@xopcai/xopc 0.0.313 → 0.0.315

package/dist/src/agent/workflow/subagent-runner.js

@@ -1,11 +1,11 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { createSqliteTranscriptRuntime } from "../embedded/transcript-runtime.js";
-import { STRUCTURED_OUTPUT_TOOL_NAME, createStructuredOutputTool } from "./structured-output-tool.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
 import { DELEGATION_TOOL_CAPABILITIES, protectDelegatedTool, resolveDelegationTools } from "../tools/delegation-policy.js";
 import { DELEGATE_BLOCKED_TOOLS } from "../tools/delegate-tool.js";
 import { createDelegationParentPolicy } from "../tools/delegation-parent-policy.js";
+import { STRUCTURED_OUTPUT_TOOL_NAME, createStructuredOutputTool } from "./structured-output-tool.js";
 //#region src/agent/workflow/subagent-runner.ts
 init_logger();
 const log = createLogger("Agent:WorkflowSubagent");
@@ -34,6 +34,7 @@ var DelegateSubagentRunner = class {
 			goal: fullPrompt,
 			requesterConversationId: opts.sessionMetadata?.parentConversationId,
 			allowedToolNames: allowed,
+			isComplete: wantStructured ? () => capture.called : void 0,
 			maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,
 			model,
 			bus: this.deps.bus,

package/dist/src/agent-config/index.js

@@ -1,5 +1,5 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_schema } from "./schema.js";
+import { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_CORE_SKILLS, DEFAULT_SKILL_POLICY, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_schema } from "./schema.js";
 import { init_resolver, resolveEffectiveAgentConfig } from "./resolver.js";
 //#region src/agent-config/index.ts
 var init_agent_config = __esmMin((() => {
@@ -8,4 +8,4 @@ var init_agent_config = __esmMin((() => {
 }));
 //#endregion
 init_agent_config();
-export { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_agent_config, resolveEffectiveAgentConfig };
+export { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_CORE_SKILLS, DEFAULT_SKILL_POLICY, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_agent_config, resolveEffectiveAgentConfig };

package/dist/src/agent-config/schema.d.ts

@@ -1,5 +1,10 @@
 import { z } from 'zod';
 export declare const DEFAULT_AGENT_MODEL_REF = "deepseek/deepseek-v4-flash";
+export declare const DEFAULT_CORE_SKILLS: readonly ["doc-coauthoring", "define-task", "find-skills", "summarize"];
+export declare const DEFAULT_SKILL_POLICY: {
+    mode: "selected";
+    include: ("doc-coauthoring" | "define-task" | "find-skills" | "summarize")[];
+};
 export declare const ModelRefSchema: z.ZodString;
 export declare const ModelRouteSchema: z.ZodObject<{
     primary: z.ZodString;

