@newheap/platform-ai-chat 0.13.0 → 0.15.0

package/index.d.ts

@@ -12,7 +12,7 @@ import { TemplatePortal } from '@angular/cdk/portal';
 type AgentSubjectRole = 'none' | 'reader' | 'participant' | 'approver';
 type AgentRunStatus = 'queued' | 'running' | 'waiting-for-approval' | 'completed' | 'failed' | 'cancelled';
 type AgentProposalStatus = 'pending' | 'approved' | 'rejected' | 'expired' | 'withdrawn' | 'stale' | 'executing' | 'executed' | 'execution-failed' | 'execution-unknown' | 'resolved' | 'shadow';
-type AgentGrantSource = 'none' | 'delegated' | 'agent' | 'delegated-read';
+type AgentGrantSource = 'none' | 'delegated' | 'agent' | 'delegated-read' | 'accountable';
 /**
  * How a run worked: `model` through the language model, `rule` through the agent's rules without a
  * model, `rule-then-model` when the rules handed the run over to the model.
@@ -49,6 +49,10 @@ interface AgentRun {
     /** The skill of the agent the run worked in; missing or null for the agent's own tools. */
     skill?: string | null;
     skillChosenBy?: AgentSkillChooser | null;
+    /** The version of a skill defined as data the run worked in; absent for a skill in code. */
+    skillVersion?: number | null;
+    /** The run evaluated a candidate version of its skill in the shadow thread. */
+    skillCandidate?: boolean;
     /** The agent that handed the run's work off; missing or null for a run no agent asked for. */
     requestedByAgentId?: string | null;
     /**
@@ -79,6 +83,16 @@ interface AgentThread {
      * nobody is notified and nothing proposed in it executes.
      */
     shadow?: boolean;
+    /**
+     * The name of the subject type in the caller's language, such as "Project", when the application
+     * named the type; `null` or missing otherwise.
+     */
+    subjectTypeName?: string | null;
+    /**
+     * Where the application shows the subject, from the type's link template; `null` or missing
+     * without one. `provideNhAssistant({ subjectLinks })` may replace it with a router link.
+     */
+    subjectLink?: string | null;
 }
 interface AgentThreadLookup {
     thread: AgentThread | null;
@@ -97,6 +111,12 @@ interface AgentProposalDecisionRight {
 /** One agent on a subject: its thread, `null` before it worked on the subject, and whether the caller may start it. */
 interface AgentSubjectWorkAgent {
     agentId: string;
+    /**
+     * The agent's name: a translation key for an agent in code, the text itself for an agent created in
+     * the administration. It names an agent kept out of the chat as well, which the status does not list;
+     * missing from servers before it was added.
+     */
+    displayNameKey?: string | null;
     thread: AgentThread | null;
     canStart: boolean;
     /**
@@ -130,6 +150,16 @@ interface AgentSubjectWork {
     subjectType: string;
     subjectId: string;
     subjectDisplayName: string | null;
+    /**
+     * The name of the subject type in the caller's language, such as "Project", when the application
+     * named the type; `null` or missing otherwise.
+     */
+    subjectTypeName?: string | null;
+    /**
+     * Where the application shows the subject, from the type's link template; `null` or missing
+     * without one. `provideNhAssistant({ subjectLinks })` may replace it with a router link.
+     */
+    subjectLink?: string | null;
     /** The caller's live role. Without a role the server answers `404 assistant-subject-not-found`. */
     role: Exclude<AgentSubjectRole, 'none'>;
     agents: AgentSubjectWorkAgent[];
@@ -152,17 +182,216 @@ interface AgentSubjectSummaryList {
 }
 /** Maximum number of subjects one `POST subjects/{type}/summary` request accepts. */
 declare const NH_ASSISTANT_MAX_SUBJECT_SUMMARY = 200;
+/** One subject a search found (`GET subjects/{type}/search`). */
+interface AgentSubjectSearchResult {
+    type: string;
+    id: string;
+    /** The name the application gives the subject; show the id without one. */
+    displayName: string | null;
+    /** The subject's isolation key: `tenant:…`, `division:…` or `global`. */
+    scopeKey: string;
+    divisionId: string | null;
+    /** Where the application shows the subject; `null` without a link template. */
+    link?: string | null;
+}
+/** The subjects of one type a search found that the caller may read, in the application's order. */
+interface AgentSubjectSearch {
+    subjectType: string;
+    items: AgentSubjectSearchResult[];
+}
+/** The shortest and longest text `searchSubjects` accepts, and the most results it returns. */
+declare const NH_ASSISTANT_SUBJECT_SEARCH: {
+    readonly minQueryLength: 2;
+    readonly maxQueryLength: 100;
+    readonly maxLimit: 50;
+};
+/** The platform's subject type of the whole application, which the server registers itself. */
+declare const NH_ASSISTANT_SYSTEM_SUBJECT_TYPE = "nh-system";
+/** The whole application as one subject, for an agent that works app-wide. */
+declare const NH_ASSISTANT_SYSTEM_GLOBAL_ID = "global";
+/** The most characters of a run's result that `getObjectAgents` returns for its latest run. */
+declare const NH_ASSISTANT_RESULT_PREVIEW_LENGTH = 300;
+/** The newest run of an agent on a subject, with the beginning of its result. */
+interface AgentLatestRun {
+    runId: string;
+    conversationId: string;
+    triggerId: string;
+    status: AgentRunStatus;
+    failureCode: string | null;
+    /** When the run ended, or started, or was queued. */
+    at: string;
+    /**
+     * The first `NH_ASSISTANT_RESULT_PREVIEW_LENGTH` characters of the run's stored answer: model
+     * output, to show as text. For a run without one, such as a run that ended before runs kept their
+     * answer, the summary it ended with; `null` while the run has none. `getRunResult` returns all of it.
+     */
+    result: string | null;
+    /** The result is longer than `result`. */
+    resultTruncated: boolean;
+    /** The run worked in the agent's shadow thread, which only administrators see. */
+    shadow: boolean;
+}
+/** One agent that works on a subject, as `getObjectAgents` lists it. */
+interface AgentObjectAgent {
+    agentId: string;
+    /** A translation key for an agent in code, the text itself for one created in the administration. */
+    displayNameKey: string;
+    descriptionKey: string;
+    /** Whether the caller may run the agent on the subject now. */
+    canStart: boolean;
+    /** The agent's thread about the subject that people open; `null` before it worked on it. */
+    conversationId: string | null;
+    /** The agent's newest run on the subject; `null` before its first. */
+    latestRun: AgentLatestRun | null;
+    /** The agent's proposals on the subject that wait for a decision. */
+    openProposals: number;
+}
+/**
+ * The agents that work on one subject and that the caller may use (`GET subjects/{type}/{id}/agents`),
+ * ordered by id. The subject is an object or the whole application.
+ */
+interface AgentObjectAgents {
+    subjectType: string;
+    subjectId: string;
+    subjectDisplayName: string | null;
+    subjectTypeName?: string | null;
+    subjectLink?: string | null;
+    /** The caller's live role. Without a role the server answers `404 assistant-subject-not-found`. */
+    role: Exclude<AgentSubjectRole, 'none'>;
+    agents: AgentObjectAgent[];
+}
+/** The most characters of a run's answer that `getRunResult` returns; a longer answer is cut. */
+declare const NH_ASSISTANT_RUN_RESULT_MAX_LENGTH = 20000;
+/** The most runs one page of a run history holds. */
+declare const NH_ASSISTANT_RUN_HISTORY_MAX_PAGE = 50;
+/**
+ * Which runs a run history lists. Every part is optional: an agent, a subject type (`nh-system` for
+ * the whole application) or one subject of it, a status, and a period by when runs were created
+ * (`from` inclusive, `to` exclusive, ISO 8601). `page` starts at 1; `itemsPerPage` is 1 to
+ * `NH_ASSISTANT_RUN_HISTORY_MAX_PAGE` (default 20).
+ */
+interface AgentRunFilter {
+    agentId?: string;
+    subjectType?: string;
+    subjectId?: string;
+    status?: AgentRunStatus;
+    from?: string;
+    to?: string;
+    page?: number;
+    itemsPerPage?: number;
+}
+/**
+ * A personal MCP server a background run left out, and why: `assistant-mcp-consent-required` (the
+ * person has not allowed background use), `assistant-mcp-connection-required` or
+ * `assistant-mcp-reauthorization-required` (the person's connection is missing or ended), or
+ * `assistant-mcp-initiator-only` (the run acted for someone other than the person who asked). The
+ * person whose consent or connection is missing is told once a day.
+ */
+interface AgentRunMcpSkip {
+    serverId: string;
+    /** The server's name when the run left it out. */
+    serverDisplayName: string;
+    code: string;
+}
+/** One run in a run history: its agent, subject, trigger, status, usage, times and result preview. */
+interface AgentRunHistoryItem {
+    id: string;
+    conversationId: string;
+    agentId: string;
+    /**
+     * The agent's name: a translation key for an agent in code, the text itself for one created in the
+     * administration; `null` for an agent that no longer exists.
+     */
+    agentDisplayNameKey?: string | null;
+    subjectType: string;
+    subjectId: string;
+    subjectDisplayName: string | null;
+    subjectTypeName?: string | null;
+    subjectLink?: string | null;
+    triggerId: string;
+    status: AgentRunStatus;
+    failureClass: string | null;
+    failureCode: string | null;
+    kind: AgentRunKind;
+    skill: string | null;
+    initiatorActorId: string | null;
+    toolCalls: number;
+    modelCalls: number;
+    inputTokens: number;
+    outputTokens: number;
+    proposalCount: number;
+    /**
+     * The first `NH_ASSISTANT_RESULT_PREVIEW_LENGTH` characters of the run's answer, model output to
+     * show as text; for a run without a stored answer, the summary it ended with.
+     */
+    result: string | null;
+    /** The answer is longer than `result`. */
+    resultTruncated: boolean;
+    /** The run worked in the agent's shadow thread: nothing it proposed executes. */
+    shadow: boolean;
+    createdAt: string;
+    startedAt: string | null;
+    endedAt: string | null;
+    /** The personal MCP servers the run left out; missing on older servers. */
+    mcpConnectionSkips?: AgentRunMcpSkip[];
+}
+/**
+ * A page of a run history, newest first (`getRunHistory` for people, the administration's
+ * `getAgentRuns` for every run of an agent).
+ */
+interface AgentRunHistory {
+    items: AgentRunHistoryItem[];
+    /** The runs that match the filter and that the caller may see. */
+    total: number;
+    /**
+     * People's history considered only the agent threads with the most recent matching runs; a
+     * narrower filter, such as one object or a period, reaches older ones.
+     */
+    limited: boolean;
+}
+/** One run with its whole result, its proposals and its files (`getRunResult`). */
+interface AgentRunResult {
+    run: AgentRunHistoryItem;
+    /**
+     * The run's whole answer as Markdown, at most `NH_ASSISTANT_RUN_RESULT_MAX_LENGTH` characters:
+     * model output, untrusted. Render it only with the assistant's safe Markdown rendering
+     * (`nh-assistant-run-result` does), never as HTML. `null` while the run has none.
+     */
+    result: string | null;
+    /** The answer was longer and `result` is its beginning. */
+    resultTruncated: boolean;
+    /** The bounded summary the run ended with, which the agent's next runs start from. */
+    summary: string | null;
+    /** The proposals the caller may see: in the run's own thread and placed at objects the caller reads. */
+    proposals: AgentProposal[];
+    /** The proposals the run placed at objects the caller may not read. */
+    hiddenProposals: number;
+    /** The files the run saved; `restricted` ones cannot be downloaded by the caller. */
+    artifacts: AgentArtifact[];
+    /** Whether the caller may open the run's thread conversation. */
+    canOpenConversation: boolean;
+}
 interface StartAgentRequest {
     agentId: string;
     subjectType: string;
     subjectId: string;
     message?: string | null;
 }
+/**
+ * What became of a start by hand (`POST threads/start`, `POST runs/{id}/retry` with `restart`):
+ * `started`, `queued`, `coalesced` with a run about to start, `superseded` the current run,
+ * `ignored` or `deduplicated`; `waiting` while the agent or its skill is paused (`reasonCode`
+ * `assistant-agent-paused` or `assistant-skill-paused`), so the run starts when it resumes; and
+ * `deferred` until the application's transaction commits, without a run or thread yet. A refused
+ * start is an HTTP error with its code, never a receipt.
+ */
+type AgentTriggerOutcome = 'started' | 'queued' | 'coalesced' | 'superseded' | 'ignored' | 'deduplicated' | 'waiting' | 'deferred';
 interface AgentTriggerReceipt {
     triggerId: string;
-    outcome: 'started' | 'queued' | 'coalesced' | 'superseded' | 'ignored' | 'deduplicated' | 'rejected';
+    outcome: AgentTriggerOutcome;
     runId: string | null;
     conversationId: string | null;
+    /** Why the run did not start yet, such as `assistant-agent-paused` with `waiting`; `null` otherwise. */
     reasonCode: string | null;
 }
 interface AgentProposal {
@@ -175,6 +404,16 @@ interface AgentProposal {
     subjectType: string;
     subjectId: string;
     subjectDisplayName: string | null;
+    /**
+     * The name of the subject type in the caller's language, such as "Project", when the application
+     * named the type; `null` or missing otherwise.
+     */
+    subjectTypeName?: string | null;
+    /**
+     * Where the application shows the subject, from the type's link template; `null` or missing
+     * without one. `provideNhAssistant({ subjectLinks })` may replace it with a router link.
+     */
+    subjectLink?: string | null;
     toolId: string;
     summary: string;
     /**
@@ -244,6 +483,29 @@ interface AgentProposal {
      * Missing on older servers.
      */
     rationale?: string | null;
+    /**
+     * The run that placed this proposal here from another subject, such as a run for the whole
+     * application; `null` for a proposal made in this thread. Missing on older servers.
+     */
+    placedBy?: AgentProposalOrigin | null;
+}
+/**
+ * The run that placed a proposal at another object than its own, and the thread it ran in. Its subject
+ * is named only for the whole application (`subjectType` `nh-system`); for another object only its kind
+ * is known, because a reader of this object may not read that one.
