@xopcai/xopc 0.0.324 → 0.0.329

package/dist/src/connectors/connected-source-understanding.js

@@ -9,6 +9,9 @@ import "../knowledge-memory/index.js";
 import { reconcileAssertion } from "../user-model/repository.js";
 import "../user-model/index.js";
 import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
+import { recordConnectedSourceObservations } from "./connected-source-observations.js";
+import { getActiveUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getUnderstandingSourceRun } from "../user-context/sources/repository.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources } from "../work-discovery/analyzer.js";
 import { createHash } from "node:crypto";
@@ -45,6 +48,90 @@ function timestamp(value) {
 	const parsed = Date.parse(value);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
+const CONSENT_FIELD_KEYS = {
+	title: new Set([
+		"title",
+		"subject",
+		"name",
+		"fullName",
+		"repository"
+	]),
+	content: new Set([
+		"content",
+		"body",
+		"text",
+		"snippet",
+		"description",
+		"summary"
+	]),
+	participants: new Set([
+		"from",
+		"to",
+		"cc",
+		"bcc",
+		"sender",
+		"author",
+		"organizer",
+		"attendees",
+		"participants",
+		"assignee",
+		"owners"
+	]),
+	status: new Set([
+		"status",
+		"state",
+		"labels"
+	]),
+	timestamps: new Set([
+		"createdAt",
+		"updatedAt",
+		"modifiedAt",
+		"start",
+		"end",
+		"created_at",
+		"updated_at",
+		"modified_at"
+	]),
+	owner_activity: new Set([
+		"user",
+		"username",
+		"owner"
+	])
+};
+function consentFilteredText(textValue, allowedFields) {
+	if (!textValue) return void 0;
+	try {
+		const parsed = JSON.parse(textValue);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+		const allowedKeys = new Set([...allowedFields].flatMap((field) => [...CONSENT_FIELD_KEYS[field] ?? []]));
+		const filtered = Object.fromEntries(Object.entries(parsed).filter(([key]) => allowedKeys.has(key)));
+		return Object.keys(filtered).length ? JSON.stringify(filtered) : void 0;
+	} catch {
+		return allowedFields.has("content") ? textValue.slice(0, 24e3) : void 0;
+	}
+}
+function itemsAllowedByConsent(items, consent) {
+	if (!consent) return [];
+	const allowed = new Set(consent.allowedFields);
+	return items.map((item) => {
+		const filteredText = consentFilteredText(item.text, allowed);
+		return {
+			id: item.id,
+			sourceId: item.sourceId,
+			type: item.type,
+			title: allowed.has("title") ? item.title : item.type,
+			...filteredText ? { text: filteredText } : {},
+			...allowed.has("owner_activity") ? { ownerAttribution: item.ownerAttribution } : { ownerAttribution: "unknown" },
+			...allowed.has("timestamps") && item.occurredAt !== void 0 ? { occurredAt: item.occurredAt } : {},
+			...allowed.has("timestamps") && item.modifiedAt !== void 0 ? { modifiedAt: item.modifiedAt } : {},
+			...allowed.has("timestamps") && item.startsAt !== void 0 ? { startsAt: item.startsAt } : {},
+			...allowed.has("timestamps") && item.endsAt !== void 0 ? { endsAt: item.endsAt } : {},
+			...allowed.has("status") && item.group ? { group: item.group } : {},
+			evidenceRef: item.evidenceRef,
+			sensitivity: item.sensitivity
+		};
+	});
+}
 function connectedItemsForUnderstanding(items) {
 	return [...items].sort((left, right) => Number(right.itemType === "connected_content") - Number(left.itemType === "connected_content")).slice(0, MAX_CONNECTED_ITEMS).flatMap((item) => {
 		const value = normalizedValue(item);
@@ -67,7 +154,7 @@ function connectedItemsForUnderstanding(items) {
 	});
 }
 function isPortraitCandidate(candidate) {
-	return candidate.category === "preference" || candidate.category === "routine" || candidate.category === "communication";
+	return candidate.category === "role" || candidate.category === "responsibility" || candidate.category === "capability" || candidate.category === "preference" || candidate.category === "routine" || candidate.category === "communication";
 }
 function durableEvidence(candidate, items) {
 	const evidence = [...new Set(candidate.evidenceRefs ?? [])].flatMap((ref) => items.get(ref) ?? []);
@@ -75,6 +162,23 @@ function durableEvidence(candidate, items) {
