@xopcai/xopc 0.0.332 → 0.0.334

package/dist/src/gateway/agents-admin.js

@@ -1,11 +1,11 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { join, resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/home-intelligence-automation-reconciler.js

@@ -11,7 +11,10 @@ async function reconcileHomeIntelligenceAutomation(automationService) {
 		},
 		safety: { mode: "auto_apply" },
 		conversationMode: "new_session",
-		notificationPolicy: "none",
+		delivery: {
+			notificationPolicy: "none",
+			destinations: []
+		},
 		reliability: { disableAfterConsecutiveFailures: 3 },
 		management: {
 			owner: "home-intelligence",

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,8 +1,8 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
-import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -2,7 +2,8 @@ import { parseUserTurnDocument, userTurnDocumentRefIds } from "../../../../packa
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
-import { replaceLatestSessionTurn, submitSessionInput } from "./session-input-handler.js";
+import { replaceLatestSessionTurn } from "./session-input-handler.js";
+import { handleSessionCommand, handleSessionInputReceipt, handleSessionPreparationRetry } from "./session-command-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 init_src();
 function registerAgentStreamRoutes(authenticated, deps) {
@@ -38,8 +39,11 @@ function registerAgentStreamRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/sessions/:conversationId/inputs", chatRateLimitMiddleware, async (c) => {
-		return submitSessionInput(c, deps, (c.req.param("conversationId") ?? "").trim());
+		return handleSessionCommand(c, deps);
 	});
+	authenticated.post("/api/sessions/:conversationId/materialize", chatRateLimitMiddleware, (c) => handleSessionCommand(c, deps, true));
+	authenticated.get("/api/sessions/:conversationId/input-receipts/:clientMessageId", (c) => handleSessionInputReceipt(c, deps));
+	authenticated.post("/api/sessions/:conversationId/preparation/retry", chatRateLimitMiddleware, (c) => handleSessionPreparationRetry(c, deps));
 	authenticated.post("/api/sessions/:conversationId/turns/:turnId/replace", chatRateLimitMiddleware, async (c) => {
 		return replaceLatestSessionTurn(c, deps, (c.req.param("conversationId") ?? "").trim(), (c.req.param("turnId") ?? "").trim());
 	});

package/dist/src/gateway/hono/routes/browser-session.js

@@ -1,12 +1,14 @@
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { BrowserSessionLimitError, createBrowserSession, deleteBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
 import { browserCookieRequestAllowed, clearBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 //#region src/gateway/hono/routes/browser-session.ts
+init_gateway_identity_repository();
 function registerBrowserSessionRoutes(app, deps) {
 	app.get("/api/browser-session", (c) => {
 		c.header("Cache-Control", "no-store");
 		const principal = getGatewayPrincipal(c);
-		return c.json({ conversationId: principal.principalId });
+		return c.json({ conversationId: `${getOrCreateGatewayIdentity().id}:${principal.principalId}` });
 	});
 	app.post("/api/browser-session", deps.strictRateLimitMiddleware, (c) => {
 		const principal = getGatewayPrincipal(c);
@@ -24,7 +26,7 @@ function registerBrowserSessionRoutes(app, deps) {
 		}
 		writeBrowserSessionCookie(c, session.token, session.expiresAt);
 		c.header("Cache-Control", "no-store");
-		return c.json({ conversationId: `browser:${session.sessionId}` });
+		return c.json({ conversationId: `${getOrCreateGatewayIdentity().id}:browser:${session.sessionId}` });
 	});
 	app.delete("/api/browser-session", (c) => {
 		if (!browserCookieRequestAllowed(c)) return c.json({ error: "Forbidden" }, 403);

package/dist/src/gateway/hono/routes/capabilities.js

@@ -55,7 +55,7 @@ function registerCapabilityRoutes(authenticated, deps) {
 		try {
 			const { instance, plan } = await persistConfigMutation({
 				config,
-				mutate: () => installStoreConnector(config, c.req.param("name"), input, optionalVersion(body)),
+				mutate: () => installStoreConnector(config, c.req.param("name"), input, optionalVersion(body), typeof body.reviewHash === "string" ? body.reviewHash : void 0),
 				save: () => service.saveConfig(config)
 			});
 			return c.json({

