@axiom-lattice/core 4.2.17 → 4.4.0

package/dist/index.d.mts

@@ -8,7 +8,7 @@ import { BaseLanguageModelInput, LanguageModelLike } from '@langchain/core/langu
 import { CallbackManagerForLLMRun } from '@langchain/core/callbacks/manager';
 import { ChatResult } from '@langchain/core/outputs';
 import * as _axiom_lattice_protocols from '@axiom-lattice/protocols';
-import { LLMConfig, SemanticMetricsServerConfig, MetricMeta, MetricQueryResult, DataSource, SemanticMetricsQueryRequest, SemanticMetricsQueryResponse, TableQueryRequest, TableQueryResponse, ExecuteSqlQueryRequest, ExecuteSqlQueryResponse, MetricsServerType, MetricsServerConfig, ToolConfig, ToolExecutor, AgentConfig, MiddlewareType, GraphBuildOptions, DeepAgentConfig, MessageChunk, MessageChunkType, QueueLatticeProtocol, QueueConfig, QueueClient, QueueResult, ScheduleLatticeProtocol, ScheduleConfig, ScheduleClient, ScheduleStorage, TaskHandler, ScheduleOnceOptions, ScheduleCronOptions, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TrustedRunContext, QueuedExecutionMode, ThreadStore, AssistantStore, SkillStore, CollectionStore, WorkspaceStore, ProjectStore, DatabaseConfigStore, MetricsServerConfigStore, McpServerConfigStore, UserStore, TenantStore, UserTenantLinkStore, WorkflowTrackingStore, EvalStore, ChannelInstallationStore, BindingRegistry, MenuRegistry, A2AApiKeyStore, OpenAuditStore, TaskStore, SharedResourceStore, ConnectionStore, TaskWorkItemStore, AgentWebAppStore, CapabilityBundleStore, ProjectRoomStore, ProjectMembershipStore, ProjectBotMembershipStore, ProjectRoomMessageStore, ProjectRoomReadStateStore, UserPushSubscriptionStore, VectorStoreProvider, Thread, CreateThreadRequest, Assistant, CreateAssistantRequest, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, Skill, CreateSkillRequest, SkillStoreContext, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, User, CreateUserRequest, UpdateUserRequest, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditAppendInput, OpenAuditQuery, OpenAuditRecord, TaskMutationSnapshot, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, Collection, CreateCollectionRequest, UpdateCollectionRequest, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, ProjectRoom, ProjectMembership, ProjectBotMembership, ProjectRoomMessage, ProjectHumanRole, ProjectMembershipMutationResult, ProjectRoomReadState, UserPushSubscription, STTModelLatticeProtocol, STTConfig, STTClient, TranscriptionResult, LoggerLatticeProtocol, LoggerConfig, LoggerClient, LoggerContext, SkillConfig, SkillClient, PluginSkillDefinition, McpTool, ResourceResolver, ResourceAddress, ShareVisibility, OpenGrant, CreateShareRequest, ChannelAdapter, InterruptPolicy, ProjectTaskLifecycleAction, TaskBeliefState, PluginMeta, Plugin, PluginMetaOutput, SandboxPluginManifest, SandboxPluginToolDef, SandboxPluginDiagnostic, CapabilityPreview, CreateCapabilityBundleInput, UpdateCapabilityBundleInput, InternalStateField, InternalInput, InternalNode, InternalAgentNode, InternalMapNode, InternalDSL, ConnectionEntry } from '@axiom-lattice/protocols';
+import { LLMConfig, SemanticMetricsServerConfig, MetricMeta, MetricQueryResult, DataSource, SemanticMetricsQueryRequest, SemanticMetricsQueryResponse, TableQueryRequest, TableQueryResponse, ExecuteSqlQueryRequest, ExecuteSqlQueryResponse, MetricsServerType, MetricsServerConfig, ToolConfig, ToolExecutor, AgentConfig, MiddlewareType, GraphBuildOptions, DeepAgentConfig, MessageChunk, MessageChunkType, QueueLatticeProtocol, QueueConfig, QueueClient, QueueResult, ScheduleLatticeProtocol, ScheduleConfig, ScheduleClient, ScheduleStorage, TaskHandler, ScheduleOnceOptions, ScheduleCronOptions, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TrustedRunContext, QueuedExecutionMode, ThreadStore, AssistantStore, SkillStore, CollectionStore, WorkspaceStore, ProjectStore, DatabaseConfigStore, MetricsServerConfigStore, McpServerConfigStore, UserStore, TenantStore, UserTenantLinkStore, WorkflowTrackingStore, EvalStore, ChannelInstallationStore, BindingRegistry, MenuRegistry, A2AApiKeyStore, OpenAuditStore, TaskStore, SharedResourceStore, ConnectionStore, TaskWorkItemStore, AgentWebAppStore, CapabilityBundleStore, ProjectRoomStore, ProjectMembershipStore, ProjectBotMembershipStore, ProjectRoomMessageStore, ProjectRoomReadStateStore, UserPushSubscriptionStore, VectorStoreProvider, Thread, CreateThreadRequest, Assistant, CreateAssistantRequest, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, Skill, CreateSkillRequest, SkillStoreContext, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, User, CreateUserRequest, UpdateUserRequest, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditAppendInput, OpenAuditQuery, OpenAuditRecord, TaskMutationSnapshot, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, Collection, CreateCollectionRequest, UpdateCollectionRequest, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, ProjectRoom, ProjectMembership, ProjectBotMembership, ProjectRoomMessage, ProjectHumanRole, ProjectMembershipMutationResult, ProjectRoomReadState, UserPushSubscription, STTModelLatticeProtocol, STTConfig, STTClient, TranscriptionResult, LoggerLatticeProtocol, LoggerConfig, LoggerClient, LoggerContext, SkillConfig, SkillClient, PluginSkillDefinition, McpTool, McpUiResourcePayload, McpServerConfig, McpUiRef, ResourceResolver, ResourceAddress, ShareVisibility, OpenGrant, CreateShareRequest, ChannelAdapter, InterruptPolicy, ProjectTaskLifecycleAction, TaskBeliefState, PluginMeta, Plugin, PluginMetaOutput, SandboxPluginManifest, SandboxPluginToolDef, SandboxPluginDiagnostic, CapabilityPreview, CreateCapabilityBundleInput, UpdateCapabilityBundleInput, InternalStateField, InternalInput, InternalNode, InternalAgentNode, InternalMapNode, InternalDSL, ConnectionEntry } from '@axiom-lattice/protocols';
 export { _axiom_lattice_protocols as Protocols };
 export { AgentConfig, AgentType, GraphBuildOptions, MemoryType, ProjectRoomTrustedRunContext, QueuedExecutionMode, TrustedRunContext, parseQueuedExecutionMode, parseTrustedRunContext } from '@axiom-lattice/protocols';
 import * as langchain from 'langchain';
@@ -23,7 +23,7 @@ import { ReplaySubject } from 'rxjs';
 import { Embeddings } from '@langchain/core/embeddings';
 import { VectorStore } from '@langchain/core/vectorstores';
 import { DocumentInterface } from '@langchain/core/documents';
-import { Connection, MultiServerMCPClient } from '@langchain/mcp-adapters';
+import { Connection } from '@langchain/mcp-adapters';
 import { SandboxClient } from '@agent-infra/sandbox';
 import { Sandbox } from 'e2b';
 import { Sandbox as Sandbox$1 } from '@daytonaio/sdk';
@@ -1739,6 +1739,31 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
      * @param tool 已有的StructuredTool实例
      */
     registerExistingTool(key: string, tool: StructuredTool): void;
+    /**
+     * Register an existing StructuredTool into a specific tenant's tool bucket.
+     *
+     * @param tenantId - tenant that owns the tool
+     * @param key - tool lattice key (no tenant prefix)
+     * @param tool - the StructuredTool client
+     */
+    registerExistingToolWithTenant(tenantId: string, key: string, tool: StructuredTool): void;
+    /**
+     * Get a tool lattice from a specific tenant bucket.
+     *
+     * @param tenantId - tenant bucket
+     * @param key - tool lattice key
+     * @returns the tool lattice or undefined
+     */
+    getToolLatticeWithTenant(tenantId: string, key: string): ToolLattice | undefined;
+    /**
+     * Get a tool client for a tenant, falling back to the "default" bucket for
+     * built-in tools. Throws if the tool exists in neither bucket.
+     *
+     * @param tenantId - requesting tenant
+     * @param key - tool lattice key
+     * @returns the StructuredTool client
+     */
+    getToolClientWithTenant(tenantId: string, key: string): StructuredTool;
     /**
      * 验证工具输入参数
      * @param key Lattice键名
@@ -1749,7 +1774,9 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
 declare const toolLatticeManager: ToolLatticeManager;
 declare const registerToolLattice: (key: string, config: ToolConfig, executor: ToolExecutor) => void;
 declare const registerExistingTool: (key: string, tool: StructuredTool) => void;
+declare const registerExistingToolWithTenant: (tenantId: string, key: string, tool: StructuredTool) => void;
 declare const getToolLattice: (key: string) => ToolLattice | undefined;
+declare const getToolClientWithTenant: (tenantId: string, key: string) => StructuredTool<_langchain_core_tools.ToolSchemaBase, any, any, any>;
 declare const getToolDefinition: (key: string) => ToolConfig;
 declare const getToolClient: (key: string) => StructuredTool<_langchain_core_tools.ToolSchemaBase, any, any, any>;
 declare const getAllToolDefinitions: () => ToolConfig[];
@@ -3927,6 +3954,42 @@ declare class InMemoryTaskStore implements TaskStore {
     clear(tenantId?: string): void;
 }
 
+/**
+ * In-memory implementation of TaskWorkItemStore.
+ * Stores work items per tenant in a Map<tenantId, Map<taskId, TaskWorkItem[]>>.
+ */
+declare class InMemoryTaskWorkItemStore implements TaskWorkItemStore {
+    private readonly tasks?;
+    private store;
+    private events;
+    /** Creates a store optionally coordinated with an in-memory task store. */
+    constructor(tasks?: InMemoryTaskStore | undefined);
+    /**
+     * Create a new work item
+     */
+    create(params: CreateWorkItemRequest): Promise<TaskWorkItem>;
+    /** Atomically append only while the shared task snapshot matches. */
+    createIfTaskSnapshot(params: CreateWorkItemRequest, snapshot: TaskMutationSnapshot): Promise<TaskWorkItem | null>;
+    private append;
+    /** Find an event by its tenant- and task-scoped key. */
+    findByEventKey(tenantId: string, taskId: string, eventKey: string): Promise<TaskWorkItem | null>;
+    /** Atomically return an existing event or create it once. */
+    createIfAbsentByEventKey(params: CreateWorkItemIfAbsentRequest): Promise<TaskWorkItem>;
+    /**
+     * List work items matching filter criteria
+     */
+    list(filter: TaskWorkItemListFilter): Promise<TaskWorkItem[]>;
+    /** List a bounded newest-first view of unreconciled execution results. */
+    listPendingExecutionResults(params: {
+        tenantId: string;
+        taskId: string;
+        limit: number;
+    }): Promise<TaskWorkItem[]>;
+    /** Lists canonical project lifecycle events with an exclusive cursor. */
+    listProjectLifecycleEvents(query: ProjectLifecycleEventQuery): Promise<TaskWorkItem[]>;
+    private eventMapKey;
+}
+
 /**
  * InMemoryCollectionStore
  *
@@ -5273,92 +5336,448 @@ declare class SimpleMemoryVectorStore extends VectorStore {
 }
 
 /**
- * McpLatticeManager
- *
- * MCP Lattice Manager - Manages MCP client connections.
- * Each MCP server gets its own independent MultiServerMCPClient instance,
- * so adding/removing servers never affects other servers' connections or tools.
- * Follows the singleton pattern for global access.
+ * MCP runtime types for tenant-scoped connection management.
  */
 
-interface McpServerInfo {
-    name: string;
-    connection: Connection;
+/** Exact tenant + server identity used as the runtime map key. */
+interface McpServerId {
+    tenantId: string;
+    serverKey: string;
 }
-interface McpLatticeInterface {
-    client: MultiServerMCPClient;
-    servers: Map<string, McpServerInfo>;
+/** Per-server connection policy. */
+interface McpConnectionOptions {
+    /** Single connect/handshake timeout in ms. */
+    timeoutMs?: number;
+    /** Max reconnect attempts before giving up. */
+    maxAttempts?: number;
+    /** Base delay for exponential backoff in ms. */
+    delayMs?: number;
+}
+/** Options accepted by `McpLatticeManager.registerServer`. */
+interface McpRegisterOptions extends McpConnectionOptions {
+    /** Tool-name allowlist to persist on the runtime for reconnect re-registration. `undefined` = all, `[]` = none. */
+    selectedTools?: string[];
+}
+/** Runtime lifecycle state of one MCP server. */
+type McpServerState = "idle" | "connecting" | "connected" | "reconnecting" | "failed";
+/** Minimal MCP client session surface used for health checks, tool listing and UI resource access. */
+interface McpClientSession {
+    listTools(): Promise<{
+        tools: Array<{
+            name: string;
+            description?: string;
+            inputSchema?: unknown;
+            _meta?: Record<string, unknown>;
+        }>;
+    }>;
+    readResource?(params: {
+        uri: string;
+    }): Promise<{
+        contents: Array<{
+            uri: string;
+            mimeType?: string;
+            text?: string;
+            blob?: string;
+            _meta?: Record<string, unknown>;
+        }>;
+    }>;
+    callTool?(params: {
+        name: string;
+        arguments?: Record<string, unknown>;
+    }): Promise<unknown>;
+}
+/** Structural surface of MultiServerMCPClient used by the manager (injectable for tests). */
+interface McpClientLike {
+    initializeConnections(): Promise<unknown>;
+    getClient(serverName: string): Promise<McpClientSession | undefined>;
+    getTools(serverName: string): Promise<DynamicStructuredTool[]>;
+    close(): Promise<void>;
+}
+/** Factory seam so tests can inject a fake MCP client. */
+type McpClientFactory = (config: {
+    mcpServers: Record<string, Connection>;
+}) => McpClientLike;
+/** Internal per-(tenant, server) runtime record. */
+interface McpServerRuntime {
+    id: McpServerId;
+    connection: Connection;
+    options: Required<McpConnectionOptions>;
+    state: McpServerState;
+    client?: McpClientLike;
+    toolKeys: string[];
+    selectedTools?: string[];
+    attempt: number;
+    timer?: ReturnType<typeof setTimeout>;
+    /** In-flight connect promise, used to single-flight concurrent connects. */
+    connectPromise?: Promise<void>;
 }
-declare class McpLatticeManager extends BaseLatticeManager<McpLatticeInterface> {
+
+/**
+ * McpLatticeManager
+ *
+ * Tenant-scoped MCP connection manager with transparent self-healing.
