@axiom-lattice/protocols 4.2.0 → 4.2.1

package/dist/index.d.ts

@@ -4610,30 +4610,120 @@ interface ChannelAdapter<TConfig = unknown> {
 }
 
 /**
- * A2AProtocol - re-exports standard A2A 0.3 types from @a2a-js/sdk
- * plus Axiom-specific auth/exposure types.
+ * OpenProtocol — contracts for the Open API surface (unified external
+ * capability invocation). See docs/superpowers/specs/2026-09-07-open-platform-api-design.md.
  */
+/** Authorization grant: default-deny; a grant covers one capability domain. */
+interface OpenGrant {
+    domain: string;
+    /**
+     * Action names (kb: ["search"]) or instance ids (agent: [assistantId]).
+     * Absent/empty = every action in the domain.
+     */
+    items?: string[];
+    selector?: {
+        sandbox?: "self";
+    };
+}
+/** Execution context synthesized from a verified credential — never from the caller. */
+interface OpenExecutionContext {
+    tenantId: string;
+    projectId: string;
+    /** Addressing only, not an authorization dimension (see design §6.2). */
+    workspaceId?: string;
+    /** Synthesized runConfig (mirrors the Agent path, incl. _resolvedConnections). */
+    runConfig: Record<string, unknown>;
+}
+interface OpenExecutionResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}
+/**
+ * Effective grants for the Open door, derived from a key record.
+ *
+ * Backward compatibility with pre-grants A2A keys:
+ * - explicit grants win;
+ * - otherwise assistantIds become an agent-domain grant;
+ * - legacy "empty assistantIds = all exposed agents" maps to a bare agent grant.
+ *
+ * The A2A door keeps reading assistantIds directly and never consults this —
+ * existing A2A behavior is unchanged by construction.
+ */
+declare function effectiveGrants(record: {
+    grants?: OpenGrant[];
+    assistantIds?: string[];
+}): OpenGrant[];
+/** Where an exposed capability comes from. */
+type OpenCapabilitySource = "builtin" | "plugin" | "agent";
+/** A selectable grant item: an action name or an instance id. */
+interface OpenCatalogItem {
+    /** Grant item value: action name (kb → "search") or instance id (agent → assistantId). */
+    id: string;
+    /** Full MCP tool name when this item is exclusively exposed (informational). */
+    toolName: string;
+    label: string;
+    description?: string;
+    annotations?: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+}
+interface OpenCatalogDomain {
+    domain: string;
+    label: string;
+    source: OpenCapabilitySource;
+    /** Display-only scope hint (defaults to tenant-wide). */
+    scopeKind?: "tenant" | "workspace" | "project";
+    /** How grant items are chosen: per-action or per-instance. */
+    itemKind: "action" | "instance";
+    items: OpenCatalogItem[];
+}
+/** Full grantable capability catalog for a tenant (drives the key picker). */
+interface OpenCatalog {
+    domains: OpenCatalogDomain[];
+}
+type OpenCredentialKind = "api_key" | "sandbox_token" | "browser_token";
+/** Append-only audit input; the writer is responsible for redacting args. */
+interface OpenAuditAppendInput {
+    tenantId: string;
+    credentialId: string;
+    credentialKind: OpenCredentialKind;
+    projectId: string;
+    domain: string;
+    action: string;
+    args: unknown;
+    status: "ok" | "error";
+    errorCode?: string;
+    durationMs: number;
+}
+interface OpenAuditRecord extends OpenAuditAppendInput {
+    id: string;
+    createdAt: Date;
+}
+interface OpenAuditQuery {
+    tenantId: string;
+    credentialId?: string;
+    domain?: string;
+    status?: "ok" | "error";
+    /** ISO timestamps; inclusive from / exclusive to. */
+    from?: string;
+    to?: string;
+    limit?: number;
+    offset?: number;
+}
+interface OpenAuditStore {
+    append(record: OpenAuditAppendInput): Promise<void>;
+    /** Tenant-scoped, newest-first. */
+    query(params: OpenAuditQuery): Promise<OpenAuditRecord[]>;
+}
 
 /**
  * Per-agent A2A exposure configuration — controls whether an agent is
  * reachable over A2A and which skills are advertised on its AgentCard.
  */
-interface A2AExposure {
-    /** Whether this agent is exposed over the A2A protocol */
-    enabled: boolean;
-    /** Skills advertised on the AgentCard; defaults to a single generic skill when omitted */
-    skills?: Array<{
-        id: string;
-        name: string;
-        description: string;
-        tags?: string[];
-        examples?: string[];
-    }>;
-    /** Supported input modes (MIME types); defaults to text modes when omitted */
-    inputModes?: string[];
-    /** Supported output modes (MIME types); defaults to text modes when omitted */
-    outputModes?: string[];
-}
 /**
  * In-memory API key entry used for request authentication.
  * Empty/undefined assistantIds means all exposed agents in the tenant.
