuses\n   */\n  getChannelsStatus(): Array<{\n    name: string;\n    enabled: boolean;\n    connected: boolean;\n  }> {\n    const runningChannels = new Set(this.channelManager.getRunningChannels());\n    const channels = this.config.channels as Record<string, { enabled?: boolean } | undefined> | undefined;\n    const builtinOrder = CHAT_CHANNEL_ORDER as readonly string[];\n\n    const rows: Array<{ name: string; enabled: boolean; connected: boolean }> = CHAT_CHANNEL_ORDER.map(\n      (name) => ({\n        name,\n        enabled: !!channels?.[name]?.enabled,\n        connected: runningChannels.has(name),\n      }),\n    );\n\n    const extReg = this.extensionLoader?.getRegistry();\n    const extraIds = extReg?.channelPlugins.map((p) => p.id).filter((id) => !builtinOrder.includes(id)) ?? [];\n    if (extraIds.length === 0) {\n      return rows;\n    }\n\n    const seen = new Set(builtinOrder);\n    for (const name of extraIds) {\n      if (seen.has(name)) continue;\n      seen.add(name);\n      rows.push({\n        name,\n        enabled: channels?.[name]?.enabled !== false,\n        connected: runningChannels.has(name),\n      });\n    }\n\n    return rows;\n  }\n\n  /**\n   * Hub metadata for gateway console (built-in registry + registered channel plugins).\n   */\n  getChannelsHubMeta(): Array<{\n    id: string;\n    label: string;\n    description: string;\n    manageable: boolean;\n    order: number;\n  }> {\n    const manageableIds = new Set<string>(['telegram', 'weixin', 'feishu']);\n    const byId = new Map<\n      string,\n      { id: string; label: string; description: string; manageable: boolean; order: number }\n    >();\n\n    for (const plugin of this.channelManager.getAllPlugins()) {\n      byId.set(plugin.id, {\n        id: plugin.id,\n        label: plugin.meta.label,\n        description: plugin.meta.blurb,\n        manageable: manageableIds.has(plugin.id),\n        order: plugin.meta.order ?? 999,\n      });\n    }\n\n    CHAT_CHANNEL_ORDER.forEach((id, index) => {\n      if (byId.has(id)) return;\n      const meta = getChatChannelMeta(id);\n      byId.set(id, {\n        id,\n        label: meta.label,\n        description: meta.description,\n        manageable: true,\n        order: index,\n      });\n    });\n\n    return Array.from(byId.values()).toSorted((a, b) => {\n      if (a.order !== b.order) return a.order - b.order;\n      return a.id.localeCompare(b.id);\n    });\n  }\n\n  /**\n   * Request an immediate heartbeat run (coalesced like interval/cron wakes).\n   */\n  requestHeartbeatNow(opts?: { reason?: string }): void {\n    this.heartbeatService?.requestNow({ reason: opts?.reason ?? 'manual' });\n  }\n\n  /**\n   * Register graceful shutdown used after spawning a replacement gateway process (foreground CLI server).\n   */\n  registerGatewayShutdownForRestart(handler: () => Promise<void>): void {\n    this.gatewayShutdownForRestart = handler;\n  }\n\n  /**\n   * Respawn the gateway process when supported (spawn + exit, supervisor exit, or disabled when XOPC_NO_RESPAWN).\n   */\n  triggerGatewayProcessRestart(): { ok: boolean; mode: string; message?: string } {\n    const result = restartGatewayProcessWithFreshPid();\n    if (result.mode === 'failed') {\n      return { ok: false, mode: result.mode, message: result.detail ?? 'spawn failed' };\n    }\n    if (result.mode === 'disabled') {\n      return {\n        ok: false,\n        mode: 'disabled',\n        message:\n          'Process respawn is disabled (XOPC_NO_RESPAWN). Restart the gateway manually (e.g. xopc gateway restart).',\n      };\n    }\n    const shutdown = this.gatewayShutdownForRestart;\n    if (!shutdown) {\n      return {\n        ok: false,\n        mode: result.mode,\n        message: 'Gateway restart is not available in this process.',\n      };\n    }\n    setImmediate(() => {\n      void shutdown().finally(() => {\n        process.exit(0);\n      });\n    });\n    return { ok: true, mode: result.mode };\n  }\n\n  /**\n   * Get health status\n   */\n  getHealth(): {\n    status: string;\n    service: string;\n    version: string;\n    uptime: number;\n    ready: boolean;\n    httpListening: boolean;\n    startupDurationMs: number | null;\n    channels: { running: number; total: number };\n    configPath: string;\n    logs?: {\n      dir: string;\n      errors24h: number;\n      stats: Record<string, number>;\n    };\n  } {\n    const runningChannels = this.channelManager.getRunningChannels();\n    const allChannels = this.channelManager.getAllChannels();\n    const logStats = getLogStats();\n    const readiness = this.readiness.getSnapshot();\n\n    return {\n      status: 