dewee-webchat 0.0.0-stage → 0.1.0

package/dist/server.js

@@ -0,0 +1,632 @@
+import {
+  HEADER_GATEWAY_TOKEN,
+  HEADER_GATEWAY_URL,
+  VERSION
+} from "./chunk-MKTHKYLY.js";
+
+// src/server/gateway-client.ts
+var GatewayError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+function wsUrl(base) {
+  const u = new URL(base);
+  u.protocol = u.protocol === "http:" ? "ws:" : "wss:";
+  u.pathname = u.pathname.replace(/\/$/, "") + "/ws";
+  return u.toString();
+}
+async function openSocket(base, timeoutMs) {
+  if (typeof globalThis.WebSocketPair !== "undefined") {
+    const httpUrl = wsUrl(base).replace(/^ws/, "http");
+    const res = await fetch(httpUrl, { headers: { Upgrade: "websocket" } });
+    const ws2 = res.webSocket;
+    if (!ws2) throw new GatewayError(`Gateway refused WebSocket upgrade (HTTP ${res.status})`, "upgrade_failed");
+    ws2.accept();
+    return ws2;
+  }
+  const WS = globalThis.WebSocket;
+  if (!WS) throw new GatewayError("No WebSocket implementation available (Node >= 22 required)", "no_websocket");
+  const ws = new WS(wsUrl(base));
+  await new Promise((resolve, reject) => {
+    const t = setTimeout(() => reject(new GatewayError("Gateway connection timed out", "timeout")), timeoutMs);
+    ws.addEventListener("open", () => {
+      clearTimeout(t);
+      resolve();
+    });
+    ws.addEventListener("error", () => {
+      clearTimeout(t);
+      reject(new GatewayError("Gateway connection failed", "connect_failed"));
+    });
+  });
+  return ws;
+}
+var GatewayConnection = class _GatewayConnection {
+  constructor(ws) {
+    this.ws = ws;
+    ws.addEventListener("message", (ev) => this.onMessage(typeof ev.data === "string" ? ev.data : String(ev.data)));
+    ws.addEventListener("close", () => this.fail(new GatewayError("Gateway connection closed", "closed")));
+    ws.addEventListener("error", () => this.fail(new GatewayError("Gateway connection error", "socket_error")));
+  }
+  ws;
+  seq = 0;
+  pending = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  closed = false;
+  static async connect(creds, userId, timeoutMs = 15e3) {
+    const conn = new _GatewayConnection(await openSocket(creds.url, timeoutMs));
+    const params = { token: creds.token, user_id: userId };
+    if (creds.tenantId) params.tenant_id = creds.tenantId;
+    try {
+      await conn.call("connect", params, timeoutMs);
+    } catch (e) {
+      conn.close();
+      throw e;
+    }
+    return conn;
+  }
+  call(method, params, timeoutMs = 0) {
+    if (this.closed) return Promise.reject(new GatewayError("Gateway connection closed", "closed"));
+    const id = `r${++this.seq}`;
+    return new Promise((resolve, reject) => {
+      let timer;
+      if (timeoutMs > 0) timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new GatewayError(`${method} timed out`, "timeout"));
+      }, timeoutMs);
+      this.pending.set(id, {
+        resolve: (v) => {
+          if (timer) clearTimeout(timer);
+          resolve(v);
+        },
+        reject: (e) => {
+          if (timer) clearTimeout(timer);
+          reject(e);
+        }
+      });
+      this.ws.send(JSON.stringify({ type: "req", id, method, params }));
+    });
+  }
+  onEvent(cb) {
+    this.listeners.add(cb);
+    return () => this.listeners.delete(cb);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    try {
+      this.ws.close(1e3, "done");
+    } catch {
+    }
+    this.fail(new GatewayError("Gateway connection closed", "closed"));
+  }
+  onMessage(raw) {
+    let frame;
+    try {
+      frame = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (frame.type === "res" && frame.id && this.pending.has(frame.id)) {
+      const p = this.pending.get(frame.id);
+      this.pending.delete(frame.id);
+      if (frame.ok) p.resolve(frame.payload);
+      else p.reject(new GatewayError(frame.error?.message || "Gateway request failed", frame.error?.code));
+    } else if (frame.type === "event" && frame.event) {
+      for (const cb of this.listeners) cb(frame.event, frame.payload);
+    }
+  }
+  fail(err) {
+    this.closed = true;
+    for (const p of this.pending.values()) p.reject(err);
+    this.pending.clear();
+  }
+};
+function buildSessionKey(agent, conversationId) {
+  return `agent:${agent}:ws:direct:${conversationId}`;