 	const dates = new Set(evidence.map((item) => item.occurredAt ?? item.modifiedAt).filter((value) => value !== void 0).map((value) => new Date(value).toISOString().slice(0, 10)));
 	return candidate.confidence === "high" && evidence.every((item) => item.ownerAttribution === "user") && evidence.length >= required && dates.size >= required ? evidence : [];
 }
+function candidatePolicy(candidate) {
+	const statement = candidate.statement.toLocaleLowerCase();
+	const sensitivityCategories = [
+		["health", /\b(health|medical|diagnos|medication|therapy|disability)\b|健康|疾病|诊断|用药|治疗|残疾/i],
+		["financial", /\b(salary|income|debt|bank|account balance|credit card)\b|工资|收入|债务|银行|余额|信用卡/i],
+		["political", /\b(political|party|election|vote[dr]?)\b|政治|政党|选举|投票/i],
+		["religious", /\b(religio|church|mosque|temple|faith)\b|宗教|教会|清真寺|寺庙|信仰/i],
+		["sexuality", /\b(sexual|orientation|gender identity)\b|性取向|性别认同/i],
+		["trauma", /\b(trauma|abuse|assault)\b|创伤|虐待|侵害/i],
+		["credential", /\b(password|secret key|api key|token)\b|密码|密钥|令牌/i]
+	].filter(([, pattern]) => pattern.test(statement)).map(([name]) => name);
+	return {
+		domain: candidate.category === "role" ? "identity" : candidate.category === "responsibility" ? "goals" : candidate.category === "capability" ? "capabilities" : candidate.category === "routine" ? "behavior" : "preferences",
+		sensitivity: sensitivityCategories.length ? sensitivityCategories.includes("health") || sensitivityCategories.includes("financial") ? "regulated" : "personal" : "normal",
+		sensitivityCategories
+	};
+}
 async function deriveConnectedSourceUnderstanding(input) {
 	const sourceItems = [...new Set(input.sourceItemIds)].slice(0, MAX_CONNECTED_ITEMS).flatMap((itemId) => getKnowledgeSourceItem(itemId) ?? []).filter((item) => item.sourceInstanceId === input.sourceInstanceId && item.metadata.agentId === input.agentId && !item.deletedAt);
 	const items = connectedItemsForUnderstanding(sourceItems);
@@ -91,14 +195,23 @@ async function deriveConnectedSourceUnderstanding(input) {
 			status: "completed"
 		};
 	}
+	const sourceRun = getUnderstandingSourceRun(input.sourceRunId);
+	const consentReceipt = sourceRun ? getActiveUnderstandingConsent(sourceRun.grantId) ?? void 0 : void 0;
+	const modelItems = itemsAllowedByConsent(items, consentReceipt);
+	recordConnectedSourceObservations({
+		items: sourceItems,
+		consent: consentReceipt,
+		sourceGrantId: sourceRun?.grantId
+	});
+	const effectiveProcessingPolicy = input.processingPolicy === "remote_allowed" && consentReceipt?.processingPolicy === "remote_allowed" ? "remote_allowed" : "local_only";
 	const extraction = claimRegisteredExtraction({
 		extractorId: "connector-semantic",
 		sourceRef: `understanding-source-run:${input.sourceRunId}`,
 		contentForHash: sourceItems.map((item) => `${item.id}:${item.contentHash}`).join("\n"),
-		processingPolicy: input.processingPolicy,
+		processingPolicy: effectiveProcessingPolicy,
 		destination: "remote_model"
 	});
-	if (!allowsRemoteSourceProcessing([input.processingPolicy]) || !extraction.shouldExecute) return {
+	if (!allowsRemoteSourceProcessing([effectiveProcessingPolicy]) || !extraction.shouldExecute) return {
 		created: 0,
 		knowledgeCount: 0,
 		status: "completed"
@@ -106,16 +219,17 @@ async function deriveConnectedSourceUnderstanding(input) {
 	try {
 		const analysis = await (input.analyze ?? analyzeUnderstandingSources)({
 			config: input.config,
-			items
+			items: modelItems
 		});
 		input.assertAuthorized?.();
-		const byRef = new Map(items.map((item) => [item.evidenceRef, item]));
+		const byRef = new Map(modelItems.map((item) => [item.evidenceRef, item]));
 		const outputs = [];
 		let created = 0;
 		for (const candidate of analysis.profileCandidates.filter(isPortraitCandidate)) {
+			const policy = candidatePolicy(candidate);
 			const evidenceItems = durableEvidence(candidate, byRef);
 			const candidateKey = `connected-profile:${candidate.category}:${candidate.factKey}`;
-			if (!evidenceItems.length) {
+			if (!evidenceItems.length || !consentReceipt || !consentReceipt.allowedDomains.includes(policy.domain) || consentReceipt.deniedDomains.includes(policy.domain)) {
 				outputs.push({
 					candidateKey,
 					outcome: "rejected"
@@ -141,7 +255,7 @@ async function deriveConnectedSourceUnderstanding(input) {
