@newheap/platform-ai-chat 0.13.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newheap/platform-ai-chat",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "peerDependencies": {
     "@angular/cdk": "^20.2.14",
     "@angular/common": "^20.3.28",

package/testing/index.d.ts

@@ -1,5 +1,5 @@
-import { AssistantStatus, AgentSummary, Conversation, ClientContext, AssistantPreferences, ToolCatalogEntry, AdminAgentInput, McpServerInput, LiveConversationChanged, LiveConversationRead, LiveConversationRemoved, LiveConversationEvent, NhAssistantLiveService, LiveAgentWorkChanged, NhAssistantLiveState } from '@newheap/platform-ai-chat';
-import * as i0 from '@angular/core';
+import { AssistantStatus, AgentSummary, Conversation, ClientContext, AssistantPreferences, ToolCatalogEntry, AdminAgentInput, CodeRunSettings, AgentRunSettingsRequest, DataSkillRequest, DataTriggerRequest, McpServerInput, McpCustomAuthMode, McpDiscovery, RunCatalog, AssistantAccount, AgentRunStatus, AgentTriggerReceipt, AgentRunMcpSkip, ApprovalPresentation, AgentProposalStatus, AgentProposalOrigin, NhAssistantMcpAuthorizationWindow, NhAssistantMcpAuthorizationOutcome, NhAssistantMcpAuthorizationHandle, LiveConversationChanged, LiveConversationRead, LiveConversationRemoved, LiveConversationEvent, LiveAgentWorkChanged, NhAssistantLiveService, NhAssistantLiveState } from '@newheap/platform-ai-chat';
+import * as _angular_core from '@angular/core';
 import { InjectionToken, EnvironmentProviders } from '@angular/core';
 import { Observable } from 'rxjs';
 
@@ -64,7 +64,18 @@ interface NhAssistantMockFailStep {
         errorCode: string;
     };
 }
-type NhAssistantMockStep = NhAssistantMockTextStep | NhAssistantMockToolStep | NhAssistantMockApprovalStep | NhAssistantMockErrorStep | NhAssistantMockFailStep;
+/**
+ * Needs the caller's own connection to an MCP server each person connects to (`connectionScope:
+ * 'user'`). Without an active connection the mock streams `connection.required`, adds `text` and
+ * ends the turn; with one the step is skipped and the next steps play.
+ */
+interface NhAssistantMockConnectionStep {
+    connectionRequired: {
+        serverId: string;
+        text?: string;
+    };
+}
+type NhAssistantMockStep = NhAssistantMockTextStep | NhAssistantMockToolStep | NhAssistantMockApprovalStep | NhAssistantMockErrorStep | NhAssistantMockFailStep | NhAssistantMockConnectionStep;
 /** A scripted assistant turn, chosen by matching the user's message. */
 interface NhAssistantMockTurn {
     /** Case-insensitive substring, regular expression or predicate. Omit to match every message. */
@@ -88,9 +99,13 @@ interface NhAssistantMockRemoteTool {
     /** Remote annotation; the mock passes it on as an untrusted hint. */
     readOnlyHint?: boolean | null;
 }
-/** A simulated MCP server. The mock stores `secret` but never returns it. */
+/** A simulated MCP server. The mock stores `secret` and `oauth.clientSecret` but never returns them. */
 interface NhAssistantMockMcpServer extends McpServerInput {
     remoteTools?: NhAssistantMockRemoteTool[];
+    /** An `oauth` organization server starts connected. */
+    organizationConnected?: boolean;
+    /** A server each person connects to starts with the caller's own account connected. */
+    personalConnected?: boolean;
 }
 /** A preconfigured agent. Code agents default to the scenario's chat agents. */
 interface NhAssistantMockAdminAgent extends AdminAgentInput {
@@ -107,6 +122,49 @@ interface NhAssistantMockAdminAgent extends AdminAgentInput {
     shadow?: boolean;
     /** The technical account in code, as with `ServiceAccount(actorId)`. */
     serviceAccount?: string;
+    /**
+     * Whether a code agent says what it works on, as with `WorksOn`; by default it does when the
+     * scenario gives `worksOnSubjectTypes`, `worksOnAllSubjects` or `worksOnApplication`.