package/dist/src/agent-config/schema.js

@@ -1,9 +1,19 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { z } from "zod";
 //#region src/agent-config/schema.ts
-var DEFAULT_AGENT_MODEL_REF, AgentIdSchema, ModelRefSchema, ModelRouteSchema, ImageGenerationRouteSchema, ComputerModelRouteSchema, ModelIntentSchema, ModelIntentRoutesSchema, ModelIntentOverridesSchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, ToolModeSchema, ToolPolicySchema, ToolPoliciesSchema, SkillDefaultsSchema, SkillOverrideSchema, WorkflowPolicySchema, RuntimePolicySchema, AgentDefaultsSchema, AgentProfileSchema, AgentEntrySchema, AgentsConfigSchema, EffectiveAgentConfigSchema;
+var DEFAULT_AGENT_MODEL_REF, DEFAULT_CORE_SKILLS, DEFAULT_SKILL_POLICY, AgentIdSchema, ModelRefSchema, ModelRouteSchema, ImageGenerationRouteSchema, ComputerModelRouteSchema, ModelIntentSchema, ModelIntentRoutesSchema, ModelIntentOverridesSchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, ToolModeSchema, ToolPolicySchema, ToolPoliciesSchema, SkillDefaultsSchema, SkillOverrideSchema, WorkflowPolicySchema, RuntimePolicySchema, AgentDefaultsSchema, AgentProfileSchema, AgentEntrySchema, AgentsConfigSchema, EffectiveAgentConfigSchema;
 var init_schema = __esmMin((() => {
 	DEFAULT_AGENT_MODEL_REF = "deepseek/deepseek-v4-flash";
+	DEFAULT_CORE_SKILLS = [
+		"doc-coauthoring",
+		"define-task",
+		"find-skills",
+		"summarize"
+	];
+	DEFAULT_SKILL_POLICY = {
+		mode: "selected",
+		include: [...DEFAULT_CORE_SKILLS]
+	};
 	AgentIdSchema = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
 	ModelRefSchema = z.string().trim().min(1).refine((value) => {
 		const separator = value.indexOf("/");
@@ -98,10 +108,7 @@ var init_schema = __esmMin((() => {
 	}).strict();
 	AgentDefaultsSchema = z.object({
 		models: AgentModelsDefaultsSchema,
-		skills: SkillDefaultsSchema.default({
-			mode: "all-enabled",
-			exclude: []
-		}),
+		skills: SkillDefaultsSchema.default(DEFAULT_SKILL_POLICY),
 		tools: ToolPoliciesSchema.default({}),
 		workflows: WorkflowPolicySchema.default({}),
 		runtime: RuntimePolicySchema.default({})
@@ -131,10 +138,7 @@ var init_schema = __esmMin((() => {
 				},
 				intents: {}
 			},
-			skills: {
-				mode: "all-enabled",
-				exclude: []
-			},
+			skills: DEFAULT_SKILL_POLICY,
 			tools: {},
 			workflows: {},
 			runtime: {}
@@ -180,4 +184,4 @@ var init_schema = __esmMin((() => {
 }));
 //#endregion
 init_schema();
-export { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_schema };
+export { AgentDefaultsSchema, AgentEntrySchema, AgentModelsDefaultsSchema, AgentModelsOverrideSchema, AgentProfileSchema, AgentsConfigSchema, ComputerModelRouteSchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_CORE_SKILLS, DEFAULT_SKILL_POLICY, EffectiveAgentConfigSchema, ImageGenerationRouteSchema, ModelIntentSchema, ModelRefSchema, ModelRouteSchema, RuntimePolicySchema, SkillDefaultsSchema, SkillOverrideSchema, ToolModeSchema, ToolPoliciesSchema, ToolPolicySchema, WorkflowPolicySchema, init_schema };

package/dist/src/ai-assist/text-assist.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
 import { isLocalModelBaseUrl, resolveModelCallApiKey, resolveModelCallOptions } from "../providers/model-call.js";
+import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 //#region src/ai-assist/text-assist.ts
 init_providers();
 init_logger();

package/dist/src/auth/credentials.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { generatePKCE, init_pkce } from "./pkce.js";
 import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
+import { generatePKCE, init_pkce } from "./pkce.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import http from "node:http";

package/dist/src/auth/profiles/store.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 //#region src/auth/profiles/store.ts

