remoteclaw 0.1.0-next.2abd2fa → 0.1.0-next.2e9a6cd

package/dist/call-CMDcRlGW.js

@@ -0,0 +1,2826 @@
+import { H as CONFIG_DIR, Ht as resolveGatewayPort, K as ensureDir$1, Rt as resolveConfigPath, at as shortenHomeInString, qt as resolveStateDir, rt as resolveUserPath } from "./entry.js";
+import { i as loadConfig } from "./config-BupC6eiJ.js";
+import { d as GATEWAY_CLIENT_IDS, f as GATEWAY_CLIENT_MODES, p as GATEWAY_CLIENT_NAMES } from "./message-channel-D72Bc6Tb.js";
+import { t as INPUT_PROVENANCE_KIND_VALUES } from "./input-provenance-DUNEQoFM.js";
+import { n as readJsonFile, r as writeJsonAtomic, t as createAsyncLock } from "./json-files-BiA_B-xm.js";
+import { t as safeEqualSecret } from "./secret-equal-CDUVxXmp.js";
+import { i as isSecureWebSocketUrl, p as rawDataToString } from "./net-QZ8IHNXc.js";
+import { n as logError, t as logDebug } from "./logger-DWbwXLjl.js";
+import { t as resolveGatewayCredentialsFromConfig } from "./credentials-BhnauW0K.js";
+import { execFile } from "node:child_process";
+import path from "node:path";
+import fs from "node:fs";
+import { promisify } from "node:util";
+import crypto, { X509Certificate, randomBytes, randomUUID } from "node:crypto";
+import AjvPkg from "ajv";
+import fsp from "node:fs/promises";
+import { WebSocket as WebSocket$1 } from "ws";
+import { Type } from "@sinclair/typebox";
+
+//#region src/infra/device-identity.ts
+function resolveDefaultIdentityPath() {
+	return path.join(resolveStateDir(), "identity", "device.json");
+}
+function ensureDir(filePath) {
+	fs.mkdirSync(path.dirname(filePath), { recursive: true });
+}
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function base64UrlEncode(buf) {
+	return buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(input) {
+	const normalized = input.replaceAll("-", "+").replaceAll("_", "/");
+	const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+	return Buffer.from(padded, "base64");
+}
+function derivePublicKeyRaw(publicKeyPem) {
+	const spki = crypto.createPublicKey(publicKeyPem).export({
+		type: "spki",
+		format: "der"
+	});
+	if (spki.length === ED25519_SPKI_PREFIX.length + 32 && spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) return spki.subarray(ED25519_SPKI_PREFIX.length);
+	return spki;
+}
+function fingerprintPublicKey(publicKeyPem) {
+	const raw = derivePublicKeyRaw(publicKeyPem);
+	return crypto.createHash("sha256").update(raw).digest("hex");
+}
+function generateIdentity() {
+	const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+	const publicKeyPem = publicKey.export({
+		type: "spki",
+		format: "pem"
+	}).toString();
+	const privateKeyPem = privateKey.export({
+		type: "pkcs8",
+		format: "pem"
+	}).toString();
+	return {
+		deviceId: fingerprintPublicKey(publicKeyPem),
+		publicKeyPem,
+		privateKeyPem
+	};
+}
+function loadOrCreateDeviceIdentity(filePath = resolveDefaultIdentityPath()) {
+	try {
+		if (fs.existsSync(filePath)) {
+			const raw = fs.readFileSync(filePath, "utf8");
+			const parsed = JSON.parse(raw);
+			if (parsed?.version === 1 && typeof parsed.deviceId === "string" && typeof parsed.publicKeyPem === "string" && typeof parsed.privateKeyPem === "string") {
+				const derivedId = fingerprintPublicKey(parsed.publicKeyPem);
+				if (derivedId && derivedId !== parsed.deviceId) {
+					const updated = {
+						...parsed,
+						deviceId: derivedId
+					};
+					fs.writeFileSync(filePath, `${JSON.stringify(updated, null, 2)}\n`, { mode: 384 });
+					try {
+						fs.chmodSync(filePath, 384);
+					} catch {}
+					return {
+						deviceId: derivedId,
+						publicKeyPem: parsed.publicKeyPem,
+						privateKeyPem: parsed.privateKeyPem
+					};
+				}
+				return {
+					deviceId: parsed.deviceId,
+					publicKeyPem: parsed.publicKeyPem,
+					privateKeyPem: parsed.privateKeyPem
+				};
+			}
+		}
+	} catch {}
+	const identity = generateIdentity();
+	ensureDir(filePath);
+	const stored = {
+		version: 1,
+		deviceId: identity.deviceId,
+		publicKeyPem: identity.publicKeyPem,
+		privateKeyPem: identity.privateKeyPem,
+		createdAtMs: Date.now()
+	};
+	fs.writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}\n`, { mode: 384 });
+	try {
+		fs.chmodSync(filePath, 384);
+	} catch {}
+	return identity;
+}
+function signDevicePayload(privateKeyPem, payload) {
+	const key = crypto.createPrivateKey(privateKeyPem);
+	return base64UrlEncode(crypto.sign(null, Buffer.from(payload, "utf8"), key));
+}
+function normalizeDevicePublicKeyBase64Url(publicKey) {
+	try {
+		if (publicKey.includes("BEGIN")) return base64UrlEncode(derivePublicKeyRaw(publicKey));
+		return base64UrlEncode(base64UrlDecode(publicKey));
+	} catch {
+		return null;
+	}
+}
+function deriveDeviceIdFromPublicKey(publicKey) {
+	try {
+		const raw = publicKey.includes("BEGIN") ? derivePublicKeyRaw(publicKey) : base64UrlDecode(publicKey);
+		return crypto.createHash("sha256").update(raw).digest("hex");
+	} catch {
+		return null;
+	}
+}
+function publicKeyRawBase64UrlFromPem(publicKeyPem) {
+	return base64UrlEncode(derivePublicKeyRaw(publicKeyPem));
+}
+function verifyDeviceSignature(publicKey, payload, signatureBase64Url) {
+	try {
+		const key = publicKey.includes("BEGIN") ? crypto.createPublicKey(publicKey) : crypto.createPublicKey({
+			key: Buffer.concat([ED25519_SPKI_PREFIX, base64UrlDecode(publicKey)]),
+			type: "spki",
+			format: "der"
+		});
+		const sig = (() => {
+			try {
+				return base64UrlDecode(signatureBase64Url);
+			} catch {
+				return Buffer.from(signatureBase64Url, "base64");
+			}
+		})();
+		return crypto.verify(null, Buffer.from(payload, "utf8"), key, sig);
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/infra/tls/fingerprint.ts
+function normalizeFingerprint(input) {
+	return input.trim().replace(/^sha-?256\s*:?\s*/i, "").replace(/[^a-fA-F0-9]/g, "").toLowerCase();
+}
+
+//#endregion
+//#region src/infra/tls/gateway.ts
+const execFileAsync = promisify(execFile);
+async function fileExists(filePath) {
+	try {
+		await fsp.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function generateSelfSignedCert(params) {
+	const certDir = path.dirname(params.certPath);
+	const keyDir = path.dirname(params.keyPath);
+	await ensureDir$1(certDir);
+	if (keyDir !== certDir) await ensureDir$1(keyDir);
+	await execFileAsync("openssl", [
+		"req",
+		"-x509",
+		"-newkey",
+		"rsa:2048",
+		"-sha256",
+		"-days",
+		"3650",
+		"-nodes",
+		"-keyout",
+		params.keyPath,
+		"-out",
+		params.certPath,
+		"-subj",
+		"/CN=remoteclaw-gateway"
+	]);
+	await fsp.chmod(params.keyPath, 384).catch(() => {});
+	await fsp.chmod(params.certPath, 384).catch(() => {});
+	params.log?.info?.(`gateway tls: generated self-signed cert at ${shortenHomeInString(params.certPath)}`);
+}
+async function loadGatewayTlsRuntime(cfg, log) {
+	if (!cfg || cfg.enabled !== true) return {
+		enabled: false,
+		required: false
+	};
+	const autoGenerate = cfg.autoGenerate !== false;
+	const baseDir = path.join(CONFIG_DIR, "gateway", "tls");
+	const certPath = resolveUserPath(cfg.certPath ?? path.join(baseDir, "gateway-cert.pem"));
+	const keyPath = resolveUserPath(cfg.keyPath ?? path.join(baseDir, "gateway-key.pem"));
+	const caPath = cfg.caPath ? resolveUserPath(cfg.caPath) : void 0;
+	const hasCert = await fileExists(certPath);
+	const hasKey = await fileExists(keyPath);
+	if (!hasCert && !hasKey && autoGenerate) try {
+		await generateSelfSignedCert({
+			certPath,
+			keyPath,
+			log
+		});
+	} catch (err) {
+		return {
+			enabled: false,
+			required: true,
+			certPath,
+			keyPath,
+			error: `gateway tls: failed to generate cert (${String(err)})`
+		};
+	}
+	if (!await fileExists(certPath) || !await fileExists(keyPath)) return {
+		enabled: false,
+		required: true,
+		certPath,
+		keyPath,
+		error: "gateway tls: cert/key missing"
+	};
+	try {
+		const cert = await fsp.readFile(certPath, "utf8");
+		const key = await fsp.readFile(keyPath, "utf8");
+		const ca = caPath ? await fsp.readFile(caPath, "utf8") : void 0;
+		const fingerprintSha256 = normalizeFingerprint(new X509Certificate(cert).fingerprint256 ?? "");
+		if (!fingerprintSha256) return {
+			enabled: false,
+			required: true,
+			certPath,
+			keyPath,
+			caPath,
+			error: "gateway tls: unable to compute certificate fingerprint"
+		};
+		return {
+			enabled: true,
+			required: true,
+			certPath,
+			keyPath,
+			caPath,
+			fingerprintSha256,
+			tlsOptions: {
+				cert,
+				key,
+				ca,
+				minVersion: "TLSv1.3"
+			}
+		};
+	} catch (err) {
+		return {
+			enabled: false,
+			required: true,
+			certPath,
+			keyPath,
+			caPath,
+			error: `gateway tls: failed to load cert (${String(err)})`
+		};
+	}
+}
+
+//#endregion
+//#region src/shared/device-auth.ts
+function normalizeDeviceAuthRole(role) {
+	return role.trim();
+}
+function normalizeDeviceAuthScopes(scopes) {
+	if (!Array.isArray(scopes)) return [];
+	const out = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		const trimmed = scope.trim();
+		if (trimmed) out.add(trimmed);
+	}
+	return [...out].toSorted();
+}
+
+//#endregion
+//#region src/infra/device-auth-store.ts
+const DEVICE_AUTH_FILE = "device-auth.json";
+function resolveDeviceAuthPath(env = process.env) {
+	return path.join(resolveStateDir(env), "identity", DEVICE_AUTH_FILE);
+}
+function readStore(filePath) {
+	try {
+		if (!fs.existsSync(filePath)) return null;
+		const raw = fs.readFileSync(filePath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed?.version !== 1 || typeof parsed.deviceId !== "string") return null;
+		if (!parsed.tokens || typeof parsed.tokens !== "object") return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+function writeStore(filePath, store) {
+	fs.mkdirSync(path.dirname(filePath), { recursive: true });
+	fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}\n`, { mode: 384 });
+	try {
+		fs.chmodSync(filePath, 384);
+	} catch {}
+}
+function loadDeviceAuthToken(params) {
+	const store = readStore(resolveDeviceAuthPath(params.env));
+	if (!store) return null;
+	if (store.deviceId !== params.deviceId) return null;
+	const role = normalizeDeviceAuthRole(params.role);
+	const entry = store.tokens[role];
+	if (!entry || typeof entry.token !== "string") return null;
+	return entry;
+}
+function storeDeviceAuthToken(params) {
+	const filePath = resolveDeviceAuthPath(params.env);
+	const existing = readStore(filePath);
+	const role = normalizeDeviceAuthRole(params.role);
+	const next = {
+		version: 1,
+		deviceId: params.deviceId,
+		tokens: existing && existing.deviceId === params.deviceId && existing.tokens ? { ...existing.tokens } : {}
+	};
+	const entry = {
+		token: params.token,
+		role,
+		scopes: normalizeDeviceAuthScopes(params.scopes),
+		updatedAtMs: Date.now()
+	};
+	next.tokens[role] = entry;
+	writeStore(filePath, next);
+	return entry;
+}
+function clearDeviceAuthToken(params) {
+	const filePath = resolveDeviceAuthPath(params.env);
+	const store = readStore(filePath);
+	if (!store || store.deviceId !== params.deviceId) return;
+	const role = normalizeDeviceAuthRole(params.role);
+	if (!store.tokens[role]) return;
+	const next = {
+		version: 1,
+		deviceId: store.deviceId,
+		tokens: { ...store.tokens }
+	};
+	delete next.tokens[role];
+	writeStore(filePath, next);
+}
+
+//#endregion
+//#region src/shared/operator-scope-compat.ts
+const OPERATOR_ROLE = "operator";
+const OPERATOR_ADMIN_SCOPE = "operator.admin";
+const OPERATOR_READ_SCOPE = "operator.read";
+const OPERATOR_WRITE_SCOPE = "operator.write";
+const OPERATOR_SCOPE_PREFIX = "operator.";
+function normalizeScopeList(scopes) {
+	const out = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		const trimmed = scope.trim();
+		if (trimmed) out.add(trimmed);
+	}
+	return [...out];
+}
+function operatorScopeSatisfied(requestedScope, granted) {
+	if (granted.has(OPERATOR_ADMIN_SCOPE) && requestedScope.startsWith(OPERATOR_SCOPE_PREFIX)) return true;
+	if (requestedScope === OPERATOR_READ_SCOPE) return granted.has(OPERATOR_READ_SCOPE) || granted.has(OPERATOR_WRITE_SCOPE);
+	if (requestedScope === OPERATOR_WRITE_SCOPE) return granted.has(OPERATOR_WRITE_SCOPE);
+	return granted.has(requestedScope);
+}
+function roleScopesAllow(params) {
+	const requested = normalizeScopeList(params.requestedScopes);
+	if (requested.length === 0) return true;
+	const allowed = normalizeScopeList(params.allowedScopes);
+	if (allowed.length === 0) return false;
+	const allowedSet = new Set(allowed);
+	if (params.role.trim() !== OPERATOR_ROLE) return requested.every((scope) => allowedSet.has(scope));
+	return requested.every((scope) => operatorScopeSatisfied(scope, allowedSet));
+}
+
+//#endregion
+//#region src/infra/pairing-files.ts
+function resolvePairingPaths(baseDir, subdir) {
+	const root = baseDir ?? resolveStateDir();
+	const dir = path.join(root, subdir);
+	return {
+		dir,
+		pendingPath: path.join(dir, "pending.json"),
+		pairedPath: path.join(dir, "paired.json")
+	};
+}
+function pruneExpiredPending(pendingById, nowMs, ttlMs) {
+	for (const [id, req] of Object.entries(pendingById)) if (nowMs - req.ts > ttlMs) delete pendingById[id];
+}
+async function upsertPendingPairingRequest(params) {
+	const existing = Object.values(params.pendingById).find(params.isExisting);
+	if (existing) return {
+		status: "pending",
+		request: existing,
+		created: false
+	};
+	const request = params.createRequest(params.isRepair);
+	params.pendingById[request.requestId] = request;