+     */
+    worksOnDeclared?: boolean;
+    /** The object types the agent is known to work on, shown as a hint next to "All objects". */
+    knownSubjectTypes?: string[];
+    /**
+     * How a code agent runs, as its code says (`codeRunSettings` of its run configuration). By default
+     * it answers to its `serviceAccount` when it has one and to itself otherwise, with the platform's
+     * approval policy and the model.
+     */
+    codeRunSettings?: Partial<CodeRunSettings>;
+    /**
+     * The run configuration an agent created in the administration starts with, as administrators saved
+     * it: its run settings, skills and triggers defined as data. Without it such an agent has none and
+     * the administration offers the guided setup.
+     */
+    runConfiguration?: NhAssistantMockRunConfigurationPreset;
+}
+/**
+ * The run configuration as data an agent created in the administration starts with. The mock saves it
+ * through its own endpoints in order (the run settings, then each skill, then each trigger), so every
+ * part is checked as an administrator's save is, against the scenario's run catalog and accounts; a
+ * part the mock refuses fails the scenario at once, like a startup check. Skills and triggers start in
+ * shadow, as saved ones do, unless `shadow` is `false`.
+ */
+interface NhAssistantMockRunConfigurationPreset {
+    runSettings: AgentRunSettingsRequest;
+    skills?: NhAssistantMockDataSkill[];
+    triggers?: NhAssistantMockDataTrigger[];
+}
+/** A skill defined as data of a preset run configuration. */
+interface NhAssistantMockDataSkill extends DataSkillRequest {
+    skillId: string;
+    /** Default `true`, as for a saved skill; `false` puts it live. */
+    shadow?: boolean;
+}
+/** A trigger defined as data of a preset run configuration. */
+interface NhAssistantMockDataTrigger extends DataTriggerRequest {
+    triggerId: string;
+    /** Default `true`, as for a saved trigger; `false` puts it live. */
+    shadow?: boolean;
 }
 /**
  * Administration data of the mock. Hosts without an admin scenario still get working
@@ -120,10 +178,57 @@ interface NhAssistantMockAdminScenario {
     tools?: ToolCatalogEntry[];
     agents?: NhAssistantMockAdminAgent[];
     mcpServers?: NhAssistantMockMcpServer[];
+    /**
+     * Authentication modes the application registered in code (`AddMcpCredentialProvider`), which
+     * `GET admin/mcp-auth-modes` lists and servers may use. Default none.
+     */
+    mcpAuthModes?: McpCustomAuthMode[];
     /** Policies the host knows; `requiredPolicy` must be one of them. Default: any value. */
     policies?: string[];
     /** Hosts that may receive the user's token (`forward-user-token`). Default: none. */
     forwardUserTokenHosts?: string[];
+    /** Secret references that name an available secret. Default: every `config:` reference. */
+    secretReferences?: string[];
+    /** Client certificate names the host configured. Default: none. */
+    clientCertificates?: string[];
+    /** The caller's consent to background use of personal servers (`mcp-connections`). Default: none. */
+    mcpConnections?: {
+        serverId: string;
+        allowBackgroundUse: boolean;
+    }[];
+    /**
+     * What the mock authorization window answers to an MCP authorization: the person approves
+     * (default), denies, or closes the window. `NhAssistantMockBackend.setMcpAuthorizationOutcome`
+     * changes it.
+     */
+    mcpAuthorization?: 'approve' | 'deny' | 'cancel';
+    /** Discovery results per server host, over the mock's defaults (`https://auth.<host>`, PKCE, dynamic registration). */
+    mcpDiscovery?: Record<string, Partial<McpDiscovery>>;
+    /** Origins an authorization may return to in redirect mode. Default: any. */
+    mcpReturnOrigins?: string[];
+    /**
+     * The building blocks in code that run configuration as data names. Default: none, with
+     * `policies` as the approval policies. `divisions: true` lets agents created in the
+     * administration work per division, as an application that lists its divisions does.