+}
+async function* streamChat(opts) {
+  const conn = await GatewayConnection.connect(opts.creds, opts.userId);
+  const queue = [];
+  let wake = null;
+  let finished = false;
+  const push = (e) => {
+    queue.push(e);
+    wake?.();
+  };
+  const end = () => {
+    finished = true;
+    wake?.();
+  };
+  const off = conn.onEvent((event, payload) => {
+    if (event !== "agent" || !payload) return;
+    const key = payload.visibleSessionKey || payload.sessionKey;
+    if (key && key !== opts.sessionKey && payload.runSessionKey !== opts.sessionKey) return;
+    const p = payload.payload || {};
+    switch (payload.type) {
+      case "run.started":
+        push({ type: "start", runId: payload.runId, conversationId: "", agent: opts.agent });
+        break;
+      case "thinking":
+        if (p.content) push({ type: "thinking", text: p.content });
+        break;
+      case "chunk":
+        if (p.content) push({ type: "delta", text: p.content });
+        break;
+      case "tool.call":
+        push({ type: "tool_call", id: p.id || "", name: p.name || "tool", arguments: p.arguments });
+        break;
+      case "tool.result":
+        push({ type: "tool_result", id: p.id || "", name: p.name || "tool", isError: !!p.is_error, result: clip(p.result ?? p.content) });
+        break;
+      case "run.failed":
+        push({ type: "error", message: p.error || p.message || "Agent run failed", code: "run_failed" });
+        end();
+        break;
+      case "run.cancelled":
+        push({ type: "error", message: "Run cancelled", code: "cancelled" });
+        end();
+        break;
+    }
+  });
+  const onAbort = () => {
+    conn.call("chat.abort", { sessionKey: opts.sessionKey }, 3e3).catch(() => {
+    }).finally(() => conn.close());
+    end();
+  };
+  opts.signal?.addEventListener("abort", onAbort, { once: true });
+  conn.call("chat.send", { agentId: opts.agent, sessionKey: opts.sessionKey, message: opts.message, stream: true }, opts.timeoutMs ?? 18e4).then((res) => {
+    push({ type: "done", content: res?.content ?? "", usage: res?.usage });
+    end();
+  }).catch((err) => {
+    if (!finished) push({ type: "error", message: err.message, code: err.code });
+    end();
+  });
+  try {
+    while (true) {
+      if (queue.length) {
+        yield queue.shift();
+        continue;
+      }
+      if (finished) break;
+      await new Promise((r) => wake = r);
+      wake = null;
+    }
+  } finally {
+    off();
+    opts.signal?.removeEventListener("abort", onAbort);
+    conn.close();
+  }
+}
+function clip(v, max = 4e3) {
+  if (v == null) return void 0;
+  const s = typeof v === "string" ? v : JSON.stringify(v);
+  return s.length > max ? s.slice(0, max) + "\u2026" : s;
+}
+async function fetchHistory(creds, userId, agent, sessionKey) {
+  const conn = await GatewayConnection.connect(creds, userId);
+  try {
+    const res = await conn.call("chat.history", { agentId: agent, sessionKey }, 15e3);
+    return foldHistory(res?.messages ?? []);
+  } finally {
+    conn.close();
+  }
+}
+function foldHistory(raw) {
+  const out = [];
+  let current = null;
+  for (const m of raw) {
+    if (m.role === "user") {
+      current = null;
+      out.push({ role: "user", content: String(m.content ?? ""), createdAt: m.created_at });
+    } else if (m.role === "assistant") {
+      if (!current) {
+        current = { role: "assistant", content: "", createdAt: m.created_at };
+        out.push(current);
+      }
+      if (m.thinking) current.thinking = (current.thinking ? current.thinking + "\n\n" : "") + m.thinking;
+      if (m.content) current.content = current.content ? `${current.content}
+
+${m.content}` : String(m.content);
+      for (const tc of m.tool_calls ?? []) {
+        const view = { id: tc.id, name: tc.name ?? tc.function?.name ?? "tool", arguments: tc.arguments ?? tc.function?.arguments, status: "done" };
+        (current.toolCalls ??= []).push(view);
+      }
+    } else if (m.role === "tool" && current?.toolCalls) {
+      const tc = current.toolCalls.find((t) => t.id === m.tool_call_id);
+      if (tc) {
+        tc.result = clip(m.content);
+        if (m.is_error) {
+          tc.isError = true;
+          tc.status = "error";
+        }
+      }
+    }
+  }