+ */
+interface AgentProposalOrigin {
+    /** The thread of the run that placed the proposal; opening it checks the reader's access. */
+    conversationId: string;
+    runId: string | null;
+    /** The run's subject type; `null` when its thread no longer exists. */
+    subjectType: string | null;
+    /** The run's subject id for the whole application (`global` or `division-…`); `null` otherwise. */
+    subjectId?: string | null;
+    /** The name of the whole application or its division in the caller's language; `null` otherwise. */
+    subjectDisplayName?: string | null;
+    /** The name of the run's subject type in the caller's language, when the application named it. */
+    subjectTypeName?: string | null;
 }
 /** An application object a proposal changes, such as `{ type: 'project-task', id: '4711' }`. */
 interface AgentProposalObject {
@@ -351,6 +613,89 @@ interface AgentArtifact {
 type AgentRunRetryMode = 'resume' | 'restart';
 /** `re-execute` runs the proposal again; `mark-resolved` confirms its outcome without running it. */
 type AgentExecutionResolution = 're-execute' | 'mark-resolved';
+/** A board of a group of agents the caller may open (`getBoards`). */
+interface AgentBoardSummary {
+    /** The group id, such as `project-management`. */
+    id: string;
+    /** The group's name in the request's language. */
+    name: string;
+    /** What the group's agents do, when the application described it. */
+    description: string | null;
+    /** How many of the group's agents the caller sees on its board. */
+    agentCount: number;
+}
+/** The boards the caller may open, ordered by name. */
+interface AgentBoardList {
+    items: AgentBoardSummary[];
+}
+/** A kind of object as a board names it. */
+interface AgentBoardSubjectType {
+    id: string;
+    /** The name of one object in the request's language; the id without a name. */
+    name: string;
+    /** The name of several objects, when the application gave one. */
+    pluralName: string | null;
+}
+/** What an agent on a board works on. */
+interface AgentBoardWorksOn {
+    /** Every kind of object. */
+    allObjects: boolean;
+    /** The whole application. */
+    application: boolean;
+    /** Per division instead of app-wide. */
+    perDivision: boolean;
+    /** The kinds of objects it names, by id. */
+    subjectTypes: AgentBoardSubjectType[];
+}
+/** One agent on a board. */
+interface AgentBoardAgent {
+    agentId: string;
+    /** A translation key for an agent in code, the text itself for one created in the administration. */
+    displayNameKey: string;
+    descriptionKey: string;
+    worksOn: AgentBoardWorksOn;
+    /**
+     * `nh-system` when the agent works on the whole application in the board's scope; `null` for an
+     * agent without such work there, which the board shows without a result or a start.
+     */
+    subjectType: string | null;
+    /** `global` for an app-wide agent, `division-…` for a per-division agent on a division's board. */
+    subjectId: string | null;
+    /** The name of that subject in the request's language. */
+    subjectDisplayName: string | null;
+    /** Whether the caller may run the agent for that subject now. */
+    canStart: boolean;
+    /** The agent's thread of that subject, when the caller may open it. */
+    conversationId: string | null;
+    /** The agent's newest run for that subject; `null` before its first. */
+    latestRun: AgentLatestRun | null;
+    /** The open proposals of that thread. */
+    openProposals: number;
+    /**
+     * Whether the latest run ended, or a proposal was made, after the caller's last visit of the board
+     * in this scope; before the first visit everything shown is new.
+     */
+    isNew: boolean;
+}
+/** The board of one group in one scope (`getBoard`). */
+interface AgentBoard {
+    id: string;
+    name: string;
+    description: string | null;
+    /** `global`, or `division:{id}` for the board of one division. */
+    scopeKey: string;
+    divisionId: string | null;
+    /** When the caller last looked at this board in this scope, before this read; `null` before the first visit. */
+    lastVisitedAt: string | null;
+    /** The group's agents the caller sees, ordered by id. */
+    agents: AgentBoardAgent[];
+}
+/** A recorded visit of a board (`visitBoard`). */
+interface AgentBoardVisit {
+    groupId: string;
+    scopeKey: string;
+    visitedAt: string;
+}
 
 interface AssistantStatus {
     enabled: boolean;
@@ -433,6 +778,10 @@ interface ConversationThread {
     role: AgentSubjectRole;
     /** Each open proposal of the thread and whether the caller may decide it now, oldest first. */
     decisions: ConversationThreadDecision[];
+    /** The name of the subject type in the caller's language, when the application named it. */
+    subjectTypeName?: string | null;
+    /** Where the application shows the subject, when the type has a link template. */
+    subjectLink?: string | null;
 }
 /**
  * The caller's right to decide one open proposal of an agent thread, checked like the decision
@@ -478,7 +827,23 @@ interface Message {
  * `rule` for an assistant message the agent's rules wrote without a model.
  */
 type MessageAuthorKind = 'person' | 'trigger' | 'rule';
-type MessagePart = TextPart | ToolCallPart | ApprovalPart;
+type MessagePart = TextPart | ToolCallPart | ApprovalPart | ConnectionRequiredPart;
+/**
+ * Why a turn asks the person to connect an MCP server: never connected, the connection ended, or
+ * the server asked for permissions the connection lacks.
+ */
+type ConnectionRequiredReason = 'not-connected' | 'reauthorization-required' | 'insufficient-scope';
+/**
+ * An MCP server, which each person connects to with their own account, that the person who asked had
+ * to connect before the agent could use it. The turn went on without its tools; the card connects
+ * the viewer's own account.
+ */
+interface ConnectionRequiredPart {
+    type: 'connection-required';
+    serverId: string;
+    displayName: string;
+    reason: ConnectionRequiredReason;
+}
 interface TextPart {
     type: 'text';
     text: string;
@@ -504,7 +869,7 @@ interface ToolCallPart {
      * `delegated`, `agent` or `delegated-read` when an agent used rights beyond the caller's own:
      * the initiator's, its own grant, or a person's through a gateway read.
      */
-    grantSource?: 'delegated' | 'agent' | 'delegated-read' | null;
+    grantSource?: 'delegated' | 'agent' | 'delegated-read' | 'accountable' | null;
     /** The result came from rights this viewer does not have and is shielded from them. */
     restricted?: boolean;
 }
@@ -650,6 +1015,12 @@ interface ToolCompletedEvent {
     resultPreview: string | null;
 }
 type ApprovalRequiredEvent = ApprovalPart;
+/** The person who asked has to connect an MCP server before the agent can use it. */
+interface ConnectionRequiredEvent {
+    serverId: string;
+    displayName: string;
+    reason: ConnectionRequiredReason;
+}
 type TurnCompletionStatus = 'completed' | 'waiting-for-approval' | 'cancelled' | 'failed';
 interface TurnUsage {
     inputTokens: number;
@@ -673,6 +1044,7 @@ interface NhAssistantSseEventMap {
     'tool.started': ToolStartedEvent;
     'tool.completed': ToolCompletedEvent;
     'approval.required': ApprovalRequiredEvent;
+    'connection.required': ConnectionRequiredEvent;
     'turn.completed': TurnCompletedEvent;
     'error': AssistantErrorEvent;
 }
@@ -702,6 +1074,10 @@ declare const NhAssistantClientErrorCodes: {
     readonly server: "assistant-server";
     /** The open conversation was deleted by its owner, or the user left or was removed. */
     readonly conversationRemoved: "assistant-conversation-removed";
+    /** The person closed the authorization window of an MCP connection before it finished. */
+    readonly mcpAuthorizationCancelled: "assistant-mcp-authorization-cancelled";
+    /** The browser blocked the authorization window of an MCP connection. */
+    readonly mcpPopupBlocked: "assistant-mcp-popup-blocked";
 };
 type NhAssistantClientErrorCode = typeof NhAssistantClientErrorCodes[keyof typeof NhAssistantClientErrorCodes];
 
@@ -741,6 +1117,14 @@ interface LiveAgentWorkChanged {
     subjectType: string;
     subjectId: string;
 }
+/**
+ * The hub's answer to `WatchAgentWork`: how many agents' work of the whole application the connection
+ * follows now, and when to renew the watch so the server checks the person's rights again.
+ */
+interface LiveAgentWorkWatch {
+    watched: number;
+    refreshAfterSeconds: number;
+}
 /**
  * `ConversationEvent`: one turn event with the same `type` and `data` as the server-sent events
  * of the starting request, or `message.created` with a `Message` when a participant's message
@@ -763,6 +1147,38 @@ interface AssistantPreferences {
     /** At most 1,000 characters. Steers style only; it never overrides the fixed rules. */
     customInstructions: string | null;
 }
+/**
+ * An MCP server that agents may use in background runs with the caller's own account once the
+ * caller allows it (`GET mcp-connections`). The consent holds for the server as it is configured
+ * now; a changed address or authentication shows it as not allowed again.
+ */
+interface McpConnection {
+    serverId: string;
+    displayName: string;
+    /** The server's host name, for example `planning.example.org`. */
+    host: string;
+    allowBackgroundUse: boolean;
+    /** When the caller allowed it; `null` while not allowed. */
+    consentedAt: string | null;
+    /** The agents the caller may use that have the server. */
+    agentIds: string[];
+    /**
+     * For a server each person connects to with OAuth: the caller's connection; `null` for a server
+     * that forwards the caller's sign-in.
+     */
+    connectionStatus: McpConnectionStatus | null;
+    /** The scopes the caller's connection grants. */
+    grantedScopes: string | null;
+    /** Scopes the server asked for that the connection lacks; connecting again adds them. */
+    requiredScopes: string | null;
+    connectedAt: string | null;
+    /** Whether background use is offered for the server at all. */
+    offersBackgroundUse: boolean;
+}
+/** Body of `PUT mcp-connections/{serverId}`. */
+interface UpdateMcpConnectionRequest {
+    allowBackgroundUse: boolean;
+}
 interface ApplicationContext {
     text: string;
     version: number;
@@ -787,6 +1203,12 @@ interface ToolCatalogEntry {
     source: 'local' | 'bridge' | 'mcp';
     effect: ToolCatalogEffect;
     description: string;
+    /**
+     * The object type a call of the tool names (`[NhAiSubject]`): a run places its proposal for another
+     * object at that object. `null` when the tool declares none, as MCP tools never do; their proposals
+     * stay in the run's own thread. Missing on older servers.
+     */
+    subjectType?: string | null;
 }
 /** Equals `NhAiAutonomyLevel`. */
 type AssistantAutonomy = 'observe' | 'explain' | 'propose' | 'simulate' | 'execute';
@@ -804,6 +1226,32 @@ interface AdminAgentInput {
      * resume an agent with `setAgentState`. A new agent starts active.
      */
     isEnabled?: boolean;
+    /**
+     * Whether people can choose an agent created in the administration in the chat. Omitted keeps it on
+     * update; a new agent is offered. An agent that is not offered keeps working on its triggers.
+     */
+    offeredInChat?: boolean;
+    /**
+     * The object types an agent created in the administration works on, from the run catalog's
+     * `subjectTypes`, at most 20. What an agent works on is sent together: omitting all of
+     * `worksOnSubjectTypes`, `worksOnAllSubjects`, `worksOnApplication`, `perDivision`, `runPolicy`
+     * and `viewPolicy` keeps it on update and lets a new agent work on all object types. Agents in
+     * code take it from their code.
+     */
+    worksOnSubjectTypes?: string[];
+    /** The agent works on every object type; not next to `worksOnSubjectTypes`. */
+    worksOnAllSubjects?: boolean;
+    /** The agent works on the whole application. */
+    worksOnApplication?: boolean;
+    /**
+     * The agent works per division; only when the run catalog reports `divisions`. Its work for the
+     * whole application, such as a schedule without a subject set, then runs once per listed division.
+     */
+    perDivision?: boolean;
+    /** Who may run the agent for the whole application, from the run catalog's `agentPolicies`; `null`: the administration policy. */
+    runPolicy?: string | null;
+    /** Who sees its results for the whole application, from the run catalog's `agentPolicies`; `null`: the agent's required policy. */
+    viewPolicy?: string | null;
 }
 /** Body of `PUT admin/agents/{id}`. */
 type UpdateAdminAgentRequest = AdminAgentInput & {
@@ -837,6 +1285,37 @@ interface AdminAgent extends AdminAgentInput {
     shadow?: AgentShadowState | null;
     /** The technical account that answers for the agent's new runs; null when it answers to none. */
     serviceAccount?: AgentServiceAccountState | null;
+    /**
+     * Whether people can choose the agent in the chat; missing means offered. Agents in code decide
+     * it with `HideFromChat()`.
+     */
+    offeredInChat?: boolean;
+    /**
+     * Whether the agent says what it works on: always for an agent created here, for an agent in code
+     * only with `WorksOn`, `WorksOnAllObjects` or `WorksOnApplication`. An agent that does not say
+     * works on all object types; missing on older servers.
+     */
+    worksOnDeclared?: boolean;
+    /**
+     * The object types the agent is known to work on, as a hint next to "All objects": those it
+     * accepts hand-offs and consultations about, those its triggers name and those of its threads.
+     */
+    knownSubjectTypes?: string[];
+    /**
+     * The groups of agents the agent is in now, by id: an administrator's choice per group, otherwise
+     * its `InGroup` in code; missing on older servers. Change them with `setAgentGroups`.
+     */
+    groups?: string[];
+    /** The groups the agent joins in code, by id; empty for an agent created here. */
+    codeGroups?: string[];
+}
+/** The groups one agent is in, as `setAgentGroups` answers. */
+interface AdminAgentGroups {
+    agentId: string;
+    /** The groups the agent is in now, by id. */
+    groups: string[];
+    /** The groups it joins in code, by id. */
+    codeGroups: string[];
 }
 /** The shadow modes an administrator chooses; `code` lets the mode in code decide again. */
 type AgentShadowMode = 'shadow' | 'live' | 'code';
@@ -927,7 +1406,136 @@ interface SetAgentStateRequest {
     /** Optional, at most 500 characters. */
     reason?: string | null;
 }
-type McpAuthMode = 'none' | 'bearer' | 'api-key' | 'forward-user-token';
+/**
+ * The built-in authentication modes. `oauth` connects with the authorization code flow: once for the
+ * organization or once per person (`McpConnectionScope`). `oauth-client-credentials` connects the
+ * organization with the host's own client credentials.
+ */
+type McpBuiltInAuthMode = 'none' | 'bearer' | 'api-key' | 'basic' | 'forward-user-token' | 'oauth' | 'oauth-client-credentials';
+/**
+ * The authentication mode of a server: a built-in mode, or a mode the application registered in code
+ * (`AddMcpCredentialProvider`), which `NhAssistantAdminApiService.getMcpAuthModes` lists.
+ */
+type McpAuthMode = McpBuiltInAuthMode | (string & {});
+/**
+ * An authentication mode the application registered in code. Its provider supplies the credential, so
+ * a server of the mode takes no secret, user name or OAuth settings in the editor. `organization`: one
+ * credential every caller shares, which may serve background runs (`headlessUse: organization`);
+ * `person`: each person's own credential, which serves only that person's background runs with their
+ * consent (`headlessUse: personal`).
