@xopcai/xopc 0.0.89 → 0.0.91

package/dist/src/gateway/agents-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-admin.js","names":["pathResolve"],"sources":["../../../src/gateway/agents-admin.ts"],"sourcesContent":["/**\n * Gateway REST helpers for multi-agent management.\n */\n\nimport { mkdir, readFile, realpath, stat, unlink, writeFile } from 'node:fs/promises';\nimport { join, resolve as pathResolve } from 'node:path';\n\nimport {\n  DEFAULT_AGENT_ID,\n  listAgentEntries,\n  normalizeAgentId,\n  resolveAgentDir,\n  resolveAgentProfileDir,\n  resolveAgentWorkspaceDir,\n  resolveDefaultAgentId,\n  resolveUserPath,\n  validateAgentIdForNewAgent,\n} from '../agent/agent-scope.js';\nimport { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES } from '../agent/context/workspace.js';\nimport { seedAgentProfileMarkdownFiles } from '../agent/context/workspace-seed.js';\nimport {\n  applyAgentConfig,\n  findAgentEntryIndex,\n  pruneAgentConfig,\n  removeAgentDirsFromDisk,\n} from '../commands/agents.config.js';\nimport type { Config } from '../config/schema.js';\nimport { WORKSPACE_FILES } from '../config/paths.js';\nimport { resolveEffectiveAgentProfile } from '../config/agent-profile.js';\nimport { resolveEffectiveTypedModels } from '../config/agent-typed-models.js';\nimport type { AgentTypedModel } from '../config/schema.js';\nimport { normalizePatchTypedModels } from './hono/lib/agent-model.js';\nimport { GATEWAY_BUILTIN_TOOL_IDS } from './agent-builtin-tools.js';\nimport { isPathUnderWorkspace, resolveWorkspaceSafePath } from './workspace-editor-path.js';\n\nconst EDITABLE_PROFILE_MARKDOWN_NAMES = new Set<string>([\n  ...AGENT_PROFILE_MARKDOWN_SYSTEM_FILES,\n  WORKSPACE_FILES.BOOTSTRAP,\n]);\n\nexport type GatewayAgentTypedModelsInfo = {\n  defaults: AgentTypedModel[];\n  entry?: AgentTypedModel[];\n  effective: AgentTypedModel[];\n};\n\nexport type GatewayAgentRow = {\n  id: string;\n  name?: string;\n  description?: string;\n  /** Value from `IDENTITY.md` **Avatar:** line when present (may be URL, `xopc:…`, etc.). */\n  avatar?: string;\n  workspace: string;\n  /** Absolute directory for profile Markdown (`SOUL.md`, …) and gateway avatars: `agents/<id>/profile/`. */\n  profileDir: string;\n  model?: { primary?: string; fallbacks?: string[] };\n  typedModels: GatewayAgentTypedModelsInfo;\n  isDefault: boolean;\n  skills: {\n    defaults: string[];\n    entry?: string[];\n    effectiveAllowlist?: string[];\n  };\n  tools: {\n    defaultsDisable: string[];\n    entryDisable: string[];\n    effectiveDisable: string[];\n  };\n};\n\nexport type GatewayAgentsListResponse = {\n  defaultId: string;\n  agents: GatewayAgentRow[];\n  builtinToolIds: string[];\n};\n\nfunction collectAgentIdsForList(cfg: Config): string[] {\n  const entries = listAgentEntries(cfg).filter((e) => e.enabled !== false);\n  const defaultId = resolveDefaultAgentId(cfg);\n  if (entries.length === 0) {\n    return [defaultId];\n  }\n  const ids = new Set<string>();\n  for (const e of entries) {\n    ids.add(normalizeAgentId(e.id));\n  }\n  ids.add(defaultId);\n  return [...ids];\n}\n\n/** Extract `**Avatar:**` value from profile IDENTITY.md (same line shape as the gateway console parser). */\nexport function extractAvatarFromIdentityMarkdown(content: string): string | undefined {\n  for (const line of content.split('\\n')) {\n    const match = line.match(/^[-*]\\s+\\*\\*Avatar:\\*\\*\\s*(.*)/i);\n    if (match) {\n      const v = match[1]?.trim() ?? '';\n      return v.length > 0 ? v : undefined;\n    }\n  }\n  return undefined;\n}\n\nexport async function listGatewayAgents(cfg: Config): Promise<GatewayAgentsListResponse> {\n  const defaultId = resolveDefaultAgentId(cfg);\n  const agents: GatewayAgentRow[] = [];\n  const defaultsSkills = cfg.agents?.defaults?.skills;\n  const defaultsDisable = cfg.agents?.defaults?.tools?.disable ?? [];\n  const defaultsTypedModels = cfg.agents?.defaults?.models ?? [];\n  for (const id of collectAgentIdsForList(cfg)) {\n    const profile = resolveEffectiveAgentProfile(cfg, id);\n    const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);\n    const model =\n      profile.primaryModelRef || profile.fallbacks.length > 0\n        ? {\n            ...(profile.primaryModelRef ? { primary: profile.primaryModelRef } : {}),\n            ...(profile.fallbacks.length > 0 ? { fallbacks: profile.fallbacks } : {}),\n          }\n        : undefined;\n    const entrySkills = entry?.skills;\n    const entryDisable = entry?.tools?.disable ?? [];\n    const entryTypedModels = entry?.models;\n    const effectiveTypedMap = resolveEffectiveTypedModels(cfg, id);\n    const effectiveTypedModels = [...effectiveTypedMap.values()];\n    let avatar: string | undefined;\n    try {\n      const identityPath = join(resolveAgentProfileDir(cfg, id), WORKSPACE_FILES.IDENTITY);\n      const content = await readFile(identityPath, 'utf-8');\n      avatar = extractAvatarFromIdentityMarkdown(content);\n    } catch {\n      /* missing IDENTITY.md or unreadable */\n    }\n    agents.push({\n      id,\n      ...(entry?.name?.trim() ? { name: entry.name.trim() } : {}),\n      ...(entry?.description?.trim() ? { description: entry.description.trim() } : {}),\n      ...(avatar ? { avatar } : {}),\n      workspace: profile.resolvedWorkspacePath,\n      profileDir: resolveAgentProfileDir(cfg, id),\n      ...(model ? { model } : {}),\n      typedModels: {\n        defaults: [...defaultsTypedModels],\n        ...(entryTypedModels !== undefined ? { entry: [...entryTypedModels] } : {}),\n        effective: effectiveTypedModels,\n      },\n      isDefault: id === defaultId,\n      skills: {\n        defaults: defaultsSkills ? [...defaultsSkills] : [],\n        ...(entrySkills !== undefined ? { entry: [...entrySkills] } : {}),\n        ...(profile.skillsAllowlist !== undefined\n          ? { effectiveAllowlist: [...profile.skillsAllowlist] }\n          : {}),\n      },\n      tools: {\n        defaultsDisable: [...defaultsDisable],\n        entryDisable: [...entryDisable],\n        effectiveDisable: [...profile.tools.disable].sort((a, b) => a.localeCompare(b)),\n      },\n    });\n  }\n  agents.sort((a, b) => a.id.localeCompare(b.id));\n  return { defaultId, agents, builtinToolIds: [...GATEWAY_BUILTIN_TOOL_IDS] };\n}\n\nexport type CreateAgentBody = {\n  /** Display name stored on the agent entry. */\n  name: string;\n  /** Optional id seed; normalized agent id defaults from `name` when omitted. */\n  id?: string;\n  workspace: string;\n  model?: string;\n  agentDir?: string;\n  description?: string;\n  /** Initial `agents.list[].tools.disable` for the new entry. */\n  toolsDisable?: string[];\n  /** Profile markdown files to write after seeding (e.g. `IDENTITY.md`, `SOUL.md`). */\n  profileFiles?: Record<string, string>;\n};\n\nexport type AgentAdminHttpStatus = 400 | 404 | 409;\n\nexport type AgentAdminResult<T> =\n  | { ok: true; data: T }\n  | { ok: false; error: string; status?: AgentAdminHttpStatus };\n\nfunction requireNonMain(id: string): AgentAdminResult<never> | null {\n  if (normalizeAgentId(id) === DEFAULT_AGENT_ID) {\n    return { ok: false, error: `\"${DEFAULT_AGENT_ID}\" is reserved`, status: 400 };\n  }\n  return null;\n}\n\nexport function prepareCreateAgent(\n  cfg: Config,\n  body: CreateAgentBody,\n): AgentAdminResult<{ nextConfig: Config; agentId: string; workspace: string }> {\n  const name = body.name?.trim() ?? '';\n  if (!name) {\n    return { ok: false, error: 'name is required', status: 400 };\n  }\n  const workspace = body.workspace?.trim() ?? '';\n  if (!workspace) {\n    return { ok: false, error: 'workspace is required', status: 400 };\n  }\n  const idRes = validateAgentIdForNewAgent(body.id, name);\n  if (idRes.ok === false) {\n    return { ok: false, error: idRes.error, status: 400 };\n  }\n  const agentId = idRes.agentId;\n  if (findAgentEntryIndex(listAgentEntries(cfg), agentId) >= 0) {\n    return { ok: false, error: `agent \"${agentId}\" already exists`, status: 409 };\n  }\n  if (body.profileFiles !== undefined) {\n    if (typeof body.profileFiles !== 'object' || body.profileFiles === null || Array.isArray(body.profileFiles)) {\n      return { ok: false, error: 'profileFiles must be an object', status: 400 };\n    }\n    for (const [name, content] of Object.entries(body.profileFiles)) {\n      const bad = assertAllowedFile(name);\n      if (bad) {\n        return bad;\n      }\n      if (typeof content !== 'string') {\n        return { ok: false, error: `profileFiles[\"${name}\"] must be a string`, status: 400 };\n      }\n    }\n  }\n\n  const wsAbs = resolveUserPath(workspace);\n  let next = applyAgentConfig(cfg, {\n    agentId,\n    name,\n    workspace: wsAbs,\n    ...(body.model?.trim() ? { model: body.model.trim() } : {}),\n    ...(body.agentDir?.trim() ? { agentDir: body.agentDir.trim() } : {}),\n    ...(body.description?.trim() ? { description: body.description.trim() } : {}),\n  });\n\n  if (body.toolsDisable !== undefined) {\n    const list = [...listAgentEntries(next)];\n    const idx = findAgentEntryIndex(list, agentId);\n    if (idx >= 0) {\n      type Entry = (typeof list)[number];\n      const entry: Entry = { ...list[idx] };\n      const disable = body.toolsDisable.map((s) => String(s).trim()).filter(Boolean);\n      entry.tools = { ...entry.tools, disable };\n      list[idx] = entry;\n      next = {\n        ...next,\n        agents: {\n          ...next.agents,\n          list,\n        },\n      };\n    }\n  }\n\n  return { ok: true, data: { nextConfig: next, agentId, workspace: wsAbs } };\n}\n\nexport type PreparedBatchCreateAgent = {\n  agentId: string;\n  profileFiles?: Record<string, string>;\n};\n\nexport function prepareCreateAgentsBatch(\n  cfg: Config,\n  bodies: CreateAgentBody[],\n): AgentAdminResult<{ nextConfig: Config; created: PreparedBatchCreateAgent[] }> {\n  if (!Array.isArray(bodies) || bodies.length === 0) {\n    return { ok: false, error: 'agents must be a non-empty array', status: 400 };\n  }\n  let next = cfg;\n  const created: PreparedBatchCreateAgent[] = [];\n  for (const body of bodies) {\n    const prep = prepareCreateAgent(next, body);\n    if (prep.ok === false) {\n      return prep;\n    }\n    next = prep.data.nextConfig;\n    created.push({\n      agentId: prep.data.agentId,\n      ...(body.profileFiles !== undefined ? { profileFiles: body.profileFiles } : {}),\n    });\n  }\n  return { ok: true, data: { nextConfig: next, created } };\n}\n\nexport async function finalizeCreateAgentDirs(\n  cfg: Config,\n  agentId: string,\n  opts?: { profileFiles?: Record<string, string> },\n): Promise<AgentAdminResult<void>> {\n  const wsPath = resolveAgentWorkspaceDir(cfg, agentId);\n  const profilePath = resolveAgentProfileDir(cfg, agentId);\n  const adPath = resolveAgentDir(cfg, agentId);\n  await mkdir(wsPath, { recursive: true });\n  await mkdir(profilePath, { recursive: true });\n  await mkdir(adPath, { recursive: true });\n  const id = normalizeAgentId(agentId);\n  const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);\n  const displayName = entry?.name?.trim() || id;\n  seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName });\n\n  const profileFiles = opts?.profileFiles;\n  if (profileFiles && Object.keys(profileFiles).length > 0) {\n    for (const [name, content] of Object.entries(profileFiles)) {\n      const written = await writeAgentProfileFile(cfg, agentId, name, content);\n      if (written.ok === false) {\n        return written;\n      }\n    }\n  }\n\n  return { ok: true, data: undefined };\n}\n\nexport type UpdateAgentBody = {\n  name?: string;\n  description?: string | null;\n  workspace?: string;\n  model?: string | null;\n  agentDir?: string | null;\n  setDefault?: boolean;\n  /** Replace `agents.list[].skills`; `null` removes the key (inherit defaults). */\n  skills?: string[] | null;\n  /** Replace `agents.list[].tools.disable`; `null` clears entry-level disables. */\n  toolsDisable?: string[] | null;\n  /** Replace `agents.list[].models`; `null` removes entry overrides (inherit defaults). */\n  models?: AgentTypedModel[] | null;\n};\n\nexport function prepareUpdateAgent(\n  cfg: Config,\n  agentIdRaw: string,\n  body: UpdateAgentBody,\n): AgentAdminResult<{ nextConfig: Config }> {\n  const agentId = normalizeAgentId(agentIdRaw);\n  let list = [...listAgentEntries(cfg)];\n  let idx = findAgentEntryIndex(list, agentId);\n  if (idx < 0 && agentId === resolveDefaultAgentId(cfg)) {\n    list = [...list, { id: agentId, enabled: true as const }];\n    idx = list.length - 1;\n  }\n  if (idx < 0) {\n    return { ok: false, error: `agent \"${agentId}\" not found`, status: 404 };\n  }\n\n  type Entry = (typeof list)[number];\n  const entry: Entry = { ...list[idx] };\n\n  if (body.name !== undefined) {\n    const n = body.name.trim();\n    if (n) {\n      entry.name = n;\n    }\n  }\n  if (body.description !== undefined) {\n    if (body.description === null || String(body.description).trim() === '') {\n      delete entry.description;\n    } else {\n      entry.description = String(body.description).trim();\n    }\n  }\n  if (body.workspace !== undefined) {\n    const w = body.workspace.trim();\n    if (w) {\n      entry.workspace = resolveUserPath(w);\n    }\n  }\n  if (body.model !== undefined) {\n    if (body.model === null) {\n      delete entry.model;\n    } else {\n      const trimmed = String(body.model).trim();\n      if (!trimmed) {\n        return { ok: false, error: 'model must be a non-empty string or null', status: 400 };\n      }\n      entry.model = { primary: trimmed };\n    }\n  }\n  if (body.agentDir !== undefined) {\n    if (body.agentDir === null || String(body.agentDir).trim() === '') {\n      delete entry.agentDir;\n    } else {\n      entry.agentDir = String(body.agentDir).trim();\n    }\n  }\n\n  if (body.skills !== undefined) {\n    if (body.skills === null) {\n      delete entry.skills;\n    } else {\n      const next = body.skills.map((s) => String(s).trim()).filter(Boolean);\n      if (next.length === 0) {\n        entry.skills = [];\n      } else {\n        entry.skills = next;\n      }\n    }\n  }\n\n  if (body.toolsDisable !== undefined) {\n    if (body.toolsDisable === null) {\n      if (entry.tools) {\n        delete entry.tools.disable;\n        if (Object.keys(entry.tools).length === 0) {\n          delete entry.tools;\n        }\n      }\n    } else {\n      const next = body.toolsDisable.map((s) => String(s).trim()).filter(Boolean);\n      entry.tools = { ...entry.tools, disable: next };\n    }\n  }\n\n  if (body.models !== undefined) {\n    if (body.models === null) {\n      delete entry.models;\n    } else {\n      const normalized = normalizePatchTypedModels(body.models);\n      if (normalized === null || normalized === undefined) {\n        delete entry.models;\n      } else {\n        entry.models = normalized;\n      }\n    }\n  }\n\n  list[idx] = entry;\n  let next: Config = {\n    ...cfg,\n    agents: {\n      ...cfg.agents,\n      list,\n    },\n  };\n\n  if (body.setDefault === true) {\n    next = {\n      ...next,\n      agents: {\n        ...next.agents,\n        default: agentId,\n      },\n    };\n  }\n  return { ok: true, data: { nextConfig: next } };\n}\n\nexport function prepareDeleteAgent(\n  cfg: Config,\n  agentIdRaw: string,\n): AgentAdminResult<{ nextConfig: Config; agentId: string }> {\n  const agentId = normalizeAgentId(agentIdRaw);\n  const reserved = requireNonMain(agentId);\n  if (reserved) {\n    return reserved;\n  }\n  if (findAgentEntryIndex(listAgentEntries(cfg), agentId) < 0) {\n    return { ok: false, error: `agent \"${agentId}\" not found`, status: 404 };\n  }\n  const { config: pruned } = pruneAgentConfig(cfg, agentId);\n  return { ok: true, data: { nextConfig: pruned, agentId } };\n}\n\nexport async function runAfterDeletePurge(cfg: Config, agentId: string): Promise<void> {\n  await removeAgentDirsFromDisk(cfg, agentId);\n}\n\nexport type AgentFileEntry = {\n  name: string;\n  missing: boolean;\n  size?: number;\n  updatedAtMs?: number;\n};\n\nasync function profileMarkdownRootReal(cfg: Config, agentId: string): Promise<string> {\n  const dir = resolveAgentProfileDir(cfg, agentId);\n  await mkdir(dir, { recursive: true });\n  try {\n    return await realpath(dir);\n  } catch {\n    return pathResolve(dir);\n  }\n}\n\nfunction assertAllowedFile(name: string): AgentAdminResult<never> | null {\n  if (!name || name.includes('/') || name.includes('\\\\') || !EDITABLE_PROFILE_MARKDOWN_NAMES.has(name)) {\n    return { ok: false, error: `unsupported file \"${name}\"`, status: 400 };\n  }\n  return null;\n}\n\nexport async function listAgentProfileFiles(\n  cfg: Config,\n  agentId: string,\n): Promise<AgentAdminResult<{ agentId: string; profileDir: string; files: AgentFileEntry[] }>> {\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const names = [...EDITABLE_PROFILE_MARKDOWN_NAMES];\n  const files: AgentFileEntry[] = [];\n  for (const name of names.sort((a, b) => a.localeCompare(b))) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs) {\n      continue;\n    }\n    try {\n      const st = await stat(abs);\n      if (!st.isFile()) {\n        continue;\n      }\n      files.push({\n        name,\n        missing: false,\n        size: st.size,\n        updatedAtMs: st.mtimeMs,\n      });\n    } catch {\n      files.push({ name, missing: true });\n    }\n  }\n  files.sort((a, b) => a.name.localeCompare(b.name));\n  return { ok: true, data: { agentId: id, profileDir: root, files } };\n}\n\nexport async function readAgentProfileFile(\n  cfg: Config,\n  agentId: string,\n  name: string,\n): Promise<AgentAdminResult<{ agentId: string; content: string; path: string }>> {\n  const bad = assertAllowedFile(name);\n  if (bad) {\n    return bad;\n  }\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const abs = resolveWorkspaceSafePath(root, name);\n  if (!abs) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  try {\n    const content = await readFile(abs, 'utf-8');\n    return { ok: true, data: { agentId: id, content, path: abs } };\n  } catch {\n    return { ok: false, error: 'file not found', status: 404 };\n  }\n}\n\nexport async function writeAgentProfileFile(\n  cfg: Config,\n  agentId: string,\n  name: string,\n  content: string,\n): Promise<AgentAdminResult<{ agentId: string; path: string }>> {\n  const bad = assertAllowedFile(name);\n  if (bad) {\n    return bad;\n  }\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const abs = resolveWorkspaceSafePath(root, name);\n  if (!abs) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  if (!isPathUnderWorkspace(rootReal, abs)) {\n    return { ok: false, error: 'path escapes profile markdown root', status: 400 };\n  }\n  await writeFile(abs, content, 'utf-8');\n  return { ok: true, data: { agentId: id, path: abs } };\n}\n\n// ---------------------------------------------------------------------------\n// Binary agent avatar (profile markdown root dir, not a SOUL/IDENTITY markdown file)\n// ---------------------------------------------------------------------------\n\nconst AGENT_AVATAR_MAX_BYTES = 512 * 1024;\nconst AGENT_AVATAR_BASENAME = 'agent-avatar';\n\nconst AGENT_AVATAR_EXTENSIONS = ['.png', '.jpg', '.jpeg', '.webp'] as const;\n\nfunction agentAvatarFilenames(): string[] {\n  return AGENT_AVATAR_EXTENSIONS.map((ext) => `${AGENT_AVATAR_BASENAME}${ext}`);\n}\n\nfunction mimeToExt(mime: string): '.png' | '.jpg' | '.jpeg' | '.webp' | null {\n  const m = mime.toLowerCase().trim();\n  if (m === 'image/png') return '.png';\n  if (m === 'image/jpeg' || m === 'image/jpg') return '.jpg';\n  if (m === 'image/webp') return '.webp';\n  return null;\n}\n\nfunction detectImageMimeFromBytes(buf: Uint8Array): 'image/png' | 'image/jpeg' | 'image/webp' | null {\n  if (buf.length >= 8 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {\n    return 'image/png';\n  }\n  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {\n    return 'image/jpeg';\n  }\n  if (\n    buf.length >= 12 &&\n    buf[0] === 0x52 &&\n    buf[1] === 0x49 &&\n    buf[2] === 0x46 &&\n    buf[3] === 0x46 &&\n    buf[8] === 0x57 &&\n    buf[9] === 0x45 &&\n    buf[10] === 0x42 &&\n    buf[11] === 0x50\n  ) {\n    return 'image/webp';\n  }\n  return null;\n}\n\nfunction assertAgentExistsForAvatar(cfg: Config, id: string): AgentAdminResult<never> | null {\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  return null;\n}\n\nexport async function readAgentAvatarFile(\n  cfg: Config,\n  agentId: string,\n): Promise<AgentAdminResult<{ agentId: string; buffer: Buffer; contentType: string; path: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const root = await profileMarkdownRootReal(cfg, id);\n  for (const name of agentAvatarFilenames()) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs) {\n      continue;\n    }\n    try {\n      const st = await stat(abs);\n      if (!st.isFile() || st.size <= 0 || st.size > AGENT_AVATAR_MAX_BYTES) {\n        continue;\n      }\n      const buffer = await readFile(abs);\n      const detected = detectImageMimeFromBytes(buffer);\n      if (!detected) {\n        continue;\n      }\n      return { ok: true, data: { agentId: id, buffer, contentType: detected, path: abs } };\n    } catch {\n      /* try next */\n    }\n  }\n  return { ok: false, error: 'avatar not found', status: 404 };\n}\n\nexport async function writeAgentAvatarFromBase64(\n  cfg: Config,\n  agentId: string,\n  base64: string,\n  mimeType: string,\n): Promise<AgentAdminResult<{ agentId: string; path: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const ext = mimeToExt(mimeType);\n  if (!ext) {\n    return { ok: false, error: 'unsupported mimeType (use image/png, image/jpeg, or image/webp)', status: 400 };\n  }\n  let raw: Buffer;\n  try {\n    raw = Buffer.from(base64, 'base64');\n  } catch {\n    return { ok: false, error: 'invalid base64', status: 400 };\n  }\n  if (raw.length === 0 || raw.length > AGENT_AVATAR_MAX_BYTES) {\n    return { ok: false, error: `avatar must be non-empty and at most ${AGENT_AVATAR_MAX_BYTES} bytes`, status: 400 };\n  }\n  const detected = detectImageMimeFromBytes(raw);\n  if (!detected || !extMatchesDetectedMime(ext, detected)) {\n    return { ok: false, error: 'file content does not match declared image type', status: 400 };\n  }\n\n  const root = await profileMarkdownRootReal(cfg, id);\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  const targetName = `${AGENT_AVATAR_BASENAME}${ext}`;\n  const abs = resolveWorkspaceSafePath(root, targetName);\n  if (!abs || !isPathUnderWorkspace(rootReal, abs)) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  for (const name of agentAvatarFilenames()) {\n    if (name === targetName) {\n      continue;\n    }\n    const other = resolveWorkspaceSafePath(root, name);\n    if (other && isPathUnderWorkspace(rootReal, other)) {\n      try {\n        await unlink(other);\n      } catch {\n        /* absent */\n      }\n    }\n  }\n  await writeFile(abs, raw);\n  return { ok: true, data: { agentId: id, path: abs } };\n}\n\nfunction mimeToExtToMime(ext: '.png' | '.jpg' | '.jpeg' | '.webp'): 'image/png' | 'image/jpeg' | 'image/webp' {\n  if (ext === '.png') return 'image/png';\n  if (ext === '.webp') return 'image/webp';\n  return 'image/jpeg';\n}\n\nfunction extMatchesDetectedMime(\n  ext: '.png' | '.jpg' | '.jpeg' | '.webp',\n  detected: 'image/png' | 'image/jpeg' | 'image/webp',\n): boolean {\n  return detected === mimeToExtToMime(ext);\n}\n\n/** Remove any `agent-avatar.*` in the agent profile markdown root. Idempotent: ok even when no file existed. */\nexport async function deleteAgentAvatarFile(cfg: Config, agentId: string): Promise<AgentAdminResult<{ agentId: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const root = await profileMarkdownRootReal(cfg, id);\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  for (const name of agentAvatarFilenames()) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs || !isPathUnderWorkspace(rootReal, abs)) {\n      continue;\n    }\n    try {\n      await unlink(abs);\n    } catch {\n      /* absent */\n    }\n  }\n  return { ok: true, data: { agentId: id } };\n}\n"],"mappings":";;;;;;;;;;;;;;;;kBAiBiC;YAUoB;AAQrD,MAAM,kCAAkC,IAAI,IAAY,CACtD,GAAG,qCACH,gBAAgB,UACjB,CAAC;AAsCF,SAAS,uBAAuB,KAAuB;CACrD,MAAM,UAAU,iBAAiB,IAAI,CAAC,QAAQ,MAAM,EAAE,YAAY,MAAM;CACxE,MAAM,YAAY,sBAAsB,IAAI;AAC5C,KAAI,QAAQ,WAAW,EACrB,QAAO,CAAC,UAAU;CAEpB,MAAM,sBAAM,IAAI,KAAa;AAC7B,MAAK,MAAM,KAAK,QACd,KAAI,IAAI,iBAAiB,EAAE,GAAG,CAAC;AAEjC,KAAI,IAAI,UAAU;AAClB,QAAO,CAAC,GAAG,IAAI;;;AAIjB,SAAgB,kCAAkC,SAAqC;AACrF,MAAK,MAAM,QAAQ,QAAQ,MAAM,KAAK,EAAE;EACtC,MAAM,QAAQ,KAAK,MAAM,kCAAkC;AAC3D,MAAI,OAAO;GACT,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI;AAC9B,UAAO,EAAE,SAAS,IAAI,IAAI,KAAA;;;;AAMhC,eAAsB,kBAAkB,KAAiD;CACvF,MAAM,YAAY,sBAAsB,IAAI;CAC5C,MAAM,SAA4B,EAAE;CACpC,MAAM,iBAAiB,IAAI,QAAQ,UAAU;CAC7C,MAAM,kBAAkB,IAAI,QAAQ,UAAU,OAAO,WAAW,EAAE;CAClE,MAAM,sBAAsB,IAAI,QAAQ,UAAU,UAAU,EAAE;AAC9D,MAAK,MAAM,MAAM,uBAAuB,IAAI,EAAE;EAC5C,MAAM,UAAU,6BAA6B,KAAK,GAAG;EACrD,MAAM,QAAQ,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,GAAG;EAC9E,MAAM,QACJ,QAAQ,mBAAmB,QAAQ,UAAU,SAAS,IAClD;GACE,GAAI,QAAQ,kBAAkB,EAAE,SAAS,QAAQ,iBAAiB,GAAG,EAAE;GACvE,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GACzE,GACD,KAAA;EACN,MAAM,cAAc,OAAO;EAC3B,MAAM,eAAe,OAAO,OAAO,WAAW,EAAE;EAChD,MAAM,mBAAmB,OAAO;EAEhC,MAAM,uBAAuB,CAAC,GADJ,4BAA4B,KAAK,GACT,CAAC,QAAQ,CAAC;EAC5D,IAAI;AACJ,MAAI;AAGF,YAAS,kCAAkC,MADrB,SADD,KAAK,uBAAuB,KAAK,GAAG,EAAE,gBAAgB,SAChC,EAAE,QAAQ,CACF;UAC7C;AAGR,SAAO,KAAK;GACV;GACA,GAAI,OAAO,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,KAAK,MAAM,EAAE,GAAG,EAAE;GAC1D,GAAI,OAAO,aAAa,MAAM,GAAG,EAAE,aAAa,MAAM,YAAY,MAAM,EAAE,GAAG,EAAE;GAC/E,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC5B,WAAW,QAAQ;GACnB,YAAY,uBAAuB,KAAK,GAAG;GAC3C,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,aAAa;IACX,UAAU,CAAC,GAAG,oBAAoB;IAClC,GAAI,qBAAqB,KAAA,IAAY,EAAE,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,EAAE;IAC1E,WAAW;IACZ;GACD,WAAW,OAAO;GAClB,QAAQ;IACN,UAAU,iBAAiB,CAAC,GAAG,eAAe,GAAG,EAAE;IACnD,GAAI,gBAAgB,KAAA,IAAY,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,EAAE;IAChE,GAAI,QAAQ,oBAAoB,KAAA,IAC5B,EAAE,oBAAoB,CAAC,GAAG,QAAQ,gBAAgB,EAAE,GACpD,EAAE;IACP;GACD,OAAO;IACL,iBAAiB,CAAC,GAAG,gBAAgB;IACrC,cAAc,CAAC,GAAG,aAAa;IAC/B,kBAAkB,CAAC,GAAG,QAAQ,MAAM,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;IAChF;GACF,CAAC;;AAEJ,QAAO,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC;AAC/C,QAAO;EAAE;EAAW;EAAQ,gBAAgB,CAAC,GAAG,yBAAyB;EAAE;;AAwB7E,SAAS,eAAe,IAA4C;AAClE,KAAI,iBAAiB,GAAG,KAAA,OACtB,QAAO;EAAE,IAAI;EAAO,OAAO,IAAI,iBAAiB;EAAgB,QAAQ;EAAK;AAE/E,QAAO;;AAGT,SAAgB,mBACd,KACA,MAC8E;CAC9E,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI;AAClC,KAAI,CAAC,KACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoB,QAAQ;EAAK;CAE9D,MAAM,YAAY,KAAK,WAAW,MAAM,IAAI;AAC5C,KAAI,CAAC,UACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAyB,QAAQ;EAAK;CAEnE,MAAM,QAAQ,2BAA2B,KAAK,IAAI,KAAK;AACvD,KAAI,MAAM,OAAO,MACf,QAAO;EAAE,IAAI;EAAO,OAAO,MAAM;EAAO,QAAQ;EAAK;CAEvD,MAAM,UAAU,MAAM;AACtB,KAAI,oBAAoB,iBAAiB,IAAI,EAAE,QAAQ,IAAI,EACzD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAmB,QAAQ;EAAK;AAE/E,KAAI,KAAK,iBAAiB,KAAA,GAAW;AACnC,MAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,aAAa,CACzG,QAAO;GAAE,IAAI;GAAO,OAAO;GAAkC,QAAQ;GAAK;AAE5E,OAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,aAAa,EAAE;GAC/D,MAAM,MAAM,kBAAkB,KAAK;AACnC,OAAI,IACF,QAAO;AAET,OAAI,OAAO,YAAY,SACrB,QAAO;IAAE,IAAI;IAAO,OAAO,iBAAiB,KAAK;IAAsB,QAAQ;IAAK;;;CAK1F,MAAM,QAAQ,gBAAgB,UAAU;CACxC,IAAI,OAAO,iBAAiB,KAAK;EAC/B;EACA;EACA,WAAW;EACX,GAAI,KAAK,OAAO,MAAM,GAAG,EAAE,OAAO,KAAK,MAAM,MAAM,EAAE,GAAG,EAAE;EAC1D,GAAI,KAAK,UAAU,MAAM,GAAG,EAAE,UAAU,KAAK,SAAS,MAAM,EAAE,GAAG,EAAE;EACnE,GAAI,KAAK,aAAa,MAAM,GAAG,EAAE,aAAa,KAAK,YAAY,MAAM,EAAE,GAAG,EAAE;EAC7E,CAAC;AAEF,KAAI,KAAK,iBAAiB,KAAA,GAAW;EACnC,MAAM,OAAO,CAAC,GAAG,iBAAiB,KAAK,CAAC;EACxC,MAAM,MAAM,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,OAAO,GAAG;GAEZ,MAAM,QAAe,EAAE,GAAG,KAAK,MAAM;GACrC,MAAM,UAAU,KAAK,aAAa,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AAC9E,SAAM,QAAQ;IAAE,GAAG,MAAM;IAAO;IAAS;AACzC,QAAK,OAAO;AACZ,UAAO;IACL,GAAG;IACH,QAAQ;KACN,GAAG,KAAK;KACR;KACD;IACF;;;AAIL,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAM;GAAS,WAAW;GAAO;EAAE;;AAQ5E,SAAgB,yBACd,KACA,QAC+E;AAC/E,KAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,OAAO,WAAW,EAC9C,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoC,QAAQ;EAAK;CAE9E,IAAI,OAAO;CACX,MAAM,UAAsC,EAAE;AAC9C,MAAK,MAAM,QAAQ,QAAQ;EACzB,MAAM,OAAO,mBAAmB,MAAM,KAAK;AAC3C,MAAI,KAAK,OAAO,MACd,QAAO;AAET,SAAO,KAAK,KAAK;AACjB,UAAQ,KAAK;GACX,SAAS,KAAK,KAAK;GACnB,GAAI,KAAK,iBAAiB,KAAA,IAAY,EAAE,cAAc,KAAK,cAAc,GAAG,EAAE;GAC/E,CAAC;;AAEJ,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAM;GAAS;EAAE;;AAG1D,eAAsB,wBACpB,KACA,SACA,MACiC;CACjC,MAAM,SAAS,yBAAyB,KAAK,QAAQ;CACrD,MAAM,cAAc,uBAAuB,KAAK,QAAQ;CACxD,MAAM,SAAS,gBAAgB,KAAK,QAAQ;AAC5C,OAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;AACxC,OAAM,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC;AAC7C,OAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;CACxC,MAAM,KAAK,iBAAiB,QAAQ;AAGpC,+BAA8B,aAAa,QAAQ,EAAE,aAFvC,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,GAClD,EAAE,MAAM,MAAM,IAAI,IACuB,CAAC;CAEnE,MAAM,eAAe,MAAM;AAC3B,KAAI,gBAAgB,OAAO,KAAK,aAAa,CAAC,SAAS,EACrD,MAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,aAAa,EAAE;EAC1D,MAAM,UAAU,MAAM,sBAAsB,KAAK,SAAS,MAAM,QAAQ;AACxE,MAAI,QAAQ,OAAO,MACjB,QAAO;;AAKb,QAAO;EAAE,IAAI;EAAM,MAAM,KAAA;EAAW;;AAkBtC,SAAgB,mBACd,KACA,YACA,MAC0C;CAC1C,MAAM,UAAU,iBAAiB,WAAW;CAC5C,IAAI,OAAO,CAAC,GAAG,iBAAiB,IAAI,CAAC;CACrC,IAAI,MAAM,oBAAoB,MAAM,QAAQ;AAC5C,KAAI,MAAM,KAAK,YAAY,sBAAsB,IAAI,EAAE;AACrD,SAAO,CAAC,GAAG,MAAM;GAAE,IAAI;GAAS,SAAS;GAAe,CAAC;AACzD,QAAM,KAAK,SAAS;;AAEtB,KAAI,MAAM,EACR,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAc,QAAQ;EAAK;CAI1E,MAAM,QAAe,EAAE,GAAG,KAAK,MAAM;AAErC,KAAI,KAAK,SAAS,KAAA,GAAW;EAC3B,MAAM,IAAI,KAAK,KAAK,MAAM;AAC1B,MAAI,EACF,OAAM,OAAO;;AAGjB,KAAI,KAAK,gBAAgB,KAAA,EACvB,KAAI,KAAK,gBAAgB,QAAQ,OAAO,KAAK,YAAY,CAAC,MAAM,KAAK,GACnE,QAAO,MAAM;KAEb,OAAM,cAAc,OAAO,KAAK,YAAY,CAAC,MAAM;AAGvD,KAAI,KAAK,cAAc,KAAA,GAAW;EAChC,MAAM,IAAI,KAAK,UAAU,MAAM;AAC/B,MAAI,EACF,OAAM,YAAY,gBAAgB,EAAE;;AAGxC,KAAI,KAAK,UAAU,KAAA,EACjB,KAAI,KAAK,UAAU,KACjB,QAAO,MAAM;MACR;EACL,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,MAAM;AACzC,MAAI,CAAC,QACH,QAAO;GAAE,IAAI;GAAO,OAAO;GAA4C,QAAQ;GAAK;AAEtF,QAAM,QAAQ,EAAE,SAAS,SAAS;;AAGtC,KAAI,KAAK,aAAa,KAAA,EACpB,KAAI,KAAK,aAAa,QAAQ,OAAO,KAAK,SAAS,CAAC,MAAM,KAAK,GAC7D,QAAO,MAAM;KAEb,OAAM,WAAW,OAAO,KAAK,SAAS,CAAC,MAAM;AAIjD,KAAI,KAAK,WAAW,KAAA,EAClB,KAAI,KAAK,WAAW,KAClB,QAAO,MAAM;MACR;EACL,MAAM,OAAO,KAAK,OAAO,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AACrE,MAAI,KAAK,WAAW,EAClB,OAAM,SAAS,EAAE;MAEjB,OAAM,SAAS;;AAKrB,KAAI,KAAK,iBAAiB,KAAA,EACxB,KAAI,KAAK,iBAAiB;MACpB,MAAM,OAAO;AACf,UAAO,MAAM,MAAM;AACnB,OAAI,OAAO,KAAK,MAAM,MAAM,CAAC,WAAW,EACtC,QAAO,MAAM;;QAGZ;EACL,MAAM,OAAO,KAAK,aAAa,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AAC3E,QAAM,QAAQ;GAAE,GAAG,MAAM;GAAO,SAAS;GAAM;;AAInD,KAAI,KAAK,WAAW,KAAA,EAClB,KAAI,KAAK,WAAW,KAClB,QAAO,MAAM;MACR;EACL,MAAM,aAAa,0BAA0B,KAAK,OAAO;AACzD,MAAI,eAAe,QAAQ,eAAe,KAAA,EACxC,QAAO,MAAM;MAEb,OAAM,SAAS;;AAKrB,MAAK,OAAO;CACZ,IAAI,OAAe;EACjB,GAAG;EACH,QAAQ;GACN,GAAG,IAAI;GACP;GACD;EACF;AAED,KAAI,KAAK,eAAe,KACtB,QAAO;EACL,GAAG;EACH,QAAQ;GACN,GAAG,KAAK;GACR,SAAS;GACV;EACF;AAEH,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE,YAAY,MAAM;EAAE;;AAGjD,SAAgB,mBACd,KACA,YAC2D;CAC3D,MAAM,UAAU,iBAAiB,WAAW;CAC5C,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAET,KAAI,oBAAoB,iBAAiB,IAAI,EAAE,QAAQ,GAAG,EACxD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAc,QAAQ;EAAK;CAE1E,MAAM,EAAE,QAAQ,WAAW,iBAAiB,KAAK,QAAQ;AACzD,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAQ;GAAS;EAAE;;AAG5D,eAAsB,oBAAoB,KAAa,SAAgC;AACrF,OAAM,wBAAwB,KAAK,QAAQ;;AAU7C,eAAe,wBAAwB,KAAa,SAAkC;CACpF,MAAM,MAAM,uBAAuB,KAAK,QAAQ;AAChD,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACrC,KAAI;AACF,SAAO,MAAM,SAAS,IAAI;SACpB;AACN,SAAOA,QAAY,IAAI;;;AAI3B,SAAS,kBAAkB,MAA8C;AACvE,KAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,CAAC,gCAAgC,IAAI,KAAK,CAClG,QAAO;EAAE,IAAI;EAAO,OAAO,qBAAqB,KAAK;EAAI,QAAQ;EAAK;AAExE,QAAO;;AAGT,eAAsB,sBACpB,KACA,SAC6F;CAC7F,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAErE,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,QAAQ,CAAC,GAAG,gCAAgC;CAClD,MAAM,QAA0B,EAAE;AAClC,MAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE;EAC3D,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,IACH;AAEF,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,IAAI;AAC1B,OAAI,CAAC,GAAG,QAAQ,CACd;AAEF,SAAM,KAAK;IACT;IACA,SAAS;IACT,MAAM,GAAG;IACT,aAAa,GAAG;IACjB,CAAC;UACI;AACN,SAAM,KAAK;IAAE;IAAM,SAAS;IAAM,CAAC;;;AAGvC,OAAM,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;AAClD,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,YAAY;GAAM;GAAO;EAAE;;AAGrE,eAAsB,qBACpB,KACA,SACA,MAC+E;CAC/E,MAAM,MAAM,kBAAkB,KAAK;AACnC,KAAI,IACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAGrE,MAAM,MAAM,yBAAyB,MADlB,wBAAwB,KAAK,GAAG,EACR,KAAK;AAChD,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAE1D,KAAI;AAEF,SAAO;GAAE,IAAI;GAAM,MAAM;IAAE,SAAS;IAAI,SAAA,MADlB,SAAS,KAAK,QAAQ;IACK,MAAM;IAAK;GAAE;SACxD;AACN,SAAO;GAAE,IAAI;GAAO,OAAO;GAAkB,QAAQ;GAAK;;;AAI9D,eAAsB,sBACpB,KACA,SACA,MACA,SAC8D;CAC9D,MAAM,MAAM,kBAAkB,KAAK;AACnC,KAAI,IACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAGrE,MAAM,MAAM,yBAAyB,MADlB,wBAAwB,KAAK,GAAG,EACR,KAAK;AAChD,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAG1D,KAAI,CAAC,qBAAqB,MADH,wBAAwB,KAAK,GAAG,EACnB,IAAI,CACtC,QAAO;EAAE,IAAI;EAAO,OAAO;EAAsC,QAAQ;EAAK;AAEhF,OAAM,UAAU,KAAK,SAAS,QAAQ;AACtC,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,MAAM;GAAK;EAAE;;AAOvD,MAAM,yBAAyB,MAAM;AACrC,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAAC;CAAQ;CAAQ;CAAS;CAAQ;AAElE,SAAS,uBAAiC;AACxC,QAAO,wBAAwB,KAAK,QAAQ,GAAG,wBAAwB,MAAM;;AAG/E,SAAS,UAAU,MAA0D;CAC3E,MAAM,IAAI,KAAK,aAAa,CAAC,MAAM;AACnC,KAAI,MAAM,YAAa,QAAO;AAC9B,KAAI,MAAM,gBAAgB,MAAM,YAAa,QAAO;AACpD,KAAI,MAAM,aAAc,QAAO;AAC/B,QAAO;;AAGT,SAAS,yBAAyB,KAAmE;AACnG,KAAI,IAAI,UAAU,KAAK,IAAI,OAAO,OAAQ,IAAI,OAAO,MAAQ,IAAI,OAAO,MAAQ,IAAI,OAAO,GACzF,QAAO;AAET,KAAI,IAAI,UAAU,KAAK,IAAI,OAAO,OAAQ,IAAI,OAAO,OAAQ,IAAI,OAAO,IACtE,QAAO;AAET,KACE,IAAI,UAAU,MACd,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,QAAQ,MACZ,IAAI,QAAQ,GAEZ,QAAO;AAET,QAAO;;AAGT,SAAS,2BAA2B,KAAa,IAA4C;AAC3F,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;AAErE,QAAO;;AAGT,eAAsB,oBACpB,KACA,SACmG;CACnG,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;AACnD,MAAK,MAAM,QAAQ,sBAAsB,EAAE;EACzC,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,IACH;AAEF,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,IAAI;AAC1B,OAAI,CAAC,GAAG,QAAQ,IAAI,GAAG,QAAQ,KAAK,GAAG,OAAO,uBAC5C;GAEF,MAAM,SAAS,MAAM,SAAS,IAAI;GAClC,MAAM,WAAW,yBAAyB,OAAO;AACjD,OAAI,CAAC,SACH;AAEF,UAAO;IAAE,IAAI;IAAM,MAAM;KAAE,SAAS;KAAI;KAAQ,aAAa;KAAU,MAAM;KAAK;IAAE;UAC9E;;AAIV,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoB,QAAQ;EAAK;;AAG9D,eAAsB,2BACpB,KACA,SACA,QACA,UAC8D;CAC9D,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,MAAM,UAAU,SAAS;AAC/B,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAmE,QAAQ;EAAK;CAE7G,IAAI;AACJ,KAAI;AACF,QAAM,OAAO,KAAK,QAAQ,SAAS;SAC7B;AACN,SAAO;GAAE,IAAI;GAAO,OAAO;GAAkB,QAAQ;GAAK;;AAE5D,KAAI,IAAI,WAAW,KAAK,IAAI,SAAS,uBACnC,QAAO;EAAE,IAAI;EAAO,OAAO,wCAAwC,uBAAuB;EAAS,QAAQ;EAAK;CAElH,MAAM,WAAW,yBAAyB,IAAI;AAC9C,KAAI,CAAC,YAAY,CAAC,uBAAuB,KAAK,SAAS,CACrD,QAAO;EAAE,IAAI;EAAO,OAAO;EAAmD,QAAQ;EAAK;CAG7F,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,WAAW,MAAM,wBAAwB,KAAK,GAAG;CACvD,MAAM,aAAa,GAAG,wBAAwB;CAC9C,MAAM,MAAM,yBAAyB,MAAM,WAAW;AACtD,KAAI,CAAC,OAAO,CAAC,qBAAqB,UAAU,IAAI,CAC9C,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAE1D,MAAK,MAAM,QAAQ,sBAAsB,EAAE;AACzC,MAAI,SAAS,WACX;EAEF,MAAM,QAAQ,yBAAyB,MAAM,KAAK;AAClD,MAAI,SAAS,qBAAqB,UAAU,MAAM,CAChD,KAAI;AACF,SAAM,OAAO,MAAM;UACb;;AAKZ,OAAM,UAAU,KAAK,IAAI;AACzB,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,MAAM;GAAK;EAAE;;AAGvD,SAAS,gBAAgB,KAAqF;AAC5G,KAAI,QAAQ,OAAQ,QAAO;AAC3B,KAAI,QAAQ,QAAS,QAAO;AAC5B,QAAO;;AAGT,SAAS,uBACP,KACA,UACS;AACT,QAAO,aAAa,gBAAgB,IAAI;;;AAI1C,eAAsB,sBAAsB,KAAa,SAAiE;CACxH,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,WAAW,MAAM,wBAAwB,KAAK,GAAG;AACvD,MAAK,MAAM,QAAQ,sBAAsB,EAAE;EACzC,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,OAAO,CAAC,qBAAqB,UAAU,IAAI,CAC9C;AAEF,MAAI;AACF,SAAM,OAAO,IAAI;UACX;;AAIV,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE,SAAS,IAAI;EAAE"}
