@xopcai/xopc 0.0.210 → 0.0.211

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -70,6 +70,13 @@ function createChatRateLimitMiddleware(deps) {
 		reason: "chat_rate_limit_exceeded"
 	});
 }
+function createMediaRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.mediaApi(),
+		exceededMessage: "Media API rate limit exceeded",
+		reason: "media_rate_limit_exceeded"
+	});
+}
 function createTaskRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.taskApi(),
@@ -92,4 +99,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createMediaRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -7,8 +7,17 @@
  */
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
-import { type OAuthCredentials } from '../../auth/oauth/types.js';
-export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<void>;
+import type { Config } from '../../config/schema.js';
+import { type CapabilityId } from '../../capabilities/readiness/index.js';
+import type { CatalogReadiness } from '../../providers/xopc-cloud-catalog-coordinator.js';
+export interface OAuthCompletionReadiness {
+    authorized: true;
+    state: 'connected' | 'connected-degraded';
+    catalog: CatalogReadiness;
+    capabilities: Record<CapabilityId, 'ready' | 'unavailable' | 'disabled'>;
+}
+export declare function buildOAuthCompletionReadiness(config: Config, catalog: CatalogReadiness): OAuthCompletionReadiness;
+export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<CatalogReadiness | undefined>;
 export declare function normalizeDesktopOAuthReturnPath(value: unknown): string | undefined;
 export declare function resolveOAuthLoginMethodPreference(params: {
     requestedMethod?: unknown;
@@ -16,6 +25,3 @@ export declare function resolveOAuthLoginMethodPreference(params: {
     remote: boolean;
 }): string | undefined;
 export declare function createOAuthAsyncHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
-export declare function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined;
-export declare function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void;
-export declare function deleteOAuthCredentialsFromCache(provider: string): void;

package/dist/src/gateway/hono/oauth-async.js

@@ -4,6 +4,8 @@ import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/regi
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
+import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
+import "../../capabilities/readiness/index.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth-async.ts
 /**
@@ -17,10 +19,20 @@ init_registry();
 init_credentials();
 init_logger();
 const log = createLogger("OAuthAsync");
+function buildOAuthCompletionReadiness(config, catalog) {
+	const plans = buildCapabilityPlansForConfig(config);
+	const capabilities = Object.fromEntries(Object.entries(plans).map(([capability, plan]) => [capability, plan.status === "disabled" ? "disabled" : plan.status === "unavailable" ? "unavailable" : "ready"]));
+	return {
+		authorized: true,
+		state: Boolean(catalog.error) || Object.values(capabilities).some((status) => status === "unavailable") ? "connected-degraded" : "connected",
+		catalog,
+		capabilities
+	};
+}
 async function refreshModelCatalogAfterOAuth(provider, service) {
-	if (provider !== "xopc-cloud") return;
+	if (provider !== "xopc-cloud") return void 0;
 	try {
-		await service.getModelCatalogSync().refreshNow();
+		return await service.getModelCatalogSync().refreshNow();
 	} catch (err) {
 		const errorMessage = err instanceof Error ? err.message : String(err);
 		log.warn({
@@ -28,6 +40,16 @@ async function refreshModelCatalogAfterOAuth(provider, service) {
 			provider,
 			errorMessage
 		}, `OAuth completed, but the model catalog could not be refreshed: ${errorMessage}`);
+		return {
+			state: "unavailable",
+			source: "none",
+			modelCount: 0,
+			error: {
+				code: "refresh_failed",
+				message: errorMessage,
+				retryable: true
+			}
+		};
 	}
 }
 /** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */
@@ -172,6 +194,7 @@ function createOAuthAsyncHandler(service) {
 				verificationUri: session.verificationUri,
 				message: session.message,
 				error: session.error,
+				readiness: session.readiness,
 				expiresAt: session.expiresAt
 			}
 		});
@@ -301,13 +324,13 @@ async function runOAuthFlow(session, oauthProvider, service) {
 	};
 	try {
 		const credentials = await oauthProvider.login(callbacks);
-		setOAuthCredentialsToCache(session.provider, credentials);
 		await new CredentialResolver().saveOAuthCredentials(session.provider, credentials);
 		session.message = session.provider === "xopc-cloud" ? "OAuth login successful. Syncing available models..." : "OAuth login successful";
-		await refreshModelCatalogAfterOAuth(session.provider, service);
+		const catalog = await refreshModelCatalogAfterOAuth(session.provider, service);
+		if (catalog && session.provider === "xopc-cloud") session.readiness = buildOAuthCompletionReadiness(service.currentConfig, catalog);
 		session.status = "completed";
 		session.credentials = credentials;
-		session.message = "OAuth login successful";
+		session.message = session.readiness?.state === "connected-degraded" ? `OAuth login successful, but capability setup is degraded${catalog?.error ? `: ${catalog.error.message}` : ""}` : "OAuth login successful";
 		log.info({
 			sessionId: session.id,
 			provider: session.provider
@@ -331,15 +354,5 @@ async function runOAuthFlow(session, oauthProvider, service) {
 		session.manualCodeReject = void 0;
 	}
 }
-const oauthCredentialsCache = /* @__PURE__ */ new Map();
-function getOAuthCredentialsFromCache(provider) {
-	return oauthCredentialsCache.get(provider);
-}
-function setOAuthCredentialsToCache(provider, creds) {
-	oauthCredentialsCache.set(provider, creds);
-}
-function deleteOAuthCredentialsFromCache(provider) {
-	oauthCredentialsCache.delete(provider);
-}
 //#endregion
-export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };
+export { buildOAuthCompletionReadiness, createOAuthAsyncHandler, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference };

package/dist/src/gateway/hono/oauth.d.ts

@@ -5,6 +5,4 @@
  */
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
-/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */
-export declare function loadOAuthCredentialsToCache(_service: GatewayService): void;
-export declare function createOAuthHandler(_service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
+export declare function createOAuthHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;

package/dist/src/gateway/hono/oauth.js

@@ -1,6 +1,8 @@
 import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getProviderAuthState, init_providers, isProviderConfigured } from "../../providers/index.js";
+import { disconnectProvider } from "../../providers/provider-disconnect.js";
+import { buildOAuthCompletionReadiness, refreshModelCatalogAfterOAuth } from "./oauth-async.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth.ts
 /**
@@ -12,19 +14,7 @@ init_registry();
 init_credentials();
 init_providers();
 const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
-const oauthCredentialsCache = /* @__PURE__ */ new Map();
-function getOAuthCredentialsFromCache(provider) {
-	return oauthCredentialsCache.get(provider);
-}
-function setOAuthCredentialsToCache(provider, creds) {
-	oauthCredentialsCache.set(provider, creds);
-}
-function deleteOAuthCredentialsFromCache(provider) {
-	oauthCredentialsCache.delete(provider);
-}
-/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */
-function loadOAuthCredentialsToCache(_service) {}
-function createOAuthHandler(_service) {
+function createOAuthHandler(service) {
 	const oauth = new Hono();
 	/**
 	* POST /api/auth/oauth/start
@@ -73,21 +63,28 @@ function createOAuthHandler(_service) {
 					return prompt.options.find((option) => option.id === "browser")?.id ?? prompt.options[0]?.id;
 				}
 			});
-			setOAuthCredentialsToCache(provider, credentials);
 			await new CredentialResolver().saveOAuthCredentials(provider, credentials);
+			const catalog = await refreshModelCatalogAfterOAuth(provider, service);
+			const readiness = catalog ? buildOAuthCompletionReadiness(service.currentConfig, catalog) : void 0;
+			service.emit("provider.auth.changed", {
+				provider,
+				connected: true
+			});
 			return c.json({
 				ok: true,
 				payload: {
 					success: true,
 					provider,
-					message: "OAuth login successful",
+					message: readiness?.state === "connected-degraded" ? "OAuth login successful, but capability setup is degraded" : "OAuth login successful",
 					expires: credentials.expires,
 					authUrl: authResult?.url,
 					deviceCode: authResult?.deviceCode,
 					verificationUri: authResult?.verificationUri,
 					instructions: authResult?.instructions,
 					usesCallbackServer: oauthProvider.usesCallbackServer ?? false,
-					manualCodeRequested
+					manualCodeRequested,
+					catalog,
+					readiness
 				}
 			});
 		} catch (err) {
@@ -101,16 +98,15 @@ function createOAuthHandler(_service) {
 	*/
 	oauth.get("/:provider", async (c) => {
 		const provider = c.req.param("provider");
-		const credentials = getOAuthCredentialsFromCache(provider);
 		const authState = await getProviderAuthState(provider);
 		const configured = await isProviderConfigured(provider);
 		return c.json({
 			ok: true,
 			payload: {
-				configured: configured || !!credentials,