+ */
+interface McpCustomAuthMode {
+    mode: string;
+    ownership: 'organization' | 'person';
+}
+/** For `oauth`: one connection for everyone (`organization`), or each person connects (`user`). */
+type McpConnectionScope = 'organization' | 'user';
+/** The state of an OAuth connection; it never carries tokens. */
+type McpConnectionStatus = 'not-connected' | 'active' | 'reauthorization-required' | 'issuer-changed';
+/**
+ * OAuth settings of a server. Omitted or `null` values keep the stored value, `""` clears it.
+ * `clientSecret` is write-only. `confirmAuthorization` runs discovery again and pins the
+ * authorization server and resource it finds; a new OAuth server and a changed address need it.
+ */
+interface McpOAuthInput {
+    clientId?: string | null;
+    clientSecret?: string | null;
+    clientSecretReference?: string | null;
+    /** Space-separated scopes the host may request; empty leaves the choice to the authorization server. */
+    scopes?: string | null;
+    /** Which account the organization connects, shown to everyone using it; required for an organization `oauth` server. */
+    organizationAccountLabel?: string | null;
+    confirmAuthorization?: boolean;
+}
+/** The OAuth settings of a server as returned: never the client secret. */
+interface McpOAuthSettings {
+    clientId: string | null;
+    hasClientSecret: boolean;
+    clientSecretReference: string | null;
+    scopes: string | null;
+    organizationAccountLabel: string | null;
+}
+/** The authorization server and resource an administrator confirmed. */
+interface McpAuthorization {
+    issuer: string;
+    resource: string;
+    confirmedAt: string;
+    confirmedBy: string | null;
+}
+/** The organization's OAuth connection of a server, without tokens. */
+interface McpOrganizationConnection {
+    status: McpConnectionStatus;
+    connectedAt: string | null;
+    connectedBy: string | null;
+    grantedScopes: string | null;
+    requiredScopes: string | null;
+    accessTokenExpiresAt: string | null;
+    lastFailureCode: string | null;
+}
+/** Body of `POST admin/mcp-servers/discover`. */
+interface McpDiscoverRequest {
+    url: string;
+}
+/** What discovery found for a server address; nothing is stored until the server is saved with `confirmAuthorization`. */
+interface McpDiscovery {
+    resource: string;
+    issuer: string;
+    authorizationServers: string[];
+    challengedScopes: string[];
+    scopesSupported: string[];
+    grantTypesSupported: string[];
+    pkceSupported: boolean;
+    clientIdMetadataDocumentSupported: boolean;
+    dynamicRegistrationSupported: boolean;
+    tokenEndpointAuthMethods: string[];
+}
+/**
+ * Body of an authorize request. `returnUrl` chooses redirect mode: the callback returns there with
+ * the flow and completion code in the fragment; its origin must be allowed by the host.
+ */
+interface McpAuthorizeRequest {
+    returnUrl?: string | null;
+    /** For a personal connection: the consent to background use, recorded with the connection. */
+    allowBackgroundUse?: boolean | null;
+}
+/** The flow and the URL the owner's browser opens; it expires at `expiresAt`. */
+interface McpAuthorizationStart {
+    flowId: string;
+    authorizationUrl: string;
+    expiresAt: string;
+    /** The origin of the assistant's callback page: the only origin whose message is accepted. */
+    callbackOrigin: string;
+}
+/** Body of `POST mcp-connections/complete`. */
+interface McpCompleteRequest {
+    flowId: string;
+    completionCode: string;
+}
+/** The connection a completed authorization activated. */
+interface McpCompletion {
+    serverId: string;
+    ownerKind: 'organization' | 'user';
+    status: McpConnectionStatus;
+    grantedScopes: string | null;
+}
+/** The personal connections of a server per status. */
+interface McpConnectionsSummary {
+    active: number;
+    reauthorizationRequired: number;
+    issuerChanged: number;
+}
+/**
+ * Whether a server's tools are offered in background runs. `organization` is only valid for
+ * `none`, `bearer`, `api-key` and `basic`; the agent then also needs a grant in code
+ * (`mcp.<server>.*`). `personal` is only valid for `forward-user-token`: the run then sends a
+ * short-lived token of the person it acts for, once that person allowed it (`McpConnection`).
+ */
+type McpHeadlessUse = 'never' | 'organization' | 'personal';
+/**
+ * `streamable-http`, or `auto` to fall back to the deprecated HTTP+SSE transport for servers
+ * that do not offer Streamable HTTP yet.
+ */
+type McpTransport = 'streamable-http' | 'auto';
 interface McpServerInput {
     id: string;
     displayName: string;
@@ -938,6 +1546,23 @@ interface McpServerInput {
     secret?: string | null;
     requiredPolicy: string | null;
     isEnabled: boolean;
+    /** Omit to keep the stored value; a new server starts at `never`. */
+    headlessUse?: McpHeadlessUse;
+    /** The user name of `basic`; the password is `secret`. Omit to keep the stored value. */
+    userName?: string | null;
+    /**
+     * Where the secret is instead of storing it: `config:<name>` or a prefix the application
+     * registered. Omit to keep, `""` to clear; a new stored secret replaces it and vice versa.
+     */
+    secretReference?: string | null;
+    /** The name of a client certificate the host configured for mutual TLS. Omit to keep, `""` to clear. */
+    clientCertificateReference?: string | null;
+    /** Omit to keep the stored value; a new server starts at `streamable-http`. */
+    transport?: McpTransport;
+    /** For `oauth`; omit to keep the stored value. A new server starts at `organization`. */
+    connectionScope?: McpConnectionScope;
+    /** The OAuth settings of `oauth` and `oauth-client-credentials`; omit to keep them. */
+    oauth?: McpOAuthInput | null;
 }
 interface McpServer {
     id: string;
@@ -951,6 +1576,24 @@ interface McpServer {
     lastSyncAt: string | null;
     lastSyncStatus: 'ok' | 'failed' | null;
     assignedAgentIds: string[];
+    headlessUse: McpHeadlessUse;
+    /** When a test, a sync or a turn with the shared credential last connected. */
+    lastConnectAt: string | null;
+    /** The failure code of that connection; `null` when it succeeded or never ran. */
+    lastConnectCode: string | null;
+    /** The user name of `basic`; the password is never returned. */
+    userName: string | null;
+    /** The secret reference; it names where the secret is, it is not the secret. */
+    secretReference: string | null;
+    clientCertificateReference: string | null;
+    transport: McpTransport;
+    connectionScope: McpConnectionScope;
+    /** The OAuth settings; `null` for other modes. */
+    oauth: McpOAuthSettings | null;
+    /** The confirmed authorization server; `null` until an administrator confirmed it. */
+    authorization: McpAuthorization | null;
+    /** The organization's OAuth connection; `null` for servers without one. */
+    organizationConnection: McpOrganizationConnection | null;
 }
 interface McpServerTestResult {
     ok: boolean;
@@ -1213,6 +1856,386 @@ interface AgentFeedbackList {
     items: AgentFeedbackItem[];
     total: number;
 }
+/** A building block registered in code that run configuration as data names. */
+interface RunBlock {
+    name: string;
+    description: string;
+    /**
+     * For a trigger event that names its object type up front, that type: data triggers on it fit only
+     * agents that work on it. Missing or `null` when the type is known only when the event fires.
+     */
+    subjectType?: string | null;
+}
+/** Response of `GET admin/run-catalog`: what skills, triggers and run settings defined as data can name. */
+interface RunCatalog {
+    triggerEvents: RunBlock[];
+    subjectSets: RunBlock[];
+    ruleHandlers: RunBlock[];
+    approvalPolicies: string[];
+    /** Chat profiles with function calling and streaming. */
+    profiles: string[];
+    /** Per approval policy who decides, how long a proposal waits and how; missing on older servers. */
+    approvalPolicySummaries?: ApprovalPolicySummary[];
+    /** Whether `searchAccounts` can find accounts by name; otherwise an account is chosen by its id. */
+    accountSearch?: boolean;
+    /**
+     * The subject types the application registered, by id, with the platform's `nh-system` (the whole
+     * application, `isSystem`); missing on older servers. Choices of object types leave out `isSystem` types.
+     */
+    subjectTypes?: AgentSubjectType[];
+    /**
+     * The policies the application lists for the run and view policy of agents created here, by name;
+     * missing on older servers.
+     */
+    agentPolicies?: RunBlock[];
+    /** Whether the application lists its divisions, so an agent may work per division. */
+    divisions?: boolean;
+    /**
+     * The groups of agents the application registers in code, by id, with their names in the request's
+     * language: what an administrator may put an agent in; missing on older servers.
+     */
+    agentGroups?: AgentGroup[];
+}
+/** A group of agents the application registers in code, as people see it. */
+interface AgentGroup {
+    /** The dash-case group id, such as `project-management`. */
+    id: string;
+    /** The group's name in the request's language. */
+    name: string;
+    /** What the group's agents do, when the application described it. */
+    description: string | null;
+}
+/** A subject type as people see it, from the run catalog. */
+interface AgentSubjectType {
+    /** The dash-case type id, such as `project`. */
+    id: string;
+    /** The name of one subject in the request's language; the id when the application did not name the type. */
+    name: string;
+    /** The name of several subjects, when the application gave one. */
+    pluralName: string | null;
+    /** The short type name of the entity the type stands for, as the NewHeap log records `ObjectType`. */
+    entityType: string | null;
+    /** The full type name of that entity, as `ObjectTypeFull`. */
+    entityTypeFull: string | null;
+    /** The link template with `{id}`; `null` without one. */
+    link: string | null;
+    /** Whether `searchSubjects` finds subjects of this type by name; otherwise people give an id. */
+    searchable: boolean;
+    /**
+     * Whether the type belongs to the platform instead of the application, such as `nh-system`, the
+     * whole application; it is not offered as a kind of object.
+     */
+    isSystem: boolean;
+}
+/** Who may decide a proposal under an approval policy. */
+interface ApproverSummary {
+    /** `initiator`: the person who caused the run; `subject-role`: a role on the subject; `policy`: an authorization policy. */
+    kind: 'initiator' | 'subject-role' | 'policy' | string;
+    /** For `subject-role`: at least `reader`, `participant` or `approver`. */
+    role?: string | null;
+    /** For `subject-role`: the application's role name, when one is required. */
+    namedRole?: string | null;
+    /** For `policy`: the authorization policy. */
+    policy?: string | null;
+}
+/** What an approval policy means, so an administration can explain the choice. */
+interface ApprovalPolicySummary {
+    name: string;
+    approvers: ApproverSummary[];
+    /** How long a proposal waits for a decision. */
+    lifetimeMinutes: number;
+    /** The person who caused a proposal may not decide it. */
+    fourEyes: boolean;
+    /** `inline`: the run waits for the decision; `deferred`: people decide later. */
+    mode: 'inline' | 'deferred' | string;
+}
+/** An account an agent can answer to, from `GET admin/accounts`. */
+interface AssistantAccount {
+    actorId: string;
+    displayName: string;
+    /** The e-mail address, when the application knows it. */
+    detail: string | null;
+}
+/** Which part of the run configuration a problem concerns. */
+type RunConfigurationProblemKind = 'agent' | 'skill' | 'candidate' | 'trigger';
+/**
+ * Data that is out of effect because it no longer fits the code, for example after a deploy removed
+ * a profile, policy, rule handler, event or subject set it names.
+ */
+interface RunConfigurationProblem {
+    agentId: string;
+    kind: RunConfigurationProblemKind;
+    /** The agent, skill or trigger id. */
+    id: string;
+    /** Such as `unknown-event` or `tool-not-covered`. */
+    code: string;
+}
+/** Whom an agent answers to. */
+type AgentAccountability = 'agent' | 'subject-responsible' | 'service-account';
+/** Reads with rights beyond the thread's readers: shielded from them, or refused. */
+type AgentElevatedReads = 'restricted' | 'deny';
+/**
+ * The run settings of an agent created in the administration. Grants are never data: in headless
+ * runs the agent acts with the rights of the account it answers to, within its tool selectors.
+ */
+interface AgentRunSettings {
+    version: number;
+    accountability: AgentAccountability;
+    serviceAccountActorId: string | null;
+    delegateFromInitiator: boolean;
+    allowGatewayReads: boolean;
+    elevatedReads: AgentElevatedReads;
+    approvalPolicy: string | null;
+    retryCount: number;
+    dailyToolCalls: number | null;
+    dailyTokens: number | null;
+    maxConcurrentRuns: number;
+    maxRunsPerSubjectPerDay: number;
+    maxTokensPerRun: number | null;
+    triageProfile: string | null;
+    ruleHandler: string | null;
+    changedAt: string;
+    changedBy: string;
+    reason: string | null;
+    inEffect: boolean;
+    problem: string | null;
+}
+/** Body of `PUT admin/agents/{id}/run-settings`. */
+interface AgentRunSettingsRequest {
+    accountability: AgentAccountability;
+    /** For `service-account` only: an account that exists and may sign in. */
+    serviceAccountActorId?: string | null;
+    delegateFromInitiator?: boolean;
+    /** Not for an agent that answers to itself. */
+    allowGatewayReads?: boolean;
+    elevatedReads?: AgentElevatedReads;
+    approvalPolicy?: string | null;
+    /** 0 to 10; 3 by default. */
+    retryCount?: number | null;
+    /** With `dailyTokens`, the daily budget per scope. */
+    dailyToolCalls?: number | null;
+    dailyTokens?: number | null;
+    /** 1 to 100; 4 by default. */
+    maxConcurrentRuns?: number | null;
+    /** 1 to 1,000; 10 by default. */
+    maxRunsPerSubjectPerDay?: number | null;
+    maxTokensPerRun?: number | null;
+    triageProfile?: string | null;
+    ruleHandler?: string | null;
+    /** The settings' current version; `null` for new settings. */
+    expectedVersion?: number | null;
+    /** Optional, at most 500 characters. */
+    reason?: string | null;
+}
+/** A skill the agent declares in code; it cannot change here. */
+interface CodeSkill {
+    skillId: string;
+    description: string;
+}
+/** A trigger registered in code; it cannot change here. */
+interface CodeTrigger {
+    triggerId: string;
+    source: 'event' | 'schedule' | 'webhook';
+    skillId: string | null;
+    /**
+     * The subject type the trigger names up front: an object type, or `nh-system` for a schedule that
+     * runs for the whole application (once per division for an agent that works per division). `null`
+     * when the type is known only when it fires; missing on older servers.
+     */
+    subjectType?: string | null;
+}
+/**
+ * How an agent in code runs, as its code says; it changes only in code. The technical account, which
+ * an administrator may replace, is the agent's `serviceAccount`.