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/automations/api/routes.js

@@ -1,221 +1,301 @@
-import { createLogger } from "../../utils/logger/index.js";
-import { init_logger } from "../../utils/logger.js";
-import { resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
-import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
-import "../../storage/sqlite/index.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { AutomationAlreadyRunningError } from "../service/automation-service.js";
-import { logRouteError } from "../../gateway/hono/lib/route-logger.js";
-import { simulateAutomation } from "../draft/automation-draft-validator.js";
-import { AutomationDraftService } from "../draft/automation-draft-service.js";
-import "../draft/index.js";
+import { AutomationCancelOutputSchema, AutomationDeleteOutputSchema, AutomationMutationOutputSchema, AutomationReadAllOutputSchema, AutomationReadOutputSchema, AutomationRunMutationOutputSchema, ProductReadContracts } from "../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import "../../capabilities/runtime/dispatcher.js";
+import { createProductDispatcher } from "../../capabilities/runtime/product.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../capabilities/adapters/http.js";
+import { randomUUID } from "node:crypto";
 //#region src/automations/api/routes.ts
-init_agent_scope();
-init_logger();
-const log = createLogger("Gateway:Automations");
-function parseLimit(raw, fallback) {
-	const parsed = raw ? Number.parseInt(raw, 10) : fallback;
-	return Number.isFinite(parsed) ? parsed : fallback;
-}
+init_src();
 function parseProjectId(raw) {
 	return raw?.trim() || void 0;
 }
 function registerAutomationRoutes(authenticated, deps) {
 	const { service } = deps;
+	const capabilities = createProductDispatcher(void 0, {
+		getAutomations: () => service.automationServiceInstance,
+		getProjects: () => service.projects,
+		getConfig: () => service.currentConfig
+	});
+	const queueRun = async (c, command, id) => {
+		try {
+			const caller = capabilityHttpContext(c);
+			const operation = `xopc.automations.${command}`;
+			const { run } = AutomationRunMutationOutputSchema.parse(await capabilities.call(operation, { id }, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}));
+			return c.json({ run }, command === "rerun" ? 201 : 200);
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	};
 	authenticated.get("/api/automations", async (c) => {
-		const projectId = parseProjectId(c.req.query("projectId"));
-		if (projectId && !service.projects.get(projectId)) return c.json({ error: "Project not found" }, 404);
-		const automations = await service.automationServiceInstance.list({ projectId });
-		return c.json({ automations });
+		try {
+			const { items } = ProductReadContracts["xopc.automations.list"].output.parse(await capabilities.call("xopc.automations.list", { projectId: parseProjectId(c.req.query("projectId")) }, capabilityHttpContext(c)));
+			return c.json({ automations: items });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.post("/api/automations", async (c) => {
 		try {
-			const body = await c.req.json();
-			if (body.projectId && !service.projects.get(body.projectId)) return c.json({ error: "Project not found" }, 404);
-			const automation = await service.automationServiceInstance.create(body);
+			const body = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.create";
+			const { automation } = AutomationMutationOutputSchema.parse(await capabilities.call(operation, body, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}));
 			return c.json({ automation }, 201);
-		} catch (err) {
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "create" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to create automation" }, 400);
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
 	authenticated.get("/api/automations/metrics", async (c) => {
-		const metrics = await service.automationServiceInstance.getMetrics();
-		return c.json(metrics);
+		try {
+			const { metrics } = ProductReadContracts["xopc.automations.metrics"].output.parse(await capabilities.call("xopc.automations.metrics", {}, capabilityHttpContext(c)));
+			return c.json(metrics);
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.post("/api/automations/draft", async (c) => {
-		const body = await c.req.json().catch(() => null);
-		const prompt = typeof body?.prompt === "string" ? body.prompt.trim() : "";
-		if (!prompt) return c.json({ error: "prompt is required" }, 400);
-		const agentId = typeof body?.agentId === "string" && body.agentId.trim() ? body.agentId.trim() : resolveDefaultAgentId(service.currentConfig);
-		const draftService = new AutomationDraftService({ config: service.currentConfig });
-		try {
-			const draft = await draftService.createDraft({
-				prompt,
-				agentId,
-				language: body?.language === "zh" ? "zh" : "en"
-			}, c.req.raw.signal);
-			const safetyMode = resolveAutomationSafetyForTrust(getUserTrustPolicy().defaultActionLevel, draft.automation.safety?.mode);
-			const trustedDraft = {