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,8 +1,11 @@
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { effectiveWorkspacePathForSession } from "../../../session/session-workspace.js";
+import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
+import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
+import { ProjectService } from "../../../projects/project-service.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
 import "../../../agent/skills/skills-marketplace.js";
+import "../../../projects/index.js";
 import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
 import { commandRegistry } from "../../../chat-commands/registry.js";
 import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
@@ -62,7 +65,11 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 	authenticated.get("/api/review/context", async (c) => {
 		const conversationId = c.req.query("conversationId")?.trim();
 		try {
-			const payload = await buildReviewContext(await resolveGitRoot(effectiveWorkspacePathForSession(service.getConfig(), conversationId, null, getProjectForSession(conversationId))));
+			const agentId = c.req.query("agentId")?.trim();
+			const projectId = c.req.query("projectId")?.trim();
+			const project = !conversationId && projectId ? new ProjectService().get(projectId) : null;
+			if (!conversationId && projectId && !project) throw new Error("Project not found");
+			const payload = await buildReviewContext(await resolveGitRoot(!conversationId && agentId ? projectWorkspacePath(project) ?? resolveEffectiveAgentProfile(agentId).resolvedWorkspacePath : effectiveWorkspacePathForSession(service.getConfig(), conversationId, null, getProjectForSession(conversationId))));
 			return c.json({
 				ok: true,
 				payload

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,10 +1,10 @@
-import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
+import { AgentCatalogService } from "../../../../agent-catalog/service.js";
+import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
-import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -6,9 +6,9 @@ const actionSchema = z.object({
 	expectedVersion: z.number().int().positive(),
 	idempotencyKey: z.string().min(1).max(200),
 	action: z.enum([
+		"install_complete",
 		"connect",
 		"check",
-		"continue",
 		"skip",
 		"cancel",
 		"select_account",
@@ -19,7 +19,8 @@ const actionSchema = z.object({
 	candidateRef: z.string().optional(),
 	needKey: z.string().optional(),
 	accountId: z.string().optional(),
-	callbackUrl: z.string().max(16384).optional()
+	callbackUrl: z.string().max(16384).optional(),
+	instanceId: z.string().optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
 	app.get("/api/sessions/:conversationId/connection-wait", (c) => {

package/dist/src/gateway/hono/routes/files.js

@@ -1,5 +1,6 @@
 import { FileServiceError, fileResourceFromPath, parseFileResourceId, resolveFilePath } from "../../../files/file-service.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
+import { getSessionPreparation } from "../../../storage/sqlite/session-creation-repository.js";
 import { fuzzySearchWorkspaceFiles, fuzzySubsequenceScore } from "../../workspace-file-search.js";
 import { registerFileReferenceRoutes } from "./file-references.js";
 import { basename, join } from "node:path";
@@ -55,6 +56,8 @@ function registerFilesRoutes(authenticated, deps) {
 		try {
 			const kind = c.req.param("kind");
 			if (kind !== "agent" && kind !== "project" && kind !== "session") throw new FileServiceError(400, "Invalid context kind");
+			const preparation = kind === "session" ? getSessionPreparation(c.req.param("id")) : void 0;
+			if (preparation && preparation.state !== "ready") throw new FileServiceError(409, "Session environment is not ready");
 			return c.json({ space: publicSpace(await files.forContext(kind, c.req.param("id"))) });
 		} catch (error) {
 			return errorResponse(c, error);

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -238,7 +238,12 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 	},
 	{
 		id: "automations",
-		match: (path) => startsWithAny(path, ["/api/automations", "/api/automation-runs"]),
+		match: (path) => startsWithAny(path, [
+			"/api/automations",
+			"/api/automation-runs",
+			"/api/automation-events",
+			"/api/automation-deliveries"
+		]),
 		load: async () => {
 			const { registerAutomationRoutes } = await import("../../../automations/api/routes.js");
 			return { register: registerAutomationRoutes };
@@ -284,6 +289,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerLogsRoutes };
 		}
 	},
+	{
+		id: "usage",
+		match: (path) => startsWithAny(path, ["/api/usage"]),
+		load: async () => {
+			const { registerUsageRoutes } = await import("./usage.js");
+			return { register: registerUsageRoutes };
+		}
+	},
 	{
 		id: "shares",
 		match: (path) => startsWithAny(path, ["/api/shares", "/api/hosted-publications"]) || /^\/api\/notes\/[^/]+\/hosted-publications(?:\/.*)?$/.test(path) || /^\/api\/sessions\/[^/]+\/(?:share-preview|shares|hosted-shares)(?:\/.*)?$/.test(path),

