@xopcai/xopc 0.0.210 → 0.0.213

package/dist/src/gateway/hono/routes/connectors.js

@@ -17,6 +17,7 @@ import { getConnectorInstance, listConnectorInstances } from "../../../connector
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
+import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { buildConnectedPeopleGraph } from "../../../knowledge/people-graph.js";
 import "../../../knowledge/index.js";
@@ -592,10 +593,13 @@ function registerConnectorRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.get("/api/connectors/composio/setup-status", async (c) => {
-		const configured = Boolean(await resolveComposioApiKey());
+		const status = Boolean(await resolveComposioApiKey()) ? {
+			configured: true,
+			mode: "byok"
+		} : await inspectManagedComposioStatus();
 		return c.json({
 			ok: true,
-			payload: { configured }
+			payload: status
 		});
 	});
 	authenticated.post("/api/connectors/composio/setup", strictRateLimitMiddleware, async (c) => {
@@ -605,7 +609,10 @@ function registerConnectorRoutes(authenticated, deps) {
 			await configureComposioApiKey(apiKey);
 			return c.json({
 				ok: true,
-				payload: { configured: true }
+				payload: {
+					configured: true,
+					mode: "byok"
+				}
 			});
 		} catch (error) {
 			return c.json({

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
     chatRateLimitMiddleware: MiddlewareHandler;
+    mediaRateLimitMiddleware?: MiddlewareHandler;
     taskRateLimitMiddleware?: MiddlewareHandler;
     xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;

package/dist/src/gateway/hono/routes/discussions.js

@@ -22,6 +22,7 @@ async function multipart(c) {
 }
 function registerDiscussionRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
+	const mediaRateLimitMiddleware = deps.mediaRateLimitMiddleware ?? deps.chatRateLimitMiddleware ?? strictRateLimitMiddleware;
 	authenticated.get("/api/discussion-capture/settings", (c) => c.json(service.discussions.settings()));
 	authenticated.put("/api/discussion-capture/settings", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
@@ -76,7 +77,7 @@ function registerDiscussionRoutes(authenticated, deps) {
 		const transcript = service.discussions.transcript(c.req.param("id"));
 		return transcript ? c.json(transcript) : c.json({ error: "Discussion not found" }, 404);
 	});
-	authenticated.put("/api/discussions/:id/segments/:sequence", strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/discussions/:id/segments/:sequence", mediaRateLimitMiddleware, async (c) => {
 		const body = await multipart(c);
 		if (!body) return c.json({ error: "Invalid multipart body" }, 400);
 		const file = body.file;

package/dist/src/gateway/hono/routes/exposure.js

@@ -1,6 +1,6 @@
-import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import { extractToken } from "../../auth.js";
 import { getExposureManager } from "../../../remote-access/exposure-manager.js";
+import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 //#region src/gateway/hono/routes/exposure.ts
 function requireGatewayToken(c) {
 	return extractToken({ authorization: c.req.header("authorization") ?? void 0 }) ?? null;

package/dist/src/gateway/hono/routes/home.d.ts

@@ -1,5 +1,5 @@
 import type { Hono } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
-export { buildHomeBriefing, buildHomeFocusItems } from '../../../tasks/home-query-service.js';
+export { buildHomeWorkbench, decisionFromTask } from '../../../tasks/home-query-service.js';
 /** Register the unified work-home read model and its decision actions. */
 export declare function registerHomeRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/home.js

@@ -2,7 +2,7 @@ import { acknowledgeHomeAttention } from "../../../storage/sqlite/home-attention
 import { decideConnectorApproval } from "../../../storage/sqlite/connector-repository.js";
 import "../../../storage/sqlite/index.js";
 import { listGatewayAgents } from "../../agents-admin.js";
-import { HomeQueryService, buildHomeBriefing, buildHomeFocusItems } from "../../../tasks/home-query-service.js";
+import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
 //#region src/gateway/hono/routes/home.ts
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {
@@ -90,4 +90,4 @@ function registerHomeRoutes(authenticated, deps) {
 	});
 }
 //#endregion
-export { buildHomeBriefing, buildHomeFocusItems, registerHomeRoutes };
+export { buildHomeWorkbench, decisionFromTask, registerHomeRoutes };