+				configured,
 				authMode: authState.authMode,
 				authStatus: authState.authStatus,
-				expiresAt: authState.expiresAt ?? credentials?.expires
+				expiresAt: authState.expiresAt
 			}
 		});
 	});
@@ -120,8 +116,12 @@ function createOAuthHandler(_service) {
 	*/
 	oauth.delete("/:provider", async (c) => {
 		const provider = c.req.param("provider");
-		deleteOAuthCredentialsFromCache(provider);
-		await new CredentialResolver().deleteProviderCredential(provider);
+		await disconnectProvider(provider);
+		service.emit("provider.auth.changed", {
+			provider,
+			connected: false
+		});
+		if (provider === "xopc-cloud") service.emit("model-catalog.updated", { modelCount: 0 });
 		return c.json({
 			ok: true,
 			payload: { disconnected: provider }
@@ -144,4 +144,4 @@ function createOAuthHandler(_service) {
 	return oauth;
 }
 //#endregion
-export { createOAuthHandler, loadOAuthCredentialsToCache };
+export { createOAuthHandler };

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -3,8 +3,8 @@ import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
-import { createOAuthHandler } from "../oauth.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
+import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
 import { relative, resolve } from "node:path";

package/dist/src/gateway/hono/routes/connectors.js

@@ -14,7 +14,6 @@ import { getConnectorDefinition, listConnectorCatalog } from "../../../connector
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, listConnectorInstances } from "../../../connectors/instances.js";
-import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
@@ -22,6 +21,7 @@ import { buildConnectedPeopleGraph } from "../../../knowledge/people-graph.js";
 import "../../../knowledge/index.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
+import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
 //#region src/gateway/hono/routes/connectors.ts

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
     chatRateLimitMiddleware: MiddlewareHandler;
+    mediaRateLimitMiddleware?: MiddlewareHandler;
     taskRateLimitMiddleware?: MiddlewareHandler;
     xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;

package/dist/src/gateway/hono/routes/discussions.js

@@ -22,6 +22,7 @@ async function multipart(c) {
 }
 function registerDiscussionRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
+	const mediaRateLimitMiddleware = deps.mediaRateLimitMiddleware ?? deps.chatRateLimitMiddleware ?? strictRateLimitMiddleware;
 	authenticated.get("/api/discussion-capture/settings", (c) => c.json(service.discussions.settings()));
 	authenticated.put("/api/discussion-capture/settings", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
@@ -76,7 +77,7 @@ function registerDiscussionRoutes(authenticated, deps) {
 		const transcript = service.discussions.transcript(c.req.param("id"));
 		return transcript ? c.json(transcript) : c.json({ error: "Discussion not found" }, 404);
 	});
-	authenticated.put("/api/discussions/:id/segments/:sequence", strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/discussions/:id/segments/:sequence", mediaRateLimitMiddleware, async (c) => {
 		const body = await multipart(c);
 		if (!body) return c.json({ error: "Invalid multipart body" }, 400);
 		const file = body.file;