package/dist/src/gateway/hono/routes/models.js

@@ -8,6 +8,7 @@ import { CredentialResolver, init_credentials } from "../../../auth/credentials.
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
 import "../../../capabilities/readiness/index.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
@@ -325,9 +326,24 @@ function registerModelsRoutes(authenticated, deps) {
 			if (a.provider !== b.provider) return a.provider.localeCompare(b.provider);
 			return a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
 		});
+		const agentId = c.req.query("agentId")?.trim();
+		let defaultId;
+		if (agentId) try {
+			const configured = resolveEffectiveAgentConfigForAgent(agentId).config.models.chat.primary;
+			const matches = models.filter((model) => model.id === configured || model.id.endsWith(`/${configured}`));
+			defaultId = models.find((model) => model.id === configured)?.id ?? (matches.length === 1 ? matches[0].id : configured);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: { message: error instanceof Error ? error.message : "Invalid agent" }
+			}, 400);
+		}
 		return c.json({
 			ok: true,
-			payload: { models }
+			payload: {
+				models,
+				...defaultId ? { defaultId } : {}
+			}
 		});
 	});
 	authenticated.get("/api/image-generation/catalog", (c) => {

package/dist/src/gateway/hono/routes/notes.js

@@ -1,9 +1,9 @@
 import { NoteDeleteOutputSchema, NoteGetOutputSchema, ProductReadContracts } from "../../../../packages/gateway-contract/src/capabilities.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { init_session_key, resolveConversationId } from "../../../routing/session-key.js";
-import { agentExists, getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
 import { CapabilityError } from "../../../capabilities/runtime/errors.js";
 import "../../../capabilities/runtime/dispatcher.js";
+import { init_session_key, resolveConversationId } from "../../../routing/session-key.js";
+import { agentExists, getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
 import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
 import { getShareStore } from "../../../share/share-store.js";
 import { resolveShareUrl } from "../../../share/share-url.js";
@@ -269,7 +269,6 @@ function registerNotesRoutes(authenticated, deps) {
 					...projectId ? { projectId } : {},
 					customData: {
 						...meta?.customData ?? {},
-						genericNewChatShell: false,
 						sourceBinding
 					}
 				});
@@ -310,7 +309,6 @@ function registerNotesRoutes(authenticated, deps) {
 			tags: Array.from(new Set([...meta?.tags ?? [], "note"])),
 			customData: {
 				...meta?.customData ?? {},
-				genericNewChatShell: false,
 				sourceBinding
 			}
 		});

package/dist/src/gateway/hono/routes/projects.js

@@ -7,12 +7,12 @@ import { loadTranscriptRowsForSession } from "../../../storage/sqlite/transcript
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { ActivityService } from "../../../activity/service.js";
 import "../../../activity/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { listKnowledgeItems, writeKnowledgeItem } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
-import { CapabilityError } from "../../../capabilities/runtime/errors.js";
-import "../../../capabilities/runtime/dispatcher.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../../../projects/workspace-project.js";
 import { inferProjectExecutionMode, inferProjectKind } from "../../../projects/project-kind.js";
 import { ProjectDeletionBlockedError, ProjectWorkspaceInUseError } from "../../../projects/project-service.js";