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -139,7 +139,8 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 		match: (path) => startsWithAny(path, [
 			"/api/models",
 			"/api/models-json",
-			"/api/providers"
+			"/api/providers",
+			"/api/capabilities/readiness"
 		]),
 		load: async () => {
 			const { registerModelsRoutes } = await import("./models.js");

package/dist/src/gateway/hono/routes/models.js

@@ -6,7 +6,9 @@ import { getModelRegistry } from "../../../providers/model-registry.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
-import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured } from "../../../providers/index.js";
+import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
+import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
+import "../../../capabilities/readiness/index.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
@@ -14,6 +16,7 @@ import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../.
 import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
 import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
+import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
 import { auditModelReferences } from "../../../providers/model-reference-auditor.js";
 import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
@@ -68,10 +71,61 @@ function registerModelsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
 	const catalogSync = service.getModelCatalogSync();
 	const xopcCloudAccount = new XopcCloudAccountService();
-	authenticated.get("/api/models/catalog/status", (c) => c.json({
-		ok: true,
-		payload: catalogSync.getStatus()
-	}));
+	authenticated.get("/api/models/catalog/status", (c) => {
+		const readiness = getXopcCloudCatalogCoordinator().snapshot();
+		return c.json({
+			ok: true,
+			payload: {
+				...catalogSync.getStatus(),
+				hydratedFromDisk: readiness.source === "disk",
+				stale: readiness.state === "stale",
+				fetchedAt: readiness.fetchedAt,
+				catalogVersion: readiness.catalogVersion,
+				lastRefreshError: readiness.error
+			}
+		});
+	});
+	authenticated.get("/api/capabilities/readiness", async (c) => {
+		const auth = await getProviderAuthState("xopc-cloud");
+		const catalog = getXopcCloudCatalogCoordinator().snapshot();
+		const authorized = auth.authStatus === "connected";
+		const capabilities = buildCapabilityPlansForConfig(service.currentConfig, { providerReady: (providerId) => providerId === "xopc-cloud" ? authorized : isProviderConfiguredSync(providerId) });
+		const issues = [
+			...auth.authStatus === "not_connected" ? [{
+				code: "oauth_not_connected",
+				capability: null
+			}] : [],
+			...auth.authStatus === "expired" ? [{
+				code: "oauth_expired_refresh_failed",
+				capability: null
+			}] : [],
+			...catalog.state === "unavailable" ? [{
+				code: "catalog_never_loaded",
+				capability: null
+			}] : [],
+			...catalog.state === "stale" ? [{
+				code: "catalog_stale",
+				capability: null
+			}] : [],
+			...Object.values(capabilities).filter((plan) => authorized && catalog.modelCount > 0 && plan.status === "unavailable").map((plan) => ({
+				code: "capability_not_published",
+				capability: plan.capability
+			}))
+		];
+		return c.json({
+			ok: true,
+			payload: {
+				provider: {
+					id: "xopc-cloud",
+					authorized,
+					authStatus: auth.authStatus,
+					catalog
+				},
+				capabilities,
+				issues
+			}
+		});
+	});
 	authenticated.get("/api/models/catalog", async (c) => {
 		const catalog = getModelCatalogStore().load();
 		const sessionConfigs = await new SessionConfigStore("").getAll();

package/dist/src/gateway/hono/routes/shares.js

@@ -8,8 +8,8 @@ import { resolveShareUrl, resolveSiteShareUrl } from "../../../share/share-url.j
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { audienceDefaults, cleanupStagedSite, decideShareKind, forgetStagedSite, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../../share/share-auto.js";
 import { deleteThumbnail, placeholderSvg, readThumbnail, scheduleThumbnail, thumbnailContentType, thumbnailExists } from "../../../share/share-thumbnail.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { extractToken } from "../../auth.js";
+import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage } from "../../../share/share-landing.js";
 import { consumeSharePublicLimit } from "../../../share/share-rate-limit.js";
 import { createZipStream, planDirectoryFiles } from "../../../share/share-zip.js";

