@xopcai/xopc 0.0.308 → 0.0.311

package/dist/src/gateway/hono/routes/scenes.js

@@ -0,0 +1,142 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
+import { SceneConflictError, SceneInputError, SceneNotFoundError } from "../../../scenes/repository.js";
+import { SceneSetupError } from "../../../scenes/service.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { z } from "zod";
+import { Hono } from "hono";
+//#region src/gateway/hono/routes/scenes.ts
+init_logger();
+const log = createLogger("Hono:Scenes");
+const requestIdentity = z.string().trim().min(1).max(200);
+const pageSchema = z.strictObject({
+	limit: z.coerce.number().int().min(1).max(100).default(50),
+	afterId: z.string().max(200).default("")
+});
+function registerSceneRoutes(authenticated, deps) {
+	const app = new Hono();
+	app.onError((error, c) => {
+		if (error instanceof SceneNotFoundError) return c.json({ error: "scene_not_found" }, 404);
+		if (error instanceof SceneConflictError) return c.json({
+			error: "scene_changed",
+			message: error.message
+		}, 409);
+		if (error instanceof SceneSetupError) return c.json({
+			error: "scene_needs_setup",
+			message: error.message,
+			missing: error.missing
+		}, 422);
+		if (error instanceof z.ZodError || error instanceof SyntaxError || error instanceof SceneInputError) return c.json({ error: "invalid_scene_input" }, 400);
+		log.error({
+			err: error,
+			phase: "scene_request"
+		}, "Scene request failed");
+		return c.json({ error: "scene_request_failed" }, 500);
+	});
+	app.use("*", async (c, next) => {
+		if (!deps.scenes) return c.json({ error: "scene_runtime_not_installed" }, 503);
+		await next();
+	});
+	const principal = (c) => ({
+		ownerId: getGatewayPrincipal(c).scopes.includes("gateway.admin") ? "local-owner" : getGatewayPrincipal(c).principalId,
+		workspaceId: deps.service.currentWorkspacePath
+	});
+	app.post("/browser/prepare", deps.strictRateLimitMiddleware, (c) => c.json(deps.scenes.browser.prepare()));
+	app.post("/browser/subscriptions", deps.strictRateLimitMiddleware, async (c) => c.json(deps.scenes.browser.register(principal(c), await c.req.json()), 201));
+	app.delete("/browser/subscriptions/:id", deps.strictRateLimitMiddleware, (c) => {
+		deps.scenes.browser.remove(principal(c), c.req.param("id"));
+		return c.json({ ok: true });
+	});
+	app.get("/preferences", (c) => c.json(deps.scenes.preferences.get(principal(c))));
+	app.patch("/preferences", deps.strictRateLimitMiddleware, async (c) => c.json(deps.scenes.preferences.update(principal(c), await c.req.json())));
+	app.post("/presence", deps.strictRateLimitMiddleware, async (c) => {
+		deps.scenes.preferences.recordPresence(principal(c), await c.req.json());
+		return c.json({ ok: true });
+	});
+	app.get("/templates", (c) => c.json({ templates: deps.scenes.repository.listTemplates() }));
+	app.get("/diagnostics", (c) => c.json(deps.scenes.metrics.diagnostics(principal(c))));
+	app.get("/metrics", (c) => {
+		const { days } = z.strictObject({ days: z.coerce.number().int().min(1).max(90).default(7) }).parse(c.req.query());
+		return c.json(deps.scenes.metrics.forUser(principal(c), days));
+	});
+	app.get("/sources/mail/accounts", (c) => c.json({ accounts: deps.scenes.mailDiscovery?.listAccounts(principal(c)) ?? [] }));
+	app.post("/sources/mail/search", deps.strictRateLimitMiddleware, async (c) => {
+		if (!deps.scenes.mailDiscovery) return c.json({ error: "mail_search_unavailable" }, 503);
+		const signal = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(15e3)]);
+		return c.json({ sources: await deps.scenes.mailDiscovery.searchSources(principal(c), await c.req.json(), signal) });
+	});
+	app.get("/sources/mail", (c) => {
+		const { limit, afterId } = pageSchema.parse(c.req.query());