+{"version":3,"file":"agents-admin.js","names":["pathResolve"],"sources":["../../../src/gateway/agents-admin.ts"],"sourcesContent":["/**\n * Gateway REST helpers for multi-agent management.\n */\n\nimport { cp, mkdir, readdir, readFile, realpath, stat, unlink, writeFile } from 'node:fs/promises';\nimport { join, resolve as pathResolve } from 'node:path';\n\nimport {\n  DEFAULT_AGENT_ID,\n  listAgentEntries,\n  normalizeAgentId,\n  resolveAgentDir,\n  resolveAgentProfileDir,\n  resolveAgentWorkspaceDir,\n  resolveDefaultAgentId,\n  resolveUserPath,\n  validateAgentIdForNewAgent,\n} from '../agent/agent-scope.js';\nimport { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES } from '../agent/context/workspace.js';\nimport { seedAgentProfileMarkdownFiles } from '../agent/context/workspace-seed.js';\nimport {\n  applyAgentConfig,\n  findAgentEntryIndex,\n  pruneAgentConfig,\n  removeAgentDirsFromDisk,\n} from '../commands/agents.config.js';\nimport type { Config } from '../config/schema.js';\nimport type { LocalizedText } from '../config/localized-text.js';\nimport { normalizeLocalizedText, resolveLocalizedText } from '../config/localized-text.js';\nimport { WORKSPACE_FILES } from '../config/paths.js';\nimport { resolveEffectiveAgentProfile } from '../config/agent-profile.js';\nimport type { AgentTypedModel } from '../config/schema.js';\nimport { GATEWAY_BUILTIN_TOOL_IDS } from './agent-builtin-tools.js';\nimport { isPathUnderWorkspace, resolveWorkspaceSafePath } from './workspace-editor-path.js';\n\nconst EDITABLE_PROFILE_MARKDOWN_NAMES = new Set<string>([\n  ...AGENT_PROFILE_MARKDOWN_SYSTEM_FILES,\n  WORKSPACE_FILES.BOOTSTRAP,\n]);\n\nexport type GatewayAgentTypedModelsInfo = {\n  defaults: AgentTypedModel[];\n  effective: AgentTypedModel[];\n};\n\nexport type GatewayAgentRow = {\n  id: string;\n  name?: string;\n  description?: string;\n  localized?: {\n    name?: LocalizedText;\n    description?: LocalizedText;\n  };\n  /** Value from `IDENTITY.md` **Avatar:** line when present (may be URL, `xopc:…`, etc.). */\n  avatar?: string;\n  workspace: string;\n  /** Absolute directory for profile Markdown (`SOUL.md`, …) and gateway avatars: `agents/<id>/profile/`. */\n  profileDir: string;\n  model?: { primary?: string; fallbacks?: string[] };\n  typedModels: GatewayAgentTypedModelsInfo;\n  isDefault: boolean;\n  skills: {\n    defaults: string[];\n    entry?: string[];\n    effectiveAllowlist?: string[];\n  };\n  tools: {\n    defaultsDisable: string[];\n    entryDisable: string[];\n    effectiveDisable: string[];\n  };\n};\n\nexport type GatewayAgentsListResponse = {\n  defaultId: string;\n  agents: GatewayAgentRow[];\n  builtinToolIds: string[];\n};\n\nfunction collectAgentIdsForList(cfg: Config): string[] {\n  const entries = listAgentEntries(cfg).filter((e) => e.enabled !== false);\n  const defaultId = resolveDefaultAgentId(cfg);\n  if (entries.length === 0) {\n    return [defaultId];\n  }\n  const ids = new Set<string>();\n  for (const e of entries) {\n    ids.add(normalizeAgentId(e.id));\n  }\n  ids.add(defaultId);\n  return [...ids];\n}\n\n/** Extract `**Avatar:**` value from profile IDENTITY.md (same line shape as the gateway console parser). */\nexport function extractAvatarFromIdentityMarkdown(content: string): string | undefined {\n  for (const line of content.split('\\n')) {\n    const match = line.match(/^[-*]\\s+\\*\\*Avatar:\\*\\*\\s*(.*)/i);\n    if (match) {\n      const v = match[1]?.trim() ?? '';\n      return v.length > 0 ? v : undefined;\n    }\n  }\n  return undefined;\n}\n\nexport async function listGatewayAgents(\n  cfg: Config,\n  options: { locale?: string } = {},\n): Promise<GatewayAgentsListResponse> {\n  const defaultId = resolveDefaultAgentId(cfg);\n  const agents: GatewayAgentRow[] = [];\n  const defaultsSkills = cfg.agents?.defaults?.skills;\n  const defaultsDisable = cfg.agents?.defaults?.tools?.disable ?? [];\n  const defaultsTypedModels = cfg.agents?.defaults?.models ?? [];\n  for (const id of collectAgentIdsForList(cfg)) {\n    const profile = resolveEffectiveAgentProfile(cfg, id);\n    const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);\n    const model =\n      profile.primaryModelRef || profile.fallbacks.length > 0\n        ? {\n            ...(profile.primaryModelRef ? { primary: profile.primaryModelRef } : {}),\n            ...(profile.fallbacks.length > 0 ? { fallbacks: profile.fallbacks } : {}),\n          }\n        : undefined;\n    const entrySkills = entry?.skills;\n    const entryDisable = entry?.tools?.disable ?? [];\n    const effectiveTypedModels = [...defaultsTypedModels];\n    let avatar: string | undefined;\n    try {\n      const identityPath = join(resolveAgentProfileDir(cfg, id), WORKSPACE_FILES.IDENTITY);\n      const content = await readFile(identityPath, 'utf-8');\n      avatar = extractAvatarFromIdentityMarkdown(content);\n    } catch {\n      /* missing IDENTITY.md or unreadable */\n    }\n    const localizedName = normalizeLocalizedText(entry?.name);\n    const localizedDescription = normalizeLocalizedText(entry?.description);\n    const displayName = resolveLocalizedText(localizedName, options.locale);\n    const displayDescription = resolveLocalizedText(localizedDescription, options.locale);\n    agents.push({\n      id,\n      ...(displayName ? { name: displayName } : {}),\n      ...(displayDescription ? { description: displayDescription } : {}),\n      ...(localizedName || localizedDescription\n        ? {\n            localized: {\n              ...(localizedName ? { name: localizedName } : {}),\n              ...(localizedDescription ? { description: localizedDescription } : {}),\n            },\n          }\n        : {}),\n      ...(avatar ? { avatar } : {}),\n      workspace: profile.resolvedWorkspacePath,\n      profileDir: resolveAgentProfileDir(cfg, id),\n      ...(model ? { model } : {}),\n      typedModels: {\n        defaults: [...defaultsTypedModels],\n        effective: effectiveTypedModels,\n      },\n      isDefault: id === defaultId,\n      skills: {\n        defaults: defaultsSkills ? [...defaultsSkills] : [],\n        ...(entrySkills !== undefined ? { entry: [...entrySkills] } : {}),\n        ...(profile.skillsAllowlist !== undefined\n          ? { effectiveAllowlist: [...profile.skillsAllowlist] }\n          : {}),\n      },\n      tools: {\n        defaultsDisable: [...defaultsDisable],\n        entryDisable: [...entryDisable],\n        effectiveDisable: [...profile.tools.disable].sort((a, b) => a.localeCompare(b)),\n      },\n    });\n  }\n  agents.sort((a, b) => a.id.localeCompare(b.id));\n  return { defaultId, agents, builtinToolIds: [...GATEWAY_BUILTIN_TOOL_IDS] };\n}\n\nexport type CreateAgentBody = {\n  /** Display name stored on the agent entry. */\n  name: LocalizedText;\n  /** Optional id seed; normalized agent id defaults from `name` when omitted. */\n  id?: string;\n  workspace: string;\n  model?: string;\n  agentDir?: string;\n  description?: LocalizedText;\n  /** Initial `agents.list[].tools.disable` for the new entry. */\n  toolsDisable?: string[];\n  /** Profile markdown files to write after seeding (e.g. `IDENTITY.md`, `SOUL.md`). */\n  profileFiles?: Record<string, string>;\n  /** Clone from an existing agent id — copies config entry fields and profile directory. */\n  cloneFrom?: string;\n};\n\nexport type AgentAdminHttpStatus = 400 | 404 | 409;\n\nexport type AgentAdminResult<T> =\n  | { ok: true; data: T }\n  | { ok: false; error: string; status?: AgentAdminHttpStatus };\n\nfunction requireNonMain(id: string): AgentAdminResult<never> | null {\n  if (normalizeAgentId(id) === DEFAULT_AGENT_ID) {\n    return { ok: false, error: `\"${DEFAULT_AGENT_ID}\" is reserved`, status: 400 };\n  }\n  return null;\n}\n\nexport function prepareCreateAgent(\n  cfg: Config,\n  body: CreateAgentBody,\n): AgentAdminResult<{ nextConfig: Config; agentId: string; workspace: string }> {\n  const normalizedName = normalizeLocalizedText(body.name);\n  const nameSeed = resolveLocalizedText(normalizedName, 'en') ?? '';\n  if (!nameSeed) {\n    return { ok: false, error: 'name is required', status: 400 };\n  }\n  const workspace = body.workspace?.trim() ?? '';\n  if (!workspace) {\n    return { ok: false, error: 'workspace is required', status: 400 };\n  }\n  const idRes = validateAgentIdForNewAgent(body.id, nameSeed);\n  if (idRes.ok === false) {\n    return { ok: false, error: idRes.error, status: 400 };\n  }\n  const agentId = idRes.agentId;\n  if (findAgentEntryIndex(listAgentEntries(cfg), agentId) >= 0) {\n    return { ok: false, error: `agent \"${agentId}\" already exists`, status: 409 };\n  }\n  if (body.profileFiles !== undefined) {\n    if (typeof body.profileFiles !== 'object' || body.profileFiles === null || Array.isArray(body.profileFiles)) {\n      return { ok: false, error: 'profileFiles must be an object', status: 400 };\n    }\n    for (const [name, content] of Object.entries(body.profileFiles)) {\n      const bad = assertAllowedFile(name);\n      if (bad) {\n        return bad;\n      }\n      if (typeof content !== 'string') {\n        return { ok: false, error: `profileFiles[\"${name}\"] must be a string`, status: 400 };\n      }\n    }\n  }\n\n  // Resolve fields from cloneFrom source when present\n  let cloneSourceEntry: ReturnType<typeof listAgentEntries>[number] | undefined;\n  if (body.cloneFrom) {\n    const srcId = normalizeAgentId(body.cloneFrom);\n    cloneSourceEntry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === srcId);\n    if (!cloneSourceEntry && srcId !== resolveDefaultAgentId(cfg)) {\n      return { ok: false, error: `source agent \"${srcId}\" not found`, status: 404 };\n    }\n  }\n\n  const wsAbs = resolveUserPath(workspace);\n\n  // Inherit model from source if not explicitly provided\n  const effectiveModel = body.model?.trim()\n    ? body.model.trim()\n    : cloneSourceEntry?.model?.primary;\n\n  let next = applyAgentConfig(cfg, {\n    agentId,\n    name: normalizedName,\n    workspace: wsAbs,\n    ...(effectiveModel ? { model: effectiveModel } : {}),\n    ...(body.agentDir?.trim() ? { agentDir: body.agentDir.trim() } : {}),\n    ...(normalizeLocalizedText(body.description) ? { description: normalizeLocalizedText(body.description) } : {}),\n  });\n\n  // Resolve tools.disable: explicit body > clone source > none\n  const toolsDisable = body.toolsDisable ?? cloneSourceEntry?.tools?.disable;\n  if (toolsDisable !== undefined) {\n    const list = [...listAgentEntries(next)];\n    const idx = findAgentEntryIndex(list, agentId);\n    if (idx >= 0) {\n      type Entry = (typeof list)[number];\n      const entry: Entry = { ...list[idx] };\n      const disable = toolsDisable.map((s) => String(s).trim()).filter(Boolean);\n      entry.tools = { ...entry.tools, disable };\n\n      if (cloneSourceEntry?.skills !== undefined && body.cloneFrom) {\n        entry.skills = [...cloneSourceEntry.skills];\n      }\n\n      list[idx] = entry;\n      next = {\n        ...next,\n        agents: {\n          ...next.agents,\n          list,\n        },\n      };\n    }\n  } else if (cloneSourceEntry && body.cloneFrom) {\n    const list = [...listAgentEntries(next)];\n    const idx = findAgentEntryIndex(list, agentId);\n    if (idx >= 0) {\n      type Entry = (typeof list)[number];\n      const entry: Entry = { ...list[idx] };\n      if (cloneSourceEntry.skills !== undefined) {\n        entry.skills = [...cloneSourceEntry.skills];\n      }\n      list[idx] = entry;\n      next = {\n        ...next,\n        agents: {\n          ...next.agents,\n          list,\n        },\n      };\n    }\n  }\n\n  return { ok: true, data: { nextConfig: next, agentId, workspace: wsAbs } };\n}\n\nexport type PreparedBatchCreateAgent = {\n  agentId: string;\n  profileFiles?: Record<string, string>;\n};\n\nexport function prepareCreateAgentsBatch(\n  cfg: Config,\n  bodies: CreateAgentBody[],\n): AgentAdminResult<{ nextConfig: Config; created: PreparedBatchCreateAgent[] }> {\n  if (!Array.isArray(bodies) || bodies.length === 0) {\n    return { ok: false, error: 'agents must be a non-empty array', status: 400 };\n  }\n  let next = cfg;\n  const created: PreparedBatchCreateAgent[] = [];\n  for (const body of bodies) {\n    const prep = prepareCreateAgent(next, body);\n    if (prep.ok === false) {\n      return prep;\n    }\n    next = prep.data.nextConfig;\n    created.push({\n      agentId: prep.data.agentId,\n      ...(body.profileFiles !== undefined ? { profileFiles: body.profileFiles } : {}),\n    });\n  }\n  return { ok: true, data: { nextConfig: next, created } };\n}\n\nexport async function finalizeCreateAgentDirs(\n  cfg: Config,\n  agentId: string,\n  opts?: { profileFiles?: Record<string, string>; cloneFrom?: string },\n): Promise<AgentAdminResult<void>> {\n  const wsPath = resolveAgentWorkspaceDir(cfg, agentId);\n  const profilePath = resolveAgentProfileDir(cfg, agentId);\n  const adPath = resolveAgentDir(cfg, agentId);\n  await mkdir(wsPath, { recursive: true });\n  await mkdir(profilePath, { recursive: true });\n  await mkdir(adPath, { recursive: true });\n  const id = normalizeAgentId(agentId);\n  const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);\n  const displayName = resolveLocalizedText(normalizeLocalizedText(entry?.name), 'en') || id;\n\n  // When cloning, copy the entire source profile directory instead of seeding\n  if (opts?.cloneFrom) {\n    const srcProfilePath = resolveAgentProfileDir(cfg, normalizeAgentId(opts.cloneFrom));\n    try {\n      const srcStat = await stat(srcProfilePath);\n      if (srcStat.isDirectory()) {\n        const srcFiles = await readdir(srcProfilePath);\n        for (const fileName of srcFiles) {\n          const srcFile = join(srcProfilePath, fileName);\n          const dstFile = join(profilePath, fileName);\n          try {\n            const fileStat = await stat(srcFile);\n            if (fileStat.isFile()) {\n              await cp(srcFile, dstFile);\n            }\n          } catch {\n            /* skip unreadable files */\n          }\n        }\n      }\n    } catch {\n      // Source profile dir doesn't exist — fall through to normal seed\n      seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName });\n    }\n  } else {\n    seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName });\n  }\n\n  const profileFiles = opts?.profileFiles;\n  if (profileFiles && Object.keys(profileFiles).length > 0) {\n    for (const [name, content] of Object.entries(profileFiles)) {\n      const written = await writeAgentProfileFile(cfg, agentId, name, content);\n      if (written.ok === false) {\n        return written;\n      }\n    }\n  }\n\n  return { ok: true, data: undefined };\n}\n\nexport type UpdateAgentBody = {\n  name?: LocalizedText;\n  description?: LocalizedText | null;\n  workspace?: string;\n  model?: string | null;\n  agentDir?: string | null;\n  setDefault?: boolean;\n  /** Replace `agents.list[].skills`; `null` removes the key (inherit defaults). */\n  skills?: string[] | null;\n  /** Replace `agents.list[].tools.disable`; `null` clears entry-level disables. */\n  toolsDisable?: string[] | null;\n};\n\nexport function prepareUpdateAgent(\n  cfg: Config,\n  agentIdRaw: string,\n  body: UpdateAgentBody,\n): AgentAdminResult<{ nextConfig: Config }> {\n  const agentId = normalizeAgentId(agentIdRaw);\n  let list = [...listAgentEntries(cfg)];\n  let idx = findAgentEntryIndex(list, agentId);\n  if (idx < 0 && agentId === resolveDefaultAgentId(cfg)) {\n    list = [...list, { id: agentId, enabled: true as const }];\n    idx = list.length - 1;\n  }\n  if (idx < 0) {\n    return { ok: false, error: `agent \"${agentId}\" not found`, status: 404 };\n  }\n\n  type Entry = (typeof list)[number];\n  const entry: Entry = { ...list[idx] };\n\n  if (body.name !== undefined) {\n    const nextName = normalizeLocalizedText(body.name);\n    if (nextName) {\n      entry.name = nextName;\n    }\n  }\n  if (body.description !== undefined) {\n    const nextDescription = body.description === null ? undefined : normalizeLocalizedText(body.description);\n    if (nextDescription) {\n      entry.description = nextDescription;\n    } else {\n      delete entry.description;\n    }\n  }\n  if (body.workspace !== undefined) {\n    const w = body.workspace.trim();\n    if (w) {\n      entry.workspace = resolveUserPath(w);\n    }\n  }\n  if (body.model !