+	await params.persist();
+	return {
+		status: "pending",
+		request,
+		created: true
+	};
+}
+
+//#endregion
+//#region src/infra/pairing-pending.ts
+async function rejectPendingPairingRequest(params) {
+	const state = await params.loadState();
+	const pending = state.pendingById[params.requestId];
+	if (!pending) return null;
+	delete state.pendingById[params.requestId];
+	await params.persistState(state);
+	return {
+		requestId: params.requestId,
+		[params.idKey]: params.getId(pending)
+	};
+}
+
+//#endregion
+//#region src/infra/pairing-token.ts
+const PAIRING_TOKEN_BYTES = 32;
+function generatePairingToken() {
+	return randomBytes(PAIRING_TOKEN_BYTES).toString("base64url");
+}
+function verifyPairingToken(provided, expected) {
+	return safeEqualSecret(provided, expected);
+}
+
+//#endregion
+//#region src/infra/device-pairing.ts
+const PENDING_TTL_MS = 300 * 1e3;
+const withLock = createAsyncLock();
+async function loadState(baseDir) {
+	const { pendingPath, pairedPath } = resolvePairingPaths(baseDir, "devices");
+	const [pending, paired] = await Promise.all([readJsonFile(pendingPath), readJsonFile(pairedPath)]);
+	const state = {
+		pendingById: pending ?? {},
+		pairedByDeviceId: paired ?? {}
+	};
+	pruneExpiredPending(state.pendingById, Date.now(), PENDING_TTL_MS);
+	return state;
+}
+async function persistState(state, baseDir) {
+	const { pendingPath, pairedPath } = resolvePairingPaths(baseDir, "devices");
+	await Promise.all([writeJsonAtomic(pendingPath, state.pendingById), writeJsonAtomic(pairedPath, state.pairedByDeviceId)]);
+}
+function normalizeDeviceId(deviceId) {
+	return deviceId.trim();
+}
+function normalizeRole(role) {
+	const trimmed = role?.trim();
+	return trimmed ? trimmed : null;
+}
+function mergeRoles(...items) {
+	const roles = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!item) continue;
+		if (Array.isArray(item)) for (const role of item) {
+			const trimmed = role.trim();
+			if (trimmed) roles.add(trimmed);
+		}
+		else {
+			const trimmed = item.trim();
+			if (trimmed) roles.add(trimmed);
+		}
+	}
+	if (roles.size === 0) return;
+	return [...roles];
+}
+function mergeScopes(...items) {
+	const scopes = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!item) continue;
+		for (const scope of item) {
+			const trimmed = scope.trim();
+			if (trimmed) scopes.add(trimmed);
+		}
+	}
+	if (scopes.size === 0) return;
+	return [...scopes];
+}
+function mergePendingDevicePairingRequest(existing, incoming, isRepair) {
+	const existingRole = normalizeRole(existing.role);
+	const incomingRole = normalizeRole(incoming.role);
+	return {
+		...existing,
+		displayName: incoming.displayName ?? existing.displayName,
+		platform: incoming.platform ?? existing.platform,
+		clientId: incoming.clientId ?? existing.clientId,
+		clientMode: incoming.clientMode ?? existing.clientMode,
+		role: existingRole ?? incomingRole ?? void 0,
+		roles: mergeRoles(existing.roles, existing.role, incoming.role),
+		scopes: mergeScopes(existing.scopes, incoming.scopes),
+		remoteIp: incoming.remoteIp ?? existing.remoteIp,
+		silent: Boolean(existing.silent && incoming.silent),
+		isRepair: existing.isRepair || isRepair,
+		ts: Date.now()
+	};
+}
+function scopesAllow(requested, allowed) {
+	if (requested.length === 0) return true;
+	if (allowed.length === 0) return false;
+	const allowedSet = new Set(allowed);
+	return requested.every((scope) => allowedSet.has(scope));
+}
+const DEVICE_SCOPE_IMPLICATIONS = {
+	"operator.admin": [
+		"operator.read",
+		"operator.write",
+		"operator.approvals",
+		"operator.pairing"
+	],
+	"operator.write": ["operator.read"]
+};
+function expandScopeImplications(scopes) {
+	const expanded = new Set(scopes);
+	const queue = [...scopes];
+	while (queue.length > 0) {
+		const scope = queue.pop();
+		if (!scope) continue;
+		for (const impliedScope of DEVICE_SCOPE_IMPLICATIONS[scope] ?? []) if (!expanded.has(impliedScope)) {
+			expanded.add(impliedScope);
+			queue.push(impliedScope);
+		}
+	}
+	return [...expanded];
+}
+function scopesAllowWithImplications(requested, allowed) {
+	return scopesAllow(expandScopeImplications(requested), expandScopeImplications(allowed));
+}
+function newToken() {
+	return generatePairingToken();
+}
+function getPairedDeviceFromState(state, deviceId) {
+	return state.pairedByDeviceId[normalizeDeviceId(deviceId)] ?? null;
+}
+function cloneDeviceTokens(device) {
+	return device.tokens ? { ...device.tokens } : {};
+}
+function buildDeviceAuthToken(params) {
+	return {
+		token: newToken(),
+		role: params.role,
+		scopes: params.scopes,
+		createdAtMs: params.existing?.createdAtMs ?? params.now,
+		rotatedAtMs: params.rotatedAtMs,
+		revokedAtMs: void 0,
+		lastUsedAtMs: params.existing?.lastUsedAtMs
+	};
+}
+async function listDevicePairing(baseDir) {
+	const state = await loadState(baseDir);
+	return {
+		pending: Object.values(state.pendingById).toSorted((a, b) => b.ts - a.ts),
+		paired: Object.values(state.pairedByDeviceId).toSorted((a, b) => b.approvedAtMs - a.approvedAtMs)
+	};
+}
+async function getPairedDevice(deviceId, baseDir) {
+	return (await loadState(baseDir)).pairedByDeviceId[normalizeDeviceId(deviceId)] ?? null;
+}
+async function requestDevicePairing(req, baseDir) {
+	return await withLock(async () => {
+		const state = await loadState(baseDir);
+		const deviceId = normalizeDeviceId(req.deviceId);
+		if (!deviceId) throw new Error("deviceId required");
+		const isRepair = Boolean(state.pairedByDeviceId[deviceId]);
+		const existing = Object.values(state.pendingById).find((pending) => pending.deviceId === deviceId);
+		if (existing) {
+			const merged = mergePendingDevicePairingRequest(existing, req, isRepair);
+			state.pendingById[existing.requestId] = merged;
+			await persistState(state, baseDir);
+			return {
+				status: "pending",
+				request: merged,
+				created: false
+			};
+		}
+		const request = {
+			requestId: randomUUID(),
+			deviceId,
+			publicKey: req.publicKey,
+			displayName: req.displayName,
+			platform: req.platform,
+			clientId: req.clientId,
+			clientMode: req.clientMode,
+			role: req.role,
+			roles: req.role ? [req.role] : void 0,
+			scopes: req.scopes,
+			remoteIp: req.remoteIp,
+			silent: req.silent,
+			isRepair,
+			ts: Date.now()
+		};
+		state.pendingById[request.requestId] = request;
+		await persistState(state, baseDir);
+		return {
+			status: "pending",
+			request,
+			created: true
+		};
+	});
+}
+async function approveDevicePairing(requestId, baseDir) {
+	return await withLock(async () => {
+		const state = await loadState(baseDir);
+		const pending = state.pendingById[requestId];
+		if (!pending) return null;
+		const now = Date.now();
+		const existing = state.pairedByDeviceId[pending.deviceId];
+		const roles = mergeRoles(existing?.roles, existing?.role, pending.roles, pending.role);
+		const approvedScopes = mergeScopes(existing?.approvedScopes ?? existing?.scopes, pending.scopes);
+		const tokens = existing?.tokens ? { ...existing.tokens } : {};
+		const roleForToken = normalizeRole(pending.role);
+		if (roleForToken) {
+			const existingToken = tokens[roleForToken];
+			const requestedScopes = normalizeDeviceAuthScopes(pending.scopes);
+			const nextScopes = requestedScopes.length > 0 ? requestedScopes : normalizeDeviceAuthScopes(existingToken?.scopes ?? approvedScopes ?? existing?.approvedScopes ?? existing?.scopes);
+			const now = Date.now();
+			tokens[roleForToken] = {
+				token: newToken(),
+				role: roleForToken,
+				scopes: nextScopes,
+				createdAtMs: existingToken?.createdAtMs ?? now,
+				rotatedAtMs: existingToken ? now : void 0,
+				revokedAtMs: void 0,
+				lastUsedAtMs: existingToken?.lastUsedAtMs
+			};
+		}
+		const device = {
+			deviceId: pending.deviceId,
+			publicKey: pending.publicKey,
+			displayName: pending.displayName,
+			platform: pending.platform,
+			clientId: pending.clientId,
+			clientMode: pending.clientMode,
+			role: pending.role,
+			roles,
+			scopes: approvedScopes,
+			approvedScopes,
+			remoteIp: pending.remoteIp,
+			tokens,
+			createdAtMs: existing?.createdAtMs ?? now,
+			approvedAtMs: now
+		};
+		delete state.pendingById[requestId];
+		state.pairedByDeviceId[device.deviceId] = device;
+		await persistState(state, baseDir);
+		return {
+			requestId,
+			device
+		};
+	});
+}
+async function rejectDevicePairing(requestId, baseDir) {
+	return await withLock(async () => {
+		return await rejectPendingPairingRequest({
+			requestId,
+			idKey: "deviceId",
+			loadState: () => loadState(baseDir),
+			persistState: (state) => persistState(state, baseDir),
+			getId: (pending) => pending.deviceId
+		});
+	});
+}
+async function removePairedDevice(deviceId, baseDir) {
+	return await withLock(async () => {
+		const state = await loadState(baseDir);
+		const normalized = normalizeDeviceId(deviceId);
+		if (!normalized || !state.pairedByDeviceId[normalized]) return null;
+		delete state.pairedByDeviceId[normalized];
+		await persistState(state, baseDir);
+		return { deviceId: normalized };
+	});
+}
+async function updatePairedDeviceMetadata(deviceId, patch, baseDir) {
+	return await withLock(async () => {
+		const state = await loadState(baseDir);
+		const existing = state.pairedByDeviceId[normalizeDeviceId(deviceId)];
+		if (!existing) return;
+		const roles = mergeRoles(existing.roles, existing.role, patch.role);
+		const scopes = mergeScopes(existing.scopes, patch.scopes);
+		state.pairedByDeviceId[deviceId] = {
+			...existing,
+			...patch,
+			deviceId: existing.deviceId,
+			createdAtMs: existing.createdAtMs,
+			approvedAtMs: existing.approvedAtMs,
+			approvedScopes: existing.approvedScopes,
+			role: patch.role ?? existing.role,
+			roles,
+			scopes
+		};
+		await persistState(state, baseDir);
+	});
+}
+function summarizeDeviceTokens(tokens) {
+	if (!tokens) return;
+	const summaries = Object.values(tokens).map((token) => ({
+		role: token.role,
+		scopes: token.scopes,
+		createdAtMs: token.createdAtMs,
+		rotatedAtMs: token.rotatedAtMs,
+		revokedAtMs: token.revokedAtMs,
+		lastUsedAtMs: token.lastUsedAtMs
+	})).toSorted((a, b) => a.role.localeCompare(b.role));
+	return summaries.length > 0 ? summaries : void 0;
+}
+async function verifyDeviceToken(params) {
+	return await withLock(async () => {
+		const state = await loadState(params.baseDir);
+		const device = getPairedDeviceFromState(state, params.deviceId);
+		if (!device) return {
+			ok: false,
+			reason: "device-not-paired"
+		};
+		const role = normalizeRole(params.role);
+		if (!role) return {
+			ok: false,
+			reason: "role-missing"
+		};
+		const entry = device.tokens?.[role];
+		if (!entry) return {
+			ok: false,
+			reason: "token-missing"
+		};
+		if (entry.revokedAtMs) return {
+			ok: false,
+			reason: "token-revoked"
+		};
+		if (!verifyPairingToken(params.token, entry.token)) return {
+			ok: false,
+			reason: "token-mismatch"
+		};
+		if (!roleScopesAllow({
+			role,
+			requestedScopes: normalizeDeviceAuthScopes(params.scopes),
+			allowedScopes: entry.scopes
+		})) return {
+			ok: false,
+			reason: "scope-mismatch"
+		};
+		entry.lastUsedAtMs = Date.now();
+		device.tokens ??= {};
+		device.tokens[role] = entry;
+		state.pairedByDeviceId[device.deviceId] = device;
+		await persistState(state, params.baseDir);
+		return { ok: true };
+	});
+}
+async function ensureDeviceToken(params) {
+	return await withLock(async () => {
+		const state = await loadState(params.baseDir);
+		const requestedScopes = normalizeDeviceAuthScopes(params.scopes);
+		const context = resolveDeviceTokenUpdateContext({
+			state,
+			deviceId: params.deviceId,
+			role: params.role
+		});
+		if (!context) return null;
+		const { device, role, tokens, existing } = context;
+		if (existing && !existing.revokedAtMs) {
+			if (roleScopesAllow({
+				role,
+				requestedScopes,
+				allowedScopes: existing.scopes
+			})) return existing;
+		}
+		const now = Date.now();
+		const next = buildDeviceAuthToken({
+			role,
+			scopes: requestedScopes,
+			existing,
+			now,
+			rotatedAtMs: existing ? now : void 0
+		});
+		tokens[role] = next;
+		device.tokens = tokens;
+		state.pairedByDeviceId[device.deviceId] = device;
+		await persistState(state, params.baseDir);
+		return next;
+	});
+}
+function resolveDeviceTokenUpdateContext(params) {
+	const device = getPairedDeviceFromState(params.state, params.deviceId);
+	if (!device) return null;
+	const role = normalizeRole(params.role);
+	if (!role) return null;
+	const tokens = cloneDeviceTokens(device);
+	return {
+		device,
+		role,
+		tokens,
+		existing: tokens[role]
+	};
+}
+async function rotateDeviceToken(params) {
+	return await withLock(async () => {
+		const state = await loadState(params.baseDir);
+		const context = resolveDeviceTokenUpdateContext({
+			state,
+			deviceId: params.deviceId,
+			role: params.role
+		});
+		if (!context) return null;
+		const { device, role, tokens, existing } = context;
+		const requestedScopes = normalizeDeviceAuthScopes(params.scopes ?? existing?.scopes ?? device.scopes);
+		if (!scopesAllowWithImplications(requestedScopes, normalizeDeviceAuthScopes(device.approvedScopes ?? device.scopes ?? existing?.scopes))) return null;
+		const now = Date.now();
+		const next = buildDeviceAuthToken({
+			role,
+			scopes: requestedScopes,
+			existing,
+			now,
+			rotatedAtMs: now
+		});
+		tokens[role] = next;