+		const sources = deps.scenes.mail.listSources(principal(c), limit, afterId);
+		return c.json({
+			sources,
+			nextCursor: sources.length === limit ? sources.at(-1).id : null
+		});
+	});
+	app.get("/templates/:key/versions/:version", (c) => c.json({ template: deps.scenes.repository.getTemplate(c.req.param("key"), c.req.param("version")) }));
+	app.post("/preflight", deps.strictRateLimitMiddleware, async (c) => c.json(await deps.scenes.application.preflight(principal(c), await c.req.json())));
+	app.get("/activations", (c) => {
+		const { limit, afterId } = pageSchema.parse(c.req.query());
+		const activations = deps.scenes.repository.listActivations(principal(c), limit, afterId);
+		return c.json({
+			activations,
+			nextCursor: activations.length === limit ? activations.at(-1).id : null
+		});
+	});
+	app.post("/activations", deps.strictRateLimitMiddleware, async (c) => {
+		const requestId = requestIdentity.parse(c.req.header("Idempotency-Key"));
+		return c.json({ activation: await deps.scenes.application.start(principal(c), await c.req.json(), requestId) }, 201);
+	});
+	app.get("/activations/:id", (c) => c.json({ activation: deps.scenes.repository.getActivation(principal(c), c.req.param("id")) }));
+	app.patch("/activations/:id", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json();
+		const activation = typeof body === "object" && body !== null && Object.hasOwn(body, "status") ? await deps.scenes.application.transition(principal(c), c.req.param("id"), body) : deps.scenes.application.configure(principal(c), c.req.param("id"), body);
+		return c.json({ activation });
+	});
+	app.post("/activations/:id/checks", deps.strictRateLimitMiddleware, (c) => c.json({ intentId: deps.scenes.application.check(principal(c), c.req.param("id"), requestIdentity.parse(c.req.header("Idempotency-Key"))) }, 202));
+	app.get("/activations/:id/runs", (c) => {
+		const { limit, afterId } = pageSchema.parse(c.req.query());
+		const runs = deps.scenes.repository.listRuns(principal(c), c.req.param("id"), limit, afterId);
+		return c.json({
+			runs,
+			nextCursor: runs.length === limit ? runs.at(-1).id : null
+		});
+	});
+	app.patch("/activations/:id/notes", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.application.writeNotes(principal(c), c.req.param("id"), await c.req.json()) }));
+	app.get("/activations/:id/notes", (c) => c.json({ notes: deps.scenes.repository.readNotes(principal(c), c.req.param("id")) }));
+	app.get("/activations/:id/work-items", (c) => {
+		const { limit, afterId } = pageSchema.parse(c.req.query());
+		const workItems = deps.scenes.repository.listWorkItems(principal(c), c.req.param("id"), limit, afterId);
+		return c.json({
+			workItems,
+			nextCursor: workItems.length === limit ? workItems.at(-1).id : null
+		});
+	});
+	app.post("/activations/:id/work-items", deps.strictRateLimitMiddleware, async (c) => c.json({ workItem: deps.scenes.application.createWorkItem(principal(c), c.req.param("id"), await c.req.json()) }, 201));
+	app.get("/activations/:id/schedules", (c) => c.json({ schedules: deps.scenes.repository.listSchedules(principal(c), c.req.param("id")) }));
+	app.patch("/activations/:id/schedules/:triggerKey", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.application.setSchedule(principal(c), c.req.param("id"), c.req.param("triggerKey"), await c.req.json()) }));
+	app.patch("/work-items/:id", deps.strictRateLimitMiddleware, async (c) => c.json({ workItem: deps.scenes.application.updateWorkItem(principal(c), c.req.param("id"), await c.req.json()) }));
+	app.get("/outcomes", (c) => {
+		const { limit, afterId, activationId } = pageSchema.extend({ activationId: requestIdentity.optional() }).parse(c.req.query());
+		const outcomes = deps.scenes.repository.listInbox(principal(c), limit, afterId, activationId ?? null);