== undefined) {\n    if (body.model === null) {\n      delete entry.model;\n    } else {\n      const trimmed = String(body.model).trim();\n      if (!trimmed) {\n        return { ok: false, error: 'model must be a non-empty string or null', status: 400 };\n      }\n      entry.model = { primary: trimmed };\n    }\n  }\n  if (body.agentDir !== undefined) {\n    if (body.agentDir === null || String(body.agentDir).trim() === '') {\n      delete entry.agentDir;\n    } else {\n      entry.agentDir = String(body.agentDir).trim();\n    }\n  }\n\n  if (body.skills !== undefined) {\n    if (body.skills === null) {\n      delete entry.skills;\n    } else {\n      const next = body.skills.map((s) => String(s).trim()).filter(Boolean);\n      if (next.length === 0) {\n        entry.skills = [];\n      } else {\n        entry.skills = next;\n      }\n    }\n  }\n\n  if (body.toolsDisable !== undefined) {\n    if (body.toolsDisable === null) {\n      if (entry.tools) {\n        delete entry.tools.disable;\n        if (Object.keys(entry.tools).length === 0) {\n          delete entry.tools;\n        }\n      }\n    } else {\n      const next = body.toolsDisable.map((s) => String(s).trim()).filter(Boolean);\n      entry.tools = { ...entry.tools, disable: next };\n    }\n  }\n\n  list[idx] = entry;\n  let next: Config = {\n    ...cfg,\n    agents: {\n      ...cfg.agents,\n      list,\n    },\n  };\n\n  if (body.setDefault === true) {\n    next = {\n      ...next,\n      agents: {\n        ...next.agents,\n        default: agentId,\n      },\n    };\n  }\n  return { ok: true, data: { nextConfig: next } };\n}\n\nexport function prepareDeleteAgent(\n  cfg: Config,\n  agentIdRaw: string,\n): AgentAdminResult<{ nextConfig: Config; agentId: string }> {\n  const agentId = normalizeAgentId(agentIdRaw);\n  const reserved = requireNonMain(agentId);\n  if (reserved) {\n    return reserved;\n  }\n  if (findAgentEntryIndex(listAgentEntries(cfg), agentId) < 0) {\n    return { ok: false, error: `agent \"${agentId}\" not found`, status: 404 };\n  }\n  const { config: pruned } = pruneAgentConfig(cfg, agentId);\n  return { ok: true, data: { nextConfig: pruned, agentId } };\n}\n\nexport async function runAfterDeletePurge(cfg: Config, agentId: string): Promise<void> {\n  await removeAgentDirsFromDisk(cfg, agentId);\n}\n\nexport type AgentFileEntry = {\n  name: string;\n  missing: boolean;\n  size?: number;\n  updatedAtMs?: number;\n};\n\nasync function profileMarkdownRootReal(cfg: Config, agentId: string): Promise<string> {\n  const dir = resolveAgentProfileDir(cfg, agentId);\n  await mkdir(dir, { recursive: true });\n  try {\n    return await realpath(dir);\n  } catch {\n    return pathResolve(dir);\n  }\n}\n\nfunction assertAllowedFile(name: string): AgentAdminResult<never> | null {\n  if (!name || name.includes('/') || name.includes('\\\\') || !EDITABLE_PROFILE_MARKDOWN_NAMES.has(name)) {\n    return { ok: false, error: `unsupported file \"${name}\"`, status: 400 };\n  }\n  return null;\n}\n\nexport async function listAgentProfileFiles(\n  cfg: Config,\n  agentId: string,\n): Promise<AgentAdminResult<{ agentId: string; profileDir: string; files: AgentFileEntry[] }>> {\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const names = [...EDITABLE_PROFILE_MARKDOWN_NAMES];\n  const files: AgentFileEntry[] = [];\n  for (const name of names.sort((a, b) => a.localeCompare(b))) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs) {\n      continue;\n    }\n    try {\n      const st = await stat(abs);\n      if (!st.isFile()) {\n        continue;\n      }\n      files.push({\n        name,\n        missing: false,\n        size: st.size,\n        updatedAtMs: st.mtimeMs,\n      });\n    } catch {\n      files.push({ name, missing: true });\n    }\n  }\n  files.sort((a, b) => a.name.localeCompare(b.name));\n  return { ok: true, data: { agentId: id, profileDir: root, files } };\n}\n\nexport async function readAgentProfileFile(\n  cfg: Config,\n  agentId: string,\n  name: string,\n): Promise<AgentAdminResult<{ agentId: string; content: string; path: string }>> {\n  const bad = assertAllowedFile(name);\n  if (bad) {\n    return bad;\n  }\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const abs = resolveWorkspaceSafePath(root, name);\n  if (!abs) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  try {\n    const content = await readFile(abs, 'utf-8');\n    return { ok: true, data: { agentId: id, content, path: abs } };\n  } catch {\n    return { ok: false, error: 'file not found', status: 404 };\n  }\n}\n\nexport async function writeAgentProfileFile(\n  cfg: Config,\n  agentId: string,\n  name: string,\n  content: string,\n): Promise<AgentAdminResult<{ agentId: string; path: string }>> {\n  const bad = assertAllowedFile(name);\n  if (bad) {\n    return bad;\n  }\n  const id = normalizeAgentId(agentId);\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  const root = await profileMarkdownRootReal(cfg, id);\n  const abs = resolveWorkspaceSafePath(root, name);\n  if (!abs) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  if (!isPathUnderWorkspace(rootReal, abs)) {\n    return { ok: false, error: 'path escapes profile markdown root', status: 400 };\n  }\n  await writeFile(abs, content, 'utf-8');\n  return { ok: true, data: { agentId: id, path: abs } };\n}\n\n// ---------------------------------------------------------------------------\n// Binary agent avatar (profile markdown root dir, not a SOUL/IDENTITY markdown file)\n// ---------------------------------------------------------------------------\n\nconst AGENT_AVATAR_MAX_BYTES = 512 * 1024;\nconst AGENT_AVATAR_BASENAME = 'agent-avatar';\n\nconst AGENT_AVATAR_EXTENSIONS = ['.png', '.jpg', '.jpeg', '.webp'] as const;\n\nfunction agentAvatarFilenames(): string[] {\n  return AGENT_AVATAR_EXTENSIONS.map((ext) => `${AGENT_AVATAR_BASENAME}${ext}`);\n}\n\nfunction mimeToExt(mime: string): '.png' | '.jpg' | '.jpeg' | '.webp' | null {\n  const m = mime.toLowerCase().trim();\n  if (m === 'image/png') return '.png';\n  if (m === 'image/jpeg' || m === 'image/jpg') return '.jpg';\n  if (m === 'image/webp') return '.webp';\n  return null;\n}\n\nfunction detectImageMimeFromBytes(buf: Uint8Array): 'image/png' | 'image/jpeg' | 'image/webp' | null {\n  if (buf.length >= 8 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {\n    return 'image/png';\n  }\n  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {\n    return 'image/jpeg';\n  }\n  if (\n    buf.length >= 12 &&\n    buf[0] === 0x52 &&\n    buf[1] === 0x49 &&\n    buf[2] === 0x46 &&\n    buf[3] === 0x46 &&\n    buf[8] === 0x57 &&\n    buf[9] === 0x45 &&\n    buf[10] === 0x42 &&\n    buf[11] === 0x50\n  ) {\n    return 'image/webp';\n  }\n  return null;\n}\n\nfunction assertAgentExistsForAvatar(cfg: Config, id: string): AgentAdminResult<never> | null {\n  if (collectAgentIdsForList(cfg).every((x) => x !== id)) {\n    return { ok: false, error: `agent \"${id}\" not found`, status: 404 };\n  }\n  return null;\n}\n\nexport async function readAgentAvatarFile(\n  cfg: Config,\n  agentId: string,\n): Promise<AgentAdminResult<{ agentId: string; buffer: Buffer; contentType: string; path: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const root = await profileMarkdownRootReal(cfg, id);\n  for (const name of agentAvatarFilenames()) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs) {\n      continue;\n    }\n    try {\n      const st = await stat(abs);\n      if (!st.isFile() || st.size <= 0 || st.size > AGENT_AVATAR_MAX_BYTES) {\n        continue;\n      }\n      const buffer = await readFile(abs);\n      const detected = detectImageMimeFromBytes(buffer);\n      if (!detected) {\n        continue;\n      }\n      return { ok: true, data: { agentId: id, buffer, contentType: detected, path: abs } };\n    } catch {\n      /* try next */\n    }\n  }\n  return { ok: false, error: 'avatar not found', status: 404 };\n}\n\nexport async function writeAgentAvatarFromBase64(\n  cfg: Config,\n  agentId: string,\n  base64: string,\n  mimeType: string,\n): Promise<AgentAdminResult<{ agentId: string; path: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const ext = mimeToExt(mimeType);\n  if (!ext) {\n    return { ok: false, error: 'unsupported mimeType (use image/png, image/jpeg, or image/webp)', status: 400 };\n  }\n  let raw: Buffer;\n  try {\n    raw = Buffer.from(base64, 'base64');\n  } catch {\n    return { ok: false, error: 'invalid base64', status: 400 };\n  }\n  if (raw.length === 0 || raw.length > AGENT_AVATAR_MAX_BYTES) {\n    return { ok: false, error: `avatar must be non-empty and at most ${AGENT_AVATAR_MAX_BYTES} bytes`, status: 400 };\n  }\n  const detected = detectImageMimeFromBytes(raw);\n  if (!detected || !extMatchesDetectedMime(ext, detected)) {\n    return { ok: false, error: 'file content does not match declared image type', status: 400 };\n  }\n\n  const root = await profileMarkdownRootReal(cfg, id);\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  const targetName = `${AGENT_AVATAR_BASENAME}${ext}`;\n  const abs = resolveWorkspaceSafePath(root, targetName);\n  if (!abs || !isPathUnderWorkspace(rootReal, abs)) {\n    return { ok: false, error: 'invalid path', status: 400 };\n  }\n  for (const name of agentAvatarFilenames()) {\n    if (name === targetName) {\n      continue;\n    }\n    const other = resolveWorkspaceSafePath(root, name);\n    if (other && isPathUnderWorkspace(rootReal, other)) {\n      try {\n        await unlink(other);\n      } catch {\n        /* absent */\n      }\n    }\n  }\n  await writeFile(abs, raw);\n  return { ok: true, data: { agentId: id, path: abs } };\n}\n\nfunction mimeToExtToMime(ext: '.png' | '.jpg' | '.jpeg' | '.webp'): 'image/png' | 'image/jpeg' | 'image/webp' {\n  if (ext === '.png') return 'image/png';\n  if (ext === '.webp') return 'image/webp';\n  return 'image/jpeg';\n}\n\nfunction extMatchesDetectedMime(\n  ext: '.png' | '.jpg' | '.jpeg' | '.webp',\n  detected: 'image/png' | 'image/jpeg' | 'image/webp',\n): boolean {\n  return detected === mimeToExtToMime(ext);\n}\n\n/** Remove any `agent-avatar.*` in the agent profile markdown root. Idempotent: ok even when no file existed. */\nexport async function deleteAgentAvatarFile(cfg: Config, agentId: string): Promise<AgentAdminResult<{ agentId: string }>> {\n  const missingAgent = assertAgentExistsForAvatar(cfg, agentId);\n  if (missingAgent) {\n    return missingAgent;\n  }\n  const id = normalizeAgentId(agentId);\n  const root = await profileMarkdownRootReal(cfg, id);\n  const rootReal = await profileMarkdownRootReal(cfg, id);\n  for (const name of agentAvatarFilenames()) {\n    const abs = resolveWorkspaceSafePath(root, name);\n    if (!abs || !isPathUnderWorkspace(rootReal, abs)) {\n      continue;\n    }\n    try {\n      await unlink(abs);\n    } catch {\n      /* absent */\n    }\n  }\n  return { ok: true, data: { agentId: id } };\n}\n"],"mappings":";;;;;;;;;;;;;;;kBAiBiC;qBAW0D;YACtC;AAMrD,MAAM,kCAAkC,IAAI,IAAY,CACtD,GAAG,qCACH,gBAAgB,UACjB,CAAC;AAyCF,SAAS,uBAAuB,KAAuB;CACrD,MAAM,UAAU,iBAAiB,IAAI,CAAC,QAAQ,MAAM,EAAE,YAAY,MAAM;CACxE,MAAM,YAAY,sBAAsB,IAAI;AAC5C,KAAI,QAAQ,WAAW,EACrB,QAAO,CAAC,UAAU;CAEpB,MAAM,sBAAM,IAAI,KAAa;AAC7B,MAAK,MAAM,KAAK,QACd,KAAI,IAAI,iBAAiB,EAAE,GAAG,CAAC;AAEjC,KAAI,IAAI,UAAU;AAClB,QAAO,CAAC,GAAG,IAAI;;;AAIjB,SAAgB,kCAAkC,SAAqC;AACrF,MAAK,MAAM,QAAQ,QAAQ,MAAM,KAAK,EAAE;EACtC,MAAM,QAAQ,KAAK,MAAM,kCAAkC;AAC3D,MAAI,OAAO;GACT,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI;AAC9B,UAAO,EAAE,SAAS,IAAI,IAAI,KAAA;;;;AAMhC,eAAsB,kBACpB,KACA,UAA+B,EAAE,EACG;CACpC,MAAM,YAAY,sBAAsB,IAAI;CAC5C,MAAM,SAA4B,EAAE;CACpC,MAAM,iBAAiB,IAAI,QAAQ,UAAU;CAC7C,MAAM,kBAAkB,IAAI,QAAQ,UAAU,OAAO,WAAW,EAAE;CAClE,MAAM,sBAAsB,IAAI,QAAQ,UAAU,UAAU,EAAE;AAC9D,MAAK,MAAM,MAAM,uBAAuB,IAAI,EAAE;EAC5C,MAAM,UAAU,6BAA6B,KAAK,GAAG;EACrD,MAAM,QAAQ,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,GAAG;EAC9E,MAAM,QACJ,QAAQ,mBAAmB,QAAQ,UAAU,SAAS,IAClD;GACE,GAAI,QAAQ,kBAAkB,EAAE,SAAS,QAAQ,iBAAiB,GAAG,EAAE;GACvE,GAAI,QAAQ,UAAU,SAAS,IAAI,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;GACzE,GACD,KAAA;EACN,MAAM,cAAc,OAAO;EAC3B,MAAM,eAAe,OAAO,OAAO,WAAW,EAAE;EAChD,MAAM,uBAAuB,CAAC,GAAG,oBAAoB;EACrD,IAAI;AACJ,MAAI;AAGF,YAAS,kCAAkC,MADrB,SADD,KAAK,uBAAuB,KAAK,GAAG,EAAE,gBAAgB,SAChC,EAAE,QAAQ,CACF;UAC7C;EAGR,MAAM,gBAAgB,uBAAuB,OAAO,KAAK;EACzD,MAAM,uBAAuB,uBAAuB,OAAO,YAAY;EACvE,MAAM,cAAc,qBAAqB,eAAe,QAAQ,OAAO;EACvE,MAAM,qBAAqB,qBAAqB,sBAAsB,QAAQ,OAAO;AACrF,SAAO,KAAK;GACV;GACA,GAAI,cAAc,EAAE,MAAM,aAAa,GAAG,EAAE;GAC5C,GAAI,qBAAqB,EAAE,aAAa,oBAAoB,GAAG,EAAE;GACjE,GAAI,iBAAiB,uBACjB,EACE,WAAW;IACT,GAAI,gBAAgB,EAAE,MAAM,eAAe,GAAG,EAAE;IAChD,GAAI,uBAAuB,EAAE,aAAa,sBAAsB,GAAG,EAAE;IACtE,EACF,GACD,EAAE;GACN,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC5B,WAAW,QAAQ;GACnB,YAAY,uBAAuB,KAAK,GAAG;GAC3C,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;GAC1B,aAAa;IACX,UAAU,CAAC,GAAG,oBAAoB;IAClC,WAAW;IACZ;GACD,WAAW,OAAO;GAClB,QAAQ;IACN,UAAU,iBAAiB,CAAC,GAAG,eAAe,GAAG,EAAE;IACnD,GAAI,gBAAgB,KAAA,IAAY,EAAE,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,EAAE;IAChE,GAAI,QAAQ,oBAAoB,KAAA,IAC5B,EAAE,oBAAoB,CAAC,GAAG,QAAQ,gBAAgB,EAAE,GACpD,EAAE;IACP;GACD,OAAO;IACL,iBAAiB,CAAC,GAAG,gBAAgB;IACrC,cAAc,CAAC,GAAG,aAAa;IAC/B,kBAAkB,CAAC,GAAG,QAAQ,MAAM,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;IAChF;GACF,CAAC;;AAEJ,QAAO,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC;AAC/C,QAAO;EAAE;EAAW;EAAQ,gBAAgB,CAAC,GAAG,yBAAyB;EAAE;;AA0B7E,SAAS,eAAe,IAA4C;AAClE,KAAI,iBAAiB,GAAG,KAAA,OACtB,QAAO;EAAE,IAAI;EAAO,OAAO,IAAI,iBAAiB;EAAgB,QAAQ;EAAK;AAE/E,QAAO;;AAGT,SAAgB,mBACd,KACA,MAC8E;CAC9E,MAAM,iBAAiB,uBAAuB,KAAK,KAAK;CACxD,MAAM,WAAW,qBAAqB,gBAAgB,KAAK,IAAI;AAC/D,KAAI,CAAC,SACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoB,QAAQ;EAAK;CAE9D,MAAM,YAAY,KAAK,WAAW,MAAM,IAAI;AAC5C,KAAI,CAAC,UACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAyB,QAAQ;EAAK;CAEnE,MAAM,QAAQ,2BAA2B,KAAK,IAAI,SAAS;AAC3D,KAAI,MAAM,OAAO,MACf,QAAO;EAAE,IAAI;EAAO,OAAO,MAAM;EAAO,QAAQ;EAAK;CAEvD,MAAM,UAAU,MAAM;AACtB,KAAI,oBAAoB,iBAAiB,IAAI,EAAE,QAAQ,IAAI,EACzD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAmB,QAAQ;EAAK;AAE/E,KAAI,KAAK,iBAAiB,KAAA,GAAW;AACnC,MAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,aAAa,CACzG,QAAO;GAAE,IAAI;GAAO,OAAO;GAAkC,QAAQ;GAAK;AAE5E,OAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,aAAa,EAAE;GAC/D,MAAM,MAAM,kBAAkB,KAAK;AACnC,OAAI,IACF,QAAO;AAET,OAAI,OAAO,YAAY,SACrB,QAAO;IAAE,IAAI;IAAO,OAAO,iBAAiB,KAAK;IAAsB,QAAQ;IAAK;;;CAM1F,IAAI;AACJ,KAAI,KAAK,WAAW;EAClB,MAAM,QAAQ,iBAAiB,KAAK,UAAU;AAC9C,qBAAmB,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,MAAM;AACtF,MAAI,CAAC,oBAAoB,UAAU,sBAAsB,IAAI,CAC3D,QAAO;GAAE,IAAI;GAAO,OAAO,iBAAiB,MAAM;GAAc,QAAQ;GAAK;;CAIjF,MAAM,QAAQ,gBAAgB,UAAU;CAGxC,MAAM,iBAAiB,KAAK,OAAO,MAAM,GACrC,KAAK,MAAM,MAAM,GACjB,kBAAkB,OAAO;CAE7B,IAAI,OAAO,iBAAiB,KAAK;EAC/B;EACA,MAAM;EACN,WAAW;EACX,GAAI,iBAAiB,EAAE,OAAO,gBAAgB,GAAG,EAAE;EACnD,GAAI,KAAK,UAAU,MAAM,GAAG,EAAE,UAAU,KAAK,SAAS,MAAM,EAAE,GAAG,EAAE;EACnE,GAAI,uBAAuB,KAAK,YAAY,GAAG,EAAE,aAAa,uBAAuB,KAAK,YAAY,EAAE,GAAG,EAAE;EAC9G,CAAC;CAGF,MAAM,eAAe,KAAK,gBAAgB,kBAAkB,OAAO;AACnE,KAAI,iBAAiB,KAAA,GAAW;EAC9B,MAAM,OAAO,CAAC,GAAG,iBAAiB,KAAK,CAAC;EACxC,MAAM,MAAM,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,OAAO,GAAG;GAEZ,MAAM,QAAe,EAAE,GAAG,KAAK,MAAM;GACrC,MAAM,UAAU,aAAa,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AACzE,SAAM,QAAQ;IAAE,GAAG,MAAM;IAAO;IAAS;AAEzC,OAAI,kBAAkB,WAAW,KAAA,KAAa,KAAK,UACjD,OAAM,SAAS,CAAC,GAAG,iBAAiB,OAAO;AAG7C,QAAK,OAAO;AACZ,UAAO;IACL,GAAG;IACH,QAAQ;KACN,GAAG,KAAK;KACR;KACD;IACF;;YAEM,oBAAoB,KAAK,WAAW;EAC7C,MAAM,OAAO,CAAC,GAAG,iBAAiB,KAAK,CAAC;EACxC,MAAM,MAAM,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,OAAO,GAAG;GAEZ,MAAM,QAAe,EAAE,GAAG,KAAK,MAAM;AACrC,OAAI,iBAAiB,WAAW,KAAA,EAC9B,OAAM,SAAS,CAAC,GAAG,iBAAiB,OAAO;AAE7C,QAAK,OAAO;AACZ,UAAO;IACL,GAAG;IACH,QAAQ;KACN,GAAG,KAAK;KACR;KACD;IACF;;;AAIL,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAM;GAAS,WAAW;GAAO;EAAE;;AAQ5E,SAAgB,yBACd,KACA,QAC+E;AAC/E,KAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,OAAO,WAAW,EAC9C,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoC,QAAQ;EAAK;CAE9E,IAAI,OAAO;CACX,MAAM,UAAsC,EAAE;AAC9C,MAAK,MAAM,QAAQ,QAAQ;EACzB,MAAM,OAAO,mBAAmB,MAAM,KAAK;AAC3C,MAAI,KAAK,OAAO,MACd,QAAO;AAET,SAAO,KAAK,KAAK;AACjB,UAAQ,KAAK;GACX,SAAS,KAAK,KAAK;GACnB,GAAI,KAAK,iBAAiB,KAAA,IAAY,EAAE,cAAc,KAAK,cAAc,GAAG,EAAE;GAC/E,CAAC;;AAEJ,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAM;GAAS;EAAE;;AAG1D,eAAsB,wBACpB,KACA,SACA,MACiC;CACjC,MAAM,SAAS,yBAAyB,KAAK,QAAQ;CACrD,MAAM,cAAc,uBAAuB,KAAK,QAAQ;CACxD,MAAM,SAAS,gBAAgB,KAAK,QAAQ;AAC5C,OAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;AACxC,OAAM,MAAM,aAAa,EAAE,WAAW,MAAM,CAAC;AAC7C,OAAM,MAAM,QAAQ,EAAE,WAAW,MAAM,CAAC;CACxC,MAAM,KAAK,iBAAiB,QAAQ;CAEpC,MAAM,cAAc,qBAAqB,uBAD3B,iBAAiB,IAAI,CAAC,MAAM,MAAM,iBAAiB,EAAE,GAAG,KAAK,GACN,EAAE,KAAK,EAAE,KAAK,IAAI;AAGvF,KAAI,MAAM,WAAW;EACnB,MAAM,iBAAiB,uBAAuB,KAAK,iBAAiB,KAAK,UAAU,CAAC;AACpF,MAAI;AAEF,QAAI,MADkB,KAAK,eAAe,EAC9B,aAAa,EAAE;IACzB,MAAM,WAAW,MAAM,QAAQ,eAAe;AAC9C,SAAK,MAAM,YAAY,UAAU;KAC/B,MAAM,UAAU,KAAK,gBAAgB,SAAS;KAC9C,MAAM,UAAU,KAAK,aAAa,SAAS;AAC3C,SAAI;AAEF,WAAI,MADmB,KAAK,QAAQ,EACvB,QAAQ,CACnB,OAAM,GAAG,SAAS,QAAQ;aAEtB;;;UAKN;AAEN,iCAA8B,aAAa,QAAQ,EAAE,aAAa,CAAC;;OAGrE,+BAA8B,aAAa,QAAQ,EAAE,aAAa,CAAC;CAGrE,MAAM,eAAe,MAAM;AAC3B,KAAI,gBAAgB,OAAO,KAAK,aAAa,CAAC,SAAS,EACrD,MAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,aAAa,EAAE;EAC1D,MAAM,UAAU,MAAM,sBAAsB,KAAK,SAAS,MAAM,QAAQ;AACxE,MAAI,QAAQ,OAAO,MACjB,QAAO;;AAKb,QAAO;EAAE,IAAI;EAAM,MAAM,KAAA;EAAW;;AAgBtC,SAAgB,mBACd,KACA,YACA,MAC0C;CAC1C,MAAM,UAAU,iBAAiB,WAAW;CAC5C,IAAI,OAAO,CAAC,GAAG,iBAAiB,IAAI,CAAC