+  return out.filter((m) => m.role === "user" || m.content || m.toolCalls?.length);
+}
+async function listAgents(creds) {
+  const headers = { Authorization: `Bearer ${creds.token}`, "X-GoClaw-User-Id": "system" };
+  if (creds.tenantId) headers["X-GoClaw-Tenant-Id"] = creds.tenantId;
+  const res = await fetch(creds.url.replace(/\/$/, "") + "/v1/agents", { headers });
+  if (!res.ok) throw new GatewayError(`Listing agents failed (HTTP ${res.status})`, "agents_failed");
+  const body = await res.json();
+  return (body.agents ?? []).filter((a) => !a.status || a.status === "active").map((a) => ({ id: a.agent_key || a.id, name: a.display_name || a.agent_key || a.id }));
+}
+
+// src/server/security.ts
+var enc = new TextEncoder();
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromB64url(s) {
+  const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+var keyCache = /* @__PURE__ */ new Map();
+function hmacKey(secret) {
+  let k = keyCache.get(secret);
+  if (!k) {
+    k = crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    keyCache.set(secret, k);
+  }
+  return k;
+}
+async function signVisitorToken(secret, claims) {
+  const body = b64url(enc.encode(JSON.stringify(claims)));
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), enc.encode(body)));
+  return `${body}.${b64url(sig)}`;
+}
+async function verifyVisitorToken(secret, token) {
+  const [body, sig] = token.split(".");
+  if (!body || !sig) return null;
+  try {
+    const ok = await crypto.subtle.verify("HMAC", await hmacKey(secret), fromB64url(sig), enc.encode(body));
+    if (!ok) return null;
+    const claims = JSON.parse(new TextDecoder().decode(fromB64url(body)));
+    if (typeof claims.v !== "string" || !/^[A-Za-z0-9_-]{8,64}$/.test(claims.v)) return null;
+    if (typeof claims.exp !== "number" || claims.exp < Date.now()) return null;
+    return claims;
+  } catch {
+    return null;
+  }
+}
+function randomId(bytes = 16) {
+  return b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function memoryRateLimiter(limits) {
+  const windows = /* @__PURE__ */ new Map();
+  return (key, bucket) => {
+    const [max, windowMs] = limits[bucket];
+    const id = `${bucket}:${key}`;
+    const now = Date.now();
+    const w = windows.get(id);
+    if (!w || now - w.start >= windowMs) {
+      windows.set(id, { start: now, count: 1 });
+      if (windows.size > 1e4) {
+        for (const [k, v] of windows) if (now - v.start >= windowMs) windows.delete(k);
+      }
+      return true;
+    }
+    w.count++;
+    return w.count <= max;
+  };
+}
+async function verifyTurnstile(secret, response, ip) {
+  const form = new FormData();
+  form.append("secret", secret);
+  form.append("response", response);
+  if (ip) form.append("remoteip", ip);
+  const res = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", { method: "POST", body: form });
+  const data = await res.json().catch(() => ({}));
+  return data.success === true;
+}
+
+// src/server/handler.ts
+var ID_RE = /^[A-Za-z0-9_-]{6,64}$/;
+var AGENT_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
+function createDeweeHandler(options) {
+  const o = {
+    maxMessageLength: 4e3,
+    userIdPrefix: "webchat-",
+    sessionTtlMs: 30 * 24 * 3600 * 1e3,
+    timeoutMs: 18e4,
+    ...options
+  };
+  let secret = o.secret;
+  if (!secret) {
+    secret = randomId(32);
+    console.warn("[dewee-webchat] No secret configured: using an ephemeral one. Visitor sessions reset on restart.");
+  }
+  const limiter = o.rateLimit === false ? null : o.rateLimit ?? memoryRateLimiter({ chat: [20, 6e4], session: [10, 6e5] });
+  const staticAgents = o.agents === "*" ? [] : (o.agents ?? []).map((a) => typeof a === "string" ? { id: a } : a);
+  const wildcardAgents = o.agents === "*";
+  const byo = o.allowClientCredentials ? o.allowClientCredentials === true ? {} : o.allowClientCredentials : null;
+  function serverCreds() {
+    return o.gatewayUrl && o.token ? { url: o.gatewayUrl, token: o.token, tenantId: o.tenantId } : null;
+  }
+  function resolveCreds(req) {
+    const url = req.headers.get(HEADER_GATEWAY_URL);
+    const token = req.headers.get(HEADER_GATEWAY_TOKEN);
+    if (url || token) {
+      if (!byo) return { creds: null, byo: true, error: "Client credentials are disabled on this server" };