-				...draft,
-				automation: {
-					...draft.automation,
-					safety: { mode: safetyMode }
-				}
-			};
-			trustedDraft.simulation = simulateAutomation(trustedDraft.automation);
-			return c.json({ draft: trustedDraft }, 201);
-		} catch (err) {
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "draft" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to create automation draft" }, 400);
+		try {
+			const input = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.draft";
+			return c.json(await capabilities.call(operation, input, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}), 201);
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
 	authenticated.post("/api/automations/simulate", async (c) => {
 		try {
-			const body = await c.req.json();
-			return c.json({ simulation: simulateAutomation(body) });
-		} catch (err) {
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "simulate" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to simulate automation" }, 400);
+			const body = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			return c.json(await capabilities.call("xopc.automations.simulate", body, capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
 	authenticated.get("/api/automation-runs", async (c) => {
 		const automationId = c.req.query("automationId")?.trim();
 		const projectId = parseProjectId(c.req.query("projectId"));
-		if (projectId && !service.projects.get(projectId)) return c.json({ error: "Project not found" }, 404);
-		const runs = await service.automationServiceInstance.listRuns({
-			automationId: automationId || void 0,
-			projectId: automationId ? void 0 : projectId,
-			limit: parseLimit(c.req.query("limit"), 50)
-		});
-		return c.json({ runs });
+		try {
+			const { items } = ProductReadContracts["xopc.automations.history"].output.parse(await capabilities.call("xopc.automations.history", {
+				automationId: automationId || void 0,
+				projectId: automationId ? void 0 : projectId,
+				limit: c.req.query("limit") === void 0 ? void 0 : Number(c.req.query("limit"))
+			}, capabilityHttpContext(c)));
+			return c.json({ runs: items });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.get("/api/automation-runs/product-events", async (c) => {
-		const eventType = c.req.query("eventType")?.trim();
-		if (!eventType) return c.json({ error: "eventType is required" }, 400);
-		const payloadKey = c.req.query("payloadKey")?.trim();
-		const payloadValue = c.req.query("payloadValue")?.trim();
-		const items = await service.automationServiceInstance.listRunsForProductEvent({
-			eventType,
-			source: c.req.query("source")?.trim() || void 0,
-			payloadKey: payloadKey || void 0,
-			payloadValue: payloadValue || void 0,
-			limit: parseLimit(c.req.query("limit"), 10)
-		});
-		return c.json({ items });
+		try {
+			const { items } = ProductReadContracts["xopc.automations.product_events"].output.parse(await capabilities.call("xopc.automations.product_events", {
+				eventType: c.req.query("eventType"),
+				source: c.req.query("source"),
+				payloadKey: c.req.query("payloadKey"),
+				payloadValue: c.req.query("payloadValue"),
+				limit: c.req.query("limit") === void 0 ? void 0 : Number(c.req.query("limit"))
+			}, capabilityHttpContext(c)));
+			return c.json({ items });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.get("/api/automation-runs/:runId", async (c) => {
-		const run = await service.automationServiceInstance.getRun(c.req.param("runId"));
-		if (!run) return c.json({ error: "Run not found" }, 404);
-		return c.json({ run });
+		try {
+			const { run } = ProductReadContracts["xopc.automations.get_run"].output.parse(await capabilities.call("xopc.automations.get_run", { id: c.req.param("runId") }, capabilityHttpContext(c)));
+			return c.json({ run });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.get("/api/automation-runs/:runId/events", async (c) => {
-		const runId = c.req.param("runId");
-		if (!await service.automationServiceInstance.getRun(runId)) return c.json({ error: "Run not found" }, 404);
-		const events = await service.automationServiceInstance.listRunEvents(runId);
-		return c.json({ events });
+		try {
+			const { events } = ProductReadContracts["xopc.automations.run_events"].output.parse(await capabilities.call("xopc.automations.run_events", { id: c.req.param("runId") }, capabilityHttpContext(c)));
+			return c.json({ events });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.post("/api/automation-runs/:runId/read", async (c) => {
-		if (!await service.automationServiceInstance.markRunRead(c.req.param("runId"))) return c.json({ error: "Run not found" }, 404);
-		return c.json({ marked: true });
+		try {
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.read";
+			const { marked } = AutomationReadOutputSchema.parse(await capabilities.call(operation, { id: c.req.param("runId") }, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}));
+			return c.json({ marked });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.post("/api/automation-runs/read-all", async (c) => {