+		return c.json({
+			outcomes,
+			nextCursor: outcomes.length === limit ? outcomes.at(-1).id : null
+		});
+	});
+	app.get("/digests/:id", (c) => {
+		const { limit, afterId } = pageSchema.parse(c.req.query());
+		return c.json(deps.scenes.repository.listDigestResults(principal(c), c.req.param("id"), limit, afterId));
+	});
+	app.get("/presentations/:id/feedback", (c) => c.json({ feedback: deps.scenes.inbox.getFeedback(principal(c), c.req.param("id")) }));
+	app.get("/presentations/:id", (c) => c.json({ outcome: deps.scenes.repository.getPresentation(principal(c), c.req.param("id")) }));
+	app.post("/presentations/:id/feedback", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.inbox.feedback(principal(c), c.req.param("id"), await c.req.json()) }));
+	app.patch("/presentations/:id", deps.strictRateLimitMiddleware, async (c) => {
+		const { read } = z.strictObject({ read: z.boolean() }).parse(await c.req.json());
+		deps.scenes.inbox.setRead(principal(c), c.req.param("id"), read);
+		return c.json({ ok: true });
+	});
+	authenticated.route("/api/scenes", app);
+}
+//#endregion
+export { registerSceneRoutes };

package/dist/src/gateway/hono/routes/sessions.js

@@ -2,7 +2,9 @@ import { deleteBrowserTabBinding } from "../../../storage/sqlite/browser-tab-bin
 import { conversationIdSchema } from "../../../../packages/gateway-contract/src/conversation-identity.js";
 import { SessionDiscoveryQuerySchema } from "../../../../packages/gateway-contract/src/session-identity.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import "../../../session/types.js";
 import { deleteSessionRecord, init_session_repository } from "../../../storage/sqlite/session-repository.js";
+import { SidebarLayoutConflictError, getSidebarLayout, replaceSidebarLayout, sortBySidebarLayout } from "../../../storage/sqlite/sidebar-layout-repository.js";
 import { ConversationAlreadyExistsError, createConversation, init_conversation_repository } from "../../../storage/sqlite/conversation-repository.js";
 import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import "../../../projects/index.js";
@@ -48,6 +50,21 @@ function parseOffset(value) {
 	const parsed = value ? Number.parseInt(value, 10) : 0;
 	return Number.isFinite(parsed) ? Math.max(0, parsed) : 0;
 }
+function listAllSidebarProjects(service, options = {}) {
+	const items = [];
+	let offset = 0;
+	while (true) {
+		const page = service.projects.listWithSidebarSessions({
+			status: "active",
+			limit: 50,
+			offset,
+			...options
+		});
+		items.push(...page.items);
+		if (!page.hasMore || page.items.length === 0) return items;
+		offset += page.items.length;
+	}
+}
 function isHistoryCursor(value) {
 	if (!/^(0|[1-9]\d*)$/.test(value)) return false;
 	return Number.isSafeInteger(Number(value));
@@ -101,18 +118,25 @@ function registerSessionsRoutes(authenticated, deps) {
 		const staleDays = parsePositiveInt(c.req.query("staleDays"), DEFAULT_SIDEBAR_STALE_DAYS, 3650);
 		const updatedAfter = Date.now() - staleDays * 24 * 60 * 60 * 1e3;
 		const includeConversationId = c.req.query("includeConversationId")?.trim() || void 0;
-		const projects = service.projects.listWithSidebarSessions({
-			status: "active",
-			limit: projectLimit,
-			offset: projectOffset,
+		const allProjectItems = listAllSidebarProjects(service, {
 			updatedAfter,
 			includePinned: true,
 			includeConversationId
 		});
+		const projectLayout = getSidebarLayout("projects");
+		const orderedProjects = sortBySidebarLayout(allProjectItems, projectLayout, (project) => project.id);
+		const projects = {
+			items: orderedProjects.slice(projectOffset, projectOffset + projectLimit),
+			total: orderedProjects.length,
+			limit: projectLimit,
+			offset: projectOffset,
+			hasMore: projectOffset + projectLimit < orderedProjects.length