+ */
+interface CodeRunSettings {
+    /** Whose rights its runs use. */
+    accountability: AgentAccountability;
+    /** Its runs also use what the person who started them may use. */
+    delegateFromInitiator: boolean;
+    /** The agent's approval policy; `null` for the platform's default. */
+    approvalPolicy: string | null;
+    /** It works by a rule handler in code instead of the model. */
+    usesRules: boolean;
+}
+/** One version of a skill defined as data. */
+interface DataSkill {
+    skillId: string;
+    version: number;
+    description: string;
+    instructions: string | null;
+    instructionsHash: string | null;
+    tools: string[];
+    profile: string | null;
+    ruleHandler: string | null;
+    maxTokensPerRun: number | null;
+    dailyToolCalls: number | null;
+    dailyTokens: number | null;
+    approvalPolicy: string | null;
+    changedAt: string;
+    changedBy: string;
+    reason: string | null;
+    /** `false` with `problem` when the version no longer fits the code. */
+    inEffect: boolean;
+    problem: string | null;
+    /** The candidate that runs in shadow next to this live version; missing or null without one. */
+    candidate?: DataSkill | null;
+}
+/** How a change of a skill takes effect: at once, or as a candidate in shadow next to the live version. */
+type SkillApplyMode = 'live' | 'shadow';
+/** Body of `PUT admin/agents/{id}/skills/{skillId}`. */
+interface DataSkillRequest {
+    /** At most 300 characters; triage and `use_skill` choose by it. */
+    description: string;
+    /** At most 20,000 characters. */
+    instructions?: string | null;
+    /** Within the agent's own tool selectors; empty uses the agent's. */
+    tools?: string[];
+    profile?: string | null;
+    ruleHandler?: string | null;
+    maxTokensPerRun?: number | null;
+    dailyToolCalls?: number | null;
+    dailyTokens?: number | null;
+    approvalPolicy?: string | null;
+    /** The live version the change was made on; `null` for a new skill. */
+    expectedVersion?: number | null;
+    reason?: string | null;
+    /** For a change of a skill; `live` by default. */
+    apply?: SkillApplyMode;
+}
+type DataSkillVersionStatus = 'live' | 'candidate' | 'superseded' | 'discarded';
+/** One version in the history of a skill defined as data. */
+interface DataSkillVersion {
+    version: number;
+    status: DataSkillVersionStatus;
+    description: string;
+    instructionsHash: string | null;
+    createdAt: string;
+    createdBy: string;
+    reason: string | null;
+}
+/** Body of `POST admin/agents/{id}/skills/{skillId}/candidate/promote` and `.../discard`. */
+interface SkillCandidateRequest {
+    /** The candidate version the change is for. */
+    version: number;
+    reason?: string | null;
+}
+/** The runs of one version in a comparison. */
+interface SkillVersionStats {
+    version: number;
+    runs: number;
+    completed: number;
+    failed: number;
+    proposals: number;
+    toolCalls: number;
+    tokens: number;
+}
+/** The proposals of both versions for one tool. */
+interface SkillComparisonTool {
+    toolId: string;
+    liveProposals: number;
+    candidateProposals: number;
+    liveApproved: number;
+    liveRejected: number;
+}
+/** Response of `GET admin/agents/{id}/skills/{skillId}/candidate/comparison`. Counts only. */
+interface SkillComparison {
+    agentId: string;
+    skillId: string;
+    from: string;
+    to: string;
+    live: SkillVersionStats;
+    candidate: SkillVersionStats;
+    /** The events both versions handled. */
+    pairedEvents: number;
+    tools: SkillComparisonTool[];
+}
+/** Optional period of a comparison; it starts when the candidate was saved by default. */
+interface SkillComparisonFilter {
+    from?: string;
+    to?: string;
+}
+/** What happens to an event while a run on the subject is active. */
+type TriggerConflict = 'coalesce' | 'queue' | 'supersede' | 'ignore';
+/** A trigger defined as data: a named event or a schedule that starts the agent. */
+interface DataTrigger {
+    triggerId: string;
+    skillId: string | null;
+    source: 'event' | 'schedule';
+    event: string | null;
+    cron: string | null;
+    timeZone: string | null;
+    /**
+     * The subject set a schedule runs for; `null` for an event, and for a schedule that runs for the
+     * whole application (once per division for an agent that works per division).
+     */
+    subjectSet: string | null;
+    message: string | null;
+    conflict: TriggerConflict;
+    debounceSeconds: number;
+    /** In shadow its runs work in the agent's shadow threads. A new trigger starts in shadow. */
+    shadow: boolean;
+    version: number;
+    changedAt: string;
+    changedBy: string;
+    reason: string | null;
+    inEffect: boolean;
+    problem: string | null;
+}
+/** Body of `PUT admin/agents/{id}/triggers/{triggerId}`. */
+interface DataTriggerRequest {
+    source: 'event' | 'schedule';
+    /** The skill the runs work in; empty lets the agent's rules or triage choose. */
+    skill?: string | null;
+    /** For an event trigger: a registered trigger event. */
+    event?: string | null;
+    /** For a schedule: a five- or six-field cron expression. */
+    cron?: string | null;
+    /** For a schedule: an IANA or Windows time zone; UTC by default. */
+    timeZone?: string | null;
+    /**
+     * For a schedule: a registered subject set. Without one the schedule runs for the whole
+     * application, which only an agent that works on it may do (`subjectSet: required` otherwise).
+     */
+    subjectSet?: string | null;
+    /** For a schedule: what every run receives, at most 2,000 characters. */
+    message?: string | null;
+    conflict?: TriggerConflict | null;
+    /** For an event trigger: at most 3,600; 120 by default. */
+    debounceSeconds?: number | null;
+    /** The trigger's current version; `null` for a new trigger. */
+    expectedVersion?: number | null;
+    reason?: string | null;
+}
+/** Body of `POST admin/agents/{id}/triggers/{triggerId}/shadow`. */
+interface DataTriggerShadowRequest {
+    mode: 'shadow' | 'live';
+    reason?: string | null;
+}
+/** Query of the removals of run settings, data skills and data triggers. */
+interface RunConfigurationRemoval {
+    expectedVersion?: number | null;
+    reason?: string | null;
+}
+/**
+ * Response of `GET admin/agents/{id}/configuration`: the agent's run settings, skills and triggers,
+ * in code and as data, and the data that no longer fits the code.
+ */
+interface AgentRunConfiguration {
+    agentId: string;
+    /** The agent's own tool selectors; a data skill's tools stay within them. */
+    toolSelectors: string[];
+    codeSkills: CodeSkill[];
+    dataSkills: DataSkill[];
+    codeTriggers: CodeTrigger[];
+    dataTriggers: DataTrigger[];
+    problems: RunConfigurationProblem[];
+    source: 'code' | 'admin';
+    /** The run settings of an agent created in the administration; `null` for an agent in code and one that only chats. */
+    runSettings: AgentRunSettings | null;
+    /** How an agent in code runs, as its code says; `null` for an agent created here, missing on older servers. */
+    codeRunSettings?: CodeRunSettings | null;
+}
 
 /** Decides whether the current user may see and use the assistant. */
 interface NhAssistantAccessPolicy {
@@ -1300,7 +2323,35 @@ interface NhAssistantConfig {
      * `#nh-assistant-join=<conversationId>.<token>`; the panel joins when the page opens with it.
      */
     buildShareLink?: (conversationId: string, token: string) => string;
+    /**
+     * Replaces the server's links to subjects, which come from the link template of the subject type
+     * (`AddSubjectType(...).OpenAt("/projects/{id}")`), with the host's own routes, per subject type:
+     * for example `{ project: subject => ['/projects', subject.id] }`. Return router commands or a URL
+     * within the application, `null` to show no link, or `undefined` to keep the server's link.
+     * Runs in the assistant's injection context. Default: the server's links.
+     */
+    subjectLinks?: Record<string, NhAssistantSubjectLinkBuilder>;
+    /**
+     * How MCP authorizations open. `popup` (default) opens a window from the click and stays on the
+     * page. `redirect` sends the page to the authorization server and back to `mcpConnectReturnUrl`,
+     * where the assistant completes the connection; its origin must be in
+     * `NewHeap:AI:Assistant:Mcp:OAuth:ReturnOrigins`.
+     */
+    mcpConnectMode?: 'popup' | 'redirect';
+    /** The page a redirect-mode authorization returns to. Default: the current address without its fragment. */
+    mcpConnectReturnUrl?: () => string;
+}
+/** A subject an agent works on, by its type and id. */
+interface NhAssistantSubjectRef {
+    type: string;
+    id: string;
 }
+/**
+ * Builds the link to one subject in the host application: router commands such as
+ * `['/projects', subject.id]`, a URL such as `/projects/7`, `null` for no link, or `undefined` to keep
+ * the server's link.
+ */
+type NhAssistantSubjectLinkBuilder = (subject: NhAssistantSubjectRef) => readonly unknown[] | string | null | undefined;
 interface NhAssistantPushConfig {
     /** URL of the bundled worker, for example `/nh-assistant/nh-assistant-push-worker.js`. */
     serviceWorkerUrl: string;
@@ -1386,7 +2437,21 @@ declare class NhAssistantApiError extends Error {
     readonly status: number;
     readonly code: string;
     readonly messageKey: string;
-    constructor(status: number, code: string, messageKey: string);
+    /**
+     * The field errors of the error body, whatever its code (for example `assistant-validation` or
+     * `assistant-run-filter-invalid`): camelCase field names, dotted for nested settings such as
+     * `oauth.clientId`, with stable values such as `required`, `invalid`, `too-long` or `not-found`.
+     * Empty when the body names none.
+     */
+    readonly fieldErrors: Readonly<Record<string, readonly string[]>>;
+    constructor(status: number, code: string, messageKey: string, 
+    /**
+     * The field errors of the error body, whatever its code (for example `assistant-validation` or
+     * `assistant-run-filter-invalid`): camelCase field names, dotted for nested settings such as
+     * `oauth.clientId`, with stable values such as `required`, `invalid`, `too-long` or `not-found`.
+     * Empty when the body names none.
+     */
+    fieldErrors?: Readonly<Record<string, readonly string[]>>);
 }
 /** Translation key that belongs to a failure code. */
 declare function nhAssistantErrorMessageKey(code: string): string;
@@ -1438,6 +2503,19 @@ declare class NhAssistantApiService {
     getPreferences(): Observable<AssistantPreferences>;
     /** Replaces the caller's own assistant preferences and returns the stored values. */
     updatePreferences(preferences: AssistantPreferences): Observable<AssistantPreferences>;
+    /** MCP servers that agents may use in background runs with the caller's own account. */
+    getMcpConnections(): Observable<McpConnection[]>;
+    /** Allows or withdraws background use of an MCP server with the caller's own account. */
+    updateMcpConnection(serverId: string, request: UpdateMcpConnectionRequest): Observable<McpConnection>;
+    /**
+     * Starts the caller's authorization of a server each person connects to. Prefer
+     * `NhAssistantMcpConnectService.connect`, which opens and completes it.
+     */
+    authorizeMcpConnection(serverId: string, request?: McpAuthorizeRequest): Observable<McpAuthorizationStart>;
+    /** Removes the caller's own connection of a server and revokes its tokens. */
+    disconnectMcpConnection(serverId: string): Observable<void>;
+    /** Activates the connection of an authorization the caller started, with the callback's completion code. */
+    completeMcpAuthorization(request: McpCompleteRequest): Observable<McpCompletion>;
     private requestStream;
     private executeStream;
     private readStream;
@@ -1454,6 +2532,7 @@ declare class NhAssistantApiService {
  */
 declare class NhAssistantAdminApiService {
     private readonly transport;
+    private readonly api;
     getContext(): Observable<ApplicationContext>;
     /** Saves a new context version; fails with `assistant-version-conflict` when `expectedVersion` is stale. */
     updateContext(request: UpdateApplicationContextRequest): Observable<ApplicationContext>;
@@ -1488,9 +2567,20 @@ declare class NhAssistantAdminApiService {
      * account that does not exist or may not sign in.
      */
     setServiceAccount(agentId: string, request: SetAgentServiceAccountRequest): Observable<AgentState>;
+    /**
+     * Puts an agent, in code or created here, in exactly `groups` of the run catalog's `agentGroups`
+     * and out of the others. The choice wins over the agent's `InGroup` in code. Fails with a field error
+     * on `groups` for an unknown group and with `assistant-shadow-variant` for a shadow variant.
+     */
+    setAgentGroups(agentId: string, groups: readonly string[]): Observable<AdminAgentGroups>;
     /** Deletes an admin agent. Code agents cannot be deleted; stop them instead. */
     deleteAgent(agentId: string): Observable<void>;
     getMcpServers(): Observable<McpServer[]>;
+    /**
+     * The authentication modes the application registered in code (`GET admin/mcp-auth-modes`), which
+     * administrators choose next to the built-in modes.
+     */
+    getMcpAuthModes(): Observable<McpCustomAuthMode[]>;
     createMcpServer(input: McpServerInput): Observable<McpServer>;
     /** Omit `secret` to keep the stored secret; send `""` to clear it. */
     updateMcpServer(serverId: string, input: McpServerInput): Observable<McpServer>;
@@ -1499,6 +2589,30 @@ declare class NhAssistantAdminApiService {
     /** Reads the remote tool list. New tools start disabled; a changed input schema disables a tool. */
     syncMcpServer(serverId: string): Observable<McpTool[]>;
     getMcpTools(serverId: string): Observable<McpTool[]>;
+    /**
+     * Reads the protected resource metadata of a server address and its authorization server without
+     * storing anything. Save the server with `oauth.confirmAuthorization` to pin what was found.
+     */
+    discoverMcpServer(url: string): Observable<McpDiscovery>;
+    /** The organization's OAuth connection of a server, without tokens. */
+    getMcpOrganizationConnection(serverId: string): Observable<McpOrganizationConnection>;
+    /**
+     * Starts the administrator's authorization of the organization connection. Open
+     * `authorizationUrl` in the administrator's browser, then complete with `completeMcpAuthorization`.
+     */
+    authorizeMcpOrganizationConnection(serverId: string, request?: McpAuthorizeRequest): Observable<McpAuthorizationStart>;
+    /** Removes the organization connection and revokes its tokens. */
+    disconnectMcpOrganizationConnection(serverId: string): Observable<void>;
+    /** The personal connections of a server per status. */
+    getMcpConnectionsSummary(serverId: string): Observable<McpConnectionsSummary>;
+    /** Revokes every person's connection of a server; each person connects again. */
+    revokeMcpConnections(serverId: string): Observable<void>;
+    /**
+     * Activates the connection of an authorization the caller started with the completion code the
+     * callback handed to the browser. An organization connection also needs the admin policy. The same
+     * call as `NhAssistantApiService.completeMcpAuthorization`, with the same failure codes.