 					predicate: `${candidate.category}.connected.${candidate.factKey}`,
 					cardinality: "single",
 					scope: { type: "global" },
-					kind: candidate.category === "communication" ? "preference" : candidate.category,
+					kind: candidate.category === "role" ? "identity" : candidate.category === "responsibility" ? "derived_insight" : candidate.category === "communication" ? "preference" : candidate.category,
 					value: candidate.statement,
 					normalizedValue: candidate.statement.toLocaleLowerCase(),
 					statement: candidate.statement,
@@ -151,7 +265,18 @@ async function deriveConnectedSourceUnderstanding(input) {
 					consequence: "medium",
 					actionability: .6,
 					volatility: candidate.category === "routine" || candidate.category === "communication" ? "slow" : "stable",
-					sensitivity: "normal",
+					sensitivity: policy.sensitivity,
+					domain: policy.domain,
+					layer: "pattern",
+					sensitivityCategories: policy.sensitivityCategories,
+					purposeIds: ["personalization", "work_assistance"],
+					allowedUses: [
+						"answer",
+						"rank",
+						"recommend"
+					],
+					allowedAgentIds: consentReceipt.allowedAgentIds,
+					consentReceiptId: consentReceipt.id,
 					disclosurePolicy: "referenceable",
 					observedAt: evidenceItem.occurredAt ?? evidenceItem.modifiedAt ?? Date.now(),
 					createdBy: "connector",
@@ -182,6 +307,71 @@ async function deriveConnectedSourceUnderstanding(input) {
 				});
 				continue;
 			}
+			const goalEvidence = evidenceRefs.flatMap((ref) => {
+				const item = byRef.get(ref);
+				return item?.ownerAttribution === "user" ? [item] : [];
+			});
+			if (consentReceipt?.allowedDomains.includes("goals") && !consentReceipt.deniedDomains.includes("goals") && thread.confidence !== "low" && goalEvidence.length) {
+				const observedAt = Math.max(...goalEvidence.map((item) => item.occurredAt ?? item.modifiedAt ?? Date.now()));
+				const validityDays = thread.horizon === "current" ? 30 : thread.horizon === "ongoing" ? 90 : 365;
+				let goalCreated = false;
+				for (const evidenceItem of goalEvidence) {
+					const evidence = createContextEvidence({
+						sourceType: "connector",
+						sourceInstanceId: input.sourceInstanceId,
+						sourceRef: evidenceItem.evidenceRef,
+						redactedExcerpt: evidenceItem.title.slice(0, 600),
+						trustLevel: "owner",
+						observedAt: evidenceItem.occurredAt ?? evidenceItem.modifiedAt ?? observedAt
+					});
+					const result = reconcileAssertion({
+						subject: {
+							type: "goal",
+							id: thread.topicKey
+						},
+						predicate: "goal.connected.current_state",
+						cardinality: "single",
+						scope: { type: "global" },
+						kind: "current_state",
+						value: {
+							title: thread.title,
+							summary: thread.summary,
+							status: thread.status
+						},
+						normalizedValue: `${thread.status}:${thread.title}:${thread.summary}`.toLocaleLowerCase(),
+						statement: `${thread.title}: ${thread.summary}`,
+						authority: "user_observed",
+						confidence: thread.confidence === "high" ? .9 : .72,
+						inferredImportance: thread.horizon === "current" ? .8 : .65,
+						consequence: "medium",
+						actionability: .85,
+						volatility: "event",
+						sensitivity: "normal",
+						domain: "goals",
+						layer: "fact",
+						sensitivityCategories: [],
+						purposeIds: ["personalization", "work_assistance"],
+						allowedUses: [
+							"answer",
+							"rank",
+							"recommend",
+							"remind"
+						],
+						allowedAgentIds: consentReceipt.allowedAgentIds,
+						consentReceiptId: consentReceipt.id,
+						disclosurePolicy: "referenceable",
+						observedAt,
+						validFrom: observedAt,
+						validTo: observedAt + validityDays * 864e5,
+						reviewAt: observedAt + Math.min(validityDays, 14) * 864e5,
+						createdBy: "connector",
+						evidenceId: evidence.id,
+						evidenceConfidence: thread.confidence === "high" ? .9 : .72
+					});
+					goalCreated ||= result.action === "created" || result.action === "superseded";
+				}
+				if (goalCreated) created += 1;
+			}
 			const result = writeKnowledgeItem({
 				kind: "work_thread",
 				scope: { type: "global" },