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -139,7 +139,8 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 		match: (path) => startsWithAny(path, [
 			"/api/models",
 			"/api/models-json",
-			"/api/providers"
+			"/api/providers",
+			"/api/capabilities/readiness"
 		]),
 		load: async () => {
 			const { registerModelsRoutes } = await import("./models.js");

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,7 +1,7 @@
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
-import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
+import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(authenticated, deps) {

package/dist/src/gateway/hono/routes/models.js

@@ -6,7 +6,9 @@ import { getModelRegistry } from "../../../providers/model-registry.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
-import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured } from "../../../providers/index.js";
+import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
+import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
+import "../../../capabilities/readiness/index.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
@@ -14,6 +16,7 @@ import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../.
 import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
 import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
+import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
 import { auditModelReferences } from "../../../providers/model-reference-auditor.js";
 import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
@@ -68,10 +71,61 @@ function registerModelsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
 	const catalogSync = service.getModelCatalogSync();
 	const xopcCloudAccount = new XopcCloudAccountService();
-	authenticated.get("/api/models/catalog/status", (c) => c.json({
-		ok: true,
-		payload: catalogSync.getStatus()
-	}));
+	authenticated.get("/api/models/catalog/status", (c) => {
+		const readiness = getXopcCloudCatalogCoordinator().snapshot();
+		return c.json({
+			ok: true,
+			payload: {
+				...catalogSync.getStatus(),
+				hydratedFromDisk: readiness.source === "disk",
+				stale: readiness.state === "stale",
+				fetchedAt: readiness.fetchedAt,
+				catalogVersion: readiness.catalogVersion,
+				lastRefreshError: readiness.error
+			}
+		});
+	});
+	authenticated.get("/api/capabilities/readiness", async (c) => {
+		const auth = await getProviderAuthState("xopc-cloud");
+		const catalog = getXopcCloudCatalogCoordinator().snapshot();
+		const authorized = auth.authStatus === "connected";
+		const capabilities = buildCapabilityPlansForConfig(service.currentConfig, { providerReady: (providerId) => providerId === "xopc-cloud" ? authorized : isProviderConfiguredSync(providerId) });
+		const issues = [
+			...auth.authStatus === "not_connected" ? [{
+				code: "oauth_not_connected",
+				capability: null
+			}] : [],
+			...auth.authStatus === "expired" ? [{
+				code: "oauth_expired_refresh_failed",
+				capability: null
+			}] : [],
+			...catalog.state === "unavailable" ? [{
+				code: "catalog_never_loaded",
+				capability: null
+			}] : [],
+			...catalog.state === "stale" ? [{
+				code: "catalog_stale",
+				capability: null
+			}] : [],
+			...Object.values(capabilities).filter((plan) => authorized && catalog.modelCount > 0 && plan.status === "unavailable").map((plan) => ({
+				code: "capability_not_published",
+				capability: plan.capability
+			}))
+		];
+		return c.json({
+			ok: true,
+			payload: {
+				provider: {
+					id: "xopc-cloud",
+					authorized,
+					authStatus: auth.authStatus,
+					catalog
+				},
+				capabilities,
+				issues
+			}
+		});
+	});
 	authenticated.get("/api/models/catalog", async (c) => {
 		const catalog = getModelCatalogStore().load();
 		const sessionConfigs = await new SessionConfigStore("").getAll();