+     */
+    completeMcpAuthorization(request: McpCompleteRequest): Observable<McpCompletion>;
     updateMcpTool(serverId: string, remoteName: string, request: UpdateMcpToolRequest): Observable<McpTool>;
     /**
      * The agent's proposals per tool and agent version in the period: decisions, the rejection rate,
@@ -1529,6 +2643,60 @@ declare class NhAssistantAdminApiService {
     startAgentReplay(variantId: string, request: AgentReplayRequest): Observable<AgentReplay>;
     /** The latest replays into a shadow variant, newest first. */
     getAgentReplays(variantId: string): Observable<AgentReplayList>;
+    /** The building blocks in code that run settings, skills and triggers defined as data can name. */
+    getRunCatalog(): Observable<RunCatalog>;
+    /**
+     * Accounts whose name or e-mail address contains `query` (2 to 100 characters), at most `limit`.
+     * Fails with `assistant-account-search-unavailable` when the application offers no search; the
+     * run catalog's `accountSearch` tells beforehand.
+     */
+    searchAccounts(query: string, limit?: number): Observable<AssistantAccount[]>;
+    /**
+     * The names the application knows for these account ids; unknown ids are left out. The server reads
+     * at most 50 ids per request, so more ids are asked for in parts of 50 and the answers merged in
+     * the order of the ids. Fails with `NhAssistantApiError` when any part fails.
+     */
+    getAccounts(actorIds: readonly string[]): Observable<AssistantAccount[]>;
+    /**
+     * The agent's run settings, skills and triggers, in code and as data, and the data that no longer
+     * fits the code. An agent in code without a run configuration answers `assistant-agent-not-found`.
+     */
+    getAgentConfiguration(agentId: string): Observable<AgentRunConfiguration>;
+    /**
+     * Adds or changes the run settings of an agent created in the administration. An agent in code
+     * fails with `assistant-run-settings-in-code`; an unknown technical account with
+     * `assistant-service-account-not-found`.
+     */
+    saveRunSettings(agentId: string, request: AgentRunSettingsRequest): Observable<AgentRunSettings>;
+    /**
+     * Every run of the agent, live and shadow, newest first, for its runs view. Read one run's whole
+     * result with `NhAssistantAgentRunApiService.getRunResult`. The server checks the filter first:
+     * `assistant-run-filter-invalid` with the refused parts in `fieldErrors`, then
+     * `assistant-agent-not-found` for an unknown agent.
+     */
+    getAgentRuns(agentId: string, filter?: Omit<AgentRunFilter, 'agentId'>): Observable<AgentRunHistory>;
+    /** Removes the run settings; while data skills or triggers belong to the agent, `assistant-run-settings-in-use`. */
+    removeRunSettings(agentId: string, removal?: RunConfigurationRemoval): Observable<void>;
+    /**
+     * Adds a skill defined as data, which starts in shadow, or stores its next version: with `apply`
+     * `live` at once, with `shadow` as the candidate that runs in shadow next to the live version.
+     */
+    saveDataSkill(agentId: string, skillId: string, request: DataSkillRequest): Observable<DataSkill>;
+    /** Takes a skill defined as data out of effect; while a data trigger names it, `assistant-skill-in-use`. */
+    removeDataSkill(agentId: string, skillId: string, removal?: RunConfigurationRemoval): Observable<void>;
+    /** Every version of a skill defined as data, newest first. */
+    getDataSkillVersions(agentId: string, skillId: string): Observable<DataSkillVersion[]>;
+    /** Makes the candidate the live version of its skill. */
+    promoteSkillCandidate(agentId: string, skillId: string, request: SkillCandidateRequest): Observable<DataSkill>;
+    /** Discards the candidate; it stays as history. */
+    discardSkillCandidate(agentId: string, skillId: string, request: SkillCandidateRequest): Observable<void>;
+    /** Compares the candidate with the live version on the runs they made in the period. */
+    compareSkillCandidate(agentId: string, skillId: string, filter?: SkillComparisonFilter): Observable<SkillComparison>;
+    /** Adds a trigger defined as data, which starts in shadow, or changes one in the mode it has. */
+    saveDataTrigger(agentId: string, triggerId: string, request: DataTriggerRequest): Observable<DataTrigger>;
+    removeDataTrigger(agentId: string, triggerId: string, removal?: RunConfigurationRemoval): Observable<void>;
+    /** Puts a trigger defined as data in shadow or live. */
+    setDataTriggerShadow(agentId: string, triggerId: string, request: DataTriggerShadowRequest): Observable<DataTrigger>;
     private download;
     private request;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantAdminApiService, never>;
@@ -1550,7 +2718,16 @@ declare class NhAssistantAgentRunApiService {
      * role; readers may open an existing one. Errors with `assistant-subject-access-denied` otherwise.
      */
     openThread(agentId: string, subjectType: string, subjectId: string): Observable<AgentThreadLookup>;
-    /** Starts the agent on the subject with the caller as initiator; needs the participant role. */
+    /**
+     * Runs the agent now on the subject with the caller as initiator. On an object it needs the
+     * participant role; on the whole application (`nh-system`) the agent's run policy, by default the
+     * administration policy. The receipt says what became of the start (`AgentTriggerOutcome`), for
+     * example `waiting` while the agent is paused. A refusal errors with `NhAssistantApiError`:
+     * `assistant-agent-does-not-work-on`, `assistant-agent-stopped`, `assistant-trigger-rate-limited`
+     * and the other conflicts (409), `assistant-subject-access-denied` or `assistant-agent-forbidden`
+     * (403), `assistant-agent-not-found` or `assistant-subject-not-found` (404),
+     * `assistant-subject-invalid` (400) and `assistant-trigger-rolled-back` (503).
+     */
     startAgent(request: StartAgentRequest): Observable<AgentTriggerReceipt>;
     /**
      * All agent work on one subject: the caller's role, every agent with a thread on it plus
@@ -1558,12 +2735,27 @@ declare class NhAssistantAgentRunApiService {
      * with `assistant-subject-not-found` when the caller has no role on the subject.
      */
     getSubjectWork(subjectType: string, subjectId: string, agentId?: string): Observable<AgentSubjectWork>;
+    /**
+     * The agents that work on the subject and that the caller may use, with whether the caller may run
+     * each now, its newest run with the beginning of its result and its open proposals. The subject is
+     * an object or the whole application (`nh-system`, `global` or `division-…`). Errors with
+     * `assistant-subject-not-found` when the caller has no role on the subject.
+     */
+    getObjectAgents(subjectType: string, subjectId: string): Observable<AgentObjectAgents>;
     /**
      * Counts the agent work on at most `NH_ASSISTANT_MAX_SUBJECT_SUMMARY` subjects of one type in one
      * request, for badges in a list; one item per id in request order. `NhAssistantSubjectSummaryService`
      * batches and caches these requests for many badges.
      */
     summarizeSubjects(subjectType: string, subjectIds: readonly string[]): Observable<AgentSubjectSummaryList>;
+    /**
+     * Finds subjects of one type by name, at most `limit` (default 20, at most 50), among those the
+     * caller may read; `query` has 2 to 100 characters. Errors with `assistant-subject-search-unavailable`
+     * for a type the application does not search (people then give the subject's id), with
+     * `assistant-subject-type-unknown` for an unknown type and with `assistant-validation` for a
+     * query of the wrong length.
+     */
+    searchSubjects(subjectType: string, query: string, limit?: number): Observable<AgentSubjectSearch>;
     getRuns(conversationId: string): Observable<AgentRunList>;
     /** Who consulted the thread's agent through another assistant, newest first. */
     getConsultations(conversationId: string, page?: number, itemsPerPage?: number): Observable<AgentConsultationList>;
@@ -1581,11 +2773,49 @@ declare class NhAssistantAgentRunApiService {
     lookupProposals(approvalIds: readonly string[]): Observable<AgentProposalLookup>;
     getMemory(conversationId: string): Observable<AgentThreadMemory>;
     getArtifacts(conversationId: string): Observable<AgentArtifact[]>;
-    /** Downloads one artifact version with the host's credentials. */
+    /**
+     * Downloads one artifact version with the host's credentials. Rejects with `NhAssistantApiError`,
+     * for example `assistant-artifact-not-found` or `assistant-network`.
+     */
     downloadArtifact(conversationId: string, artifactId: string): Promise<Blob>;
+    /**
+     * The agent runs the caller may see, newest first: runs on objects the caller reads and runs for
+     * the whole application whose agent's view policy the caller passes. Errors with
+     * `assistant-run-filter-invalid` for an invalid filter, with the refused parts in `fieldErrors`
+     * (`page`, `itemsPerPage`, `agentId`, `subjectType`, `subjectId`, `status`, `to`).
+     */
+    getRunHistory(filter?: AgentRunFilter): Observable<AgentRunHistory>;
+    /**
+     * The boards of the groups of agents the caller sees at least one agent of, ordered by name: an
+     * agent that works on the whole application by its view policy, another by its required policy.
+     */
+    getBoards(): Observable<AgentBoardList>;
+    /**
+     * The board of one group: per agent what it works on, its latest result for the whole application,
+     * its open proposals, whether the caller may run it now and whether something is new since the
+     * caller's last visit. `divisionId` opens the board of one division the caller may work in. Fails
+     * with `assistant-board-not-found` for an unknown group or one the caller sees no agent of, and with
+     * `assistant-board-scope-invalid` for a malformed division id.
+     */
+    getBoard(groupId: string, divisionId?: string | null): Observable<AgentBoard>;
+    /** Records that the caller looked at the board now, so it marks what is new after this visit. */
+    visitBoard(groupId: string, divisionId?: string | null): Observable<AgentBoardVisit>;
+    /**
+     * One run with its whole result, its proposals and its files. Fails with `assistant-run-not-found`
+     * for an unknown run and for one the caller may not see.
+     */
+    getRunResult(runId: string): Observable<AgentRunResult>;
+    /**
+     * Downloads one file a run saved, with the host's credentials. Rejects with `NhAssistantApiError`,
+     * for example `assistant-artifact-not-found`, `assistant-run-not-found` or `assistant-network`.
+     */
+    downloadRunArtifact(runId: string, artifactId: string): Promise<Blob>;
     /** Cancels a run at its next safe point and withdraws its open proposals; needs the participant role. */
     cancelRun(runId: string): Observable<void>;
-    /** Resumes or restarts a failed or cancelled run; needs the approver role. */
+    /**
+     * Resumes or restarts a failed or cancelled run; needs the approver role. A restart starts the agent
+     * again like `startAgent`, with the same outcomes and refusals; a resume answers `queued`.
+     */
     retryRun(runId: string, mode: AgentRunRetryMode): Observable<AgentTriggerReceipt>;
     /** Pending proposals the caller may decide, sorted by expiry. */
     getInbox(filter?: AgentInboxFilter): Observable<AgentInbox>;
@@ -1665,7 +2895,8 @@ type NhAssistantLiveState = 'off' | 'connecting' | 'connected' | 'reconnecting'
  * Live updates of the assistant hub: conversation changes, read positions, removals, the turn
  * events of other sessions and changes to the work of agents that run on their own. Connects only
  * while the store asks for it, reconnects on its own and emits `resync` after every (re)connect,
- * because updates sent while disconnected are lost.
+ * because updates sent while disconnected are lost. The work of agents for the whole application
+ * lists no members, so it arrives only while a screen watches it (`watchAgentWork`).
  */
 declare class NhAssistantLiveService {
     private readonly config;
@@ -1683,6 +2914,9 @@ declare class NhAssistantLiveService {
     private hubUrl;
     private revision;
     private restartTimer?;
+    /** The screens that watch the work of agents for the whole application. */
+    private agentWorkWatchers;
+    private watchTimer?;
     readonly changed$: Observable<LiveConversationChanged>;
     readonly read$: Observable<LiveConversationRead>;
     readonly removed$: Observable<LiveConversationRemoved>;
@@ -1702,8 +2936,24 @@ declare class NhAssistantLiveService {
      * signed-in user changed.
      */
     connect(hubPath: string | null, restart?: boolean): Promise<void>;
+    /**
+     * Follows the work of agents for the whole application, such as their proposals and runs, while the
+     * returned function has not been called; a screen that shows it, such as the approval inbox or a
+     * board, watches it while it is shown. The whole application lists no members, so the hub sends its
+     * agents' work only to connections that watch it: it joins the work the server decides the person
+     * may read, the agent's view policy included, renews the watch when the server says and after every
+     * reconnect, and so checks the person's rights again. The watch ends when the last screen releases
+     * it. Without a connection nothing arrives and screens keep their own reload.
+     */
+    watchAgentWork(): () => void;
     stop(): Promise<void>;
     private build;
+    /**
+     * Asks the hub to watch the work of agents for the whole application for the screens that watch it,
+     * and schedules the renewal the server asks for. An older server without watching, or a failed call,
+     * is tried again later; live updates stay optional.
+     */
+    private renewAgentWorkWatch;
     /** Starts over after the automatic reconnect gave up or the first start failed. */
     private scheduleRestart;
     private token;
@@ -1722,6 +2972,8 @@ declare class NhAssistantLiveService {
 interface NhAssistantError {
     code: string;
     messageKey: string;
+    /** The field errors of an `assistant-validation` failure, by camelCase field name. */
+    fieldErrors?: Readonly<Record<string, readonly string[]>>;
 }
 /**
  * A non-blocking remark about a turn that completed normally, for example a limit that cut the
@@ -1867,7 +3119,10 @@ declare class NhAssistantStore {
     readonly pageContextExcluded: _angular_core.Signal<boolean>;
     /** Whether the drawer was open when this account last left the application. */
     readonly restorePanelOpen: _angular_core.Signal<boolean>;
-    /** True while the user can send: enabled, an agent is chosen and no turn runs or waits. */
+    /**
+     * True while the user can send: enabled, an agent is chosen and no turn runs or waits. A
+     * conversation whose last turn failed accepts a new message; an archived one does not.
+     */
     readonly canSend: _angular_core.Signal<boolean>;
     /** Messages not yet accepted by the server, for the open conversation. Never persisted. */
     readonly queuedMessages: _angular_core.Signal<readonly NhAssistantQueuedMessage[]>;
@@ -1928,7 +3183,12 @@ declare class NhAssistantStore {
      * their own turns. Resolves `false` when the message was not accepted.