+		device.tokens = tokens;
+		state.pairedByDeviceId[device.deviceId] = device;
+		await persistState(state, params.baseDir);
+		return next;
+	});
+}
+async function revokeDeviceToken(params) {
+	return await withLock(async () => {
+		const state = await loadState(params.baseDir);
+		const device = state.pairedByDeviceId[normalizeDeviceId(params.deviceId)];
+		if (!device) return null;
+		const role = normalizeRole(params.role);
+		if (!role) return null;
+		if (!device.tokens?.[role]) return null;
+		const tokens = { ...device.tokens };
+		const entry = {
+			...tokens[role],
+			revokedAtMs: Date.now()
+		};
+		tokens[role] = entry;
+		device.tokens = tokens;
+		state.pairedByDeviceId[device.deviceId] = device;
+		await persistState(state, params.baseDir);
+		return entry;
+	});
+}
+async function clearDevicePairing(deviceId, baseDir) {
+	return await withLock(async () => {
+		const state = await loadState(baseDir);
+		const normalizedId = normalizeDeviceId(deviceId);
+		if (!state.pairedByDeviceId[normalizedId]) return false;
+		delete state.pairedByDeviceId[normalizedId];
+		await persistState(state, baseDir);
+		return true;
+	});
+}
+
+//#endregion
+//#region src/gateway/device-auth.ts
+function buildDeviceAuthPayload(params) {
+	const scopes = params.scopes.join(",");
+	const token = params.token ?? "";
+	return [
+		"v2",
+		params.deviceId,
+		params.clientId,
+		params.clientMode,
+		params.role,
+		scopes,
+		String(params.signedAtMs),
+		token,
+		params.nonce
+	].join("|");
+}
+
+//#endregion
+//#region src/sessions/session-label.ts
+const SESSION_LABEL_MAX_LENGTH = 64;
+function parseSessionLabel(raw) {
+	if (typeof raw !== "string") return {
+		ok: false,
+		error: "invalid label: must be a string"
+	};
+	const trimmed = raw.trim();
+	if (!trimmed) return {
+		ok: false,
+		error: "invalid label: empty"
+	};
+	if (trimmed.length > SESSION_LABEL_MAX_LENGTH) return {
+		ok: false,
+		error: `invalid label: too long (max ${SESSION_LABEL_MAX_LENGTH})`
+	};
+	return {
+		ok: true,
+		label: trimmed
+	};
+}
+
+//#endregion
+//#region src/gateway/protocol/schema/primitives.ts
+const NonEmptyString = Type.String({ minLength: 1 });
+const SessionLabelString = Type.String({
+	minLength: 1,
+	maxLength: SESSION_LABEL_MAX_LENGTH
+});
+const GatewayClientIdSchema = Type.Union(Object.values(GATEWAY_CLIENT_IDS).map((value) => Type.Literal(value)));
+const GatewayClientModeSchema = Type.Union(Object.values(GATEWAY_CLIENT_MODES).map((value) => Type.Literal(value)));
+
+//#endregion
+//#region src/gateway/protocol/schema/agent.ts
+const AgentEventSchema = Type.Object({
+	runId: NonEmptyString,
+	seq: Type.Integer({ minimum: 0 }),
+	stream: NonEmptyString,
+	ts: Type.Integer({ minimum: 0 }),
+	data: Type.Record(Type.String(), Type.Unknown())
+}, { additionalProperties: false });
+const SendParamsSchema = Type.Object({
+	to: NonEmptyString,
+	message: Type.Optional(Type.String()),
+	mediaUrl: Type.Optional(Type.String()),
+	mediaUrls: Type.Optional(Type.Array(Type.String())),
+	gifPlayback: Type.Optional(Type.Boolean()),
+	channel: Type.Optional(Type.String()),
+	accountId: Type.Optional(Type.String()),
+	threadId: Type.Optional(Type.String()),
+	sessionKey: Type.Optional(Type.String()),
+	idempotencyKey: NonEmptyString
+}, { additionalProperties: false });
+const PollParamsSchema = Type.Object({
+	to: NonEmptyString,
+	question: NonEmptyString,
+	options: Type.Array(NonEmptyString, {
+		minItems: 2,
+		maxItems: 12
+	}),
+	maxSelections: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 12
+	})),
+	durationSeconds: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 604800
+	})),
+	durationHours: Type.Optional(Type.Integer({ minimum: 1 })),
+	silent: Type.Optional(Type.Boolean()),
+	isAnonymous: Type.Optional(Type.Boolean()),
+	threadId: Type.Optional(Type.String()),
+	channel: Type.Optional(Type.String()),
+	accountId: Type.Optional(Type.String()),
+	idempotencyKey: NonEmptyString
+}, { additionalProperties: false });
+const AgentParamsSchema = Type.Object({
+	message: NonEmptyString,
+	agentId: Type.Optional(NonEmptyString),
+	to: Type.Optional(Type.String()),
+	replyTo: Type.Optional(Type.String()),
+	sessionId: Type.Optional(Type.String()),
+	sessionKey: Type.Optional(Type.String()),
+	thinking: Type.Optional(Type.String()),
+	deliver: Type.Optional(Type.Boolean()),
+	attachments: Type.Optional(Type.Array(Type.Unknown())),
+	channel: Type.Optional(Type.String()),
+	replyChannel: Type.Optional(Type.String()),
+	accountId: Type.Optional(Type.String()),
+	replyAccountId: Type.Optional(Type.String()),
+	threadId: Type.Optional(Type.String()),
+	groupId: Type.Optional(Type.String()),
+	groupChannel: Type.Optional(Type.String()),
+	groupSpace: Type.Optional(Type.String()),
+	timeout: Type.Optional(Type.Integer({ minimum: 0 })),
+	bestEffortDeliver: Type.Optional(Type.Boolean()),
+	lane: Type.Optional(Type.String()),
+	extraSystemPrompt: Type.Optional(Type.String()),
+	inputProvenance: Type.Optional(Type.Object({
+		kind: Type.String({ enum: [...INPUT_PROVENANCE_KIND_VALUES] }),
+		sourceSessionKey: Type.Optional(Type.String()),
+		sourceChannel: Type.Optional(Type.String()),
+		sourceTool: Type.Optional(Type.String())
+	}, { additionalProperties: false })),
+	idempotencyKey: NonEmptyString,
+	label: Type.Optional(SessionLabelString),
+	spawnedBy: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const AgentIdentityParamsSchema = Type.Object({
+	agentId: Type.Optional(NonEmptyString),
+	sessionKey: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const AgentIdentityResultSchema = Type.Object({
+	agentId: NonEmptyString,
+	name: Type.Optional(NonEmptyString),
+	avatar: Type.Optional(NonEmptyString),
+	emoji: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+const AgentWaitParamsSchema = Type.Object({
+	runId: NonEmptyString,
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 }))
+}, { additionalProperties: false });
+const WakeParamsSchema = Type.Object({
+	mode: Type.Union([Type.Literal("now"), Type.Literal("next-heartbeat")]),
+	text: NonEmptyString
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/agents-models-skills.ts
+const ModelChoiceSchema = Type.Object({
+	id: NonEmptyString,
+	name: NonEmptyString,
+	provider: NonEmptyString,
+	contextWindow: Type.Optional(Type.Integer({ minimum: 1 })),
+	reasoning: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const AgentSummarySchema = Type.Object({
+	id: NonEmptyString,
+	name: Type.Optional(NonEmptyString),
+	identity: Type.Optional(Type.Object({
+		name: Type.Optional(NonEmptyString),
+		theme: Type.Optional(NonEmptyString),
+		emoji: Type.Optional(NonEmptyString),
+		avatar: Type.Optional(NonEmptyString),
+		avatarUrl: Type.Optional(NonEmptyString)
+	}, { additionalProperties: false }))
+}, { additionalProperties: false });
+const AgentsListParamsSchema = Type.Object({}, { additionalProperties: false });
+const AgentsListResultSchema = Type.Object({
+	defaultId: NonEmptyString,
+	mainKey: NonEmptyString,
+	scope: Type.Union([Type.Literal("per-sender"), Type.Literal("global")]),
+	agents: Type.Array(AgentSummarySchema)
+}, { additionalProperties: false });
+const AgentsCreateParamsSchema = Type.Object({
+	name: NonEmptyString,
+	workspace: NonEmptyString,
+	emoji: Type.Optional(Type.String()),
+	avatar: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const AgentsCreateResultSchema = Type.Object({
+	ok: Type.Literal(true),
+	agentId: NonEmptyString,
+	name: NonEmptyString,
+	workspace: NonEmptyString
+}, { additionalProperties: false });
+const AgentsUpdateParamsSchema = Type.Object({
+	agentId: NonEmptyString,
+	name: Type.Optional(NonEmptyString),
+	workspace: Type.Optional(NonEmptyString),
+	model: Type.Optional(NonEmptyString),
+	avatar: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const AgentsUpdateResultSchema = Type.Object({
+	ok: Type.Literal(true),
+	agentId: NonEmptyString
+}, { additionalProperties: false });
+const AgentsDeleteParamsSchema = Type.Object({
+	agentId: NonEmptyString,
+	deleteFiles: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const AgentsDeleteResultSchema = Type.Object({
+	ok: Type.Literal(true),
+	agentId: NonEmptyString,
+	removedBindings: Type.Integer({ minimum: 0 })
+}, { additionalProperties: false });
+const AgentsFileEntrySchema = Type.Object({
+	name: NonEmptyString,
+	path: NonEmptyString,
+	missing: Type.Boolean(),
+	size: Type.Optional(Type.Integer({ minimum: 0 })),
+	updatedAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	content: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const AgentsFilesListParamsSchema = Type.Object({ agentId: NonEmptyString }, { additionalProperties: false });
+const AgentsFilesListResultSchema = Type.Object({
+	agentId: NonEmptyString,
+	workspace: NonEmptyString,
+	files: Type.Array(AgentsFileEntrySchema)
+}, { additionalProperties: false });
+const AgentsFilesGetParamsSchema = Type.Object({
+	agentId: NonEmptyString,
+	name: NonEmptyString
+}, { additionalProperties: false });
+const AgentsFilesGetResultSchema = Type.Object({
+	agentId: NonEmptyString,
+	workspace: NonEmptyString,
+	file: AgentsFileEntrySchema
+}, { additionalProperties: false });
+const AgentsFilesSetParamsSchema = Type.Object({
+	agentId: NonEmptyString,
+	name: NonEmptyString,
+	content: Type.String()
+}, { additionalProperties: false });
+const AgentsFilesSetResultSchema = Type.Object({
+	ok: Type.Literal(true),
+	agentId: NonEmptyString,
+	workspace: NonEmptyString,
+	file: AgentsFileEntrySchema
+}, { additionalProperties: false });
+const ModelsListParamsSchema = Type.Object({}, { additionalProperties: false });
+const ModelsListResultSchema = Type.Object({ models: Type.Array(ModelChoiceSchema) }, { additionalProperties: false });
+const ToolsCatalogParamsSchema = Type.Object({
+	agentId: Type.Optional(NonEmptyString),
+	includePlugins: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const ToolCatalogProfileSchema = Type.Object({
+	id: Type.Union([
+		Type.Literal("minimal"),
+		Type.Literal("coding"),
+		Type.Literal("messaging"),
+		Type.Literal("full")
+	]),
+	label: NonEmptyString
+}, { additionalProperties: false });
+const ToolCatalogEntrySchema = Type.Object({
+	id: NonEmptyString,
+	label: NonEmptyString,
+	description: Type.String(),
+	source: Type.Union([Type.Literal("core"), Type.Literal("plugin")]),
+	pluginId: Type.Optional(NonEmptyString),
+	optional: Type.Optional(Type.Boolean()),
+	defaultProfiles: Type.Array(Type.Union([
+		Type.Literal("minimal"),
+		Type.Literal("coding"),
+		Type.Literal("messaging"),
+		Type.Literal("full")
+	]))
+}, { additionalProperties: false });
+const ToolCatalogGroupSchema = Type.Object({
+	id: NonEmptyString,
+	label: NonEmptyString,
+	source: Type.Union([Type.Literal("core"), Type.Literal("plugin")]),
+	pluginId: Type.Optional(NonEmptyString),
+	tools: Type.Array(ToolCatalogEntrySchema)
+}, { additionalProperties: false });
+const ToolsCatalogResultSchema = Type.Object({
+	agentId: NonEmptyString,
+	profiles: Type.Array(ToolCatalogProfileSchema),
+	groups: Type.Array(ToolCatalogGroupSchema)
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/channels.ts
+const TalkModeParamsSchema = Type.Object({
+	enabled: Type.Boolean(),
+	phase: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const TalkConfigParamsSchema = Type.Object({ includeSecrets: Type.Optional(Type.Boolean()) }, { additionalProperties: false });
+const TalkProviderConfigSchema = Type.Object({
+	voiceId: Type.Optional(Type.String()),
+	voiceAliases: Type.Optional(Type.Record(Type.String(), Type.String())),
+	modelId: Type.Optional(Type.String()),
+	outputFormat: Type.Optional(Type.String()),
+	apiKey: Type.Optional(Type.String())
+}, { additionalProperties: true });
+const TalkConfigResultSchema = Type.Object({ config: Type.Object({
+	talk: Type.Optional(Type.Object({
+		provider: Type.Optional(Type.String()),
+		providers: Type.Optional(Type.Record(Type.String(), TalkProviderConfigSchema)),
+		voiceId: Type.Optional(Type.String()),
+		voiceAliases: Type.Optional(Type.Record(Type.String(), Type.String())),
+		modelId: Type.Optional(Type.String()),
+		outputFormat: Type.Optional(Type.String()),
+		apiKey: Type.Optional(Type.String()),
+		interruptOnSpeech: Type.Optional(Type.Boolean())
+	}, { additionalProperties: false })),
+	session: Type.Optional(Type.Object({ mainKey: Type.Optional(Type.String()) }, { additionalProperties: false })),
+	ui: Type.Optional(Type.Object({ seamColor: Type.Optional(Type.String()) }, { additionalProperties: false }))
+}, { additionalProperties: false }) }, { additionalProperties: false });
+const ChannelsStatusParamsSchema = Type.Object({
+	probe: Type.Optional(Type.Boolean()),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 }))
+}, { additionalProperties: false });
+const ChannelAccountSnapshotSchema = Type.Object({
+	accountId: NonEmptyString,
+	name: Type.Optional(Type.String()),
+	enabled: Type.Optional(Type.Boolean()),
+	configured: Type.Optional(Type.Boolean()),
+	linked: Type.Optional(Type.Boolean()),
+	running: Type.Optional(Type.Boolean()),
+	connected: Type.Optional(Type.Boolean()),
+	reconnectAttempts: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastConnectedAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastError: Type.Optional(Type.String()),