+     */
+    runCatalog?: Partial<RunCatalog>;
+    /**
+     * Triggers in code, per agent; they cannot change in the administration. `subjectType` is the type
+     * a trigger names up front, `nh-system` for a schedule for the whole application.
+     */
+    codeTriggers?: {
+        agentId: string;
+        triggerId: string;
+        source: 'event' | 'schedule' | 'webhook';
+        skillId?: string | null;
+        subjectType?: string | null;
+    }[];
+    /**
+     * The accounts `GET admin/accounts` finds, as the application's `INhActorSearch` would. With
+     * accounts, run settings accept only these technical accounts; without, the account search is
+     * unavailable and any id that does not start with `unknown` is accepted.
+     */
+    accounts?: AssistantAccount[];
 }
 /** A person in the simulated organization. */
 interface NhAssistantMockPerson {
@@ -144,6 +249,141 @@ interface NhAssistantMockCollaboration {
     /** Default 20. */
     maxParticipants?: number;
 }
+/** A subject of a mock subject type, as the application's resolver describes it. */
+interface NhAssistantMockSubject {
+    id: string;
+    displayName: string;
+    /** Default `global`. */
+    scopeKey?: string;
+    divisionId?: string | null;
+    /** Whether the signed-in user may read the subject; others never find it. Default `true`. */
+    readable?: boolean;
+    /** The signed-in user's role on a readable subject. Default `participant`, who may run its agents. */
+    role?: 'reader' | 'participant' | 'approver';
+}
+/**
+ * A division the application lists, for agents that work on the whole application per division:
+ * the run catalog then reports divisions only when `admin.runCatalog.divisions` says so.
+ */
+interface NhAssistantMockDivision {
+    /** The division's id, a GUID; its subject of the whole application is `nh-system/division-{id:N}`. */
+    id: string;
+    name: string;
+    /** Whether the signed-in user works in the division. Default `true`. */
+    readable?: boolean;
+}
+/**
+ * What a run of an agent started by hand does in the mock, which runs no agents: it ends at once with
+ * this status and result, leaving this many open proposals. The agent's state decides first, as on
+ * the server: a stopped agent or one disabled in code is refused (`409`), and a paused agent answers
+ * `waiting` with `assistant-agent-paused`.
+ */
+interface NhAssistantMockRunNow {
+    /** Default `completed`. */
+    status?: AgentRunStatus;
+    /** The run's result; default none. */
+    result?: string | null;
+    /**
+     * The run's result per culture (`en`, `nl-NL`), as a run whose rules wrote it per culture keeps it:
+     * a reader gets the one of the request's language (exact, then the language), `result` otherwise.
+     */
+    results?: Readonly<Record<string, string>>;
+    /** The open proposals the run leaves on its subject. Default 0. */
+    proposals?: number;
+    /**
+     * The receipt's outcome. Default `started`. `ignored` and `deferred` record no run; `waiting` records
+     * none either and names `assistant-skill-paused`, as for a paused skill.
+     */
+    outcome?: AgentTriggerReceipt['outcome'];
+    /**
+     * The runs by hand the agent may make per object in a day; a start beyond it answers
+     * `409 assistant-trigger-rate-limited`. Default no limit.
+     */
+    dailyLimit?: number;
+}
+/**
+ * A run that happened before the first request, for the run histories (`GET runs`, the
+ * administration's runs view) and `GET runs/{id}`. The mock shows it to the caller as the server
+ * would: on an object the caller reads, for the whole application when the caller passes the agent's
+ * view policy, by default its required policy; administrators see every run of an agent.