'ok',\n      service: 'xopc-gateway',\n      version: PACKAGE_VERSION,\n      uptime: Math.floor((Date.now() - this.startTime) / 1000),\n      ready: readiness.ready,\n      httpListening: readiness.httpListening,\n      startupDurationMs: readiness.startupDurationMs,\n      channels: {\n        running: runningChannels.length,\n        total: allChannels.length,\n      },\n      configPath: this.configPath,\n      logs: {\n        dir: getLogDir(),\n        errors24h: logStats.errorsLast24h,\n        stats: logStats.byLevel,\n      },\n    };\n  }\n\n  get isRunning(): boolean {\n    return this.running;\n  }\n\n  /**\n   * Get extension registry for external access (HTTP routes, gateway methods)\n   */\n  getExtensionRegistry() {\n    return this.extensionLoader?.getRegistry();\n  }\n\n  /** Extension loader for discovery and frontend asset APIs (may be null if extensions failed to init). */\n  getExtensionLoader(): ExtensionLoader | null {\n    return this.extensionLoader;\n  }\n\n  /**\n   * Get model registry for external access (HTTP routes)\n   */\n  getModelRegistry() {\n    const { getModelRegistry } = require('../providers/index.js');\n    return getModelRegistry();\n  }\n\n  /**\n   * Invoke a gateway method registered by extensions\n   */\n  async invokeGatewayMethod(method: string, params: Record<string, unknown>): Promise<unknown> {\n    const registry = this.getExtensionRegistry();\n    if (!registry) {\n      throw new Error('Extension registry not available');\n    }\n\n    const handler = registry.getGatewayMethod(method);\n    if (!handler) {\n      throw new Error(`Gateway method not found: ${method}`);\n    }\n\n    return await handler(params);\n  }\n\n  get currentConfig(): Config {\n    return this.config;\n  }\n\n  get currentWorkspacePath(): string {\n    return this.workspacePath;\n  }\n\n  get messageBusInstance(): MessageBus {\n    return this.bus;\n  }\n\n  /** Effective HTTP listen port (CLI `--port` override or config default). */\n  getEffectiveListenPort(): number {\n    return resolveEffectiveGatewayPort(this.config, this.serviceConfig.listenPort);\n  }\n\n\n  get cronServiceInstance(): CronService {\n    return this.cronService;\n  }\n\n  get sessionIndexInstance(): SessionIndex {\n    return this.sessionIndex;\n  }\n\n  /** Shared workflow run orchestrator + session bridge (one instance per gateway). */\n  createWorkflowRunService(): WorkflowRunService {\n    if (!this.workflowRunServiceInstance) {\n      this.workflowSessionBridge = new WorkflowSessionBridge(this);\n      this.workflowRunServiceInstance = new WorkflowRunService({\n        service: this,\n        sessionBridge: this.workflowSessionBridge,\n        buildChildTools: buildWorkflowChildTools,\n      });\n    }\n    return this.workflowRunServiceInstance;\n  }\n\n  /** Process a message directly through the agent (for CLI mode). */\n  async processDirect(content: string, sessionKey = 'agent:main:main'): Promise<string> {\n    return this.agentService.turnDispatcher.processDirect(content, sessionKey);\n  }\n\n  // ========== SSE Event System ==========\n\n  subscribe(\n    sessionId: string,\n    listener: (event: ServiceEvent) => Promise<void> | void,\n  ): () => void {\n    return this.sse.subscribe(sessionId, listener);\n  }\n\n  emit(type: string, payload: unknown): void {\n    this.sse.emit(type, payload);\n  }\n\n  /** Replay events since `lastEventId` for SSE reconnection. */\n  getEventsSince(sessionId: string, lastEventId: string): ServiceEvent[] {\n    return this.sse.getEventsSince(sessionId, lastEventId);\n  }\n\n  /**\n   * Validate authentication token from request headers.\n   * Returns true if auth is disabled (mode: 'none') or token is valid.\n   */\n  validateAuth(headers?: Record<string, string | string[] | undefined>): boolean {\n    const token = extractToken(headers);\n    return validateToken(this.auth, token);\n  }\n\n  /**\n   * Get current auth mode.\n   */\n  getAuthMode(): 'none' | 'token' | 'password' | 'trusted-proxy' {\n    return this.auth.mode;\n  }\n\n  /** Resolved gateway auth (mode, credentials, trusted-proxy config). */\n  getResolvedAuth(): ResolvedGatewayAuth {\n    return this.auth;\n  }\n\n  /**\n   * Get current auth token (for CLI server integration).\n   * Returns undefined if mode is not token.\n   */\n  getAuthToken(): string | undefined {\n    return this.auth.mode === 'token' ? this.auth.token : undefined;\n  }\n\n  /**\n   * Refresh (regenerate) the gateway auth token.\n   * Returns the new token.\n   */\n  async refreshAuthToken(): Promise<string> {\n    if (this.auth.mode !