+		};
 		const projectItems = await Promise.all(projects.items.map(async (project) => {
-			const sessions = await service.sessions.listSessions({
+			const sessionLayout = getSidebarLayout(`project:${project.id}`);
+			const allSessions = await service.sessions.listSessions({
 				projectId: project.id,
-				limit: sessionPreviewLimit,
+				limit: 5e3,
 				offset: 0,
 				updatedAfter,
 				includePinned: true,
@@ -122,21 +146,47 @@ function registerSessionsRoutes(authenticated, deps) {
 			});
 			return {
 				project,
-				sessions: sessions.items,
-				sessionTotal: sessions.total,
-				sessionHasMore: sessions.hasMore
+				sessions: sortBySidebarLayout(allSessions.items, sessionLayout, (session) => session.key).slice(0, sessionPreviewLimit),
+				sessionTotal: allSessions.total,
+				sessionHasMore: sessionPreviewLimit < allSessions.total
 			};
 		}));
-		const inbox = await service.sessions.listSessions({
+		const inboxLayout = getSidebarLayout("inbox");
+		const allInbox = await service.sessions.listSessions({
 			unassigned: true,
-			limit: inboxLimit,
-			offset: inboxOffset,
+			limit: 5e3,
+			offset: 0,
 			updatedAfter,
 			includePinned: true,
 			includeConversationId,
 			sortBy: "updatedAt",
 			sortOrder: "desc"
 		});
+		const orderedInbox = sortBySidebarLayout(allInbox.items, inboxLayout, (session) => session.key);
+		const inbox = {
+			...allInbox,
+			items: orderedInbox.slice(inboxOffset, inboxOffset + inboxLimit),
+			limit: inboxLimit,
+			offset: inboxOffset,
+			hasMore: inboxOffset + inboxLimit < allInbox.total
+		};
+		const pinnedLayout = getSidebarLayout("pinned");
+		const pinned = sortBySidebarLayout((await service.sessions.listSessions({
+			status: "pinned",
+			limit: 5e3,
+			offset: 0,
+			sortBy: "updatedAt",
+			sortOrder: "desc"
+		})).items, pinnedLayout, (session) => session.key);
+		const layouts = Object.fromEntries([
+			projectLayout,
+			inboxLayout,
+			pinnedLayout,
+			...projects.items.map((project) => getSidebarLayout(`project:${project.id}`))
+		].map((layout) => [layout.containerId, {
+			itemIds: layout.itemIds,
+			revision: layout.revision
+		}]));
 		return c.json({
 			ok: true,
 			projects: {
@@ -146,9 +196,87 @@ function registerSessionsRoutes(authenticated, deps) {
 				offset: projects.offset,
 				hasMore: projects.hasMore
 			},
-			inbox
+			inbox,
+			pinned,
+			layouts
 		});
 	});
+	authenticated.put("/api/sidebar/layouts/:containerId", async (c) => {
+		const blocked = ensureGatewayReadyForSessions(c, service, "sessions.list");
+		if (blocked) return blocked;
+		const containerId = decodeURIComponent(c.req.param("containerId"));
+		if (containerId !== "projects" && containerId !== "pinned" && containerId !== "inbox" && !containerId.startsWith("project:")) return c.json({
+			ok: false,
+			error: "Invalid sidebar container"
+		}, 400);
+		const body = await c.req.json().catch(() => ({}));
+		if (!Array.isArray(body.itemIds) || body.itemIds.length > 5e3 || body.itemIds.some((id) => typeof id !== "string" || !id.trim())) return c.json({
+			ok: false,
+			error: "itemIds must be an array of non-empty strings"
+		}, 400);
+		if (!Number.isInteger(body.expectedRevision) || body.expectedRevision < 0) return c.json({
+			ok: false,
+			error: "expectedRevision must be a non-negative integer"
+		}, 400);
+		const itemIds = [...new Set(body.itemIds)];
+		if (itemIds.length !== body.itemIds.length) return c.json({
+			ok: false,
+			error: "itemIds must be unique"
+		}, 400);
+		let completeItemIds = itemIds;
+		if (containerId === "projects") {
+			if (itemIds.some((id) => !service.projects.get(id))) return c.json({
+				ok: false,
+				error: "Project not found"
+			}, 404);
+			const allIds = listAllSidebarProjects(service).map((project) => project.id);