package/dist/src/connectors/learning-coordinator.js

@@ -3,19 +3,18 @@ import { init_logger } from "../utils/logger.js";
 import { claimNextConnectorLearningJob, enqueueConnectorLearningJob, listConnectorLearningJobs, recoverStaleConnectorLearningJobs, setConnectorLearningPaused, updateConnectorLearningJob } from "../storage/sqlite/connector-learning-repository.js";
 import { getConnectorAccount, reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
 import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
+import { pruneBoundedKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { buildConnectorLearningArguments, getConnectorLearningPlan } from "./learning-recipes.js";
 import { getConnectorDefinition } from "./catalog.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
-import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
-import "../knowledge/index.js";
 import { ingestComposioConnectedSource } from "./connected-source-ingestion.js";
+import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { deriveConnectedSourceUnderstanding } from "./connected-source-understanding.js";
 import { listConnectedContentCandidates, readConnectedContent } from "./content-enrichment.js";
-import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 //#region src/connectors/learning-coordinator.ts
 init_sqlite();
 init_logger();
@@ -33,25 +32,60 @@ function connectorSourceCategory(toolkit) {
 	if (toolkit === "github" || toolkit === "linear") return "code_activity";
 	return "files";
 }
-function ensureUnderstandingSourceRun(job, toolkit, displayName) {
+function ensureUnderstandingSourceRun(job, toolkit, displayName, config) {
 	const existing = listUnderstandingSourceGrants({ includeRevoked: true }).find((grant) => grant.sourceKey === `connector-account:${job.accountId}`);
 	if (existing?.status === "revoked") throw new Error("Source authorization was revoked.");
+	const grant = existing ?? upsertUnderstandingSourceGrant({
+		sourceKey: `connector-account:${job.accountId}`,
+		adapterId: `connector:${job.connectorId}`,
+		category: connectorSourceCategory(toolkit),
+		platform: "all",
+		displayName,
+		accessMode: "continuous",
+		retentionPolicy: config.userContext.userModel.processingPolicy === "remote_allowed" ? "derived_only" : "bounded_raw",
+		processingPolicy: config.userContext.userModel.processingPolicy,
+		config: {
+			connectorId: job.connectorId,
+			accountId: job.accountId,
+			readOnly: true
+		}
+	});
+	if (!getActiveUnderstandingConsent(grant.id)) grantUnderstandingConsent({
+		grantId: grant.id,
+		purposes: ["personalization", "work_assistance"],
+		allowedDomains: [
+			"identity",
+			"goals",
+			"capabilities",
+			"behavior",
+			"preferences",
+			"relationships",
+			"environment",
+			"digital_life"
+		],
+		deniedDomains: [
+			"health",
+			"emotion",
+			"life_history",
+			"resources_constraints"
+		],
+		allowedFields: [
+			"title",
+			"content",
+			"timestamps",
+			"participants",
+			"owner_activity",
+			"status"
+		],
+		accessMode: grant.accessMode,
+		lookbackDays: getConnectorLearningPlan(toolkit)?.bootstrapWindowDays ?? 30,
+		rawRetentionDays: grant.retentionPolicy === "bounded_raw" ? 7 : 0,