+      if (!url || !token) return { creds: null, byo: true, error: "Both gateway URL and token are required" };
+      let u;
+      try {
+        u = new URL(url);
+      } catch {
+        return { creds: null, byo: true, error: "Invalid gateway URL" };
+      }
+      const listed = !!byo.allowedHosts?.includes(u.hostname);
+      if (byo.allowedHosts?.length && !listed) return { creds: null, byo: true, error: "Gateway host not allowed" };
+      if (isInternalHost(u.hostname) && !listed) return { creds: null, byo: true, error: "Gateway host not allowed" };
+      if (u.protocol !== "https:" && !(listed && u.protocol === "http:")) return { creds: null, byo: true, error: "Gateway URL must use https" };
+      return { creds: { url: u.origin + u.pathname.replace(/\/$/, ""), token }, byo: true };
+    }
+    return { creds: serverCreds(), byo: false };
+  }
+  async function agentsFor(creds, isByo) {
+    if ((isByo || wildcardAgents) && creds) return listAgents(creds);
+    if (creds && staticAgents.some((a) => !a.name)) {
+      namedAgents ??= listAgents(creds).then((all) => staticAgents.map((a) => ({ ...a, name: a.name ?? all.find((x) => x.id === a.id)?.name }))).catch(() => {
+        namedAgents = void 0;
+        return staticAgents;
+      });
+      return namedAgents;
+    }
+    return staticAgents;
+  }
+  let namedAgents;
+  function corsHeaders(req) {
+    const origin = req.headers.get("origin");
+    if (!origin) return {};
+    const allowed = o.allowedOrigins === "*" || (o.allowedOrigins ?? []).includes(origin) || origin === new URL(req.url).origin;
+    if (!allowed) return {};
+    return {
+      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+      "Access-Control-Allow-Headers": `content-type, authorization, ${HEADER_GATEWAY_URL}, ${HEADER_GATEWAY_TOKEN}`,
+      "Access-Control-Max-Age": "600",
+      Vary: "Origin"
+    };
+  }
+  function originAllowed(req) {
+    const origin = req.headers.get("origin");
+    if (!origin || origin === new URL(req.url).origin) return true;
+    return o.allowedOrigins === "*" || (o.allowedOrigins ?? []).includes(origin);
+  }
+  const json = (req, body, status = 200) => new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...corsHeaders(req) }
+  });
+  const fail = (req, status, message, code = "bad_request") => json(req, { error: { message, code } }, status);
+  const clientIp = (req) => req.headers.get("cf-connecting-ip") || req.headers.get("x-real-ip") || req.headers.get("x-forwarded-for")?.split(",")[0].trim() || "unknown";
+  async function visitorFrom(req) {
+    const auth = req.headers.get("authorization") || "";
+    const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    const claims = token ? await verifyVisitorToken(secret, token) : null;
+    return claims?.v ?? null;
+  }
+  async function pickAgent(requested, creds, isByo) {
+    if (isByo || wildcardAgents) {
+      const a = requested || o.defaultAgent || (await agentsFor(creds, isByo))[0]?.id;
+      return a && AGENT_RE.test(a) ? a : null;
+    }
+    const def = o.defaultAgent || staticAgents[0]?.id;
+    if (!requested) return def ?? null;
+    return staticAgents.some((a) => a.id === requested) ? requested : null;
+  }
+  async function handleConfig(req) {
+    const { creds, byo: isByo, error } = resolveCreds(req);
+    if (error) return fail(req, 400, error, "bad_credentials");
+    let agents = [];
+    try {
+      agents = await agentsFor(creds, isByo);
+    } catch (e) {
+      return fail(req, 502, e.message, "gateway_error");
+    }
+    const body = {
+      agents,
+      defaultAgent: !isByo && o.defaultAgent || agents[0]?.id || "",
+      allowAgentSwitch: o.allowAgentSwitch ?? (isByo || agents.length > 1),
+      allowClientCredentials: !!byo,
+      turnstileSiteKey: o.turnstile?.siteKey,
+      maxMessageLength: o.maxMessageLength,
+      version: VERSION
+    };
+    return json(req, body);
+  }
+  async function handleSession(req) {
+    const ip = clientIp(req);
+    if (limiter && !await limiter(ip, "session")) return fail(req, 429, "Too many sessions, slow down", "rate_limited");
+    const body = await req.json().catch(() => ({}));
+    if (o.turnstile) {
+      if (!body?.turnstileToken || !await verifyTurnstile(o.turnstile.secretKey, String(body.turnstileToken), ip)) {