+			completeItemIds = [...itemIds, ...allIds.filter((id) => !itemIds.includes(id))];
+		} else {
+			const projectId = containerId.startsWith("project:") ? containerId.slice(8) : void 0;
+			if (projectId && !service.projects.get(projectId)) return c.json({
+				ok: false,
+				error: "Project not found"
+			}, 404);
+			if ((await Promise.all(itemIds.map((id) => service.sessions.getSession(id)))).some((session) => {
+				if (!session || session.status === "archived") return true;
+				if (containerId === "pinned") return session.status !== "pinned";
+				if (session.status === "pinned") return true;
+				if (containerId === "inbox") return Boolean(session.projectId);
+				return session.projectId !== projectId;
+			})) return c.json({
+				ok: false,
+				error: "Sidebar item does not belong to the container"
+			}, 409);
+			const eligibleIds = (await service.sessions.listSessions({
+				...containerId === "pinned" ? { status: "pinned" } : containerId === "inbox" ? {
+					unassigned: true,
+					excludeArchived: true
+				} : {
+					projectId,
+					excludeArchived: true
+				},
+				limit: 5e3,
+				offset: 0,
+				sortBy: "updatedAt",
+				sortOrder: "desc"
+			})).items.filter((session) => containerId === "pinned" || session.status !== "pinned").map((session) => session.key);
+			completeItemIds = [...itemIds, ...eligibleIds.filter((id) => !itemIds.includes(id))];
+		}
+		try {
+			const layout = replaceSidebarLayout(containerId, completeItemIds, body.expectedRevision);
+			return c.json({
+				ok: true,
+				layout
+			});
+		} catch (error) {
+			if (error instanceof SidebarLayoutConflictError) return c.json({
+				ok: false,
+				error: error.message,
+				layout: error.current
+			}, 409);
+			throw error;
+		}
+	});
 	authenticated.post("/api/sessions", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		if (body.conversationId !== void 0 && !conversationIdSchema.safeParse(body.conversationId).success) return c.json({

package/dist/src/gateway/hono/routes/tasks.js

@@ -1,7 +1,6 @@
 import { init_transaction, runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
 import { TaskPhaseSchema } from "../../../../packages/gateway-contract/src/task-lifecycle.js";
 import { TaskBoardPositionRequestSchema, TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskHandoffRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
-import { ProjectMonitoringUpdateSchema } from "../../../../packages/gateway-contract/src/project-monitoring.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { enqueueTaskChangedEvent, init_task_change_events } from "../../../tasks/task-change-events.js";
 import { TaskRunRepository, init_task_run_repository } from "../../../tasks/task-run-repository.js";
@@ -12,7 +11,6 @@ import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import { TaskContextRepository } from "../../../tasks/task-context-repository.js";
 import { TaskDependencyError, TaskDependencyService } from "../../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../../tasks/task-application-service.js";
-import { ProjectMonitoringService } from "../../../tasks/project-monitoring-service.js";
 import { ProjectOperatingViewService } from "../../../tasks/project-operating-view-service.js";
 import { TaskValueMetricsService } from "../../../tasks/task-value-metrics-service.js";
 import { TaskHandoffService } from "../../../tasks/task-handoff-service.js";
@@ -30,7 +28,6 @@ function registerTaskRoutes(authenticated, deps) {
 	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
-	const monitoring = new ProjectMonitoringService(deps.service.currentWorkspacePath);
 	const metrics = new TaskValueMetricsService();
 	const tasks = new TaskRepository();
 	const runs = new TaskRunRepository();