@@ -4643,6 +4733,8 @@ interface A2AApiKeyEntry {
     tenantId: string;
     projectId: string;
     assistantIds?: string[];
+    /** Open-door grants; the agent whitelist derives from the agent-domain items. */
+    grants?: OpenGrant[];
 }
 /**
  * Authentication context attached to an incoming A2A request after key validation.
@@ -4671,6 +4763,11 @@ interface A2AApiKeyRecord {
     projectId: string;
     /** Assistant whitelist; empty/undefined = all exposed agents in the tenant */
     assistantIds?: string[];
+    /**
+     * Open-door authorization grants (A2A door keeps reading assistantIds).
+     * Absent/empty → derived via effectiveGrants() legacy semantics.
+     */
+    grants?: OpenGrant[];
     label?: string;
     enabled: boolean;
     createdAt: Date;
@@ -4682,8 +4779,16 @@ interface CreateA2AApiKeyInput {
     projectId: string;
     /** Assistant whitelist; empty/undefined = all exposed agents in the tenant */
     assistantIds?: string[];
+    /** Open-door grants (see OpenProtocol); absent → legacy derivation */
+    grants?: OpenGrant[];
     label?: string;
 }
+interface UpdateA2AApiKeyInput {
+    label?: string;
+    projectId?: string;
+    assistantIds?: string[];
+    grants?: OpenGrant[];
+}
 interface A2AApiKeyStore {
     /** Look up a key record by its bearer token value (for auth). */
     findByKey(key: string): Promise<A2AApiKeyRecord | null>;
@@ -4705,6 +4810,8 @@ interface A2AApiKeyStore {
     rotate(id: string): Promise<A2AApiKeyRecord>;
     /** Delete a key permanently. */
     delete(id: string): Promise<void>;
+    /** Update mutable fields of an existing key (label, grants, projectId, assistantIds). */
+    update(id: string, input: UpdateA2AApiKeyInput): Promise<A2AApiKeyRecord>;
     /** Bulk load all active keys into a lookup Map (used at startup). */
     loadIntoMap(): Promise<Map<string, A2AApiKeyEntry>>;
 }
@@ -5372,7 +5479,10 @@ interface ProjectRoomMessageStore {
     createIdempotent(input: Omit<ProjectRoomMessage, "createdAt"> & {
         idempotencyKey: string;
     }): Promise<ProjectRoomMessage>;
-    /** Lists messages strictly before an optional cursor, up to the requested limit. */
+    /**
+     * Lists messages strictly before an optional cursor, up to the requested limit.
+     * Individually invalid persisted rows are skipped (and logged) instead of failing the whole read.
+     */
     list(input: {
         tenantId: string;
         roomId: string;
@@ -5830,6 +5940,8 @@ interface ShareRecord {
     passwordHash: string | null;
     expiresAt: Date | null;
     maxAccess: number | null;
+    /** Extra Open-door grants appended to sandbox tokens (V1: kb read-only). */
+    openGrants?: OpenGrant[];
     accessCount: number;
     revoked: boolean;
     createdAt: Date;
@@ -5844,6 +5956,8 @@ interface CreateShareRequest {
     title?: string;
     expiresAt?: string;
     maxAccess?: number;
+    /** Extra Open-door grants for sandbox tokens minted for this share. */
+    openGrants?: OpenGrant[];
 }
 /** Response returned to clients after a share is created. */
 interface ShareResult {
@@ -5929,6 +6043,16 @@ interface PluginConnection {
 interface PluginToolMeta {
     name: string;
     description: string;
+    /** When true, this tool surfaces on the Open API (MCP) surface. */
+    expose?: boolean;
+}
+/** Open-surface exposure entry with MCP annotation hints. */
+interface PluginOpenExposeTool {
+    name: string;
+    /** MCP readOnlyHint — pure query, no side effects. */
+    readOnly?: boolean;
+    /** MCP destructiveHint — may cause irreversible changes. */
+    destructive?: boolean;
 }
 /**
  * A text file included in a plugin skill bundle.
@@ -5987,6 +6111,14 @@ interface PluginMeta {
     icon?: string;
     /** 工具清单（可选，middleware 能自动提取时不需要写） */
     tools?: PluginToolMeta[];
+    /**
+     * Open 面（MCP）暴露的工具名清单——独立于 tools 声明，一行即生长。
+     * 声明后 OpenCredentialService 的 grants 匹配 domain=<meta.type>。
+     *
+     * 条目可为字符串（默认 readOnly=false, destructive=false）或带注解对象，
+     * 注解映射到 MCP annotations（readOnlyHint / destructiveHint）。
+     */
+    openExpose?: Array<string | PluginOpenExposeTool>;
     /**
      * 中间件配置 schema（用于 agent 配置面板）。新的 connection-backed
      * plugins use `connections: string[]` and optional `connectAll?: boolean`.
@@ -6109,6 +6241,67 @@ interface Plugin {
     stores?: Record<string, object | (() => object)>;
 }
 
+/**
+ * A single tool contributed by a sandbox-authored tenant plugin.
+ *
+ * @property name - Tool name exposed to the LLM (validated `^[a-zA-Z0-9_-]{1,64}$`).
+ * @property description - Tool description.