      */
     send(text: string): Promise<boolean>;
-    /** Sends immediately when idle, otherwise appends to the conversation's FIFO queue. */
+    /**
+     * Sends immediately when the conversation accepts a message, otherwise appends to the
+     * conversation's FIFO queue. A shown error alone does not hold a message back while nothing is
+     * queued: the person asks again, for example after a failed turn. Queued messages still wait
+     * for an explicit `resumeQueue` after Stop or a failure.
+     */
     submit(text: string): Promise<boolean>;
     /** Edits an unsent queued message without replacing the composer's current draft. */
     updateQueuedMessage(id: string, text: string): boolean;
@@ -2208,6 +3468,129 @@ declare const NH_ASSISTANT_CONVERSATION_FRAGMENT = "nh-assistant-conversation";
 /** Builds the default invitation link: the current page with the join fragment. */
 declare function nhAssistantShareLink(conversationId: string, token: string): string;
 
+/** The `type` of the message the assistant's OAuth callback page posts to its opener. */
+declare const NH_ASSISTANT_MCP_AUTHORIZATION_MESSAGE = "nh-assistant-mcp-authorization";
+/**
+ * What an authorization window reports: the flow and its one-time completion code, which
+ * `POST mcp-connections/complete` turns into the connection with the caller's own session, or the
+ * failure code of the callback (for example `assistant-mcp-authorization-failed`).
+ */
+type NhAssistantMcpAuthorizationOutcome = {
+    flowId: string;
+    completionCode: string;
+    code?: undefined;
+} | {
+    flowId: string | null;
+    code: string;
+    completionCode?: undefined;
+};
+/** A window opened for one authorization. */
+interface NhAssistantMcpAuthorizationHandle {
+    /** Shows the authorization and emits its outcome once, then completes. */
+    authorize(start: McpAuthorizationStart): Observable<NhAssistantMcpAuthorizationOutcome>;
+    /** Closes the window, for example when starting the authorization failed. */
+    close(): void;
+}
+/**
+ * Opens MCP authorizations in the person's browser. `open()` runs in the click handler, before the
+ * authorization URL is known, so popup blockers allow the window.
+ */
+interface NhAssistantMcpAuthorizationWindow {
+    open(): NhAssistantMcpAuthorizationHandle;
+}
+/**
+ * The authorization window of the assistant components. The default opens a popup and waits for the
+ * callback page's message; the testing package replaces it for the mock back-end.
+ */
+declare const NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW: InjectionToken<NhAssistantMcpAuthorizationWindow>;
+/**
+ * Opens the authorization in a popup. Only a message from that popup, sent by the assistant's
+ * callback page (`callbackOrigin`), with the started flow is accepted; the completion code is useless
+ * without the starter's own session. A closed popup
+ * without a message reports `assistant-mcp-authorization-cancelled`, a blocked one
+ * `assistant-mcp-popup-blocked`.
+ */
+declare class NhAssistantMcpPopupAuthorizationWindow implements NhAssistantMcpAuthorizationWindow {
+    private readonly document;
+    constructor(document: Document);
+    open(): NhAssistantMcpAuthorizationHandle;
+}
+/**
+ * Reads the outcome of a redirect-mode authorization from a URL fragment
+ * (`#nh-mcp-flow=…&nh-mcp-code=…` or `#nh-mcp-error=…&nh-mcp-message-key=…`); null when the fragment
+ * has none. The text of a failure comes from its code. Remove the fragment from the address bar after
+ * reading it.
+ */
+declare function nhAssistantMcpAuthorizationFromFragment(fragment: string): NhAssistantMcpAuthorizationOutcome | null;
+/**
+ * Runs one authorization: starts it, shows it in the window opened before, and completes it with
+ * the caller's own session. Errors with `NhAssistantApiError`, also for the window's failure codes.
+ */
+declare function nhAssistantConnectMcp(handle: NhAssistantMcpAuthorizationHandle, start: Observable<McpAuthorizationStart>, complete: (request: McpCompleteRequest) => Observable<McpCompletion>): Observable<McpCompletion>;
+
+/**
+ * The outcome of an authorization the page returned from in redirect mode: the activated connection,
+ * or the failure code to show. `serverId` names the server whose connection the page left for, when
+ * this browser tab remembered it, so a screen shows the outcome at that server only.
+ */
+type NhAssistantMcpReturnOutcome = {
+    completion: McpCompletion;
+    code?: undefined;
+    serverId?: string | null;
+} | {
+    code: string;
+    completion?: undefined;
+    serverId?: string | null;
+};
+/**
+ * Connects MCP accounts the way the host configured (`mcpConnectMode`): in a popup that the click
+ * opens, or by sending the page to the authorization server and back. Every authorization completes
+ * with the caller's own session.
+ */
+declare class NhAssistantMcpConnectService {
+    private readonly api;
+    private readonly config;
+    private readonly authorizationWindow;
+    private readonly document;
+    /**
+     * The outcome of the redirect-mode authorization this page opened with, until a screen showed it.
+     * `nh-assistant-connection-required` shows the outcome of its server without taking it; the
+     * connection lists of the preferences and the administration show it and take it.
+     */
+    readonly returned: _angular_core.WritableSignal<NhAssistantMcpReturnOutcome | null>;
+    /** Whether authorizations leave the page instead of opening a popup. */
+    get redirects(): boolean;
+    /**
+     * Connects the caller's own account to a server each person connects to. Call it in the click
+     * handler, so the popup is allowed. In redirect mode the page leaves and the observable never
+     * emits; the page completes the authorization when it returns.
+     */
+    connect(serverId: string, options?: {
+        allowBackgroundUse?: boolean;
+    }): Observable<McpCompletion>;
+    /**
+     * Runs any authorization start, for example an administrator's organization connection, in the
+     * configured mode. `serverId` lets the page show the outcome at that server after a redirect.
+     */
+    run(start: (request: McpAuthorizeRequest) => Observable<McpAuthorizationStart>, serverId?: string): Observable<McpCompletion>;
+    /** Leaves the page for an authorization in redirect mode. */
+    navigate(url: string): void;
+    /**
+     * Completes a redirect-mode authorization when the page opened with its fragment, removes the
+     * fragment from the address and records the outcome in `returned`: the connection, or the code of
+     * whatever failed, also when completing it failed. Emits null without a fragment and never errors.
+     */
+    completeReturn(): Observable<NhAssistantMcpReturnOutcome | null>;
+    private record;
+    private removeFragment;
+    /** Remembers in this tab which server's connection the page leaves for. */
+    private rememberLeftFor;
+    /** The server this tab left for, forgotten once read. */
+    private takeLeftFor;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantMcpConnectService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<NhAssistantMcpConnectService>;
+}
+
 type NhAssistantIconName = 'assistant' | 'close' | 'send' | 'stop' | 'plus' | 'list' | 'trash' | 'tool' | 'check' | 'x' | 'warning' | 'chevron-down' | 'clock' | 'settings' | 'admin' | 'edit' | 'refresh' | 'link' | 'page' | 'users' | 'copy' | 'bell' | 'leave';
 /**
  * Optional icon classes of the host's icon library, for example `{ close: 'ph ph-x' }`.
@@ -2234,7 +3617,7 @@ declare class NhAssistantLauncherComponent {
     readonly store: NhAssistantStore;
     readonly panel: NhAssistantPanelService;
     readonly waitingForApproval: _angular_core.Signal<boolean>;
-    readonly badge: _angular_core.Signal<"running" | "unread" | "waiting" | null>;
+    readonly badge: _angular_core.Signal<"running" | "waiting" | "unread" | null>;
     readonly unreadLabel: _angular_core.Signal<string>;
     readonly label: _angular_core.Signal<"nh-assistant.launcher.close" | "nh-assistant.launcher.open">;
     constructor();
@@ -2281,7 +3664,14 @@ declare class NhAssistantThreadComponent {
     readonly approvalDecision: _angular_core.OutputEmitterRef<ApprovalDecision>;
     /** The decision about an approval card together with its approval id. */
     readonly approvalChoice: _angular_core.OutputEmitterRef<NhAssistantApprovalChoice>;
+    /**
+     * The question to ask again after the viewer connected an MCP server from a connection card: the
+     * text of the user message the card answered. The panel sends it.
+     */
+    readonly retryMessage: _angular_core.OutputEmitterRef<string>;
     private readonly names;
+    /** Asks the question again that the assistant message with a connection card answered. */
+    retryAfterConnect(message: Message): void;
     readonly virtualThreshold = 200;
     readonly virtual: _angular_core.Signal<boolean>;
     /**
@@ -2312,7 +3702,7 @@ declare class NhAssistantThreadComponent {
     private scrollElement;
     private scrollToEnd;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantThreadComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantThreadComponent, "nh-assistant-thread", never, { "messages": { "alias": "messages"; "required": true; "isSignal": true; }; "streaming": { "alias": "streaming"; "required": false; "isSignal": true; }; "deciding": { "alias": "deciding"; "required": false; "isSignal": true; }; "markdown": { "alias": "markdown"; "required": false; "isSignal": true; }; "members": { "alias": "members"; "required": false; "isSignal": true; }; "currentActorId": { "alias": "currentActorId"; "required": false; "isSignal": true; }; "canDecide": { "alias": "canDecide"; "required": false; "isSignal": true; }; "decisionOwner": { "alias": "decisionOwner"; "required": false; "isSignal": true; }; "approvalRights": { "alias": "approvalRights"; "required": false; "isSignal": true; }; }, { "approvalDecision": "approvalDecision"; "approvalChoice": "approvalChoice"; }, never, never, true, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantThreadComponent, "nh-assistant-thread", never, { "messages": { "alias": "messages"; "required": true; "isSignal": true; }; "streaming": { "alias": "streaming"; "required": false; "isSignal": true; }; "deciding": { "alias": "deciding"; "required": false; "isSignal": true; }; "markdown": { "alias": "markdown"; "required": false; "isSignal": true; }; "members": { "alias": "members"; "required": false; "isSignal": true; }; "currentActorId": { "alias": "currentActorId"; "required": false; "isSignal": true; }; "canDecide": { "alias": "canDecide"; "required": false; "isSignal": true; }; "decisionOwner": { "alias": "decisionOwner"; "required": false; "isSignal": true; }; "approvalRights": { "alias": "approvalRights"; "required": false; "isSignal": true; }; }, { "approvalDecision": "approvalDecision"; "approvalChoice": "approvalChoice"; "retryMessage": "retryMessage"; }, never, never, true, never>;
 }
 
 /**
@@ -2334,15 +3724,21 @@ declare class NhAssistantPanelComponent implements AfterViewInit, OnDestroy {
     readonly showConversations: _angular_core.WritableSignal<boolean>;
     readonly showPreferences: _angular_core.WritableSignal<boolean>;
     readonly showShare: _angular_core.WritableSignal<boolean>;
-    readonly shareSection: _angular_core.WritableSignal<"members" | "link" | "all">;
+    readonly shareSection: _angular_core.WritableSignal<"members" | "all" | "link">;
     readonly notificationError: _angular_core.WritableSignal<NhAssistantError | null>;
     readonly notificationsLabel: _angular_core.Signal<"nh-assistant.panel.notifications-off" | "nh-assistant.panel.notifications-on">;
     readonly adminRoute: string | any[] | null;
     readonly conversation: _angular_core.Signal<Conversation | null>;
     private readonly conversationId;
     readonly messages: _angular_core.Signal<Message[]>;
+    /** An archived conversation takes no new messages. A failed one does: the person asks again. */
     readonly closed: _angular_core.Signal<boolean>;
     readonly busy: _angular_core.Signal<boolean>;
+    /**
+     * The last turn failed and no error bar explains it, for example after the conversation was
+     * reopened. The panel then says so, while the composer stays available.
+     */
+    readonly lastTurnFailed: _angular_core.Signal<boolean>;
     readonly composerDisabled: _angular_core.Signal<boolean>;
     readonly editingQueuedId: _angular_core.WritableSignal<string | null>;
     readonly queuedDraft: _angular_core.WritableSignal<string>;
@@ -2650,8 +4046,9 @@ declare class NhAssistantAgentPickerComponent {
 /** Maximum length of the user's own instructions. */
 declare const NH_ASSISTANT_MAX_CUSTOM_INSTRUCTIONS = 1000;
 /**
- * The user's own assistant preferences: desktop notifications, style, form of address,
- * answer length and optional instructions. Notifications apply immediately; the other
+ * The user's own assistant preferences: desktop notifications, background use of MCP servers
+ * with the user's own account, style, form of address, answer length and optional instructions.
+ * Notifications and background use apply immediately; the other
  * preferences steer style only and are saved together, below the application context and
  * agent instructions.
  */
@@ -2697,6 +4094,75 @@ declare class NhAssistantPreferencesComponent {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantPreferencesComponent, "nh-assistant-preferences", never, {}, { "closed": "closed"; "saved": "saved"; }, never, never, true, never>;
 }
 
+/**
+ * The caller's own MCP accounts: servers each person connects to with OAuth, with Connect,
+ * Connect again and Disconnect, and the consent to background use of servers that run with the
+ * caller's own account. Each change applies at once. Renders nothing while no server asks for it,
+ * so most applications never show it.
+ */
+declare class NhAssistantMcpConnectionsComponent {
+    private readonly api;
+    private readonly connector;
+    private readonly store;
+    private loadSubscription?;
+    private updateSubscription?;
+    readonly id: string;
+    readonly connections: _angular_core.WritableSignal<McpConnection[]>;
+    readonly loadFailed: _angular_core.WritableSignal<boolean>;
+    /** The server whose consent or connection is being changed. */
+    readonly busy: _angular_core.WritableSignal<string | null>;
+    readonly confirmingDisconnect: _angular_core.WritableSignal<string | null>;
+    /** The latest change to announce, per server. */
+    readonly notice: _angular_core.WritableSignal<{
+        serverId: string;
+        key: string;
+    } | null>;
+    readonly error: _angular_core.WritableSignal<NhAssistantError | null>;
+    readonly errorKeys: _angular_core.Signal<string[]>;
+    /** Whether any listed server is one the caller connects with OAuth. */
+    readonly connectsAccounts: _angular_core.Signal<boolean>;
+    constructor();
+    load(): void;
+    /** The agents' names as the chat shows them; an agent the chat does not list shows its id. */
+    agentKeys(connection: McpConnection): string[];
+    toggle(connection: McpConnection, event: Event): void;
+    /** Connects the caller's own account; call from the click, so the popup is allowed. */
+    connect(connection: McpConnection): void;
+    disconnect(connection: McpConnection): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantMcpConnectionsComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantMcpConnectionsComponent, "nh-assistant-mcp-connections", never, {}, {}, never, never, true, never>;
+}
+
+/**
+ * The card of a turn that went on without an MCP server the person who asked has to connect. It
+ * connects the viewer's own account, in a popup or by redirect as the host configured, and then
+ * offers to ask again. After a redirect the page returns to, the card of that server shows how the
+ * connection ended: connected, or the failure with its translated code.