@@ -577,49 +574,6 @@ function registerTaskRoutes(authenticated, deps) {
 			error: "Project not found"
 		}, 404);
 	});
-	authenticated.get("/api/projects/:projectId/monitoring", (c) => {
-		const projectId = c.req.param("projectId");
-		if (!deps.service.projects.get(projectId)) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		return c.json({
-			ok: true,
-			policy: monitoring.get(projectId)
-		});
-	});
-	authenticated.patch("/api/projects/:projectId/monitoring", taskRateLimit, async (c) => {
-		const projectId = c.req.param("projectId");
-		if (!deps.service.projects.get(projectId)) return c.json({
-			ok: false,
-			error: "Project not found"
-		}, 404);
-		const parsed = ProjectMonitoringUpdateSchema.safeParse(await c.req.json().catch(() => ({})));
-		if (!parsed.success) return c.json({
-			ok: false,
-			error: "Invalid monitoring policy"
-		}, 400);
-		const current = monitoring.get(projectId);
-		try {
-			const policy = monitoring.configure({
-				projectId,
-				mode: parsed.data.mode ?? current.mode,
-				quietHours: parsed.data.quietHours === null ? void 0 : parsed.data.quietHours ?? current.quietHours,
-				allowedActions: parsed.data.allowedActions ?? current.allowedActions,
-				confidenceThreshold: parsed.data.confidenceThreshold ?? current.confidenceThreshold,
-				scenarios: parsed.data.scenarios ?? (current.configured ? current.scenarios : void 0)
-			});
-			return c.json({
-				ok: true,
-				policy
-			});
-		} catch (error) {
-			return c.json({
-				ok: false,
-				error: error instanceof Error ? error.message : String(error)
-			}, 400);
-		}
-	});
 }
 //#endregion
 export { registerTaskRoutes };

package/dist/src/gateway/hono/routes/user-model.js

@@ -1,7 +1,8 @@
+import { init_transaction, runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
 import { createCollaborationRule, getCollaborationRule, listCollaborationRules, setCollaborationRuleStatus } from "../../../storage/sqlite/collaboration-rule-repository.js";
 import { KnowledgeReviewConflictError, deleteKnowledgeItem, getKnowledgeItem, listKnowledgeItems, reviewKnowledgeItem, searchKnowledgeItems } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
-import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus } from "../../../user-model/goals.js";
+import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus, updatePriorityWindow, updateUserGoal } from "../../../user-model/goals.js";
 import { deleteUserAssertion, getAssertionSlot, getUserAssertion, listUserAssertionSources, listUserAssertions, reconcileAssertion, setAssertionStatus } from "../../../user-model/repository.js";
 import { applyUserProfilePatch, getUserProfileSnapshot } from "../../../user-model/profile.js";
 import { bootstrapUserModel } from "../../../user-model/bootstrap.js";
@@ -13,6 +14,7 @@ import { getExecutionContextAudit, recordExecutionContextFeedback } from "../../
 import { listUnderstandingSourceGrants } from "../../../user-context/sources/repository.js";
 import { userInfo } from "node:os";
 //#region src/gateway/hono/routes/user-model.ts
+init_transaction();
 function object(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
@@ -387,6 +389,57 @@ function registerUserModelRoutes(authenticated, deps) {
 			return c.json({ error: errorMessage(error) }, 400);
 		}
 	});
+	authenticated.patch("/api/user-model/priorities/:id", write, async (c) => {
+		const input = await body(c);
+		const priority = listPriorityWindows().find((item) => item.id === c.req.param("id"));
+		if (!priority) return c.json({ error: "Priority not found" }, 404);
+		if (!input) return c.json({ error: "A priority patch is required" }, 400);
+		if (![
+			"title",
+			"desiredOutcome",
+			"validTo",
+			"status"
+		].some((field) => Object.hasOwn(input, field))) return c.json({ error: "At least one editable priority field is required" }, 400);