package/dist/src/gateway/hono/routes/understanding-sources.js

@@ -1,10 +1,13 @@
 import { deleteUnderstanding, listUnderstandingEvidence, listUnderstandings } from "../../../storage/sqlite/user-context-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import "../../../storage/sqlite/index.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { deleteUserFocus, getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUserFocuses, revokeUnderstandingSourceGrant, setUserFocusStatus } from "../../../user-context/sources/repository.js";
+import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { getWorkDiscoveryService } from "./work-discovery.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
 //#region src/gateway/hono/routes/understanding-sources.ts
+init_agent_scope();
 function stringField(body, field) {
 	if (!body || typeof body !== "object") return "";
 	const value = body[field];
@@ -39,6 +42,32 @@ function registerUnderstandingSourceRoutes(authenticated, deps) {
 		ok: true,
 		grants: listUnderstandingSourceGrants({ includeRevoked: c.req.query("includeRevoked") === "true" })
 	}));
+	authenticated.get("/api/understanding/sources/content-candidates", (c) => {
+		const agentId = resolveDefaultAgentId(deps.service.currentConfig);
+		return c.json({
+			ok: true,
+			candidates: listConnectedContentCandidates({ agentId })
+		});
+	});
+	authenticated.post("/api/understanding/sources/content-reads", limited, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const sourceItemIds = body && typeof body === "object" && Array.isArray(body.sourceItemIds) ? body.sourceItemIds.filter((value) => typeof value === "string") : [];
+		try {
+			const agentId = resolveDefaultAgentId(deps.service.currentConfig);
+			return c.json({
+				ok: true,
+				result: await readConnectedContent({
+					sourceItemIds,
+					agentId
+				})
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
 	authenticated.delete("/api/understanding/sources/grants/:grantId", limited, (c) => {
 		const current = getUnderstandingSourceGrant(c.req.param("grantId"));
 		const accountId = typeof current?.config.accountId === "string" ? current.config.accountId : void 0;

package/dist/src/gateway/hono/routes/voice.d.ts

@@ -1,6 +1,5 @@
 /**
- * Voice routes — POST /api/voice/transcriptions (multipart) and legacy
- * POST /api/voice/transcribe (JSON/base64).
+ * Voice routes — POST /api/voice/transcriptions (multipart).
  *
  * The endpoints share one execution path that:
  *   1. Runs the configured STT provider and fallback chain