+ * Each (tenantId, serverKey) pair owns an independent client, tool set and
+ * reconnect state, so a failure in one never affects the others.
+ */
+
+/**
+ * Manages tenant-scoped MCP connections with isolated failures and background
+ * self-healing.
+ *
+ * @example
+ * ```ts
+ * mcpManager.registerServer("tenant-1", "github", connection);
+ * await mcpManager.connectAll();
+ * await mcpManager.registerToolsToToolLattice("tenant-1", "github", ["list_issues"]);
+ * ```
+ *
+ * @remarks
+ * - One MCP client per `(tenantId, serverKey)`; a failure in one server is
+ *   isolated from the others.
+ * - Connect attempts are bounded by `timeoutMs`; failed servers retry with
+ *   exponential backoff up to `maxAttempts`.
+ * - A periodic watchdog health-checks connected sessions and reconnects them.
+ * - Concurrent connects for the same server are single-flighted; removing or
+ *   re-registering a server aborts any in-flight connect so it cannot
+ *   resurrect the runtime or republish its tools.
+ */
+declare class McpLatticeManager extends BaseLatticeManager<McpClientLike> {
     private static _instance;
-    /** One MultiServerMCPClient per server, keyed by server name */
-    private clients;
-    /** Server connection configs, keyed by server name */
-    private servers;
-    /** Track registered tool keys per server for cleanup */
-    private registeredToolKeys;
+    private runtimes;
+    private clientFactory;
+    private watchdog?;
+    private healthCheckInFlight;
     static getInstance(): McpLatticeManager;
     protected getLatticeType(): string;
-    registerServers(servers: McpServerInfo[]): void;
-    addServer(name: string, connection: Connection): void;
+    /** Test seam: override the MCP client factory. */
+    configure(options?: {
+        clientFactory?: McpClientFactory;
+    }): void;
+    private compositeKey;
+    private getRuntime;
     /**
-     * Remove a server. Closes its client and unregisters its tools.
+     * Whether a runtime is still the live entry for its `(tenantId, serverKey)`.
+     * In-flight continuations use this to avoid publishing onto an orphaned
+     * runtime that was removed or overwritten.
      */
-    removeServer(name: string): Promise<boolean>;
+    private isActive;
     /**
-     * Connect all registered servers that are not yet connected.
-     * Each server gets its own MultiServerMCPClient instance.
-     * Existing connections are not affected.
+     * Build the tool lattice key for an MCP tool.
+     *
+     * @param serverKey - MCP server business key
+     * @param toolName - MCP tool name
+     * @returns the tenant-agnostic tool key `mcp:{server}:{tool}`
      */
-    connect(): Promise<void>;
+    static buildToolKey(serverKey: string, toolName: string): string;
     /**
-     * Reconnect a single server: close old client, create new one, re-register tools.
+     * Register (or replace) an MCP server connection for a tenant.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Stable server identifier within the tenant.
+     * @param connection Adapter connection config.
+     * @param options Optional connect timeout / retry policy overrides.
+     * @remarks Re-registering an existing `(tenantId, serverKey)` clears its
+     * pending reconnect timer, unregisters its tools, closes the old client
+     * (fire-and-forget) and aborts any in-flight connect.
      */
-    reconnectServer(name: string): Promise<void>;
-    disconnect(): Promise<void>;
-    isConnected(): boolean;
-    isServerConnected(name: string): boolean;
+    registerServer(tenantId: string, serverKey: string, connection: Connection, options?: McpRegisterOptions): void;
     /**
-     * Get tools from a specific server using raw MCP protocol.
-     * Returns native JSON schema tools — suitable for API responses.
+     * Whether a server is currently registered for a tenant.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns `true` if a runtime entry exists.
      */
-    getServerTools(serverName: string): Promise<McpTool[]>;
+    hasServer(tenantId: string, serverKey: string): boolean;
     /**
-     * Get all tools from all servers as McpTool[] (API format).
+     * Whether a server's client is connected.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns `true` only when the runtime state is `connected`.
      */
-    getAllTools(): Promise<McpTool[]>;
+    isServerConnected(tenantId: string, serverKey: string): boolean;
+    private ensureWatchdog;
+    private connectRuntime;
     /**
-     * Get raw LangChain DynamicStructuredTool objects for ToolLattice registration.
-     * Optionally filtered by server name.
+     * Connect a single registered server, throwing on failure.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @throws If the server is not registered or the connect attempt fails.
+     * @remarks On failure the server is scheduled for background reconnect.
      */
-    getRawTools(serverName?: string): Promise<DynamicStructuredTool[]>;
-    getServerNames(): string[];
-    hasServer(name: string): boolean;
+    connectServer(tenantId: string, serverKey: string): Promise<void>;
     /**
-     * Build the tool lattice key for an MCP tool.
+     * Connect every registered server, isolating per-server failures.
+     *
+     * @remarks Failures are caught and scheduled for background reconnect, so
+     * this method never rejects because one server is unreachable.
+     */
+    connectAll(): Promise<void>;
+    /**
+     * Reuse a healthy connection, otherwise (re)connect the server.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @throws If the server is not registered or the connect attempt fails.
+     * @remarks Concurrent calls are single-flighted onto one connect attempt.
+     * On failure the server is scheduled for background reconnect.
+     */
+    ensureConnected(tenantId: string, serverKey: string): Promise<void>;
+    private scheduleReconnect;
+    private reconnectRuntime;
+    /**
+     * Force a reconnect of a registered server, re-registering its tools.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @throws If the server is not registered or the reconnect attempt fails.
+     */
+    reconnectServer(tenantId: string, serverKey: string): Promise<void>;
+    private checkHealth;
+    /**
+     * Remove a registered server, closing its client and unregistering its tools.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns `true` if a server was removed.
+     * @remarks The runtime is removed from the map before the client is closed
+     * so any in-flight connect aborts instead of resurrecting it.
+     */
+    removeServer(tenantId: string, serverKey: string): Promise<boolean>;
+    /**
+     * List a connected server's tools in API format.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns Native JSON-schema tool descriptors.
+     * @throws If the server is not connected.
+     */
+    getServerTools(tenantId: string, serverKey: string): Promise<McpTool[]>;
+    /**
+     * Get a connected server's raw LangChain tools.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns Raw `DynamicStructuredTool` instances.
+     * @throws If the server is not connected.
+     */
+    getRawTools(tenantId: string, serverKey: string): Promise<DynamicStructuredTool[]>;
+    /**
+     * List a connected server's tools including raw `_meta` (for UI association).
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @returns Tool descriptors with optional `_meta`.
+     * @throws If the server is not connected.
+     */
+    getAvailableTools(tenantId: string, serverKey: string): Promise<Array<{
+        name: string;
+        description: string;
+        inputSchema: unknown;
+        meta?: Record<string, unknown>;
+    }>>;
+    /**
+     * Read a `ui://` resource and surface its content-item `_meta.ui` CSP/permissions.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @param uri The `ui://` resource URI.
+     * @returns Normalized UI resource payload.
+     * @throws If the server is not connected or has no resources support.
+     */
+    readUiResource(tenantId: string, serverKey: string, uri: string): Promise<McpUiResourcePayload>;
+    /**
+     * Proxy a `tools/call` to a connected server (used by the gateway UI RPC route).
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @param name Tool name.
+     * @param args Tool arguments.
+     * @returns Raw CallToolResult.
+     * @throws If the server is not connected.
      */
-    static buildToolKey(serverName: string, toolName: string): string;
+    callServerTool(tenantId: string, serverKey: string, name: string, args: Record<string, unknown>): Promise<unknown>;
     /**
-     * Unregister all tools for a specific server from ToolLattice.
+     * Read a non-UI resource from a connected server.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @param uri Resource URI.
+     * @returns Raw ReadResourceResult.
+     * @throws If the server is not connected or has no resources support.
      */
-    unregisterServerTools(serverName: string): void;
+    readServerResource(tenantId: string, serverKey: string, uri: string): Promise<unknown>;
     /**
-     * Register MCP tools from a specific server to Tool Lattice.
-     * Tools are registered with key pattern: mcp:{serverName}:{toolName}
-     * Only registers tools whose names are in selectedTools (if provided).
+     * Unregister a server's tools from the tool lattice.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
      */
-    registerToolsToToolLattice(serverName: string, selectedTools?: string[]): Promise<void>;
+    unregisterServerTools(tenantId: string, serverKey: string): void;
     /**
-     * Test a single MCP server connection using a standalone client.
-     * Does not affect the global mcpManager state.
+     * Register a connected server's tools into the tool lattice.
+     *
+     * @param tenantId Tenant that owns the connection.
+     * @param serverKey Server identifier within the tenant.
+     * @param selectedTools Tool names to expose. `undefined` registers all tools;
+     * an empty array registers none. Once provided, the selection is remembered
+     * and reused on reconnect.
+     * @throws If the server is not registered or not connected.
+     * @remarks No-op if the runtime was removed/replaced while fetching tools.
      */
-    static testConnection(serverName: string, connection: Connection): Promise<{
+    registerToolsToToolLattice(tenantId: string, serverKey: string, selectedTools?: string[]): Promise<void>;
+    /**
+     * Test a single MCP server using a standalone client.
+     * Never touches manager state and always closes the client.
+     */
+    static testConnection(serverName: string, connection: Connection, factory?: McpClientFactory): Promise<{
         tools: McpTool[];
         latency: number;
     }>;
+    /**
+     * Stop the watchdog and close/clear every runtime.
+     *
+     * @remarks Intended for shutdown and test teardown: it also aborts any
+     * in-flight connect because every runtime is cleared from the map.
+     */
+    dispose(): Promise<void>;
 }
 declare const mcpManager: McpLatticeManager;
 
+/**
+ * Pure reconnect/backoff policy helpers for the MCP manager.
+ */
+/** Default timeout (ms) for a single MCP connect/handshake attempt. */
+declare const DEFAULT_CONNECT_TIMEOUT_MS = 15000;
+/** Default number of reconnect attempts before a server is marked failed. */
+declare const DEFAULT_MAX_ATTEMPTS = 3;
+/** Default base delay (ms) for exponential reconnect backoff. */
+declare const DEFAULT_DELAY_MS = 1000;
+/** Upper bound (ms) for a single reconnect backoff delay. */
+declare const MAX_BACKOFF_MS = 30000;
+/** Interval (ms) between MCP session health checks. */
+declare const HEALTH_CHECK_INTERVAL_MS = 30000;
+/** Timeout (ms) for a single MCP session health check. */
+declare const HEALTH_CHECK_TIMEOUT_MS = 5000;
+/**
+ * Exponential backoff delay: `base * 2^(attempt-1)`, capped at `max`.
+ * `attempt <= 0` returns `base`.
+ *
+ * @param attempt Zero-based reconnect attempt index.
+ * @param base Base delay in ms.
+ * @param max Maximum delay in ms.
+ * @returns Delay in ms for the given attempt.
+ */
+declare function nextBackoffDelay(attempt: number, base?: number, max?: number): number;
+/**
+ * Race an operation against a timeout. On timeout it rejects first, then runs
+ * `onTimeout` (best-effort cleanup, e.g. close a leaking client) without
+ * blocking the rejection and swallowing any cleanup error.
+ *
+ * @param operation The operation to race.
+ * @param ms Timeout in ms.
+ * @param onTimeout Fire-and-forget cleanup invoked once the timeout wins.
+ * @returns The operation's result if it settles before the timeout.
+ * @throws Error with `timed out` when `ms` elapses first, otherwise the
+ * operation's own rejection.
+ */
+declare function withTimeout<T>(operation: Promise<T>, ms: number, onTimeout: () => Promise<void>): Promise<T>;
+
+/**
+ * Convert a persisted McpServerConfig into a @langchain/mcp-adapters Connection,
+ * enabling transport-level auto-recovery (stdio restart / http+sse reconnect).
+ */
+
+/**
+ * Map an MCP server config to an adapter connection.
+ *
+ * @param config - persisted MCP server configuration
+ * @returns adapter Connection with auto-recovery enabled
+ */
+declare function convertToConnection(config: McpServerConfig): Connection;
+
+/**
+ * Extract an MCP Apps UI ref from a tool's raw `_meta`.