+		if (Object.hasOwn(input, "title") && typeof input.title !== "string" || Object.hasOwn(input, "desiredOutcome") && typeof input.desiredOutcome !== "string" || Object.hasOwn(input, "validTo") && typeof input.validTo !== "number" || Object.hasOwn(input, "status") && typeof input.status !== "string") return c.json({ error: "Priority patch fields have invalid types" }, 400);
+		const title = typeof input.title === "string" ? input.title.trim() : void 0;
+		const desiredOutcome = typeof input.desiredOutcome === "string" ? input.desiredOutcome.trim() : void 0;
+		const validTo = typeof input.validTo === "number" ? input.validTo : void 0;
+		const status = typeof input.status === "string" ? input.status : void 0;
+		if (status && ![
+			"active",
+			"paused",
+			"completed",
+			"expired"
+		].includes(status)) return c.json({ error: "Invalid priority status" }, 400);
+		if (validTo !== void 0 && validTo < priority.validFrom) return c.json({ error: "Priority validTo must be after validFrom" }, 400);
+		if (title !== void 0 && !title) return c.json({ error: "Priority title is required" }, 400);
+		if (desiredOutcome !== void 0 && !desiredOutcome) return c.json({ error: "Priority outcome is required" }, 400);
+		try {
+			const result = runSqliteWriteTransaction(() => {
+				let goal;
+				if (priority.targetType === "goal" && (title !== void 0 || desiredOutcome !== void 0)) {
+					const currentGoal = listUserGoals().find((item) => item.id === priority.targetId);
+					if (!currentGoal) throw new Error("Priority goal not found");
+					goal = updateUserGoal(currentGoal.id, {
+						title: title ?? currentGoal.title,
+						desiredOutcome: desiredOutcome ?? currentGoal.desiredOutcome,
+						...currentGoal.targetAt === void 0 ? {} : { targetAt: currentGoal.targetAt }
+					});
+				}
+				return {
+					priority: updatePriorityWindow(priority.id, {
+						...priority.targetType === "goal" || title === void 0 ? {} : { targetId: title },
+						...validTo === void 0 ? {} : { validTo },
+						...status === void 0 ? {} : { status }
+					}),
+					...goal ? { goal } : {}
+				};
+			});
+			return c.json(result);
+		} catch (error) {
+			return c.json({ error: errorMessage(error) }, 400);
+		}
+	});
 	authenticated.get("/api/knowledge-memory", (c) => {
 		const query = c.req.query("q")?.trim();
 		if (!query) return c.json({ items: listKnowledgeItems({

package/dist/src/gateway/scenes/browserNotifications.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { NotificationDispatcher } from '../../notifications/dispatch.js';
+import { type SceneActivation, type ScenePermission } from '../../scenes/contracts.js';
+export declare function createSceneBrowserDispatcher(db: DatabaseSync, authorize: (activation: SceneActivation) => ScenePermission, clock?: () => number): NotificationDispatcher;

package/dist/src/gateway/scenes/browserNotifications.js

@@ -0,0 +1,54 @@
+import { intersectPermissions, sceneContentHash } from "../../scenes/contracts.js";
+import { SceneRepository } from "../../scenes/repository.js";
+import { ScenePreferenceService, sceneChecksAllowed } from "../../scenes/preferences.js";
+import { notificationQuietUntil } from "../../notifications/quietHours.js";
+import { sceneNotificationEligibility } from "../../scenes/notificationEligibility.js";
+import { createBrowserNotificationTransport } from "../../notifications/browserTransport.js";
+import { NotificationDispatcher } from "../../notifications/dispatch.js";
+//#region src/gateway/scenes/browserNotifications.ts
+function createSceneBrowserDispatcher(db, authorize, clock = Date.now) {
+	const repository = new SceneRepository(db);
+	const members = (dispatch) => dispatch.subjectId ? [{
+		subject_id: dispatch.subjectId,