== 'token') {\n      throw new Error('Cannot refresh token: auth mode is not token');\n    }\n\n    // Generate new token\n    const newToken = crypto.randomBytes(24).toString('hex');\n    \n    // Update in-memory auth\n    this.auth.token = newToken;\n    \n    // Update config\n    this.config = {\n      ...this.config,\n      gateway: {\n        ...this.config.gateway,\n        auth: {\n          ...this.config.gateway?.auth,\n          mode: 'token',\n          token: newToken,\n        },\n      },\n    };\n    \n    await this.saveConfig(this.config);\n\n    log.info({ tokenPreview: `${newToken.slice(0, 8)}...` }, 'Gateway token refreshed');\n    \n    return newToken;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA4B6D;aACa;YAM9C;sBAG4B;oBAGQ;AA4BhE,MAAM,MAAM,aAAa,iBAAiB;AAE1C,IAAa,iBAAb,MAA4B;CAC1B;CACA;CACA;CACA,gBAA6C;CAC7C;CACA;CACA,kBAAkD;CAClD,4BAA6H;CAC7H,2BAAgH;CAChH,0BAAgE;;CAEhE,0BAAiD;CACjD,mBAAoD;CACpD;CACA,UAAkB;CAClB,YAAoB,KAAK,KAAK;CAC9B;CACA;CAGA;CAEA,MAAuB,IAAI,eAAe;CAE1C,yBAAsD;;CAGtD,4BAAkE;;CAGlE,gCAAkD,EAAE;CACpD,8BAAmE;CACnE,gCAAqE;CAErE,YAA6B,IAAI,kBAAkB;CACnD,eAAmD;CACnD,wBAA8D;CAC9D,6BAAgE;;;;;;CAOhE;;CAGA,IAAI,WAA0B;AAAE,SAAO,KAAK,YAAY;;;;;;;CAOxD;;;;;CAMA;CAEA,YAAY,gBAA8C,EAAE,EAAE;AAA1C,OAAA,gBAAA;AAClB,OAAK,MAAM,IAAI,YAAY;AAC3B,OAAK,aAAa,cAAc,cAAc,mBAAmB;AACjE,OAAK,SAAS,WAAW,KAAK,WAAW;AACzC,MAAI,qBAAqB,KAAK,OAAO,CAC9BA,YAAkB,KAAK,QAAQ,KAAK,WAAW,CAAC,OAAO,QAAQ;GAClE,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,OAAO;IAAmB,cAAc;IAAI,EAAE,0CAA0C,KAAK;IAC7G;AAIJ,OAAK,OAAO,mBAAmB,EAC7B,YAAY,KAAK,OAAO,SAAS,MAClC,CAAC;AAGF,8BAA4B,KAAK,KAAK;AAGtC,gCAA8B,KAAK,KAAK;EAExC,MAAM,cAAc,KAAK,wBAAwB;EACjD,MAAM,gBAAgB,2BAA2B;GAC/C,KAAK,KAAK;GACV,MAAM,KAAK;GACX,cAAc,cAAc;GAC5B,MAAM;GACP,CAAC;AAGF,qBAAmB;GACjB,MAAM,KAAK;GACX,UAAU,cAAc;GACxB,aAAa,cAAc;GAC3B,kBAAkB,cAAc;GAChC,YAAY,cAAc;GAC1B,gBAAgB,KAAK,OAAO,SAAS;GACrC,qBAAqB,KAAK,OAAO,SAAS,wBAAwB;GAClE,0CAA0C,cAAc;GACxD,uBAAuB,+BAA+B,KAAK,OAAO;GAClE,qBAAqB,KAAK,OAAO,SAAS,MAAM,cAAc,KAAA;GAC/D,CAAC;AAGF,MAAI,KAAK,KAAK,SAAS,SAAS;GAC9B,MAAM,eAAe,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO;AAC7E,OAAI,KAAK;IAAE,MAAM,KAAK,KAAK;IAAM,OAAO;IAAc,EAAE,4BAA4B;aAC3E,KAAK,KAAK,SAAS,gBAC5B,KAAI,KACF;GACE,MAAM,KAAK,KAAK;GAChB,YAAY,KAAK,KAAK,cAAc;GACpC,mBAAmB,KAAK,OAAO,SAAS,gBAAgB,UAAU;GACnE,EACD,0CACD;MAED,KAAI,KAAK,EAAE,MAAM,KAAK,KAAK,MAAM,EAAE,4BAA4B;AAIjE,OAAK,iBAAiB,IAAI,eAAe,KAAK,QAAQ,KAAK,IAAI;AAG/D,OAAK,gBAAgB,iBAAiB,KAAK,OAAO,IAAI;AACtD,OAAK,2BAA2B;AAGhC,OAAK,eAAe,IAAI,aAAa,EACnC,QAAQ,KAAK,QACd,CAAC;AAEF,OAAK,cAAc,IAAI,YAAY,EACjC,UAAU,qBAAqB,EAChC,CAAC;AAEF,OAAK,cAAc,IAAI,mBAAmB;GACxC,KAAK,KAAK;GACV,cAAc,KAAK;GACnB,uBAAuB,KAAK,oBAAoB;GAChD,yBAAyB,KAAK;GAC9B,iBAAiB,KAAK;GACtB,OAAO,MAAM,YAAY,KAAK,IAAI,KAAK,MAAM,QAAQ;GACtD,CAAC;AAEF,OAAK,WAAW,IAAI,mBAAmB;GACrC,cAAc,KAAK;GACnB,uBAAuB,KAAK,oBAAoB;GAChD,wBAAwB,OAAO,KAAK,YAAY,eAAe,GAAG;GACnE,CAAC;AAEF,OAAK,cAAc,IAAI,0BAA0B;GAC/C,iBAAiB,KAAK;GACtB,uBAAuB,KAAK,oBAAoB;GAChD,0BAA0B,KAAK;GAC/B,yBAAyB,KAAK;GAC9B,aAAa,QAAQ,KAAK,WAAW,IAAI;GACzC,OAAO,MAAM,YAAY,KAAK,KAAK,MAAM,QAAQ;GAClD,CAAC;AAEF,OAAK,oBAAoB,IAAI,yBAAyB;GACpD,YAAY,KAAK;GACjB,KAAK,KAAK;GACV,iBAAiB,KAAK,cAAc,oBAAoB;GACxD,iBAAiB,KAAK;GACtB,YAAY,SAAS;AAAE,SAAK,SAAS;;GACrC,uBAAuB,KAAK,oBAAoB;GAChD,yBAAyB,KAAK;GAC9B,sBAAsB,KAAK;GAC3B,2BAA2B,KAAK;GAChC,0BAA0B,KAAK;GAC/B,uCAAuC,KAAK,iCAAiC;GAC7E,yBAAyB,KAAK,mBAAmB;GACjD,OAAO,MAAM,YAAY,KAAK,KAAK,MAAM,QAAQ;GAClD,CAAC;;;CAIJ,IAAI,eAA6B;AAC/B,SAAO,KAAK,oBAAoB;;CAGlC,qBAA2C;AACzC,MAAI,KAAK,cACP,QAAO,KAAK;EAGd,MAAM,UAAqC,EAAE,SAAS,KAAK,aAAa;AACxE,OAAK,gBAAgB,IAAI,aAAa,KAAK,KAAK;GAC9C,WAAW,KAAK;GAChB,OAAO,KAAK,OAAO,QAAQ,UAAU,OAAO;GAC5C,QAAQ,KAAK;GACb,cAAc,KAAK,aAAa,UAAU;GAC1C,2BAA2B,eAAe;AACxC,SAAK,aAAa,KAAK,kBAAkB,EAAE,KAAK,YAAY,CAAC;;GAE/D,6BAA6B,eAAe;AAC1C,SAAK,KAAK,8BAA8B,EAAE,KAAK,YAAY,CAAC;;GAE9D,mBAAmB,KAAK,iBAAiB,aAAa;GACtD,sBAAsB,QAAQ;GAC9B,6BAA6B,KAAK,0BAA0B;GAC5D,gBAAgB,EACd,uBAAuB,YAAY,YACjC,KAAK,YAAY,qBAAqB;IACpC;IACA;IACA,gBAAgB,YAAY,MAAkB;AAC5C,UAAK,cAAe,eAAe,uBAAuB,YAAY,EAAE;;IAE3E,CAAC,EACL;GACF,CAAC;AAEF,OAAK,cAAc,kBAAkB,KAAK,eAAe;AACzD,OAAK,eAAe,qBAAqB;GACvC,qBAAqB,OAAO,KAAK,cAAe,mBAAmB,GAAG;GACtE,wBAAwB,IAAI,OAAO,KAAK,cAAe,sBAAsB,IAAI,GAAG;GACrF,CAAC;AAEF,OAAK,YAAY,QAAQ;GACvB,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,kBAAkB,KAAK,wBAAwB;GAC/C,cAAc,KAAK,aAAa,UAAU;GAC1C,6BAA6B,kBAAkB,KAAK,OAAO;GAC3D,oBAAoB,KAAK,0BAA0B;GACpD,CAAC;AACF,UAAQ,UAAU,KAAK;AAEvB,OAAK,cAAc,gBAAgB,iCAAiC,YAAY,YAAY;GAC1F,MAAM,yBAAyB;AAC7B,QAAI,KAAK,cAAe,oBAAoB,WAAW,GAAG,GAAG;AAC3D,gBAAW,kBAAkB,GAAG;AAChC;;AAEF,QAAI,KAAK,YAAY,aAAa,WAAW,EAAE;AAC7C,gBAAW,kBAAkB,GAAG;AAChC;;AAEG,SAAK,YAAY,kCAAkC,YAAY,QAAQ;;AAE9E,kBAAe,iBAAiB;IAChC;AAEF,SAAO,KAAK;;CAGd,yBAAmD;AACjD,MAAI,KAAK,iBACP,QAAO,KAAK;AAEd,OAAK