+ *
+ * Supports both the current nested `_meta.ui.resourceUri` shape and the
+ * deprecated flat `_meta["ui/resourceUri"]` key. Only `ui://` URIs qualify.
+ *
+ * @param meta Tool `_meta` object (may be undefined).
+ * @param serverKey Owning MCP server key.
+ * @returns Normalized {@link McpUiRef} or `null` when no UI resource is declared.
+ */
+declare function extractAppsRef(meta: unknown, serverKey: string): McpUiRef | null;
+/**
+ * Extract legacy MCP-UI refs from a tool result's content blocks.
+ *
+ * Finds `resource` content blocks whose `resource.uri` is a `ui://` URI and
+ * normalizes them into {@link McpUiRef} entries.
+ *
+ * @param content Tool result content (array of blocks, or any other shape).
+ * @param serverKey Owning MCP server key.
+ * @returns Matching refs; empty when none are found.
+ */
+declare function extractLegacyRefs(content: unknown, serverKey: string): McpUiRef[];
+/**
+ * Append the `mcp_app` content fence to a tool result, preserving its shape.
+ *
+ * `@langchain/mcp-adapters` commonly returns an array of content blocks
+ * (text/image/audio/file). Joining only `.text` would silently drop every
+ * non-text block, so instead of normalizing to a string this function appends
+ * the fence as an extra text block:
+ *
+ * - `string` → `"<content>\n\n<fence>"` (still a string).
+ * - `array` → `[...content, { type: "text", text: fence }]` (new array).
+ * - single **pure text block** (`type === "text"` or `type` undefined, with no
+ *   `data`/`resource`) → `"<text>\n\n<fence>"` (a string, so the fence is
+ *   directly discoverable by string consumers).
+ * - single non-text block object (e.g. an image with a text caption) →
+ *   `[content, { type: "text", text: fence }]` so `data`/`resource` and every
+ *   other field survive instead of being dropped or stringified.
+ * - anything else → stringified content with the fence appended (fallback).
+ *
+ * @param content Existing content (string, content block, block array, or other value).
+ * @param ref UI ref to encode into the fence.
+ * @returns The fence appended in a shape that preserves every original block.
+ */
+declare function appendUiFence(content: unknown, ref: McpUiRef): string | unknown[];
+/**
+ * Wrap an MCP tool so its result carries an `mcp_app` fence for the given ref.
+ *
+ * The wrapped tool keeps the raw tool's `responseFormat` so `.invoke()` receives
+ * a shape it expects: for `"content_and_artifact"` the wrapper always returns a
+ * two-tuple (`[fencedContent, artifact]`), preserving the original artifact when
+ * present; for any other format it returns the fenced content directly.
+ *
+ * The original content shape is preserved — a string or a single pure text
+ * block stays a string, a block array gains an extra text block for the fence,
+ * and a single non-text block (including one with a text caption) is wrapped in
+ * an array (see {@link appendUiFence}) so non-text blocks are never dropped.
+ *
+ * The fence carries only the UI ref identity (server key, resource URI,
+ * display mode, title). MCP rich results (`structuredContent`, `_meta`,
+ * non-text blocks) stay on the raw tool result / `artifact`, which the client
+ * merger normalizes into `ToolCall.ui` — the fence must not duplicate them.
+ *
+ * @param raw The original LangChain tool.
+ * @param ref UI ref known at registration time.
+ * @returns A new {@link DynamicStructuredTool} preserving the raw tool's name,
+ *   description, schema, `responseFormat`, `defaultConfig`, `metadata`, and
+ *   `returnDirect`.
+ *
+ * @example
+ * ```ts
+ * const ref = { kind: "mcp", serverKey: "weather", resourceUri: "ui://weather/app", displayMode: "inline" };
+ * const fenced = wrapMcpToolWithUi(rawMcpTool, ref);
+ * // fenced.invoke({ city: "Paris" }) resolves to content ending in a ```mcp_app fence
+ * ```
+ *
+ * @remarks Only use this when a ref exists; otherwise register `raw` unchanged.
+ */
+declare function wrapMcpToolWithUi(raw: DynamicStructuredTool, ref: McpUiRef): DynamicStructuredTool;
+
 interface FsEntry {
     path: string;
     kind: string;
@@ -8108,11 +8527,14 @@ interface ProjectTaskAdmissionNotifierOptions {
     listenerTimeoutMs?: number;
 }
 /**
- * Publishes process-local hints that newly persisted Agent Project tasks need reconciliation.
+ * Publishes process-local hints that a TaskItem was explicitly dispatched to the Project queue
+ * runtime.
  *
- * @remarks Delivery is FIFO per Tenant/Task and awaits every listener settlement. Callers that
- * persist tasks must invoke `publish` fire-and-forget and contain rejection because this hint is
- * not durable lifecycle authority.
+ * @remarks The only publisher is the `task` tool's managed-authority path (`onManagedStart`).
+ * Creation and status writes never publish: a created task is a record until `task` runs it.
+ * Delivery is FIFO per Tenant/Task and awaits every listener settlement. Callers that dispatch
+ * must invoke `publish` fire-and-forget and contain rejection because this hint is not durable
+ * lifecycle authority.
  */
 declare class ProjectTaskAdmissionNotifier {
     private readonly listeners;
@@ -8141,7 +8563,7 @@ declare class ProjectTaskAdmissionNotifier {
     private deliver;
     private deliverTo;
 }
-/** Process-global Project task admission notifier used by governed creation paths. */
+/** Process-global Project task admission notifier used by the managed dispatch path. */
 declare const projectTaskAdmissionNotifier: ProjectTaskAdmissionNotifier;
 
 /** Exact Tenant and Project scope for collaboration mutations. */
@@ -8930,6 +9352,15 @@ interface BeliefImpactInput {
     key: string;
     after: number;
     basis: string;
+    /**
+     * Declares that `key` is intentionally a NEW belief the reporting task
+     * discovered, rather than a reference to an existing owner-table key.
+     *
+     * When absent, the key MUST already exist in the belief owner's table;
+     * a missing key without this flag is rejected (`INVALID_BELIEF_KEY`) so a
+     * typo or hallucinated key can never silently pollute the shared model.
+     */
+    isNew?: boolean;
 }
 
 /** A recoverable work-item failure that occurred after a task transition committed. */
@@ -8953,6 +9384,7 @@ type LifecycleResult = {
     code: string;
     error: string;
     hint?: string;
+    retryable?: boolean;
     evidenceId?: string;
     eventKey?: string;
     warnings?: LifecycleWarning[];
@@ -8975,6 +9407,7 @@ type StartLifecycleResult = {
     code: string;
     error: string;
     hint?: string;
+    retryable?: boolean;
     eventKey?: string;
     warnings?: LifecycleWarning[];
 };
@@ -8994,6 +9427,11 @@ interface AgentTaskCompletionInput {
     actor: string;
     threadId?: string;
     sourceId?: string;
+    /**
+     * Completes despite a persisted `requireReview` because no HITL channel can
+     * ever review it. The caller records the waiver (audit) separately.
+     */
+    waiveReview?: boolean;
 }
 /** Input for submitting agent completion evidence to HITL review. */
 interface SubmitTaskReviewInput extends AgentTaskCompletionInput {
@@ -9101,18 +9539,7 @@ interface BeliefOwnerSnapshot {
         workspaceId?: string;
         projectId?: string;
     };
-    parentUpdatedAt?: string;
 }
-/**
- * Returns whether a task belongs to the trusted, nondefault Project lifecycle.
- *
- * @param task Task snapshot whose durable scope and trusted origin are inspected.
- * @returns True only for nondefault Project Room or Project Task origins.
- */
-declare function isProjectLifecycleTask(task: TaskItem): task is TaskItem & {
-    workspaceId: string;
-    projectId: string;
-};
 /**
  * Parses a descriptor-safe canonical external-dependency interruption.
  *
@@ -9162,6 +9589,17 @@ declare class TaskLifecycleService {
      * @remarks Review interruptions must be approved or rejected through their evidence-bound methods.
      */
     resumeInterruption(input: ResumeInterruptionInput): Promise<LifecycleResult>;
+    /**
+     * Reopens a review interruption without an approval.
+     *
+     * @param input Task, actor, and optional thread.
+     * @returns Structured resume result with an audited `review_waived` transition.
+     * @remarks Explicit escape for the "review channel does not exist" case: unlike
+     * `resumeInterruption`, this intentionally allows a `review_required`
+     * interruption so the requester can complete with a waiver. A real HITL
+     * channel keeps using `approveInterrupted`/`rejectInterrupted`.
+     */
+    withdrawReview(input: ResumeInterruptionInput): Promise<LifecycleResult>;
     /** Atomically fails an active agent task and records an idempotent status event. */
     failTask(input: FailTaskInput): Promise<LifecycleResult>;
     /** Atomically starts a pending agent task and records an idempotent status event. */
@@ -9247,11 +9685,32 @@ declare class TaskLifecycleService {
     private transitionAgentTask;
     private statusEventKey;
     private writeStatusEvent;
+    /**
+     * Publishes one committed transition for any scope-bearing task.
+     *
+     * @remarks `action` keeps the `ProjectTaskLifecycleAction` type for wire
+     * compatibility even though publication is now generic (ADR-118 Plan A).
+     * Presence-based gating means tasks with a real workspace/project publish even
+     * when they are not project-sourced, including the literal `"default"` scope.
+     * The gateway subscriber filters by its own project predicate; this bounded
+     * window lasts until the host filter lands (ADR-118 Plan A, Task 3).
+     */
     private notifyWinningTransition;
     private validateExternalDependencies;
     private externalDependencyReadiness;
     private finishExternalDependencyInterruption;
     private clearAuditMarker;
+    /**
+     * Restores a context marker removed by {@link clearAuditMarker}.
+     *
+     * @param task Task whose marker was cleared.
+     * @param key Context key to restore.
+     * @param value Marker payload to write back.
+     * @returns The updated task, or the input task when the CAS loses or throws.
+     * @remarks Used when publishing the completion notification fails after the
+     * marker was cleared, so the transition keeps a repair marker for a later pass.
+     */
+    private restoreContextKey;
     private writeReviewActivity;
     private createEvent;
     private success;
@@ -9265,6 +9724,15 @@ declare class TaskLifecycleService {
  */
 declare function createTaskLifecycleService(deps?: TaskLifecycleServiceDeps): TaskLifecycleService;
 
+/**
+ * Shared persistent-task execution types.
+ *
+ * @remarks ADR-118 follow-up: the dispatch planner and the run-only executor both
+ * depend on these contracts. Keeping them in a neutral module lets the planner
+ * consume them without importing the executor, which in turn imports the planner
+ * value (avoiding a type-level cycle between the two).
+ */
+
 /** Describes one isolated Agent invocation for persistent task execution. */
 interface TaskAgentInvocation {
     tenantId: string;
@@ -9284,6 +9752,12 @@ interface TaskExecutionServiceDeps {
     workItemStore: TaskWorkItemStore;
     invokeAgent: (input: TaskAgentInvocation) => Promise<unknown>;
     resolveAgent: (tenantId: string, agentId: string) => Promise<boolean>;
+    /**
+     * Optional thread-id generator; defaults to `randomUUID`.
+     *
+     * @remarks The generated id is the isolated run thread and is persisted as the
+     * task's `context.thread_id`.
+     */
     createThreadId?: () => string;
 }
 /** Identifies a persistent task, target Agent, caller, and runtime scope. */
@@ -9294,7 +9768,17 @@ interface StartTaskExecutionInput {
     taskId: string;
     agentId: string;
     actor: string;
+    /**
+     * Thread the dispatch was requested from (caller provenance).
+     *
+     * @remarks Not the run link: the immediate executor generates its own
+     * isolated run thread and persists that as the task's `context.thread_id`.
+     */
     callerThreadId?: string;
+    /** Trusted Project caller membership forwarded to a managed authority, when known. */
+    callerMembershipId?: string;
+    /** Trusted Project caller Assistant forwarded to a managed authority, when known. */
+    callerAssistantId?: string;
 }
 /** Successful isolated execution observation recorded for later reconciliation. */
 interface TaskExecutionSuccess {
@@ -9306,6 +9790,20 @@ interface TaskExecutionSuccess {
     executionResultId: string;
     warnings?: LifecycleWarning[];
 }
+/**
+ * Result of routing execution to a registered authority.
+ *
+ * @remarks The authority (e.g. the durable Project queue) runs the task
+ * asynchronously; the caller observes the task itself rather than an inline
+ * observation.
+ */
+interface TaskExecutionManaged {
+    success: true;
+    managed: true;
+    taskId: string;
+    agentId: string;
+    authorityId: string;
+}
 /** Typed validation, lifecycle, or Agent invocation failure. */
 interface TaskExecutionFailure {
     success: false;
@@ -9317,15 +9815,20 @@ interface TaskExecutionFailure {
     executionResultId?: string;
     blockedBy?: string[];
     invocationError?: string;
+    /** Actionable remediation for the failure, when one is known. */
+    hint?: string;
+    /** Whether the caller may safely retry the same dispatch. */
+    retryable?: boolean;
     warnings?: LifecycleWarning[];
 }
-/** Result returned by a persistent task execution attempt. */
-type TaskExecutionResult = TaskExecutionSuccess | TaskExecutionFailure;
+/** Result returned by a persistent task execution attempt or authority route. */
+type TaskExecutionResult = TaskExecutionSuccess | TaskExecutionManaged | TaskExecutionFailure;
+
 /**
  * Creates a synchronous persistent-task execution service from injected stores and Agent adapters.
  *
  * @param deps Task stores, target resolution, isolated invocation, and optional thread ID generation.
