@xopcai/xopc 0.0.215 → 0.0.218

package/dist/src/connectors/learning-coordinator.js

@@ -14,11 +14,14 @@ import { createUnderstandingSourceRun, listUnderstandingSourceRuns, updateUnders
 import { ConnectedUnderstandingPipeline } from "../knowledge/connected-understanding-pipeline.js";
 import "../knowledge/index.js";
 import { ingestComposioConnectedSource } from "./connected-source-ingestion.js";
+import { deriveConnectedSourceUnderstanding } from "./connected-source-understanding.js";
+import { listConnectedContentCandidates, readConnectedContent } from "./content-enrichment.js";
 //#region src/connectors/learning-coordinator.ts
 init_logger();
 const log = createLogger("ConnectorLearning");
 const CONNECTED_ACCOUNT_UNAVAILABLE = "connected_account_unavailable";
 const CONNECTED_SOURCE_SYNC_FAILED = "connected_source_sync_failed";
+const CONNECTED_SOURCE_ANALYSIS_FAILED = "connected_source_analysis_failed";
 function learningFailureCode(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	return message.includes("ToolRouterV2_InvalidConnectedAccountIds") || message.includes("Could not find connected account(s)") || message.includes("missing its provider identity") ? CONNECTED_ACCOUNT_UNAVAILABLE : CONNECTED_SOURCE_SYNC_FAILED;
@@ -178,6 +181,22 @@ function startConnectorLearningCoordinator(options) {
 			itemsSeen += synced.itemsSeen;
 			itemsIndexed += synced.itemsIndexed;
 		}
+		const enrichmentErrors = [];
+		if (plan.toolkit === "googledrive") {
+			const candidates = listConnectedContentCandidates({
+				agentId: job.agentId,
+				sourceInstanceId: job.sourceInstanceId,
+				limit: 5
+			});
+			if (candidates.length) {
+				const enriched = await readConnectedContent({
+					agentId: job.agentId,
+					sourceItemIds: candidates.map((candidate) => candidate.sourceItemId)
+				});
+				enrichmentErrors.push(...enriched.failed.map((failure) => failure.error));
+				itemsIndexed += enriched.completed;
+			}
+		}
 		if (listConnectorLearningJobs({
 			accountId: job.accountId,
 			limit: 100
@@ -199,22 +218,54 @@ function startConnectorLearningCoordinator(options) {
 			evidenceRefs: [`connector-account:${job.accountId}`],
 			sourceRunId: sourceRun.id
 		});
+		let semantic = {
+			created: 0,
+			focusCount: 0,
+			status: "completed"
+		};
+		try {
+			semantic = await deriveConnectedSourceUnderstanding({
+				config: options.getConfig(),
+				agentId: job.agentId,
+				sourceInstanceId: job.sourceInstanceId,
+				sourceRunId: sourceRun.id,
+				memoryManager: options.getMemoryManager()
+			});
+		} catch (error) {
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			semantic = {
+				created: 0,
+				focusCount: 0,
+				status: "failed",
+				error: CONNECTED_SOURCE_ANALYSIS_FAILED
+			};
+			log.warn({
+				err: error,
+				jobId: job.id,
+				connectorId: job.connectorId
+			}, `Connected source semantic analysis failed: ${errorMessage}`);
+		}
+		const candidatesCreated = understanding.created + semantic.created + semantic.focusCount;
+		const incomplete = enrichmentErrors.length > 0 || semantic.status !== "completed";
 		const completed = updateConnectorLearningJob(job.id, {
 			status: "completed",
 			phase: "completed",
-			candidatesCreated: understanding.created,
+			candidatesCreated,
 			nextRunAt: null,
 			finished: true
 		});
 		updateUnderstandingSourceRun(sourceRun.id, {
-			status: "completed",
+			status: incomplete ? "partial" : "completed",
 			itemsSeen,
 			cursorAfter: (/* @__PURE__ */ new Date()).toISOString(),
 			completed: true,
 			metadata: {
 				...sourceRun.metadata,
 				itemsIndexed,
-				candidatesCreated: understanding.created
+				candidatesCreated,
+				semanticStatus: semantic.status,
+				...semantic.error ? { semanticError: semantic.error } : {},
+				...enrichmentErrors.length ? { enrichmentFailureCount: enrichmentErrors.length } : {}
 			}
 		});
 		updateUnderstandingSourceGrantCheckpoint(sourceRun.grantId, {
@@ -258,7 +309,7 @@ function startConnectorLearningCoordinator(options) {
 					const definition = getConnectorDefinition(job.connectorId);
 					if (definition?.runtime.type === "composio" && definition.runtime.role === "toolkit") updateUnderstandingSourceRun(ensureUnderstandingSourceRun(job, definition.runtime.toolkit, definition.displayName).id, {
 						status: "failed",
-						errorMessage,
+						errorMessage: learningFailureCode(err),
 						completed: true
 					});
 					log.warn({