+ * @property schema - Restricted JSON Schema subset describing the tool input.
+ * @property handler - Safe relative path (within the plugin directory) to a JS file.
+ */
+interface SandboxPluginToolDef {
+    name: string;
+    description: string;
+    schema: Record<string, unknown>;
+    handler: string;
+    expose?: boolean;
+    readOnly?: boolean;
+    destructive?: boolean;
+    timeoutMs?: number;
+    maxResultBytes?: number;
+}
+/**
+ * Connection capability contributed by a sandbox plugin. `test`/`discover`
+ * point at handler files relative to the plugin directory.
+ */
+interface SandboxPluginConnectionDef {
+    fields: PluginConnectionFieldSchema[];
+    test?: {
+        handler: string;
+    };
+    discover?: {
+        handler: string;
+    };
+    resourceLabel?: string;
+}
+/**
+ * Authoritative declarative definition of a tenant plugin, stored at
+ * `/root/.agents/plugins/<type>/plugin.json`.
+ */
+interface SandboxPluginManifest {
+    schemaVersion: 1;
+    type: string;
+    name: string;
+    description: string;
+    version: string;
+    icon?: string;
+    category?: string;
+    configSchema?: Record<string, unknown>;
+    defaultConfig?: Record<string, unknown>;
+    connection?: SandboxPluginConnectionDef;
+    tools: SandboxPluginToolDef[];
+    skills?: Record<string, PluginSkillDefinition>;
+    agents?: Record<string, AgentConfig>;
+}
+/** Structured load/validation feedback surfaced to authors and operators. */
+interface SandboxPluginDiagnostic {
+    level: "error" | "warning";
+    code: string;
+    pluginType?: string;
+    tool?: string;
+    message: string;
+}
+
 /**
  * 通用类型定义
  *
@@ -6222,4 +6415,4 @@ declare function parseTrustedRunContext(value: unknown): TrustedRunContext;
  */
 declare function parseQueuedExecutionMode(value: unknown): QueuedExecutionMode;
 
-export { type A2AApiKeyEntry, type A2AApiKeyRecord, type A2AApiKeyStore, type A2AAuthContext, type A2AExposure, type A2ARemoteAgentConfig, type AgentClient, type AgentConfig, type AgentConfigWithTools, type AgentLatticeProtocol, type AgentMenuConfig, type AgentMiddlewareConfig, type AgentRunConfig, AgentType, type AgentWebApp, type AgentWebAppAppearance, type AgentWebAppBootstrap, type AgentWebAppCalloutWidget, type AgentWebAppError, type AgentWebAppErrorCode, type AgentWebAppFeatures, type AgentWebAppGenUIBlock, type AgentWebAppIdentityAssurance, type AgentWebAppIdentityConfig, type AgentWebAppIdentityPolicy, type AgentWebAppInterrupt, type AgentWebAppIssuerConfig, type AgentWebAppRuntimeMessage, type AgentWebAppRuntimeThread, type AgentWebAppScope, type AgentWebAppStatus, type AgentWebAppStore, type AgentWebAppStorePatch, type AgentWebAppStreamEvent, type AgentWebAppStreamProjectionContext, type AgentWebAppTableWidget, type AgentWebAppThreadMetadata, type AgentWebAppUpdateOptions, type Assistant, type AssistantMessage, type AssistantStore, type Attachment, type AvailableModule, type BaseLatticeProtocol, type BaseMessage, type Binding, type BindingListParams, type BindingMutablePatch, type BindingRegistry, type BootstrapFilesConfig, type BrowserMiddlewareConfig, type Callback, type CapabilityBundle, type CapabilityBundleDeleteResult, type CapabilityBundleStore, type CapabilityBundleUpdateConflict, type CapabilityFieldSource, type CapabilityOverride, type CapabilityPreview, type CapabilityPreviewIssue, type CapabilityRuntime, type ChannelAdapter, type ChannelBindingMigrationConflict, ChannelBindingMigrationConflictError, type ChannelInstallation, type ChannelInstallationStore, type ChannelInstallationType, type ClawMiddlewareConfig, type CodeEvalMiddlewareConfig, type Collection, type CollectionField, type CollectionFieldType, type CollectionMiddlewareConfig, type CollectionSchema, type CollectionStore, type ConnectionEntry, type ConnectionStore, type ConversationRecord, type CreateA2AApiKeyInput, type CreateAgentWebAppInput, type CreateAssistantRequest, type CreateBindingInput, type CreateCapabilityBundleInput, type CreateChannelInstallationInput, type CreateChannelInstallationRequest, type CreateCollectionRequest, type CreateConversationInput, type CreateDatabaseConfigRequest, type CreateEvalCaseRequest, type CreateEvalProjectRequest, type CreateEvalRunRequest, type CreateEvalSuiteRequest, type CreateMcpServerConfigRequest, type CreateMenuItemInput, type CreateMetricsServerConfigRequest, type