+		processingPolicy: grant.processingPolicy,
+		allowedAgentIds: [job.agentId],
+		disclosureVersion: "connector-understanding-v1"
+	});
 	return getOrCreateConnectorUnderstandingSourceRun({
-		grantId: (existing ?? upsertUnderstandingSourceGrant({
-			sourceKey: `connector-account:${job.accountId}`,
-			adapterId: `connector:${job.connectorId}`,
-			category: connectorSourceCategory(toolkit),
-			platform: "all",
-			displayName,
-			accessMode: "continuous",
-			retentionPolicy: "bounded_raw",
-			processingPolicy: "remote_allowed",
-			config: {
-				connectorId: job.connectorId,
-				accountId: job.accountId,
-				readOnly: true
-			}
-		})).id,
+		grantId: grant.id,
 		connectorLearningJobId: job.id,
 		kind: job.mode,
 		status: "queued",
@@ -105,7 +139,7 @@ function startConnectorLearningCoordinator(options) {
 			idempotencyKey: request.idempotencyKey ?? (mode === "bootstrap" ? `bootstrap:${connection.accountId}:v1` : `incremental:${connection.accountId}:${request.reason ?? "manual"}:${bucket}`),
 			nextRunAt: request.nextRunAt
 		});
-		ensureUnderstandingSourceRun(job, definition.runtime.toolkit, definition.displayName);
+		ensureUnderstandingSourceRun(job, definition.runtime.toolkit, definition.displayName, options.getConfig());
 		publish(job);
 		queueMicrotask(() => void runNow());
 		return job;
@@ -123,7 +157,7 @@ function startConnectorLearningCoordinator(options) {
 		if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error(`Connector learning is unavailable for ${job.connectorId}.`);
 		const plan = getConnectorLearningPlan(definition.runtime.toolkit);
 		if (!plan) throw new Error(`Connector learning has no plan for ${definition.runtime.toolkit}.`);
-		const sourceRun = ensureUnderstandingSourceRun(job, plan.toolkit, definition.displayName);
+		const sourceRun = ensureUnderstandingSourceRun(job, plan.toolkit, definition.displayName, options.getConfig());
 		updateUnderstandingSourceRun(sourceRun.id, { status: "running" });
 		let connection = listConnectorConnections().find((candidate) => candidate.id === job.connectionId);
 		if (!connection) throw new Error("Connector account no longer exists.");
@@ -286,10 +320,13 @@ function startConnectorLearningCoordinator(options) {
 			lastCollectedAt: Date.now()
 		});
 		publish(completed);
-		const retention = new ConnectedKnowledgePipeline({
-			agentId: job.agentId,
-			workspaceId: getWorkspacePath(options.getConfig())
-		}).pruneBoundedRetention(job.sourceInstanceId, Date.now() - plan.bootstrapWindowDays * 24 * 60 * 6e4);
+		const sourceGrant = getUnderstandingSourceGrant(sourceRun.grantId);
+		const activeConsent = getActiveUnderstandingConsent(sourceRun.grantId);
+		const rawRetentionDays = sourceGrant?.retentionPolicy === "bounded_raw" ? activeConsent?.rawRetentionDays ?? 7 : 0;
+		const retention = {
+			rawDeleted: pruneBoundedKnowledgeSourceItems(job.sourceInstanceId, rawRetentionDays === 0 ? Date.now() + 1 : Date.now() - rawRetentionDays * 864e5),
+			derivedDeleted: 0
+		};
 		if (retention.rawDeleted || retention.derivedDeleted) log.info({
 			jobId: job.id,
 			sourceInstanceId: job.sourceInstanceId,