,mBAAmB,IAAI,iBAAiB;GAC3C,cAAc,KAAK,oBAAoB;GACvC,YAAY,KAAK;GACjB,aAAa,KAAK;GAClB,cAAc,KAAK,aAAa,UAAU;GAC1C,iBAAiB,KAAK;GACvB,CAAC;AACF,SAAO,KAAK;;CAKd,oCAAoC,YAAoB,UAAwB;AAC9E,OAAK,YAAY,oCAAoC,YAAY,SAAS;;CAG5E,SACE,GAAG,MACyC;AAC5C,SAAO,KAAK,YAAY,SAAS,GAAG,KAAK;;CAG3C,cAAc,OAAwB;AACpC,SAAO,KAAK,YAAY,cAAc,MAAM;;CAG9C,kBACE,QACA,SACqD;AACrD,SAAO,KAAK,YAAY,kBAAkB,QAAQ,QAAQ;;CAG5D,sBAAsB,WAAmB,QAAyB;AAChE,SAAO,KAAK,YAAY,sBAAsB,WAAW,OAAO;;CAGlE,4BAA0C;AACxC,MAAI;AACF,OAAI,8BAA8B,KAAK,OAAO,EAAE;AAC9C,QAAI,KAAK,gEAAgE;AACzE;;GAGF,MAAM,gBAAgB;IACpB,cAAc,KAAK;IACnB,eAAe,sBAAsB;IACtC;AACD,QAAK,4BAA4B,+BAA+B,eAAe,KAAK,OAAO;AAC3F,QAAK,kBAAkB,IAAI,gBAAgB,cAAc;AACzD,QAAK,gBAAgB,oBAAoB,KAAK,0BAA0B;AACxE,QAAK,gBAAgB,UAAU,KAAK,OAAsD;WACnF,OAAO;AACd,OAAI,KAAK,EAAE,OAAO,EAAE,wCAAwC;;;CAIhE,kCAAgD;AAC9C,MAAI,CAAC,KAAK,gBACR;EAEF,MAAM,MAAM,KAAK,gBAAgB,aAAa;AAC9C,OAAK,MAAM,UAAU,IAAI,eACvB,MAAK,eAAe,eAAe,OAAO;;;;;CAO9C,MAAc,oCAAmD;AAC/D,MAAI,CAAC,KAAK,gBACR;AAEF,MAAI;AACF,SAAM,KAAK,gBAAgB,qBAAqB,EAAE,OAAO,WAAW,CAAC;AACrE,QAAK,iCAAiC;GACtC,MAAM,MAAM,KAAK,gBAAgB,aAAa;AAC9C,OAAI,MACF;IACE,kBAAkB,IAAI,WAAW;IACjC,gBAAgB,IAAI,eAAe;IACpC,EACD,iEACD;WACM,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,0CAA0C;;;CAIhE,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,gBACR;AAEF,MAAI;AACF,SAAM,KAAK,gBAAgB,qBAAqB,EAAE,OAAO,YAAY,CAAC;AACtE,QAAK,iCAAiC;AACtC,OAAI,MAAM,mCAAmC;WACtC,KAAK;AACZ,OAAI,KAAK,EAAE,KAAK,EAAE,qCAAqC;;;CAI3D,4BAA0C;AACxC,uBAAqB;AACd,QAAK,sBAAsB;IAChC;;CAGJ,MAAc,uBAAsC;EAClD,MAAM,QAAQ,KAAK;AACnB,MAAI;AACF,OAAI,MACF,OAAM,MAAM,QAAQ,gCAAgC,sBAAsB,CAAC;OAE3E,OAAM,sBAAsB;WAEvB,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,cAAc;IAAI,OAAO;IAA0B,EAAE,kCAAkC,KAAK;;AAG9G,MAAI,CAAC,KAAK,mBAAmB,8BAA8B,KAAK,OAAO,CACrE;AAGF,MAAI;AACF,OAAI,MACF,OAAM,MAAM,QAAQ,kCAAkC,KAAK,wBAAwB,CAAC;OAEpF,OAAM,KAAK,wBAAwB;WAE9B,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,KAAK;IAAE;IAAK,cAAc;IAAI,OAAO;IAA4B,EAAE,mCAAmC,KAAK;;;CAInH,MAAM,QAAuB;AAC3B,MAAI,KAAK,QAAS;AAElB,2BAAyB,MAAM,YAAY;AACzC,QAAK,KAAK,MAAM,QAAQ;IACxB;AAEF,MAAI,MAAM,8BAA8B;AACxC,OAAK,YAAY,KAAK,KAAK;AAC3B,OAAK,UAAU;AACf,OAAK,eAAe,2BAA2B;AAC/C,OAAK,UAAU,aAAa,KAAK,UAAU;EAC3C,MAAM,QAAQ,KAAK;AAEnB,wBAAsB,KAAK,YAAY,kBAAkB,CAAC;AAE1D,OAAK,oBAAoB;AAEzB,OAAK,eAAe,iBAAiB;GACnC,oBAAoB,IAAI,SAAS,YAC/B,KAAK,aAAa,oBAAoB,6BAA6B,IAAI,SAAS,QAAQ;GAC1F,iBAAiB,IAAI,SAAS,SAAS,OAAO,YAC5C,KAAK,aAAa,oBAAoB,0BAA0B,IAAI,SAAS,SAAS,OAAO,QAAQ;GACxG,CAAC;AACF,OAAK,eAAe,0BAA0B,gBAAgB,KAAK,QAAQ,kBAAkB,KAAK,OAAO,CAAC,CAAC;AAE3G,MAAI,KAAK,gBACP,MAAK,gBAAgB,kBAAkB;GACrC,KAAK,KAAK;GACV,gBAAgB,KAAK;GACrB,8BAA8B,YAAoB,wBAAgC;AAChF,yBAAqB;AACd,UAAK,YAAY,kCAAkC,YAAY,oBAAoB;MACxF;;GAEL,CAAC;AAGJ,QAAM,MAAM,QAAQ,yBAAyB,KAAK,mCAAmC,CAAC;EAEtF,MAAM,eACJ,QAAQ,IAAI,uBAAuB,OACnC,QAAQ,IAAI,uBAAuB,UACnC,QAAQ,IAAI,wBAAwB,OACpC,QAAQ,IAAI,wBAAwB;EAGtC,MAAM,kBAAkB,YAAY,KAAK;EACzC,IAAI,gBAAgB;EACpB,IAAI,cAAc;EAClB,IAAI,uBAAuB;EAC3B,IAAI,mBAAkC;EACtC,IAAI,+BAAe,IAAI,KAAa;AAEpC,MAAI,aACF,KAAI,KAAK,uEAAuE;OAC3E;GACL,MAAM,KAAK,YAAY,KAAK;AAC5B,SAAM,MAAM,QAAQ,6BAA6B,KAAK,eAAe,YAAY,CAAC;AAClF,mBAAgB,YAAY,KAAK,GAAG;GAEpC,MAAM,KAAK,YAAY,KAAK;GAC5B,MAAM,kBAAkB,8BAA8B;IACpD,QAAQ,KAAK;IACb,gBAAgB,KAAK;IACrB,mCAAmC,KAAK,cAAc,sCAAsC;IAC7F,CAAC;AACF,kBAAe,gBAAgB;AAC/B,iBAAc,YAAY,KAAK,GAAG;AAClC,QAAK,gCAAgC,CAAC,GAAG,aAAa;AACtD,QAAK,8BAA8B,gBAAgB;AACnD,QAAK,gCAAgC,gBAAgB;AAErD,OAAI,aAAa,OAAO,EACtB,KAAI,KAAK,EAAE,UAAU,CAAC,GAAG,aAAa,EAAE,EAAE,uDAAuD;GAGnG,MAAM,KAAK,YAAY,KAAK;AAC5B,SAAM,MAAM,QAAQ,wBAClB,KAAK,eAAe,MAClB,aAAa,OAAO,IAAI,EAAE,uBAAuB,cAAc,GAAG,KAAA,EACnE,CACF;AACD,0BAAuB,YAAY,KAAK,GAAG;AAE3C,OAAI,KAAK,cAAc,sCAAsC,MAAM;IACjE,MAAM,KAAK,YAAY,KAAK;AAC5B,UAAM,MAAM,QAAQ,kCAClB,KAAK,eAAe,+BAA+B,CACpD;AACD,uBAAmB,YAAY,KAAK,GAAG;;;EAI3C,MAAM,8BAA8B,YAAY,KAAK,GAAG;EACxD,MAAM,cAAc,KAAK,OAAO,SAAS,2BAA2B;EACpE,MAAM,gBAAoD;GACxD,mCAAmC,KAAK,cAAc,sCAAsC;GAC5F,yBAAyB,KAAK,cAAc,oCACxC,KAAK,8BACL;GACJ,2BAA2B,KAAK;GAChC,oBAAoB,KAAK;GACzB,sBAAsB,KAAK,8BAA8B;GACzD,eAAe,KAAK,MAAM,cAAc;GACxC,aAAa,KAAK,MAAM,YAAY;GACpC,sBAAsB,KAAK,MAAM,qBAAqB;GACtD,kBAAkB,qBAAqB,OAAO,OAAO,KAAK,MAAM,iBAAiB;GACjF,6BAA6B,KAAK,MAAM,4BAA4B;GACrE;AACD,MAAI,KACF;GAAE,OAAO;GAA2B,OAAO;GAAU,GAAG;GAAe,EACvE,2CACD;AAGD,QAAM,MAAM,QAAQ,6BAA6B,KAAK,aAAa,YAAY,CAAC;AAChF,MAAI,MAAM,8BAA8B;AAExC,OAAK,YAAY,QAAQ;GACvB,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,kBAAkB,KAAK,wBAAwB;GAC/C,cAAc,KAAK,aAAa,UAAU;GAC1C,6BAA6B,kBAAkB,KAAK,OAAO;GAC3D,oBAAoB,KAAK,0BAA0B;GACpD,CAAC;AAEF,OAAK,aAAa,GAAG,mBAAmB,SAA0D;AAChG,QAAK,KAAK,mBAAmB;IAAE,KAAK,KAAK;IAAK,MAAM,KAAK;IAAM,MAAM,KAAK;IAAM,CAAC;IACjF;AAGF,MAAI,KAAK,OAAO,MAAM,YAAY,MAChC,OAAM,MAAM,QAAQ,yBAAyB,KAAK,YAAY,YAAY,CAAC;AAG7E,OAAK,wBAAwB,CAAC,MAAM,gCAAgC,KAAK,OAAO,CAAC;AAE5E,SAAO,+CACT,MAAM,EAAE,sCAAsC,gCAAgC,KAAK,OAAO,CAAC,CAC3F,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,EAAE,2CAA2C,CAAC;AAGhF,QAAM,MAAM,QAAQ,iCAAiC,KAAK,qCAAqC,CAAC;AAGhG,OAAK,aAAa,OAAO,CAAC,OAAO,QAAQ;AACvC,OAAI,MAAM,EAAE,KAAK,EAAE,sBAAsB;IACzC;AAGF,MAAI,KAAK,cAAc,sCAAsC,KAC3D,MAAK,wBAAwB,CAAC,OAAO,QAAQ;AAC3C,OAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;IAC9C;AAIJ,MAAI,KAAK,cAAc,oBAAoB,MACzC,MAAK,kBAAkB,kBAAkB;AAG3C,OAAK,yBAAyB,2BAA2B;GACvD,QAAQ,KAAK;GACb,0BAA0B,WAAW;AACnC,SAAK,KAAK,oBAAoB,OAAO;;GAExC,CAAC;AAEF,4BAA0B,KAAK;AAK1B,SAAO,0BACT,MAAM,EAAE,sBAAsB,iBAAiB,CAAC,CAChD,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,EAAE,6BAA6B,CAAC;AAElE,MAAI,KAAK,cAAc,sCAAsC,KAC3D,MAAK,kBAAkB;MAEvB,OAAM,KAAK,gCAAgC;AAG7C,MAAI,MAAM,0BAA0B;;;CAItC,oBAA0B;AACxB,OAAK,UAAU,mBAAmB;AAClC,OAAK,cAAc,KAAK,iBAAiB;;CAG3C,iBAA0B;AACxB,SAAO,KAAK,UAAU,SAAS;;CAGjC,sBAAgD;AAC9C,SAAO,KAAK,UAAU,aAAa;;CAGrC,MAAc,mCAAkD;EAC9D,MAAM,MAAM,QAAQ,IAAI,8BAA8B,MAAM;AAC5D,MAAI,CAAC,IACH;EAEF,MAAM,UAAU,OAAO,SAAS,KAAK,GAAG;AACxC,MAAI,CAAC,OAAO,SAAS,QAAQ,IAAI,WAAW,EAC1C;AAEF,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;;CAG9D,mBAAiC;AAC/B,OAAK,UAAU,WAAW;AAC1B,OAAK,cAAc,KAAK,QAAQ;AAChC,OAAK,2BAA2B;;;CAIlC,MAAc,mCAAkD;EAC9D,MAAM,OAAO,KAAK,wBAAwB;AAC1C,QAAM,oBAAoB,CAAC,UAAU,KAAK,QAAQ,MAAM,KAAK,cAAc,CAAC;;;;;;CAO9E,MAAM,kBAAiC;AACrC,QAAM,KAAK,kCAAkC;AAE7C,MAAI,KAAK,cAAc,sCAAsC,KAC3D;EAEF,MAAM,kBAAkB,YAAY,KAAK;EACzC,MAAM,QAAQ,KAAK;AACnB,MAAI;AACF,SAAM,KAAK,kCAAkC;GAE7C,MAAM,OAAO,YAAY,KAAK;AAC9B,OAAI,MACF,OAAM,MAAM,QAAQ,mCAAmC,KAAK,eAAe,uBAAuB,CAAC;OAEnG,OAAM,KAAK,eAAe,uBAAuB;GAEnD,MAAM,0BAA0B,YAAY,KAAK,GAAG;GAEpD,MAAM,KAAK,YAAY,KAAK;AAC5B,OAAI,MACF,OAAM,MAAM,QAAQ,kCAClB,KAAK,eAAe,+BAA+B,CACpD;OAED,OAAM,KAAK,eAAe,+BAA+B;GAE3D,MAAM,mBAAmB,YAAY,KAAK,GAAG;AAE7C,QAAK,wBAAwB,CAAC,OAAO,QAAQ;AAC3C,QAAI,MAAM,EAAE,KAAK,EAAE,2BAA2B;KAC9C;AACF,QAAK,KAAK,mBAAmB,EAAE,UAAU,KAAK,mBAAmB,EAAE,CAAC;GAEpE,MAAM,yBAAyB,YAAY,KAAK,GAAG;GACnD,MAAM,gBAAoD;IACxD,yBAAyB,KAAK;IAC9B,2BAA2B,KAAK;IAChC,oBAAoB,KAAK;IACzB,yBAAyB,KAAK,MAAM,wBAAwB;IAC5D,kBAAkB,KAAK,MAAM,iBAAiB;IAC9C,wBAAwB,KAAK,MAAM,uBAAuB;IAC3D;AACD,OAAI,KACF;IAAE,OAAO;IAA2B,OAAO;IAAU,GAAG;IAAe,EACvE,4DACD;WACM,KAAK;GACZ,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC3D,OAAI,MACF;IACE;IACA,cAAc;IACd,OAAO;IACP,OAAO;IACP,oBAAoB,KAAK;IACzB,WAAW,KAAK,MAAM,YAAY,KAAK,GAAG,gBAAgB;IAC3D,EACD,sDAAsD,KACvD;YACO;AACR,QAAK,kBAAkB;;;CAI3B,MAAM,OAAsB;AAC1B,MAAI,CAAC,KAAK,QAAS;AAEnB,0BAAwB,KAAK;AAE7B,MAAI,MAAM,8BAA8B;AACxC,OAAK,UAAU,cAAc;AAE7B,QAAM,uBAAuB,CAAC,OAAO,QAAQ;AAC3C,OAAI,KAAK,EAAE,KAAK,EAAE,qCAAqC;IACvD;AAEF,MAAI,KAAK,wBAAwB;AAC/B,QAAK,wBAAwB;AAC7B,QAAK,yBAAyB;;AAGhC,QAAM,KAAK,kBAAkB,iBAAiB;AAG9C,OAAK,kBAAkB,MAAM;AAG7B,MAAI,KAAK,yBAAyB;AAChC,SAAM,KAAK,yBAAyB;AACpC,QAAK,0BAA0B;;AAEjC,OAAK,2BAA2B;AAChC,OAAK,0BAA0B;AAE/B,wBAAsB,KAAK;AAC3B,OAAK,YAAY,sBAAsB;AACvC,QAAM,8BAA8B,CAAC,OAAO,QAAQ;AAClD,OAAI,KAAK,EAAE,KAAK,EAAE,8BAA8B;IAChD;AACF,OAAK,eAAe,MAAM;AAG1B,OAAK,UAAU;AACf,OAAK,IAAI,UAAU;AAEnB,OAAK,gCAAgC,EAAE;AACvC,OAAK,8BAA8B;AACnC,OAAK,gCAAgC;AAErC,QAAM,KAAK,eAAe,MAAM;AAGhC,QAAM,KAAK,YAAY,MAAM;AAG7B,UAAQ,YAAY;AAEpB,MAAI,MAAM,0BAA0B;;;CAItC,MAAc,sCAAqD;AACjE,QAAM,KAAK,iCAAiC;;;CAI9C,MAAM,gCAA+C;AACnD,MAAI,CAAC,KAAK,wBAAyB;AACnC,QAAM,KAAK,yBAAyB;AACpC,OAAK,0BAA0B;AAC/B,OAAK,2BAA2B;AAChC,OAAK,0BAA0B;AAC/B,MAAI,MAAM,uCAAuC;;;;;;CAOnD,MAAM,kCAAiD;EACrD,MAAM,EAAE,mCAAmC,MAAM,OAAO;AAGxD,MAAI,CAFmB,+BAA+B,KAAK,OAExC,EAAE;AACnB,OAAI,KAAK,yBAAyB;AAChC,UAAM,KAAK,yBAAyB;AACpC,SAAK,0BAA0B;AAC/B,SAAK,2BAA2B;AAChC,SAAK,0BAA0B;AAC/B,QAAI,MAAM,iEAAiE;;AAE7E;;EAGF,MAAM,WAAW,KAAK,OAAO,QAAQ,WAAkD;EAGvF,MAAM,MAAM,SAAS;EACrB,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,IAAI,OAAO;EACxD,MAAM,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,IAAI,OAAO;EACpE,MAAM,oBACJ,OAAO,KAAK,sBAAsB,YAAY,IAAI,qBAAqB,MACnE,KAAK,MAAM,IAAI,kBAAkB,GACjC,KAAA;EACN,MAAM,SAAS,SAAS;EACxB,MAAM,iBACJ,OAAO,WAAW,YAAY,OAAO,SAAS,OAAO,IAAI,SAAS,IAC9D,KAAK,MAAM,SAAS,IAAK,GACzB,KAAA;EACN,MAAM,UAAU,GAAG,KAAK,GAAG;AAE3B,MAAI,KAAK,2BAA2B,KAAK,4BAA4B,QACnE;AAGF,MAAI,KAAK,yBAAyB;AAChC,SAAM,KAAK,yBAAyB;AACpC,QAAK,0BAA0B;AAC/B,QAAK,2BAA2B;AAChC,QAAK,0BAA0B;;AAGjC,MAAI;GACF,MAAM,EAAE,kCAAkC,MAAM,OAAO;GACvD,MAAM,EAAE,UAAU,YAAY,MAAM,8BAA8B;IAChE;IACA;IACA;IACA;IACD,CAAC;AACF,QAAK,2BAA2B;AAChC,QAAK,0BAA0B;AAC/B,QAAK,0BAA0B;AAC/B,OAAI,KAAK;IAAE;IAAM;IAAM,EAAE,sCAAsC;WACxD,KAAK;GACZ,MAAM,OAAO,OAAO,OAAO,QAAQ,YAAY,UAAU,MAAO,IAA0B,OAAO,KAAA;AACjG,OAAI,MACF;IACE;IACA,OAAO;IACP,GAAI,SAAS,eACT;KACE,UAAU;KACV,UAAU;KACV,MAAM;KACP,GACD,EAAE;IACP,EACD,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACjG;;;;;;CAOL,MAAc,yBAAwC;AACpD,MAAI,MAAM,sCAAsC;AAChD,SAAO,KAAK,QACV,KAAI;GACF,MAAM,MAAM,MAAM,KAAK,IAAI,iBAAiB;AAC5C,SAAM,KAAK,eAAe,