+ */
+declare class NhAssistantConnectionRequiredComponent {
+    private readonly connections;
+    private subscription?;
+    readonly part: _angular_core.InputSignal<ConnectionRequiredPart>;
+    /** Whether "Ask again" is offered once the account is connected. */
+    readonly canRetry: _angular_core.InputSignal<boolean>;
+    /** Asks the question of the turn again after the account was connected. */
+    readonly retry: _angular_core.OutputEmitterRef<void>;
+    readonly id: string;
+    readonly state: _angular_core.WritableSignal<"failed" | "idle" | "connected" | "connecting">;
+    /** Why connecting failed, as a code and translation key. */
+    readonly error: _angular_core.WritableSignal<NhAssistantError | null>;
+    /** The code of `error`. */
+    readonly errorCode: _angular_core.Signal<string | null>;
+    readonly errorKeys: _angular_core.Signal<string[]>;
+    /** The connect button names connecting again when the person had connected before. */
+    readonly again: _angular_core.Signal<boolean>;
+    constructor();
+    connect(): void;
+    private showReturned;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantConnectionRequiredComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantConnectionRequiredComponent, "nh-assistant-connection-required", never, { "part": { "alias": "part"; "required": true; "isSignal": true; }; "canRetry": { "alias": "canRetry"; "required": false; "isSignal": true; }; }, { "retry": "retry"; }, never, never, true, never>;
+}
+
 /**
  * Sharing of the open conversation. The owner creates, copies, renews or stops an invitation
  * link, invites colleagues through the application's directory when it offers one, and removes
@@ -2710,7 +4176,7 @@ declare class NhAssistantShareComponent {
     /** Emitted when the user leaves the view. */
     readonly closed: _angular_core.OutputEmitterRef<void>;
     /** Show the invitation link, participants, or both (the default for custom hosts). */
-    readonly section: _angular_core.InputSignal<"members" | "link" | "all">;
+    readonly section: _angular_core.InputSignal<"members" | "all" | "link">;
     readonly id: string;
     readonly conversation: _angular_core.Signal<Conversation | null>;
     readonly isOwner: _angular_core.Signal<boolean>;
@@ -2796,6 +4262,13 @@ declare class NhAssistantTranslatePipe implements PipeTransform {
     static ɵpipe: _angular_core.ɵɵPipeDeclaration<NhAssistantTranslatePipe, "nhAssistantTranslate", true>;
 }
 
+/**
+ * Watches the work of agents for the whole application while the calling component lives, so their
+ * proposals and runs arrive as live agent-work updates although the whole application lists no
+ * members (see `NhAssistantLiveService.watchAgentWork`). Call it in an injection context, for example
+ * a component constructor, of a screen that shows that work, such as the approval inbox or a board.
+ */
+declare function nhAssistantWatchAgentWork(): void;
 /**
  * Calls `reload` once a burst of live agent-work updates that `matches` has settled, and after
  * every (re)connect of the hub, because updates sent while it was disconnected are lost. Without a
@@ -2804,12 +4277,142 @@ declare class NhAssistantTranslatePipe implements PipeTransform {
  */
 declare function nhAssistantReloadOnAgentWork(matches: (change: LiveAgentWorkChanged) => boolean, reload: () => void): void;
 
+/** One choice of a picker: the stored value, its name and what it means. */
+interface NhAssistantPickerOption {
+    value: string;
+    label: string;
+    description?: string | null;
+}
+/**
+ * A searchable choice for the administration (internal): a combobox with a listbox popup in the ARIA
+ * 1.2 pattern. Typing filters the options on name and description, the arrow keys move, Enter
+ * chooses and Escape closes. With `search` it asks the server instead, after `minQueryLength`
+ * characters; a failed search says why below the field, with its translated code, and offers to
+ * search again instead of claiming that nothing was found. `noneLabel` adds an explicit empty
+ * choice, emitted as `''`.
+ */
+declare class NhAssistantPickerComponent {
+    private readonly host;
+    private searchTimer?;
+    private searchSubscription?;
+    /** The text of the latest search, for searching again after a failure. */
+    private lastQuery;
+    private readonly field;
+    /** The id of the text field, for the label's `for`. */
+    readonly inputId: _angular_core.InputSignal<string>;
+    readonly options: _angular_core.InputSignal<readonly NhAssistantPickerOption[]>;
+    readonly value: _angular_core.InputSignal<string | null>;
+    /** The name to show for a value that is not among the options, such as a found account. */
+    readonly selectedLabel: _angular_core.InputSignal<string | null>;
+    /** The label of the empty choice; without it there is none. */
+    readonly noneLabel: _angular_core.InputSignal<string | null>;
+    readonly placeholder: _angular_core.InputSignal<string | null>;
+    /** Searches the server; the options are ignored while it is set. */
+    readonly search: _angular_core.InputSignal<((query: string) => Observable<NhAssistantPickerOption[]>) | null>;
+    readonly minQueryLength: _angular_core.InputSignal<number>;
+    readonly invalid: _angular_core.InputSignal<boolean>;
+    readonly describedBy: _angular_core.InputSignal<string | null>;
+    readonly disabled: _angular_core.InputSignal<boolean>;
+    readonly valueChange: _angular_core.OutputEmitterRef<string>;
+    /** The chosen option, also for a search result the options do not contain. */
+    readonly optionChange: _angular_core.OutputEmitterRef<NhAssistantPickerOption | null>;
+    readonly listId: string;
+    readonly open: _angular_core.WritableSignal<boolean>;
+    /** The text typed since the list opened; `null` shows the chosen option's name. */
+    readonly query: _angular_core.WritableSignal<string | null>;
+    readonly active: _angular_core.WritableSignal<number>;
+    readonly searching: _angular_core.WritableSignal<boolean>;
+    readonly results: _angular_core.WritableSignal<NhAssistantPickerOption[]>;
+    /** Why the latest search failed; `null` after a search that answered. */
+    readonly searchError: _angular_core.WritableSignal<NhAssistantError | null>;
+    readonly searchErrorKeys: _angular_core.Signal<string[]>;
+    readonly searchErrorId: string;
+    /** The field describes itself with the host's ids and, after a failed search, with its reason. */
+    readonly fieldDescribedBy: _angular_core.Signal<string | null>;
+    private readonly chosen;
+    readonly selected: _angular_core.Signal<NhAssistantPickerOption | null>;
+    readonly inputText: _angular_core.Signal<string>;
+    readonly visible: _angular_core.Signal<NhAssistantPickerOption[]>;
+    /** Why the list is empty: still typing, searching, the search failed, or nothing found. */
+    readonly emptyKey: _angular_core.Signal<"nh-assistant.picker.searching" | "nh-assistant.picker.search-failed" | "nh-assistant.picker.type-more" | "nh-assistant.picker.no-results">;
+    readonly activeId: _angular_core.Signal<string | null>;
+    constructor();
+    optionId(index: number): string;
+    /** Moves the focus to the text field, for example after a refused save. */
+    focus(): void;
+    toggle(): void;
+    openList(): void;
+    onInput(event: Event): void;
+    onKeydown(event: KeyboardEvent): void;
+    onBlur(): void;
+    /** Searches the latest text again after a failed search and shows the list. */
+    retrySearch(): void;
+    choose(option: NhAssistantPickerOption): void;
+    private close;
+    private startSearch;
+    private scrollActiveIntoView;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantPickerComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantPickerComponent, "nh-assistant-picker", never, { "inputId": { "alias": "inputId"; "required": true; "isSignal": true; }; "options": { "alias": "options"; "required": false; "isSignal": true; }; "value": { "alias": "value"; "required": false; "isSignal": true; }; "selectedLabel": { "alias": "selectedLabel"; "required": false; "isSignal": true; }; "noneLabel": { "alias": "noneLabel"; "required": false; "isSignal": true; }; "placeholder": { "alias": "placeholder"; "required": false; "isSignal": true; }; "search": { "alias": "search"; "required": false; "isSignal": true; }; "minQueryLength": { "alias": "minQueryLength"; "required": false; "isSignal": true; }; "invalid": { "alias": "invalid"; "required": false; "isSignal": true; }; "describedBy": { "alias": "describedBy"; "required": false; "isSignal": true; }; "disabled": { "alias": "disabled"; "required": false; "isSignal": true; }; }, { "valueChange": "valueChange"; "optionChange": "optionChange"; }, never, never, true, never>;
+}
+
+/** Where a subject link leads: a route of the host application or an `https` address elsewhere. */
+interface NhAssistantSubjectTarget {
+    href: string;
+    /** The URL the router navigates to; `null` for an address outside the application. */
+    route: string | null;
+}
+/**
+ * The name of a subject with the name of its type, linked to where the application shows the
+ * subject (internal). The host's `subjectLinks` builder wins over the server's link; a link within
+ * the application navigates through the router, an `https` link leaves it, and anything else shows
+ * no link. Ctrl-, Cmd-, Shift- and middle-clicks keep the browser's behavior, such as a new tab.
+ * A name that already says the type, as "The whole application" does for the application as a
+ * whole, is shown once.
+ */
+declare class NhAssistantSubjectLinkComponent {
+    private readonly config;
+    private readonly router;
+    private readonly locationStrategy;
+    private readonly injector;
+    readonly subjectType: _angular_core.InputSignal<string>;
+    readonly subjectId: _angular_core.InputSignal<string>;
+    /** The text people read, usually the subject's display name. */
+    readonly label: _angular_core.InputSignal<string>;
+    /** The name of the subject type, such as "Project"; nothing is shown without one. */
+    readonly typeName: _angular_core.InputSignal<string | null | undefined>;
+    /** The server's link to the subject. */
+    readonly link: _angular_core.InputSignal<string | null | undefined>;
+    /** The type's name, unless the subject's name is the type's name itself, as for the whole application. */
+    readonly shownTypeName: _angular_core.Signal<string | null>;
+    readonly target: _angular_core.Signal<NhAssistantSubjectTarget | null>;
+    open(event: MouseEvent, target: NhAssistantSubjectTarget): void;
+    private urlTarget;
+    private routeTarget;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantSubjectLinkComponent, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<NhAssistantSubjectLinkComponent, "nh-assistant-subject-link", never, { "subjectType": { "alias": "subjectType"; "required": true; "isSignal": true; }; "subjectId": { "alias": "subjectId"; "required": true; "isSignal": true; }; "label": { "alias": "label"; "required": true; "isSignal": true; }; "typeName": { "alias": "typeName"; "required": false; "isSignal": true; }; "link": { "alias": "link"; "required": false; "isSignal": true; }; }, {}, never, never, true, never>;
+}
+
+/** Renders model text into sanitized HTML. Pure, so unchanged text is not rendered again. */
+declare class NhAssistantMarkdownPipe implements PipeTransform {
+    private readonly renderer;
+    transform(text: string): string;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantMarkdownPipe, never>;
+    static ɵpipe: _angular_core.ɵɵPipeDeclaration<NhAssistantMarkdownPipe, "nhAssistantMarkdown", true>;
+}
+
 /** Converts any failure into a user-facing code and translation key, never raw text. */
 declare function toNhAssistantError(error: unknown): NhAssistantError;
+/** The error of a code without a message key of its own, such as a code a callback page reported. */
+declare function nhAssistantErrorOf(code: string): NhAssistantError;
 /** Translation keys for an error, from the most to the least specific. */
 declare function nhAssistantErrorKeys(error: NhAssistantError | null): string[];
+/**
+ * Translation keys for a bare failure code, such as a run's `failureCode`: the registered text of
+ * the code, then the generic text. Empty without a code.