package/dist/src/connectors/learning-recipes.js

@@ -12,9 +12,16 @@ function buildConnectorLearningArguments(plan, stream, input, identity) {
 	}
 	if (plan.toolkit === "gmail") {
 		const after = cursor?.checkpoint ? Math.floor(Date.parse(cursor.checkpoint) / 1e3) : NaN;
+		const baseQuery = typeof stream.arguments.query === "string" ? stream.arguments.query.trim() : "";
+		const incrementalQuery = Number.isFinite(after) ? `after:${after}` : "";
 		return {
 			...stream.arguments,
-			...Number.isFinite(after) ? { query: `after:${after} -in:spam -in:trash` } : {},
+			...baseQuery || incrementalQuery ? { query: [
+				baseQuery,
+				incrementalQuery,
+				"-in:spam",
+				"-in:trash"
+			].filter(Boolean).join(" ") } : {},
 			...cursor?.pageToken ? { page_token: cursor.pageToken } : {}
 		};
 	}
@@ -39,6 +46,16 @@ const PLANS = {
 		toolkit: "gmail",
 		identityProbe: { actionId: "GMAIL_GET_PROFILE" },
 		streams: [{
+			scope: "sent-messages",
+			actionId: "GMAIL_FETCH_EMAILS",
+			kind: "activity",
+			arguments: {
+				max_results: 30,
+				include_payload: true,
+				verbose: false,
+				query: "in:sent newer_than:30d"
+			}
+		}, {
 			scope: "messages",
 			actionId: "GMAIL_FETCH_EMAILS",
 			kind: "activity",
@@ -46,7 +63,7 @@ const PLANS = {
 				max_results: 30,
 				include_payload: true,
 				verbose: false,
-				query: "newer_than:30d -in:spam -in:trash"
+				query: "newer_than:30d -in:sent"
 			}
 		}],
 		bootstrapWindowDays: 30,

package/dist/src/discussions/audio-repair.d.ts

@@ -1,4 +1,4 @@
-import type { DecodedPcmAudio } from '../voice/local/wav.js';
+import type { DecodedPcmAudio } from '../voice/audio/wav.js';
 export interface AudioRange {
     startedAtMs: number;
     endedAtMs: number;

package/dist/src/discussions/live-worker.js

@@ -51,9 +51,7 @@ var DiscussionLiveWorker = class {
 	}
 	resolveConcurrency() {
 		if (this.deps.transcribeSegment) return this.concurrency;
-		const config = this.deps.getConfig();
-		const sttConfig = mergeSttConfigFromAppConfig(config.tools?.media?.audio, config.tools?.media);
-		return sttConfig.provider === "xopc-local" || sttConfig.provider === "local" ? 1 : this.concurrency;
+		return this.concurrency;
 	}
 	async processOne() {
 		const segment = claimNextDiscussionTranscriptSegment(this.owner);

package/dist/src/discussions/recording.js

@@ -1,11 +1,11 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { DISCUSSION_MAX_DURATION_MS } from "../../packages/gateway-contract/src/discussions.js";
 import { init_src } from "../../packages/gateway-contract/src/index.js";
-import { decodeWavToMonoFloat32 } from "../voice/local/wav.js";
-import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
 import { resolveNoteMediaDir } from "../notes/paths.js";
 import { DiscussionServiceError } from "./errors.js";
 import { getDiscussionCapture, updateDiscussionCapture } from "./repository.js";
+import { decodeWavToMonoFloat32 } from "../voice/audio/wav.js";
+import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
 import { join } from "node:path";
 import { createReadStream } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";

package/dist/src/discussions/sealer.js

@@ -1,7 +1,5 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { decodeWavToMonoFloat32 } from "../voice/local/wav.js";
-import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
 import { transcribe } from "../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../voice/stt/availability.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
@@ -10,6 +8,8 @@ import { getDiscussionCapture, listDiscussionCaptures, listDiscussionTranscriptS
 import { assembleDiscussionTranscript } from "./transcript.js";
 import { replaceTranscriptSegments, saveTranscriptRevision } from "./revisions.js";
 import { missingAudioRanges, slicePcmWav } from "./audio-repair.js";
+import { decodeWavToMonoFloat32 } from "../voice/audio/wav.js";
+import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
 import { getRecordingJob } from "./recordingJobs.js";
 import { createHash } from "node:crypto";
 //#region src/discussions/sealer.ts