package/dist/src/gateway/hono/routes/public-gateway.js

@@ -1,10 +1,11 @@
 import { PACKAGE_VERSION, init_package_version } from "../../../package-version.js";
 import { claimConnectorWebhookDelivery, completeConnectorWebhookDelivery, releaseConnectorWebhookDelivery } from "../../../storage/sqlite/connector-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
+import { resolveAutomationWebhookSecret } from "../../../automations/webhook-secrets.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { appendComposioTriggerEvent, applyComposioConnectionLifecycleEvent, normalizeComposioTriggerPayload, verifyComposioWebhook } from "../../../connectors/composio-triggers.js";
 import { serveStaticFile } from "../lib/static-ui.js";
-import { createHash } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/gateway/hono/routes/public-gateway.ts
 init_package_version();
 init_sqlite();
@@ -19,6 +20,9 @@ const PUBLIC_UI_ROOT_ASSETS = [
 	"pwa-512x512.png",
 	"site.webmanifest"
 ];
+function secretsEqual(actual, expected) {
+	return timingSafeEqual(createHash("sha256").update(actual).digest(), createHash("sha256").update(expected).digest());
+}
 function registerPublicGatewayRoutes(app, service) {
 	app.get("/health", (c) => {
 		return c.json(service.getHealth());
@@ -84,9 +88,16 @@ function registerPublicGatewayRoutes(app, service) {
 			if (inactiveConnectionId) service.setConnectorLearningPaused(inactiveConnectionId, true);
 			const event = await appendComposioTriggerEvent(service.currentConfig, archivedPayload);
 			if (normalized.toolkit) service.requestConnectorLearningForToolkit(normalized.toolkit);
-			const runs = await service.automationServiceInstance.triggerEvent({
+			const ingested = service.ingestAutomationEvent({
+				id: `connector:composio:${webhookId}`,
 				type: `connector.${normalized.trigger ?? normalized.type}`,
 				source: normalized.toolkit ? `composio:${normalized.toolkit}` : "composio",
+				subject: {
+					kind: "connector_event",
+					id: webhookId
+				},
+				dedupeKey: webhookId,
+				trust: "connector",
 				payload: {
 					...normalized.data,
 					connectorId: normalized.toolkit ? `composio-${normalized.toolkit}` : "composio",
@@ -98,7 +109,7 @@ function registerPublicGatewayRoutes(app, service) {
 				ok: true,
 				payload: {
 					eventId: event.id,
-					automationRuns: runs.length
+					automationDeliveries: ingested.deliveryCount
 				}
 			});
 		} catch (error) {
@@ -109,6 +120,85 @@ function registerPublicGatewayRoutes(app, service) {
 			}, 500);
 		}
 	});
+	app.post("/api/automation-hooks/:automationId", async (c) => {
+		const automationId = c.req.param("automationId");
+		const automation = await service.automationServiceInstance.get(automationId);
+		if (!automation || !automation.enabled || automation.trigger.kind !== "webhook") return c.json({
+			ok: false,
+			error: "Automation webhook not found."
+		}, 404);
+		const secretId = automation.trigger.secretId?.trim();
+		let expectedSecret;
+		try {
+			expectedSecret = secretId ? resolveAutomationWebhookSecret(secretId) : void 0;
+		} catch {
+			return c.json({
+				ok: false,
+				error: "Automation webhook secrets are misconfigured."
+			}, 503);
+		}
+		if (!expectedSecret) return c.json({
+			ok: false,
+			error: "Automation webhook secret is not configured."
+		}, 503);
+		const authorization = c.req.header("authorization")?.trim() ?? "";
+		const suppliedSecret = authorization.startsWith("Bearer ") ? authorization.slice(7).trim() : c.req.header("x-xopc-webhook-secret")?.trim() ?? "";
+		if (!suppliedSecret || !secretsEqual(suppliedSecret, expectedSecret)) return c.json({
+			ok: false,
+			error: "Invalid automation webhook secret."
+		}, 401);
+		const idempotencyKey = c.req.header("idempotency-key")?.trim();
+		if (!idempotencyKey || idempotencyKey.length > 200) return c.json({
+			ok: false,
+			error: "A valid Idempotency-Key header is required."
+		}, 400);
+		const declaredSize = Number(c.req.header("content-length") ?? 0);
+		if (Number.isFinite(declaredSize) && declaredSize > 256 * 1024) return c.json({
+			ok: false,
+			error: "Webhook payload is too large."
+		}, 413);
+		const rawBody = await c.req.text();
+		if (Buffer.byteLength(rawBody) > 256 * 1024) return c.json({
+			ok: false,
+			error: "Webhook payload is too large."
+		}, 413);
+		let payload;
+		try {
+			const parsed = rawBody ? JSON.parse(rawBody) : {};
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("invalid payload");
+			payload = parsed;
+		} catch {
+			return c.json({
+				ok: false,
+				error: "Webhook payload must be a JSON object."
+			}, 400);
+		}
+		try {
+			const result = service.ingestAutomationEvent({
+				id: `webhook:${automationId}:${idempotencyKey}`,
+				type: "automation.webhook.received",
+				source: `webhook:${automationId}`,
+				subject: {
+					kind: "automation",
+					id: automationId
+				},
+				correlationId: c.req.header("x-correlation-id")?.trim() || void 0,
+				dedupeKey: idempotencyKey,
+				trust: "untrusted_webhook",
+				payload
+			}, { targetAutomationIds: [automationId] });
+			return c.json({
+				ok: true,
+				eventId: result.event.id,
+				duplicate: !result.created
+			}, result.created ? 202 : 200);
+		} catch {
+			return c.json({
+				ok: false,
+				error: "Automation webhook ingestion failed."
+			}, 500);
+		}
+	});
 	app.get("/api", (c) => {
 		return c.json({
 			service: "xopc-gateway",