+ */
+interface NhAssistantMockRun {
+    /** Default a generated id. */
+    id?: string;
+    agentId: string;
+    /** An object type of `subjectTypes`, or `nh-system` for the whole application. */
+    subjectType: string;
+    /** The object's id, or `global` (or `division-…`) for the whole application. */
+    subjectId: string;
+    /** The object's name; default the name `subjectTypes` gives it, or the id. */
+    subjectDisplayName?: string;
+    /** Default `completed`. */
+    status?: AgentRunStatus;
+    /** Why a `failed` run failed, such as `assistant-trigger-rolled-back`. Default `assistant-turn-failed`. */
+    failureCode?: string;
+    /** Default `manual`. */
+    triggerId?: string;
+    /** The run's answer as Markdown, model output; default none. */
+    result?: string | null;
+    /**
+     * The run's result per culture (`en`, `nl-NL`), as a run whose rules wrote it per culture keeps it:
+     * a reader gets the one of the request's language (exact, then the language), `result` otherwise.
+     */
+    results?: Readonly<Record<string, string>>;
+    /** When the run was queued, ISO 8601; default now. */
+    createdAt?: string;
+    /** How long the run took. Default 30. */
+    durationSeconds?: number;
+    /** Default 0. */
+    proposalCount?: number;
+    /** Default 0. */
+    toolCalls?: number;
+    /** Default 0. */
+    tokens?: number;
+    /** The run worked in the agent's shadow thread. Default `false`. */
+    shadow?: boolean;
+    /** The personal MCP servers the run left out, as the server records them. Default none. */
+    mcpConnectionSkips?: AgentRunMcpSkip[];
+}
+/**
+ * A subject type the application registered with `AddSubjectType`, with its names per language, the
+ * entity it stands for, its link template and the subjects people can find. The mock checks it as
+ * the server checks the registration at startup: a dash-case id outside the reserved `nh-` prefix,
+ * names of 1 to 100 characters with one in the fallback language, and one `{id}` in the link.
+ */
+interface NhAssistantMockSubjectType {
+    id: string;
+    /** Names per culture name, such as `{ en: 'Project', nl: 'Project' }`; without, people see the id. */
+    names?: Record<string, string>;
+    pluralNames?: Record<string, string>;
+    /** Default `en`. */
+    fallbackLanguage?: string;
+    entityType?: string | null;
+    entityTypeFull?: string | null;
+    /** Link template with exactly one `{id}`, such as `/projects/{id}`. */
+    link?: string | null;
+    subjects?: NhAssistantMockSubject[];
+    /** Whether `GET subjects/{type}/search` finds the subjects by name. Default: when the type has subjects. */
+    searchable?: boolean;
+}
+/**
+ * A group of agents the application registers in code, checked as the server checks it at startup:
+ * a dash-case id of at most 64 characters, a name of 1 to 100 characters per language with one in the
+ * fallback language, and optional descriptions of at most 300 characters the same way.
+ */
+interface NhAssistantMockAgentGroup {
+    id: string;
+    /** Names per culture name, such as `{ en: 'Project management', nl: 'Projectbeheer' }`. */
+    names: Record<string, string>;
+    descriptions?: Record<string, string>;
+    /** Default `en`. */
+    fallbackLanguage?: string;
+    /**
+     * The agents in the group when the mock starts: agents in code join it in code (`InGroup`), agents
+     * created as data as an administrator put them there. Administrators' later choices win.
+     */
+    agentIds?: string[];
+}
 /** The scenario the mock API plays without a back-end. */
 interface NhAssistantMockScenario {
     /** Default `true`. */
@@ -159,6 +399,69 @@ interface NhAssistantMockScenario {
     preferences?: AssistantPreferences;
     admin?: NhAssistantMockAdminScenario;
     collaboration?: NhAssistantMockCollaboration;
+    /**
+     * The application's subject types: the run catalog lists them, next to the platform's `nh-system`
+     * (the whole application, `isSystem`) that the mock always adds as the server does,
+     * `GET subjects/{type}/search` finds their readable subjects and `GET subjects/{type}/{id}/work`
+     * names a subject chosen by id, `nh-system/global` included.