package/dist/src/gateway/hono/routes/tunnel.js

@@ -2,18 +2,18 @@ import { init_public_url, validatePublicUrl } from "../../../config/public-url.j
 import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
 import { loadTunnelState } from "../../../tunnel/tunnel-state.js";
 import { resolveReverseProxyPublicUrl } from "../../public-url.js";
+import { extractToken } from "../../auth.js";
 import { TUNNEL_CONSENT_REQUIRED_CODE, TunnelConsentError, assertTunnelMayStart, getTunnelConsentState } from "../../../tunnel/consent.js";
 import { getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
-import { applyTunnelConsentToConfig, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
 import { createPairingSecret, exchangePairingSecretOnce, getCachedPairingExchange } from "../../../tunnel/pairing.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
 import { getTunnelService, hashGatewayToken } from "../../../tunnel/tunnel-service.js";
 import { configureTunnelFromGatewayConfig } from "../../../tunnel/gateway-lifecycle.js";
+import { applyTunnelConsentToConfig, setTunnelEnabledInConfig } from "../../../tunnel/tunnel-config.js";
 import { getClientIpFromHeaders } from "../../security/loopback.js";
+import { applyLanPairingGatewayPatch } from "../../../tunnel/enable-lan-pairing.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
-import { extractToken } from "../../auth.js";
-import { applyLanPairingGatewayPatch } from "../../../tunnel/enable-lan-pairing.js";
 import { buildMobileConnectUrlOrder, resolveMobilePairLanUrl, validateMobilePairBaseUrl } from "../../../tunnel/pair-url.js";
 import { buildMobilePairContext } from "../../../tunnel/pair-context.js";
 import { consumePairingExchangeFailLimit } from "../../../tunnel/pairing-rate-limit.js";

package/dist/src/gateway/hono/routes/understanding-sources.js

@@ -1,10 +1,13 @@
 import { deleteUnderstanding, listUnderstandingEvidence, listUnderstandings } from "../../../storage/sqlite/user-context-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import "../../../storage/sqlite/index.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { deleteUserFocus, getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUserFocuses, revokeUnderstandingSourceGrant, setUserFocusStatus } from "../../../user-context/sources/repository.js";
+import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { getWorkDiscoveryService } from "./work-discovery.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
 //#region src/gateway/hono/routes/understanding-sources.ts
+init_agent_scope();
 function stringField(body, field) {
 	if (!body || typeof body !== "object") return "";
 	const value = body[field];
@@ -39,6 +42,32 @@ function registerUnderstandingSourceRoutes(authenticated, deps) {
 		ok: true,
 		grants: listUnderstandingSourceGrants({ includeRevoked: c.req.query("includeRevoked") === "true" })
 	}));
+	authenticated.get("/api/understanding/sources/content-candidates", (c) => {
+		const agentId = resolveDefaultAgentId(deps.service.currentConfig);
+		return c.json({
+			ok: true,
+			candidates: listConnectedContentCandidates({ agentId })
+		});
+	});
+	authenticated.post("/api/understanding/sources/content-reads", limited, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const sourceItemIds = body && typeof body === "object" && Array.isArray(body.sourceItemIds) ? body.sourceItemIds.filter((value) => typeof value === "string") : [];
+		try {
+			const agentId = resolveDefaultAgentId(deps.service.currentConfig);
+			return c.json({
+				ok: true,
+				result: await readConnectedContent({
+					sourceItemIds,
+					agentId
+				})
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
 	authenticated.delete("/api/understanding/sources/grants/:grantId", limited, (c) => {
 		const current = getUnderstandingSourceGrant(c.req.param("grantId"));
 		const accountId = typeof current?.config.accountId === "string" ? current.config.accountId : void 0;

package/dist/src/gateway/hono/routes/voice.d.ts

@@ -1,6 +1,5 @@
 /**
- * Voice routes — POST /api/voice/transcriptions (multipart) and legacy
- * POST /api/voice/transcribe (JSON/base64).
+ * Voice routes — POST /api/voice/transcriptions (multipart).
  *
  * The endpoints share one execution path that:
  *   1. Runs the configured STT provider and fallback chain