package/dist/src/connectors/learning-recipes.js

@@ -43,8 +43,8 @@ const PLANS = {
 			actionId: "GMAIL_FETCH_EMAILS",
 			kind: "activity",
 			arguments: {
-				max_results: 100,
-				include_payload: false,
+				max_results: 30,
+				include_payload: true,
 				verbose: false,
 				query: "newer_than:30d -in:spam -in:trash"
 			}

package/dist/src/document-understanding/extract.d.ts

@@ -1,7 +1,7 @@
 export type DocumentExtractionResult = {
     ok: true;
     text: string;
-    kind: 'plain' | 'pdf';
+    kind: 'plain' | 'pdf' | 'office';
 } | {
     ok: false;
     reason: string;

package/dist/src/document-understanding/extract.js

@@ -1,6 +1,9 @@
 import { extname } from "node:path";
+import AdmZip from "adm-zip";
 //#region src/document-understanding/extract.ts
 const MAX_EXTRACTED_CHARS = 6e4;
+const MAX_OFFICE_XML_BYTES = 8 * 1024 * 1024;
+const MAX_OFFICE_TOTAL_XML_BYTES = 16 * 1024 * 1024;
 function truncate(text) {
 	return text.length > MAX_EXTRACTED_CHARS ? `${text.slice(0, MAX_EXTRACTED_CHARS)}\n\n[document extraction truncated ${text.length - MAX_EXTRACTED_CHARS} chars]` : text;
 }
@@ -43,11 +46,61 @@ function extractPdfText(buffer) {
 		text: truncate(text)
 	};
 }
+function decodeXmlText(value) {
+	return value.replaceAll("&amp;", "&").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'");
+}
+function officeXmlText(buffer, extension) {
+	let zip;
+	try {
+		zip = new AdmZip(buffer);
+	} catch {
+		return {
+			ok: false,
+			reason: "Office document archive is invalid."
+		};
+	}
+	const prefixes = extension === ".docx" ? ["word/document.xml"] : extension === ".pptx" ? ["ppt/slides/"] : ["xl/sharedStrings.xml", "xl/worksheets/"];
+	const entries = zip.getEntries().filter((entry) => !entry.isDirectory && entry.header.size <= MAX_OFFICE_XML_BYTES && prefixes.some((prefix) => entry.entryName.startsWith(prefix))).sort((left, right) => left.entryName.localeCompare(right.entryName));
+	const parts = [];
+	let extractedBytes = 0;
+	for (const entry of entries) {
+		if (extractedBytes + entry.header.size > MAX_OFFICE_TOTAL_XML_BYTES) break;
+		extractedBytes += entry.header.size;
+		const xml = entry.getData().toString("utf8");
+		for (const match of xml.matchAll(/<(?:w:t|a:t|t)(?:\s[^>]*)?>([\s\S]*?)<\/(?:w:t|a:t|t)>/g)) {
+			const text = decodeXmlText((match[1] ?? "").replace(/<[^>]+>/g, "")).trim();
+			if (text) parts.push(text);
+		}
+	}
+	const text = parts.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+	return text ? {
+		ok: true,
+		kind: "office",
+		text: truncate(text)
+	} : {
+		ok: false,
+		reason: "Office document extraction found no readable text."
+	};
+}
 function extractDocumentText(params) {
 	const ext = extname(params.fileName).toLowerCase();
 	const mime = params.mimeType?.toLowerCase() ?? "";
 	if (mime === "application/pdf" || ext === ".pdf") return extractPdfText(params.buffer);
-	if (mime.startsWith("text/")) return {
+	if ([
+		".docx",
+		".pptx",
+		".xlsx"
+	].includes(ext)) return officeXmlText(params.buffer, ext);
+	if (mime.startsWith("text/") || [
+		".csv",
+		".html",
+		".json",
+		".md",
+		".rtf",
+		".tsv",
+		".txt",
+		".xml"
+	].includes(ext)) return {
 		ok: true,
 		kind: "plain",
 		text: truncate(params.buffer.toString("utf8"))