CreateProjectRequest, type CreateRunStepRequest, type CreateShareRequest, type CreateSkillRequest, type CreateTaskRequest, type CreateTenantRequest, type CreateThreadRequest, type CreateUserRequest, type CreateUserTenantLinkRequest, type CreateWorkItemIfAbsentRequest, type CreateWorkItemRequest, type CreateWorkflowRunRequest, type CreateWorkspaceRequest, type CustomMenuConfig, type DataSource, type DatabaseConfig, type DatabaseConfigEntry, type DatabaseConfigStore, type DatabaseType, type DeepAgentConfig, type DescriptorDataValue, type DeveloperMessage, type DispatchResult, DuplicateChannelBindingSubjectError, EXECUTION_RESULT_EVENT_KEY_PATTERN, EXECUTION_RESULT_EVENT_KEY_PATTERN_SOURCE, EXECUTION_RESULT_EVENT_KEY_PREFIX, type EmbeddingsConfig, type EmbeddingsLatticeProtocol, type EvalCase, type EvalProject, type EvalProjectReport, type EvalRun, type EvalRunResult, type EvalStore, type EvalSuite, type ExecuteSqlQueryRequest, type ExecuteSqlQueryResponse, type ExpectedCapabilityBundleRevisions, type FilterCondition, type GraphBuildOptions, type HtmlMenuConfig, type IConversationStore, type ID, type InboundMessage, type InternalAgentNode, type InternalBaseNode, type InternalCreateCapabilityBundleInput, type InternalDSL, type InternalEdge, type InternalInput, type InternalInputNode, type InternalMapNode, type InternalNode, type InternalNodeConfig, type InternalOutput, type InternalState, type InternalStateField, type InternalTerminalNode, type InternalUpdateCapabilityBundleInput, type InterruptMessage, type InterruptPolicy, InvalidProjectCapabilityBundleConfigError, type LLMConfig, type LarkChannelInstallationConfig, type LatticeError, type LatticeEventBus, type LatticeMessage, type LocalA2AProviderId, type LocalA2AProviderState, type LocalA2AProviderStatus, type LocalA2ATemplateDefinition, type LocalRuntimeConfig, type LoggerClient, type LoggerConfig, type LoggerContext, type LoggerLatticeProtocol, LoggerType, MAX_PENDING_EXECUTION_RESULTS_LIMIT, type McpClient, type McpClientOptions, type McpConnectionStatus, type McpLatticeMessage, type McpLatticeProtocol, McpMessageType, type McpServerConfig, type McpServerConfigEntry, type McpServerConfigStore, type McpStats, type McpTool, type McpToolResult, type McpTransportType, type MemoryClient, type MemoryConfig, type MemoryLatticeProtocol, MemoryType, type MenuContentConfig, type MenuContentType, type MenuItem, type MenuRegistry, type MenuTarget, type Message, type MessageChunk, type MessageChunkType, MessageChunkTypes, type MessageContext, type MessageMiddleware, type MetricColumn, type MetricDataPoint, type MetricMeta, type MetricQueryResult, type MetricsMiddlewareConfig, type MetricsServerConfig, type MetricsServerConfigEntry, type MetricsServerConfigStore, type MetricsServerType, type MiddlewareType, type ModelLatticeProtocol, type OutboundMessage, PROJECT_ROOM_USER_CHANNEL_PROJECT, PROJECT_TASK_LIFECYCLE_ACTIONS, type PaginatedResult, type PaginationParams, type PinoFileOptions, type Plugin, type PluginConnection, type PluginConnectionFieldSchema, type PluginConnectionTestResult, type PluginContext, type PluginDiscoveredResource, type PluginMeta, type PluginMetaOutput, type PluginMiddlewareFactory, type PluginSkillDefinition, type PluginSkillResource, type PluginStandardConnectionConfig, type PluginToolMeta, type ProcessingAgentConfig, type Project, type ProjectBotMembership, type ProjectBotMembershipStatus, type ProjectBotMembershipStore, type ProjectBotRole, type ProjectCapabilityConfig, type ProjectFilter, type ProjectHumanRole, type ProjectKind, type ProjectLifecycleEventCursor, type ProjectLifecycleEventQuery, type ProjectMembership, type ProjectMembershipMutationResult, type ProjectMembershipStatus, type ProjectMembershipStore, type ProjectRoom, ProjectRoomBrokerCapacityError, type ProjectRoomBusinessEvent, type ProjectRoomBusinessEventDraft, type ProjectRoomControlEvent, ProjectRoomCursorError, type ProjectRoomEventBrokerProtocol, type ProjectRoomEventId, type ProjectRoomEventOf, type ProjectRoomEventScope, type ProjectRoomEventSubscription, type ProjectRoomMembershipAffectedEvent, type ProjectRoomMembershipChangedEvent, type ProjectRoomMention, type ProjectRoomMessage, type ProjectRoomMessageAuthor, type ProjectRoomMessageCreatedEvent, type ProjectRoomMessageCursor, type ProjectRoomMessageSource, type ProjectRoomMessageStore, type ProjectRoomPublicBotMembership, type