package/dist/src/gateway/hono/routes/voice.js

@@ -6,7 +6,7 @@ import { speak } from "../../../voice/tts/speak-core.js";
 import { mergeTtsConfigFromAppConfig } from "../../../voice/tts/merge-config.js";
 import { getLocalVoiceRuntimeClient } from "../../../voice/local/runtime-client.js";
 import { resolveSttProviderConfigSlice } from "../../../voice/stt/config-slice.js";
-import { transcribe } from "../../../voice/stt/transcribe-core.js";
+import { STTTranscriptionError, transcribe } from "../../../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../../../voice/stt/availability.js";
 import { mergeSttConfigFromAppConfig } from "../../../voice/stt/config.js";
 import "../../../voice/stt/index.js";
@@ -497,6 +497,7 @@ function registerVoiceRoutes(authenticated, deps) {
 					...detectedLanguage ? { language: detectedLanguage } : {},
 					provider: result.provider,
 					attempts: result.attempts,
+					...result.duration !== void 0 ? { durationSeconds: result.duration } : {},
 					latencyMs: Date.now() - startedAt
 				}
 			});
@@ -507,9 +508,22 @@ function registerVoiceRoutes(authenticated, deps) {
 				mimeType: input.mimeType,
 				fileName: input.fileName
 			}, `Voice transcription failed: ${msg}`);
+			if (error instanceof STTTranscriptionError) {
+				const status = error.reasonCode === "unsupported_format" ? 415 : error.reasonCode === "timeout" ? 504 : 502;
+				return c.json({
+					ok: false,
+					error: {
+						code: error.reasonCode,
+						message: `Transcription failed: ${msg}`
+					}
+				}, status);
+			}
 			return c.json({
 				ok: false,
-				error: { message: `Transcription failed: ${msg}` }
+				error: {
+					code: "provider_error",
+					message: `Transcription failed: ${msg}`
+				}
 			}, 502);
 		}
 	};
@@ -544,39 +558,6 @@ function registerVoiceRoutes(authenticated, deps) {
 			...language ? { language } : {}
 		});
 	});
-	/** Legacy JSON/base64 endpoint retained for mobile and external clients. */
-	authenticated.post("/api/voice/transcribe", strictRateLimitMiddleware, async (c) => {
-		let body = {};
-		try {
-			body = await c.req.json();
-		} catch {
-			return c.json({
-				ok: false,
-				error: { message: "Invalid JSON body" }
-			}, 400);
-		}
-		if (typeof body.audio !== "string" || !body.audio.trim()) return c.json({
-			ok: false,
-			error: { message: "Missing required field: audio (base64)" }
-		}, 400);
-		if (typeof body.mimeType !== "string" || !body.mimeType.trim()) return c.json({
-			ok: false,
-			error: { message: "Missing required field: mimeType" }
-		}, 400);
-		const encoded = body.audio.replace(/\s/g, "");
-		if (encoded.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) return c.json({
-			ok: false,
-			error: { message: "Invalid base64 audio data" }
-		}, 400);
-		const language = typeof body.language === "string" && body.language.trim() ? body.language.trim() : void 0;
-		const fileName = typeof body.fileName === "string" && body.fileName.trim() ? body.fileName.trim() : `audio-${Date.now()}`;
-		return runTranscription(c, {
-			audioBuffer: Buffer.from(encoded, "base64"),
-			mimeType: body.mimeType.trim(),
-			fileName,
-			...language ? { language } : {}
-		});
-	});
 }
 //#endregion
 export { registerVoiceRoutes };