;CACrC,IAAI,MAAM,oBAAoB,MAAM,QAAQ;AAC5C,KAAI,MAAM,KAAK,YAAY,sBAAsB,IAAI,EAAE;AACrD,SAAO,CAAC,GAAG,MAAM;GAAE,IAAI;GAAS,SAAS;GAAe,CAAC;AACzD,QAAM,KAAK,SAAS;;AAEtB,KAAI,MAAM,EACR,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAc,QAAQ;EAAK;CAI1E,MAAM,QAAe,EAAE,GAAG,KAAK,MAAM;AAErC,KAAI,KAAK,SAAS,KAAA,GAAW;EAC3B,MAAM,WAAW,uBAAuB,KAAK,KAAK;AAClD,MAAI,SACF,OAAM,OAAO;;AAGjB,KAAI,KAAK,gBAAgB,KAAA,GAAW;EAClC,MAAM,kBAAkB,KAAK,gBAAgB,OAAO,KAAA,IAAY,uBAAuB,KAAK,YAAY;AACxG,MAAI,gBACF,OAAM,cAAc;MAEpB,QAAO,MAAM;;AAGjB,KAAI,KAAK,cAAc,KAAA,GAAW;EAChC,MAAM,IAAI,KAAK,UAAU,MAAM;AAC/B,MAAI,EACF,OAAM,YAAY,gBAAgB,EAAE;;AAGxC,KAAI,KAAK,UAAU,KAAA,EACjB,KAAI,KAAK,UAAU,KACjB,QAAO,MAAM;MACR;EACL,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC,MAAM;AACzC,MAAI,CAAC,QACH,QAAO;GAAE,IAAI;GAAO,OAAO;GAA4C,QAAQ;GAAK;AAEtF,QAAM,QAAQ,EAAE,SAAS,SAAS;;AAGtC,KAAI,KAAK,aAAa,KAAA,EACpB,KAAI,KAAK,aAAa,QAAQ,OAAO,KAAK,SAAS,CAAC,MAAM,KAAK,GAC7D,QAAO,MAAM;KAEb,OAAM,WAAW,OAAO,KAAK,SAAS,CAAC,MAAM;AAIjD,KAAI,KAAK,WAAW,KAAA,EAClB,KAAI,KAAK,WAAW,KAClB,QAAO,MAAM;MACR;EACL,MAAM,OAAO,KAAK,OAAO,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AACrE,MAAI,KAAK,WAAW,EAClB,OAAM,SAAS,EAAE;MAEjB,OAAM,SAAS;;AAKrB,KAAI,KAAK,iBAAiB,KAAA,EACxB,KAAI,KAAK,iBAAiB;MACpB,MAAM,OAAO;AACf,UAAO,MAAM,MAAM;AACnB,OAAI,OAAO,KAAK,MAAM,MAAM,CAAC,WAAW,EACtC,QAAO,MAAM;;QAGZ;EACL,MAAM,OAAO,KAAK,aAAa,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,QAAQ;AAC3E,QAAM,QAAQ;GAAE,GAAG,MAAM;GAAO,SAAS;GAAM;;AAInD,MAAK,OAAO;CACZ,IAAI,OAAe;EACjB,GAAG;EACH,QAAQ;GACN,GAAG,IAAI;GACP;GACD;EACF;AAED,KAAI,KAAK,eAAe,KACtB,QAAO;EACL,GAAG;EACH,QAAQ;GACN,GAAG,KAAK;GACR,SAAS;GACV;EACF;AAEH,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE,YAAY,MAAM;EAAE;;AAGjD,SAAgB,mBACd,KACA,YAC2D;CAC3D,MAAM,UAAU,iBAAiB,WAAW;CAC5C,MAAM,WAAW,eAAe,QAAQ;AACxC,KAAI,SACF,QAAO;AAET,KAAI,oBAAoB,iBAAiB,IAAI,EAAE,QAAQ,GAAG,EACxD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,QAAQ;EAAc,QAAQ;EAAK;CAE1E,MAAM,EAAE,QAAQ,WAAW,iBAAiB,KAAK,QAAQ;AACzD,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,YAAY;GAAQ;GAAS;EAAE;;AAG5D,eAAsB,oBAAoB,KAAa,SAAgC;AACrF,OAAM,wBAAwB,KAAK,QAAQ;;AAU7C,eAAe,wBAAwB,KAAa,SAAkC;CACpF,MAAM,MAAM,uBAAuB,KAAK,QAAQ;AAChD,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AACrC,KAAI;AACF,SAAO,MAAM,SAAS,IAAI;SACpB;AACN,SAAOA,QAAY,IAAI;;;AAI3B,SAAS,kBAAkB,MAA8C;AACvE,KAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,KAAK,IAAI,CAAC,gCAAgC,IAAI,KAAK,CAClG,QAAO;EAAE,IAAI;EAAO,OAAO,qBAAqB,KAAK;EAAI,QAAQ;EAAK;AAExE,QAAO;;AAGT,eAAsB,sBACpB,KACA,SAC6F;CAC7F,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAErE,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,QAAQ,CAAC,GAAG,gCAAgC;CAClD,MAAM,QAA0B,EAAE;AAClC,MAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,EAAE;EAC3D,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,IACH;AAEF,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,IAAI;AAC1B,OAAI,CAAC,GAAG,QAAQ,CACd;AAEF,SAAM,KAAK;IACT;IACA,SAAS;IACT,MAAM,GAAG;IACT,aAAa,GAAG;IACjB,CAAC;UACI;AACN,SAAM,KAAK;IAAE;IAAM,SAAS;IAAM,CAAC;;;AAGvC,OAAM,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;AAClD,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,YAAY;GAAM;GAAO;EAAE;;AAGrE,eAAsB,qBACpB,KACA,SACA,MAC+E;CAC/E,MAAM,MAAM,kBAAkB,KAAK;AACnC,KAAI,IACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAGrE,MAAM,MAAM,yBAAyB,MADlB,wBAAwB,KAAK,GAAG,EACR,KAAK;AAChD,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAE1D,KAAI;AAEF,SAAO;GAAE,IAAI;GAAM,MAAM;IAAE,SAAS;IAAI,SAAA,MADlB,SAAS,KAAK,QAAQ;IACK,MAAM;IAAK;GAAE;SACxD;AACN,SAAO;GAAE,IAAI;GAAO,OAAO;GAAkB,QAAQ;GAAK;;;AAI9D,eAAsB,sBACpB,KACA,SACA,MACA,SAC8D;CAC9D,MAAM,MAAM,kBAAkB,KAAK;AACnC,KAAI,IACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;AACpC,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;CAGrE,MAAM,MAAM,yBAAyB,MADlB,wBAAwB,KAAK,GAAG,EACR,KAAK;AAChD,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAG1D,KAAI,CAAC,qBAAqB,MADH,wBAAwB,KAAK,GAAG,EACnB,IAAI,CACtC,QAAO;EAAE,IAAI;EAAO,OAAO;EAAsC,QAAQ;EAAK;AAEhF,OAAM,UAAU,KAAK,SAAS,QAAQ;AACtC,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,MAAM;GAAK;EAAE;;AAOvD,MAAM,yBAAyB,MAAM;AACrC,MAAM,wBAAwB;AAE9B,MAAM,0BAA0B;CAAC;CAAQ;CAAQ;CAAS;CAAQ;AAElE,SAAS,uBAAiC;AACxC,QAAO,wBAAwB,KAAK,QAAQ,GAAG,wBAAwB,MAAM;;AAG/E,SAAS,UAAU,MAA0D;CAC3E,MAAM,IAAI,KAAK,aAAa,CAAC,MAAM;AACnC,KAAI,MAAM,YAAa,QAAO;AAC9B,KAAI,MAAM,gBAAgB,MAAM,YAAa,QAAO;AACpD,KAAI,MAAM,aAAc,QAAO;AAC/B,QAAO;;AAGT,SAAS,yBAAyB,KAAmE;AACnG,KAAI,IAAI,UAAU,KAAK,IAAI,OAAO,OAAQ,IAAI,OAAO,MAAQ,IAAI,OAAO,MAAQ,IAAI,OAAO,GACzF,QAAO;AAET,KAAI,IAAI,UAAU,KAAK,IAAI,OAAO,OAAQ,IAAI,OAAO,OAAQ,IAAI,OAAO,IACtE,QAAO;AAET,KACE,IAAI,UAAU,MACd,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,OAAO,MACX,IAAI,QAAQ,MACZ,IAAI,QAAQ,GAEZ,QAAO;AAET,QAAO;;AAGT,SAAS,2BAA2B,KAAa,IAA4C;AAC3F,KAAI,uBAAuB,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,CACpD,QAAO;EAAE,IAAI;EAAO,OAAO,UAAU,GAAG;EAAc,QAAQ;EAAK;AAErE,QAAO;;AAGT,eAAsB,oBACpB,KACA,SACmG;CACnG,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;AACnD,MAAK,MAAM,QAAQ,sBAAsB,EAAE;EACzC,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,IACH;AAEF,MAAI;GACF,MAAM,KAAK,MAAM,KAAK,IAAI;AAC1B,OAAI,CAAC,GAAG,QAAQ,IAAI,GAAG,QAAQ,KAAK,GAAG,OAAO,uBAC5C;GAEF,MAAM,SAAS,MAAM,SAAS,IAAI;GAClC,MAAM,WAAW,yBAAyB,OAAO;AACjD,OAAI,CAAC,SACH;AAEF,UAAO;IAAE,IAAI;IAAM,MAAM;KAAE,SAAS;KAAI;KAAQ,aAAa;KAAU,MAAM;KAAK;IAAE;UAC9E;;AAIV,QAAO;EAAE,IAAI;EAAO,OAAO;EAAoB,QAAQ;EAAK;;AAG9D,eAAsB,2BACpB,KACA,SACA,QACA,UAC8D;CAC9D,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,MAAM,UAAU,SAAS;AAC/B,KAAI,CAAC,IACH,QAAO;EAAE,IAAI;EAAO,OAAO;EAAmE,QAAQ;EAAK;CAE7G,IAAI;AACJ,KAAI;AACF,QAAM,OAAO,KAAK,QAAQ,SAAS;SAC7B;AACN,SAAO;GAAE,IAAI;GAAO,OAAO;GAAkB,QAAQ;GAAK;;AAE5D,KAAI,IAAI,WAAW,KAAK,IAAI,SAAS,uBACnC,QAAO;EAAE,IAAI;EAAO,OAAO,wCAAwC,uBAAuB;EAAS,QAAQ;EAAK;CAElH,MAAM,WAAW,yBAAyB,IAAI;AAC9C,KAAI,CAAC,YAAY,CAAC,uBAAuB,KAAK,SAAS,CACrD,QAAO;EAAE,IAAI;EAAO,OAAO;EAAmD,QAAQ;EAAK;CAG7F,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,WAAW,MAAM,wBAAwB,KAAK,GAAG;CACvD,MAAM,aAAa,GAAG,wBAAwB;CAC9C,MAAM,MAAM,yBAAyB,MAAM,WAAW;AACtD,KAAI,CAAC,OAAO,CAAC,qBAAqB,UAAU,IAAI,CAC9C,QAAO;EAAE,IAAI;EAAO,OAAO;EAAgB,QAAQ;EAAK;AAE1D,MAAK,MAAM,QAAQ,sBAAsB,EAAE;AACzC,MAAI,SAAS,WACX;EAEF,MAAM,QAAQ,yBAAyB,MAAM,KAAK;AAClD,MAAI,SAAS,qBAAqB,UAAU,MAAM,CAChD,KAAI;AACF,SAAM,OAAO,MAAM;UACb;;AAKZ,OAAM,UAAU,KAAK,IAAI;AACzB,QAAO;EAAE,IAAI;EAAM,MAAM;GAAE,SAAS;GAAI,MAAM;GAAK;EAAE;;AAGvD,SAAS,gBAAgB,KAAqF;AAC5G,KAAI,QAAQ,OAAQ,QAAO;AAC3B,KAAI,QAAQ,QAAS,QAAO;AAC5B,QAAO;;AAGT,SAAS,uBACP,KACA,UACS;AACT,QAAO,aAAa,gBAAgB,IAAI;;;AAI1C,eAAsB,sBAAsB,KAAa,SAAiE;CACxH,MAAM,eAAe,2BAA2B,KAAK,QAAQ;AAC7D,KAAI,aACF,QAAO;CAET,MAAM,KAAK,iBAAiB,QAAQ;CACpC,MAAM,OAAO,MAAM,wBAAwB,KAAK,GAAG;CACnD,MAAM,WAAW,MAAM,wBAAwB,KAAK,GAAG;AACvD,MAAK,MAAM,QAAQ,sBAAsB,EAAE;EACzC,MAAM,MAAM,yBAAyB,MAAM,KAAK;AAChD,MAAI,CAAC,OAAO,CAAC,qBAAqB,UAAU,IAAI,CAC9C;AAEF,MAAI;AACF,SAAM,OAAO,IAAI;UACX;;AAIV,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE,SAAS,IAAI;EAAE"}

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -178,6 +178,11 @@ export declare function buildSafeWebConfigPayload(service: GatewayService): Prom
             tools: {
                 disable?: string[];
             };
+            models: {
+                id: string;
+                model: string;
+                description?: string;
+            }[];
             params: Record<string, unknown>;
         };
     };
@@ -236,6 +241,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService): Prom
         channelConnectDeferIds: string[];
         channelConnectDeferSkipIds: string[];
         share: import("../../../share/share-types.js").ShareConfig;
+        publicUrl: string;
         skillsMarketplaceProvider: string;
         skillsStoreBaseUrl: string;
     };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -9,10 +9,10 @@ import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normal
 import { bundledChannelPlugins } from "../../../generated/bundled-channel-plugins.js";
 import { listChannelPlugins, syncChannelPluginsFromManager } from "../../../channels/plugins/registry.js";
 import { resolveCronConfigForWeb, resolveGoalsConfigForWeb, resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
-import { agentImageGenerationModelAutoProviderFallback, agentImageGenerationModelTimeoutMs, agentModelFallbacksToArray, agentModelRefToString } from "./agent-model.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
+import { agentImageGenerationModelAutoProviderFallback, agentImageGenerationModelTimeoutMs, agentModelFallbacksToArray, agentModelRefToString } from "./agent-model.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts
@@ -139,6 +139,7 @@ async function buildSafeWebConfigPayload(service) {
 				systemPromptOverride: config.agents?.defaults?.systemPromptOverride,
 				skills: config.agents?.defaults?.skills,
 				tools: config.agents?.defaults?.tools,
+				models: config.agents?.defaults?.models,
 				params: config.agents?.defaults?.params
 			}
 		},
@@ -189,6 +190,7 @@ async function buildSafeWebConfigPayload(service) {
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],
 			channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds) ? config.gateway.channelConnectDeferSkipIds : [],
 			share: resolveShareConfig(config.gateway?.share),
+			publicUrl: config.gateway?.publicUrl ?? null,
 			skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? "skillhub",
 			skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? "https://store.xopc.ai"
 		},

package/dist/src/gateway/hono/lib/config-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-payload.js","names":["getModelsJsonPath"],"sources":["../../../../../src/gateway/hono/lib/config-payload.ts"],"sourcesContent":["import {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport {\n  listChannelPlugins,\n  syncChannelPluginsFromManager,\n} from '../../../channels/plugins/registry.js';\nimport { normalizeConfiguredMcpServers } from '../../../config/mcp-config-normalize.js';\nimport type { Config } from '../../../config/schema.js';\nimport { bundledChannelPlugins } from '../../../generated/bundled-channel-plugins.js';\nimport {\n  GENERIC_MASKED_SECRET,\n  maskSecretLength,\n} from './mask-secret-length.js';\nimport { maskTunnelSecretForWeb } from '../../../tunnel/env.js';\nimport { resolveShareConfig } from '../../../share/share-config.js';\nimport {\n  resolveCronConfigForWeb,\n  resolveGoalsConfigForWeb,\n  resolveSessionConfigForWeb,\n  resolveUpdateConfigForWeb,\n} from '../../../config/web-patch.js';\nimport { CredentialResolver } from '../../../auth/credentials.js';\nimport { loadModelsJson, getModelsJsonPath } from '../../../config/models-json.js';\nimport { getAllProviders, isProviderConfigured } from '../../../providers/index.js';\nimport { getProviderRegistry } from '../../../providers/plugin-registry.js';\nimport type { GatewayService } from '../../service.js';\nimport { safeToolsWebForGet } from '../../config-tools-web.js';\nimport {\n  agentImageGenerationModelAutoProviderFallback,\n  agentImageGenerationModelTimeoutMs,\n  agentModelFallbacksToArray,\n  agentModelRefToString,\n} from './agent-model.js';\nimport { buildSafeProvidersConfigForWeb } from './safe-providers-config.js';\nimport { maskSttConfigForWeb, maskTtsConfigForWeb } from './safe-voice-config.js';\n\nfunction readModelsJsonProviderApiKey(providerId: string): string | undefined {\n  const { config } = loadModelsJson(getModelsJsonPath());\n  const entry = config.providers?.[providerId];\n  const key = entry?.apiKey;\n  return typeof key === 'string' && key.trim() ? key.trim() : undefined;\n}\n\n/** Length-preserving mask for LLM provider keys in GET `/api/config`. */\nasync function maskLlmProviderApiKeyForWeb(provider: string): Promise<string> {\n  const resolver = new CredentialResolver();\n  const stored = await resolver.revealGatewayStoredApiKey(provider);\n  if (stored) return maskSecretLength(stored);\n\n  const fromModelsJson = readModelsJsonProviderApiKey(provider);\n  if (fromModelsJson) return maskSecretLength(fromModelsJson);\n\n  // Extension plugins manage their own auth; don't show a fake gateway key mask.\n  if (getProviderRegistry().has(provider)) return '';\n\n  if (await isProviderConfigured(provider)) return GENERIC_MASKED_SECRET;\n  return '';\n}\n\n/** MCP block for GET/PATCH `/api/config` (authenticated console editing). */\nexport function buildSafeMcpConfigForWeb(config: Config) {\n  const mcp = config.mcp;\n  if (!mcp) {\n    return { servers: {} as Record<string, Record<string, unknown>> };\n  }\n  return {\n    ...(mcp.sessionIdleTtlMs !== undefined ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {}),\n    servers: normalizeConfiguredMcpServers(mcp.servers),\n  };\n}\n\nfunction maskBrowserCloudConfigForWeb(cloud: unknown): Record<string, unknown> | null {\n  if (!cloud || typeof cloud !== 'object' || Array.isArray(cloud)) {\n    return null;\n  }\n  const raw = cloud as Record<string, unknown>;\n  const safe: Record<string, unknown> = {};\n  if (typeof raw.apiKey === 'string' && raw.apiKey.trim()) {\n    safe.apiKey = maskSecretLength(raw.apiKey);\n  }\n  if (typeof raw.projectId === 'string' && raw.projectId.trim()) {\n    safe.projectId = raw.projectId.trim();\n  }\n  if (typeof raw.region === 'string' && raw.region.trim()) {\n    safe.region = raw.region.trim();\n  }\n  return Object.keys(safe).length > 0 ? safe : null;\n}\n\nexport function buildSafeBrowserConfigForWeb(browser: Config['agents']['defaults']['browser'] | undefined) {\n  if (!browser || typeof browser !== 'object') {\n    return {\n      enabled: false,\n      headless: false,\n      allowPrivateUrls: false,\n      commandTimeout: null,\n      backend: null,\n      cloudProvider: null,\n      cloud: null,\n      cdpUrl: null,\n      extension: null,\n      cloakbrowser: null,\n      humanize: null,\n      humanPreset: null,\n      dialogPolicy: null,\n      dialogTimeoutSeconds: null,\n    };\n  }\n\n  return {\n    enabled: browser.enabled !== false,\n    headless: browser.headless === true,\n    allowPrivateUrls: browser.allowPrivateUrls === true,\n    commandTimeout:\n      typeof browser.commandTimeout === 'number' && Number.isFinite(browser.commandTimeout)\n        ? Math.floor(browser.commandTimeout)\n        : null,\n    backend:\n      browser.backend === 'local' ||\n      browser.backend === 'cdp' ||\n      browser.backend === 'cloud' ||\n      browser.backend === 'extension' ||\n      browser.backend === 'cloakbrowser'\n        ? browser.backend\n        : null,\n    cloudProvider:\n      browser.cloudProvider === 'browserbase' || browser.cloudProvider === 'browser-use'\n        ? browser.cloudProvider\n        : null,\n    cloud: maskBrowserCloudConfigForWeb(browser.cloud),\n    cdpUrl: typeof browser.cdpUrl === 'string' && browser.cdpUrl.trim() ? browser.cdpUrl.trim() : null,\n    extension: browser.extension && typeof browser.extension === 'object' && !Array.isArray(browser.extension)\n      ? browser.extension\n      : null,\n    cloakbrowser:\n      browser.cloakbrowser && typeof browser.cloakbrowser === 'object' && !Array.isArray(browser.cloakbrowser)\n        ? browser.cloakbrowser\n        : null,\n    humanize: typeof browser.humanize === 'boolean' ? browser.humanize : null,\n    humanPreset: browser.humanPreset === 'default' || browser.humanPreset === 'careful' ? browser.humanPreset : null,\n    dialogPolicy:\n      browser.dialogPolicy === 'must_respond' ||\n      browser.dialogPolicy === 'auto_accept' ||\n      browser.dialogPolicy === 'auto_dismiss'\n        ? browser.dialogPolicy\n        : null,\n    dialogTimeoutSeconds:\n      typeof browser.dialogTimeoutSeconds === 'number' && Number.isFinite(browser.dialogTimeoutSeconds)\n        ? Math.floor(browser.dialogTimeoutSeconds)\n        : null,\n  };\n}\n\n/** Sanitized config snapshot for GET/PATCH `/api/config` (matches persisted `service.currentConfig`). */\nexport async function buildSafeWebConfigPayload(service: GatewayService) {\n  const config = service.currentConfig;\n  if (listChannelPlugins().length === 0) {\n    syncChannelPluginsFromManager(bundledChannelPlugins);\n  }\n  const channelsPayload = Object.fromEntries(\n    listChannelPlugins().map((plugin) => {\n      if (plugin.configSurface) {\n        return [plugin.id, plugin.configSurface.buildConfigSurface(config)];\n      }\n      const channelCfg = config.channels?.[plugin.id] as Record<string, unknown> | undefined;\n      return [\n        plugin.id,\n        {\n          enabled: channelCfg?.enabled ?? false,\n          configured: plugin.config.listAccountIds(config).length > 0,\n        },\n      ];\n    }),\n  );\n  return {\n    agents: {\n      defaultId: resolveDefaultAgentId(config),\n      list: listAgentEntries(config)\n        .filter((e) => e.enabled !== false)\n        .map((e) => ({\n          id: normalizeAgentId(e.id),\n          ...