+	lastStartAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastStopAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastInboundAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastOutboundAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastProbeAt: Type.Optional(Type.Integer({ minimum: 0 })),
+	mode: Type.Optional(Type.String()),
+	dmPolicy: Type.Optional(Type.String()),
+	allowFrom: Type.Optional(Type.Array(Type.String())),
+	tokenSource: Type.Optional(Type.String()),
+	botTokenSource: Type.Optional(Type.String()),
+	appTokenSource: Type.Optional(Type.String()),
+	baseUrl: Type.Optional(Type.String()),
+	allowUnmentionedGroups: Type.Optional(Type.Boolean()),
+	cliPath: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+	dbPath: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+	port: Type.Optional(Type.Union([Type.Integer({ minimum: 0 }), Type.Null()])),
+	probe: Type.Optional(Type.Unknown()),
+	audit: Type.Optional(Type.Unknown()),
+	application: Type.Optional(Type.Unknown())
+}, { additionalProperties: true });
+const ChannelUiMetaSchema = Type.Object({
+	id: NonEmptyString,
+	label: NonEmptyString,
+	detailLabel: NonEmptyString,
+	systemImage: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const ChannelsStatusResultSchema = Type.Object({
+	ts: Type.Integer({ minimum: 0 }),
+	channelOrder: Type.Array(NonEmptyString),
+	channelLabels: Type.Record(NonEmptyString, NonEmptyString),
+	channelDetailLabels: Type.Optional(Type.Record(NonEmptyString, NonEmptyString)),
+	channelSystemImages: Type.Optional(Type.Record(NonEmptyString, NonEmptyString)),
+	channelMeta: Type.Optional(Type.Array(ChannelUiMetaSchema)),
+	channels: Type.Record(NonEmptyString, Type.Unknown()),
+	channelAccounts: Type.Record(NonEmptyString, Type.Array(ChannelAccountSnapshotSchema)),
+	channelDefaultAccountId: Type.Record(NonEmptyString, NonEmptyString)
+}, { additionalProperties: false });
+const ChannelsLogoutParamsSchema = Type.Object({
+	channel: NonEmptyString,
+	accountId: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const WebLoginStartParamsSchema = Type.Object({
+	force: Type.Optional(Type.Boolean()),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	verbose: Type.Optional(Type.Boolean()),
+	accountId: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const WebLoginWaitParamsSchema = Type.Object({
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	accountId: Type.Optional(Type.String())
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/config.ts
+const ConfigGetParamsSchema = Type.Object({}, { additionalProperties: false });
+const ConfigSetParamsSchema = Type.Object({
+	raw: NonEmptyString,
+	baseHash: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+const ConfigApplyLikeParamsSchema = Type.Object({
+	raw: NonEmptyString,
+	baseHash: Type.Optional(NonEmptyString),
+	sessionKey: Type.Optional(Type.String()),
+	note: Type.Optional(Type.String()),
+	restartDelayMs: Type.Optional(Type.Integer({ minimum: 0 }))
+}, { additionalProperties: false });
+const ConfigApplyParamsSchema = ConfigApplyLikeParamsSchema;
+const ConfigPatchParamsSchema = ConfigApplyLikeParamsSchema;
+const ConfigSchemaParamsSchema = Type.Object({}, { additionalProperties: false });
+const UpdateRunParamsSchema = Type.Object({
+	sessionKey: Type.Optional(Type.String()),
+	note: Type.Optional(Type.String()),
+	restartDelayMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 1 }))
+}, { additionalProperties: false });
+const ConfigUiHintSchema = Type.Object({
+	label: Type.Optional(Type.String()),
+	help: Type.Optional(Type.String()),
+	tags: Type.Optional(Type.Array(Type.String())),
+	group: Type.Optional(Type.String()),
+	order: Type.Optional(Type.Integer()),
+	advanced: Type.Optional(Type.Boolean()),
+	sensitive: Type.Optional(Type.Boolean()),
+	placeholder: Type.Optional(Type.String()),
+	itemTemplate: Type.Optional(Type.Unknown())
+}, { additionalProperties: false });
+const ConfigSchemaResponseSchema = Type.Object({
+	schema: Type.Unknown(),
+	uiHints: Type.Record(Type.String(), ConfigUiHintSchema),
+	version: NonEmptyString,
+	generatedAt: NonEmptyString
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/cron.ts
+function cronAgentTurnPayloadSchema(params) {
+	return Type.Object({
+		kind: Type.Literal("agentTurn"),
+		message: params.message,
+		model: Type.Optional(Type.String()),
+		thinking: Type.Optional(Type.String()),
+		timeoutSeconds: Type.Optional(Type.Integer({ minimum: 0 })),
+		allowUnsafeExternalContent: Type.Optional(Type.Boolean()),
+		deliver: Type.Optional(Type.Boolean()),
+		channel: Type.Optional(Type.String()),
+		to: Type.Optional(Type.String()),
+		bestEffortDeliver: Type.Optional(Type.Boolean())
+	}, { additionalProperties: false });
+}
+const CronSessionTargetSchema = Type.Union([Type.Literal("main"), Type.Literal("isolated")]);
+const CronWakeModeSchema = Type.Union([Type.Literal("next-heartbeat"), Type.Literal("now")]);
+const CronRunStatusSchema = Type.Union([
+	Type.Literal("ok"),
+	Type.Literal("error"),
+	Type.Literal("skipped")
+]);
+const CronSortDirSchema = Type.Union([Type.Literal("asc"), Type.Literal("desc")]);
+const CronJobsEnabledFilterSchema = Type.Union([
+	Type.Literal("all"),
+	Type.Literal("enabled"),
+	Type.Literal("disabled")
+]);
+const CronJobsSortBySchema = Type.Union([
+	Type.Literal("nextRunAtMs"),
+	Type.Literal("updatedAtMs"),
+	Type.Literal("name")
+]);
+const CronRunsStatusFilterSchema = Type.Union([
+	Type.Literal("all"),
+	Type.Literal("ok"),
+	Type.Literal("error"),
+	Type.Literal("skipped")
+]);
+const CronRunsStatusValueSchema = Type.Union([
+	Type.Literal("ok"),
+	Type.Literal("error"),
+	Type.Literal("skipped")
+]);
+const CronDeliveryStatusSchema = Type.Union([
+	Type.Literal("delivered"),
+	Type.Literal("not-delivered"),
+	Type.Literal("unknown"),
+	Type.Literal("not-requested")
+]);
+const CronCommonOptionalFields = {
+	agentId: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	sessionKey: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	description: Type.Optional(Type.String()),
+	enabled: Type.Optional(Type.Boolean()),
+	deleteAfterRun: Type.Optional(Type.Boolean())
+};
+function cronIdOrJobIdParams(extraFields) {
+	return Type.Union([Type.Object({
+		id: NonEmptyString,
+		...extraFields
+	}, { additionalProperties: false }), Type.Object({
+		jobId: NonEmptyString,
+		...extraFields
+	}, { additionalProperties: false })]);
+}
+const CronRunLogJobIdSchema = Type.String({
+	minLength: 1,
+	pattern: "^[^/\\\\]+$"
+});
+const CronScheduleSchema = Type.Union([
+	Type.Object({
+		kind: Type.Literal("at"),
+		at: NonEmptyString
+	}, { additionalProperties: false }),
+	Type.Object({
+		kind: Type.Literal("every"),
+		everyMs: Type.Integer({ minimum: 1 }),
+		anchorMs: Type.Optional(Type.Integer({ minimum: 0 }))
+	}, { additionalProperties: false }),
+	Type.Object({
+		kind: Type.Literal("cron"),
+		expr: NonEmptyString,
+		tz: Type.Optional(Type.String()),
+		staggerMs: Type.Optional(Type.Integer({ minimum: 0 }))
+	}, { additionalProperties: false })
+]);
+const CronPayloadSchema = Type.Union([Type.Object({
+	kind: Type.Literal("systemEvent"),
+	text: NonEmptyString
+}, { additionalProperties: false }), cronAgentTurnPayloadSchema({ message: NonEmptyString })]);
+const CronPayloadPatchSchema = Type.Union([Type.Object({
+	kind: Type.Literal("systemEvent"),
+	text: Type.Optional(NonEmptyString)
+}, { additionalProperties: false }), cronAgentTurnPayloadSchema({ message: Type.Optional(NonEmptyString) })]);
+const CronDeliverySharedProperties = {
+	channel: Type.Optional(Type.Union([Type.Literal("last"), NonEmptyString])),
+	bestEffort: Type.Optional(Type.Boolean())
+};
+const CronDeliveryNoopSchema = Type.Object({
+	mode: Type.Literal("none"),
+	...CronDeliverySharedProperties,
+	to: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const CronDeliveryAnnounceSchema = Type.Object({
+	mode: Type.Literal("announce"),
+	...CronDeliverySharedProperties,
+	to: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const CronDeliveryWebhookSchema = Type.Object({
+	mode: Type.Literal("webhook"),
+	...CronDeliverySharedProperties,
+	to: NonEmptyString
+}, { additionalProperties: false });
+const CronDeliverySchema = Type.Union([
+	CronDeliveryNoopSchema,
+	CronDeliveryAnnounceSchema,
+	CronDeliveryWebhookSchema
+]);
+const CronDeliveryPatchSchema = Type.Object({
+	mode: Type.Optional(Type.Union([
+		Type.Literal("none"),
+		Type.Literal("announce"),
+		Type.Literal("webhook")
+	])),
+	...CronDeliverySharedProperties,
+	to: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const CronJobStateSchema = Type.Object({
+	nextRunAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	runningAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastRunAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastRunStatus: Type.Optional(CronRunStatusSchema),
+	lastStatus: Type.Optional(CronRunStatusSchema),
+	lastError: Type.Optional(Type.String()),
+	lastDurationMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	consecutiveErrors: Type.Optional(Type.Integer({ minimum: 0 })),
+	lastDelivered: Type.Optional(Type.Boolean()),
+	lastDeliveryStatus: Type.Optional(CronDeliveryStatusSchema),
+	lastDeliveryError: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const CronJobSchema = Type.Object({
+	id: NonEmptyString,
+	agentId: Type.Optional(NonEmptyString),
+	sessionKey: Type.Optional(NonEmptyString),
+	name: NonEmptyString,
+	description: Type.Optional(Type.String()),
+	enabled: Type.Boolean(),
+	deleteAfterRun: Type.Optional(Type.Boolean()),
+	createdAtMs: Type.Integer({ minimum: 0 }),
+	updatedAtMs: Type.Integer({ minimum: 0 }),
+	schedule: CronScheduleSchema,
+	sessionTarget: CronSessionTargetSchema,
+	wakeMode: CronWakeModeSchema,
+	payload: CronPayloadSchema,
+	delivery: Type.Optional(CronDeliverySchema),
+	state: CronJobStateSchema
+}, { additionalProperties: false });
+const CronListParamsSchema = Type.Object({
+	includeDisabled: Type.Optional(Type.Boolean()),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 200
+	})),
+	offset: Type.Optional(Type.Integer({ minimum: 0 })),
+	query: Type.Optional(Type.String()),
+	enabled: Type.Optional(CronJobsEnabledFilterSchema),
+	sortBy: Type.Optional(CronJobsSortBySchema),
+	sortDir: Type.Optional(CronSortDirSchema)
+}, { additionalProperties: false });
+const CronStatusParamsSchema = Type.Object({}, { additionalProperties: false });
+const CronAddParamsSchema = Type.Object({
+	name: NonEmptyString,
+	...CronCommonOptionalFields,
+	schedule: CronScheduleSchema,
+	sessionTarget: CronSessionTargetSchema,
+	wakeMode: CronWakeModeSchema,
+	payload: CronPayloadSchema,
+	delivery: Type.Optional(CronDeliverySchema)
+}, { additionalProperties: false });
+const CronJobPatchSchema = Type.Object({
+	name: Type.Optional(NonEmptyString),
+	...CronCommonOptionalFields,
+	schedule: Type.Optional(CronScheduleSchema),
+	sessionTarget: Type.Optional(CronSessionTargetSchema),
+	wakeMode: Type.Optional(CronWakeModeSchema),
+	payload: Type.Optional(CronPayloadPatchSchema),
+	delivery: Type.Optional(CronDeliveryPatchSchema),
+	state: Type.Optional(Type.Partial(CronJobStateSchema))
+}, { additionalProperties: false });
+const CronUpdateParamsSchema = cronIdOrJobIdParams({ patch: CronJobPatchSchema });
+const CronRemoveParamsSchema = cronIdOrJobIdParams({});
+const CronRunParamsSchema = cronIdOrJobIdParams({ mode: Type.Optional(Type.Union([Type.Literal("due"), Type.Literal("force")])) });
+const CronRunsParamsSchema = Type.Object({
+	scope: Type.Optional(Type.Union([Type.Literal("job"), Type.Literal("all")])),
+	id: Type.Optional(CronRunLogJobIdSchema),
+	jobId: Type.Optional(CronRunLogJobIdSchema),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 200
+	})),
+	offset: Type.Optional(Type.Integer({ minimum: 0 })),
+	statuses: Type.Optional(Type.Array(CronRunsStatusValueSchema, {
+		minItems: 1,
+		maxItems: 3
+	})),
+	status: Type.Optional(CronRunsStatusFilterSchema),
+	deliveryStatuses: Type.Optional(Type.Array(CronDeliveryStatusSchema, {
+		minItems: 1,
+		maxItems: 4
+	})),
+	deliveryStatus: Type.Optional(CronDeliveryStatusSchema),
+	query: Type.Optional(Type.String()),
+	sortDir: Type.Optional(CronSortDirSchema)
+}, { additionalProperties: false });
+const CronRunLogEntrySchema = Type.Object({
+	ts: Type.Integer({ minimum: 0 }),
+	jobId: NonEmptyString,
+	action: Type.Literal("finished"),
+	status: Type.Optional(CronRunStatusSchema),
+	error: Type.Optional(Type.String()),
+	summary: Type.Optional(Type.String()),
+	delivered: Type.Optional(Type.Boolean()),
+	deliveryStatus: Type.Optional(CronDeliveryStatusSchema),
+	deliveryError: Type.Optional(Type.String()),
+	sessionId: Type.Optional(NonEmptyString),
+	sessionKey: Type.Optional(NonEmptyString),
+	runAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	durationMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	nextRunAtMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	model: Type.Optional(Type.String()),
+	provider: Type.Optional(Type.String()),
+	usage: Type.Optional(Type.Object({
+		input_tokens: Type.Optional(Type.Number()),
+		output_tokens: Type.Optional(Type.Number()),
+		total_tokens: Type.Optional(Type.Number()),
+		cache_read_tokens: Type.Optional(Type.Number()),
+		cache_write_tokens: Type.Optional(Type.Number())
+	}, { additionalProperties: false })),
+	jobName: Type.Optional(Type.String())
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/error-codes.ts
+const ErrorCodes = {
+	NOT_LINKED: "NOT_LINKED",