KAAK,IAAI;WAC5B,OAAO;AACd,OAAI,iBAAiB,wBACnB;GAEF,MAAM,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACjE,OAAI,MACF;IAAE,KAAK;IAAO,cAAc;IAAI,OAAO;IAAoB,EAC3D,gDAAgD,KACjD;AACD,SAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAK,CAAC;;;CAO/D,mCAAyC;AACvC,OAAK,kBAAkB,kCAAkC;;CAG3D,eAA+D;AAC7D,SAAO,KAAK,kBAAkB,cAAc;;CAG9C,kCAAiD;AAC/C,SAAO,KAAK,kBAAkB,iCAAiC;;CAGjE,kCAAiD;AAC/C,SAAO,KAAK,kBAAkB,iCAAiC;;CAGjE,WAAW,QAA6D;AACtE,SAAO,KAAK,kBAAkB,WAAW,OAAO;;CAGlD,oCACE,aACA,QAC2E;AAC3E,SAAO,KAAK,kBAAkB,oCAAoC,aAAa,OAAO;;CAGxF,aAAa,SAAyE;AACpF,SAAO,KAAK,kBAAkB,aAAa,QAAQ;;;;;CAMrD,MAAM,YACJ,SACA,QACA,SACgD;AAChD,MAAI;AACF,SAAM,KAAK,eAAe,KAAK;IAC7B;IACA,SAAS;IACT;IACD,CAAC;GACF,MAAM,YAAY,OAAO,KAAK,KAAK;AACnC,QAAK,KAAK,gBAAgB;IAAE;IAAS;IAAQ;IAAW,CAAC;AACzD,UAAO;IAAE,MAAM;IAAM;IAAW;WACzB,OAAO;AACd,OAAI,MAAM;IAAE;IAAS;IAAQ;IAAO,EAAE,yBAAyB;AAC/D,SAAM;;;;;;CAOV,oBAIG;EACD,MAAM,kBAAkB,IAAI,IAAI,KAAK,eAAe,oBAAoB,CAAC;EACzE,MAAM,WAAW,KAAK,OAAO;EAC7B,MAAM,eAAe;EAErB,MAAM,OAAsE,mBAAmB,KAC5F,UAAU;GACT;GACA,SAAS,CAAC,CAAC,WAAW,OAAO;GAC7B,WAAW,gBAAgB,IAAI,KAAK;GACrC,EACF;EAGD,MAAM,YADS,KAAK,iBAAiB,aAAa,GACzB,eAAe,KAAK,MAAM,EAAE,GAAG,CAAC,QAAQ,OAAO,CAAC,aAAa,SAAS,GAAG,CAAC,IAAI,EAAE;AACzG,MAAI,SAAS,WAAW,EACtB,QAAO;EAGT,MAAM,OAAO,IAAI,IAAI,aAAa;AAClC,OAAK,MAAM,QAAQ,UAAU;AAC3B,OAAI,KAAK,IAAI,KAAK,CAAE;AACpB,QAAK,IAAI,KAAK;AACd,QAAK,KAAK;IACR;IACA,SAAS,WAAW,OAAO,YAAY;IACvC,WAAW,gBAAgB,IAAI,KAAK;IACrC,CAAC;;AAGJ,SAAO;;;;;CAMT,qBAMG;EACD,MAAM,gBAAgB,IAAI,IAAY;GAAC;GAAY;GAAU;GAAS,CAAC;EACvE,MAAM,uBAAO,IAAI,KAGd;AAEH,OAAK,MAAM,UAAU,KAAK,eAAe,eAAe,CACtD,MAAK,IAAI,OAAO,IAAI;GAClB,IAAI,OAAO;GACX,OAAO,OAAO,KAAK;GACnB,aAAa,OAAO,KAAK;GACzB,YAAY,cAAc,IAAI,OAAO,GAAG;GACxC,OAAO,OAAO,KAAK,SAAS;GAC7B,CAAC;AAGJ,qBAAmB,SAAS,IAAI,UAAU;AACxC,OAAI,KAAK,IAAI,GAAG,CAAE;GAClB,MAAM,OAAO,mBAAmB,GAAG;AACnC,QAAK,IAAI,IAAI;IACX;IACA,OAAO,KAAK;IACZ,aAAa,KAAK;IAClB,YAAY;IACZ,OAAO;IACR,CAAC;IACF;AAEF,SAAO,MAAM,KAAK,KAAK,QAAQ,CAAC,CAAC,UAAU,GAAG,MAAM;AAClD,OAAI,EAAE,UAAU,EAAE,MAAO,QAAO,EAAE,QAAQ,EAAE;AAC5C,UAAO,EAAE,GAAG,cAAc,EAAE,GAAG;IAC/B;;;;;CAMJ,oBAAoB,MAAkC;AACpD,OAAK,kBAAkB,WAAW,EAAE,QAAQ,MAAM,UAAU,UAAU,CAAC;;;;;CAMzE,kCAAkC,SAAoC;AACpE,OAAK,4BAA4B;;;;;CAMnC,+BAAgF;EAC9E,MAAM,SAAS,mCAAmC;AAClD,MAAI,OAAO,SAAS,SAClB,QAAO;GAAE,IAAI;GAAO,MAAM,OAAO;GAAM,SAAS,OAAO,UAAU;GAAgB;AAEnF,MAAI,OAAO,SAAS,WAClB,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SACE;GACH;EAEH,MAAM,WAAW,KAAK;AACtB,MAAI,CAAC,SACH,QAAO;GACL,IAAI;GACJ,MAAM,OAAO;GACb,SAAS;GACV;AAEH,qBAAmB;AACZ,aAAU,CAAC,cAAc;AAC5B,YAAQ,KAAK,EAAE;KACf;IACF;AACF,SAAO;GAAE,IAAI;GAAM,MAAM,OAAO;GAAM;;;;;CAMxC,YAeE;EACA,MAAM,kBAAkB,KAAK,eAAe,oBAAoB;EAChE,MAAM,cAAc,KAAK,eAAe,gBAAgB;EACxD,MAAM,WAAW,aAAa;EAC9B,MAAM,YAAY,KAAK,UAAU,aAAa;AAE9C,SAAO;GACL,QAAQ;GACR,SAAS;GACT,SAAS;GACT,QAAQ,KAAK,OAAO,KAAK,KAAK,GAAG,KAAK,aAAa,IAAK;GACxD,OAAO,UAAU;GACjB,eAAe,UAAU;GACzB,mBAAmB,UAAU;GAC7B,UAAU;IACR,SAAS,gBAAgB;IACzB,OAAO,YAAY;IACpB;GACD,YAAY,KAAK;GACjB,MAAM;IACJ,KAAK,WAAW;IAChB,WAAW,SAAS;IACpB,OAAO,SAAS;IACjB;GACF;;CAGH,IAAI,YAAqB;AACvB,SAAO,KAAK;;;;;CAMd,uBAAuB;AACrB,SAAO,KAAK,iBAAiB,aAAa;;;CAI5C,qBAA6C;AAC3C,SAAO,KAAK;;;;;CAMd,mBAAmB;EACjB,MAAM,EAAE,sBAAA,gBAAA,EAAA,aAAA,kBAAA;AACR,SAAO,kBAAkB;;;;;CAM3B,MAAM,oBAAoB,QAAgB,QAAmD;EAC3F,MAAM,WAAW,KAAK,sBAAsB;AAC5C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,mCAAmC;EAGrD,MAAM,UAAU,SAAS,iBAAiB,OAAO;AACjD,MAAI,CAAC,QACH,OAAM,IAAI,MAAM,6BAA6B,SAAS;AAGxD,SAAO,MAAM,QAAQ,OAAO;;CAG9B,IAAI,gBAAwB;AAC1B,SAAO,KAAK;;CAGd,IAAI,uBAA+B;AACjC,SAAO,KAAK;;CAGd,IAAI,qBAAiC;AACnC,SAAO,KAAK;;;CAId,yBAAiC;AAC/B,SAAO,4BAA4B,KAAK,QAAQ,KAAK,cAAc,WAAW;;CAIhF,IAAI,sBAAmC;AACrC,SAAO,KAAK;;CAGd,IAAI,uBAAqC;AACvC,SAAO,KAAK;;;CAId,2BAA+C;AAC7C,MAAI,CAAC,KAAK,4BAA4B;AACpC,QAAK,wBAAwB,IAAI,sBAAsB,KAAK;AAC5D,QAAK,6BAA6B,IAAI,mBAAmB;IACvD,SAAS;IACT,eAAe,KAAK;IACpB,iBAAiB;IAClB,CAAC;;AAEJ,SAAO,KAAK;;;CAId,MAAM,cAAc,SAAiB,aAAa,mBAAoC;AACpF,SAAO,KAAK,aAAa,eAAe,cAAc,SAAS,WAAW;;CAK5E,UACE,WACA,UACY;AACZ,SAAO,KAAK,IAAI,UAAU,WAAW,SAAS;;CAGhD,KAAK,MAAc,SAAwB;AACzC,OAAK,IAAI,KAAK,MAAM,QAAQ;;;CAI9B,eAAe,WAAmB,aAAqC;AACrE,SAAO,KAAK,IAAI,eAAe,WAAW,YAAY;;;;;;CAOxD,aAAa,SAAkE;EAC7E,MAAM,QAAQ,aAAa,QAAQ;AACnC,SAAO,cAAc,KAAK,MAAM,MAAM;;;;;CAMxC,cAA+D;AAC7D,SAAO,KAAK,KAAK;;;CAInB,kBAAuC;AACrC,SAAO,KAAK;;;;;;CAOd,eAAmC;AACjC,SAAO,KAAK,KAAK,SAAS,UAAU,KAAK,KAAK,QAAQ,KAAA;;;;;;CAOxD,MAAM,mBAAoC;AACxC,MAAI,KAAK,KAAK,SAAS,QACrB,OAAM,IAAI,MAAM,+CAA+C;EAIjE,MAAM,WAAW,OAAO,YAAY,GAAG,CAAC,SAAS,MAAM;AAGvD,OAAK,KAAK,QAAQ;AAGlB,OAAK,SAAS;GACZ,GAAG,KAAK;GACR,SAAS;IACP,GAAG,KAAK,OAAO;IACf,MAAM;KACJ,GAAG,KAAK,OAAO,SAAS;KACxB,MAAM;KACN,OAAO;KACR;IACF;GACF;AAED,QAAM,KAAK,WAAW,KAAK,OAAO;AAElC,MAAI,KAAK,EAAE,cAAc,GAAG,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,0BAA0B;AAEnF,SAAO"}