ProjectRoomPublicMembership, type ProjectRoomPublicMessage, type ProjectRoomReadChangedEvent, type ProjectRoomReadState, type ProjectRoomReadStateStore, type ProjectRoomRealtimeActor, type ProjectRoomRosterChangedEvent, type ProjectRoomScopedBusinessEvent, type ProjectRoomSseWritable, type ProjectRoomStore, type ProjectRoomTaskChangedEvent, type ProjectRoomThreadMetadata, type ProjectRoomTrustedRunContext, type ProjectStore, type ProjectTaskLifecycleAction, ProjectTaskStoreUnsupportedError, type ProjectTaskThreadMetadata, type ProjectTaskTrustedRunContext, type ProjectTaskWorkItemStore, type PublicChannelInstallationType, type QueryParams, type QueryResultFormat, type QueryWorkflowRunsOptions, type QueryWorkflowRunsResult, type QueueClient, type QueueConfig, type QueueLatticeProtocol, type QueueResult, QueueType, type QueuedExecutionMode, type ReactAgentConfig, type ReplyTarget, type ResourceAddress, type ResourceResolver, type Result, type RunStep, type STTClient, type STTConfig, type STTModelLatticeProtocol, type SandboxMiddlewareConfig, type ScheduleClient, type ScheduleConfig, type ScheduleCronOptions, ScheduleExecutionType, type ScheduleLatticeProtocol, type ScheduleOnceOptions, type ScheduleStorage, ScheduleType, type ScheduledTaskDefinition, ScheduledTaskStatus, type SchedulerMiddlewareConfig, type SemanticMetricsFilter, type SemanticMetricsQueryRequest, type SemanticMetricsQueryResponse, type SemanticMetricsServerConfig, type ShareRecord, type ShareResult, type ShareVisibility, type SharedResourceStore, type Skill, type SkillClient, type SkillClientType, type SkillConfig, type SkillLatticeProtocol, type SkillStore, type SkillStoreContext, type SqlMiddlewareConfig, type StepStatus, type StepType, type StorageType, type SystemMessage, type TableQueryRequest, type TableQueryResponse, type TaskBeliefDiagnosticCode, type TaskBeliefEntry, type TaskBeliefParseFailure, type TaskBeliefParseResult, type TaskBeliefParseSuccess, type TaskBeliefState, type TaskDependentListQuery, type TaskFileRef, type TaskHandler, type TaskItem, type TaskListFilter, type TaskMutationSnapshot, type TaskStore, type TaskWorkItem, type TaskWorkItemListFilter, type TaskWorkItemStore, type TeamAgentConfig, type TeamTeammateConfig, type Tenant, type TenantStatus, type TenantStore, type TestMcpServerToolsResponse, type Thread, type ThreadStore, type Timestamp, type ToolCall, type ToolConfig, type ToolExecutor, type ToolLatticeProtocol, type ToolMessage, type TopologyEdge, type TranscriptionResult, type TrustedRunContext, type UIComponent, UIComponentType, type UIConfig, type UILatticeProtocol, type UpdateAgentWebAppInput, type UpdateCapabilityBundleInput, type UpdateChannelInstallationRequest, type UpdateCollectionRequest, type UpdateDatabaseConfigRequest, type UpdateMcpServerConfigRequest, type UpdateMenuItemInput, type UpdateMetricsServerConfigRequest, type UpdateProjectCapabilityBundlesResult, type UpdateProjectRequest, type UpdateRunStepRequest, type UpdateTaskRequest, type UpdateTenantRequest, type UpdateUserRequest, type UpdateUserTenantLinkRequest, type UpdateWorkflowRunRequest, type UpdateWorkspaceRequest, type User, type UserMessage, type UserStatus, type UserStore, type UserTenantLink, type UserTenantLinkStore, type UserTenantRole, type VectorStoreConfig, type VectorStoreCreateParams, type VectorStoreLatticeProtocol, type VectorStoreProvider, type WechatChannelInstallationConfig, type WorkflowAgentConfig, type WorkflowRun, type WorkflowRunStatus, type WorkflowTrackingStore, type Workspace, type WorkspaceStore, type YamlAgentStep, type YamlMapStep, type YamlParallelBlock, type YamlTopLevelStep, type YamlWorkflow, assertGenericProjectConfig, createAgentWebAppStreamProjectionContext, descriptorDataValue, getSubAgentsFromConfig, getToolsFromConfig, hasTools, isA2ARemoteAgentConfig, isDeepAgentConfig, isExecutionResultEventKey, isProcessingAgentConfig, isProjectRoomEventId, isTeamAgentConfig, isWorkflowAgentConfig, parseAgentWebAppGenUIBlock, parseProjectRoomEventId, parseQueuedExecutionMode, parseTaskBeliefState, parseTrustedRunContext, projectAgentWebAppChunk, projectRoomUserEventScope, replaceTaskBeliefState, requireProjectTaskWorkItemStore, snapshotExactArray, snapshotExactRecord, snapshotProjectRoomBotMembershipRealtime, snapshotProjectRoomMembershipRealtime, snapshotProjectRoomMessageRealtime, taskBeliefStatesEqual, toProjectRoomPublicBotMembership, toProjectRoomPublicMembership, toProjectRoomPublicMessage };