+ */
+declare function nhAssistantCodeKeys(code: string | null | undefined): string[];
 /** Dash-case identifiers as the contract requires for agent and MCP server ids. */
 declare const NH_ASSISTANT_DASH_CASE: RegExp;
 
-export { NH_ASSISTANT_ACCESS_POLICY, NH_ASSISTANT_CONFIG, NH_ASSISTANT_CONVERSATION_FRAGMENT, NH_ASSISTANT_FEEDBACK_CATEGORIES, NH_ASSISTANT_FEEDBACK_GROUPS, NH_ASSISTANT_FETCH, NH_ASSISTANT_ICONS, NH_ASSISTANT_JOIN_FRAGMENT, NH_ASSISTANT_MAX_BULK_FEEDBACK, NH_ASSISTANT_MAX_CUSTOM_INSTRUCTIONS, NH_ASSISTANT_MAX_FEEDBACK_TEXT, NH_ASSISTANT_MAX_PROPOSAL_LOOKUP, NH_ASSISTANT_MAX_SUBJECT_SUMMARY, NH_ASSISTANT_NO_ANSWER_NOTICE_CODE, NH_ASSISTANT_PAGE_CONTEXT_LIMITS, NH_ASSISTANT_PANEL_MOBILE_QUERY, NH_ASSISTANT_PANEL_WIDTH, NH_ASSISTANT_SSE_EVENT_TYPES, NH_ASSISTANT_TRANSLATIONS, NH_ASSISTANT_VIRTUAL_SCROLL_THRESHOLD, NhAssistantActivityComponent, NhAssistantAdminApiService, NhAssistantAgentPickerComponent, NhAssistantAgentRunApiService, NhAssistantAllowAllAccessPolicy, NhAssistantApiError, NhAssistantApiService, NhAssistantApprovalCardComponent, NhAssistantClientErrorCodes, NhAssistantComposerComponent, NhAssistantConversationListComponent, NhAssistantLauncherComponent, NhAssistantLiveService, NhAssistantPanelComponent, NhAssistantPanelService, NhAssistantPreferencesComponent, NhAssistantProposalFeedbackComponent, NhAssistantPushService, NhAssistantShareComponent, NhAssistantSseParser, NhAssistantStore, NhAssistantSubjectBadgeComponent, NhAssistantSubjectSummaryService, NhAssistantThreadComponent, NhAssistantToolCallCardComponent, NhAssistantToolCallGroupComponent, NhAssistantTranslationMerger, applyNhAssistantApprovalDecision, applyNhAssistantConversationChange, applyNhAssistantEvent, applyNhAssistantLiveEvent, describeNhAssistantClientContext, formatNhAssistantCountdown, nhAssistantCodeForStatus, nhAssistantErrorMessageKey, nhAssistantIsUnread, nhAssistantLatestTurnHasText, nhAssistantShareLink, normalizeNhAssistantClientContext, provideNhAssistant, NH_ASSISTANT_DASH_CASE as ɵNH_ASSISTANT_DASH_CASE, NhAssistantIconComponent as ɵNhAssistantIconComponent, NhAssistantTranslatePipe as ɵNhAssistantTranslatePipe, nhAssistantErrorKeys as ɵnhAssistantErrorKeys, nhAssistantReloadOnAgentWork as ɵnhAssistantReloadOnAgentWork, toNhAssistantError as ɵtoNhAssistantError };
-export type { AdminAgent, AdminAgentInput, AgentArtifact, AgentConsultation, AgentConsultationList, AgentConsultationStatus, AgentDecisionOutcome, AgentEvaluation, AgentEvaluationCost, AgentEvaluationDecisions, AgentEvaluationDifference, AgentEvaluationFilter, AgentEvaluationRouting, AgentEvaluationRuns, AgentEvaluationTool, AgentExecutionResolution, AgentFeedbackCategoryCount, AgentFeedbackExportFilter, AgentFeedbackFilter, AgentFeedbackItem, AgentFeedbackList, AgentFeedbackListFilter, AgentFeedbackOutcome, AgentFeedbackSummary, AgentFeedbackSummaryRow, AgentGrantSource, AgentInbox, AgentInboxFilter, AgentInvalidationCount, AgentProposal, AgentProposalDecision, AgentProposalDecisionRight, AgentProposalFeedback, AgentProposalFeedbackCategory, AgentProposalFeedbackGroup, AgentProposalLookup, AgentProposalObject, AgentProposalStatus, AgentReplay, AgentReplayList, AgentReplayRequest, AgentRun, AgentRunKind, AgentRunList, AgentRunRetryMode, AgentRunState, AgentRunStatus, AgentServiceAccountState, AgentShadowMode, AgentShadowState, AgentSkillChooser, AgentSkillState, AgentState, AgentSubjectRole, AgentSubjectSummary, AgentSubjectSummaryList, AgentSubjectWork, AgentSubjectWorkAgent, AgentSubjectWorkProposal, AgentSummary, AgentThread, AgentThreadLookup, AgentThreadMemory, AgentTriggerReceipt, ApplicationContext, ApplicationContextVersion, ApprovalDecision, ApprovalPart, ApprovalPresentation, ApprovalPresentationField, ApprovalRequiredEvent, ApprovalStatus, AssistantAddressForm, AssistantAutonomy, AssistantCollaboration, AssistantErrorEvent, AssistantPreferences, AssistantResponseLength, AssistantStatus, AssistantStyle, ClientContext, ClientContextEntity, Conversation, ConversationKind, ConversationMember, ConversationPage, ConversationRole, ConversationStatus, ConversationSummary, ConversationThread, ConversationThreadDecision, CreateConversationRequest, DecideApprovalRequest, DirectoryEntry, LiveAgentWorkChanged, LiveAgentWorkReason, LiveConversationChanged, LiveConversationEvent, LiveConversationRead, LiveConversationRemoved, McpAuthMode, McpServer, McpServerInput, McpServerTestResult, McpTool, McpToolEffect, McpToolStatus, Message, MessageAuthorKind, MessageDeltaEvent, MessagePart, NhAssistantAccessPolicy, NhAssistantActivity, NhAssistantApprovalChoice, NhAssistantApprovalRight, NhAssistantApprovalWaitingFor, NhAssistantClientContext, NhAssistantClientErrorCode, NhAssistantConfig, NhAssistantError, NhAssistantFetch, NhAssistantIconName, NhAssistantLiveState, NhAssistantNotice, NhAssistantProposalFeedbackSaved, NhAssistantPushConfig, NhAssistantPushState, NhAssistantQueuedMessage, NhAssistantRawSseMessage, NhAssistantSseEvent, NhAssistantSseEventMap, NhAssistantSseEventType, NhAssistantStatusCodes, NhAssistantToolCallGroupState, NotificationSettings, PushSubscriptionRequest, SendMessageRequest, SetAgentServiceAccountRequest, SetAgentShadowRequest, SetAgentStateRequest, ShareLink, StaleKind, StartAgentRequest, TextPart, ToolCallPart, ToolCallStatus, ToolCatalogEffect, ToolCatalogEntry, ToolCompletedEvent, ToolStartedEvent, TurnCompletedEvent, TurnCompletionStatus, TurnStartedEvent, TurnUsage, UpdateAdminAgentRequest, UpdateApplicationContextRequest, UpdateMcpToolRequest };
+export { NH_ASSISTANT_ACCESS_POLICY, NH_ASSISTANT_CONFIG, NH_ASSISTANT_CONVERSATION_FRAGMENT, NH_ASSISTANT_FEEDBACK_CATEGORIES, NH_ASSISTANT_FEEDBACK_GROUPS, NH_ASSISTANT_FETCH, NH_ASSISTANT_ICONS, NH_ASSISTANT_JOIN_FRAGMENT, NH_ASSISTANT_MAX_BULK_FEEDBACK, NH_ASSISTANT_MAX_CUSTOM_INSTRUCTIONS, NH_ASSISTANT_MAX_FEEDBACK_TEXT, NH_ASSISTANT_MAX_PROPOSAL_LOOKUP, NH_ASSISTANT_MAX_SUBJECT_SUMMARY, NH_ASSISTANT_MCP_AUTHORIZATION_MESSAGE, NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW, NH_ASSISTANT_NO_ANSWER_NOTICE_CODE, NH_ASSISTANT_PAGE_CONTEXT_LIMITS, NH_ASSISTANT_PANEL_MOBILE_QUERY, NH_ASSISTANT_PANEL_WIDTH, NH_ASSISTANT_RESULT_PREVIEW_LENGTH, NH_ASSISTANT_RUN_HISTORY_MAX_PAGE, NH_ASSISTANT_RUN_RESULT_MAX_LENGTH, NH_ASSISTANT_SSE_EVENT_TYPES, NH_ASSISTANT_SUBJECT_SEARCH, NH_ASSISTANT_SYSTEM_GLOBAL_ID, NH_ASSISTANT_SYSTEM_SUBJECT_TYPE, NH_ASSISTANT_TRANSLATIONS, NH_ASSISTANT_VIRTUAL_SCROLL_THRESHOLD, NhAssistantActivityComponent, NhAssistantAdminApiService, NhAssistantAgentPickerComponent, NhAssistantAgentRunApiService, NhAssistantAllowAllAccessPolicy, NhAssistantApiError, NhAssistantApiService, NhAssistantApprovalCardComponent, NhAssistantClientErrorCodes, NhAssistantComposerComponent, NhAssistantConnectionRequiredComponent, NhAssistantConversationListComponent, NhAssistantLauncherComponent, NhAssistantLiveService, NhAssistantMcpConnectService, NhAssistantMcpConnectionsComponent, NhAssistantMcpPopupAuthorizationWindow, NhAssistantPanelComponent, NhAssistantPanelService, NhAssistantPreferencesComponent, NhAssistantProposalFeedbackComponent, NhAssistantPushService, NhAssistantShareComponent, NhAssistantSseParser, NhAssistantStore, NhAssistantSubjectBadgeComponent, NhAssistantSubjectSummaryService, NhAssistantThreadComponent, NhAssistantToolCallCardComponent, NhAssistantToolCallGroupComponent, NhAssistantTranslationMerger, applyNhAssistantApprovalDecision, applyNhAssistantConversationChange, applyNhAssistantEvent, applyNhAssistantLiveEvent, describeNhAssistantClientContext, formatNhAssistantCountdown, nhAssistantCodeForStatus, nhAssistantConnectMcp, nhAssistantErrorMessageKey, nhAssistantIsUnread, nhAssistantLatestTurnHasText, nhAssistantMcpAuthorizationFromFragment, nhAssistantShareLink, normalizeNhAssistantClientContext, provideNhAssistant, NH_ASSISTANT_DASH_CASE as ɵNH_ASSISTANT_DASH_CASE, NhAssistantIconComponent as ɵNhAssistantIconComponent, NhAssistantMarkdownPipe as ɵNhAssistantMarkdownPipe, NhAssistantPickerComponent as ɵNhAssistantPickerComponent, NhAssistantSubjectLinkComponent as ɵNhAssistantSubjectLinkComponent, NhAssistantTranslatePipe as ɵNhAssistantTranslatePipe, nhAssistantCodeKeys as ɵnhAssistantCodeKeys, nhAssistantErrorKeys as ɵnhAssistantErrorKeys, nhAssistantErrorOf as ɵnhAssistantErrorOf, nhAssistantReloadOnAgentWork as ɵnhAssistantReloadOnAgentWork, nhAssistantWatchAgentWork as ɵnhAssistantWatchAgentWork, toNhAssistantError as ɵtoNhAssistantError };
+export type { AdminAgent, AdminAgentGroups, AdminAgentInput, AgentAccountability, AgentArtifact, AgentBoard, AgentBoardAgent, AgentBoardList, AgentBoardSubjectType, AgentBoardSummary, AgentBoardVisit, AgentBoardWorksOn, AgentConsultation, AgentConsultationList, AgentConsultationStatus, AgentDecisionOutcome, AgentElevatedReads, AgentEvaluation, AgentEvaluationCost, AgentEvaluationDecisions, AgentEvaluationDifference, AgentEvaluationFilter, AgentEvaluationRouting, AgentEvaluationRuns, AgentEvaluationTool, AgentExecutionResolution, AgentFeedbackCategoryCount, AgentFeedbackExportFilter, AgentFeedbackFilter, AgentFeedbackItem, AgentFeedbackList, AgentFeedbackListFilter, AgentFeedbackOutcome, AgentFeedbackSummary, AgentFeedbackSummaryRow, AgentGrantSource, AgentGroup, AgentInbox, AgentInboxFilter, AgentInvalidationCount, AgentLatestRun, AgentObjectAgent, AgentObjectAgents, AgentProposal, AgentProposalDecision, AgentProposalDecisionRight, AgentProposalFeedback, AgentProposalFeedbackCategory, AgentProposalFeedbackGroup, AgentProposalLookup, AgentProposalObject, AgentProposalOrigin, AgentProposalStatus, AgentReplay, AgentReplayList, AgentReplayRequest, AgentRun, AgentRunConfiguration, AgentRunFilter, AgentRunHistory, AgentRunHistoryItem, AgentRunKind, AgentRunList, AgentRunMcpSkip, AgentRunResult, AgentRunRetryMode, AgentRunSettings, AgentRunSettingsRequest, AgentRunState, AgentRunStatus, AgentServiceAccountState, AgentShadowMode, AgentShadowState, AgentSkillChooser, AgentSkillState, AgentState, AgentSubjectRole, AgentSubjectSearch, AgentSubjectSearchResult, AgentSubjectSummary, AgentSubjectSummaryList, AgentSubjectType, AgentSubjectWork, AgentSubjectWorkAgent, AgentSubjectWorkProposal, AgentSummary, AgentThread, AgentThreadLookup, AgentThreadMemory, AgentTriggerOutcome, AgentTriggerReceipt, ApplicationContext, ApplicationContextVersion, ApprovalDecision, ApprovalPart, ApprovalPolicySummary, ApprovalPresentation, ApprovalPresentationField, ApprovalRequiredEvent, ApprovalStatus, ApproverSummary, AssistantAccount, AssistantAddressForm, AssistantAutonomy, AssistantCollaboration, AssistantErrorEvent, AssistantPreferences, AssistantResponseLength, AssistantStatus, AssistantStyle, ClientContext, ClientContextEntity, CodeRunSettings, CodeSkill, CodeTrigger, ConnectionRequiredEvent, ConnectionRequiredPart, ConnectionRequiredReason, Conversation, ConversationKind, ConversationMember, ConversationPage, ConversationRole, ConversationStatus, ConversationSummary, ConversationThread, ConversationThreadDecision, CreateConversationRequest, DataSkill, DataSkillRequest, DataSkillVersion, DataSkillVersionStatus, DataTrigger, DataTriggerRequest, DataTriggerShadowRequest, DecideApprovalRequest, DirectoryEntry, LiveAgentWorkChanged, LiveAgentWorkReason, LiveAgentWorkWatch, LiveConversationChanged, LiveConversationEvent, LiveConversationRead, LiveConversationRemoved, McpAuthMode, McpAuthorization, McpAuthorizationStart, McpAuthorizeRequest, McpBuiltInAuthMode, McpCompleteRequest, McpCompletion, McpConnection, McpConnectionScope, McpConnectionStatus, McpConnectionsSummary, McpCustomAuthMode, McpDiscoverRequest, McpDiscovery, McpHeadlessUse, McpOAuthInput, McpOAuthSettings, McpOrganizationConnection, McpServer, McpServerInput, McpServerTestResult, McpTool, McpToolEffect, McpToolStatus, McpTransport, Message, MessageAuthorKind, MessageDeltaEvent, MessagePart, NhAssistantAccessPolicy, NhAssistantActivity, NhAssistantApprovalChoice, NhAssistantApprovalRight, NhAssistantApprovalWaitingFor, NhAssistantClientContext, NhAssistantClientErrorCode, NhAssistantConfig, NhAssistantError, NhAssistantFetch, NhAssistantIconName, NhAssistantLiveState, NhAssistantMcpAuthorizationHandle, NhAssistantMcpAuthorizationOutcome, NhAssistantMcpAuthorizationWindow, NhAssistantMcpReturnOutcome, NhAssistantNotice, NhAssistantProposalFeedbackSaved, NhAssistantPushConfig, NhAssistantPushState, NhAssistantQueuedMessage, NhAssistantRawSseMessage, NhAssistantSseEvent, NhAssistantSseEventMap, NhAssistantSseEventType, NhAssistantStatusCodes, NhAssistantSubjectLinkBuilder, NhAssistantSubjectRef, NhAssistantToolCallGroupState, NotificationSettings, PushSubscriptionRequest, RunBlock, RunCatalog, RunConfigurationProblem, RunConfigurationProblemKind, RunConfigurationRemoval, SendMessageRequest, SetAgentServiceAccountRequest, SetAgentShadowRequest, SetAgentStateRequest, ShareLink, SkillApplyMode, SkillCandidateRequest, SkillComparison, SkillComparisonFilter, SkillComparisonTool, SkillVersionStats, StaleKind, StartAgentRequest, TextPart, ToolCallPart, ToolCallStatus, ToolCatalogEffect, ToolCatalogEntry, ToolCompletedEvent, ToolStartedEvent, TriggerConflict, TurnCompletedEvent, TurnCompletionStatus, TurnStartedEvent, TurnUsage, UpdateAdminAgentRequest, UpdateApplicationContextRequest, UpdateMcpConnectionRequest, UpdateMcpToolRequest, NhAssistantPickerOption as ɵNhAssistantPickerOption };