+	NOT_PAIRED: "NOT_PAIRED",
+	AGENT_TIMEOUT: "AGENT_TIMEOUT",
+	INVALID_REQUEST: "INVALID_REQUEST",
+	UNAVAILABLE: "UNAVAILABLE"
+};
+function errorShape(code, message, opts) {
+	return {
+		code,
+		message,
+		...opts
+	};
+}
+
+//#endregion
+//#region src/gateway/protocol/schema/devices.ts
+const DevicePairListParamsSchema = Type.Object({}, { additionalProperties: false });
+const DevicePairApproveParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
+const DevicePairRejectParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
+const DevicePairRemoveParamsSchema = Type.Object({ deviceId: NonEmptyString }, { additionalProperties: false });
+const DeviceTokenRotateParamsSchema = Type.Object({
+	deviceId: NonEmptyString,
+	role: NonEmptyString,
+	scopes: Type.Optional(Type.Array(NonEmptyString))
+}, { additionalProperties: false });
+const DeviceTokenRevokeParamsSchema = Type.Object({
+	deviceId: NonEmptyString,
+	role: NonEmptyString
+}, { additionalProperties: false });
+const DevicePairRequestedEventSchema = Type.Object({
+	requestId: NonEmptyString,
+	deviceId: NonEmptyString,
+	publicKey: NonEmptyString,
+	displayName: Type.Optional(NonEmptyString),
+	platform: Type.Optional(NonEmptyString),
+	clientId: Type.Optional(NonEmptyString),
+	clientMode: Type.Optional(NonEmptyString),
+	role: Type.Optional(NonEmptyString),
+	roles: Type.Optional(Type.Array(NonEmptyString)),
+	scopes: Type.Optional(Type.Array(NonEmptyString)),
+	remoteIp: Type.Optional(NonEmptyString),
+	silent: Type.Optional(Type.Boolean()),
+	isRepair: Type.Optional(Type.Boolean()),
+	ts: Type.Integer({ minimum: 0 })
+}, { additionalProperties: false });
+const DevicePairResolvedEventSchema = Type.Object({
+	requestId: NonEmptyString,
+	deviceId: NonEmptyString,
+	decision: NonEmptyString,
+	ts: Type.Integer({ minimum: 0 })
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/snapshot.ts
+const PresenceEntrySchema = Type.Object({
+	host: Type.Optional(NonEmptyString),
+	ip: Type.Optional(NonEmptyString),
+	version: Type.Optional(NonEmptyString),
+	platform: Type.Optional(NonEmptyString),
+	deviceFamily: Type.Optional(NonEmptyString),
+	modelIdentifier: Type.Optional(NonEmptyString),
+	mode: Type.Optional(NonEmptyString),
+	lastInputSeconds: Type.Optional(Type.Integer({ minimum: 0 })),
+	reason: Type.Optional(NonEmptyString),
+	tags: Type.Optional(Type.Array(NonEmptyString)),
+	text: Type.Optional(Type.String()),
+	ts: Type.Integer({ minimum: 0 }),
+	deviceId: Type.Optional(NonEmptyString),
+	roles: Type.Optional(Type.Array(NonEmptyString)),
+	scopes: Type.Optional(Type.Array(NonEmptyString)),
+	instanceId: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+const HealthSnapshotSchema = Type.Any();
+const SessionDefaultsSchema = Type.Object({
+	defaultAgentId: NonEmptyString,
+	mainKey: NonEmptyString,
+	mainSessionKey: NonEmptyString,
+	scope: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+const StateVersionSchema = Type.Object({
+	presence: Type.Integer({ minimum: 0 }),
+	health: Type.Integer({ minimum: 0 })
+}, { additionalProperties: false });
+const SnapshotSchema = Type.Object({
+	presence: Type.Array(PresenceEntrySchema),
+	health: HealthSnapshotSchema,
+	stateVersion: StateVersionSchema,
+	uptimeMs: Type.Integer({ minimum: 0 }),
+	configPath: Type.Optional(NonEmptyString),
+	stateDir: Type.Optional(NonEmptyString),
+	sessionDefaults: Type.Optional(SessionDefaultsSchema),
+	authMode: Type.Optional(Type.Union([
+		Type.Literal("none"),
+		Type.Literal("token"),
+		Type.Literal("password"),
+		Type.Literal("trusted-proxy")
+	])),
+	updateAvailable: Type.Optional(Type.Object({
+		currentVersion: NonEmptyString,
+		latestVersion: NonEmptyString,
+		channel: NonEmptyString
+	}))
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/frames.ts
+const TickEventSchema = Type.Object({ ts: Type.Integer({ minimum: 0 }) }, { additionalProperties: false });
+const ShutdownEventSchema = Type.Object({
+	reason: NonEmptyString,
+	restartExpectedMs: Type.Optional(Type.Integer({ minimum: 0 }))
+}, { additionalProperties: false });
+const ConnectParamsSchema = Type.Object({
+	minProtocol: Type.Integer({ minimum: 1 }),
+	maxProtocol: Type.Integer({ minimum: 1 }),
+	client: Type.Object({
+		id: GatewayClientIdSchema,
+		displayName: Type.Optional(NonEmptyString),
+		version: NonEmptyString,
+		platform: NonEmptyString,
+		deviceFamily: Type.Optional(NonEmptyString),
+		modelIdentifier: Type.Optional(NonEmptyString),
+		mode: GatewayClientModeSchema,
+		instanceId: Type.Optional(NonEmptyString)
+	}, { additionalProperties: false }),
+	caps: Type.Optional(Type.Array(NonEmptyString, { default: [] })),
+	commands: Type.Optional(Type.Array(NonEmptyString)),
+	permissions: Type.Optional(Type.Record(NonEmptyString, Type.Boolean())),
+	pathEnv: Type.Optional(Type.String()),
+	role: Type.Optional(NonEmptyString),
+	scopes: Type.Optional(Type.Array(NonEmptyString)),
+	device: Type.Optional(Type.Object({
+		id: NonEmptyString,
+		publicKey: NonEmptyString,
+		signature: NonEmptyString,
+		signedAt: Type.Integer({ minimum: 0 }),
+		nonce: NonEmptyString
+	}, { additionalProperties: false })),
+	auth: Type.Optional(Type.Object({
+		token: Type.Optional(Type.String()),
+		deviceToken: Type.Optional(Type.String()),
+		password: Type.Optional(Type.String())
+	}, { additionalProperties: false })),
+	locale: Type.Optional(Type.String()),
+	userAgent: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const HelloOkSchema = Type.Object({
+	type: Type.Literal("hello-ok"),
+	protocol: Type.Integer({ minimum: 1 }),
+	server: Type.Object({
+		version: NonEmptyString,
+		connId: NonEmptyString
+	}, { additionalProperties: false }),
+	features: Type.Object({
+		methods: Type.Array(NonEmptyString),
+		events: Type.Array(NonEmptyString)
+	}, { additionalProperties: false }),
+	snapshot: SnapshotSchema,
+	canvasHostUrl: Type.Optional(NonEmptyString),
+	auth: Type.Optional(Type.Object({
+		deviceToken: NonEmptyString,
+		role: NonEmptyString,
+		scopes: Type.Array(NonEmptyString),
+		issuedAtMs: Type.Optional(Type.Integer({ minimum: 0 }))
+	}, { additionalProperties: false })),
+	policy: Type.Object({
+		maxPayload: Type.Integer({ minimum: 1 }),
+		maxBufferedBytes: Type.Integer({ minimum: 1 }),
+		tickIntervalMs: Type.Integer({ minimum: 1 })
+	}, { additionalProperties: false })
+}, { additionalProperties: false });
+const ErrorShapeSchema = Type.Object({
+	code: NonEmptyString,
+	message: NonEmptyString,
+	details: Type.Optional(Type.Unknown()),
+	retryable: Type.Optional(Type.Boolean()),
+	retryAfterMs: Type.Optional(Type.Integer({ minimum: 0 }))
+}, { additionalProperties: false });
+const RequestFrameSchema = Type.Object({
+	type: Type.Literal("req"),
+	id: NonEmptyString,
+	method: NonEmptyString,
+	params: Type.Optional(Type.Unknown())
+}, { additionalProperties: false });
+const ResponseFrameSchema = Type.Object({
+	type: Type.Literal("res"),
+	id: NonEmptyString,
+	ok: Type.Boolean(),
+	payload: Type.Optional(Type.Unknown()),
+	error: Type.Optional(ErrorShapeSchema)
+}, { additionalProperties: false });
+const EventFrameSchema = Type.Object({
+	type: Type.Literal("event"),
+	event: NonEmptyString,
+	payload: Type.Optional(Type.Unknown()),
+	seq: Type.Optional(Type.Integer({ minimum: 0 })),
+	stateVersion: Type.Optional(StateVersionSchema)
+}, { additionalProperties: false });
+const GatewayFrameSchema = Type.Union([
+	RequestFrameSchema,
+	ResponseFrameSchema,
+	EventFrameSchema
+], { discriminator: "type" });
+
+//#endregion
+//#region src/gateway/protocol/schema/logs-chat.ts
+const LogsTailParamsSchema = Type.Object({
+	cursor: Type.Optional(Type.Integer({ minimum: 0 })),
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 5e3
+	})),
+	maxBytes: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 1e6
+	}))
+}, { additionalProperties: false });
+const LogsTailResultSchema = Type.Object({
+	file: NonEmptyString,
+	cursor: Type.Integer({ minimum: 0 }),
+	size: Type.Integer({ minimum: 0 }),
+	lines: Type.Array(Type.String()),
+	truncated: Type.Optional(Type.Boolean()),
+	reset: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const ChatHistoryParamsSchema = Type.Object({
+	sessionKey: NonEmptyString,
+	limit: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 1e3
+	}))
+}, { additionalProperties: false });
+const ChatSendParamsSchema = Type.Object({
+	sessionKey: NonEmptyString,
+	message: Type.String(),
+	thinking: Type.Optional(Type.String()),
+	deliver: Type.Optional(Type.Boolean()),
+	attachments: Type.Optional(Type.Array(Type.Unknown())),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	idempotencyKey: NonEmptyString
+}, { additionalProperties: false });
+const ChatAbortParamsSchema = Type.Object({
+	sessionKey: NonEmptyString,
+	runId: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+const ChatInjectParamsSchema = Type.Object({
+	sessionKey: NonEmptyString,
+	message: NonEmptyString,
+	label: Type.Optional(Type.String({ maxLength: 100 }))
+}, { additionalProperties: false });
+const ChatEventSchema = Type.Object({
+	runId: NonEmptyString,
+	sessionKey: NonEmptyString,
+	seq: Type.Integer({ minimum: 0 }),
+	state: Type.Union([
+		Type.Literal("delta"),
+		Type.Literal("final"),
+		Type.Literal("aborted"),
+		Type.Literal("error")
+	]),
+	message: Type.Optional(Type.Unknown()),
+	errorMessage: Type.Optional(Type.String()),
+	usage: Type.Optional(Type.Unknown()),
+	stopReason: Type.Optional(Type.String())
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/nodes.ts
+const NodePairRequestParamsSchema = Type.Object({
+	nodeId: NonEmptyString,
+	displayName: Type.Optional(NonEmptyString),
+	platform: Type.Optional(NonEmptyString),
+	version: Type.Optional(NonEmptyString),
+	coreVersion: Type.Optional(NonEmptyString),
+	uiVersion: Type.Optional(NonEmptyString),
+	deviceFamily: Type.Optional(NonEmptyString),
+	modelIdentifier: Type.Optional(NonEmptyString),
+	caps: Type.Optional(Type.Array(NonEmptyString)),
+	commands: Type.Optional(Type.Array(NonEmptyString)),
+	remoteIp: Type.Optional(NonEmptyString),
+	silent: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const NodePairListParamsSchema = Type.Object({}, { additionalProperties: false });
+const NodePairApproveParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
+const NodePairRejectParamsSchema = Type.Object({ requestId: NonEmptyString }, { additionalProperties: false });
+const NodePairVerifyParamsSchema = Type.Object({
+	nodeId: NonEmptyString,
+	token: NonEmptyString
+}, { additionalProperties: false });
+const NodeRenameParamsSchema = Type.Object({
+	nodeId: NonEmptyString,
+	displayName: NonEmptyString
+}, { additionalProperties: false });
+const NodeListParamsSchema = Type.Object({}, { additionalProperties: false });
+const NodeDescribeParamsSchema = Type.Object({ nodeId: NonEmptyString }, { additionalProperties: false });
+const NodeInvokeParamsSchema = Type.Object({
+	nodeId: NonEmptyString,
+	command: NonEmptyString,
+	params: Type.Optional(Type.Unknown()),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	idempotencyKey: NonEmptyString
+}, { additionalProperties: false });
+const NodeInvokeResultParamsSchema = Type.Object({
+	id: NonEmptyString,
+	nodeId: NonEmptyString,
+	ok: Type.Boolean(),
+	payload: Type.Optional(Type.Unknown()),
+	payloadJSON: Type.Optional(Type.String()),
+	error: Type.Optional(Type.Object({
+		code: Type.Optional(NonEmptyString),
+		message: Type.Optional(NonEmptyString)
+	}, { additionalProperties: false }))
+}, { additionalProperties: false });
+const NodeEventParamsSchema = Type.Object({
+	event: NonEmptyString,
+	payload: Type.Optional(Type.Unknown()),
+	payloadJSON: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const NodeInvokeRequestEventSchema = Type.Object({
+	id: NonEmptyString,
+	nodeId: NonEmptyString,
+	command: NonEmptyString,
+	paramsJSON: Type.Optional(Type.String()),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 0 })),
+	idempotencyKey: Type.Optional(NonEmptyString)
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/push.ts
+const ApnsEnvironmentSchema = Type.String({ enum: ["sandbox", "production"] });
+const PushTestParamsSchema = Type.Object({
+	nodeId: NonEmptyString,
+	title: Type.Optional(Type.String()),
+	body: Type.Optional(Type.String()),
+	environment: Type.Optional(ApnsEnvironmentSchema)
+}, { additionalProperties: false });
+const PushTestResultSchema = Type.Object({
+	ok: Type.Boolean(),
+	status: Type.Integer(),
+	apnsId: Type.Optional(Type.String()),
+	reason: Type.Optional(Type.String()),
+	tokenSuffix: Type.String(),
+	topic: Type.String(),
+	environment: ApnsEnvironmentSchema
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/sessions.ts
+const SessionsListParamsSchema = Type.Object({
+	limit: Type.Optional(Type.Integer({ minimum: 1 })),
+	activeMinutes: Type.Optional(Type.Integer({ minimum: 1 })),
+	includeGlobal: Type.Optional(Type.Boolean()),
+	includeUnknown: Type.Optional(Type.Boolean()),
+	includeDerivedTitles: Type.Optional(Type.Boolean()),
+	includeLastMessage: Type.Optional(Type.Boolean()),
+	label: Type.Optional(SessionLabelString),
+	spawnedBy: Type.Optional(NonEmptyString),
+	agentId: Type.Optional(NonEmptyString),
+	search: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const SessionsPreviewParamsSchema = Type.Object({
+	keys: Type.Array(NonEmptyString, { minItems: 1 }),
+	limit: Type.Optional(Type.Integer({ minimum: 1 })),