+export { type A2AApiKeyEntry, type A2AApiKeyRecord, type A2AApiKeyStore, type A2AAuthContext, type A2ARemoteAgentConfig, type AgentClient, type AgentConfig, type AgentConfigWithTools, type AgentLatticeProtocol, type AgentMenuConfig, type AgentMiddlewareConfig, type AgentRunConfig, AgentType, type AgentWebApp, type AgentWebAppAppearance, type AgentWebAppBootstrap, type AgentWebAppCalloutWidget, type AgentWebAppError, type AgentWebAppErrorCode, type AgentWebAppFeatures, type AgentWebAppGenUIBlock, type AgentWebAppIdentityAssurance, type AgentWebAppIdentityConfig, type AgentWebAppIdentityPolicy, type AgentWebAppInterrupt, type AgentWebAppIssuerConfig, type AgentWebAppRuntimeMessage, type AgentWebAppRuntimeThread, type AgentWebAppScope, type AgentWebAppStatus, type AgentWebAppStore, type AgentWebAppStorePatch, type AgentWebAppStreamEvent, type AgentWebAppStreamProjectionContext, type AgentWebAppTableWidget, type AgentWebAppThreadMetadata, type AgentWebAppUpdateOptions, type Assistant, type AssistantMessage, type AssistantStore, type Attachment, type AvailableModule, type BaseLatticeProtocol, type BaseMessage, type Binding, type BindingListParams, type BindingMutablePatch, type BindingRegistry, type BootstrapFilesConfig, type BrowserMiddlewareConfig, type Callback, type CapabilityBundle, type CapabilityBundleDeleteResult, type CapabilityBundleStore, type CapabilityBundleUpdateConflict, type CapabilityFieldSource, type CapabilityOverride, type CapabilityPreview, type CapabilityPreviewIssue, type CapabilityRuntime, type ChannelAdapter, type ChannelBindingMigrationConflict, ChannelBindingMigrationConflictError, type ChannelInstallation, type ChannelInstallationStore, type ChannelInstallationType, type ClawMiddlewareConfig, type CodeEvalMiddlewareConfig, type Collection, type CollectionField, type CollectionFieldType, type CollectionMiddlewareConfig, type CollectionSchema, type CollectionStore, type ConnectionEntry, type ConnectionStore, type ConversationRecord, type CreateA2AApiKeyInput, type CreateAgentWebAppInput, type CreateAssistantRequest, type CreateBindingInput, type CreateCapabilityBundleInput, type CreateChannelInstallationInput, type CreateChannelInstallationRequest, type CreateCollectionRequest, type CreateConversationInput, type CreateDatabaseConfigRequest, type CreateEvalCaseRequest, type CreateEvalProjectRequest, type CreateEvalRunRequest, type CreateEvalSuiteRequest, type CreateMcpServerConfigRequest, type CreateMenuItemInput, type CreateMetricsServerConfigRequest, type CreateProjectRequest, type CreateRunStepRequest, type CreateShareRequest, type CreateSkillRequest, type CreateTaskRequest, type CreateTenantRequest, type CreateThreadRequest, type CreateUserRequest, type CreateUserTenantLinkRequest, type CreateWorkItemIfAbsentRequest, type CreateWorkItemRequest, type CreateWorkflowRunRequest, type CreateWorkspaceRequest, type CustomMenuConfig, type DataSource, type DatabaseConfig, type DatabaseConfigEntry, type DatabaseConfigStore, type DatabaseType, type DeepAgentConfig, type DescriptorDataValue, type DeveloperMessage, type DispatchResult, DuplicateChannelBindingSubjectError, EXECUTION_RESULT_EVENT_KEY_PATTERN, EXECUTION_RESULT_EVENT_KEY_PATTERN_SOURCE, EXECUTION_RESULT_EVENT_KEY_PREFIX, type EmbeddingsConfig, type EmbeddingsLatticeProtocol, type EvalCase, type EvalProject, type EvalProjectReport, type EvalRun, type EvalRunResult, type EvalStore, type EvalSuite, type ExecuteSqlQueryRequest, type ExecuteSqlQueryResponse, type ExpectedCapabilityBundleRevisions, type FilterCondition, type GraphBuildOptions, type HtmlMenuConfig, type IConversationStore, type ID, type InboundMessage, type InternalAgentNode, type InternalBaseNode, type InternalCreateCapabilityBundleInput, type InternalDSL, type InternalEdge, type InternalInput, type InternalInputNode, type InternalMapNode, type InternalNode, type InternalNodeConfig, type InternalOutput, type InternalState, type InternalStateField, type InternalTerminalNode, type InternalUpdateCapabilityBundleInput, type InterruptMessage, type InterruptPolicy, InvalidProjectCapabilityBundleConfigError, type LLMConfig, type LarkChannelInstallationConfig, type LatticeError, type LatticeEventBus, type LatticeMessage, type LocalA2AProviderId, type LocalA2AProviderState, type