package/dist/src/extensions/agent-plugins/auth.d.ts

@@ -22,6 +22,8 @@ declare const bindingSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type PluginAuthBinding = z.infer<typeof bindingSchema>;
+export declare const pluginCredentialProviderPrefix: (id: string) => string;
+export declare const parsePluginAuthBinding: (value: unknown) => PluginAuthBinding;
 export declare function pluginEndpointFingerprint(server: PluginServer): string;
 export declare function readPluginAuthBinding(store: AgentPluginStore, id: string, name: string, server: PluginServer): PluginAuthBinding | undefined;
 export declare function savePluginAuthBinding(store: AgentPluginStore, id: string, name: string, input: {
@@ -34,6 +36,4 @@ export declare function savePluginAuthBinding(store: AgentPluginStore, id: strin
     }>;
 }): Promise<void>;
 export declare function applyPluginAuthBinding(raw: Record<string, unknown>, binding: PluginAuthBinding | undefined): Record<string, unknown>;
-export declare function pluginOAuthScope(raw: unknown): string | undefined;
-export declare function removePluginCredentials(store: AgentPluginStore, id: string): Promise<void>;
 export {};

package/dist/src/extensions/agent-plugins/auth.js

@@ -1,12 +1,11 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { pluginName, pluginServerId } from "./validation.js";
+import { pluginName } from "./validation.js";
 import { clearPluginMcpHealth } from "./health.js";
 import { isDangerousHostEnvVarName } from "../../infra/host-env-security.js";
-import { McpOAuthStore } from "../../agent/mcp/oauth/mcp-oauth-store.js";
 import { join } from "node:path";
-import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { validateHeaderName } from "node:http";
@@ -32,7 +31,8 @@ const bindingSchema = z.strictObject({
 	}))
 });
 const hash = (value) => createHash("sha256").update(value).digest("hex");
-const providerPrefix = (id) => `plugin-${hash(id).slice(0, 16)}-`;
+const pluginCredentialProviderPrefix = (id) => `plugin-${hash(id).slice(0, 16)}-`;
+const parsePluginAuthBinding = (value) => bindingSchema.parse(value);
 function pluginEndpointFingerprint(server) {
 	return hash(server.type === "stdio" ? JSON.stringify(server) : new URL(server.url).toString());
 }
@@ -71,7 +71,7 @@ async function savePluginAuthBinding(store, id, name, input) {
 		const normalizedKey = field.target === "headers" || process.platform === "win32" ? field.key.toLowerCase() : field.key;
 		if (seen.has(normalizedKey)) throw new Error("Duplicate credential field");
 		seen.add(normalizedKey);
-		const provider = `${providerPrefix(id)}${hash(JSON.stringify([
+		const provider = `${pluginCredentialProviderPrefix(id)}${hash(JSON.stringify([
 			"owner",
 			id,
 			name,
@@ -123,34 +123,5 @@ function applyPluginAuthBinding(raw, binding) {
 	result.xopcAuthRevision = hash(JSON.stringify(binding));
 	return result;
 }
-function pluginOAuthScope(raw) {
-	const plugin = raw?.xopcPlugin;
-	return plugin ? `owner:${pluginServerId(plugin.id, plugin.serverName)}` : void 0;
-}
-async function removePluginCredentials(store, id) {
-	pluginName.parse(id);
-	const plugin = store.get(id);
-	const serverNames = new Set(Object.keys(plugin?.servers ?? {}));
-	const dir = join(store.stateDir, "plugin-auth", id);
-	if (existsSync(dir)) for (const file of readdirSync(dir)) {
-		if (!/^[a-f0-9]{64}\.json$/.test(file)) throw new Error("Unexpected plugin auth store entry");
-		const binding = bindingSchema.parse(JSON.parse(readFileSync(join(dir, file), "utf8")));
-		serverNames.add(binding.serverName);
-	}
-	const { getMcpOAuthManager } = await import("../../agent/mcp/oauth/mcp-oauth-manager.js");
-	for (const name of serverNames) {
-		await getMcpOAuthManager({ xopcPlugin: {
-			id,
-			serverName: name
-		} }).cancelPending();
-		await new McpOAuthStore(`owner:${pluginServerId(id, name)}`).deleteScope();
-	}
-	const resolver = new CredentialResolver(store.stateDir === resolveStateDir() ? {} : { stateDir: store.stateDir });
-	for (const profile of await resolver.listProfiles()) if (profile.provider.startsWith(providerPrefix(id))) await resolver.deleteProviderCredential(profile.provider);
-	if (existsSync(dir)) rmSync(dir, {
-		recursive: true,
-		force: true
-	});
-}
 //#endregion
-export { applyPluginAuthBinding, pluginEndpointFingerprint, pluginOAuthScope, readPluginAuthBinding, removePluginCredentials, savePluginAuthBinding };
+export { applyPluginAuthBinding, parsePluginAuthBinding, pluginCredentialProviderPrefix, pluginEndpointFingerprint, readPluginAuthBinding, savePluginAuthBinding };