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/gateway/agents-admin.js

@@ -1,7 +1,7 @@
-import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
 import { resolveCapabilityPresetLayer, resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,9 +1,9 @@
 import { ContextCompactionPolicySchema, UserContextDreamingSchema, UserContextPrivacySchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/lib/static-ui.js

@@ -29,6 +29,7 @@ const MIME_TYPES = {
 	jpeg: "image/jpeg",
 	webp: "image/webp",
 	ico: "image/x-icon",
+	webmanifest: "application/manifest+json",
 	woff: "font/woff",
 	woff2: "font/woff2",
 	txt: "text/plain; charset=utf-8"

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -15,6 +15,10 @@ export interface OAuthCompletionReadiness {
     state: 'connected' | 'connected-degraded';
     catalog: CatalogReadiness;
     capabilities: Record<CapabilityId, 'ready' | 'unavailable' | 'disabled'>;
+    configuration?: {
+        applied: boolean;
+        error?: string;
+    };
 }
 export declare function buildOAuthCompletionReadiness(config: Config, catalog: CatalogReadiness): OAuthCompletionReadiness;
 export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<CatalogReadiness | undefined>;

package/dist/src/gateway/hono/oauth-async.js

@@ -6,6 +6,7 @@ import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";
+import { applyXopcCloudCapabilitySetup } from "../xopc-cloud-capability-setup.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth-async.ts
 /**
@@ -327,7 +328,29 @@ async function runOAuthFlow(session, oauthProvider, service) {
 		await new CredentialResolver().saveOAuthCredentials(session.provider, credentials);
 		session.message = session.provider === "xopc-cloud" ? "OAuth login successful. Syncing available models..." : "OAuth login successful";
 		const catalog = await refreshModelCatalogAfterOAuth(session.provider, service);
-		if (catalog && session.provider === "xopc-cloud") session.readiness = buildOAuthCompletionReadiness(service.currentConfig, catalog);
+		if (catalog && session.provider === "xopc-cloud") {
+			const setup = await applyXopcCloudCapabilitySetup(service);
+			const readiness = buildOAuthCompletionReadiness(service.currentConfig, catalog);
+			if (setup.configured === true) session.readiness = {
+				...readiness,
+				configuration: { applied: true }
+			};
+			else {
+				log.warn({
+					provider: session.provider,
+					errorMessage: setup.error,
+					missing: setup.missing
+				}, `OAuth completed, but XOPC Cloud capabilities could not be configured: ${setup.error}`);
+				session.readiness = {
+					...readiness,
+					state: "connected-degraded",
+					configuration: {
+						applied: false,
+						error: setup.error
+					}
+				};
+			}
+		}
 		session.status = "completed";
 		session.credentials = credentials;
 		session.message = session.readiness?.state === "connected-degraded" ? `OAuth login successful, but capability setup is degraded${catalog?.error ? `: ${catalog.error.message}` : ""}` : "OAuth login successful";

package/dist/src/gateway/hono/oauth.js

@@ -2,6 +2,7 @@ import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/regi
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getProviderAuthState, init_providers, isProviderConfigured } from "../../providers/index.js";
 import { disconnectProvider } from "../../providers/provider-disconnect.js";
+import { applyXopcCloudCapabilitySetup } from "../xopc-cloud-capability-setup.js";
 import { buildOAuthCompletionReadiness, refreshModelCatalogAfterOAuth } from "./oauth-async.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth.ts
@@ -65,7 +66,19 @@ function createOAuthHandler(service) {
 			});
 			await new CredentialResolver().saveOAuthCredentials(provider, credentials);
 			const catalog = await refreshModelCatalogAfterOAuth(provider, service);
-			const readiness = catalog ? buildOAuthCompletionReadiness(service.currentConfig, catalog) : void 0;
+			let capabilitySetup;
+			if (catalog && provider === "xopc-cloud") capabilitySetup = await applyXopcCloudCapabilitySetup(service);
+			const baseReadiness = catalog ? buildOAuthCompletionReadiness(service.currentConfig, catalog) : void 0;
+			const readiness = baseReadiness && capabilitySetup ? {
+				...baseReadiness,
+				...capabilitySetup.configured === true ? { configuration: { applied: true } } : {
+					state: "connected-degraded",
+					configuration: {
+						applied: false,
+						error: capabilitySetup.error
+					}
+				}
+			} : baseReadiness;
 			service.emit("provider.auth.changed", {
 				provider,
 				connected: true