+        return fail(req, 403, "Verification failed", "turnstile_failed");
+      }
+    }
+    const previous = typeof body?.token === "string" ? await verifyVisitorToken(secret, body.token) : null;
+    const visitorId = previous?.v ?? randomId(16);
+    const expiresAt = Date.now() + o.sessionTtlMs;
+    return json(req, { visitorId, token: await signVisitorToken(secret, { v: visitorId, exp: expiresAt }), expiresAt });
+  }
+  async function handleChat(req) {
+    const visitorId = await visitorFrom(req);
+    if (!visitorId) return fail(req, 401, "Missing or expired visitor session", "unauthorized");
+    if (limiter && !await limiter(`${visitorId}|${clientIp(req)}`, "chat")) return fail(req, 429, "Too many messages, please wait a moment", "rate_limited");
+    const { creds, byo: isByo, error } = resolveCreds(req);
+    if (error) return fail(req, 400, error, "bad_credentials");
+    if (!creds) return fail(req, 500, "Gateway is not configured", "not_configured");
+    const body = await req.json().catch(() => null);
+    const message = typeof body?.message === "string" ? body.message.trim() : "";
+    if (!message) return fail(req, 400, "Message is required");
+    if (message.length > o.maxMessageLength) return fail(req, 413, `Message exceeds ${o.maxMessageLength} characters`, "too_long");
+    const conversationId = typeof body?.conversationId === "string" && ID_RE.test(body.conversationId) ? body.conversationId : randomId(9);
+    const agent = await pickAgent(body?.agent, creds, isByo);
+    if (!agent) return fail(req, 403, "Agent not allowed", "agent_not_allowed");
+    const sessionKey = buildSessionKey(agent, `webchat-${visitorId}-${conversationId}`);
+    const abort = new AbortController();
+    req.signal?.addEventListener("abort", () => abort.abort(), { once: true });
+    const { readable, writable } = new TransformStream();
+    const writer = writable.getWriter();
+    const enc2 = new TextEncoder();
+    const send = (e) => writer.write(enc2.encode(typeof e === "string" ? e : `data: ${JSON.stringify(e)}
+
+`)).catch(() => abort.abort());
+    (async () => {
+      const keepAlive = setInterval(() => send(": ping\n\n"), 15e3);
+      let reply = "";
+      let errMsg;
+      try {
+        await send({ type: "start", conversationId, agent });
+        for await (const ev of streamChat({ creds, userId: o.userIdPrefix + visitorId, agent, sessionKey, message, signal: abort.signal, timeoutMs: o.timeoutMs })) {
+          if (ev.type === "start") continue;
+          if (ev.type === "done") reply = ev.content;
+          if (ev.type === "error") errMsg = ev.message;
+          await send(ev);
+          if (abort.signal.aborted) break;
+        }
+      } catch (e) {
+        errMsg = e.message;
+        await send({ type: "error", message: errMsg, code: "gateway_error" });
+      } finally {
+        clearInterval(keepAlive);
+        try {
+          o.onChat?.({ visitorId, agent, message, reply, error: errMsg });
+        } catch {
+        }
+        writer.close().catch(() => {
+        });
+      }
+    })();
+    return new Response(readable, {
+      headers: {
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-cache, no-transform",
+        "x-accel-buffering": "no",
+        ...corsHeaders(req)
+      }
+    });
+  }
+  async function handleHistory(req) {
+    const visitorId = await visitorFrom(req);
+    if (!visitorId) return fail(req, 401, "Missing or expired visitor session", "unauthorized");
+    const { creds, byo: isByo, error } = resolveCreds(req);
+    if (error) return fail(req, 400, error, "bad_credentials");
+    if (!creds) return fail(req, 500, "Gateway is not configured", "not_configured");
+    const url = new URL(req.url);
+    const conversationId = url.searchParams.get("conversationId") || "";
+    if (!ID_RE.test(conversationId)) return fail(req, 400, "Invalid conversationId");
+    const agent = await pickAgent(url.searchParams.get("agent"), creds, isByo);
+    if (!agent) return fail(req, 403, "Agent not allowed", "agent_not_allowed");
+    try {
+      const messages = await fetchHistory(creds, o.userIdPrefix + visitorId, agent, buildSessionKey(agent, `webchat-${visitorId}-${conversationId}`));