LocalA2AProviderStatus, type LocalA2ATemplateDefinition, type LocalRuntimeConfig, type LoggerClient, type LoggerConfig, type LoggerContext, type LoggerLatticeProtocol, LoggerType, MAX_PENDING_EXECUTION_RESULTS_LIMIT, type McpClient, type McpClientOptions, type McpConnectionStatus, type McpLatticeMessage, type McpLatticeProtocol, McpMessageType, type McpServerConfig, type McpServerConfigEntry, type McpServerConfigStore, type McpStats, type McpTool, type McpToolResult, type McpTransportType, type MemoryClient, type MemoryConfig, type MemoryLatticeProtocol, MemoryType, type MenuContentConfig, type MenuContentType, type MenuItem, type MenuRegistry, type MenuTarget, type Message, type MessageChunk, type MessageChunkType, MessageChunkTypes, type MessageContext, type MessageMiddleware, type MetricColumn, type MetricDataPoint, type MetricMeta, type MetricQueryResult, type MetricsMiddlewareConfig, type MetricsServerConfig, type MetricsServerConfigEntry, type MetricsServerConfigStore, type MetricsServerType, type MiddlewareType, type ModelLatticeProtocol, type OpenAuditAppendInput, type OpenAuditQuery, type OpenAuditRecord, type OpenAuditStore, type OpenCapabilitySource, type OpenCatalog, type OpenCatalogDomain, type OpenCatalogItem, type OpenCredentialKind, type OpenExecutionContext, type OpenExecutionResult, type OpenGrant, type OutboundMessage, PROJECT_ROOM_USER_CHANNEL_PROJECT, PROJECT_TASK_LIFECYCLE_ACTIONS, type PaginatedResult, type PaginationParams, type PinoFileOptions, type Plugin, type PluginConnection, type PluginConnectionFieldSchema, type PluginConnectionTestResult, type PluginContext, type PluginDiscoveredResource, type PluginMeta, type PluginMetaOutput, type PluginMiddlewareFactory, type PluginSkillDefinition, type PluginSkillResource, type PluginStandardConnectionConfig, type PluginToolMeta, type ProcessingAgentConfig, type Project, type ProjectBotMembership, type ProjectBotMembershipStatus, type ProjectBotMembershipStore, type ProjectBotRole, type ProjectCapabilityConfig, type ProjectFilter, type ProjectHumanRole, type ProjectKind, type ProjectLifecycleEventCursor, type ProjectLifecycleEventQuery, type ProjectMembership, type ProjectMembershipMutationResult, type ProjectMembershipStatus, type ProjectMembershipStore, type ProjectRoom, ProjectRoomBrokerCapacityError, type ProjectRoomBusinessEvent, type ProjectRoomBusinessEventDraft, type ProjectRoomControlEvent, ProjectRoomCursorError, type ProjectRoomEventBrokerProtocol, type ProjectRoomEventId, type ProjectRoomEventOf, type ProjectRoomEventScope, type ProjectRoomEventSubscription, type ProjectRoomMembershipAffectedEvent, type ProjectRoomMembershipChangedEvent, type ProjectRoomMention, type ProjectRoomMessage, type ProjectRoomMessageAuthor, type ProjectRoomMessageCreatedEvent, type ProjectRoomMessageCursor, type ProjectRoomMessageSource, type ProjectRoomMessageStore, type ProjectRoomPublicBotMembership, type ProjectRoomPublicMembership, type ProjectRoomPublicMessage, type ProjectRoomReadChangedEvent, type ProjectRoomReadState, type ProjectRoomReadStateStore, type ProjectRoomRealtimeActor, type ProjectRoomRosterChangedEvent, type ProjectRoomScopedBusinessEvent, type ProjectRoomSseWritable, type ProjectRoomStore, type ProjectRoomTaskChangedEvent, type ProjectRoomThreadMetadata, type ProjectRoomTrustedRunContext, type ProjectStore, type ProjectTaskLifecycleAction, ProjectTaskStoreUnsupportedError, type ProjectTaskThreadMetadata, type ProjectTaskTrustedRunContext, type ProjectTaskWorkItemStore, type PublicChannelInstallationType, type QueryParams, type QueryResultFormat, type QueryWorkflowRunsOptions, type QueryWorkflowRunsResult, type QueueClient, type QueueConfig, type QueueLatticeProtocol, type QueueResult, QueueType, type QueuedExecutionMode, type ReactAgentConfig, type ReplyTarget, type ResourceAddress, type ResourceResolver, type Result, type RunStep, type STTClient, type STTConfig, type STTModelLatticeProtocol, type SandboxMiddlewareConfig, type SandboxPluginConnectionDef, type SandboxPluginDiagnostic, type SandboxPluginManifest, type SandboxPluginToolDef, type ScheduleClient, type ScheduleConfig, type ScheduleCronOptions, ScheduleExecutionType, type ScheduleLatticeProtocol, type ScheduleOnceOptions, type ScheduleStorage, ScheduleType, type ScheduledTaskDefinition, ScheduledTaskStatus, type SchedulerMiddlewareConfig, type SemanticMetricsFilter, type