- * @returns A service whose `start` method validates, starts, dispatches, and records an observation.
+ * @returns A service whose `start` method plans, runs, and records a persistent task dispatch.
  *
  * @example
  * ```ts
@@ -9339,11 +9842,586 @@ declare function createTaskExecutionService(deps: TaskExecutionServiceDeps): {
     start: (input: StartTaskExecutionInput) => Promise<TaskExecutionResult>;
 };
 
+/**
+ * Dispatch planner for immediate persistent task execution (ADR-118 §边界修正 1).
+ *
+ * @remarks This module owns the L1/L3 half of dispatch: record read, scope
+ * verification, record preconditions, target capability, registered authority
+ * routing, target existence, and dependency/parent resolution. It performs no
+ * direct task-store write (but may trigger a registered authority's managed-start
+ * side effect) and never invokes an Agent. {@link prepareTaskDispatch} returns either
+ * a routed managed result, a typed failure, or an {@link ImmediateDispatchPlan}
+ * consumed by the run-only executor.
+ */
+
+/** Everything the run half needs to invoke the target and record the result. */
+interface ImmediateDispatchPlan {
+    /** Tenant owning the task and the run. */
+    tenantId: string;
+    /** Persisted task snapshot that passed every precondition. */
+    task: TaskItem;
+    /** Resolved target Agent to execute the task. */
+    agentId: string;
+    /** Actor recorded on lifecycle and work-item writes. */
+    actor: string;
+    /** Caller thread provenance; not the run link (the executor links its own run thread). */
+    callerThreadId?: string;
+    /** In-scope parent task, when the task has one; otherwise `null`. */
+    parent: TaskItem | null;
+    /** In-scope, completed dependencies whose results seed the worker message. */
+    completedDependencies: TaskItem[];
+}
+/**
+ * Outcome of planning a dispatch, before any run-side mutation or invocation.
+ *
+ * @remarks A discriminated union: `managed` means a registered authority owns
+ * execution, `failure` carries a typed precondition/policy rejection, and
+ * `ready` carries the {@link ImmediateDispatchPlan} for immediate execution.
+ */
+type DispatchPreparation = {
+    kind: "managed";
+    result: TaskExecutionManaged;
+} | {
+    kind: "failure";
+    failure: TaskExecutionFailure;
+} | {
+    kind: "ready";
+    plan: ImmediateDispatchPlan;
+};
+/**
+ * Plans a persistent task dispatch without mutating state or invoking an Agent.
+ *
+ * @param deps Task store and target existence probe.
+ * @param input Tenant, target Agent, actor, caller, and runtime scope.
+ * @returns A managed route, a typed failure, or a ready immediate dispatch plan.
+ *
+ * @remarks Steps run in a fixed order so the first applicable outcome wins:
+ * read/scope → status preconditions → authority routing → target existence →
+ * dependency validation → parent load. Only the immediate path reaches the
+ * target-existence and dependency/parent steps; a managed authority returns
+ * before them. This function performs no direct task-store write (a managed
+ * authority's managed-start side effect may still run).
+ *
+ * @example
+ * ```ts
+ * const prepared = await prepareTaskDispatch(deps, { tenantId, taskId, agentId, actor });
+ * if (prepared.kind === "ready") await run(prepared.plan);
+ * ```
+ */
+declare function prepareTaskDispatch(deps: Pick<TaskExecutionServiceDeps, "taskStore" | "resolveAgent">, input: StartTaskExecutionInput): Promise<DispatchPreparation>;
+
+/**
+ * TaskRunBridge — the single owner of "execution writes to the task record".
+ *
+ * @remarks ADR-118: the execution layer (L2) must not write task state inline. This bridge
+ * owns dispatch (`pending → in_progress`, `beginRun`, shared by the immediate executor and
+ * the managed project dispatch) and abnormal outcome convergence (`settleRun`, used by the
+ * managed observer). Normal completion stays with the worker's own `manage_task` writes
+ * (single-writer convention; not a lease).
+ */
+
+/**
+ * Raised when an ownership transfer is requested without an injected task store.
+ *
+ * @remarks The immediate executor always supplies the store; the managed Project
+ * dispatch builds the bridge with only `lifecycle` and never calls
+ * {@link TaskRunBridge.transferOwner}.
+ */
+declare class TaskRunBridgeStoresRequiredError extends Error {
+    /** Stable machine-readable failure code. */
+    readonly code: "TASK_RUN_BRIDGE_STORES_REQUIRED";
+    constructor();
+}
+/**
+ * Describes one dispatch attempt for a persisted task run.
+ *
+ * @remarks `threadId` is optional so callers that dispatch before a thread
+ * exists can omit it; the lifecycle and work-item writes record it when present.
+ */
+interface BeginRunInput {
+    /** Tenant identifier owning the task. */
+    tenantId: string;
+    /** Persisted task snapshot captured before dispatch. */
+    task: TaskItem;
+    /** Actor recorded on the lifecycle transition and status work item. */
+    actor: string;
+    /**
+     * Isolated run thread recorded on the dispatch and linked into the task.
+     *
+     * @remarks For agent tasks `lifecycle.startTask` persists it as
+     * `context.thread_id`, so the TaskItem points at the clean run thread.
+     * Optional so callers that dispatch before a thread exists can omit it.
+     */
+    threadId?: string;
+}
+/**
+ * Result of a dispatch that mutated (or confirmed) the run's starting state.
+ *
+ * @remarks `mutated` and `transitioned` are propagated verbatim from the
+ * lifecycle winner; a `false` value is a successful no-op, not a failure.
+ */
+interface BeginRunSuccess {
+    success: true;
+    /** Latest task snapshot after dispatch. */
+    task: TaskItem;
+    /** Recoverable work-item warnings emitted while starting the run. */
+    warnings: LifecycleWarning[];
+    /** Whether any persisted task field changed. */
+    mutated: boolean;
+    /** Whether this dispatch won the pending-to-in-progress transition. */
+    transitioned: boolean;
+}
+/** Typed dispatch failure returned unchanged from the lifecycle or task store. */
+interface BeginRunFailure {
+    success: false;
+    /** Stable machine-readable failure code. */
+    code: string;
+    /** Human-readable failure message. */
+    error: string;
+    /** Optional remediation hint from the lifecycle. */
+    hint?: string;
+    /** Whether the caller may safely retry the dispatch. */
+    retryable?: boolean;
+    /** Recoverable work-item warnings emitted before the failure. */
+    warnings?: LifecycleWarning[];
+}
+/** Discriminated result of {@link TaskRunBridge.beginRun}. */
+type BeginRunResult = BeginRunSuccess | BeginRunFailure;
+/**
+ * Terminal-ish outcome a finished run converged to.
+ *
+ * @remarks `failed` with `lifecycleHandled: true` means the lifecycle already
+ * converged the task and the bridge must not write again (pure no-op).
+ */
+type SettleRunOutcome = 
+/**
+ * The agent run ended without the task's own lifecycle transition.
+ *
+ * @remarks This is intentionally NOT a success path: it maps to
+ * `failTask("Agent execution ended without a task lifecycle transition")`
+ * so a run that stopped without converging the task is recorded as a
+ * failure rather than silently left active.
+ */
+{
+    kind: "completed";
+}
+/** Cancels the run; `summary` overrides the default cancellation summary. */
+ | {
+    kind: "cancelled";
+    summary?: string;
+}
+/** Interrupts the run; `summary` overrides the default interruption summary. */
+ | {
+    kind: "interrupted";
+    summary?: string;
+} | {
+    kind: "failed";
+    lifecycleHandled: boolean;
+    error: string;
+};
+/**
+ * Describes one ordinary task ownership transfer performed before dispatch.
+ *
+ * @remarks Transfers are last-write-wins (ADR-116): content writes do not use
+ * CAS. The task must already be captured in scope before calling.
+ */
+interface TransferOwnerInput {
+    /** Tenant identifier owning the task. */
+    tenantId: string;
+    /** Persisted task snapshot captured before dispatch. */
+    task: TaskItem;
+    /** Agent that will own and execute the dispatched task. */
+    agentId: string;
+}
+/**
+ * Result of {@link TaskRunBridge.transferOwner}.
+ *
+ * @remarks On success, `task` is the transferred snapshot when the write
+ * succeeded, or the original snapshot when the task was already owned by the
+ * target or the store update returned `null`. A store write rejection is
+ * returned as a typed failure so callers keep their no-throw contract.
+ */
+type TransferOwnerResult = {
+    success: true;
+    /** Latest task snapshot after the attempted transfer. */
+    task: TaskItem;
+} | {
+    success: false;
+    /** Stable machine-readable failure code. */
+    code: string;
+    /** Human-readable failure message. */
+    error: string;
+};
+/** Describes one outcome convergence write for a finished run. */
+interface SettleRunInput {
+    /** Tenant identifier owning the task. */
+    tenantId: string;
+    /** Persisted task snapshot captured before convergence. */
+    task: TaskItem;
+    /** Actor recorded on the lifecycle transition. */
+    actor: string;
+    /**
+     * Optional owning thread identifier recorded on the lifecycle transition.
+     *
+     * @remarks Callers that converge a task without an exact thread (for example
+     * the A2A adapter observing an external state) may omit it.
+     */
+    threadId?: string;
+    /** Run outcome to converge onto the task record. */
+    outcome: SettleRunOutcome;
+}
+/** Persistence and lifecycle dependencies used by {@link createTaskRunBridge}. */
+interface TaskRunBridgeDeps {
+    /** Task lifecycle operations the bridge is allowed to invoke. */
+    lifecycle: Pick<TaskLifecycleService, "startTask" | "resumeInterruption" | "retryTask" | "failTask" | "cancelTask" | "interruptTask">;
+    /**
+     * Optional task store used by ownership transfer (any owner type) and the
+     * non-agent (user-owned) dispatch branch. Callers that never transfer or
+     * dispatch user-owned tasks (such as the Project task observer) may omit it.
+     */
+    taskStore?: Pick<TaskStore, "updateIfStatusAndUpdatedAt" | "update">;
+    /**
+     * Optional work-item store used only by the non-agent (user-owned) dispatch
+     * branch. Agent-only callers may omit it.
+     */
+    workItemStore?: Pick<TaskWorkItemStore, "create">;
+}
+/**
+ * The single owner of "execution writes to the task record".
+ *
+ * @remarks
+ * - `beginRun` owns the `pending -> in_progress` dispatch write.
+ * - `settleRun` owns outcome convergence for a finished run.
+ * - Callers are responsible for running lifecycle result checks (e.g. logging,
+ *   notification) on the value returned by `settleRun`.
+ */
+interface TaskRunBridge {
+    /**
+     * Transfers ordinary (non-governed) task ownership to the dispatch target.
+     *
+     * @param input Tenant, captured task snapshot, and target Agent identifier.
+     * @returns A success carrying the transferred snapshot when the write
+     * succeeds (or the original snapshot when the task is already owned by the
+     * target agent, or the store update returns `null`), or a typed
+     * `TASK_STORE_WRITE_FAILED` failure when the store write rejects.
+     *
+     * @remarks
+     * - Ownership is compared on **both** fields: a `user` task whose `ownerId`
+     *   equals `agentId` still transfers to `ownerType: "agent"`.
+     * - Writes last-write-wins (ADR-116); when `update` returns `null` the
+     *   dispatch proceeds with the original snapshot and {@link beginRun} decides.
+     * - A store write rejection is returned as a failure, never thrown, so
+     *   callers keep their no-throw contract.
+     * - Throws {@link TaskRunBridgeStoresRequiredError} when no task store was
+     *   injected.
+     */
+    transferOwner(input: TransferOwnerInput): Promise<TransferOwnerResult>;
+    /**
+     * Dispatches a run, moving a pending task to `in_progress`.
+     *
+     * @param input Tenant, captured task snapshot, actor, and optional thread ID.
+     * @returns A success carrying the winning snapshot and transition metadata, or
+     * an unchanged lifecycle/store failure.
+     */
+    beginRun(input: BeginRunInput): Promise<BeginRunResult>;
+    /**
+     * Converges a finished run's outcome onto the task record.
+     *
+     * @param input Tenant, captured task snapshot, actor, optional thread ID, and outcome.
+     * @returns The lifecycle result for the convergence transition, or a
+     * successful no-op when the run already handled its own lifecycle.
+     *
+     * @remarks The bridge returns only the lifecycle result. The caller still
+     * owns the run `cause` it used for `outcome-${cause}` labels/telemetry; the
+     * bridge does not echo or reinterpret it. This method performs the lifecycle
+     * write **unconditionally**: it does no re-read/terminal/ownership precondition
+     * check, so callers must keep their own guards (e.g. the observer's
+     * aborted/re-read/owner+thread/terminal guard block) before calling it.
+     */
+    settleRun(input: SettleRunInput): Promise<LifecycleResult>;
+}
+/**
+ * Creates the task/run bridge that centralizes execution writes to the task record.
+ *
+ * The bridge owns three writes: ownership transfer (`transferOwner`), dispatch
+ * (`beginRun`), and outcome convergence (`settleRun`). All are
+ * behavior-preserving extracts of the immediate executor and the Project task
+ * observer so those callers stop writing the task record directly.
+ *
+ * @param deps Lifecycle operations plus the optional task/work-item stores used
+ * by ownership transfer and the non-agent dispatch branch.
+ * @returns A {@link TaskRunBridge} with `transferOwner`, `beginRun`, and
+ * `settleRun`.