-		const count = await service.automationServiceInstance.markAllRunsRead({ projectId: c.req.query("projectId") });
-		return c.json({ count });
-	});
-	authenticated.post("/api/automation-runs/:runId/rerun", async (c) => {
 		try {
-			const run = await service.automationServiceInstance.rerunFromRun(c.req.param("runId"));
-			return c.json({ run }, 201);
-		} catch (err) {
-			if (err instanceof AutomationAlreadyRunningError) return c.json({
-				error: err.message,
-				code: "automation_already_running",
-				automationId: err.automationId,
-				runningRunId: err.runningRunId
-			}, 409);
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "rerun" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to rerun automation" }, 400);
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.read_all";
+			const { count } = AutomationReadAllOutputSchema.parse(await capabilities.call(operation, { projectId: parseProjectId(c.req.query("projectId")) }, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}));
+			return c.json({ count });
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
+	authenticated.post("/api/automation-runs/:runId/rerun", async (c) => {
+		return queueRun(c, "rerun", c.req.param("runId"));
+	});
 	authenticated.post("/api/automation-runs/:runId/repair-draft", async (c) => {
-		const runId = c.req.param("runId");
-		const run = await service.automationServiceInstance.getRun(runId);
-		if (!run) return c.json({ error: "Run not found" }, 404);
-		if (![
-			"failed",
-			"timeout",
-			"cancelled"
-		].includes(run.status)) return c.json({ error: "Repair draft is only available for failed, timed out, or cancelled runs" }, 400);
-		const automation = await service.automationServiceInstance.get(run.automationId);
-		if (!automation) return c.json({ error: "Automation not found" }, 404);
-		const body = await c.req.json().catch(() => null);
-		const agentId = typeof body?.agentId === "string" && body.agentId.trim() ? body.agentId.trim() : resolveDefaultAgentId(service.currentConfig);
-		const events = await service.automationServiceInstance.listRunEvents(runId);
-		const draftService = new AutomationDraftService({ config: service.currentConfig });
-		try {
-			const repair = await draftService.createRepairDraft({
-				agentId,
-				automation,
-				run,
-				events,
-				language: body?.language === "zh" ? "zh" : "en"
-			}, c.req.raw.signal);
-			return c.json({ repair }, 201);
-		} catch (err) {
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "repairDraft" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to create automation repair draft" }, 400);
+		try {
+			const text = await c.req.text();
+			let body;
+			try {
+				body = text ? JSON.parse(text) : {};
+			} catch {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			}
+			if (!body || typeof body !== "object" || Array.isArray(body)) throw new CapabilityError("INVALID_INPUT", "Expected a request object");
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.repair_draft";
+			return c.json(await capabilities.call(operation, {
+				...body,
+				id: c.req.param("runId")
+			}, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}), 201);
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
 	authenticated.post("/api/automation-runs/:runId/cancel", async (c) => {
-		const cancelled = await service.automationServiceInstance.cancelRun(c.req.param("runId"));
-		return c.json({ cancelled });
+		try {
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.cancel";
+			const { cancelled, confirmed } = AutomationCancelOutputSchema.parse(await capabilities.call(operation, { id: c.req.param("runId") }, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}));
+			return c.json({
+				cancelled,
+				confirmed
+			});
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.get("/api/automations/:id", async (c) => {
-		const automation = await service.automationServiceInstance.get(c.req.param("id"));
-		if (!automation) return c.json({ error: "Automation not found" }, 404);
-		return c.json({ automation });
+		try {
+			const { automation } = ProductReadContracts["xopc.automations.get"].output.parse(await capabilities.call("xopc.automations.get", { id: c.req.param("id") }, capabilityHttpContext(c)));
+			return c.json({ automation });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.patch("/api/automations/:id", async (c) => {
 		try {
-			const patch = await c.req.json();
-			if (patch.projectId && !service.projects.get(patch.projectId)) return c.json({ error: "Project not found" }, 404);
-			const automation = await service.automationServiceInstance.update(c.req.param("id"), patch);
-			if (!automation) return c.json({ error: "Automation not found" }, 404);
+			const body = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			if (!body || typeof body !== "object" || Array.isArray(body)) throw new CapabilityError("INVALID_INPUT", "Expected a patch object");
+			const { expectedRevision: suppliedRevision, ...patch } = body;
+			const key = c.req.header("idempotency-key");