package/dist/src/gateway/hono/routes/workflows.js

@@ -10,10 +10,39 @@ import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-se
 import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
 import "../../../workflows/authoring/index.js";
 import "../../../workflows/draft/index.js";
+import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
 import { basename, join } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/workflows.ts
 init_agent_scope();
+const WORKFLOW_CONTEXT_KINDS = new Set([
+	"project",
+	"task",
+	"note",
+	"session",
+	"attachment",
+	"memory"
+]);
+function parseWorkflowContextRefs(value) {
+	if (value === void 0) return void 0;
+	if (!Array.isArray(value) || value.length > 50) throw new Error("contextRefs must be an array with at most 50 items");
+	return value.map((candidate) => {
+		if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) throw new Error("Invalid workflow context reference");
+		const ref = candidate;
+		const kind = typeof ref.kind === "string" ? ref.kind : "";
+		const id = typeof ref.id === "string" ? ref.id.trim() : "";
+		if (!WORKFLOW_CONTEXT_KINDS.has(kind) || !id || id.length > 512) throw new Error("Invalid workflow context reference");
+		const role = typeof ref.role === "string" ? ref.role.trim() : void 0;
+		const title = typeof ref.title === "string" ? ref.title.trim() : void 0;
+		if ((role?.length ?? 0) > 64 || (title?.length ?? 0) > 256) throw new Error("Invalid workflow context reference");
+		return {
+			kind,
+			id,
+			...role ? { role } : {},
+			...title ? { title } : {}
+		};
+	});
+}
 function registerWorkflowRoutes(authenticated, deps) {
 	const { service } = deps;
 	const workflowRunService = service.createWorkflowRunService();
@@ -38,6 +67,38 @@ function registerWorkflowRoutes(authenticated, deps) {
 			return c.json({ error: err instanceof Error ? err.message : "Workflow definition not found" }, 404);
 		}
 	});
+	authenticated.get("/api/workflows/project-presets", (c) => {
+		const projectId = c.req.query("projectId")?.trim();
+		if (!projectId) return c.json({ error: "projectId is required" }, 400);
+		if (!service.projects.get(projectId)) return c.json({ error: "Project not found" }, 404);
+		return c.json({ presets: new ProjectWorkflowPresetRepository().list(projectId) });
+	});
+	authenticated.put("/api/workflows/project-presets/:definitionId", async (c) => {
+		const definitionId = c.req.param("definitionId").trim();
+		const body = await readJsonBody(c.req.raw);
+		const projectId = body.projectId?.trim();
+		if (!projectId) return c.json({ error: "projectId is required" }, 400);
+		if (!service.projects.get(projectId)) return c.json({ error: "Project not found" }, 404);
+		try {
+			createWorkflowCatalog().load(definitionId);
+			const contextRefs = parseWorkflowContextRefs(body.contextRefs) ?? [];
+			if (contextRefs.some((ref) => ref.kind !== "task" && ref.kind !== "note")) return c.json({ error: "Project workflow presets support task and note context only" }, 400);
+			const preset = new ProjectWorkflowPresetRepository().save({
+				projectId,
+				definitionId,
+				contextRefs
+			});
+			return c.json({ preset });
+		} catch (cause) {
+			return c.json({ error: cause instanceof Error ? cause.message : "Could not save project workflow" }, 400);
+		}
+	});
+	authenticated.delete("/api/workflows/project-presets/:definitionId", (c) => {
+		const projectId = c.req.query("projectId")?.trim();
+		if (!projectId) return c.json({ error: "projectId is required" }, 400);
+		const removed = new ProjectWorkflowPresetRepository().remove(projectId, c.req.param("definitionId"));
+		return c.json({ removed });
+	});
 	authenticated.post("/api/workflows/definitions/validate", async (c) => {
 		const body = await readJsonBody(c.req.raw);
 		const result = validateWorkflowDefinitionInput({
@@ -206,6 +267,7 @@ function registerWorkflowRoutes(authenticated, deps) {
 		const catalog = createWorkflowCatalog();
 		try {
 			if (!catalog.remove(id)) return c.json({ error: "User workflow not found or cannot delete built-in workflow" }, 404);
+			new ProjectWorkflowPresetRepository().removeDefinition(id);
 			const drafts = new WorkflowDraftStore().list(id);
 			for (const draft of drafts) new WorkflowDraftStore().remove(draft.id);
 			return c.json({ removed: true });
@@ -228,6 +290,12 @@ function registerWorkflowRoutes(authenticated, deps) {
 		const taskRunId = body.taskRunId?.trim();
 		const projectId = body.projectId?.trim();
 		if (projectId && !service.projects.get(projectId)) return c.json({ error: "Project not found" }, 404);
+		let contextRefs;
+		try {
+			contextRefs = parseWorkflowContextRefs(body.contextRefs);
+		} catch (cause) {
+			return c.json({ error: cause instanceof Error ? cause.message : "Invalid workflow context references" }, 400);
+		}
 		const explicitAgentId = body.agentId ?? c.req.query("agentId");
 		const agentId = projectId ? resolveProjectAgentId({
 			config: service.currentConfig,
@@ -240,6 +308,7 @@ function registerWorkflowRoutes(authenticated, deps) {
 			definitionId,
 			taskRunId,
 			projectId,
+			contextRefs,
 			input: body.inputEnvelope ? void 0 : body.input,
 			inputEnvelope: body.inputEnvelope,
 			goal: body.goal,