package/dist/src/gateway/hono/routes/config.js

@@ -1,4 +1,5 @@
 import { enumerateLanGatewayCandidates } from "../../host.js";
+import { prepareLocalVoiceModelAfterProviderSwitch } from "../../../voice/local/provider-switch.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyAgentsPatch } from "./config-patch/agents.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
@@ -51,6 +52,7 @@ function registerConfigRoutes(authenticated, deps) {
 	authenticated.patch("/api/config", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json();
 		const config = service.currentConfig;
+		const previousSttProvider = config.tools?.media?.audio?.provider;
 		applyAgentsPatch(config, body);
 		applyChannelsPatch(config, body);
 		const gatewayResult = applyGatewayPatch(config, body);
@@ -73,6 +75,7 @@ function registerConfigRoutes(authenticated, deps) {
 			ok: false,
 			error: result.error
 		}, 500);
+		prepareLocalVoiceModelAfterProviderSwitch(previousSttProvider, service.currentConfig);
 		if (body.gateway?.heartbeat !== void 0 && typeof body.gateway.heartbeat === "object") service.reloadHeartbeatFromCurrentConfig();
 		const safeConfig = await buildSafeWebConfigPayload(service, { locale: localeFromRequest(c) });
 		return c.json({

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";

package/dist/src/gateway/hono/routes/public-gateway.js

@@ -7,6 +7,17 @@ import { serveStaticFile } from "../lib/static-ui.js";
 import { createHash } from "node:crypto";
 //#region src/gateway/hono/routes/public-gateway.ts
 init_package_version();
+const PUBLIC_UI_ROOT_ASSETS = [
+	"apple-touch-icon.png",
+	"favicon-16x16.png",
+	"favicon-32x32.png",
+	"favicon.png",
+	"favicon.svg",
+	"notification-sw.js",
+	"pwa-192x192.png",
+	"pwa-512x512.png",
+	"site.webmanifest"
+];
 function registerPublicGatewayRoutes(app, service) {
 	app.get("/health", (c) => {
 		return c.json(service.getHealth());
@@ -171,6 +182,11 @@ function registerPublicGatewayRoutes(app, service) {
 		if (fallback) return fallback;
 		return c.text("Not found", 404);
 	});
+	for (const assetPath of PUBLIC_UI_ROOT_ASSETS) app.get(`/${assetPath}`, (c) => {
+		const response = serveStaticFile(assetPath, c.req.raw);
+		if (response) return response;
+		return c.text("Not found", 404);
+	});
 	app.get("/logo.svg", (c) => {
 		const response = serveStaticFile("logo.svg", c.req.raw);
 		if (response) return response;