+	maxChars: Type.Optional(Type.Integer({ minimum: 20 }))
+}, { additionalProperties: false });
+const SessionsResolveParamsSchema = Type.Object({
+	key: Type.Optional(NonEmptyString),
+	sessionId: Type.Optional(NonEmptyString),
+	label: Type.Optional(SessionLabelString),
+	agentId: Type.Optional(NonEmptyString),
+	spawnedBy: Type.Optional(NonEmptyString),
+	includeGlobal: Type.Optional(Type.Boolean()),
+	includeUnknown: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const SessionsPatchParamsSchema = Type.Object({
+	key: NonEmptyString,
+	label: Type.Optional(Type.Union([SessionLabelString, Type.Null()])),
+	verboseLevel: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	responseUsage: Type.Optional(Type.Union([
+		Type.Literal("off"),
+		Type.Literal("tokens"),
+		Type.Literal("full"),
+		Type.Literal("on"),
+		Type.Null()
+	])),
+	elevatedLevel: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	execHost: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	execSecurity: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	execAsk: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	execNode: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	model: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	spawnedBy: Type.Optional(Type.Union([NonEmptyString, Type.Null()])),
+	spawnDepth: Type.Optional(Type.Union([Type.Integer({ minimum: 0 }), Type.Null()])),
+	sendPolicy: Type.Optional(Type.Union([
+		Type.Literal("allow"),
+		Type.Literal("deny"),
+		Type.Null()
+	])),
+	groupActivation: Type.Optional(Type.Union([
+		Type.Literal("mention"),
+		Type.Literal("always"),
+		Type.Null()
+	]))
+}, { additionalProperties: false });
+const SessionsResetParamsSchema = Type.Object({
+	key: NonEmptyString,
+	reason: Type.Optional(Type.Union([Type.Literal("new"), Type.Literal("reset")]))
+}, { additionalProperties: false });
+const SessionsDeleteParamsSchema = Type.Object({
+	key: NonEmptyString,
+	deleteTranscript: Type.Optional(Type.Boolean()),
+	emitLifecycleHooks: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+const SessionsCompactParamsSchema = Type.Object({
+	key: NonEmptyString,
+	maxLines: Type.Optional(Type.Integer({ minimum: 1 }))
+}, { additionalProperties: false });
+const SessionsUsageParamsSchema = Type.Object({
+	key: Type.Optional(NonEmptyString),
+	startDate: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" })),
+	endDate: Type.Optional(Type.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}$" })),
+	mode: Type.Optional(Type.Union([
+		Type.Literal("utc"),
+		Type.Literal("gateway"),
+		Type.Literal("specific")
+	])),
+	utcOffset: Type.Optional(Type.String({ pattern: "^UTC[+-]\\d{1,2}(?::[0-5]\\d)?$" })),
+	limit: Type.Optional(Type.Integer({ minimum: 1 })),
+	includeContextWeight: Type.Optional(Type.Boolean())
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/wizard.ts
+const WizardRunStatusSchema = Type.Union([
+	Type.Literal("running"),
+	Type.Literal("done"),
+	Type.Literal("cancelled"),
+	Type.Literal("error")
+]);
+const WizardStartParamsSchema = Type.Object({
+	mode: Type.Optional(Type.Union([Type.Literal("local"), Type.Literal("remote")])),
+	workspace: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const WizardAnswerSchema = Type.Object({
+	stepId: NonEmptyString,
+	value: Type.Optional(Type.Unknown())
+}, { additionalProperties: false });
+const WizardNextParamsSchema = Type.Object({
+	sessionId: NonEmptyString,
+	answer: Type.Optional(WizardAnswerSchema)
+}, { additionalProperties: false });
+const WizardSessionIdParamsSchema = Type.Object({ sessionId: NonEmptyString }, { additionalProperties: false });
+const WizardCancelParamsSchema = WizardSessionIdParamsSchema;
+const WizardStatusParamsSchema = WizardSessionIdParamsSchema;
+const WizardStepOptionSchema = Type.Object({
+	value: Type.Unknown(),
+	label: NonEmptyString,
+	hint: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const WizardStepSchema = Type.Object({
+	id: NonEmptyString,
+	type: Type.Union([
+		Type.Literal("note"),
+		Type.Literal("select"),
+		Type.Literal("text"),
+		Type.Literal("confirm"),
+		Type.Literal("multiselect"),
+		Type.Literal("progress"),
+		Type.Literal("action")
+	]),
+	title: Type.Optional(Type.String()),
+	message: Type.Optional(Type.String()),
+	options: Type.Optional(Type.Array(WizardStepOptionSchema)),
+	initialValue: Type.Optional(Type.Unknown()),
+	placeholder: Type.Optional(Type.String()),
+	sensitive: Type.Optional(Type.Boolean()),
+	executor: Type.Optional(Type.Union([Type.Literal("gateway"), Type.Literal("client")]))
+}, { additionalProperties: false });
+const WizardResultFields = {
+	done: Type.Boolean(),
+	step: Type.Optional(WizardStepSchema),
+	status: Type.Optional(WizardRunStatusSchema),
+	error: Type.Optional(Type.String())
+};
+const WizardNextResultSchema = Type.Object(WizardResultFields, { additionalProperties: false });
+const WizardStartResultSchema = Type.Object({
+	sessionId: NonEmptyString,
+	...WizardResultFields
+}, { additionalProperties: false });
+const WizardStatusResultSchema = Type.Object({
+	status: WizardRunStatusSchema,
+	error: Type.Optional(Type.String())
+}, { additionalProperties: false });
+
+//#endregion
+//#region src/gateway/protocol/schema/protocol-schemas.ts
+const PROTOCOL_VERSION = 3;
+
+//#endregion
+//#region src/gateway/protocol/index.ts
+const ajv = new AjvPkg({
+	allErrors: true,
+	strict: false,
+	removeAdditional: false
+});
+const validateConnectParams = ajv.compile(ConnectParamsSchema);
+const validateRequestFrame = ajv.compile(RequestFrameSchema);
+const validateResponseFrame = ajv.compile(ResponseFrameSchema);
+const validateEventFrame = ajv.compile(EventFrameSchema);
+const validateSendParams = ajv.compile(SendParamsSchema);
+const validatePollParams = ajv.compile(PollParamsSchema);
+const validateAgentParams = ajv.compile(AgentParamsSchema);
+const validateAgentIdentityParams = ajv.compile(AgentIdentityParamsSchema);
+const validateAgentWaitParams = ajv.compile(AgentWaitParamsSchema);
+const validateWakeParams = ajv.compile(WakeParamsSchema);
+const validateAgentsListParams = ajv.compile(AgentsListParamsSchema);
+const validateAgentsCreateParams = ajv.compile(AgentsCreateParamsSchema);
+const validateAgentsUpdateParams = ajv.compile(AgentsUpdateParamsSchema);
+const validateAgentsDeleteParams = ajv.compile(AgentsDeleteParamsSchema);
+const validateAgentsFilesListParams = ajv.compile(AgentsFilesListParamsSchema);
+const validateAgentsFilesGetParams = ajv.compile(AgentsFilesGetParamsSchema);
+const validateAgentsFilesSetParams = ajv.compile(AgentsFilesSetParamsSchema);
+const validateNodePairRequestParams = ajv.compile(NodePairRequestParamsSchema);
+const validateNodePairListParams = ajv.compile(NodePairListParamsSchema);
+const validateNodePairApproveParams = ajv.compile(NodePairApproveParamsSchema);
+const validateNodePairRejectParams = ajv.compile(NodePairRejectParamsSchema);
+const validateNodePairVerifyParams = ajv.compile(NodePairVerifyParamsSchema);
+const validateNodeRenameParams = ajv.compile(NodeRenameParamsSchema);
+const validateNodeListParams = ajv.compile(NodeListParamsSchema);
+const validateNodeDescribeParams = ajv.compile(NodeDescribeParamsSchema);
+const validateNodeInvokeParams = ajv.compile(NodeInvokeParamsSchema);
+const validateNodeInvokeResultParams = ajv.compile(NodeInvokeResultParamsSchema);
+const validateNodeEventParams = ajv.compile(NodeEventParamsSchema);
+const validatePushTestParams = ajv.compile(PushTestParamsSchema);
+const validateSessionsListParams = ajv.compile(SessionsListParamsSchema);
+const validateSessionsPreviewParams = ajv.compile(SessionsPreviewParamsSchema);
+const validateSessionsResolveParams = ajv.compile(SessionsResolveParamsSchema);
+const validateSessionsPatchParams = ajv.compile(SessionsPatchParamsSchema);
+const validateSessionsResetParams = ajv.compile(SessionsResetParamsSchema);
+const validateSessionsDeleteParams = ajv.compile(SessionsDeleteParamsSchema);
+const validateSessionsCompactParams = ajv.compile(SessionsCompactParamsSchema);
+const validateSessionsUsageParams = ajv.compile(SessionsUsageParamsSchema);
+const validateConfigGetParams = ajv.compile(ConfigGetParamsSchema);
+const validateConfigSetParams = ajv.compile(ConfigSetParamsSchema);
+const validateConfigApplyParams = ajv.compile(ConfigApplyParamsSchema);
+const validateConfigPatchParams = ajv.compile(ConfigPatchParamsSchema);
+const validateConfigSchemaParams = ajv.compile(ConfigSchemaParamsSchema);
+const validateWizardStartParams = ajv.compile(WizardStartParamsSchema);
+const validateWizardNextParams = ajv.compile(WizardNextParamsSchema);
+const validateWizardCancelParams = ajv.compile(WizardCancelParamsSchema);
+const validateWizardStatusParams = ajv.compile(WizardStatusParamsSchema);
+const validateTalkModeParams = ajv.compile(TalkModeParamsSchema);
+const validateTalkConfigParams = ajv.compile(TalkConfigParamsSchema);
+const validateChannelsStatusParams = ajv.compile(ChannelsStatusParamsSchema);
+const validateChannelsLogoutParams = ajv.compile(ChannelsLogoutParamsSchema);
+const validateModelsListParams = ajv.compile(ModelsListParamsSchema);
+const validateToolsCatalogParams = ajv.compile(ToolsCatalogParamsSchema);
+const validateCronListParams = ajv.compile(CronListParamsSchema);
+const validateCronStatusParams = ajv.compile(CronStatusParamsSchema);
+const validateCronAddParams = ajv.compile(CronAddParamsSchema);
+const validateCronUpdateParams = ajv.compile(CronUpdateParamsSchema);
+const validateCronRemoveParams = ajv.compile(CronRemoveParamsSchema);
+const validateCronRunParams = ajv.compile(CronRunParamsSchema);
+const validateCronRunsParams = ajv.compile(CronRunsParamsSchema);
+const validateDevicePairListParams = ajv.compile(DevicePairListParamsSchema);
+const validateDevicePairApproveParams = ajv.compile(DevicePairApproveParamsSchema);
+const validateDevicePairRejectParams = ajv.compile(DevicePairRejectParamsSchema);
+const validateDevicePairRemoveParams = ajv.compile(DevicePairRemoveParamsSchema);
+const validateDeviceTokenRotateParams = ajv.compile(DeviceTokenRotateParamsSchema);
+const validateDeviceTokenRevokeParams = ajv.compile(DeviceTokenRevokeParamsSchema);
+const validateLogsTailParams = ajv.compile(LogsTailParamsSchema);
+const validateChatHistoryParams = ajv.compile(ChatHistoryParamsSchema);
+const validateChatSendParams = ajv.compile(ChatSendParamsSchema);
+const validateChatAbortParams = ajv.compile(ChatAbortParamsSchema);
+const validateChatInjectParams = ajv.compile(ChatInjectParamsSchema);
+const validateChatEvent = ajv.compile(ChatEventSchema);
+const validateUpdateRunParams = ajv.compile(UpdateRunParamsSchema);
+const validateWebLoginStartParams = ajv.compile(WebLoginStartParamsSchema);
+const validateWebLoginWaitParams = ajv.compile(WebLoginWaitParamsSchema);
+function formatValidationErrors(errors) {
+	if (!errors?.length) return "unknown validation error";
+	const parts = [];
+	for (const err of errors) {
+		const keyword = typeof err?.keyword === "string" ? err.keyword : "";
+		const instancePath = typeof err?.instancePath === "string" ? err.instancePath : "";
+		if (keyword === "additionalProperties") {
+			const additionalProperty = (err?.params)?.additionalProperty;
+			if (typeof additionalProperty === "string" && additionalProperty.trim()) {
+				const where = instancePath ? `at ${instancePath}` : "at root";
+				parts.push(`${where}: unexpected property '${additionalProperty}'`);
+				continue;
+			}
+		}
+		const message = typeof err?.message === "string" && err.message.trim() ? err.message : "validation error";
+		const where = instancePath ? `at ${instancePath}: ` : "";
+		parts.push(`${where}${message}`);
+	}
+	const unique = Array.from(new Set(parts.filter((part) => part.trim())));
+	if (!unique.length) return ajv.errorsText(errors, { separator: "; " }) || "unknown validation error";
+	return unique.join("; ");
+}
+
+//#endregion
+//#region src/gateway/client.ts
+var GatewayClient = class {
+	constructor(opts) {
+		this.ws = null;
+		this.pending = /* @__PURE__ */ new Map();
+		this.backoffMs = 1e3;
+		this.closed = false;
+		this.lastSeq = null;
+		this.connectNonce = null;
+		this.connectSent = false;
+		this.connectTimer = null;
+		this.lastTick = null;
+		this.tickIntervalMs = 3e4;
+		this.tickTimer = null;
+		this.opts = {
+			...opts,
+			deviceIdentity: opts.deviceIdentity ?? loadOrCreateDeviceIdentity()
+		};
+	}
+	start() {
+		if (this.closed) return;
+		const url = this.opts.url ?? "ws://127.0.0.1:18789";
+		if (this.opts.tlsFingerprint && !url.startsWith("wss://")) {
+			this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway tls fingerprint requires wss:// gateway url"));
+			return;
+		}
+		if (!isSecureWebSocketUrl(url)) {
+			let displayHost = url;
+			try {
+				displayHost = new URL(url).hostname || url;
+			} catch {}
+			const error = /* @__PURE__ */ new Error(`SECURITY ERROR: Cannot connect to "${displayHost}" over plaintext ws://. Both credentials and chat data would be exposed to network interception. Use wss:// for remote URLs. Safe defaults: keep gateway.bind=loopback and connect via SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host), or use Tailscale Serve/Funnel. Run \`remoteclaw doctor --fix\` for guidance.`);
+			this.opts.onConnectError?.(error);
+			return;
+		}
+		const wsOptions = { maxPayload: 25 * 1024 * 1024 };