package/dist/src/extensions/agent-plugins/credentials.d.ts

@@ -0,0 +1,2 @@
+import { AgentPluginStore } from './store.js';
+export declare function removePluginCredentials(store: AgentPluginStore, id: string): Promise<void>;

package/dist/src/extensions/agent-plugins/credentials.js

@@ -0,0 +1,37 @@
+import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
+import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
+import { pluginName, pluginServerId } from "./validation.js";
+import { parsePluginAuthBinding, pluginCredentialProviderPrefix } from "./auth.js";
+import { McpOAuthStore } from "../../agent/mcp/oauth/mcp-oauth-store.js";
+import { getMcpOAuthManager } from "../../agent/mcp/oauth/mcp-oauth-manager.js";
+import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+//#region src/extensions/agent-plugins/credentials.ts
+init_credentials();
+init_paths_state();
+async function removePluginCredentials(store, id) {
+	pluginName.parse(id);
+	const plugin = store.get(id);
+	const serverNames = new Set(Object.keys(plugin?.servers ?? {}));
+	const dir = join(store.stateDir, "plugin-auth", id);
+	if (existsSync(dir)) for (const file of readdirSync(dir)) {
+		if (!/^[a-f0-9]{64}\.json$/.test(file)) throw new Error("Unexpected plugin auth store entry");
+		const binding = parsePluginAuthBinding(JSON.parse(readFileSync(join(dir, file), "utf8")));
+		serverNames.add(binding.serverName);
+	}
+	for (const name of serverNames) {
+		await getMcpOAuthManager({ xopcPlugin: {
+			id,
+			serverName: name
+		} }).cancelPending();
+		await new McpOAuthStore(`owner:${pluginServerId(id, name)}`).deleteScope();
+	}
+	const resolver = new CredentialResolver(store.stateDir === resolveStateDir() ? {} : { stateDir: store.stateDir });
+	for (const profile of await resolver.listProfiles()) if (profile.provider.startsWith(pluginCredentialProviderPrefix(id))) await resolver.deleteProviderCredential(profile.provider);
+	if (existsSync(dir)) rmSync(dir, {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
+export { removePluginCredentials };

package/dist/src/extensions/agent-plugins/plugin-oauth-scope.d.ts

@@ -0,0 +1 @@
+export declare function pluginOAuthScope(raw: unknown): string | undefined;

package/dist/src/extensions/agent-plugins/plugin-oauth-scope.js

@@ -0,0 +1,8 @@
+import { pluginServerId } from "./validation.js";
+//#region src/extensions/agent-plugins/plugin-oauth-scope.ts
+function pluginOAuthScope(raw) {
+	const plugin = raw?.xopcPlugin;
+	return plugin ? `owner:${pluginServerId(plugin.id, plugin.serverName)}` : void 0;
+}
+//#endregion
+export { pluginOAuthScope };