+     */
+    subjectTypes?: NhAssistantMockSubjectType[];
+    /**
+     * The application's divisions: `GET subjects/nh-system/search` finds those the user works in by
+     * name, and the whole application in a division is named after it.
+     */
+    divisions?: NhAssistantMockDivision[];
+    /**
+     * The authorization policies the signed-in user passes: agents' required, run and view policies.
+     * Default: every policy. Without a run policy an agent runs for the whole application for
+     * administrators (`admin.canAdminister`), as the server's administration policy decides.
+     */
+    callerPolicies?: string[];
+    /** What a run by hand does, per agent id; `POST threads/start` and the agents of a subject show it. */
+    runNow?: Record<string, NhAssistantMockRunNow>;
+    /** Runs that happened before the first request, for the run histories and their results. */
+    runs?: NhAssistantMockRun[];
+    /**
+     * The application's groups of agents (`AddAgentGroup`) with the agents that join them in code: the
+     * run catalog lists them, administrators put agents in them and take them out, and `GET boards`
+     * shows their boards.
+     */
+    agentGroups?: NhAssistantMockAgentGroup[];
+    /**
+     * Proposals the agents left, for example ones a run for the whole application placed at projects:
+     * the approval inbox, their thread and their subject's work list them, and people decide them.
+     */
+    proposals?: NhAssistantMockProposal[];
+}
+/**
+ * A proposal an agent left, as the mock serves it; the mock fills what it leaves out. With
+ * `placedBy` a run placed it here from another subject, such as a run for the whole application.
+ */
+interface NhAssistantMockProposal {
+    approvalId: string;
+    agentId: string;
+    subjectType: string;
+    subjectId: string;
+    subjectDisplayName?: string | null;
+    subjectTypeName?: string | null;
+    subjectLink?: string | null;
+    /** The thread the proposal waits in. Default `{approvalId}-thread`. */
+    conversationId?: string;
+    runId?: string | null;
+    toolId: string;
+    presentation?: ApprovalPresentation | null;
+    /** Default `pending`. */
+    status?: AgentProposalStatus;
+    rationale?: string | null;
+    placedBy?: AgentProposalOrigin | null;
+    /**
+     * Whether the signed-in user may decide it. Default `true`. A proposal of the whole application
+     * (`nh-system`) exists only for its approvers who pass the agent's view policy, by default its
+     * required policy: the administrators in the mock; for anybody else it is not found at all.
+     */
+    canDecide?: boolean;
+    /** Why not, when `canDecide` is `false`. Default `assistant-approval-policy-denied`. */
+    reasonCode?: string | null;
 }
 /** One request the mock API received, for assertions in tests. */
 interface NhAssistantMockRequest {
@@ -168,10 +471,28 @@ interface NhAssistantMockRequest {
     body: unknown;
 }
 
+/**
+ * The authorization window of the mock API: instead of a popup at an authorization server it plays
+ * the callback of the started flow right away, as the scenario's `admin.mcpAuthorization` says. It
+ * records the authorization URLs it was asked to show.
+ */
+declare class NhAssistantMockAuthorizationWindow implements NhAssistantMcpAuthorizationWindow {
+    private readonly callback;
+    /** The authorization URLs shown, oldest first. */
+    readonly shown: string[];
+    /** How many windows were closed without finishing, for example because starting failed. */
+    closed: number;
+    constructor(callback: (flowId: string) => NhAssistantMcpAuthorizationOutcome);
+    open(): NhAssistantMcpAuthorizationHandle;
+}
+
 declare const NH_ASSISTANT_MOCK_SCENARIO: InjectionToken<NhAssistantMockScenario>;
 /** Path the mock reports as hub; the mock live service answers it in memory. */
 declare const NH_ASSISTANT_MOCK_HUB_PATH = "/hub/assistant-mock";
-/** One live update of the mock, as the assistant hub would send it. */
+/**
+ * One live update of the mock, as the assistant hub would send it. Agent work for the whole
+ * application (`wholeApplication`) reaches the caller only while a screen watches it, as on the hub.
