feat: update package dependencies and configurations

- Updated several package versions in package.json for improved stability and features, including:
  - Upgraded @dotenvx/dotenvx to version 1.61.1
  - Upgraded @mastra/client-js to version 1.13.5-alpha.5
  - Upgraded @mastra/cloudflare to version 1.3.2-alpha.0
  - Upgraded @mastra/cloudflare-d1 to version 1.0.5-alpha.0
  - Upgraded @mastra/convex to version 1.0.8-alpha.0
  - Upgraded @mastra/core to version 1.26.0-alpha.5
  - Upgraded eslint to version 10.2.1
  - Upgraded marked to version 18.0.1
  - Upgraded convert-csv-to-json to version 4.36.0
  - Upgraded crawlee to version 4.0.0-beta.47
- Removed unnecessary lines in package.json for better readability.

fix: modify researchAgent configurations
- Changed defaultOptions in researchAgent.ts to enable includeRawChunks and disable autoResumeSuspendedTools for better tool management.

style: update logger level
- Changed logger level from 'info' to 'debug' in logger.ts for more verbose logging during development.

refactor: clean up index.ts imports and configurations
- Removed unused imports and commented-out code in index.ts for clarity.
- Adjusted CORS headers in the mastra configuration for better API security.

refactor: enhance document chunking tool
- Updated embedding model references in document-chunking.tool.ts to use fastembed directly.
- Changed span types from TOOL_CALL to MODEL_CHUNK for better observability.
- Added experimental telemetry options for embedding functions to track inputs and outputs.

feat: implement Composio agent
- Created a new Composio agent in compsio.ts that integrates with Composio's API for enhanced task automation.

feat: add process manager for sandbox
- Introduced a new process manager in process-manager.ts to handle sandbox processes more effectively.

docs: add Weaving API documentation
- Created weavingapi.md to document the Weaving API, detailing its functionality and usage for spell casting in gaming contexts.

feat: implement Composio MCP client
- Added composio-mcp.ts to manage interactions with Composio's MCP, including OAuth handling and prompt management.

Author: ssdeanx

memory-bank/activeContext.md

@@ -1,3 +1,17 @@
+# Active Context Update (2026-04-17 - weavingapi TBC timing cleanup)
+
+- Reworked `src/mastra/public/workspace/weavingapi.md` to use Vanilla/TBC-only shaman spell ranks, removing WotLK-only `Lava Burst` / `Hex` IDs from the weaving path.
+- The weaving timing logic now caches resolved spell ranks, keeps the explicit spell-ID table as the first hot-path gate, uses `GetTimePreciseSec()` when available, refreshes `GetNetStats()` on every prediction pass, and keeps world latency as the primary offset with home/realm latency as fallback.
+- Spell haste is refreshed from `UnitSpellHaste()` on every prediction pass, and the active tracked spell is re-predicted during casts so aura and rating changes update immediately.
+- The swing-timer contract through `aura_env.setSwingState(...)` remains unchanged, and `SWING_TIMER_WILL_CLIPPED` still receives the original cast-duration payload.
+- The shared spellcast handler now tracks the current spell during casts and clears stale casting state on stop/interrupt paths, including an explicit clear update when an untracked cast starts, so the aura does not get stuck in a false casting state when a spell ID is missing.
+
+# Active Context Update (2026-04-17 - swingtimer precise-clock and aura refresh)
+
+- `src/mastra/public/workspace/swingtimer.md` now primes `_G.GetTimePreciseSec` (with `GetTime` fallback) and uses that precise clock together with the frame-cached latency value for melee swing timing; the changelog/version was bumped to reflect the final delta-correction and reset-safe behavior.
+- The swing timer now seeds latency on load, refreshes latency every frame, and prefers world latency over home latency so combat timing tracks the world connection first.
+- `UNIT_AURA` now drives direct swing-speed rescaling immediately, `PLAYER_TALENT_UPDATE` resyncs melee speed after talent swaps, the swing delta event is now wired into real swing resets/speed changes, the main/off delta correction now tracks the observed swing error instead of staying at zero and zeros itself during equipment resets, `ResetTimers()` now exists for equipment changes, the duplicate latency helper/shadowed cache path was removed, and the parry-specific handling was left unchanged.
+
 # Active Context Update (2026-04-16 - technical-analysis diagnostics fully clean)
 
 - `src/mastra/tools/technical-analysis.tool.ts` is now clean under VS Code `get_errors` after correcting the accidentally leaked return-type annotations and forcing the MACD/ADX result mappings to return explicit local types.
@@ -928,6 +942,11 @@
 