package/dist/src/gateway/workspace-fs-file-list.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
+import { readdir } from "node:fs/promises";
 //#region src/gateway/workspace-fs-file-list.ts
 init_logger();
 const log = createLogger("WorkspaceFsFileList");

package/dist/src/infra/restart.js

@@ -1,8 +1,8 @@
+import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 //#region src/infra/restart.ts
 /**
 * Gateway restart coordination — OpenClaw-aligned SIGUSR1 authorization and restart intent.

package/dist/src/infra/update-check.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { channelToNpmTag } from "./update-channels.js";
-import { access, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { access, readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 //#region src/infra/update-check.ts
 init_package_version();

package/dist/src/infra/update-global.js

@@ -1,7 +1,7 @@
 import { createDefaultCommandRunner } from "./run-command.js";
+import path from "node:path";
 import fs from "node:fs";
 import fs$1 from "node:fs/promises";
-import path from "node:path";
 //#region src/infra/update-global.ts
 const XOPC_PACKAGE_NAME = "@xopcai/xopc";
 const COREPACK_ENABLE_DOWNLOAD_PROMPT_DEFAULT = "0";

package/dist/src/infra/update-lock.js

@@ -1,9 +1,9 @@
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
+import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths_state, resolveUpdateLockPath } from "../config/paths-state.js";
-import { mkdir, readFile, unlink } from "node:fs/promises";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { dirname } from "node:path";
+import { mkdir, readFile, unlink } from "node:fs/promises";
 //#region src/infra/update-lock.ts
 init_write_file_atomic();
 init_paths_state();

package/dist/src/infra/update-runner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { access, readdir, unlink } from "node:fs/promises";
 import { join } from "node:path";
+import { access, readdir, unlink } from "node:fs/promises";
 import { spawn } from "node:child_process";
 //#region src/infra/update-runner.ts
 init_logger();

package/dist/src/infra/update-startup.js

@@ -1,8 +1,8 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
-import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
+import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-state.js";
+import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
 import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";

package/dist/src/infra/write-file-atomic.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { randomUUID } from "node:crypto";
+import path from "node:path";
 import { chmodSync, closeSync, copyFileSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { chmod, copyFile, mkdir, open, rename, rm } from "node:fs/promises";
-import path from "node:path";
 //#region src/infra/write-file-atomic.ts
 /**
 * Durable single-file writes: temp file → fsync → rename to target.