+		if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
+			wsOptions.rejectUnauthorized = false;
+			wsOptions.checkServerIdentity = ((_host, cert) => {
+				const fingerprintValue = typeof cert === "object" && cert && "fingerprint256" in cert ? cert.fingerprint256 ?? "" : "";
+				const fingerprint = normalizeFingerprint(typeof fingerprintValue === "string" ? fingerprintValue : "");
+				const expected = normalizeFingerprint(this.opts.tlsFingerprint ?? "");
+				if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
+				if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+				if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
+			});
+		}
+		this.ws = new WebSocket$1(url, wsOptions);
+		this.ws.on("open", () => {
+			if (url.startsWith("wss://") && this.opts.tlsFingerprint) {
+				const tlsError = this.validateTlsFingerprint();
+				if (tlsError) {
+					this.opts.onConnectError?.(tlsError);
+					this.ws?.close(1008, tlsError.message);
+					return;
+				}
+			}
+			this.queueConnect();
+		});
+		this.ws.on("message", (data) => this.handleMessage(rawDataToString(data)));
+		this.ws.on("close", (code, reason) => {
+			const reasonText = rawDataToString(reason);
+			this.ws = null;
+			if (code === 1008 && reasonText.toLowerCase().includes("device token mismatch") && !this.opts.token && !this.opts.password && this.opts.deviceIdentity) {
+				const deviceId = this.opts.deviceIdentity.deviceId;
+				const role = this.opts.role ?? "operator";
+				try {
+					clearDeviceAuthToken({
+						deviceId,
+						role
+					});
+					clearDevicePairing(deviceId).catch((err) => {
+						logDebug(`failed clearing stale device pairing for device ${deviceId}: ${String(err)}`);
+					});
+					logDebug(`cleared stale device-auth token for device ${deviceId}`);
+				} catch (err) {
+					logDebug(`failed clearing stale device-auth token for device ${deviceId}: ${String(err)}`);
+				}
+			}
+			this.flushPendingErrors(/* @__PURE__ */ new Error(`gateway closed (${code}): ${reasonText}`));
+			this.scheduleReconnect();
+			this.opts.onClose?.(code, reasonText);
+		});
+		this.ws.on("error", (err) => {
+			logDebug(`gateway client error: ${String(err)}`);
+			if (!this.connectSent) this.opts.onConnectError?.(err instanceof Error ? err : new Error(String(err)));
+		});
+	}
+	stop() {
+		this.closed = true;
+		if (this.tickTimer) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = null;
+		}
+		this.ws?.close();
+		this.ws = null;
+		this.flushPendingErrors(/* @__PURE__ */ new Error("gateway client stopped"));
+	}
+	sendConnect() {
+		if (this.connectSent) return;
+		const nonce = this.connectNonce?.trim() ?? "";
+		if (!nonce) {
+			this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway connect challenge missing nonce"));
+			this.ws?.close(1008, "connect challenge missing nonce");
+			return;
+		}
+		this.connectSent = true;
+		if (this.connectTimer) {
+			clearTimeout(this.connectTimer);
+			this.connectTimer = null;
+		}
+		const role = this.opts.role ?? "operator";
+		const explicitGatewayToken = this.opts.token?.trim() || void 0;
+		const explicitDeviceToken = this.opts.deviceToken?.trim() || void 0;
+		const storedToken = this.opts.deviceIdentity ? loadDeviceAuthToken({
+			deviceId: this.opts.deviceIdentity.deviceId,
+			role
+		})?.token : null;
+		const resolvedDeviceToken = explicitDeviceToken ?? (!explicitGatewayToken ? storedToken ?? void 0 : void 0);
+		const authToken = explicitGatewayToken ?? resolvedDeviceToken;
+		const authPassword = this.opts.password?.trim() || void 0;
+		const auth = authToken || authPassword || resolvedDeviceToken ? {
+			token: authToken,
+			deviceToken: resolvedDeviceToken,
+			password: authPassword
+		} : void 0;
+		const signedAtMs = Date.now();
+		const scopes = this.opts.scopes ?? ["operator.admin"];
+		const device = (() => {
+			if (!this.opts.deviceIdentity) return;
+			const payload = buildDeviceAuthPayload({
+				deviceId: this.opts.deviceIdentity.deviceId,
+				clientId: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
+				clientMode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+				role,
+				scopes,
+				signedAtMs,
+				token: authToken ?? null,
+				nonce
+			});
+			const signature = signDevicePayload(this.opts.deviceIdentity.privateKeyPem, payload);
+			return {
+				id: this.opts.deviceIdentity.deviceId,
+				publicKey: publicKeyRawBase64UrlFromPem(this.opts.deviceIdentity.publicKeyPem),
+				signature,
+				signedAt: signedAtMs,
+				nonce
+			};
+		})();
+		const params = {
+			minProtocol: this.opts.minProtocol ?? PROTOCOL_VERSION,
+			maxProtocol: this.opts.maxProtocol ?? PROTOCOL_VERSION,
+			client: {
+				id: this.opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
+				displayName: this.opts.clientDisplayName,
+				version: this.opts.clientVersion ?? "dev",
+				platform: this.opts.platform ?? process.platform,
+				mode: this.opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND,
+				instanceId: this.opts.instanceId
+			},
+			caps: Array.isArray(this.opts.caps) ? this.opts.caps : [],
+			commands: Array.isArray(this.opts.commands) ? this.opts.commands : void 0,
+			permissions: this.opts.permissions && typeof this.opts.permissions === "object" ? this.opts.permissions : void 0,
+			pathEnv: this.opts.pathEnv,
+			auth,
+			role,
+			scopes,
+			device
+		};
+		this.request("connect", params).then((helloOk) => {
+			const authInfo = helloOk?.auth;
+			if (authInfo?.deviceToken && this.opts.deviceIdentity) storeDeviceAuthToken({
+				deviceId: this.opts.deviceIdentity.deviceId,
+				role: authInfo.role ?? role,
+				token: authInfo.deviceToken,
+				scopes: authInfo.scopes ?? []
+			});
+			this.backoffMs = 1e3;
+			this.tickIntervalMs = typeof helloOk.policy?.tickIntervalMs === "number" ? helloOk.policy.tickIntervalMs : 3e4;
+			this.lastTick = Date.now();
+			this.startTickWatch();
+			this.opts.onHelloOk?.(helloOk);
+		}).catch((err) => {
+			this.opts.onConnectError?.(err instanceof Error ? err : new Error(String(err)));
+			const msg = `gateway connect failed: ${String(err)}`;
+			if (this.opts.mode === GATEWAY_CLIENT_MODES.PROBE) logDebug(msg);
+			else logError(msg);
+			this.ws?.close(1008, "connect failed");
+		});
+	}
+	handleMessage(raw) {
+		try {
+			const parsed = JSON.parse(raw);
+			if (validateEventFrame(parsed)) {
+				const evt = parsed;
+				if (evt.event === "connect.challenge") {
+					const payload = evt.payload;
+					const nonce = payload && typeof payload.nonce === "string" ? payload.nonce : null;
+					if (!nonce || nonce.trim().length === 0) {
+						this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway connect challenge missing nonce"));
+						this.ws?.close(1008, "connect challenge missing nonce");
+						return;
+					}
+					this.connectNonce = nonce.trim();
+					this.sendConnect();
+					return;
+				}
+				const seq = typeof evt.seq === "number" ? evt.seq : null;
+				if (seq !== null) {
+					if (this.lastSeq !== null && seq > this.lastSeq + 1) this.opts.onGap?.({
+						expected: this.lastSeq + 1,
+						received: seq
+					});
+					this.lastSeq = seq;
+				}
+				if (evt.event === "tick") this.lastTick = Date.now();
+				this.opts.onEvent?.(evt);
+				return;
+			}
+			if (validateResponseFrame(parsed)) {
+				const pending = this.pending.get(parsed.id);
+				if (!pending) return;
+				const status = parsed.payload?.status;
+				if (pending.expectFinal && status === "accepted") return;
+				this.pending.delete(parsed.id);
+				if (parsed.ok) pending.resolve(parsed.payload);
+				else pending.reject(new Error(parsed.error?.message ?? "unknown error"));
+			}
+		} catch (err) {
+			logDebug(`gateway client parse error: ${String(err)}`);
+		}
+	}
+	queueConnect() {
+		this.connectNonce = null;
+		this.connectSent = false;
+		const rawConnectDelayMs = this.opts.connectDelayMs;
+		const connectChallengeTimeoutMs = typeof rawConnectDelayMs === "number" && Number.isFinite(rawConnectDelayMs) ? Math.max(250, Math.min(1e4, rawConnectDelayMs)) : 2e3;
+		if (this.connectTimer) clearTimeout(this.connectTimer);
+		this.connectTimer = setTimeout(() => {
+			if (this.connectSent || this.ws?.readyState !== WebSocket$1.OPEN) return;
+			this.opts.onConnectError?.(/* @__PURE__ */ new Error("gateway connect challenge timeout"));
+			this.ws?.close(1008, "connect challenge timeout");
+		}, connectChallengeTimeoutMs);
+	}
+	scheduleReconnect() {
+		if (this.closed) return;
+		if (this.tickTimer) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = null;
+		}
+		const delay = this.backoffMs;
+		this.backoffMs = Math.min(this.backoffMs * 2, 3e4);
+		setTimeout(() => this.start(), delay).unref();
+	}
+	flushPendingErrors(err) {
+		for (const [, p] of this.pending) p.reject(err);
+		this.pending.clear();
+	}
+	startTickWatch() {
+		if (this.tickTimer) clearInterval(this.tickTimer);
+		const rawMinInterval = this.opts.tickWatchMinIntervalMs;
+		const minInterval = typeof rawMinInterval === "number" && Number.isFinite(rawMinInterval) ? Math.max(1, Math.min(3e4, rawMinInterval)) : 1e3;
+		const interval = Math.max(this.tickIntervalMs, minInterval);
+		this.tickTimer = setInterval(() => {
+			if (this.closed) return;
+			if (!this.lastTick) return;
+			if (Date.now() - this.lastTick > this.tickIntervalMs * 2) this.ws?.close(4e3, "tick timeout");
+		}, interval);
+	}
+	validateTlsFingerprint() {
+		if (!this.opts.tlsFingerprint || !this.ws) return null;
+		const expected = normalizeFingerprint(this.opts.tlsFingerprint);
+		if (!expected) return /* @__PURE__ */ new Error("gateway tls fingerprint missing");
+		const socket = this.ws._socket;
+		if (!socket || typeof socket.getPeerCertificate !== "function") return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+		const fingerprint = normalizeFingerprint(socket.getPeerCertificate()?.fingerprint256 ?? "");
+		if (!fingerprint) return /* @__PURE__ */ new Error("gateway tls fingerprint unavailable");
+		if (fingerprint !== expected) return /* @__PURE__ */ new Error("gateway tls fingerprint mismatch");
+		return null;
+	}
+	async request(method, params, opts) {
+		if (!this.ws || this.ws.readyState !== WebSocket$1.OPEN) throw new Error("gateway not connected");
+		const id = randomUUID();
+		const frame = {
+			type: "req",
+			id,
+			method,
+			params
+		};
+		if (!validateRequestFrame(frame)) throw new Error(`invalid request frame: ${JSON.stringify(validateRequestFrame.errors, null, 2)}`);
+		const expectFinal = opts?.expectFinal === true;
+		const p = new Promise((resolve, reject) => {
+			this.pending.set(id, {
+				resolve: (value) => resolve(value),
+				reject,
+				expectFinal
+			});
+		});
+		this.ws.send(JSON.stringify(frame));
+		return p;
+	}
+};
+
+//#endregion
+//#region src/gateway/method-scopes.ts
+const ADMIN_SCOPE = "operator.admin";
+const READ_SCOPE = "operator.read";
+const WRITE_SCOPE = "operator.write";
+const APPROVALS_SCOPE = "operator.approvals";
+const PAIRING_SCOPE = "operator.pairing";
+const CLI_DEFAULT_OPERATOR_SCOPES = [
+	ADMIN_SCOPE,
+	READ_SCOPE,
+	WRITE_SCOPE,
+	APPROVALS_SCOPE,
+	PAIRING_SCOPE
+];
+const NODE_ROLE_METHODS = new Set(["node.invoke.result", "node.event"]);
+const METHOD_SCOPE_GROUPS = {
+	[APPROVALS_SCOPE]: [
+		"exec.approval.request",
+		"exec.approval.waitDecision",
+		"exec.approval.resolve"
+	],
+	[PAIRING_SCOPE]: [
+		"node.pair.request",
+		"node.pair.list",
+		"node.pair.approve",
+		"node.pair.reject",
+		"node.pair.verify",
+		"device.pair.list",
+		"device.pair.approve",
+		"device.pair.reject",
+		"device.pair.remove",
+		"device.token.rotate",
+		"device.token.revoke",
+		"node.rename"
+	],
+	[READ_SCOPE]: [
+		"health",
+		"logs.tail",
+		"channels.status",
+		"status",
+		"usage.status",
+		"usage.cost",
+		"tts.status",
+		"tts.providers",
+		"models.list",
+		"tools.catalog",
+		"plugin:tools:list",
+		"agents.list",
+		"agent.identity.get",
+		"voicewake.get",
+		"sessions.list",
+		"sessions.preview",
+		"sessions.resolve",
+		"sessions.usage",
+		"sessions.usage.timeseries",
+		"sessions.usage.logs",
+		"cron.list",
+		"cron.status",
+		"cron.runs",
+		"system-presence",
+		"last-heartbeat",
+		"node.list",
+		"node.describe",
+		"chat.history",
+		"config.get",
+		"talk.config",
+		"agents.files.list",
+		"agents.files.get"
+	],
+	[WRITE_SCOPE]: [
+		"send",
+		"poll",
+		"agent",
+		"agent.wait",
+		"wake",
+		"talk.mode",
+		"tts.enable",
+		"tts.disable",
+		"tts.convert",
+		"tts.setProvider",
+		"voicewake.set",
+		"node.invoke",
+		"sessions.spawn",
+		"sessions.subagents",
+		"chat.send",
+		"chat.abort",
+		"browser.request",
+		"push.test",
+		"hooks.tool.before",
+		"hooks.tool.after",
+		"plugin:tools:invoke",
+		"message:send",
+		"message:reply",
+		"message:thread-reply",
+		"message:broadcast",
+		"message:sendAttachment",
+		"message:sendWithEffect"
+	],
+	[ADMIN_SCOPE]: [
+		"channels.logout",
+		"agents.create",
+		"agents.update",
+		"agents.delete",
+		"cron.add",
+		"cron.update",
+		"cron.remove",
+		"cron.run",
+		"sessions.patch",
+		"sessions.reset",
+		"sessions.delete",
+		"sessions.compact",
+		"connect",
+		"chat.inject",
+		"web.login.start",
+		"web.login.wait",
+		"set-heartbeats",
+		"system-event",
+		"agents.files.set",
+		"message:delete",
+		"message:react",
+		"message:pin",
+		"message:readMessages"
+	]
+};
+const ADMIN_METHOD_PREFIXES = [
+	"exec.approvals.",
+	"config.",
+	"wizard.",
+	"update."