SemanticMetricsQueryRequest, type SemanticMetricsQueryResponse, type SemanticMetricsServerConfig, type ShareRecord, type ShareResult, type ShareVisibility, type SharedResourceStore, type Skill, type SkillClient, type SkillClientType, type SkillConfig, type SkillLatticeProtocol, type SkillStore, type SkillStoreContext, type SqlMiddlewareConfig, type StepStatus, type StepType, type StorageType, type SystemMessage, type TableQueryRequest, type TableQueryResponse, type TaskBeliefDiagnosticCode, type TaskBeliefEntry, type TaskBeliefParseFailure, type TaskBeliefParseResult, type TaskBeliefParseSuccess, type TaskBeliefState, type TaskDependentListQuery, type TaskFileRef, type TaskHandler, type TaskItem, type TaskListFilter, type TaskMutationSnapshot, type TaskStore, type TaskWorkItem, type TaskWorkItemListFilter, type TaskWorkItemStore, type TeamAgentConfig, type TeamTeammateConfig, type Tenant, type TenantStatus, type TenantStore, type TestMcpServerToolsResponse, type Thread, type ThreadStore, type Timestamp, type ToolCall, type ToolConfig, type ToolExecutor, type ToolLatticeProtocol, type ToolMessage, type TopologyEdge, type TranscriptionResult, type TrustedRunContext, type UIComponent, UIComponentType, type UIConfig, type UILatticeProtocol, type UpdateA2AApiKeyInput, type UpdateAgentWebAppInput, type UpdateCapabilityBundleInput, type UpdateChannelInstallationRequest, type UpdateCollectionRequest, type UpdateDatabaseConfigRequest, type UpdateMcpServerConfigRequest, type UpdateMenuItemInput, type UpdateMetricsServerConfigRequest, type UpdateProjectCapabilityBundlesResult, type UpdateProjectRequest, type UpdateRunStepRequest, type UpdateTaskRequest, type UpdateTenantRequest, type UpdateUserRequest, type UpdateUserTenantLinkRequest, type UpdateWorkflowRunRequest, type UpdateWorkspaceRequest, type User, type UserMessage, type UserStatus, type UserStore, type UserTenantLink, type UserTenantLinkStore, type UserTenantRole, type VectorStoreConfig, type VectorStoreCreateParams, type VectorStoreLatticeProtocol, type VectorStoreProvider, type WechatChannelInstallationConfig, type WorkflowAgentConfig, type WorkflowRun, type WorkflowRunStatus, type WorkflowTrackingStore, type Workspace, type WorkspaceStore, type YamlAgentStep, type YamlMapStep, type YamlParallelBlock, type YamlTopLevelStep, type YamlWorkflow, assertGenericProjectConfig, createAgentWebAppStreamProjectionContext, descriptorDataValue, effectiveGrants, getSubAgentsFromConfig, getToolsFromConfig, hasTools, isA2ARemoteAgentConfig, isDeepAgentConfig, isExecutionResultEventKey, isProcessingAgentConfig, isProjectRoomEventId, isTeamAgentConfig, isWorkflowAgentConfig, parseAgentWebAppGenUIBlock, parseProjectRoomEventId, parseQueuedExecutionMode, parseTaskBeliefState, parseTrustedRunContext, projectAgentWebAppChunk, projectRoomUserEventScope, replaceTaskBeliefState, requireProjectTaskWorkItemStore, snapshotExactArray, snapshotExactRecord, snapshotProjectRoomBotMembershipRealtime, snapshotProjectRoomMembershipRealtime, snapshotProjectRoomMessageRealtime, taskBeliefStatesEqual, toProjectRoomPublicBotMembership, toProjectRoomPublicMembership, toProjectRoomPublicMessage };

package/dist/index.js

@@ -45,6 +45,7 @@ __export(index_exports, {
   assertGenericProjectConfig: () => assertGenericProjectConfig,
   createAgentWebAppStreamProjectionContext: () => createAgentWebAppStreamProjectionContext,
   descriptorDataValue: () => descriptorDataValue,
+  effectiveGrants: () => effectiveGrants,
   getSubAgentsFromConfig: () => getSubAgentsFromConfig,
   getToolsFromConfig: () => getToolsFromConfig,
   hasTools: () => hasTools,
@@ -935,6 +936,15 @@ function parseQueuedExecutionMode(value) {
   if (value !== "followup") throw new Error("Invalid queued execution mode");
   return value;
 }
+
+// src/OpenProtocol.ts
+function effectiveGrants(record) {
+  if (record.grants && record.grants.length > 0) return record.grants;
+  if (record.assistantIds && record.assistantIds.length > 0) {
+    return [{ domain: "agent", items: record.assistantIds }];
+  }
+  return [{ domain: "agent" }];
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AgentType,
@@ -962,6 +972,7 @@ function parseQueuedExecutionMode(value) {
   assertGenericProjectConfig,
   createAgentWebAppStreamProjectionContext,
   descriptorDataValue,
+  effectiveGrants,
   getSubAgentsFromConfig,
   getToolsFromConfig,
   hasTools,