package/dist/src/gateway/hono/routes/voice.js

@@ -6,7 +6,7 @@ import { speak } from "../../../voice/tts/speak-core.js";
 import { mergeTtsConfigFromAppConfig } from "../../../voice/tts/merge-config.js";
 import { getLocalVoiceRuntimeClient } from "../../../voice/local/runtime-client.js";
 import { resolveSttProviderConfigSlice } from "../../../voice/stt/config-slice.js";
-import { transcribe } from "../../../voice/stt/transcribe-core.js";
+import { STTTranscriptionError, transcribe } from "../../../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../../../voice/stt/availability.js";
 import { mergeSttConfigFromAppConfig } from "../../../voice/stt/config.js";
 import "../../../voice/stt/index.js";
@@ -497,6 +497,7 @@ function registerVoiceRoutes(authenticated, deps) {
 					...detectedLanguage ? { language: detectedLanguage } : {},
 					provider: result.provider,
 					attempts: result.attempts,
+					...result.duration !== void 0 ? { durationSeconds: result.duration } : {},
 					latencyMs: Date.now() - startedAt
 				}
 			});
@@ -507,9 +508,22 @@ function registerVoiceRoutes(authenticated, deps) {
 				mimeType: input.mimeType,
 				fileName: input.fileName
 			}, `Voice transcription failed: ${msg}`);
+			if (error instanceof STTTranscriptionError) {
+				const status = error.reasonCode === "unsupported_format" ? 415 : error.reasonCode === "timeout" ? 504 : 502;
+				return c.json({
+					ok: false,
+					error: {
+						code: error.reasonCode,
+						message: `Transcription failed: ${msg}`
+					}
+				}, status);
+			}
 			return c.json({
 				ok: false,
-				error: { message: `Transcription failed: ${msg}` }
+				error: {
+					code: "provider_error",
+					message: `Transcription failed: ${msg}`
+				}
 			}, 502);
 		}
 	};
@@ -544,39 +558,6 @@ function registerVoiceRoutes(authenticated, deps) {
 			...language ? { language } : {}
 		});
 	});
-	/** Legacy JSON/base64 endpoint retained for mobile and external clients. */
-	authenticated.post("/api/voice/transcribe", strictRateLimitMiddleware, async (c) => {
-		let body = {};
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({
-				ok: false,
-				error: { message: "Invalid JSON body" }
-			}, 400);
-		}
-		if (typeof body.audio !== "string" || !body.audio.trim()) return c.json({
-			ok: false,
-			error: { message: "Missing required field: audio (base64)" }
-		}, 400);
-		if (typeof body.mimeType !== "string" || !body.mimeType.trim()) return c.json({
-			ok: false,
-			error: { message: "Missing required field: mimeType" }
-		}, 400);
-		const encoded = body.audio.replace(/\s/g, "");
-		if (encoded.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) return c.json({
-			ok: false,
-			error: { message: "Invalid base64 audio data" }
-		}, 400);
-		const language = typeof body.language === "string" && body.language.trim() ? body.language.trim() : void 0;
-		const fileName = typeof body.fileName === "string" && body.fileName.trim() ? body.fileName.trim() : `audio-${Date.now()}`;
-		return runTranscription(c, {
-			audioBuffer: Buffer.from(encoded, "base64"),
-			mimeType: body.mimeType.trim(),
-			fileName,
-			...language ? { language } : {}
-		});
-	});
 }
 //#endregion
 export { registerVoiceRoutes };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -36,6 +36,7 @@ declare class BucketRegistry {
     private authFailureSignature?;
     private strictApiLimiter?;
     private chatApiLimiter?;
+    private mediaApiLimiter?;
     private taskApiLimiter?;
     private xopcCloudPollLimiter?;
     private channelApiLimiter?;
@@ -53,6 +54,8 @@ declare class BucketRegistry {
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;
+    /** Durable media chunk uploads — 300 req / 60 s per client IP. */
+    mediaApi(): RateLimiter;
     /** Interactive task and board mutations — 300 req / 60 s per client IP. */
     taskApi(): RateLimiter;
     /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -48,6 +48,7 @@ var BucketRegistry = class {
 	authFailureSignature;
 	strictApiLimiter;
 	chatApiLimiter;
+	mediaApiLimiter;
 	taskApiLimiter;
 	xopcCloudPollLimiter;
 	channelApiLimiter;
@@ -90,6 +91,14 @@ var BucketRegistry = class {
 		});
 		return this.chatApiLimiter;
 	}
+	/** Durable media chunk uploads — 300 req / 60 s per client IP. */
+	mediaApi() {
+		if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.mediaApiLimiter;
+	}
 	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
 	taskApi() {
 		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
@@ -151,6 +160,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
+		this.mediaApiLimiter?.destroy();
 		this.taskApiLimiter?.destroy();
 		this.xopcCloudPollLimiter?.destroy();
 		this.channelApiLimiter?.destroy();
@@ -161,6 +171,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
+		this.mediaApiLimiter = void 0;
 		this.taskApiLimiter = void 0;
 		this.xopcCloudPollLimiter = void 0;
 		this.channelApiLimiter = void 0;
@@ -175,6 +186,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.resetForTests();
 		this.strictApiLimiter?.resetForTests();
 		this.chatApiLimiter?.resetForTests();
+		this.mediaApiLimiter?.resetForTests();
 		this.taskApiLimiter?.resetForTests();
 		this.xopcCloudPollLimiter?.resetForTests();
 		this.channelApiLimiter?.resetForTests();

package/dist/src/gateway/service/session-input-coordinator.js

@@ -90,12 +90,11 @@ var SessionInputCoordinator = class {
 					remaining: [...result.remainingMessages, replacement]
 				});
 			}
-			const state = this.publish(sessionKey);
 			this.drain(sessionKey);
 			return {
 				ok: true,
 				effectiveDelivery: "next",
-				state
+				state: this.publish(sessionKey)
 			};
 		});
 	}