package/dist/src/gateway/hono/routes/understanding-sources.js

@@ -2,7 +2,7 @@ import { deleteUnderstanding, listUnderstandingEvidence, listUnderstandings } fr
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { deleteUserFocus, getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUserFocuses, revokeUnderstandingSourceGrant, setUserFocusStatus } from "../../../user-context/sources/repository.js";
+import { deleteUserFocus, getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUnderstandingSourceRuns, listUserFocuses, revokeUnderstandingSourceGrant, setUserFocusStatus } from "../../../user-context/sources/repository.js";
 import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { getWorkDiscoveryService } from "./work-discovery.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
@@ -38,10 +38,17 @@ function registerUnderstandingSourceRoutes(authenticated, deps) {
 			sources: listUnderstandingSourceDefinitions(platform)
 		});
 	});
-	authenticated.get("/api/understanding/sources/grants", (c) => c.json({
-		ok: true,
-		grants: listUnderstandingSourceGrants({ includeRevoked: c.req.query("includeRevoked") === "true" })
-	}));
+	authenticated.get("/api/understanding/sources/grants", (c) => {
+		const grants = listUnderstandingSourceGrants({ includeRevoked: c.req.query("includeRevoked") === "true" });
+		return c.json({
+			ok: true,
+			grants,
+			latestRuns: Object.fromEntries(grants.flatMap((grant) => {
+				const run = listUnderstandingSourceRuns(grant.id, 1)[0];
+				return run ? [[grant.id, run]] : [];
+			}))
+		});
+	});
 	authenticated.get("/api/understanding/sources/content-candidates", (c) => {
 		const agentId = resolveDefaultAgentId(deps.service.currentConfig);
 		return c.json({
@@ -71,14 +78,25 @@ function registerUnderstandingSourceRoutes(authenticated, deps) {
 	authenticated.delete("/api/understanding/sources/grants/:grantId", limited, (c) => {
 		const current = getUnderstandingSourceGrant(c.req.param("grantId"));
 		const accountId = typeof current?.config.accountId === "string" ? current.config.accountId : void 0;
+		const connectorId = typeof current?.config.connectorId === "string" ? current.config.connectorId : void 0;
+		const sourceInstanceId = accountId && connectorId ? `composio:${connectorId}:${accountId}` : void 0;
 		const connectionId = accountId ? getConnectorAccount(accountId)?.currentConnectionId : void 0;
 		if (connectionId) deps.service.setConnectorLearningPaused(connectionId, true);
 		const grant = revokeUnderstandingSourceGrant(c.req.param("grantId"));
 		if (grant && c.req.query("deleteDerived") === "true") {
 			const activeGrantIds = new Set(listUnderstandingSourceGrants().map((item) => item.id));
+			const activeSourceInstanceIds = new Set(listUnderstandingSourceGrants().flatMap((item) => {
+				const activeAccountId = typeof item.config.accountId === "string" ? item.config.accountId : void 0;
+				const activeConnectorId = typeof item.config.connectorId === "string" ? item.config.connectorId : void 0;
+				return activeAccountId && activeConnectorId ? [`composio:${activeConnectorId}:${activeAccountId}`] : [];
+			}));
 			for (const understanding of listUnderstandings()) {
-				const grantEvidence = listUnderstandingEvidence(understanding.id).map((evidence) => /^understanding-source-grant:([^:]+):/.exec(evidence.sourceRef)?.[1]).filter((id) => Boolean(id));
-				if (grantEvidence.includes(grant.id) && !grantEvidence.some((id) => id !== grant.id && activeGrantIds.has(id))) deleteUnderstanding(understanding.id);
+				const evidence = listUnderstandingEvidence(understanding.id);
+				const grantEvidence = evidence.map((evidence) => /^understanding-source-grant:([^:]+):/.exec(evidence.sourceRef)?.[1]).filter((id) => Boolean(id));
+				const connectorEvidence = evidence.map((item) => item.sourceInstanceId).filter((id) => Boolean(id));
+				const belongsToRevokedSource = grantEvidence.includes(grant.id) || Boolean(sourceInstanceId && connectorEvidence.includes(sourceInstanceId));
+				const hasActiveAlternative = grantEvidence.some((id) => id !== grant.id && activeGrantIds.has(id)) || connectorEvidence.some((id) => id !== sourceInstanceId && activeSourceInstanceIds.has(id));
+				if (belongsToRevokedSource && !hasActiveAlternative) deleteUnderstanding(understanding.id);
 			}
 		}
 		return grant ? c.json({

package/dist/src/gateway/hono/routes/voice.js

@@ -12,8 +12,8 @@ import { mergeSttConfigFromAppConfig } from "../../../voice/stt/config.js";
 import "../../../voice/stt/index.js";
 import { listSttProvidersForApi } from "../../../voice/stt/list-providers.js";
 import "../../../voice/tts/index.js";
-import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
+import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
 //#region src/gateway/hono/routes/voice.ts
 init_providers();

package/dist/src/gateway/hono/routes/workflows.js

@@ -7,10 +7,10 @@ import { messagesToClientHistory } from "../../../session/client-history.js";
 import "../../../workflows/domain/index.js";
 import { resolveWorkflowRunArtifactsDir } from "../../../workflows/store/paths.js";
 import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
-import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
-import "../../../workflows/authoring/index.js";
 import "../../../workflows/draft/index.js";
 import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
+import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
+import "../../../workflows/authoring/index.js";
 import { basename, join } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/workflows.ts