package/dist/src/gateway/index.js

@@ -1,10 +1,10 @@
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
+import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
+import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
 import { buckets } from "./rate-limit/buckets.js";
 import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
 import "./rate-limit/index.js";
-import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
-import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -36,6 +36,7 @@ declare class BucketRegistry {
     private authFailureSignature?;
     private strictApiLimiter?;
     private chatApiLimiter?;
+    private mediaApiLimiter?;
     private taskApiLimiter?;
     private xopcCloudPollLimiter?;
     private channelApiLimiter?;
@@ -53,6 +54,8 @@ declare class BucketRegistry {
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;
+    /** Durable media chunk uploads — 300 req / 60 s per client IP. */
+    mediaApi(): RateLimiter;
     /** Interactive task and board mutations — 300 req / 60 s per client IP. */
     taskApi(): RateLimiter;
     /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -48,6 +48,7 @@ var BucketRegistry = class {
 	authFailureSignature;
 	strictApiLimiter;
 	chatApiLimiter;
+	mediaApiLimiter;
 	taskApiLimiter;
 	xopcCloudPollLimiter;
 	channelApiLimiter;
@@ -90,6 +91,14 @@ var BucketRegistry = class {
 		});
 		return this.chatApiLimiter;
 	}
+	/** Durable media chunk uploads — 300 req / 60 s per client IP. */
+	mediaApi() {
+		if (!this.mediaApiLimiter) this.mediaApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.mediaApiLimiter;
+	}
 	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
 	taskApi() {
 		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
@@ -151,6 +160,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
+		this.mediaApiLimiter?.destroy();
 		this.taskApiLimiter?.destroy();
 		this.xopcCloudPollLimiter?.destroy();
 		this.channelApiLimiter?.destroy();
@@ -161,6 +171,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
+		this.mediaApiLimiter = void 0;
 		this.taskApiLimiter = void 0;
 		this.xopcCloudPollLimiter = void 0;
 		this.channelApiLimiter = void 0;
@@ -175,6 +186,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.resetForTests();
 		this.strictApiLimiter?.resetForTests();
 		this.chatApiLimiter?.resetForTests();
+		this.mediaApiLimiter?.resetForTests();
 		this.taskApiLimiter?.resetForTests();
 		this.xopcCloudPollLimiter?.resetForTests();
 		this.channelApiLimiter?.resetForTests();

package/dist/src/gateway/runtime-config.js

@@ -1,8 +1,8 @@
 import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
-import "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import "./rate-limit/index.js";
 //#region src/gateway/runtime-config.ts
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;

package/dist/src/gateway/security/audit.js

@@ -1,10 +1,10 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
-import "../rate-limit/index.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../auth.js";
 import { resolveGatewayListenPlan } from "../listen.js";
 import { collectExposureConflicts, isRemoteGatewayInsecure, isTailnetBindUnavailable } from "../../remote-access/exposure-guards.js";
+import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "../rate-limit/env-flags.js";
+import "../rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "../runtime-config.js";
 //#region src/gateway/security/audit.ts
 init_logger();

package/dist/src/gateway/service/config-coordinator.js

@@ -4,12 +4,12 @@ import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
-import { sanitizeTunnelConfig } from "../../tunnel/tunnel-config.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";
 import "../../agent/mcp/bundle-mcp-tools.js";
 import { ConfigHotReloader } from "../../config/reload.js";
 import "../../config/index.js";
 import { computeBundledExtensionExtensionsPatch } from "../../extensions/bundled-extension-activation.js";
+import { sanitizeTunnelConfig } from "../../tunnel/tunnel-config.js";
 //#region src/gateway/service/config-coordinator.ts
 init_providers();
 init_logger();

package/dist/src/gateway/service/session-input-coordinator.js

@@ -90,12 +90,11 @@ var SessionInputCoordinator = class {
 					remaining: [...result.remainingMessages, replacement]
 				});
 			}
-			const state = this.publish(sessionKey);
 			this.drain(sessionKey);
 			return {
 				ok: true,
 				effectiveDelivery: "next",
-				state
+				state: this.publish(sessionKey)
 			};
 		});
 	}

package/dist/src/gateway/service.d.ts

@@ -67,6 +67,7 @@ export declare class GatewayService {
     private workflowRunServiceInstance;
     private taskRunDispatcher;
     private taskRunDispatchTimer;
+    private managedComposioEventPoller?;
     private mobileNotifications;
     private connectorSupervisor;
     private connectorLearningCoordinator;