(typeof e.name === 'string' && e.name.trim() ? { name: e.name.trim() } : {}),\n        })),\n      defaults: {\n        model: agentModelRefToString(config.agents?.defaults?.model) ?? '',\n        modelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.model),\n        imageModel: agentModelRefToString(config.agents?.defaults?.imageModel) ?? null,\n        imageModelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.imageModel),\n        imageGenerationModel: agentModelRefToString(config.agents?.defaults?.imageGenerationModel) ?? null,\n        imageGenerationModelFallbacks: agentModelFallbacksToArray(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelTimeoutMs: agentImageGenerationModelTimeoutMs(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelAutoProviderFallback: agentImageGenerationModelAutoProviderFallback(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        mediaMaxMb: config.agents?.defaults?.mediaMaxMb,\n        maxTokens: config.agents?.defaults?.maxTokens,\n        temperature: config.agents?.defaults?.temperature,\n        maxToolIterations: config.agents?.defaults?.maxToolIterations,\n        workspace: config.agents?.defaults?.workspace,\n        thinkingDefault: config.agents?.defaults?.thinkingDefault,\n        reasoningDefault: config.agents?.defaults?.reasoningDefault,\n        verboseDefault: config.agents?.defaults?.verboseDefault,\n        browser: buildSafeBrowserConfigForWeb(config.agents?.defaults?.browser),\n        maxTaskDurationMs: config.agents?.defaults?.maxTaskDurationMs,\n        maxRequestsPerTurn: config.agents?.defaults?.maxRequestsPerTurn,\n        maxToolFailuresPerTurn: config.agents?.defaults?.maxToolFailuresPerTurn,\n        compaction: config.agents?.defaults?.compaction,\n        pruning: config.agents?.defaults?.pruning,\n        memory: config.agents?.defaults?.memory,\n        sessionSearch: config.agents?.defaults?.sessionSearch,\n        backgroundReview: config.agents?.defaults?.backgroundReview,\n        webExtract: config.agents?.defaults?.webExtract,\n        delegate: config.agents?.defaults?.delegate,\n        executeCode: config.agents?.defaults?.executeCode,\n        systemPromptOverride: config.agents?.defaults?.systemPromptOverride,\n        skills: config.agents?.defaults?.skills,\n        tools: config.agents?.defaults?.tools,\n        params: config.agents?.defaults?.params,\n      },\n    },\n    channels: channelsPayload,\n    providers: Object.fromEntries(\n      await Promise.all(\n        getAllProviders().map(async (provider) => [\n          provider,\n          await maskLlmProviderApiKeyForWeb(provider),\n        ]),\n      ),\n    ),\n    /** Masked `cfg.providers` for capability keys (image / STT / etc.). */\n    providersConfig: buildSafeProvidersConfigForWeb(config.providers),\n    gateway: {\n      bind: config.gateway?.bind ?? 'loopback',\n      customBindHost: config.gateway?.customBindHost,\n      port: config.gateway?.port,\n      corsOrigins: Array.isArray(config.gateway?.corsOrigins) ? config.gateway.corsOrigins : [],\n      trustedProxies: Array.isArray(config.gateway?.trustedProxies)\n        ? config.gateway.trustedProxies\n        : [],\n      allowRealIpFallback: config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback:\n        config.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n      security: {\n        strict: config.gateway?.security?.strict === true,\n      },\n      auth: {\n        mode: config.gateway?.auth?.mode || 'token',\n        token: config.gateway?.auth?.token ? maskSecretLength(config.gateway.auth.token) : '',\n        password: config.gateway?.auth?.password\n          ? maskSecretLength(config.gateway.auth.password)\n          : '',\n        trustedProxy: config.gateway?.auth?.trustedProxy\n          ? {\n              userHeader: config.gateway.auth.trustedProxy.userHeader,\n              requiredHeaders: config.gateway.auth.trustedProxy.requiredHeaders ?? [],\n              allowUsers: config.gateway.auth.trustedProxy.allowUsers ?? [],\n              allowLoopback: config.gateway.auth.trustedProxy.allowLoopback === true,\n            }\n          : undefined,\n        rateLimit: {\n          enabled: config.gateway?.auth?.rateLimit?.enabled !== false,\n          maxAttempts:\n            typeof config.gateway?.auth?.rateLimit?.maxAttempts === 'number'\n              ? config.gateway.auth.rateLimit.maxAttempts\n              : 5,\n          windowMs:\n            typeof config.gateway?.auth?.rateLimit?.windowMs === 'number'\n              ? config.gateway.auth.rateLimit.windowMs\n              : 900_000,\n          blockDurationMs:\n            typeof config.gateway?.auth?.rateLimit?.blockDurationMs === 'number'\n              ? config.gateway.auth.rateLimit.blockDurationMs\n              : typeof config.gateway?.auth?.rateLimit?.lockoutMs === 'number'\n                ? config.gateway.auth.rateLimit.lockoutMs\n                : 300_000,\n          exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false,\n        },\n      },\n      heartbeat: {\n        enabled: config.gateway?.heartbeat?.enabled,\n        intervalMs: config.gateway?.heartbeat?.intervalMs,\n        includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,\n        target: config.gateway?.heartbeat?.target,\n        targetChatId: config.gateway?.heartbeat?.targetChatId,\n        prompt: config.gateway?.heartbeat?.prompt,\n        ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,\n        isolatedSession: config.gateway?.heartbeat?.isolatedSession,\n        activeHours: config.gateway?.heartbeat?.activeHours,\n      },\n      maxSseConnections:\n        typeof config.gateway?.maxSseConnections === 'number'\n          ? config.gateway.maxSseConnections\n          : 100,\n      channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? 'auto',\n      channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds)\n        ? config.gateway.channelConnectDeferIds\n        : [],\n      channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds)\n        ? config.gateway.channelConnectDeferSkipIds\n        : [],\n      share: resolveShareConfig(config.gateway?.share),\n      skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? 'skillhub',\n      skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? 'https://store.xopc.ai',\n    },\n    cron: resolveCronConfigForWeb(config),\n    goals: resolveGoalsConfigForWeb(config),\n    session: resolveSessionConfigForWeb(config),\n    tunnel: {\n      enabled: config.tunnel?.enabled === true,\n      autoStart: config.tunnel?.autoStart === true,\n      brokerUrl: config.tunnel?.brokerUrl ?? 'https://frp.xopc.ai/api',\n      registrationSecret: config.tunnel?.registrationSecret\n        ? maskTunnelSecretForWeb(config.tunnel.registrationSecret)\n        : '',\n      consent: config.tunnel?.consent\n        ? {\n            version: config.tunnel.consent.version,\n            acceptedAt: config.tunnel.consent.acceptedAt,\n          }\n        : undefined,\n      transport: { tls: 'broker_terminated' as const },\n    },\n    update: {\n      ...resolveUpdateConfigForWeb(config),\n    },\n    stt: maskSttConfigForWeb(config.tools?.media?.audio),\n    tts: maskTtsConfigForWeb(config.messages?.tts),\n    tools: safeToolsWebForGet(config),\n    bindings: Array.isArray(config.bindings) ? config.bindings : [],\n    mcp: buildSafeMcpConfigForWeb(config),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;kBAIuC;kBAoB2B;kBACiB;gBACC;sBACR;AAY5E,SAAS,6BAA6B,YAAwC;CAC5E,MAAM,EAAE,WAAW,eAAeA,uBAAmB,CAAC;CAEtD,MAAM,OADQ,OAAO,YAAY,cACd;AACnB,QAAO,OAAO,QAAQ,YAAY,IAAI,MAAM,GAAG,IAAI,MAAM,GAAG,KAAA;;;AAI9D,eAAe,4BAA4B,UAAmC;CAE5E,MAAM,SAAS,MAAM,IADA,oBACQ,CAAC,0BAA0B,SAAS;AACjE,KAAI,OAAQ,QAAO,iBAAiB,OAAO;CAE3C,MAAM,iBAAiB,6BAA6B,SAAS;AAC7D,KAAI,eAAgB,QAAO,iBAAiB,eAAe;AAG3D,KAAI,qBAAqB,CAAC,IAAI,SAAS,CAAE,QAAO;AAEhD,KAAI,MAAM,qBAAqB,SAAS,CAAE,QAAO;AACjD,QAAO;;;AAIT,SAAgB,yBAAyB,QAAgB;CACvD,MAAM,MAAM,OAAO;AACnB,KAAI,CAAC,IACH,QAAO,EAAE,SAAS,EAAE,EAA6C;AAEnE,QAAO;EACL,GAAI,IAAI,qBAAqB,KAAA,IAAY,EAAE,kBAAkB,IAAI,kBAAkB,GAAG,EAAE;EACxF,SAAS,8BAA8B,IAAI,QAAQ;EACpD;;AAGH,SAAS,6BAA6B,OAAgD;AACpF,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;CAET,MAAM,MAAM;CACZ,MAAM,OAAgC,EAAE;AACxC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,iBAAiB,IAAI,OAAO;AAE5C,KAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,MAAM,CAC3D,MAAK,YAAY,IAAI,UAAU,MAAM;AAEvC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,IAAI,OAAO,MAAM;AAEjC,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;;AAG/C,SAAgB,6BAA6B,SAA8D;AACzG,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO;EACL,SAAS;EACT,UAAU;EACV,kBAAkB;EAClB,gBAAgB;EAChB,SAAS;EACT,eAAe;EACf,OAAO;EACP,QAAQ;EACR,WAAW;EACX,cAAc;EACd,UAAU;EACV,aAAa;EACb,cAAc;EACd,sBAAsB;EACvB;AAGH,QAAO;EACL,SAAS,QAAQ,YAAY;EAC7B,UAAU,QAAQ,aAAa;EAC/B,kBAAkB,QAAQ,qBAAqB;EAC/C,gBACE,OAAO,QAAQ,mBAAmB,YAAY,OAAO,SAAS,QAAQ,eAAe,GACjF,KAAK,MAAM,QAAQ,eAAe,GAClC;EACN,SACE,QAAQ,YAAY,WACpB,QAAQ,YAAY,SACpB,QAAQ,YAAY,WACpB,QAAQ,YAAY,eACpB,QAAQ,YAAY,iBAChB,QAAQ,UACR;EACN,eACE,QAAQ,kBAAkB,iBAAiB,QAAQ,kBAAkB,gBACjE,QAAQ,gBACR;EACN,OAAO,6BAA6B,QAAQ,MAAM;EAClD,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,GAAG;EAC9F,WAAW,QAAQ,aAAa,OAAO,QAAQ,cAAc,YAAY,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACtG,QAAQ,YACR;EACJ,cACE,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,YAAY,CAAC,MAAM,QAAQ,QAAQ,aAAa,GACpG,QAAQ,eACR;EACN,UAAU,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW;EACrE,aAAa,QAAQ,gBAAgB,aAAa,QAAQ,gBAAgB,YAAY,QAAQ,cAAc;EAC5G,cACE,QAAQ,iBAAiB,kBACzB,QAAQ,iBAAiB,iBACzB,QAAQ,iBAAiB,iBACrB,QAAQ,eACR;EACN,sBACE,OAAO,QAAQ,yBAAyB,YAAY,OAAO,SAAS,QAAQ,qBAAqB,GAC7F,KAAK,MAAM,QAAQ,qBAAqB,GACxC;EACP;;;AAIH,eAAsB,0BAA0B,SAAyB;CACvE,MAAM,SAAS,QAAQ;AACvB,KAAI,oBAAoB,CAAC,WAAW,EAClC,+BAA8B,sBAAsB;CAEtD,MAAM,kBAAkB,OAAO,YAC7B,oBAAoB,CAAC,KAAK,WAAW;AACnC,MAAI,OAAO,cACT,QAAO,CAAC,OAAO,IAAI,OAAO,cAAc,mBAAmB,OAAO,CAAC;EAErE,MAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,SAAO,CACL,OAAO,IACP;GACE,SAAS,YAAY,WAAW;GAChC,YAAY,OAAO,OAAO,eAAe,OAAO,CAAC,SAAS;GAC3D,CACF;GACD,CACH;AACD,QAAO;EACL,QAAQ;GACN,WAAW,sBAAsB,OAAO;GACxC,MAAM,iBAAiB,OAAO,CAC3B,QAAQ,MAAM,EAAE,YAAY,MAAM,CAClC,KAAK,OAAO;IACX,IAAI,iBAAiB,EAAE,GAAG;IAC1B,GAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,EAAE;IAC/E,EAAE;GACL,UAAU;IACR,OAAO,sBAAsB,OAAO,QAAQ,UAAU,MAAM,IAAI;IAChE,gBAAgB,2BAA2B,OAAO,QAAQ,UAAU,MAAM;IAC1E,YAAY,sBAAsB,OAAO,QAAQ,UAAU,WAAW,IAAI;IAC1E,qBAAqB,2BAA2B,OAAO,QAAQ,UAAU,WAAW;IACpF,sBAAsB,sBAAsB,OAAO,QAAQ,UAAU,qBAAqB,IAAI;IAC9F,+BAA+B,2BAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,+BAA+B,mCAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,0CAA0C,8CACxC,OAAO,QAAQ,UAAU,qBAC1B;IACD,YAAY,OAAO,QAAQ,UAAU;IACrC,WAAW,OAAO,QAAQ,UAAU;IACpC,aAAa,OAAO,QAAQ,UAAU;IACtC,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,WAAW,OAAO,QAAQ,UAAU;IACpC,iBAAiB,OAAO,QAAQ,UAAU;IAC1C,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,gBAAgB,OAAO,QAAQ,UAAU;IACzC,SAAS,6BAA6B,OAAO,QAAQ,UAAU,QAAQ;IACvE,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,oBAAoB,OAAO,QAAQ,UAAU;IAC7C,wBAAwB,OAAO,QAAQ,UAAU;IACjD,YAAY,OAAO,QAAQ,UAAU;IACrC,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,QAAQ,UAAU;IACjC,eAAe,OAAO,QAAQ,UAAU;IACxC,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,YAAY,OAAO,QAAQ,UAAU;IACrC,UAAU,OAAO,QAAQ,UAAU;IACnC,aAAa,OAAO,QAAQ,UAAU;IACtC,sBAAsB,OAAO,QAAQ,UAAU;IAC/C,QAAQ,OAAO,QAAQ,UAAU;IACjC,OAAO,OAAO,QAAQ,UAAU;IAChC,QAAQ,OAAO,QAAQ,UAAU;IAClC;GACF;EACD,UAAU;EACV,WAAW,OAAO,YAChB,MAAM,QAAQ,IACZ,iBAAiB,CAAC,IAAI,OAAO,aAAa,CACxC,UACA,MAAM,4BAA4B,SAAS,CAC5C,CAAC,CACH,CACF;;EAED,iBAAiB,+BAA+B,OAAO,UAAU;EACjE,SAAS;GACP,MAAM,OAAO,SAAS,QAAQ;GAC9B,gBAAgB,OAAO,SAAS;GAChC,MAAM,OAAO,SAAS;GACtB,aAAa,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,OAAO,QAAQ,cAAc,EAAE;GACzF,gBAAgB,MAAM,QAAQ,OAAO,SAAS,eAAe,GACzD,OAAO,QAAQ,iBACf,EAAE;GACN,qBAAqB,OAAO,SAAS,wBAAwB;GAC7D,0CACE,OAAO,SAAS,6CAA6C;GAC/D,UAAU,EACR,QAAQ,OAAO,SAAS,UAAU,WAAW,MAC9C;GACD,MAAM;IACJ,MAAM,OAAO,SAAS,MAAM,QAAQ;IACpC,OAAO,OAAO,SAAS,MAAM,QAAQ,iBAAiB,OAAO,QAAQ,KAAK,MAAM,GAAG;IACnF,UAAU,OAAO,SAAS,MAAM,WAC5B,iBAAiB,OAAO,QAAQ,KAAK,SAAS,GAC9C;IACJ,cAAc,OAAO,SAAS,MAAM,eAChC;KACE,YAAY,OAAO,QAAQ,KAAK,aAAa;KAC7C,iBAAiB,OAAO,QAAQ,KAAK,aAAa,mBAAmB,EAAE;KACvE,YAAY,OAAO,QAAQ,KAAK,aAAa,cAAc,EAAE;KAC7D,eAAe,OAAO,QAAQ,KAAK,aAAa,kBAAkB;KACnE,GACD,KAAA;IACJ,WAAW;KACT,SAAS,OAAO,SAAS,MAAM,WAAW,YAAY;KACtD,aACE,OAAO,OAAO,SAAS,MAAM,WAAW,gBAAgB,WACpD,OAAO,QAAQ,KAAK,UAAU,cAC9B;KACN,UACE,OAAO,OAAO,SAAS,MAAM,WAAW,aAAa,WACjD,OAAO,QAAQ,KAAK,UAAU,WAC9B;KACN,iBACE,OAAO,OAAO,SAAS,MAAM,WAAW,oBAAoB,WACxD,OAAO,QAAQ,KAAK,UAAU,kBAC9B,OAAO,OAAO,SAAS,MAAM,WAAW,cAAc,WACpD,OAAO,QAAQ,KAAK,UAAU,YAC9B;KACR,gBAAgB,OAAO,SAAS,MAAM,WAAW,mBAAmB;KACrE;IACF;GACD,WAAW;IACT,SAAS,OAAO,SAAS,WAAW;IACpC,YAAY,OAAO,SAAS,WAAW;IACvC,4BAA4B,OAAO,SAAS,WAAW,+BAA+B;IACtF,QAAQ,OAAO,SAAS,WAAW;IACnC,cAAc,OAAO,SAAS,WAAW;IACzC,QAAQ,OAAO,SAAS,WAAW;IACnC,aAAa,OAAO,SAAS,WAAW;IACxC,iBAAiB,OAAO,SAAS,WAAW;IAC5C,aAAa,OAAO,SAAS,WAAW;IACzC;GACD,mBACE,OAAO,OAAO,SAAS,sBAAsB,WACzC,OAAO,QAAQ,oBACf;GACN,yBAAyB,OAAO,SAAS,2BAA2B;GACpE,wBAAwB,MAAM,QAAQ,OAAO,SAAS,uBAAuB,GACzE,OAAO,QAAQ,yBACf,EAAE;GACN,4BAA4B,MAAM,QAAQ,OAAO,SAAS,2BAA2B,GACjF,OAAO,QAAQ,6BACf,EAAE;GACN,OAAO,mBAAmB,OAAO,SAAS,MAAM;GAChD,2BAA2B,OAAO,SAAS,6BAA6B;GACxE,oBAAoB,OAAO,SAAS,sBAAsB;GAC3D;EACD,MAAM,wBAAwB,OAAO;EACrC,OAAO,yBAAyB,OAAO;EACvC,SAAS,2BAA2B,OAAO;EAC3C,QAAQ;GACN,SAAS,OAAO,QAAQ,YAAY;GACpC,WAAW,OAAO,QAAQ,cAAc;GACxC,WAAW,OAAO,QAAQ,aAAa;GACvC,oBAAoB,OAAO,QAAQ,qBAC/B,uBAAuB,OAAO,OAAO,mBAAmB,GACxD;GACJ,SAAS,OAAO,QAAQ,UACpB;IACE,SAAS,OAAO,OAAO,QAAQ;IAC/B,YAAY,OAAO,OAAO,QAAQ;IACnC,GACD,KAAA;GACJ,WAAW,EAAE,KAAK,qBAA8B;GACjD;EACD,QAAQ,EACN,GAAG,0BAA0B,OAAO,EACrC;EACD,KAAK,oBAAoB,OAAO,OAAO,OAAO,MAAM;EACpD,KAAK,oBAAoB,OAAO,UAAU,IAAI;EAC9C,OAAO,mBAAmB,OAAO;EACjC,UAAU,MAAM,QAAQ,OAAO,SAAS,GAAG,OAAO,WAAW,EAAE;EAC/D,KAAK,yBAAyB,OAAO;EACtC"}
+{"version":3,"file":"config-payload.js","names":["getModelsJsonPath"],"sources":["../../../../../src/gateway/hono/lib/config-payload.ts"],"sourcesContent":["import {\n  listAgentEntries,\n  normalizeAgentId,\n  resolveDefaultAgentId,\n} from '../../../agent/agent-scope.js';\nimport {\n  listChannelPlugins,\n  syncChannelPluginsFromManager,\n} from '../../../channels/plugins/registry.js';\nimport { normalizeConfiguredMcpServers } from '../../../config/mcp-config-normalize.js';\nimport type { Config } from '../../../config/schema.js';\nimport { bundledChannelPlugins } from '../../../generated/bundled-channel-plugins.js';\nimport {\n  GENERIC_MASKED_SECRET,\n  maskSecretLength,\n} from './mask-secret-length.js';\nimport { maskTunnelSecretForWeb } from '../../../tunnel/env.js';\nimport { resolveShareConfig } from '../../../share/share-config.js';\nimport {\n  resolveCronConfigForWeb,\n  resolveGoalsConfigForWeb,\n  resolveSessionConfigForWeb,\n  resolveUpdateConfigForWeb,\n} from '../../../config/web-patch.js';\nimport { CredentialResolver } from '../../../auth/credentials.js';\nimport { loadModelsJson, getModelsJsonPath } from '../../../config/models-json.js';\nimport { getAllProviders, isProviderConfigured } from '../../../providers/index.js';\nimport { getProviderRegistry } from '../../../providers/plugin-registry.js';\nimport type { GatewayService } from '../../service.js';\nimport { safeToolsWebForGet } from '../../config-tools-web.js';\nimport {\n  agentImageGenerationModelAutoProviderFallback,\n  agentImageGenerationModelTimeoutMs,\n  agentModelFallbacksToArray,\n  agentModelRefToString,\n} from './agent-model.js';\nimport { buildSafeProvidersConfigForWeb } from './safe-providers-config.js';\nimport { maskSttConfigForWeb, maskTtsConfigForWeb } from './safe-voice-config.js';\n\nfunction readModelsJsonProviderApiKey(providerId: string): string | undefined {\n  const { config } = loadModelsJson(getModelsJsonPath());\n  const entry = config.providers?.[providerId];\n  const key = entry?.apiKey;\n  return typeof key === 'string' && key.trim() ? key.trim() : undefined;\n}\n\n/** Length-preserving mask for LLM provider keys in GET `/api/config`. */\nasync function maskLlmProviderApiKeyForWeb(provider: string): Promise<string> {\n  const resolver = new CredentialResolver();\n  const stored = await resolver.revealGatewayStoredApiKey(provider);\n  if (stored) return maskSecretLength(stored);\n\n  const fromModelsJson = readModelsJsonProviderApiKey(provider);\n  if (fromModelsJson) return maskSecretLength(fromModelsJson);\n\n  // Extension plugins manage their own auth; don't show a fake gateway key mask.\n  if (getProviderRegistry().has(provider)) return '';\n\n  if (await isProviderConfigured(provider)) return GENERIC_MASKED_SECRET;\n  return '';\n}\n\n/** MCP block for GET/PATCH `/api/config` (authenticated console editing). */\nexport function buildSafeMcpConfigForWeb(config: Config) {\n  const mcp = config.mcp;\n  if (!mcp) {\n    return { servers: {} as Record<string, Record<string, unknown>> };\n  }\n  return {\n    ...(mcp.sessionIdleTtlMs !== undefined ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {}),\n    servers: normalizeConfiguredMcpServers(mcp.servers),\n  };\n}\n\nfunction maskBrowserCloudConfigForWeb(cloud: unknown): Record<string, unknown> | null {\n  if (!cloud || typeof cloud !== 'object' || Array.isArray(cloud)) {\n    return null;\n  }\n  const raw = cloud as Record<string, unknown>;\n  const safe: Record<string, unknown> = {};\n  if (typeof raw.apiKey === 'string' && raw.apiKey.trim()) {\n    safe.apiKey = maskSecretLength(raw.apiKey);\n  }\n  if (typeof raw.projectId === 'string' && raw.projectId.trim()) {\n    safe.projectId = raw.projectId.trim();\n  }\n  if (typeof raw.region === 'string' && raw.region.trim()) {\n    safe.region = raw.region.trim();\n  }\n  return Object.keys(safe).length > 0 ? safe : null;\n}\n\nexport function buildSafeBrowserConfigForWeb(browser: Config['agents']['defaults']['browser'] | undefined) {\n  if (!browser || typeof browser !== 'object') {\n    return {\n      enabled: false,\n      headless: false,\n      allowPrivateUrls: false,\n      commandTimeout: null,\n      backend: null,\n      cloudProvider: null,\n      cloud: null,\n      cdpUrl: null,\n      extension: null,\n      cloakbrowser: null,\n      humanize: null,\n      humanPreset: null,\n      dialogPolicy: null,\n      dialogTimeoutSeconds: null,\n    };\n  }\n\n  return {\n    enabled: browser.enabled !