+ *
+ * @example
+ * ```ts
+ * const bridge = createTaskRunBridge({
+ *   lifecycle: createTaskLifecycleService({ taskStore, workItemStore }),
+ *   taskStore,
+ *   workItemStore,
+ * });
+ *
+ * const transfer = await bridge.transferOwner({ tenantId, task, agentId });
+ * if (!transfer.success) return transfer;
+ * const started = await bridge.beginRun({ tenantId, task: transfer.task, actor, threadId });
+ * ```
+ *
+ * @remarks
+ * `transferOwner` and the non-agent (user-owned) dispatch branch require
+ * `taskStore` (and `workItemStore` for the latter); callers that only dispatch
+ * agent tasks (such as the Project task observer) may omit them. `settleRun`
+ * only requires `lifecycle`.
+ */
+declare function createTaskRunBridge(deps: TaskRunBridgeDeps): TaskRunBridge;
+
+/**
+ * Process-local record of tasks currently held by a live run.
+ *
+ * @remarks
+ * A task is registered when a run starts holding it (dispatch claim or the run
+ * entry `beforeAgent`) and unregistered when that run ends (`afterAgent`). The
+ * registry answers "is this `in_progress` task actually being executed right
+ * now?" for the reconcile fallback. It is intentionally in-process: a restart
+ * empties it, which is exactly what makes every orphaned `in_progress` task
+ * recoverable after a crash.
+ *
+ * @example
+ * ```ts
+ * import { taskRunRegistry } from "./TaskRunRegistry";
+ * taskRunRegistry.register(taskId);
+ * taskRunRegistry.isLive(taskId); // true
+ * taskRunRegistry.unregister(taskId);
+ * ```
+ */
+declare class TaskRunRegistry {
+    private readonly live;
+    /** Marks a task as currently held by a live run. */
+    register(taskId: string): void;
+    /** Removes a task once its run has ended. */
+    unregister(taskId: string): void;
+    /** Reports whether a task is currently held by a live run. */
+    isLive(taskId: string): boolean;
+    /** Returns a snapshot of the live task ids (diagnostics/tests). */
+    snapshot(): string[];
+    /** Clears all live entries (tests / process teardown). */
+    clear(): void;
+}
+/** Shared process-local registry used by the task engine and the reconcile fallback. */
+declare const taskRunRegistry: TaskRunRegistry;
+/** Input for {@link reconcileStaleTaskRuns}. */
+interface ReconcileStaleTaskRunsInput {
+    /** Candidate tasks within the caller's scope (the host owns enumeration). */
+    tasks: TaskItem[];
+    /** Actor recorded on the convergence transition. */
+    actor: string;
+    /** Lifecycle used to converge an orphaned task. */
+    lifecycle: Pick<TaskLifecycleService, "interruptTask">;
+    /** Registry override (tests); defaults to {@link taskRunRegistry}. */
+    registry?: TaskRunRegistry;
+}
+/** Result of {@link reconcileStaleTaskRuns}. */
+interface ReconcileStaleTaskRunsResult {
+    /** Task ids that were converged to `interrupted`. */
+    converged: string[];
+}
+/**
+ * Converges `in_progress` tasks that no live run holds to `interrupted`.
+ *
+ * @param input Candidate tasks, actor, lifecycle, and optional registry.
+ * @returns The ids that were converged.
+ * @remarks
+ * The caller owns scope enumeration (a store cannot list across tenants). A task
+ * is converged only when it is `in_progress` and absent from the registry, so a
+ * task a live run genuinely holds is never touched.
+ *
+ * @example
+ * ```ts
+ * const { converged } = await reconcileStaleTaskRuns({
+ *   tasks: scopeTasks, actor: "system:reconcile", lifecycle,
+ * });
+ * ```
+ */
+declare function reconcileStaleTaskRuns(input: ReconcileStaleTaskRunsInput): Promise<ReconcileStaleTaskRunsResult>;
+/** Input for {@link reconcileTenantTaskRuns}. */
+interface ReconcileTenantTaskRunsInput {
+    /** Tenant whose `in_progress` tasks are enumerated. */
+    tenantId: string;
+    /** Actor recorded on the convergence transition. */
+    actor: string;
+    /** Store used to enumerate the tenant's `in_progress` tasks. */
+    taskStore: Pick<TaskStore, "list">;
+    /** Lifecycle used to converge an orphaned task. */
+    lifecycle: Pick<TaskLifecycleService, "interruptTask">;
+    /** Registry override (tests); defaults to {@link taskRunRegistry}. */
+    registry?: TaskRunRegistry;
+    /**
+     * Optional host predicate selecting which candidates this reconciler owns.
+     *
+     * @remarks Host-owned task families (for example governed Project tasks, which
+     * have their own observer) pass a predicate that excludes them, so this
+     * generic reconciler never competes with a domain reconciler.
+     */
+    include?: (task: TaskItem) => boolean;
+}
+/**
+ * Reconciles a tenant's orphaned `in_progress` tasks.
+ *
+ * @param input Tenant, actor, store, lifecycle, optional registry and predicate.
+ * @returns The ids that were converged.
+ * @remarks
+ * Enumerates `{ tenantId, status: "in_progress" }` and delegates to
+ * {@link reconcileStaleTaskRuns}. The caller owns the `include` predicate; a
+ * host must exclude task families that have their own reconciliation.
+ *
+ * @example
+ * ```ts
+ * await reconcileTenantTaskRuns({
+ *   tenantId, actor: "system:reconcile", taskStore, lifecycle,
+ *   include: (task) => !isProjectLifecycleTask(task),
+ * });
+ * ```
+ */
+declare function reconcileTenantTaskRuns(input: ReconcileTenantTaskRunsInput): Promise<ReconcileStaleTaskRunsResult>;
+/** Input for {@link reconcileAllTenantTaskRuns}. */
+interface ReconcileAllTenantTaskRunsInput {
+    /** Actor recorded on the convergence transition. */
+    actor: string;
+    /** Store used to enumerate tenants. */
+    tenantStore: {
+        listTenants(): Promise<Array<{
+            id: string;
+        }>>;
+    };
+    /** Store used to enumerate each tenant's `in_progress` tasks. */
+    taskStore: Pick<TaskStore, "list">;
+    /** Lifecycle used to converge an orphaned task. */
+    lifecycle: Pick<TaskLifecycleService, "interruptTask">;
+    /** Registry override (tests); defaults to {@link taskRunRegistry}. */
+    registry?: TaskRunRegistry;
+    /** Host predicate selecting which candidates this reconciler owns. */
+    include?: (task: TaskItem) => boolean;
+}
+/**
+ * Reconciles orphaned `in_progress` tasks across all tenants.
+ *
+ * @param input Actor, tenant store, task store, lifecycle, optional registry and predicate.
+ * @returns The ids that were converged across every tenant.
+ * @remarks Enumerates tenants via `listTenants()` and delegates per tenant to
+ * {@link reconcileTenantTaskRuns}. Intended for a host startup/interval job;
+ * callers own when it runs.
+ *
+ * @example
+ * ```ts
+ * await reconcileAllTenantTaskRuns({
+ *   actor: "system:reconcile", tenantStore, taskStore, lifecycle,
+ *   include: (task) => !isProjectLifecycleTask(task),
+ * });
+ * ```
+ */
+declare function reconcileAllTenantTaskRuns(input: ReconcileAllTenantTaskRunsInput): Promise<ReconcileStaleTaskRunsResult>;
+
 /** Internal authority for immediate delegated worker execution. */
 declare const DELEGATED_WORKER_SCOPE_TOKEN: unique symbol;
 /** Reports whether a run configuration contains the private delegated token key. */
 declare function hasDelegatedWorkerToken(runConfig: Record<string, unknown> & Partial<Record<typeof DELEGATED_WORKER_SCOPE_TOKEN, unknown>>): boolean;
 
+/**
+ * Requested dispatch target and trusted caller identity forwarded to a managed authority.
+ *
+ * @remarks Core forwards the requested `agentId` and the trusted Project caller
+ * it parsed from the run context. The authority owns every roster, ownership
+ * transfer, and authorization decision; Core never interprets them.
+ */
+interface ManagedTaskStartOptions {
+    /** Requested dispatch target Agent, when the caller named one. */
+    agentId?: string;
+    /** Trusted Project caller membership identifier, when the run context carried one. */
+    callerMembershipId?: string;
+    /** Trusted Project caller Assistant identifier, when the run context carried one. */
+    callerAssistantId?: string;
+}
+/**
+ * Typed failure a managed authority throws to surface a stable dispatch outcome.
+ *
+ * @remarks Only this error type is surfaced verbatim by the immediate primitive
+ * (code, message, `hint`, `retryable`). Any other thrown error is reported as
+ * `TASK_EXECUTION_ENQUEUE_FAILED` so unrelated driver or store codes never leak
+ * into the dispatch result.
+ *
+ * @example
+ * ```ts
+ * throw new ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", "Owner is not active", {
+ *   hint: "Dispatch to an active bot in this Project's roster.",
+ * });
+ * ```
+ */
+declare class ManagedTaskStartError extends Error {
+    /** Stable machine-readable failure code surfaced to the dispatch caller. */
+    readonly code: string;
+    /** Actionable remediation shown alongside the failure, when known. */
+    readonly hint?: string;
+    /** Whether the caller may safely retry the same dispatch, when known. */
+    readonly retryable?: boolean;
+    /**
+     * Creates a managed dispatch failure.
+     *
+     * @param code Stable machine-readable failure code.
+     * @param message Human-readable failure description.
+     * @param options Optional remediation hint and retryability flag.
+     */
+    constructor(code: string, message: string, options?: {
+        hint?: string;
+        retryable?: boolean;
+    });
+}
+/**
+ * A registered owner of task execution.
+ *
+ * A matching authority means "this task is executed by the authority, not by
+ * the immediate primitive". The registration is a composition concern: the
+ * business scenario (Project Room/Task, Learning, ...) supplies the predicate
+ * and messaging; the execution primitive only queries the registry.
+ */
+interface ExecutionAuthority {
+    /** Stable identifier of the authority (e.g. `project-lifecycle`). */
+    id: string;
+    /** Predicate deciding whether this authority owns the given task. */
+    matches(task: TaskItem): boolean;
+    /** Failure code returned by the immediate primitive when it is bypassed. */
+    code?: string;
+    /** Human-readable message returned alongside the code. */
+    message?: string;
+    /**
+     * Optional hook invoked by the immediate primitive when this authority owns
+     * the task. When present, `start` routes the request to the authority and
+     * returns a managed (asynchronous) result instead of refusing.
+     *
+     * @param task Persisted task snapshot captured before routing.
+     * @param options Requested target and trusted caller identity, when known.
+     */
+    onManagedStart?(task: TaskItem, options?: ManagedTaskStartOptions): Promise<void> | void;
+}
+/**
+ * Process-global registry mapping tasks to the authority that owns their execution.
+ *
+ * @remarks
+ * - Registration is idempotent by `id` (re-registering replaces the entry).
+ * - `resolve` is order-insensitive: the first matching authority wins.
+ * - A throwing predicate is treated as a non-match so a broken scenario can
+ *   never brick the immediate execution primitive.
+ */
+declare class ExecutionAuthorityRegistry {
+    private readonly authorities;
+    /** Registers (or replaces) an authority. @returns An unregister function. */
+    register(authority: ExecutionAuthority): () => void;
+    /** Resolves the authority that owns the task's execution, if any. */
+    resolve(task: TaskItem): ExecutionAuthority | undefined;
+    /** Removes every registration. Intended for isolated tests. */
+    clear(): void;
+}
+/** Process-global execution authority registry used by the immediate executor. */
+declare const executionAuthorityRegistry: ExecutionAuthorityRegistry;
+
 declare const AGENT_TASK_EVENT = "agent:execute";
 
 /**
@@ -9803,12 +10881,15 @@ declare function compileSandboxPlugin(args: CompileSandboxPluginArgs): Plugin;
  * @property hash - Content hash of the validated manifests and their relative file paths; empty when the sandbox was unavailable.
  * @property plugins - Compiled plugins ready to register for the tenant.
  * @property diagnostics - Structured load/validation diagnostics for the snapshot.
+ * @property manifests - Normalized manifests keyed by plugin type; the validated
+ *   source of truth for handler paths and tool caps (not the raw `plugin.json`).
  */
 interface TenantPlugins {
     tenantId: string;
     hash: string;
     plugins: Plugin[];
     diagnostics: SandboxPluginDiagnostic[];
+    manifests: Record<string, SandboxPluginManifest>;
 }
 /**
  * Dependencies for {@link TenantPluginCatalog}.
@@ -9876,6 +10957,20 @@ declare class TenantPluginCatalog {
      * @returns The cached snapshot, or `undefined` when the tenant has not loaded
      */
     getCached(tenantId: string): TenantPlugins | undefined;
+    /**
+     * Return the validated manifest for a tenant plugin type.
+     *
+     * The returned manifest is the normalized output of
+     * {@link validateSandboxPluginManifest}, **not** the raw `plugin.json` bytes.
+     * Callers that execute tools must read handler paths and resource caps from
+     * here so a cache/TOCTOU skew or a hand-edited file cannot bypass validation.
+     *
+     * @param tenantId - Tenant that owns the plugin
+     * @param type - Plugin type (directory name)
+     * @returns The normalized manifest, or `undefined` when the plugin is absent
+     *   or failed validation
+     */
+    getValidatedManifest(tenantId: string, type: string): Promise<SandboxPluginManifest | undefined>;
     /**
      * Drop the cached snapshot for a tenant.