+			if (key !== void 0 && suppliedRevision === void 0) throw new CapabilityError("INVALID_INPUT", "Idempotent automation changes require expectedRevision from the original read");
+			const id = c.req.param("id");
+			const expectedRevision = suppliedRevision !== void 0 ? suppliedRevision : (await service.automationServiceInstance.get(id))?.updatedAtMs;
+			if (expectedRevision === void 0) throw new CapabilityError("NOT_FOUND", "Automation not found");
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.update";
+			const { automation } = AutomationMutationOutputSchema.parse(await capabilities.call(operation, {
+				id,
+				expectedRevision,
+				patch
+			}, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: key ?? randomUUID()
+			}));
 			return c.json({ automation });
-		} catch (err) {
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "update" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to update automation" }, 400);
+		} catch (error) {
+			return capabilityHttpError(c, error);
 		}
 	});
 	authenticated.delete("/api/automations/:id", async (c) => {
-		const removed = await service.automationServiceInstance.remove(c.req.param("id"));
-		return c.json({ removed });
+		try {
+			const text = await c.req.text();
+			let body = {};
+			try {
+				body = text ? JSON.parse(text) : {};
+			} catch {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			}
+			if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => key !== "expectedRevision")) throw new CapabilityError("INVALID_INPUT", "Only expectedRevision is accepted");
+			const suppliedRevision = body.expectedRevision;
+			const key = c.req.header("idempotency-key");
+			if (key !== void 0 && suppliedRevision === void 0) throw new CapabilityError("INVALID_INPUT", "Idempotent deletion requires the original expectedRevision");
+			const id = c.req.param("id");
+			const expectedRevision = suppliedRevision !== void 0 ? suppliedRevision : (await service.automationServiceInstance.get(id))?.updatedAtMs ?? null;
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.delete";
+			const { removed } = AutomationDeleteOutputSchema.parse(await capabilities.call(operation, {
+				id,
+				expectedRevision
+			}, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: key ?? randomUUID()
+			}));
+			return c.json({ removed });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	authenticated.post("/api/automations/:id/run", async (c) => {
+		return queueRun(c, "run", c.req.param("id"));
+	});
+	for (const command of ["pause", "resume"]) authenticated.post(`/api/automations/:id/${command}`, async (c) => {
 		try {
-			const run = await service.automationServiceInstance.runNow(c.req.param("id"));
-			return c.json({ run });
-		} catch (err) {
-			if (err instanceof AutomationAlreadyRunningError) return c.json({
-				error: err.message,
-				code: "automation_already_running",
-				automationId: err.automationId,
-				runningRunId: err.runningRunId
-			}, 409);
-			logRouteError(log, c, err, "gateway.route.automations", { operation: "run" });
-			return c.json({ error: err instanceof Error ? err.message : "Failed to run automation" }, 400);
-		}
-	});
-	authenticated.post("/api/automations/:id/pause", async (c) => {
-		const automation = await service.automationServiceInstance.pause(c.req.param("id"));
-		if (!automation) return c.json({ error: "Automation not found" }, 404);
-		return c.json({ automation });
-	});
-	authenticated.post("/api/automations/:id/resume", async (c) => {
-		const automation = await service.automationServiceInstance.resume(c.req.param("id"));
-		if (!automation) return c.json({ error: "Automation not found" }, 404);
-		return c.json({ automation });
+			const text = await c.req.text();
+			let body = {};
+			try {
+				body = text ? JSON.parse(text) : {};
+			} catch {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			}
+			if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => key !== "expectedRevision")) throw new CapabilityError("INVALID_INPUT", "Only expectedRevision is accepted");
+			const suppliedRevision = body.expectedRevision;
+			const key = c.req.header("idempotency-key");
+			if (key !== void 0 && suppliedRevision === void 0) throw new CapabilityError("INVALID_INPUT", "Idempotent automation changes require expectedRevision from the original read");
+			const id = c.req.param("id");
+			const expectedRevision = suppliedRevision !== void 0 ? suppliedRevision : (await service.automationServiceInstance.get(id))?.updatedAtMs;
+			if (expectedRevision === void 0) throw new CapabilityError("NOT_FOUND", "Automation not found");
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.automations.set_enabled";
+			const { automation } = AutomationMutationOutputSchema.parse(await capabilities.call(operation, {
+				id,
+				enabled: command === "resume",
+				expectedRevision
+			}, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: key ?? randomUUID()
+			}));
+			return c.json({ automation });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 }
 //#endregion