package/dist/src/gateway/hono/routes/scenes.js

@@ -66,14 +66,22 @@ function registerSceneRoutes(authenticated, deps) {
 			idempotencyKey: c.req.header("Idempotency-Key") ?? randomUUID()
 		});
 	};
-	app.get("/source-providers", (c) => c.json({ providers: deps.scenes.followUps?.sources.list() ?? [] }));
-	app.get("/source-providers/:provider/accounts", (c) => c.json({ accounts: deps.scenes.followUps?.sources.get(c.req.param("provider")).listAccounts?.(principal(c)) ?? [] }));
+	const template = (key, version) => deps.scenes.repository.getTemplate(key, version);
+	const adapterTarget = (key, version) => {
+		const manifest = template(key, version);
+		return manifest.execution.kind === "agent" ? void 0 : {
+			manifest,
+			adapter: deps.scenes.activationAdapters.get(manifest.execution.kind)
+		};
+	};
+	app.get("/source-providers", (c) => c.json({ providers: deps.scenes.sourceProviders.providers() }));
+	app.get("/source-providers/:provider/accounts", (c) => c.json({ accounts: deps.scenes.sourceProviders.get(c.req.param("provider")).listAccounts?.(principal(c)) ?? [] }));
 	app.post("/source-providers/:provider/resolve-link", deps.strictRateLimitMiddleware, async (c) => {
 		const input = z.strictObject({
 			accountId: z.string().min(1).max(200),
 			url: z.string().url().max(2e3)
 		}).parse(await c.req.json());
-		const source = deps.scenes.followUps?.sources.get(c.req.param("provider"));
+		const source = deps.scenes.sourceProviders.get(c.req.param("provider"));
 		if (!source?.resolveLink) return c.json({ error: "source_resolution_unavailable" }, 422);
 		const reference = await source.resolveLink(principal(c), input.accountId, input.url, AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(3e4)]));
 		return c.json({ source: {
@@ -81,48 +89,21 @@ function registerSceneRoutes(authenticated, deps) {
 			reference
 		} });
 	});
-	app.get("/task-follow-ups", (c) => c.json({ items: deps.scenes.followUps?.list(principal(c)) ?? [] }));
-	app.get("/task-follow-ups/projects/:projectId/branches", async (c) => {
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		return c.json(await deps.scenes.followUps.branches.list(principal(c), c.req.param("projectId")));
+	app.get("/resources/projects/:projectId/branches", async (c) => {
+		const owner = deps.scenes.activationAdapters.list().find((item) => item.listProjectBranches);
+		if (!owner?.listProjectBranches) return c.json({ error: "branch_inventory_unavailable" }, 503);
+		return c.json(await owner.listProjectBranches(principal(c), c.req.param("projectId")));
 	});
-	app.post("/task-follow-ups/branch-links", deps.strictRateLimitMiddleware, async (c) => {
+	app.post("/resources/branch-links", deps.strictRateLimitMiddleware, async (c) => {
 		const input = z.strictObject({
 			projectId: z.string().min(1).max(200),
 			taskId: z.string().uuid(),
 			branchRef: z.string().startsWith("refs/heads/").max(300),
 			expectedSha: z.string().regex(/^[a-f0-9]{40,64}$/)
 		}).parse(await c.req.json());
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		return c.json(await deps.scenes.followUps.branches.associate(principal(c), input));
-	});
-	app.post("/task-follow-ups/preflight", deps.strictRateLimitMiddleware, async (c) => {
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		return c.json(await deps.scenes.followUps.preflight(principal(c), await c.req.json()));
-	});
-	app.post("/task-follow-ups", deps.strictRateLimitMiddleware, async (c) => {
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		return c.json(await deps.scenes.followUps.create(principal(c), await c.req.json()), 201);
-	});
-	app.get("/task-follow-ups/:id", (c) => {
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		return c.json(deps.scenes.followUps.get(principal(c), c.req.param("id")));
-	});
-	app.patch("/task-follow-ups/:id", deps.strictRateLimitMiddleware, async (c) => {
-		const input = z.union([z.strictObject({
-			expectedRevision: z.number().int().positive(),
-			status: z.enum([
-				"active",
-				"paused",
-				"archived"
-			])
-		}), z.strictObject({
-			expectedRevision: z.number().int().positive(),
-			configuration: z.unknown()
-		})]).parse(await c.req.json());
-		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
-		if ("configuration" in input) return c.json(await deps.scenes.followUps.configure(principal(c), c.req.param("id"), input.expectedRevision, input.configuration));