      *
@@ -10191,13 +11286,16 @@ declare const documentParserPlugin: Plugin;
  * Semantic Metrics Middleware & Plugin (connection-backed, /api/v1).
  *
  * Exposes datasource exploration, meta publishing, and runtime query tools.
- * Credentials are resolved via the framework-injected `_resolvedConnections`.
+ * Credentials are resolved by the plugin's own tools at invocation time from
+ * the tenant-scoped Connection Store (see `resolveMetricsClientFromSelector`).
  */
 
 /**
  * Create the Semantic Metrics middleware exposing three action-dispatch tools.
  *
- * @param config - Plugin config; reads `config._resolvedConnections` (framework-injected).
+ * @param config - Plugin config; reads `connections`/`connectAll` (resolved per
+ * invocation from the tenant-scoped Connection Store). Resource scope is owned
+ * by the connection's own `selectedEntities`.
  * @returns Middleware with the datasource/meta/runtime tool set.
  */
 declare function createSemanticMetricsMiddleware(config: Record<string, unknown>): AgentMiddleware;
@@ -10337,6 +11435,76 @@ interface UnknownToolHandlerConfig {
  */
 declare function createUnknownToolHandlerMiddleware(config?: UnknownToolHandlerConfig): AgentMiddleware;
 
+/**
+ * Repeated Tool Call Breaker Middleware
+ *
+ * Model-agnostic loop guard. Counts consecutive identical tool-call signatures
+ * in graph state (`afterModel`), blocks the call with a corrective reminder at
+ * the warn threshold (`wrapToolCall`), and throws a `RepeatedToolCallError` to
+ * hard-stop the run at the stop threshold.
+ *
+ * This protects runs from models that re-issue the exact same call (same tool,
+ * same arguments) without incorporating the previous result — e.g. a deepseek
+ * agent issuing the identical `read_eval get_run_results` call dozens of times.
+ *
+ * @example
+ * ```ts
+ * middlewares.push(createRepeatedToolCallBreakerMiddleware({ warnThreshold: 3, stopThreshold: 5 }));
+ * ```
+ *
+ * @remarks
+ * Thresholds are supplied at construction time; callers typically read them from
+ * env via `readLoopBreakerConfig`. A threshold of `0` disables the guard.
+ */
+
+/** Raised when a run keeps issuing the identical tool call past the stop threshold. */
+declare class RepeatedToolCallError extends Error {
+    readonly toolName: string | undefined;
+    readonly count: number;
+    readonly stopThreshold: number;
+    readonly argsPreview: string;
+    constructor(toolName: string | undefined, count: number, stopThreshold: number, argsPreview: string);
+}
+/** Thresholds for the loop guards. A value of `0` disables that guard. */
+interface LoopBreakerConfig {
+    /** Call count at which repeated identical calls are blocked with a reminder. */
+    repeatWarn: number;
+    /** Call count at which a `RepeatedToolCallError` is thrown. */
+    repeatStop: number;
+    /** Per-run tool-call budget for the global limit middleware. */
+    runLimit: number;
+    /** Per-run cap for the `skill` tool, to stop skill-load enumeration (0 disables). */
+    skillRunLimit: number;
+}
+/** Read loop-breaker thresholds from env. 0 disables a guard. Invalid values fall back to defaults. */
+declare function readLoopBreakerConfig(env?: NodeJS.ProcessEnv): LoopBreakerConfig;
+/** Construction options for {@link createRepeatedToolCallBreakerMiddleware}. */
+interface RepeatedToolCallBreakerOptions {
+    /**
+     * Call count at which the repeated call is blocked with a reminder (default 3).
+     * A positive value is floored to `2` so the first call of every signature always
+     * executes (`warnThreshold: 1` cannot brick all tool use). A value `<= 0` disables
+     * the blocking tier while counting and the stop throw stay active.
+     */
+    warnThreshold?: number;
+    /**
+     * Call count at which a `RepeatedToolCallError` is thrown (default 5).
+     * Construction coerces this to at least 1; a value `<= 0` disables the whole guard at install time.
+     */
+    stopThreshold?: number;
+}
+/**
+ * Warn-and-block, then hard-stop, when the model keeps issuing the identical tool call.
+ *
+ * @param options - Threshold configuration; see {@link RepeatedToolCallBreakerOptions}.
+ *   A positive `warnThreshold` has an effective minimum of `2`, so the first call of
+ *   every signature always executes; `warnThreshold <= 0` disables the block tier
+ *   (counting and the hard stop still apply); `stopThreshold <= 0` is treated as
+ *   disabled at install time (callers gate on it).
+ * @returns A LangChain `AgentMiddleware` that can be pushed onto the middleware chain.
+ */
+declare function createRepeatedToolCallBreakerMiddleware(options?: RepeatedToolCallBreakerOptions): AgentMiddleware;
+
 /** Describes how a tool argument selects a capability-scoped resource. */
 interface CapabilityResourceSelector {
     /** Tool argument containing the selected resource key. */
@@ -10794,6 +11962,39 @@ declare class ConnectionRegistry {
     private static ensureStore;
 }
 
+/** A plugin connection resolved to its stored key and config. */
+interface ResolvedPluginConnection {
+    /** Connection key (unique within `(tenantId, type)`). */
+    key: string;
+    /** Stored connection config (credentials, resource selection, …). */
+    config: Record<string, unknown>;
+}
+/** Run-scoped identity needed to resolve a plugin's connections. */
+interface PluginConnectionScope {
+    /** Authoritative tenant; resolution is skipped when absent. */
+    tenantId?: string;
+}
+/**
+ * Resolve the connections selected by a plugin's `connections` / `connectAll`
+ * config against the tenant-scoped Connection Store.
+ *
+ * @param type - Plugin type (`Plugin.meta.type` = `ConnectionEntry.type`).
+ * @param config - Plugin middleware config carrying `connections` and/or `connectAll`.
+ * @param scope - Run-scoped identity; only `tenantId` is used.
+ * @returns The matching `{ key, config }` entries in registry order; empty when
+ *   no tenant, no selection, or nothing matches (foreign tenant/type filtered out).
+ * @remarks
+ * - `connectAll: true` lists every connection of the type for the tenant.
+ * - Explicit `connections` are looked up individually; missing keys are dropped.
+ * - Callers are trusted in-process plugin code; the resolver does not verify that
+ *   `type` is the caller's own plugin type. Plugins must pass their own
+ *   `meta.type` — treating this as a tenant-wide credential read is out of contract.
+ */
+declare function resolvePluginConnections(type: string, config: {
+    connections?: unknown;
+    connectAll?: unknown;
+}, scope: PluginConnectionScope): Promise<ResolvedPluginConnection[]>;
+
 /**
  * Export/Import shared type definitions.
  *
@@ -11157,4 +12358,4 @@ declare function parseDirectRoomType(projectId: string): "human" | "bot" | null;
  */
 declare function isDirectRoom(projectId: string): boolean;
 
-export { AGENT_TASK_EVENT, type AddMessageParams, type AddMessageResult, Agent, type AgentClient, type AgentExecutor, AgentInstanceManager, type AgentLattice, AgentLatticeManager, type AgentLifecycleEventName, AgentManager, type AgentStreamExecutor, type AgentTaskCompletionInput, type AgentThreadInterface, type ApproveInterruptedTaskInput, BUILTIN_PLUGINS, BUILTIN_SKILLS, type BackendFactory, type BackendProtocol, type BufferStats, CAPABILITY_TOOL_NAME_CONFLICT, type CacheEntry, type CalibrationProbe, CapabilityBundleMergeError, type CapabilityBundleMergeErrorCode, CapabilityBundleMerger, CapabilityBundleValidationError, type CapabilityBundleValidationErrorCode, type CapabilityGuardDenialCode, type CapabilityResourceSelector, type CapabilityToolMetadata, CapabilityToolNameConflictError, CapabilityToolRegistry, type CaseRunResult, type Chunk, ChunkBuffer, ChunkBufferLatticeManager, CollectionLatticeManager, type ColumnInfo, type CompileSandboxPluginArgs, CompositeBackend, type ConflictItem, type ConnectAllChannelsOptions, ConnectionRegistry, ConsoleLoggerClient, type CreateSandboxProviderConfig, type CronFields, CustomMetricsClient, type CustomMiddlewareFactory, CustomMiddlewareRegistry, DEFAULT_CALIBRATION_PROBES, type DatabaseConfig, type DatabaseType, DaytonaInstance, DaytonaProvider, type DaytonaProviderConfig, DefaultScheduleClient, DelegatedScopeNotQueueableError, type DeleteResult, DependencyResolver, DuplicateProjectRoomMessageIdempotencyKeyError, E2BInstance, E2BProvider, type E2BProviderConfig, EMPTY_CONTENT_WARNING, type EditResult, type EmbeddingsInfo, type EmbeddingsLatticeInterface, EmbeddingsLatticeManager, type EnsureMicrosandboxInput, type EvalRunService, type ExportBundle, type ExportContext, type ExportJob, type ExportableEntity, type ExportableEntityDefinition, ExportableEntityRegistry, type ExportableFile, type ExportableTypeInfo, type ExternalDependencyInterruption, type FileData, type FileInfo, FileSystemSkillStore, type FileSystemSkillStoreOptions, FilesystemBackend, type FsEntry, type GrepMatch, type IMessageQueueStore, type IMetricsServerClient, type ISqlDatabase, IdRemapper, type ImportApplyResolution, type ImportApplyResult, type ImportEntityResult, type ImportEntityStatus, type ImportPreviewResult, InMemoryA2AApiKeyStore, InMemoryAgentWebAppStore, InMemoryAssistantStore, InMemoryBindingStore, InMemoryCapabilityBundleStore, InMemoryChannelInstallationStore, InMemoryChunkBuffer, InMemoryCollectionStore, InMemoryDatabaseConfigStore, InMemoryMailboxStore, InMemoryMenuStore, InMemoryOpenAuditStore, InMemoryProjectBotMembershipStore, InMemoryProjectMembershipStore, InMemoryProjectRoomCoordinator, InMemoryProjectRoomMessageStore, InMemoryProjectRoomReadStateStore, InMemoryProjectRoomStore, InMemoryTaskListStore, InMemoryTaskStore, InMemoryTenantStore, InMemoryThreadMessageQueueStore, InMemoryThreadStore, InMemoryUserPushSubscriptionStore, InMemoryUserStore, InMemoryUserTenantLinkStore, type InsertionItem, type JudgeVerdict, LINE_NUMBER_WIDTH, type LangGraphStateChecker, type LatticeAgentStepConfig, LatticeEval, type LatticeEvalBatchReport, type LatticeEvalCase, type LatticeEvalCaseType, type LatticeEvalCaseWithTemplate, type LatticeEvalConfig, type LatticeEvalLogEvent, type LatticeEvalLogLevel, LatticeEvalProject, type LatticeEvalProjectType, type LatticeEvalResult, type LatticeEvalRubric, LatticeEvalSuite, type LatticeEvalSuiteType, type LatticeEvalTemplate, type LifecycleResult, type LifecycleWarning, LocalSandboxInstance, LocalSandboxProvider, type LocalSandboxProviderConfig, type LoggerLattice, LoggerLatticeManager, MAX_LINE_LENGTH, MAX_PACK_ENTRIES, MAX_PACK_FILE_BYTES, MAX_PACK_TOTAL_BYTES, type MailboxMessage, type MailboxStore, type ManifestValidationResult, type McpLatticeInterface, McpLatticeManager, type McpServerInfo, MemoryBackend, MemoryLatticeManager, MemoryQueueClient, MemoryScheduleStorage, type MergedPluginSkills, type MessageCompletedEvent, type MessageContent, type MessageContentPart, type MessageContentValue, type MessageFailedEvent, type MessageInterruptedEvent, type MessageLike, type MessageStartedEvent, MessageType, MetricsServerManager, MicrosandboxRemoteInstance, MicrosandboxRemoteProvider, type MicrosandboxRemoteProviderClient, type MicrosandboxRemoteProviderConfig, MicrosandboxServiceClient, type MicrosandboxServiceClientConfig, type MicrosandboxShellExecInput, type ModelConfig, type ModelLatticeInterface, ModelLatticeManager, MysqlDatabase, type OutputType, PACK_DIRECTORY_TIMEOUT_SECONDS, type PackSourceInfo, type PendingMessage, PersonalAssistantConfig, PinoLoggerClient, PluginRegistry, type PostProcessTaskMutationResponseInput, PostgresDatabase, type PreviewError, ProjectBotMembershipIdConflictError, ProjectMutationMutex, type ProjectMutationScope, ProjectRoomMessageIdConflictError, type ProjectTaskAdmissionListener, type ProjectTaskAdmissionNotification, ProjectTaskAdmissionNotifier, type ProjectTaskAdmissionNotifierOptions, type ProjectTaskAssignmentScope, ProjectTaskOwnerPolicy, type