 # Active Context
 
+## Active Context Update (2026-04-17 - weavingapi nil-safety and haste-aware prediction)
+- Reworked `src/mastra/public/workspace/weavingapi.md` so it now resolves the highest valid rank per spell family, avoiding nil `castTime` crashes when a WotLK-only rank is missing on a TBC/Classic client.
+- Added live cast prediction based on `GetSpellHaste()` / `UnitSpellHaste()` with `GetHaste()` fallback, plus latency-aware timing, while keeping `swingtimer.md` untouched.
+- Kept the WeakAuras event contract intact (`WEAVING_UPDATE_STATUS` / `SWING_TIMER_WILL_CLIPPED`) and added safe guards around `GetSpellInfo`, `UnitAttackSpeed`, and swing-state updates.
+
 ## Active Context Update (2026-04-05 - auth event typing and premium auth UI)
 - `app/login/page.tsx` and `app/login/signup/page.tsx` now use the native submit-event typing via `SyntheticEvent<HTMLFormElement, SubmitEvent>` instead of the deprecated `FormEvent` alias.
 - Both auth screens were redesigned into split-layout, glassmorphism-style views with stronger hierarchy, clearer onboarding copy, and better large-screen presentation.

memory-bank/progress.md

@@ -1,3 +1,20 @@
+# Progress Update (2026-04-17 - weavingapi TBC-only cache and world latency)
+
+- Updated `src/mastra/public/workspace/weavingapi.md` to a TBC-only shaman weaving implementation with cached spell-rank resolution and world-latency-aware cast timing.
+- Preserved the explicit spell-ID table as the hot-path gate while keeping the Vanilla/TBC Lightning Bolt, Chain Lightning, Healing Wave, Lesser Healing Wave, and Chain Heal rank groups cached once.
+- Switched the main timing path to `GetTimePreciseSec()` when available, with `GetTime()` fallback, and made `GetNetStats()` refresh on every prediction pass instead of using a half-second cache window.
+- Kept world latency as the primary offset with home/realm latency as fallback, and refreshed spell haste automatically on each prediction pass so rating and aura changes stay in sync.
+- Tracked the active spell during casts so `UNIT_AURA` and other refresh events can re-predict the live cast immediately instead of waiting for the next cast event.
+- Kept `SWING_TIMER_WILL_CLIPPED` payload compatibility by continuing to emit cast duration rather than absolute timestamps.
+- Left `src/mastra/public/workspace/swingtimer.md` untouched.
+- Hardened the shared spellcast handler so stop/interrupt events clear stale casting state, and untracked cast starts now emit an explicit clear update instead of leaving the weaving HUD stuck on a previous cast.
+
+# Progress Update (2026-04-17 - swingtimer precise-clock and aura refresh)
+
+- Updated `src/mastra/public/workspace/swingtimer.md` to use `_G.GetTimePreciseSec` (with `GetTime` fallback) for precise melee swing timing while keeping latency frame-cached, and bumped the swingtimer version/changelog to reflect the final delta-correction and reset-safe behavior.
+- Seeded the latency cache on load, removed the duplicate shadowed latency helper path, and switched combat latency to prefer the world connection so swing timing tracks the combat channel first.
+- Changed `UNIT_AURA` to rescale swing speed immediately, added `PLAYER_TALENT_UPDATE` so melee speed also resyncs after talent swaps, wired the swing delta event into the actual swing reset/speed-change paths, made the main/off delta correction track observed swing error instead of staying at zero and zero itself during equipment resets, and added a real `ResetTimers()` implementation for equipment changes while leaving the parry branch untouched.
+
 # Progress Update (2026-04-16 - technical-analysis diagnostics fixed)
 
 - Resolved the final `get_errors` issues in `src/mastra/tools/technical-analysis.tool.ts` by correcting leaked return-type annotations, re-typing the MACD/ADX mappings, and restarting the VS Code TypeScript server.
@@ -570,6 +587,11 @@
 
 # Progress
 
+## Completed
+- Reworked `src/mastra/public/workspace/weavingapi.md` to be nil-safe for missing spell ranks, using highest-valid-rank resolution per spell family instead of hardcoded WotLK-only lookups.
+- Updated weaving prediction to use live spell haste, melee haste, and latency-aware cast timing while leaving `src/mastra/public/workspace/swingtimer.md` unchanged.
+- Preserved the existing WeakAuras event names and swing-state handoff contract, with safer guards around `GetSpellInfo`, `UnitAttackSpeed`, and swing clip checks.
+
 ## Completed
 - Replaced the deprecated `FormEvent`-style submit typing in the auth screens with native submit-event typing.
 - Redesigned `app/login/page.tsx` and `app/login/signup/page.tsx` into higher-polish split-layout auth experiences with better hierarchy, spacing, and feedback.