+		subject_revision: dispatch.subjectRevision
+	}] : db.prepare(`SELECT m.subject_id, m.subject_revision FROM notification_digest_members m
+        JOIN notification_digests d ON d.id = m.digest_id
+        WHERE d.notification_id = ? AND d.owner_id = ? AND d.workspace_id = ?`).all(dispatch.notificationId, dispatch.ownerId, dispatch.workspaceId);
+	const eligible = (dispatch, subject) => {
+		const result = sceneNotificationEligibility(db, {
+			...dispatch,
+			subjectId: String(subject.subject_id)
+		}, clock(), Number(subject.subject_revision));
+		if (result.action !== "eligible") return null;
+		const activation = repository.getActivation(dispatch, result.activationId);
+		if (sceneContentHash(intersectPermissions(activation.permissions, authorize(activation))) !== sceneContentHash(intersectPermissions(activation.permissions))) return null;
+		return result;
+	};
+	return new NotificationDispatcher(db, {
+		clock,
+		send: createBrowserNotificationTransport(db, {
+			clock,
+			route: (dispatch) => {
+				if (!dispatch.subjectId) return "/scenes/inbox";
+				const result = eligible(dispatch, {
+					subject_id: dispatch.subjectId,
+					subject_revision: dispatch.subjectRevision
+				});
+				return result ? `/scenes/${encodeURIComponent(result.activationId)}?result=${encodeURIComponent(result.presentationId)}` : null;
+			}
+		}),
+		authorize: async (dispatch) => {
+			const policy = new ScenePreferenceService(db).get(dispatch);
+			if (!sceneChecksAllowed(policy, clock()) || policy.notificationsMuted || policy.level === "quiet" || policy.preferredChannel !== "browser") return { action: "cancel" };
+			if (!members(dispatch).filter((subject) => eligible(dispatch, subject)).filter((subject) => !policy.suppressWhileViewing || !db.prepare(`SELECT 1 FROM notification_presence WHERE owner_id = ? AND workspace_id = ?
+        AND subject_id = ? AND subject_revision = ? AND expires_at > ?`).get(dispatch.ownerId, dispatch.workspaceId, subject.subject_id, subject.subject_revision, clock())).length) return { action: "cancel" };
+			const until = notificationQuietUntil(policy, clock());
+			return until === null ? { action: "send" } : {
+				action: "defer",
+				until
+			};
+		}
+	});
+}
+//#endregion
+export { createSceneBrowserDispatcher };

package/dist/src/gateway/scenes/host.d.ts

@@ -0,0 +1,34 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { ProductNotification } from '@xopcai/gateway-contract';
+import type { Config } from '../../config/schema.js';
+import type { ScenePrincipal } from '../../scenes/contracts.js';
+import { type SceneReadOnlyExecutor } from '../../scenes/execution.js';
+import type { SceneHttpServices } from '../../scenes/httpServices.js';
+import type { SceneMailContextProvider } from '../../scenes/mailContext.js';
+/** Composition root for the initialized database. Never creates tables or starts an old worker. */
+export declare class GatewaySceneHost {
+    private readonly db;
+    readonly http: SceneHttpServices;
+    private readonly runtime;
+    private readonly notifications;
+    private readonly browserDispatcher;
+    private timer?;
+    private active?;
+    private stopped;
+    private nextMaintenanceAt;
+    private readonly clock;
+    constructor(db: DatabaseSync, input: {
+        principal: ScenePrincipal;
+        config: () => Config;
+        publish: (type: 'notification.created', notification: ProductNotification) => void;
+        executor?: SceneReadOnlyExecutor;
+        mail?: SceneMailContextProvider;
+        clock?: () => number;
+        intervalMs?: number;
+    });
+    private readonly intervalMs;
+    start(): void;
+    tick(): Promise<void>;
+    /** Must finish before the Gateway closes SQLite or its realtime broker. */
+    stop(): Promise<void>;
+}