ProjectTaskOwnerPolicyCode, ProjectTaskOwnerPolicyError, type ProjectTaskReassignmentAuthorization, type ProjectTaskReassignmentAuthorizationInput, type ProjectTaskReassignmentAuthorizer, type ProjectTaskReassignmentThreadValidationInput, type ProjectTaskReassignmentThreadValidator, type ProjectTaskRosterScope, PrometheusClient, type QueryResult, type QueueLattice, QueueLatticeManager, type QueueMessage, QueueMode, type QueuePendingEvent, type QueueScope, ROOM_COORDINATOR_KEY, type ReassignProjectTaskInput, type ReconcileTaskDescriptionInput, type RejectInterruptedTaskInput, RemoteSandboxInstance, RemoteSandboxProvider, type RemoteSandboxProviderConfig, type ReplyReadyEvent, type Resolution, type ResolutionAction, type ResolveAgentFn, type ResolvedConfig, type ResolvedPluginSkill, type ResumeTaskResult, type RoomAgentMessageCallbackFailure, type RoomAgentMessageCommitted, type RoomAgentMessageInput, RoomAgentMessageService, type RoomAgentReplyInput, type RunSandboxConfig, type RuntimeModelConfig, type RuntimeSkillSelection, SAFE_PATH_COMPONENT, type STTModelInfo, STTModelLattice, type STTModelLatticeInterface, STTModelLatticeManager, type SandboxFileInfo, type SandboxFileService, SandboxFilesystem, type SandboxGrepMatch, type SandboxInstance, type SandboxIsolationLevel, SandboxLatticeManager, type SandboxManagerProtocol, SandboxPluginExecutor, type SandboxPluginExecutorDeps, type SandboxPluginInvokeArgs, type SandboxPluginResult, type SandboxProvider, type SandboxProviderFactory, type SandboxProviderType, type SandboxResolver, type SandboxRunConfig, type SandboxShellService, SandboxSkillStore, type SandboxSkillStoreOptions, type SandboxVolumeDefinition, type ScheduleLattice, ScheduleLatticeManager, type SchedulerMiddlewareOptions, SemanticMetricsClient, type SharePayload, SimpleMemoryVectorStore, type SkillLattice, SkillLatticeManager, type SkillMeta, type SkillResource, SqlDatabaseManager, type StartLifecycleResult, type StartTaskExecutionInput, type StateAndStore, StateBackend, StoreBackend, type StoreLattice, StoreLatticeManager, type StoreType, type StoreTypeMap, type SubmitTaskReviewInput, TASK_RESPONSE_FINAL_WARNING_LIMIT, TASK_RESPONSE_PRIOR_WARNING_LIMIT, TASK_RESPONSE_SCALAR_MAX_BYTES, TOOL_RESULT_TOKEN_LIMIT, TRUNCATION_GUIDANCE, type TableInfo, type TableSchema, type TaskAgentInvocation, type TaskEvent, type TaskExecutionFailure, type TaskExecutionResult, type TaskExecutionServiceDeps, type TaskExecutionSuccess, type TaskLifecycleListener, type TaskLifecycleNotification, TaskLifecycleNotifier, TaskLifecycleService, type TaskLifecycleServiceDeps, type TaskListStore, type TaskResponseParseResult, type TaskSpec, TaskStatus, type TaskUpdatable, TeamAgentGraphBuilder, type TeamConfig, type TeamMiddlewareOptions, type TeamTask, type TeammateSpec, type TeammateToolsOptions, TenantPluginCatalog, type TenantPluginCatalogDeps, type TenantPlugins, type ThreadBuffer, type ThreadBufferConfig, type ThreadBusyEvent, type ThreadEndCode, ThreadEndError, type ThreadIdleEvent, type ThreadInfo, type ThreadQueueConfig, type ThreadState, ThreadStatus, type ThreadStatusChangedEvent, TokenCache, type ToolDefinition, type ToolLattice, ToolLatticeManager, type TrustedAgentMessageDispatcher, type TrustedMessageOptions, type UnknownToolHandlerConfig, type ValidateManifestArgs, type VectorStoreLatticeInterface, VectorStoreLatticeManager, type VectorStoreProviderLattice, VectorStoreProviderManager, VolumeFilesystem, type VolumeFsClient, type WorkflowValidationError, type WriteResult, abortWorkflowRun, agentInstanceManager, agentLatticeManager, appendReconciliationWarning, buildGrepResultsDict, buildInput, buildNamedVolumeName, buildRemotePackDirectoryCommand, buildSandboxMetadataEnv, buildSkillFile, buildStateAnnotation, buildTableName, buildTaskMutationFallback, buildTaskNormalizationFallback, checkEmptyContent, clearEncryptionKeyCache, clearEvalRunService, collectionLatticeManager, compileInternal, compileSandboxPlugin, compileWorkflow, computeSandboxName, configureStores, connectAllChannels, createAgentNode, createAgentTeam, createCapabilityGuardMiddleware, createExecuteSqlQueryTool, createFileData, createInfoSqlTool, createListMetricsDataSourcesTool, createListMetricsServersTool, createListTablesSqlTool, createMapNode, createModelSelectorMiddleware, createNodeHandler, createProjectRoomMiddleware, createProjectTaskOwnerPolicy, createProjectTaskReassignmentAuthorizer, createQueryCheckerSqlTool, createQueryMetricDefinitionTool, createQueryMetricsListTool, createQuerySemanticMetricDataTool, createQuerySqlTool, createQueryTableDefinitionTool, createQueryTablesListTool, createResourceAddress, createSandboxProvider, createSandboxResolver, createSchedulerMiddleware, createSemanticMetricsMiddleware, createSharePayload, createTaskExecutionService, createTaskLifecycleService, createTaskMiddleware, createTeamMiddleware, createTeammateTools, createTrustedAgentMessageDispatcher, createUnknownToolHandlerMiddleware, createWidgetMiddleware, decrypt, describeCronExpression, documentLearningPlugin, documentParserPlugin, embeddingsLatticeManager, encrypt, ensureBuiltinAgentsForTenant, ensurePluginSkillInSandbox, evaluateLatticeCaseWithLogs, eventBus, eventBus as eventBusDefault, extractFetcherError, extractOutput, fileDataToString, formatContentWithLineNumbers, formatGrepMatches, formatGrepResults, formatReadResponse, generateDirectBotProjectId, generateDirectHumanProjectId, generateToken, getAgentClient, getAgentConfig, getAllAgentConfigs, getAllBuiltInSkillMetas, getAllToolDefinitions, getBindingRegistry, getBuiltInSkillContent, getBuiltInSkillMeta, getBuiltInSkillNames, getCheckpointSaver, getChunkBuffer, getCollectionEntryCount, getEmbeddingsClient, getEmbeddingsLattice, getEncryptionKey, getEvalRunService, getLoggerLattice, getMenuRegistry, getModelLattice, getNextCronTime, getOrCreateCollectionVectorStore, getPluginSkillManifestVersion, getQueueLattice, getRuntimeCapabilityConfig, getRuntimeSkillSelection, getSTTClient, getSTTClientWithTenant, getSTTModelLattice, getSandBoxManager, getSandboxPluginCatalog, getScheduleLattice, getStoreLattice, getToolClient, getToolDefinition, getToolLattice, getVectorStoreClient, getVectorStoreLattice, getVectorStoreProvider, getWorkflowSignal, globSearchFiles, grepMatchesFromFiles, grepSearchFiles, hasChunkBuffer, hasDelegatedWorkerToken, hasRuntimeCapabilityPolicy, invokeWithRetry, isBuiltInSkill, isDirectRoom, isPluginSkillAuthorizedInSandbox, isPluginSkillManagedInSandbox, isProjectLifecycleTask, isUsingDefaultKey, isValidCronExpression, isValidSandboxName, isValidSkillName, jsonSchemaToZod, listCollectionEntries, listSandboxProviderTypes, loggerLatticeManager, mcpManager, mergeCapabilityBundles, mergePluginSkills, mergePluginSources, metricsServerManager, modelLatticeManager, normalizeSandboxName, ownTaskResponseField, parallelLimit, parseCronExpression, parseDirectRoomType, parseExternalDependency, parseJudgeVerdict, parsePackSize, parseSkillFrontmatter, parseTaskResponse, parseYaml, performStringReplacement, postProcessTaskMutationResponse, projectMutationMutex, projectRoomPlugin, projectTaskAdmissionNotifier, queueLatticeManager, registerAgentLattice, registerAgentLatticeWithTenant, registerAgentLattices, registerCheckpointSaver, registerChunkBuffer, registerEmbeddingsLattice, registerExistingTool, registerLoggerLattice, registerModelLattice, registerQueueLattice, registerSTTModelLattice, registerSandboxProviderType, registerScheduleLattice, registerStoreLattice, registerTeammateAgent, registerToolLattice, registerVectorStoreLattice, registerVectorStoreProvider, registerWorkflowRun, removeCollectionVectorStore, renderTemplate, resolveEnabledPluginSkill, resolveJudgeModelKey, resolvePath, resolveSandboxPluginConnections, resolveTenantPluginSkill, roomCoordinatorConfig, runRemotePackDirectory, safeTaskResponseId, sandboxLatticeManager, sanitizeToolCallId, scheduleLatticeManager, semanticMetricsPlugin, serializePluginMeta, serializeTaskMutationSuccess, serializeTaskNormalizationFallback, serializeTaskReadResponse, setBindingRegistry, setEvalRunService, setMenuRegistry, setSandboxPluginCatalog, skillLatticeManager, sqlDatabaseManager, storeLatticeManager, sttModelLatticeManager, taskLifecycleNotifier, toJsonSchema, toSafeStateExpr, toolLatticeManager, truncateIfTooLong, unregisterTeammateAgent, unregisterWorkflowRun, updateFileData, validateAgentInput, validateCapabilityBundleInput, validateDSL, validateEncryptionKey, validatePackSourcePath, validatePath, validateRelativePath, validateSandboxPluginManifest, validateSkillName, validateToolInput, vectorStoreLatticeManager, vectorStoreProviderManager };
+export { AGENT_TASK_EVENT, type AddMessageParams, type AddMessageResult, Agent, type AgentClient, type AgentExecutor, AgentInstanceManager, type AgentLattice, AgentLatticeManager, type AgentLifecycleEventName, AgentManager, type AgentStreamExecutor, type AgentTaskCompletionInput, type AgentThreadInterface, type ApproveInterruptedTaskInput, BUILTIN_PLUGINS, BUILTIN_SKILLS, type BackendFactory, type BackendProtocol, type BeginRunFailure, type BeginRunInput, type BeginRunResult, type BeginRunSuccess, type BufferStats, CAPABILITY_TOOL_NAME_CONFLICT, type CacheEntry, type CalibrationProbe, CapabilityBundleMergeError, type CapabilityBundleMergeErrorCode, CapabilityBundleMerger, CapabilityBundleValidationError, type CapabilityBundleValidationErrorCode, type CapabilityGuardDenialCode, type CapabilityResourceSelector, type CapabilityToolMetadata, CapabilityToolNameConflictError, CapabilityToolRegistry, type CaseRunResult, type Chunk, ChunkBuffer, ChunkBufferLatticeManager, CollectionLatticeManager, type ColumnInfo, type CompileSandboxPluginArgs, CompositeBackend, type ConflictItem, type ConnectAllChannelsOptions, ConnectionRegistry, ConsoleLoggerClient, type CreateSandboxProviderConfig, type CronFields, CustomMetricsClient, type CustomMiddlewareFactory, CustomMiddlewareRegistry, DEFAULT_CALIBRATION_PROBES, DEFAULT_CONNECT_TIMEOUT_MS, DEFAULT_DELAY_MS, DEFAULT_MAX_ATTEMPTS, type DatabaseConfig, type DatabaseType, DaytonaInstance, DaytonaProvider, type DaytonaProviderConfig, DefaultScheduleClient, DelegatedScopeNotQueueableError, type DeleteResult, DependencyResolver, type DispatchPreparation, DuplicateProjectRoomMessageIdempotencyKeyError, E2BInstance, E2BProvider, type E2BProviderConfig, EMPTY_CONTENT_WARNING, type EditResult, type EmbeddingsInfo, type EmbeddingsLatticeInterface, EmbeddingsLatticeManager, type EnsureMicrosandboxInput, type EvalRunService, type ExecutionAuthority, ExecutionAuthorityRegistry, type ExportBundle, type ExportContext, type ExportJob, type ExportableEntity, type ExportableEntityDefinition, ExportableEntityRegistry, type ExportableFile, type ExportableTypeInfo, type ExternalDependencyInterruption, type FileData, type FileInfo, FileSystemSkillStore, type FileSystemSkillStoreOptions, FilesystemBackend, type FsEntry, type GrepMatch, HEALTH_CHECK_INTERVAL_MS, HEALTH_CHECK_TIMEOUT_MS, type IMessageQueueStore, type IMetricsServerClient, type ISqlDatabase, IdRemapper, type ImmediateDispatchPlan, type ImportApplyResolution, type ImportApplyResult, type ImportEntityResult, type ImportEntityStatus, type ImportPreviewResult, InMemoryA2AApiKeyStore, InMemoryAgentWebAppStore, InMemoryAssistantStore, InMemoryBindingStore, InMemoryCapabilityBundleStore, InMemoryChannelInstallationStore, InMemoryChunkBuffer, InMemoryCollectionStore, InMemoryDatabaseConfigStore, InMemoryMailboxStore, InMemoryMenuStore, InMemoryOpenAuditStore, InMemoryProjectBotMembershipStore, InMemoryProjectMembershipStore, InMemoryProjectRoomCoordinator, InMemoryProjectRoomMessageStore, InMemoryProjectRoomReadStateStore, InMemoryProjectRoomStore, InMemoryTaskListStore, InMemoryTaskStore, InMemoryTaskWorkItemStore, InMemoryTenantStore, InMemoryThreadMessageQueueStore, InMemoryThreadStore, InMemoryUserPushSubscriptionStore, InMemoryUserStore, InMemoryUserTenantLinkStore, type