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -50,7 +50,7 @@ declare class BucketRegistry {
      * config read.
      */
     authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter;
-    /** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */
+    /** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;

package/dist/src/gateway/rate-limit/buckets.js

@@ -75,10 +75,10 @@ var BucketRegistry = class {
 		}
 		return this.authFailureLimiter;
 	}
-	/** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */
+	/** Authenticated admin / mutation endpoints — 150 req / 60 s per client IP. */
 	strictApi() {
 		if (!this.strictApiLimiter) this.strictApiLimiter = new RateLimiter({
-			maxRequests: 15,
+			maxRequests: 150,
 			windowMs: 6e4
 		});
 		return this.strictApiLimiter;

package/dist/src/gateway/service/config-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
+import { loadConfig, saveConfig } from "../../config/loader.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";

package/dist/src/gateway/service.js

@@ -9,14 +9,14 @@ import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connectio
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../agent/agent-scope.js";
-import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentDir, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
+import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_providers, providers_exports } from "../providers/index.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
@@ -50,18 +50,18 @@ import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
-import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
-import "../knowledge/index.js";
-import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
-import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
 import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
 import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
+import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
+import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
+import "../knowledge/index.js";
+import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
+import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
+import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -116,7 +116,7 @@ import { GatewayAgentRunner } from "./service/agent-runner.js";
 import { RealtimeRuntime } from "../realtime/runtime.js";
 import { GatewayReadiness } from "./startup-readiness.js";
 import { createGatewayStartupTrace } from "./startup-trace.js";
-import { applyAutomaticVoiceLanguage, inferProductLanguageFromEnvironment, initializeVoiceDefaults, prepareConfiguredLocalVoiceModel } from "../voice/language-profile.js";
+import { applyAutomaticVoiceLanguage, inferProductLanguageFromEnvironment, initializeVoiceDefaults } from "../voice/language-profile.js";
 import crypto from "crypto";
 //#region src/gateway/service.ts
 init_agent_scope();
@@ -793,7 +793,6 @@ var GatewayService = class {
 		this.proactiveWorker.start();
 		this.proactiveTemporalWorker.start();
 		this.proactiveInboxWorker.start();
-		prepareConfiguredLocalVoiceModel(this.config);
 		this.startupTrace = createGatewayStartupTrace();
 		this.readiness.markStarting(this.startTime);
 		const trace = this.startupTrace;
@@ -1268,7 +1267,6 @@ var GatewayService = class {
 				error: saved.error ?? "Failed to save voice language"
 			};
 		}
-		prepareConfiguredLocalVoiceModel(this.config);
 		return {
 			applied: changed,
 			language,

package/dist/src/gateway/xopc-cloud-capability-setup.d.ts

@@ -0,0 +1,41 @@
+import type { Config } from '../config/schema.js';
+import type { CatalogSource } from '../providers/model-catalog-store.js';
+type CloudCapability = 'vision' | 'image-generation' | 'stt' | 'tts';
+export interface XopcCloudCapabilitySelection {
+    vision: string;
+    imageGeneration: string;
+    stt: string;
+    tts: string;
+    ttsVoice: string;
+}
+export type PrepareXopcCloudCapabilitySetupResult = {
+    ok: true;
+    config: Config;
+    selection: XopcCloudCapabilitySelection;
+} | {
+    ok: false;
+    error: string;
+    missing: CloudCapability[];
+};
+export type ApplyXopcCloudCapabilitySetupResult = {
+    configured: true;
+    selection: XopcCloudCapabilitySelection;
+} | {
+    configured: false;
+    error: string;
+    missing?: CloudCapability[];
+};
+export declare function selectXopcCloudCapabilities(source: CatalogSource): {
+    selection?: XopcCloudCapabilitySelection;
+    missing: CloudCapability[];
+};
+/** Build one atomic config update for every managed XOPC Cloud media capability. */
+export declare function prepareXopcCloudCapabilitySetup(config: Config, source: CatalogSource): PrepareXopcCloudCapabilitySetupResult;
+export declare function applyXopcCloudCapabilitySetup(service: {
+    currentConfig: Config;
+    saveConfig(config: Config): Promise<{
+        saved: boolean;
+        error?: string;
+    }>;
+}): Promise<ApplyXopcCloudCapabilitySetupResult>;
+export {};