+      return json(req, { messages });
+    } catch (e) {
+      if (e.code === "NOT_FOUND") return json(req, { messages: [] });
+      return fail(req, 502, e.message, "gateway_error");
+    }
+  }
+  return async function deweeHandler(req) {
+    if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: corsHeaders(req) });
+    if (!originAllowed(req)) return fail(req, 403, "Origin not allowed", "forbidden_origin");
+    const action = new URL(req.url).pathname.replace(/\/+$/, "").split("/").pop();
+    try {
+      if (req.method === "GET" && action === "config") return await handleConfig(req);
+      if (req.method === "POST" && action === "session") return await handleSession(req);
+      if (req.method === "POST" && action === "chat") return await handleChat(req);
+      if (req.method === "GET" && action === "history") return await handleHistory(req);
+      return fail(req, 404, "Not found", "not_found");
+    } catch (e) {
+      return fail(req, 500, e.message || "Internal error", "internal");
+    }
+  };
+}
+function optionsFromEnv(env, overrides = {}) {
+  const list = (v) => v?.split(",").map((s) => s.trim()).filter(Boolean);
+  const agents = env.DEWEE_AGENTS?.trim() === "*" ? "*" : list(env.DEWEE_AGENTS);
+  const origins = env.DEWEE_ALLOWED_ORIGINS?.trim() === "*" ? "*" : list(env.DEWEE_ALLOWED_ORIGINS);
+  const byoHosts = list(env.DEWEE_CLIENT_CREDENTIAL_HOSTS);
+  return {
+    gatewayUrl: env.DEWEE_GATEWAY_URL || env.GOCLAW_GATEWAY_URL,
+    token: env.DEWEE_GATEWAY_TOKEN || env.GOCLAW_GATEWAY_TOKEN,
+    tenantId: env.DEWEE_TENANT_ID,
+    secret: env.DEWEE_WEBCHAT_SECRET,
+    agents,
+    defaultAgent: env.DEWEE_DEFAULT_AGENT,
+    allowedOrigins: origins,
+    allowClientCredentials: env.DEWEE_ALLOW_CLIENT_CREDENTIALS === "true" ? byoHosts?.length ? { allowedHosts: byoHosts } : true : false,
+    turnstile: env.TURNSTILE_SITE_KEY && env.TURNSTILE_SECRET_KEY ? { siteKey: env.TURNSTILE_SITE_KEY, secretKey: env.TURNSTILE_SECRET_KEY } : void 0,
+    // undefined overrides must not erase env-derived values
+    ...Object.fromEntries(Object.entries(overrides).filter(([, v]) => v !== void 0))
+  };
+}
+function isInternalHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".internal") || h.endsWith(".local") || !h.includes(".") && !h.includes(":")) return true;
+  const v4 = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  if (v4) {
+    const [a, b] = [Number(v4[1]), Number(v4[2])];
+    return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
+  }
+  return h.includes(":") && (h === "::1" || h === "::" || h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80") || h.startsWith("::ffff:"));
+}
+
+// src/server/node.ts
+function toNodeHandler(handler) {
+  return async (req, res) => {
+    const proto = req.headers["x-forwarded-proto"]?.split(",")[0] || (req.socket.encrypted ? "https" : "http");
+    const url = new URL(req.originalUrl || req.url || "/", `${proto}://${req.headers.host || "localhost"}`);
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (Array.isArray(v)) v.forEach((x) => headers.append(k, x));
+      else if (v != null) headers.set(k, v);
+    }
+    const abort = new AbortController();
+    res.on("close", () => {
+      if (!res.writableFinished) abort.abort();
+    });
+    let body;
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      if (req.body !== void 0) body = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+      else {
+        const chunks = [];
+        for await (const c of req) chunks.push(c);
+        body = Buffer.concat(chunks);
+      }
+    }
+    const response = await handler(new Request(url, { method: req.method, headers, body, signal: abort.signal }));
+    res.writeHead(response.status, Object.fromEntries(response.headers));
+    if (!response.body) return void res.end();
+    const reader = response.body.getReader();
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        res.write(value);
+      }
+    } catch {
+    } finally {
+      res.end();
+    }
+  };
+}
+export {
+  GatewayConnection,
+  GatewayError,
+  buildSessionKey,
+  createDeweeHandler,
+  fetchHistory,
+  foldHistory,
+  listAgents,
+  memoryRateLimiter,
+  optionsFromEnv,
+  signVisitorToken,
+  streamChat,
+  toNodeHandler,
+  verifyVisitorToken
+};