package/dist/src/providers/auth-runtime/auth-profile-store.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 //#region src/providers/auth-runtime/auth-profile-store.ts
 /**
 * {@link AuthProfileStore} implementations.

package/dist/src/providers/index.d.ts

@@ -32,7 +32,15 @@ export declare function isProviderConfiguredSync(provider: string): boolean;
 export declare function isProviderConfigured(provider: string): Promise<boolean>;
 /** Where runtime {@link getApiKey} resolves the key from (no secret values). */
 export type ProviderActiveKeySource = 'none' | 'agent' | 'gateway' | 'oauth' | 'env' | 'models_json' | 'extension';
+export type ProviderAuthMode = ProviderActiveKeySource;
+export type ProviderAuthStatus = 'connected' | 'expired' | 'not_connected';
+export interface ProviderAuthState {
+    authMode: ProviderAuthMode;
+    authStatus: ProviderAuthStatus;
+    expiresAt?: number;
+}
 export declare function getProviderActiveKeySource(provider: string): Promise<ProviderActiveKeySource>;
+export declare function getProviderAuthState(provider: string): Promise<ProviderAuthState>;
 export declare function getConfiguredProviders(): Promise<string[]>;
 export declare function getAllModels(): readonly Model<Api>[];
 export declare function getAvailableModels(): Promise<readonly Model<Api>[]>;

package/dist/src/providers/index.js

@@ -1,8 +1,8 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
-import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
-import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
 import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
+import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
+import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";
 import { getModel, getModels, getProviders } from "@earendil-works/pi-ai";
 //#region src/providers/index.ts
@@ -26,6 +26,7 @@ var providers_exports = /* @__PURE__ */ __exportAll({
 	getModelRegistry: () => getModelRegistry,
 	getModelsByProvider: () => getModelsByProvider,
 	getProviderActiveKeySource: () => getProviderActiveKeySource,
+	getProviderAuthState: () => getProviderAuthState,
 	getProviderDisplayName: () => getProviderDisplayName,
 	getSortedProviders: () => getSortedProviders,
 	isProviderConfigured: () => isProviderConfigured,
@@ -139,14 +140,49 @@ async function isProviderConfigured(provider) {
 	return await hasCredentials(provider);
 }
 async function getProviderActiveKeySource(provider) {
-	if (getProviderRegistry().has(provider)) return "extension";
-	const fromCredentials = await new CredentialResolver().resolveApiKeySource(provider);
-	if (fromCredentials === "agent") return "agent";
-	if (fromCredentials === "global") return "gateway";
-	if (fromCredentials === "oauth") return "oauth";
-	if (fromCredentials === "env") return "env";
-	if (getModelRegistry().getApiKey(provider)) return "models_json";
-	return "none";
+	return (await getProviderAuthState(provider)).authMode;
+}
+async function getProviderAuthState(provider) {
+	if (getProviderRegistry().has(provider)) return {
+		authMode: "extension",
+		authStatus: "connected"
+	};
+	const resolver = new CredentialResolver();
+	const fromCredentials = await resolver.resolveApiKeySource(provider);
+	if (fromCredentials === "agent") return {
+		authMode: "agent",
+		authStatus: "connected"
+	};
+	if (fromCredentials === "global") return {
+		authMode: "gateway",
+		authStatus: "connected"
+	};
+	if (fromCredentials === "oauth") {
+		const token = await resolver.loadOAuthTokenRecord(provider);
+		return {
+			authMode: "oauth",
+			authStatus: Boolean(token?.expiresAt && token.expiresAt < Date.now()) ? "expired" : "connected",
+			...token?.expiresAt ? { expiresAt: token.expiresAt } : {}
+		};
+	}
+	if (fromCredentials === "env") return {
+		authMode: "env",
+		authStatus: "connected"
+	};
+	const expiredOAuthToken = await resolver.loadOAuthTokenRecord(provider);
+	if (expiredOAuthToken?.expiresAt && expiredOAuthToken.expiresAt < Date.now()) return {
+		authMode: "oauth",
+		authStatus: "expired",
+		expiresAt: expiredOAuthToken.expiresAt
+	};
+	if (getModelRegistry().getApiKey(provider)) return {
+		authMode: "models_json",
+		authStatus: "connected"
+	};
+	return {
+		authMode: "none",
+		authStatus: "not_connected"
+	};
 }
 async function getConfiguredProviders() {
 	const allProviders = getAllProviders();
@@ -412,7 +448,8 @@ var init_providers = __esmMin((() => {
 		"github-copilot": {
 			name: "GitHub Copilot (OAuth)",
 			category: "oauth",
-			supportsOAuth: true
+			supportsOAuth: true,
+			supportsApiKey: false
 		},
 		"openai-codex": {
 			name: "OpenAI Codex (OAuth)",
@@ -423,18 +460,20 @@ var init_providers = __esmMin((() => {
 		"google-gemini-cli": {
 			name: "Google Gemini CLI (OAuth)",
 			category: "oauth",
-			supportsOAuth: true
+			supportsOAuth: true,
+			supportsApiKey: false
 		},
 		"google-antigravity": {
 			name: "Google Antigravity (OAuth)",
 			category: "oauth",
-			supportsOAuth: true
+			supportsOAuth: true,
+			supportsApiKey: false
 		}
 	};
 	DEFAULT_FALLBACK_MODEL = "deepseek/deepseek-v4-flash";
 }));
 //#endregion
 init_providers();
-export { EXTENSION_PROVIDER_BASE_URL, ModelRegistry, PROVIDER_ENV_MAP, PROVIDER_META, getAllModels, getAllProviders, getApiKey, getApiKeyFromEnv, getApiKeySync, getAvailableModels, getConfiguredProviders, getDefaultModel, getDefaultModelSync, getModelRegistry, getModelsByProvider, getProviderActiveKeySource, getProviderDisplayName, getSortedProviders, init_providers, isProviderConfigured, isProviderConfiguredSync, pluginModelToModel, prewarmModelRegistry, providerSupportsApiKey, providerSupportsOAuth, providers_exports, resetModelRegistry, resolveModel };
+export { EXTENSION_PROVIDER_BASE_URL, ModelRegistry, PROVIDER_ENV_MAP, PROVIDER_META, getAllModels, getAllProviders, getApiKey, getApiKeyFromEnv, getApiKeySync, getAvailableModels, getConfiguredProviders, getDefaultModel, getDefaultModelSync, getModelRegistry, getModelsByProvider, getProviderActiveKeySource, getProviderAuthState, getProviderDisplayName, getSortedProviders, init_providers, isProviderConfigured, isProviderConfiguredSync, pluginModelToModel, prewarmModelRegistry, providerSupportsApiKey, providerSupportsOAuth, providers_exports, resetModelRegistry, resolveModel };
 
 //# sourceMappingURL=index.js.map