InsertionItem, type JudgeVerdict, LINE_NUMBER_WIDTH, type LangGraphStateChecker, type LatticeAgentStepConfig, LatticeEval, type LatticeEvalBatchReport, type LatticeEvalCase, type LatticeEvalCaseType, type LatticeEvalCaseWithTemplate, type LatticeEvalConfig, type LatticeEvalLogEvent, type LatticeEvalLogLevel, LatticeEvalProject, type LatticeEvalProjectType, type LatticeEvalResult, type LatticeEvalRubric, LatticeEvalSuite, type LatticeEvalSuiteType, type LatticeEvalTemplate, type LifecycleResult, type LifecycleWarning, LocalSandboxInstance, LocalSandboxProvider, type LocalSandboxProviderConfig, type LoggerLattice, LoggerLatticeManager, type LoopBreakerConfig, MAX_BACKOFF_MS, MAX_LINE_LENGTH, MAX_PACK_ENTRIES, MAX_PACK_FILE_BYTES, MAX_PACK_TOTAL_BYTES, type MailboxMessage, type MailboxStore, ManagedTaskStartError, type ManagedTaskStartOptions, type ManifestValidationResult, type McpClientFactory, type McpClientLike, type McpClientSession, type McpConnectionOptions, McpLatticeManager, type McpRegisterOptions, type McpServerId, type McpServerRuntime, type McpServerState, MemoryBackend, MemoryLatticeManager, MemoryQueueClient, MemoryScheduleStorage, type MergedPluginSkills, type MessageCompletedEvent, type MessageContent, type MessageContentPart, type MessageContentValue, type MessageFailedEvent, type MessageInterruptedEvent, type MessageLike, type MessageStartedEvent, MessageType, MetricsServerManager, MicrosandboxRemoteInstance, MicrosandboxRemoteProvider, type MicrosandboxRemoteProviderClient, type MicrosandboxRemoteProviderConfig, MicrosandboxServiceClient, type MicrosandboxServiceClientConfig, type MicrosandboxShellExecInput, type ModelConfig, type ModelLatticeInterface, ModelLatticeManager, MysqlDatabase, type OutputType, PACK_DIRECTORY_TIMEOUT_SECONDS, type PackSourceInfo, type PendingMessage, PersonalAssistantConfig, PinoLoggerClient, type PluginConnectionScope, PluginRegistry, type PostProcessTaskMutationResponseInput, PostgresDatabase, type PreviewError, ProjectBotMembershipIdConflictError, ProjectMutationMutex, type ProjectMutationScope, ProjectRoomMessageIdConflictError, type ProjectTaskAdmissionListener, type ProjectTaskAdmissionNotification, ProjectTaskAdmissionNotifier, type ProjectTaskAdmissionNotifierOptions, type ProjectTaskAssignmentScope, ProjectTaskOwnerPolicy, type ProjectTaskOwnerPolicyCode, ProjectTaskOwnerPolicyError, type ProjectTaskReassignmentAuthorization, type ProjectTaskReassignmentAuthorizationInput, type ProjectTaskReassignmentAuthorizer, type ProjectTaskReassignmentThreadValidationInput, type ProjectTaskReassignmentThreadValidator, type ProjectTaskRosterScope, PrometheusClient, type QueryResult, type QueueLattice, QueueLatticeManager, type QueueMessage, QueueMode, type QueuePendingEvent, type QueueScope, ROOM_COORDINATOR_KEY, type ReassignProjectTaskInput, type ReconcileAllTenantTaskRunsInput, type ReconcileStaleTaskRunsInput, type ReconcileStaleTaskRunsResult, type ReconcileTaskDescriptionInput, type ReconcileTenantTaskRunsInput, type RejectInterruptedTaskInput, RemoteSandboxInstance, RemoteSandboxProvider, type RemoteSandboxProviderConfig, type RepeatedToolCallBreakerOptions, RepeatedToolCallError, type ReplyReadyEvent, type Resolution, type ResolutionAction, type ResolveAgentFn, type ResolvedConfig, type ResolvedPluginConnection, type ResolvedPluginSkill, type ResumeTaskResult, type RoomAgentMessageCallbackFailure, type RoomAgentMessageCommitted, type RoomAgentMessageInput, RoomAgentMessageService, type RoomAgentReplyInput, type RunSandboxConfig, type RuntimeModelConfig, type RuntimeSkillSelection, SAFE_PATH_COMPONENT, type STTModelInfo, STTModelLattice, type STTModelLatticeInterface, STTModelLatticeManager, type SandboxFileInfo, type SandboxFileService, SandboxFilesystem, type SandboxGrepMatch, type SandboxInstance, type SandboxIsolationLevel, SandboxLatticeManager, type SandboxManagerProtocol, SandboxPluginExecutor, type SandboxPluginExecutorDeps, type SandboxPluginInvokeArgs, type SandboxPluginResult, type SandboxProvider, type SandboxProviderFactory, type SandboxProviderType, type SandboxResolver, type SandboxRunConfig, type SandboxShellService, SandboxSkillStore, type SandboxSkillStoreOptions, type SandboxVolumeDefinition, type ScheduleLattice, ScheduleLatticeManager, type SchedulerMiddlewareOptions, SemanticMetricsClient, type SettleRunInput, type SettleRunOutcome, type SharePayload, SimpleMemoryVectorStore, type SkillLattice, SkillLatticeManager, type SkillMeta, type SkillResource, SqlDatabaseManager, type StartLifecycleResult, type StartTaskExecutionInput, type StateAndStore, StateBackend, StoreBackend, type StoreLattice, StoreLatticeManager, type StoreType, type StoreTypeMap, type SubmitTaskReviewInput, TASK_RESPONSE_FINAL_WARNING_LIMIT, TASK_RESPONSE_PRIOR_WARNING_LIMIT, TASK_RESPONSE_SCALAR_MAX_BYTES, TOOL_RESULT_TOKEN_LIMIT, TRUNCATION_GUIDANCE, type TableInfo, type TableSchema, type TaskAgentInvocation, type TaskEvent, type TaskExecutionFailure, type TaskExecutionManaged, type TaskExecutionResult, type TaskExecutionServiceDeps, type TaskExecutionSuccess, type TaskLifecycleListener, type TaskLifecycleNotification, TaskLifecycleNotifier, TaskLifecycleService, type TaskLifecycleServiceDeps, type TaskListStore, type TaskResponseParseResult, type TaskRunBridge, type TaskRunBridgeDeps, TaskRunBridgeStoresRequiredError, TaskRunRegistry, type TaskSpec, TaskStatus, type TaskUpdatable, TeamAgentGraphBuilder, type TeamConfig, type TeamMiddlewareOptions, type TeamTask, type TeammateSpec, type TeammateToolsOptions, TenantPluginCatalog, type TenantPluginCatalogDeps, type TenantPlugins, type ThreadBuffer, type ThreadBufferConfig, type ThreadBusyEvent, type ThreadEndCode, ThreadEndError, type ThreadIdleEvent, type ThreadInfo, type ThreadQueueConfig, type ThreadState, ThreadStatus, type ThreadStatusChangedEvent, TokenCache, type ToolDefinition, type ToolLattice, ToolLatticeManager, type TransferOwnerInput, type TransferOwnerResult, type TrustedAgentMessageDispatcher, type TrustedMessageOptions, type UnknownToolHandlerConfig, type ValidateManifestArgs, type VectorStoreLatticeInterface, VectorStoreLatticeManager, type VectorStoreProviderLattice, VectorStoreProviderManager, VolumeFilesystem, type VolumeFsClient, type WorkflowValidationError, type WriteResult, abortWorkflowRun, agentInstanceManager, agentLatticeManager, appendReconciliationWarning, appendUiFence, buildGrepResultsDict, buildInput, buildNamedVolumeName, buildRemotePackDirectoryCommand, buildSandboxMetadataEnv, buildSkillFile, buildStateAnnotation, buildTableName, buildTaskMutationFallback, buildTaskNormalizationFallback, checkEmptyContent, clearEncryptionKeyCache, clearEvalRunService, collectionLatticeManager, compileInternal, compileSandboxPlugin, compileWorkflow, computeSandboxName, configureStores, connectAllChannels, convertToConnection, createAgentNode, createAgentTeam, createCapabilityGuardMiddleware, createExecuteSqlQueryTool, createFileData, createInfoSqlTool, createListMetricsDataSourcesTool, createListMetricsServersTool, createListTablesSqlTool, createMapNode, createModelSelectorMiddleware, createNodeHandler, createProjectRoomMiddleware, createProjectTaskOwnerPolicy, createProjectTaskReassignmentAuthorizer, createQueryCheckerSqlTool, createQueryMetricDefinitionTool, createQueryMetricsListTool, createQuerySemanticMetricDataTool, createQuerySqlTool, createQueryTableDefinitionTool, createQueryTablesListTool, createRepeatedToolCallBreakerMiddleware, createResourceAddress, createSandboxProvider, createSandboxResolver, createSchedulerMiddleware, createSemanticMetricsMiddleware, createSharePayload, createTaskExecutionService, createTaskLifecycleService, createTaskMiddleware, createTaskRunBridge, createTeamMiddleware, createTeammateTools, createTrustedAgentMessageDispatcher, createUnknownToolHandlerMiddleware, createWidgetMiddleware, decrypt, describeCronExpression, documentLearningPlugin, documentParserPlugin, embeddingsLatticeManager, encrypt, ensureBuiltinAgentsForTenant, ensurePluginSkillInSandbox, evaluateLatticeCaseWithLogs, eventBus, eventBus as eventBusDefault, executionAuthorityRegistry, extractAppsRef, extractFetcherError, extractLegacyRefs, extractOutput, fileDataToString, formatContentWithLineNumbers, formatGrepMatches, formatGrepResults, formatReadResponse, generateDirectBotProjectId, generateDirectHumanProjectId, generateToken, getAgentClient, getAgentConfig, getAllAgentConfigs, getAllBuiltInSkillMetas, getAllToolDefinitions, getBindingRegistry, getBuiltInSkillContent, getBuiltInSkillMeta, getBuiltInSkillNames, getCheckpointSaver, getChunkBuffer, getCollectionEntryCount, getEmbeddingsClient, getEmbeddingsLattice, getEncryptionKey, getEvalRunService, getLoggerLattice, getMenuRegistry, getModelLattice, getNextCronTime, getOrCreateCollectionVectorStore, getPluginSkillManifestVersion, getQueueLattice, getRuntimeCapabilityConfig, getRuntimeSkillSelection, getSTTClient, getSTTClientWithTenant, getSTTModelLattice, getSandBoxManager, getSandboxPluginCatalog, getScheduleLattice, getStoreLattice, getToolClient, getToolClientWithTenant, getToolDefinition, getToolLattice, getVectorStoreClient, getVectorStoreLattice, getVectorStoreProvider, getWorkflowSignal, globSearchFiles, grepMatchesFromFiles, grepSearchFiles, hasChunkBuffer, hasDelegatedWorkerToken, hasRuntimeCapabilityPolicy, invokeWithRetry, isBuiltInSkill, isDirectRoom, isPluginSkillAuthorizedInSandbox, isPluginSkillManagedInSandbox, isUsingDefaultKey, isValidCronExpression, isValidSandboxName, isValidSkillName, jsonSchemaToZod, listCollectionEntries, listSandboxProviderTypes, loggerLatticeManager, mcpManager, mergeCapabilityBundles, mergePluginSkills, mergePluginSources, metricsServerManager, modelLatticeManager, nextBackoffDelay, normalizeSandboxName, ownTaskResponseField, parallelLimit, parseCronExpression, parseDirectRoomType, parseExternalDependency, parseJudgeVerdict, parsePackSize, parseSkillFrontmatter, parseTaskResponse, parseYaml, performStringReplacement, postProcessTaskMutationResponse, prepareTaskDispatch, projectMutationMutex, projectRoomPlugin, projectTaskAdmissionNotifier, queueLatticeManager, readLoopBreakerConfig, reconcileAllTenantTaskRuns, reconcileStaleTaskRuns, reconcileTenantTaskRuns, registerAgentLattice, registerAgentLatticeWithTenant, registerAgentLattices, registerCheckpointSaver, registerChunkBuffer, registerEmbeddingsLattice, registerExistingTool, registerExistingToolWithTenant, registerLoggerLattice, registerModelLattice, registerQueueLattice, registerSTTModelLattice, registerSandboxProviderType, registerScheduleLattice, registerStoreLattice, registerTeammateAgent, registerToolLattice, registerVectorStoreLattice, registerVectorStoreProvider, registerWorkflowRun, removeCollectionVectorStore, renderTemplate, resolveEnabledPluginSkill, resolveJudgeModelKey, resolvePath, resolvePluginConnections, resolveSandboxPluginConnections, resolveTenantPluginSkill, roomCoordinatorConfig, runRemotePackDirectory, safeTaskResponseId, sandboxLatticeManager, sanitizeToolCallId, scheduleLatticeManager, semanticMetricsPlugin, serializePluginMeta, serializeTaskMutationSuccess, serializeTaskNormalizationFallback, serializeTaskReadResponse, setBindingRegistry, setEvalRunService, setMenuRegistry, setSandboxPluginCatalog, skillLatticeManager, sqlDatabaseManager, storeLatticeManager, sttModelLatticeManager, taskLifecycleNotifier, taskRunRegistry, toJsonSchema, toSafeStateExpr, toolLatticeManager, truncateIfTooLong, unregisterTeammateAgent, unregisterWorkflowRun, updateFileData, validateAgentInput, validateCapabilityBundleInput, validateDSL, validateEncryptionKey, validatePackSourcePath, validatePath, validateRelativePath, validateSandboxPluginManifest, validateSkillName, validateToolInput, vectorStoreLatticeManager, vectorStoreProviderManager, withTimeout, wrapMcpToolWithUi };