== false,\n    headless: browser.headless === true,\n    allowPrivateUrls: browser.allowPrivateUrls === true,\n    commandTimeout:\n      typeof browser.commandTimeout === 'number' && Number.isFinite(browser.commandTimeout)\n        ? Math.floor(browser.commandTimeout)\n        : null,\n    backend:\n      browser.backend === 'local' ||\n      browser.backend === 'cdp' ||\n      browser.backend === 'cloud' ||\n      browser.backend === 'extension' ||\n      browser.backend === 'cloakbrowser'\n        ? browser.backend\n        : null,\n    cloudProvider:\n      browser.cloudProvider === 'browserbase' || browser.cloudProvider === 'browser-use'\n        ? browser.cloudProvider\n        : null,\n    cloud: maskBrowserCloudConfigForWeb(browser.cloud),\n    cdpUrl: typeof browser.cdpUrl === 'string' && browser.cdpUrl.trim() ? browser.cdpUrl.trim() : null,\n    extension: browser.extension && typeof browser.extension === 'object' && !Array.isArray(browser.extension)\n      ? browser.extension\n      : null,\n    cloakbrowser:\n      browser.cloakbrowser && typeof browser.cloakbrowser === 'object' && !Array.isArray(browser.cloakbrowser)\n        ? browser.cloakbrowser\n        : null,\n    humanize: typeof browser.humanize === 'boolean' ? browser.humanize : null,\n    humanPreset: browser.humanPreset === 'default' || browser.humanPreset === 'careful' ? browser.humanPreset : null,\n    dialogPolicy:\n      browser.dialogPolicy === 'must_respond' ||\n      browser.dialogPolicy === 'auto_accept' ||\n      browser.dialogPolicy === 'auto_dismiss'\n        ? browser.dialogPolicy\n        : null,\n    dialogTimeoutSeconds:\n      typeof browser.dialogTimeoutSeconds === 'number' && Number.isFinite(browser.dialogTimeoutSeconds)\n        ? Math.floor(browser.dialogTimeoutSeconds)\n        : null,\n  };\n}\n\n/** Sanitized config snapshot for GET/PATCH `/api/config` (matches persisted `service.currentConfig`). */\nexport async function buildSafeWebConfigPayload(service: GatewayService) {\n  const config = service.currentConfig;\n  if (listChannelPlugins().length === 0) {\n    syncChannelPluginsFromManager(bundledChannelPlugins);\n  }\n  const channelsPayload = Object.fromEntries(\n    listChannelPlugins().map((plugin) => {\n      if (plugin.configSurface) {\n        return [plugin.id, plugin.configSurface.buildConfigSurface(config)];\n      }\n      const channelCfg = config.channels?.[plugin.id] as Record<string, unknown> | undefined;\n      return [\n        plugin.id,\n        {\n          enabled: channelCfg?.enabled ?? false,\n          configured: plugin.config.listAccountIds(config).length > 0,\n        },\n      ];\n    }),\n  );\n  return {\n    agents: {\n      defaultId: resolveDefaultAgentId(config),\n      list: listAgentEntries(config)\n        .filter((e) => e.enabled !== false)\n        .map((e) => ({\n          id: normalizeAgentId(e.id),\n          ...(typeof e.name === 'string' && e.name.trim() ? { name: e.name.trim() } : {}),\n        })),\n      defaults: {\n        model: agentModelRefToString(config.agents?.defaults?.model) ?? '',\n        modelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.model),\n        imageModel: agentModelRefToString(config.agents?.defaults?.imageModel) ?? null,\n        imageModelFallbacks: agentModelFallbacksToArray(config.agents?.defaults?.imageModel),\n        imageGenerationModel: agentModelRefToString(config.agents?.defaults?.imageGenerationModel) ?? null,\n        imageGenerationModelFallbacks: agentModelFallbacksToArray(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelTimeoutMs: agentImageGenerationModelTimeoutMs(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        imageGenerationModelAutoProviderFallback: agentImageGenerationModelAutoProviderFallback(\n          config.agents?.defaults?.imageGenerationModel,\n        ),\n        mediaMaxMb: config.agents?.defaults?.mediaMaxMb,\n        maxTokens: config.agents?.defaults?.maxTokens,\n        temperature: config.agents?.defaults?.temperature,\n        maxToolIterations: config.agents?.defaults?.maxToolIterations,\n        workspace: config.agents?.defaults?.workspace,\n        thinkingDefault: config.agents?.defaults?.thinkingDefault,\n        reasoningDefault: config.agents?.defaults?.reasoningDefault,\n        verboseDefault: config.agents?.defaults?.verboseDefault,\n        browser: buildSafeBrowserConfigForWeb(config.agents?.defaults?.browser),\n        maxTaskDurationMs: config.agents?.defaults?.maxTaskDurationMs,\n        maxRequestsPerTurn: config.agents?.defaults?.maxRequestsPerTurn,\n        maxToolFailuresPerTurn: config.agents?.defaults?.maxToolFailuresPerTurn,\n        compaction: config.agents?.defaults?.compaction,\n        pruning: config.agents?.defaults?.pruning,\n        memory: config.agents?.defaults?.memory,\n        sessionSearch: config.agents?.defaults?.sessionSearch,\n        backgroundReview: config.agents?.defaults?.backgroundReview,\n        webExtract: config.agents?.defaults?.webExtract,\n        delegate: config.agents?.defaults?.delegate,\n        executeCode: config.agents?.defaults?.executeCode,\n        systemPromptOverride: config.agents?.defaults?.systemPromptOverride,\n        skills: config.agents?.defaults?.skills,\n        tools: config.agents?.defaults?.tools,\n        models: config.agents?.defaults?.models,\n        params: config.agents?.defaults?.params,\n      },\n    },\n    channels: channelsPayload,\n    providers: Object.fromEntries(\n      await Promise.all(\n        getAllProviders().map(async (provider) => [\n          provider,\n          await maskLlmProviderApiKeyForWeb(provider),\n        ]),\n      ),\n    ),\n    /** Masked `cfg.providers` for capability keys (image / STT / etc.). */\n    providersConfig: buildSafeProvidersConfigForWeb(config.providers),\n    gateway: {\n      bind: config.gateway?.bind ?? 'loopback',\n      customBindHost: config.gateway?.customBindHost,\n      port: config.gateway?.port,\n      corsOrigins: Array.isArray(config.gateway?.corsOrigins) ? config.gateway.corsOrigins : [],\n      trustedProxies: Array.isArray(config.gateway?.trustedProxies)\n        ? config.gateway.trustedProxies\n        : [],\n      allowRealIpFallback: config.gateway?.allowRealIpFallback === true,\n      dangerouslyAllowHostHeaderOriginFallback:\n        config.gateway?.dangerouslyAllowHostHeaderOriginFallback === true,\n      security: {\n        strict: config.gateway?.security?.strict === true,\n      },\n      auth: {\n        mode: config.gateway?.auth?.mode || 'token',\n        token: config.gateway?.auth?.token ? maskSecretLength(config.gateway.auth.token) : '',\n        password: config.gateway?.auth?.password\n          ? maskSecretLength(config.gateway.auth.password)\n          : '',\n        trustedProxy: config.gateway?.auth?.trustedProxy\n          ? {\n              userHeader: config.gateway.auth.trustedProxy.userHeader,\n              requiredHeaders: config.gateway.auth.trustedProxy.requiredHeaders ?? [],\n              allowUsers: config.gateway.auth.trustedProxy.allowUsers ?? [],\n              allowLoopback: config.gateway.auth.trustedProxy.allowLoopback === true,\n            }\n          : undefined,\n        rateLimit: {\n          enabled: config.gateway?.auth?.rateLimit?.enabled !== false,\n          maxAttempts:\n            typeof config.gateway?.auth?.rateLimit?.maxAttempts === 'number'\n              ? config.gateway.auth.rateLimit.maxAttempts\n              : 5,\n          windowMs:\n            typeof config.gateway?.auth?.rateLimit?.windowMs === 'number'\n              ? config.gateway.auth.rateLimit.windowMs\n              : 900_000,\n          blockDurationMs:\n            typeof config.gateway?.auth?.rateLimit?.blockDurationMs === 'number'\n              ? config.gateway.auth.rateLimit.blockDurationMs\n              : typeof config.gateway?.auth?.rateLimit?.lockoutMs === 'number'\n                ? config.gateway.auth.rateLimit.lockoutMs\n                : 300_000,\n          exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false,\n        },\n      },\n      heartbeat: {\n        enabled: config.gateway?.heartbeat?.enabled,\n        intervalMs: config.gateway?.heartbeat?.intervalMs,\n        includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,\n        target: config.gateway?.heartbeat?.target,\n        targetChatId: config.gateway?.heartbeat?.targetChatId,\n        prompt: config.gateway?.heartbeat?.prompt,\n        ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,\n        isolatedSession: config.gateway?.heartbeat?.isolatedSession,\n        activeHours: config.gateway?.heartbeat?.activeHours,\n      },\n      maxSseConnections:\n        typeof config.gateway?.maxSseConnections === 'number'\n          ? config.gateway.maxSseConnections\n          : 100,\n      channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? 'auto',\n      channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds)\n        ? config.gateway.channelConnectDeferIds\n        : [],\n      channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds)\n        ? config.gateway.channelConnectDeferSkipIds\n        : [],\n      share: resolveShareConfig(config.gateway?.share),\n      publicUrl: config.gateway?.publicUrl ?? null,\n      skillsMarketplaceProvider: config.gateway?.skillsMarketplaceProvider ?? 'skillhub',\n      skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? 'https://store.xopc.ai',\n    },\n    cron: resolveCronConfigForWeb(config),\n    goals: resolveGoalsConfigForWeb(config),\n    session: resolveSessionConfigForWeb(config),\n    tunnel: {\n      enabled: config.tunnel?.enabled === true,\n      autoStart: config.tunnel?.autoStart === true,\n      brokerUrl: config.tunnel?.brokerUrl ?? 'https://frp.xopc.ai/api',\n      registrationSecret: config.tunnel?.registrationSecret\n        ? maskTunnelSecretForWeb(config.tunnel.registrationSecret)\n        : '',\n      consent: config.tunnel?.consent\n        ? {\n            version: config.tunnel.consent.version,\n            acceptedAt: config.tunnel.consent.acceptedAt,\n          }\n        : undefined,\n      transport: { tls: 'broker_terminated' as const },\n    },\n    update: {\n      ...resolveUpdateConfigForWeb(config),\n    },\n    stt: maskSttConfigForWeb(config.tools?.media?.audio),\n    tts: maskTtsConfigForWeb(config.messages?.tts),\n    tools: safeToolsWebForGet(config),\n    bindings: Array.isArray(config.bindings) ? config.bindings : [],\n    mcp: buildSafeMcpConfigForWeb(config),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;kBAIuC;kBAoB2B;kBACiB;gBACC;sBACR;AAY5E,SAAS,6BAA6B,YAAwC;CAC5E,MAAM,EAAE,WAAW,eAAeA,uBAAmB,CAAC;CAEtD,MAAM,OADQ,OAAO,YAAY,cACd;AACnB,QAAO,OAAO,QAAQ,YAAY,IAAI,MAAM,GAAG,IAAI,MAAM,GAAG,KAAA;;;AAI9D,eAAe,4BAA4B,UAAmC;CAE5E,MAAM,SAAS,MAAM,IADA,oBACQ,CAAC,0BAA0B,SAAS;AACjE,KAAI,OAAQ,QAAO,iBAAiB,OAAO;CAE3C,MAAM,iBAAiB,6BAA6B,SAAS;AAC7D,KAAI,eAAgB,QAAO,iBAAiB,eAAe;AAG3D,KAAI,qBAAqB,CAAC,IAAI,SAAS,CAAE,QAAO;AAEhD,KAAI,MAAM,qBAAqB,SAAS,CAAE,QAAO;AACjD,QAAO;;;AAIT,SAAgB,yBAAyB,QAAgB;CACvD,MAAM,MAAM,OAAO;AACnB,KAAI,CAAC,IACH,QAAO,EAAE,SAAS,EAAE,EAA6C;AAEnE,QAAO;EACL,GAAI,IAAI,qBAAqB,KAAA,IAAY,EAAE,kBAAkB,IAAI,kBAAkB,GAAG,EAAE;EACxF,SAAS,8BAA8B,IAAI,QAAQ;EACpD;;AAGH,SAAS,6BAA6B,OAAgD;AACpF,KAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAC7D,QAAO;CAET,MAAM,MAAM;CACZ,MAAM,OAAgC,EAAE;AACxC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,iBAAiB,IAAI,OAAO;AAE5C,KAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,MAAM,CAC3D,MAAK,YAAY,IAAI,UAAU,MAAM;AAEvC,KAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,MAAM,CACrD,MAAK,SAAS,IAAI,OAAO,MAAM;AAEjC,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;;AAG/C,SAAgB,6BAA6B,SAA8D;AACzG,KAAI,CAAC,WAAW,OAAO,YAAY,SACjC,QAAO;EACL,SAAS;EACT,UAAU;EACV,kBAAkB;EAClB,gBAAgB;EAChB,SAAS;EACT,eAAe;EACf,OAAO;EACP,QAAQ;EACR,WAAW;EACX,cAAc;EACd,UAAU;EACV,aAAa;EACb,cAAc;EACd,sBAAsB;EACvB;AAGH,QAAO;EACL,SAAS,QAAQ,YAAY;EAC7B,UAAU,QAAQ,aAAa;EAC/B,kBAAkB,QAAQ,qBAAqB;EAC/C,gBACE,OAAO,QAAQ,mBAAmB,YAAY,OAAO,SAAS,QAAQ,eAAe,GACjF,KAAK,MAAM,QAAQ,eAAe,GAClC;EACN,SACE,QAAQ,YAAY,WACpB,QAAQ,YAAY,SACpB,QAAQ,YAAY,WACpB,QAAQ,YAAY,eACpB,QAAQ,YAAY,iBAChB,QAAQ,UACR;EACN,eACE,QAAQ,kBAAkB,iBAAiB,QAAQ,kBAAkB,gBACjE,QAAQ,gBACR;EACN,OAAO,6BAA6B,QAAQ,MAAM;EAClD,QAAQ,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,GAAG;EAC9F,WAAW,QAAQ,aAAa,OAAO,QAAQ,cAAc,YAAY,CAAC,MAAM,QAAQ,QAAQ,UAAU,GACtG,QAAQ,YACR;EACJ,cACE,QAAQ,gBAAgB,OAAO,QAAQ,iBAAiB,YAAY,CAAC,MAAM,QAAQ,QAAQ,aAAa,GACpG,QAAQ,eACR;EACN,UAAU,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW;EACrE,aAAa,QAAQ,gBAAgB,aAAa,QAAQ,gBAAgB,YAAY,QAAQ,cAAc;EAC5G,cACE,QAAQ,iBAAiB,kBACzB,QAAQ,iBAAiB,iBACzB,QAAQ,iBAAiB,iBACrB,QAAQ,eACR;EACN,sBACE,OAAO,QAAQ,yBAAyB,YAAY,OAAO,SAAS,QAAQ,qBAAqB,GAC7F,KAAK,MAAM,QAAQ,qBAAqB,GACxC;EACP;;;AAIH,eAAsB,0BAA0B,SAAyB;CACvE,MAAM,SAAS,QAAQ;AACvB,KAAI,oBAAoB,CAAC,WAAW,EAClC,+BAA8B,sBAAsB;CAEtD,MAAM,kBAAkB,OAAO,YAC7B,oBAAoB,CAAC,KAAK,WAAW;AACnC,MAAI,OAAO,cACT,QAAO,CAAC,OAAO,IAAI,OAAO,cAAc,mBAAmB,OAAO,CAAC;EAErE,MAAM,aAAa,OAAO,WAAW,OAAO;AAC5C,SAAO,CACL,OAAO,IACP;GACE,SAAS,YAAY,WAAW;GAChC,YAAY,OAAO,OAAO,eAAe,OAAO,CAAC,SAAS;GAC3D,CACF;GACD,CACH;AACD,QAAO;EACL,QAAQ;GACN,WAAW,sBAAsB,OAAO;GACxC,MAAM,iBAAiB,OAAO,CAC3B,QAAQ,MAAM,EAAE,YAAY,MAAM,CAClC,KAAK,OAAO;IACX,IAAI,iBAAiB,EAAE,GAAG;IAC1B,GAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,GAAG,EAAE;IAC/E,EAAE;GACL,UAAU;IACR,OAAO,sBAAsB,OAAO,QAAQ,UAAU,MAAM,IAAI;IAChE,gBAAgB,2BAA2B,OAAO,QAAQ,UAAU,MAAM;IAC1E,YAAY,sBAAsB,OAAO,QAAQ,UAAU,WAAW,IAAI;IAC1E,qBAAqB,2BAA2B,OAAO,QAAQ,UAAU,WAAW;IACpF,sBAAsB,sBAAsB,OAAO,QAAQ,UAAU,qBAAqB,IAAI;IAC9F,+BAA+B,2BAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,+BAA+B,mCAC7B,OAAO,QAAQ,UAAU,qBAC1B;IACD,0CAA0C,8CACxC,OAAO,QAAQ,UAAU,qBAC1B;IACD,YAAY,OAAO,QAAQ,UAAU;IACrC,WAAW,OAAO,QAAQ,UAAU;IACpC,aAAa,OAAO,QAAQ,UAAU;IACtC,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,WAAW,OAAO,QAAQ,UAAU;IACpC,iBAAiB,OAAO,QAAQ,UAAU;IAC1C,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,gBAAgB,OAAO,QAAQ,UAAU;IACzC,SAAS,6BAA6B,OAAO,QAAQ,UAAU,QAAQ;IACvE,mBAAmB,OAAO,QAAQ,UAAU;IAC5C,oBAAoB,OAAO,QAAQ,UAAU;IAC7C,wBAAwB,OAAO,QAAQ,UAAU;IACjD,YAAY,OAAO,QAAQ,UAAU;IACrC,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,QAAQ,UAAU;IACjC,eAAe,OAAO,QAAQ,UAAU;IACxC,kBAAkB,OAAO,QAAQ,UAAU;IAC3C,YAAY,OAAO,QAAQ,UAAU;IACrC,UAAU,OAAO,QAAQ,UAAU;IACnC,aAAa,OAAO,QAAQ,UAAU;IACtC,sBAAsB,OAAO,QAAQ,UAAU;IAC/C,QAAQ,OAAO,QAAQ,UAAU;IACjC,OAAO,OAAO,QAAQ,UAAU;IAChC,QAAQ,OAAO,QAAQ,UAAU;IACjC,QAAQ,OAAO,QAAQ,UAAU;IAClC;GACF;EACD,UAAU;EACV,WAAW,OAAO,YAChB,MAAM,QAAQ,IACZ,iBAAiB,CAAC,IAAI,OAAO,aAAa,CACxC,UACA,MAAM,4BAA4B,SAAS,CAC5C,CAAC,CACH,CACF;;EAED,iBAAiB,+BAA+B,OAAO,UAAU;EACjE,SAAS;GACP,MAAM,OAAO,SAAS,QAAQ;GAC9B,gBAAgB,OAAO,SAAS;GAChC,MAAM,OAAO,SAAS;GACtB,aAAa,MAAM,QAAQ,OAAO,SAAS,YAAY,GAAG,OAAO,QAAQ,cAAc,EAAE;GACzF,gBAAgB,MAAM,QAAQ,OAAO,SAAS,eAAe,GACzD,OAAO,QAAQ,iBACf,EAAE;GACN,qBAAqB,OAAO,SAAS,wBAAwB;GAC7D,0CACE,OAAO,SAAS,6CAA6C;GAC/D,UAAU,EACR,QAAQ,OAAO,SAAS,UAAU,WAAW,MAC9C;GACD,MAAM;IACJ,MAAM,OAAO,SAAS,MAAM,QAAQ;IACpC,OAAO,OAAO,SAAS,MAAM,QAAQ,iBAAiB,OAAO,QAAQ,KAAK,MAAM,GAAG;IACnF,UAAU,OAAO,SAAS,MAAM,WAC5B,iBAAiB,OAAO,QAAQ,KAAK,SAAS,GAC9C;IACJ,cAAc,OAAO,SAAS,MAAM,eAChC;KACE,YAAY,OAAO,QAAQ,KAAK,aAAa;KAC7C,iBAAiB,OAAO,QAAQ,KAAK,aAAa,mBAAmB,EAAE;KACvE,YAAY,OAAO,QAAQ,KAAK,aAAa,cAAc,EAAE;KAC7D,eAAe,OAAO,QAAQ,KAAK,aAAa,kBAAkB;KACnE,GACD,KAAA;IACJ,WAAW;KACT,SAAS,OAAO,SAAS,MAAM,WAAW,YAAY;KACtD,aACE,OAAO,OAAO,SAAS,MAAM,WAAW,gBAAgB,WACpD,OAAO,QAAQ,KAAK,UAAU,cAC9B;KACN,UACE,OAAO,OAAO,SAAS,MAAM,WAAW,aAAa,WACjD,OAAO,QAAQ,KAAK,UAAU,WAC9B;KACN,iBACE,OAAO,OAAO,SAAS,MAAM,WAAW,oBAAoB,WACxD,OAAO,QAAQ,KAAK,UAAU,kBAC9B,OAAO,OAAO,SAAS,MAAM,WAAW,cAAc,WACpD,OAAO,QAAQ,KAAK,UAAU,YAC9B;KACR,gBAAgB,OAAO,SAAS,MAAM,WAAW,mBAAmB;KACrE;IACF;GACD,WAAW;IACT,SAAS,OAAO,SAAS,WAAW;IACpC,YAAY,OAAO,SAAS,WAAW;IACvC,4BAA4B,OAAO,SAAS,WAAW,+BAA+B;IACtF,QAAQ,OAAO,SAAS,WAAW;IACnC,cAAc,OAAO,SAAS,WAAW;IACzC,QAAQ,OAAO,SAAS,WAAW;IACnC,aAAa,OAAO,SAAS,WAAW;IACxC,iBAAiB,OAAO,SAAS,WAAW;IAC5C,aAAa,OAAO,SAAS,WAAW;IACzC;GACD,mBACE,OAAO,OAAO,SAAS,sBAAsB,WACzC,OAAO,QAAQ,oBACf;GACN,yBAAyB,OAAO,SAAS,2BAA2B;GACpE,wBAAwB,MAAM,QAAQ,OAAO,SAAS,uBAAuB,GACzE,OAAO,QAAQ,yBACf,EAAE;GACN,4BAA4B,MAAM,QAAQ,OAAO,SAAS,2BAA2B,GACjF,OAAO,QAAQ,6BACf,EAAE;GACN,OAAO,mBAAmB,OAAO,SAAS,MAAM;GAChD,WAAW,OAAO,SAAS,aAAa;GACxC,2BAA2B,OAAO,SAAS,6BAA6B;GACxE,oBAAoB,OAAO,SAAS,sBAAsB;GAC3D;EACD,MAAM,wBAAwB,OAAO;EACrC,OAAO,yBAAyB,OAAO;EACvC,SAAS,2BAA2B,OAAO;EAC3C,QAAQ;GACN,SAAS,OAAO,QAAQ,YAAY;GACpC,WAAW,OAAO,QAAQ,cAAc;GACxC,WAAW,OAAO,QAAQ,aAAa;GACvC,oBAAoB,OAAO,QAAQ,qBAC/B,uBAAuB,OAAO,OAAO,mBAAmB,GACxD;GACJ,SAAS,OAAO,QAAQ,UACpB;IACE,SAAS,OAAO,OAAO,QAAQ;IAC/B,YAAY,OAAO,OAAO,QAAQ;IACnC,GACD,KAAA;GACJ,WAAW,EAAE,KAAK,qBAA8B;GACjD;EACD,QAAQ,EACN,GAAG,0BAA0B,OAAO,EACrC;EACD,KAAK,oBAAoB,OAAO,OAAO,OAAO,MAAM;EACpD,KAAK,oBAAoB,OAAO,UAAU,IAAI;EAC9C,OAAO,mBAAmB,OAAO;EACjC,UAAU,MAAM,QAAQ,OAAO,SAAS,GAAG,OAAO,WAAW,EAAE;EAC/D,KAAK,yBAAyB,OAAO;EACtC"}

package/dist/src/gateway/hono/middleware/auth.d.ts

@@ -10,6 +10,8 @@ export interface AuthConfig {
         allowRealIpFallback?: boolean;
     };
 }
+/** Exported for gateway security tests. */
+export declare function isQueryTokenAllowedPath(path: string, method: string): boolean;
 export declare function auth(config?: AuthConfig): import("hono/dist/types/types.js").MiddlewareHandler<any, string, {}, (Response & import("hono/dist/types/types.js").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/auth.js

@@ -25,16 +25,20 @@ function extractTokenFromHeader(authHeader) {
 }
 /**
 * SECURITY: query-string tokens leak into server logs, Referer headers, and
-* browser history. We accept them only for SSE/WebSocket connections where
-* the `Authorization` header cannot be set by `EventSource`. For normal REST
-* requests prefer the `Authorization: Bearer <token>` header.