-		return c.json(await deps.scenes.followUps.transition(principal(c), c.req.param("id"), input.expectedRevision, input.status));
+		const owner = deps.scenes.activationAdapters.list().find((item) => item.associateBranch);
+		if (!owner?.associateBranch) return c.json({ error: "branch_inventory_unavailable" }, 503);
+		return c.json(await owner.associateBranch(principal(c), input));
 	});
 	app.post("/browser/prepare", deps.strictRateLimitMiddleware, (c) => c.json(deps.scenes.browser.prepare()));
 	app.post("/browser/subscriptions", deps.strictRateLimitMiddleware, async (c) => c.json(deps.scenes.browser.register(principal(c), await c.req.json()), 201));
@@ -160,7 +141,14 @@ function registerSceneRoutes(authenticated, deps) {
 		key: c.req.param("key"),
 		version: c.req.param("version")
 	})));
-	app.post("/preflight", deps.strictRateLimitMiddleware, async (c) => c.json(await read(c, "xopc.scenes.preflight", await c.req.json())));
+	app.post("/preflight", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json();
+		if (typeof body.templateKey === "string" && typeof body.templateVersion === "string") {
+			const target = adapterTarget(body.templateKey, body.templateVersion);
+			if (target) return c.json(await target.adapter.preflight(principal(c), target.manifest, body.configuration));
+		}
+		return c.json(await read(c, "xopc.scenes.preflight", body));
+	});
 	app.get("/activations", async (c) => {
 		return c.json(await read(c, "xopc.scenes.list", {
 			...c.req.query(),
@@ -169,14 +157,42 @@ function registerSceneRoutes(authenticated, deps) {
 	});
 	app.post("/activations", deps.strictRateLimitMiddleware, async (c) => {
 		requestIdentity.parse(c.req.header("Idempotency-Key"));
-		return c.json(await write(c, "xopc.scenes.start", await c.req.json()), 201);
+		const body = await c.req.json();
+		if (typeof body.templateKey === "string" && typeof body.templateVersion === "string") {
+			const target = adapterTarget(body.templateKey, body.templateVersion);
+			if (target) return c.json(await target.adapter.create(principal(c), target.manifest, body.configuration), 201);
+		}
+		return c.json(await write(c, "xopc.scenes.start", body), 201);
 	});
 	app.get("/activations/:id", async (c) => {
 		const { activation } = ProductReadContracts["xopc.scenes.get"].output.parse(await read(c, "xopc.scenes.get", { id: c.req.param("id") }));
-		return c.json({ activation });
+		const manifest = template(activation.templateKey, activation.templateVersion);
+		const activationAdapter = manifest.execution.kind === "agent" ? void 0 : deps.scenes.activationAdapters.get(manifest.execution.kind);
+		return c.json({
+			activation,
+			template: manifest,
+			...activationAdapter ? { details: activationAdapter.get(principal(c), activation.id) } : {}
+		});
 	});
 	app.patch("/activations/:id", deps.strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json();
+		const activation = deps.scenes.repository.getActivation(principal(c), c.req.param("id"));
+		const manifest = template(activation.templateKey, activation.templateVersion);
+		if (manifest.execution.kind !== "agent") {
+			const input = z.union([z.strictObject({
+				expectedRevision: z.number().int().positive(),
+				status: z.enum([
+					"active",
+					"paused",
+					"archived"
+				])
+			}), z.strictObject({
+				expectedRevision: z.number().int().positive(),
+				configuration: z.unknown()
+			})]).parse(body);
+			const execution = deps.scenes.activationAdapters.get(manifest.execution.kind);
+			return c.json("configuration" in input ? await execution.configure(principal(c), activation.id, input.expectedRevision, input.configuration) : await execution.transition(principal(c), activation.id, input.expectedRevision, input.status));
+		}
 		if (!(typeof body === "object" && body !== null && Object.hasOwn(body, "status"))) return c.json(await write(c, "xopc.scenes.configure", {
 			...body,
 			id: c.req.param("id")

package/dist/src/gateway/hono/routes/session-command-handler.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function handleSessionCommand(c: Context, deps: AuthenticatedRouteDeps, materialize?: boolean): Promise<Response>;
+export declare function handleSessionInputReceipt(c: Context, deps: AuthenticatedRouteDeps): Promise<Response>;
+export declare function handleSessionPreparationRetry(c: Context, deps: AuthenticatedRouteDeps): Promise<Response>;