+];
+const METHOD_SCOPE_BY_NAME = new Map(Object.entries(METHOD_SCOPE_GROUPS).flatMap(([scope, methods]) => methods.map((method) => [method, scope])));
+function resolveScopedMethod(method) {
+	const explicitScope = METHOD_SCOPE_BY_NAME.get(method);
+	if (explicitScope) return explicitScope;
+	if (ADMIN_METHOD_PREFIXES.some((prefix) => method.startsWith(prefix))) return ADMIN_SCOPE;
+}
+function isNodeRoleMethod(method) {
+	return NODE_ROLE_METHODS.has(method);
+}
+function resolveRequiredOperatorScopeForMethod(method) {
+	return resolveScopedMethod(method);
+}
+function resolveLeastPrivilegeOperatorScopesForMethod(method) {
+	const requiredScope = resolveRequiredOperatorScopeForMethod(method);
+	if (requiredScope) return [requiredScope];
+	return [];
+}
+function authorizeOperatorScopesForMethod(method, scopes) {
+	if (scopes.includes(ADMIN_SCOPE)) return { allowed: true };
+	const requiredScope = resolveRequiredOperatorScopeForMethod(method) ?? ADMIN_SCOPE;
+	if (requiredScope === READ_SCOPE) {
+		if (scopes.includes(READ_SCOPE) || scopes.includes(WRITE_SCOPE)) return { allowed: true };
+		return {
+			allowed: false,
+			missingScope: READ_SCOPE
+		};
+	}
+	if (scopes.includes(requiredScope)) return { allowed: true };
+	return {
+		allowed: false,
+		missingScope: requiredScope
+	};
+}
+
+//#endregion
+//#region src/gateway/call.ts
+function resolveExplicitGatewayAuth(opts) {
+	return {
+		token: typeof opts?.token === "string" && opts.token.trim().length > 0 ? opts.token.trim() : void 0,
+		password: typeof opts?.password === "string" && opts.password.trim().length > 0 ? opts.password.trim() : void 0
+	};
+}
+function ensureExplicitGatewayAuth(params) {
+	if (!params.urlOverride) return;
+	if (params.auth.token || params.auth.password) return;
+	const message = [
+		"gateway url override requires explicit credentials",
+		params.errorHint,
+		params.configPath ? `Config: ${params.configPath}` : void 0
+	].filter(Boolean).join("\n");
+	throw new Error(message);
+}
+function buildGatewayConnectionDetails(options = {}) {
+	const config = options.config ?? loadConfig();
+	const configPath = options.configPath ?? resolveConfigPath(process.env, resolveStateDir(process.env));
+	const isRemoteMode = config.gateway?.mode === "remote";
+	const remote = isRemoteMode ? config.gateway?.remote : void 0;
+	const tlsEnabled = config.gateway?.tls?.enabled === true;
+	const localPort = resolveGatewayPort(config);
+	const bindMode = config.gateway?.bind ?? "loopback";
+	const localUrl = `${tlsEnabled ? "wss" : "ws"}://127.0.0.1:${localPort}`;
+	const urlOverride = typeof options.url === "string" && options.url.trim().length > 0 ? options.url.trim() : void 0;
+	const remoteUrl = typeof remote?.url === "string" && remote.url.trim().length > 0 ? remote.url.trim() : void 0;
+	const remoteMisconfigured = isRemoteMode && !urlOverride && !remoteUrl;
+	const url = urlOverride || remoteUrl || localUrl;
+	const urlSource = urlOverride ? "cli --url" : remoteUrl ? "config gateway.remote.url" : remoteMisconfigured ? "missing gateway.remote.url (fallback local)" : "local loopback";
+	const remoteFallbackNote = remoteMisconfigured ? "Warn: gateway.mode=remote but gateway.remote.url is missing; set gateway.remote.url or switch gateway.mode=local." : void 0;
+	const bindDetail = !urlOverride && !remoteUrl ? `Bind: ${bindMode}` : void 0;
+	if (!isSecureWebSocketUrl(url)) throw new Error([
+		`SECURITY ERROR: Gateway URL "${url}" uses plaintext ws:// to a non-loopback address.`,
+		"Both credentials and chat data would be exposed to network interception.",
+		`Source: ${urlSource}`,
+		`Config: ${configPath}`,
+		"Fix: Use wss:// for remote gateway URLs.",
+		"Safe remote access defaults:",
+		"- keep gateway.bind=loopback and use an SSH tunnel (ssh -N -L 18789:127.0.0.1:18789 user@gateway-host)",
+		"- or use Tailscale Serve/Funnel for HTTPS remote access",
+		"Doctor: remoteclaw doctor --fix",
+		"Docs: https://docs.remoteclaw.org/gateway/remote"
+	].join("\n"));
+	return {
+		url,
+		urlSource,
+		bindDetail,
+		remoteFallbackNote,
+		message: [
+			`Gateway target: ${url}`,
+			`Source: ${urlSource}`,
+			`Config: ${configPath}`,
+			bindDetail,
+			remoteFallbackNote
+		].filter(Boolean).join("\n")
+	};
+}
+function trimToUndefined(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function resolveGatewayCallTimeout(timeoutValue) {
+	const timeoutMs = typeof timeoutValue === "number" && Number.isFinite(timeoutValue) ? timeoutValue : 1e4;
+	return {
+		timeoutMs,
+		safeTimerTimeoutMs: Math.max(1, Math.min(Math.floor(timeoutMs), 2147483647))
+	};
+}
+function resolveGatewayCallContext(opts) {
+	const config = opts.config ?? loadConfig();
+	const configPath = opts.configPath ?? resolveConfigPath(process.env, resolveStateDir(process.env));
+	const isRemoteMode = config.gateway?.mode === "remote";
+	const remote = isRemoteMode ? config.gateway?.remote : void 0;
+	return {
+		config,
+		configPath,
+		isRemoteMode,
+		remote,
+		urlOverride: trimToUndefined(opts.url),
+		remoteUrl: trimToUndefined(remote?.url),
+		explicitAuth: resolveExplicitGatewayAuth({
+			token: opts.token,
+			password: opts.password
+		})
+	};
+}
+function ensureRemoteModeUrlConfigured(context) {
+	if (!context.isRemoteMode || context.urlOverride || context.remoteUrl) return;
+	throw new Error([
+		"gateway remote mode misconfigured: gateway.remote.url missing",
+		`Config: ${context.configPath}`,
+		"Fix: set gateway.remote.url, or set gateway.mode=local."
+	].join("\n"));
+}
+function resolveGatewayCredentials(context) {
+	return resolveGatewayCredentialsFromConfig({
+		cfg: context.config,
+		env: process.env,
+		explicitAuth: context.explicitAuth,
+		urlOverride: context.urlOverride,
+		remotePasswordPrecedence: "env-first"
+	});
+}
+async function resolveGatewayTlsFingerprint(params) {
+	const { opts, context, url } = params;
+	const tlsRuntime = context.config.gateway?.tls?.enabled === true && !context.urlOverride && !context.remoteUrl && url.startsWith("wss://") ? await loadGatewayTlsRuntime(context.config.gateway?.tls) : void 0;
+	const overrideTlsFingerprint = trimToUndefined(opts.tlsFingerprint);
+	const remoteTlsFingerprint = context.isRemoteMode && !context.urlOverride && context.remoteUrl ? trimToUndefined(context.remote?.tlsFingerprint) : void 0;
+	return overrideTlsFingerprint || remoteTlsFingerprint || (tlsRuntime?.enabled ? tlsRuntime.fingerprintSha256 : void 0);
+}
+function formatGatewayCloseError(code, reason, connectionDetails) {
+	const reasonText = reason?.trim() || "no close reason";
+	const hint = code === 1006 ? "abnormal closure (no close frame)" : code === 1e3 ? "normal closure" : "";
+	return `gateway closed (${code}${hint ? ` ${hint}` : ""}): ${reasonText}\n${connectionDetails.message}`;
+}
+function formatGatewayTimeoutError(timeoutMs, connectionDetails) {
+	return `gateway timeout after ${timeoutMs}ms\n${connectionDetails.message}`;
+}
+async function executeGatewayRequestWithScopes(params) {
+	const { opts, scopes, url, token, password, tlsFingerprint, timeoutMs, safeTimerTimeoutMs } = params;
+	return await new Promise((resolve, reject) => {
+		let settled = false;
+		let ignoreClose = false;
+		const stop = (err, value) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			if (err) reject(err);
+			else resolve(value);
+		};
+		const client = new GatewayClient({
+			url,
+			token,
+			password,
+			tlsFingerprint,
+			instanceId: opts.instanceId ?? randomUUID(),
+			clientName: opts.clientName ?? GATEWAY_CLIENT_NAMES.CLI,
+			clientDisplayName: opts.clientDisplayName,
+			clientVersion: opts.clientVersion ?? "dev",
+			platform: opts.platform,
+			mode: opts.mode ?? GATEWAY_CLIENT_MODES.CLI,
+			role: "operator",
+			scopes,
+			deviceIdentity: loadOrCreateDeviceIdentity(),
+			minProtocol: opts.minProtocol ?? PROTOCOL_VERSION,
+			maxProtocol: opts.maxProtocol ?? PROTOCOL_VERSION,
+			onHelloOk: async () => {
+				try {
+					const result = await client.request(opts.method, opts.params, { expectFinal: opts.expectFinal });
+					ignoreClose = true;
+					stop(void 0, result);
+					client.stop();
+				} catch (err) {
+					ignoreClose = true;
+					client.stop();
+					stop(err);
+				}
+			},
+			onClose: (code, reason) => {
+				if (settled || ignoreClose) return;
+				ignoreClose = true;
+				client.stop();
+				stop(new Error(formatGatewayCloseError(code, reason, params.connectionDetails)));
+			}
+		});
+		const timer = setTimeout(() => {
+			ignoreClose = true;
+			client.stop();
+			stop(new Error(formatGatewayTimeoutError(timeoutMs, params.connectionDetails)));
+		}, safeTimerTimeoutMs);
+		client.start();
+	});
+}
+async function callGatewayWithScopes(opts, scopes) {
+	const { timeoutMs, safeTimerTimeoutMs } = resolveGatewayCallTimeout(opts.timeoutMs);
+	const context = resolveGatewayCallContext(opts);
+	ensureExplicitGatewayAuth({
+		urlOverride: context.urlOverride,
+		auth: context.explicitAuth,
+		errorHint: "Fix: pass --token or --password (or gatewayToken in tools).",
+		configPath: context.configPath
+	});
+	ensureRemoteModeUrlConfigured(context);
+	const connectionDetails = buildGatewayConnectionDetails({
+		config: context.config,
+		url: context.urlOverride,
+		...opts.configPath ? { configPath: opts.configPath } : {}
+	});
+	const url = connectionDetails.url;
+	const tlsFingerprint = await resolveGatewayTlsFingerprint({
+		opts,
+		context,
+		url
+	});
+	const { token, password } = resolveGatewayCredentials(context);
+	return await executeGatewayRequestWithScopes({
+		opts,
+		scopes,
+		url,
+		token,
+		password,
+		tlsFingerprint,
+		timeoutMs,
+		safeTimerTimeoutMs,
+		connectionDetails
+	});
+}
+async function callGatewayCli(opts) {
+	return await callGatewayWithScopes(opts, Array.isArray(opts.scopes) ? opts.scopes : CLI_DEFAULT_OPERATOR_SCOPES);
+}
+async function callGatewayLeastPrivilege(opts) {
+	return await callGatewayWithScopes(opts, resolveLeastPrivilegeOperatorScopesForMethod(opts.method));
+}
+async function callGateway(opts) {
+	if (Array.isArray(opts.scopes)) return await callGatewayWithScopes(opts, opts.scopes);
+	const callerMode = opts.mode ?? GATEWAY_CLIENT_MODES.BACKEND;
+	const callerName = opts.clientName ?? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT;
+	if (callerMode === GATEWAY_CLIENT_MODES.CLI || callerName === GATEWAY_CLIENT_NAMES.CLI) return await callGatewayCli(opts);
+	return await callGatewayLeastPrivilege({
+		...opts,
+		mode: callerMode,
+		clientName: callerName
+	});
+}
+function randomIdempotencyKey() {
+	return randomUUID();
+}
+
+//#endregion
+export { validateNodeInvokeResultParams as $, upsertPendingPairingRequest as $t, validateConfigApplyParams as A, PROTOCOL_VERSION as At, validateCronRunsParams as B, rejectDevicePairing as Bt, validateAgentsUpdateParams as C, validateWakeParams as Ct, validateChatHistoryParams as D, validateWizardNextParams as Dt, validateChatAbortParams as E, validateWizardCancelParams as Et, validateConnectParams as F, buildDeviceAuthPayload as Ft, validateDevicePairRejectParams as G, summarizeDeviceTokens as Gt, validateCronUpdateParams as H, requestDevicePairing as Ht, validateCronAddParams as I, approveDevicePairing as It, validateDeviceTokenRotateParams as J, generatePairingToken as Jt, validateDevicePairRemoveParams as K, updatePairedDeviceMetadata as Kt, validateCronListParams as L, ensureDeviceToken as Lt, validateConfigPatchParams as M, errorShape as Mt, validateConfigSchemaParams as N, SESSION_LABEL_MAX_LENGTH as Nt, validateChatInjectParams as O, validateWizardStartParams as Ot, validateConfigSetParams as P, parseSessionLabel as Pt, validateNodeInvokeParams as Q, resolvePairingPaths as Qt, validateCronRemoveParams as R, getPairedDevice as Rt, validateAgentsListParams as S, validateUpdateRunParams as St, validateChannelsStatusParams as T, validateWebLoginWaitParams as Tt, validateDevicePairApproveParams as U, revokeDeviceToken as Ut, validateCronStatusParams as V, removePairedDevice as Vt, validateDevicePairListParams as W, rotateDeviceToken as Wt, validateNodeDescribeParams as X, rejectPendingPairingRequest as Xt, validateLogsTailParams as Y, verifyPairingToken as Yt, validateNodeEventParams as Z, pruneExpiredPending as Zt, validateAgentsCreateParams as _, validateSessionsResolveParams as _t, randomIdempotencyKey as a, validateNodePairVerifyParams as at, validateAgentsFilesListParams as b, validateTalkModeParams as bt, READ_SCOPE as c, validatePushTestParams as ct, resolveLeastPrivilegeOperatorScopesForMethod as d, validateSessionsCompactParams as dt, roleScopesAllow as en, validateNodeListParams as et, GatewayClient as f, validateSessionsDeleteParams as ft, validateAgentWaitParams as g, validateSessionsResetParams as gt, validateAgentParams as h, validateSessionsPreviewParams as ht, ensureExplicitGatewayAuth as i, verifyDeviceSignature as in, validateNodePairRequestParams as it, validateConfigGetParams as j, ErrorCodes as jt, validateChatSendParams as k, validateWizardStatusParams as kt, authorizeOperatorScopesForMethod as l, validateRequestFrame as lt, validateAgentIdentityParams as m, validateSessionsPatchParams as mt, callGateway as n, deriveDeviceIdFromPublicKey as nn, validateNodePairListParams as nt, resolveExplicitGatewayAuth as o, validateNodeRenameParams as ot, formatValidationErrors as p, validateSessionsListParams as pt, validateDeviceTokenRevokeParams as q, verifyDeviceToken as qt, callGatewayLeastPrivilege as r, normalizeDevicePublicKeyBase64Url as rn, validateNodePairRejectParams as rt, ADMIN_SCOPE as s, validatePollParams as st, buildGatewayConnectionDetails as t, loadGatewayTlsRuntime as tn, validateNodePairApproveParams as tt, isNodeRoleMethod as u, validateSendParams as ut, validateAgentsDeleteParams as v, validateSessionsUsageParams as vt, validateChannelsLogoutParams as w, validateWebLoginStartParams as wt, validateAgentsFilesSetParams as x, validateToolsCatalogParams as xt, validateAgentsFilesGetParams as y, validateTalkConfigParams as yt, validateCronRunParams as z, listDevicePairing as zt };