+* browser history. We accept them only where the `Authorization` header cannot
+* be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent
+* avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.
 */
 function extractTokenFromQuery(url) {
 	return new URL(url).searchParams.get("token");
 }
 const QUERY_TOKEN_ALLOWED_PATHS = new Set(["/api/events", "/api/ws"]);
-function isQueryTokenAllowedPath(path) {
-	return QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith("/api/events");
+const AGENT_AVATAR_GET_PATH = /^\/api\/agents\/[^/]+\/avatar$/;
+/** Exported for gateway security tests. */
+function isQueryTokenAllowedPath(path, method) {
+	if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith("/api/events")) return true;
+	if (method === "GET" && AGENT_AVATAR_GET_PATH.test(path)) return true;
+	return false;
 }
 function resolveRemoteAddress(c) {
 	try {
@@ -159,7 +163,7 @@ function auth(config) {
 		const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);
 		const authHeader = extractTokenFromHeader(c.req.header("authorization"));
 		const requestPath = new URL(c.req.url).pathname;
-		const queryToken = isQueryTokenAllowedPath(requestPath) ? extractTokenFromQuery(c.req.url) : null;
+		const queryToken = isQueryTokenAllowedPath(requestPath, c.req.method) ? extractTokenFromQuery(c.req.url) : null;
 		if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has("token")) log.warn({
 			path: requestPath,
 			method: c.req.method,
@@ -211,6 +215,6 @@ function auth(config) {
 	});
 }
 //#endregion
-export { auth };
+export { auth, isQueryTokenAllowedPath };
 
 //# sourceMappingURL=auth.js.map

package/dist/src/gateway/hono/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only for SSE/WebSocket connections where\n * the `Authorization` header cannot be set by `EventSource`. For normal REST\n * requests prefer the `Authorization: Bearer <token>` header.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nfunction isQueryTokenAllowedPath(path: string): boolean {\n  return QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events');\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath) ? extractTokenFromQuery(c.req.url) : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n      'HTTP auth rejected: token mismatch',\n    );\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAkBwD;AAExD,MAAM,MAAM,aAAa,YAAY;AAarC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,SAAS,wBAAwB,MAAuB;AACtD,QAAO,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc;;AAG9E,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,YAAY,GAAG,sBAAsB,EAAE,IAAI,IAAI,GAAG;AAE7F,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,EAC7E,qCACD;AACD,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../../../src/gateway/hono/middleware/auth.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory';\nimport type { Context } from 'hono';\nimport { getConnInfo } from '@hono/node-server/conninfo';\n\nimport type { GatewayAuthConfig } from '../../../config/schema.js';\nimport type { ResolvedGatewayAuth } from '../../auth.js';\nimport { resolveClientIpFromRequest } from '../../client-ip.js';\nimport {\n  authPolicyConfig,\n  buckets,\n  isAuthRateLimitGloballyDisabled,\n  resolveAuthRateLimit,\n  resolveAuthTracking,\n  type ResolvedAuthRateLimitConfig,\n} from '../../rate-limit/index.js';\nimport { getClientIpFromHeaders } from '../../security/loopback.js';\nimport { safeEqualSecret } from '../../security/secret-equal.js';\nimport { authorizeTrustedProxy } from '../../trusted-proxy.js';\nimport { createLogger } from '../../../utils/logger.js';\n\nconst log = createLogger('Hono:Auth');\n\nexport interface AuthConfig {\n  token?: string;\n  /** Current gateway auth from config (for rate-limit settings); optional. */\n  getGatewayAuth?: () => GatewayAuthConfig | undefined;\n  getResolvedAuth?: () => ResolvedGatewayAuth;\n  getTrustedProxyContext?: () => {\n    trustedProxies?: string[];\n    allowRealIpFallback?: boolean;\n  };\n}\n\nfunction validateToken(providedToken: string | undefined, expectedToken: string): boolean {\n  if (!providedToken) return false;\n  return safeEqualSecret(providedToken, expectedToken);\n}\n\nfunction extractTokenFromHeader(authHeader: string | null): string | null {\n  if (!authHeader) return null;\n  const parts = authHeader.split(' ');\n  if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') return parts[1];\n  return authHeader;\n}\n\n/**\n * SECURITY: query-string tokens leak into server logs, Referer headers, and\n * browser history. We accept them only where the `Authorization` header cannot\n * be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent\n * avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.\n */\nfunction extractTokenFromQuery(url: string): string | null {\n  return new URL(url).searchParams.get('token');\n}\n\nconst QUERY_TOKEN_ALLOWED_PATHS = new Set(['/api/events', '/api/ws']);\n\nconst AGENT_AVATAR_GET_PATH = /^\\/api\\/agents\\/[^/]+\\/avatar$/;\n\n/** Exported for gateway security tests. */\nexport function isQueryTokenAllowedPath(path: string, method: string): boolean {\n  if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith('/api/events')) {\n    return true;\n  }\n  if (method === 'GET' && AGENT_AVATAR_GET_PATH.test(path)) {\n    return true;\n  }\n  return false;\n}\n\nfunction resolveRemoteAddress(c: Context): string | undefined {\n  try {\n    return getConnInfo(c).remote.address;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMiddlewareClientIp(\n  c: Context,\n  trustedProxies?: string[],\n  allowRealIpFallback?: boolean,\n): string {\n  if (trustedProxies?.length) {\n    return resolveClientIpFromRequest({\n      remoteAddress: resolveRemoteAddress(c),\n      getHeader: (name) => c.req.header(name),\n      trustedProxies,\n      allowRealIpFallback,\n    });\n  }\n  return getClientIpFromHeaders({\n    get: (name: string) => c.req.header(name) ?? undefined,\n  });\n}\n\ntype RateLimitContext = {\n  active: boolean;\n  cfg: ResolvedAuthRateLimitConfig;\n  /** `undefined` when the client is exempted (loopback, disabled, etc.). */\n  trackingKey: string | undefined;\n};\n\nfunction buildRateLimitContext(\n  getGatewayAuth: AuthConfig['getGatewayAuth'],\n  clientIp: string,\n  origin: string | undefined,\n): RateLimitContext {\n  const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);\n  const active = cfg.enabled && !isAuthRateLimitGloballyDisabled();\n  if (!active) return { active: false, cfg, trackingKey: undefined };\n  const tracking = resolveAuthTracking({ clientIp, origin, cfg: authPolicyConfig(cfg) });\n  return {\n    active: true,\n    cfg,\n    trackingKey: tracking.exempt ? undefined : tracking.key,\n  };\n}\n\nfunction checkBlocked(rl: RateLimitContext): { blocked: false } | { blocked: true; retryAfterSec: number } {\n  if (!rl.active || rl.trackingKey === undefined) return { blocked: false };\n  return buckets.authFailure(rl.cfg).check(rl.trackingKey);\n}\n\nfunction recordFailure(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).fail(rl.trackingKey);\n}\n\nfunction recordSuccess(rl: RateLimitContext): void {\n  if (!rl.active || rl.trackingKey === undefined) return;\n  buckets.authFailure(rl.cfg).succeed(rl.trackingKey);\n}\n\nfunction blockedResponse(c: Context, retryAfterSec: number) {\n  c.header('Retry-After', String(retryAfterSec));\n  return c.json(\n    {\n      error: 'Too Many Requests',\n      code: 'auth_blocked',\n      message: 'Too many authentication attempts',\n      retryAfter: retryAfterSec,\n    },\n    429,\n  );\n}\n\nexport function auth(config?: AuthConfig) {\n  const { token, getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};\n\n  return createMiddleware(async (c, next) => {\n    const resolvedAuth = getResolvedAuth?.();\n    const authMode = resolvedAuth?.mode ?? (token ? 'token' : 'none');\n\n    if (authMode === 'trusted-proxy') {\n      const proxyContext = getTrustedProxyContext?.();\n      const trustedProxies = proxyContext?.trustedProxies;\n      const trustedProxyConfig = resolvedAuth?.trustedProxy;\n\n      const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);\n      const origin = c.req.header('origin');\n      const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n      // Server misconfiguration — not an attack signal. Don't count.\n      if (!trustedProxyConfig) {\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: 'trusted_proxy_config_missing' },\n          'HTTP auth rejected: trusted-proxy config missing',\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'auth_unconfigured', message: 'Trusted-proxy auth is not configured' },\n          401,\n        );\n      }\n\n      const blocked = checkBlocked(rl);\n      if (blocked.blocked) {\n        log.warn(\n          { clientIp, origin: origin ?? undefined, path: c.req.path, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n          'Auth rate limit blocked',\n        );\n        return blockedResponse(c, blocked.retryAfterSec);\n      }\n\n      const result = authorizeTrustedProxy({\n        remoteAddress: resolveRemoteAddress(c),\n        getHeader: (name) => c.req.header(name),\n        trustedProxies,\n        trustedProxyConfig,\n      });\n\n      if (result.ok === false) {\n        recordFailure(rl);\n        log.warn(\n          { path: c.req.path, method: c.req.method, clientIp, reason: result.reason },\n          `HTTP auth rejected: trusted-proxy validation failed (${result.reason})`,\n        );\n        return c.json(\n          { error: 'Unauthorized', code: 'invalid_proxy_credentials', message: 'Trusted-proxy authentication failed' },\n          401,\n        );\n      }\n\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    if (authMode === 'none' || !token) {\n      return next();\n    }\n\n    const proxyContext = getTrustedProxyContext?.();\n    const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);\n    const origin = c.req.header('origin');\n    const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);\n\n    const authHeader = extractTokenFromHeader(c.req.header('authorization'));\n    const requestPath = new URL(c.req.url).pathname;\n    const queryToken = isQueryTokenAllowedPath(requestPath, c.req.method)\n      ? extractTokenFromQuery(c.req.url)\n      : null;\n\n    if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has('token')) {\n      log.warn(\n        { path: requestPath, method: c.req.method, clientIp },\n        'Token in query string rejected: use Authorization header for this endpoint',\n      );\n    }\n\n    const providedToken = authHeader || queryToken;\n\n    if (providedToken && validateToken(providedToken, token)) {\n      recordSuccess(rl);\n      await next();\n      return;\n    }\n\n    const blocked = checkBlocked(rl);\n    if (blocked.blocked) {\n      log.warn(\n        { clientIp, origin: origin ?? undefined, path: requestPath, method: c.req.method, retryAfterSec: blocked.retryAfterSec, reason: 'auth_blocked' },\n        'Auth rate limit blocked',\n      );\n      return blockedResponse(c, blocked.retryAfterSec);\n    }\n\n    // Missing token is an unauthenticated request, not a brute-force signal —\n    // page reloads / SDK cold starts often hit endpoints before the token is\n    // attached. Counting this would lock users out of the token-entry path.\n    if (!providedToken) {\n      log.warn(\n        { path: c.req.path, method: c.req.method, clientIp, reason: 'missing_token' },\n        'HTTP auth rejected: no Bearer or ?token=',\n      );\n      return c.json(\n        { error: 'Unauthorized', code: 'missing_token', message: 'Missing authentication token' },\n        401,\n      );\n    }\n\n    recordFailure(rl);\n    log.warn(\n      { path: c.req.path, method: c.req.method, clientIp, reason: 'invalid_token' },\n      'HTTP auth rejected: token mismatch',\n    );\n    return c.json(\n      { error: 'Unauthorized', code: 'invalid_token', message: 'Invalid authentication token' },\n      401,\n    );\n  });\n}\n"],"mappings":";;;;;;;;;;;;;aAkBwD;AAExD,MAAM,MAAM,aAAa,YAAY;AAarC,SAAS,cAAc,eAAmC,eAAgC;AACxF,KAAI,CAAC,cAAe,QAAO;AAC3B,QAAO,gBAAgB,eAAe,cAAc;;AAGtD,SAAS,uBAAuB,YAA0C;AACxE,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,KAAI,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,SAAU,QAAO,MAAM;AAC5E,QAAO;;;;;;;;AAST,SAAS,sBAAsB,KAA4B;AACzD,QAAO,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ;;AAG/C,MAAM,4BAA4B,IAAI,IAAI,CAAC,eAAe,UAAU,CAAC;AAErE,MAAM,wBAAwB;;AAG9B,SAAgB,wBAAwB,MAAc,QAAyB;AAC7E,KAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,WAAW,cAAc,CACvE,QAAO;AAET,KAAI,WAAW,SAAS,sBAAsB,KAAK,KAAK,CACtD,QAAO;AAET,QAAO;;AAGT,SAAS,qBAAqB,GAAgC;AAC5D,KAAI;AACF,SAAO,YAAY,EAAE,CAAC,OAAO;SACvB;AACN;;;AAIJ,SAAS,0BACP,GACA,gBACA,qBACQ;AACR,KAAI,gBAAgB,OAClB,QAAO,2BAA2B;EAChC,eAAe,qBAAqB,EAAE;EACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;EACvC;EACA;EACD,CAAC;AAEJ,QAAO,uBAAuB,EAC5B,MAAM,SAAiB,EAAE,IAAI,OAAO,KAAK,IAAI,KAAA,GAC9C,CAAC;;AAUJ,SAAS,sBACP,gBACA,UACA,QACkB;CAClB,MAAM,MAAM,qBAAqB,kBAAkB,EAAE,UAAU;AAE/D,KAAI,EADW,IAAI,WAAW,CAAC,iCAAiC,EACnD,QAAO;EAAE,QAAQ;EAAO;EAAK,aAAa,KAAA;EAAW;CAClE,MAAM,WAAW,oBAAoB;EAAE;EAAU;EAAQ,KAAK,iBAAiB,IAAI;EAAE,CAAC;AACtF,QAAO;EACL,QAAQ;EACR;EACA,aAAa,SAAS,SAAS,KAAA,IAAY,SAAS;EACrD;;AAGH,SAAS,aAAa,IAAqF;AACzG,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW,QAAO,EAAE,SAAS,OAAO;AACzE,QAAO,QAAQ,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,YAAY;;AAG1D,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,KAAK,GAAG,YAAY;;AAGlD,SAAS,cAAc,IAA4B;AACjD,KAAI,CAAC,GAAG,UAAU,GAAG,gBAAgB,KAAA,EAAW;AAChD,SAAQ,YAAY,GAAG,IAAI,CAAC,QAAQ,GAAG,YAAY;;AAGrD,SAAS,gBAAgB,GAAY,eAAuB;AAC1D,GAAE,OAAO,eAAe,OAAO,cAAc,CAAC;AAC9C,QAAO,EAAE,KACP;EACE,OAAO;EACP,MAAM;EACN,SAAS;EACT,YAAY;EACb,EACD,IACD;;AAGH,SAAgB,KAAK,QAAqB;CACxC,MAAM,EAAE,OAAO,gBAAgB,iBAAiB,2BAA2B,UAAU,EAAE;AAEvF,QAAO,iBAAiB,OAAO,GAAG,SAAS;EACzC,MAAM,eAAe,mBAAmB;EACxC,MAAM,WAAW,cAAc,SAAS,QAAQ,UAAU;AAE1D,MAAI,aAAa,iBAAiB;GAChC,MAAM,eAAe,0BAA0B;GAC/C,MAAM,iBAAiB,cAAc;GACrC,MAAM,qBAAqB,cAAc;GAEzC,MAAM,WAAW,0BAA0B,GAAG,gBAAgB,cAAc,oBAAoB;GAChG,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;GACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;AAGlE,OAAI,CAAC,oBAAoB;AACvB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ;KAAgC,EAC5F,mDACD;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAAqB,SAAS;KAAwC,EACrG,IACD;;GAGH,MAAM,UAAU,aAAa,GAAG;AAChC,OAAI,QAAQ,SAAS;AACnB,QAAI,KACF;KAAE;KAAU,QAAQ,UAAU,KAAA;KAAW,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ,eAAe,QAAQ;KAAe,QAAQ;KAAgB,EAC/I,0BACD;AACD,WAAO,gBAAgB,GAAG,QAAQ,cAAc;;GAGlD,MAAM,SAAS,sBAAsB;IACnC,eAAe,qBAAqB,EAAE;IACtC,YAAY,SAAS,EAAE,IAAI,OAAO,KAAK;IACvC;IACA;IACD,CAAC;AAEF,OAAI,OAAO,OAAO,OAAO;AACvB,kBAAc,GAAG;AACjB,QAAI,KACF;KAAE,MAAM,EAAE,IAAI;KAAM,QAAQ,EAAE,IAAI;KAAQ;KAAU,QAAQ,OAAO;KAAQ,EAC3E,wDAAwD,OAAO,OAAO,GACvE;AACD,WAAO,EAAE,KACP;KAAE,OAAO;KAAgB,MAAM;KAA6B,SAAS;KAAuC,EAC5G,IACD;;AAGH,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;AAGF,MAAI,aAAa,UAAU,CAAC,MAC1B,QAAO,MAAM;EAGf,MAAM,eAAe,0BAA0B;EAC/C,MAAM,WAAW,0BAA0B,GAAG,cAAc,gBAAgB,cAAc,oBAAoB;EAC9G,MAAM,SAAS,EAAE,IAAI,OAAO,SAAS;EACrC,MAAM,KAAK,sBAAsB,gBAAgB,UAAU,OAAO;EAElE,MAAM,aAAa,uBAAuB,EAAE,IAAI,OAAO,gBAAgB,CAAC;EACxE,MAAM,cAAc,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;EACvC,MAAM,aAAa,wBAAwB,aAAa,EAAE,IAAI,OAAO,GACjE,sBAAsB,EAAE,IAAI,IAAI,GAChC;AAEJ,MAAI,CAAC,cAAc,eAAe,QAAQ,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,IAAI,QAAQ,CACpF,KAAI,KACF;GAAE,MAAM;GAAa,QAAQ,EAAE,IAAI;GAAQ;GAAU,EACrD,6EACD;EAGH,MAAM,gBAAgB,cAAc;AAEpC,MAAI,iBAAiB,cAAc,eAAe,MAAM,EAAE;AACxD,iBAAc,GAAG;AACjB,SAAM,MAAM;AACZ;;EAGF,MAAM,UAAU,aAAa,GAAG;AAChC,MAAI,QAAQ,SAAS;AACnB,OAAI,KACF;IAAE;IAAU,QAAQ,UAAU,KAAA;IAAW,MAAM;IAAa,QAAQ,EAAE,IAAI;IAAQ,eAAe,QAAQ;IAAe,QAAQ;IAAgB,EAChJ,0BACD;AACD,UAAO,gBAAgB,GAAG,QAAQ,cAAc;;AAMlD,MAAI,CAAC,eAAe;AAClB,OAAI,KACF;IAAE,MAAM,EAAE,IAAI;IAAM,QAAQ,EAAE,IAAI;IAAQ;IAAU,QAAQ;IAAiB,EAC7E,2CACD;AACD,UAAO,EAAE,KACP;IAAE,OAAO;IAAgB,MAAM;IAAiB,SAAS;IAAgC,EACzF,IACD;;AAGH,gBAAc,GAAG;AACjB,MAAI,KACF;GAAE,MAAM,EAAE,IAAI;GAAM,QAAQ,EAAE,IAAI;GAAQ;GAAU,QAAQ;GAAiB,EAC7E,qCACD;AACD,SAAO,EAAE,KACP;GAAE,OAAO;GAAgB,MAAM;GAAiB,SAAS;GAAgC,EACzF,IACD;GACD"}