+ */
 type NhAssistantMockLiveMessage = {
     kind: 'changed';
     data: LiveConversationChanged;
@@ -184,6 +505,10 @@ type NhAssistantMockLiveMessage = {
 } | {
     kind: 'event';
     data: LiveConversationEvent;
+} | {
+    kind: 'agent-work';
+    data: LiveAgentWorkChanged;
+    wholeApplication: boolean;
 };
 /**
  * In-memory implementation of the assistant HTTP API and its event streams. It keeps
@@ -200,8 +525,12 @@ declare class NhAssistantMockBackend {
     private readonly pageContexts;
     private readonly enabledState;
     private readonly admin;
-    private readonly canAdministerState;
     private readonly currentUser;
+    private readonly proposals;
+    private readonly subjects;
+    private readonly agentRuns;
+    private readonly boards;
+    private readonly canAdministerState;
     private readonly members;
     private readonly readPositions;
     private readonly shareTokens;
@@ -211,8 +540,8 @@ declare class NhAssistantMockBackend {
     private sequence;
     /** Requests received so far, oldest first. */
     readonly requests: NhAssistantMockRequest[];
-    readonly enabled: i0.Signal<boolean>;
-    readonly canAdminister: i0.Signal<boolean>;
+    readonly enabled: _angular_core.Signal<boolean>;
+    readonly canAdminister: _angular_core.Signal<boolean>;
     /** Live updates for the mock live service, in the order the hub would send them. */
     readonly live$: Observable<NhAssistantMockLiveMessage>;
     constructor();
@@ -228,6 +557,18 @@ declare class NhAssistantMockBackend {
     setCanAdminister(canAdminister: boolean): void;
     /** Replaces the tools a simulated MCP server lists; the next sync picks them up. */
     setRemoteTools(serverId: string, tools: NhAssistantMockRemoteTool[]): void;
+    /**
+     * The window the assistant components open for MCP authorizations; `provideNhAssistantMockApi`
+     * provides it as `NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW`.
+     */
+    readonly authorizationWindow: NhAssistantMockAuthorizationWindow;
+    /** What the mock authorization window answers next: the person approves, denies or closes it. */
+    setMcpAuthorizationOutcome(outcome: 'approve' | 'deny' | 'cancel'): void;
+    /**
+     * Simulates an OAuth connection that ended outside the application: a refused refresh
+     * (`reauthorization-required`) or another authorization server (`issuer-changed`).
+     */
+    setMcpConnectionStatus(serverId: string, status: 'reauthorization-required' | 'issuer-changed'): void;
     /** A `fetch` implementation that answers the assistant endpoints below `apiBaseUrl`. */
     readonly fetch: (input: string, init: RequestInit) => Promise<Response>;
     private route;
@@ -250,21 +591,42 @@ declare class NhAssistantMockBackend {
     private addMember;
     private removeMember;
     private emitChanged;
+    /**
+     * Announces that the work of an agent changed, as the server does after its runs and proposals:
+     * the work of an object reaches the caller, the work of the whole application only when the caller
+     * passes the agent's view policy, by default its required policy, and only while a screen watches it
+     * (`NhAssistantMockLiveService.watchAgentWork`). The mock runs no agents on its own; call it to show a
+     * screen what a run in the background would change. Runs by hand and decisions announce themselves.
+     */
+    publishAgentWork(change: LiveAgentWorkChanged, agentId: string): void;
     private emitLive;
     private maxParticipants;
+    /** A contract error with the one status the server gives its code. */
     private error;
+    /**
+     * Whether the caller decides the agent's proposals of the whole application: an approver of the whole
+     * application (an administrator in the mock) who passes the agent's view policy, by default its
+     * required policy.
+     */
+    /** Whether the caller passes the agent's view policy, by default its required policy. */
+    private readsApplicationWork;
+    private decidesForApplication;
     private nextId;
+    /** An administration answer about agents with each agent's groups, as the server answers it. */
+    private withGroups;
+    private groupsOf;
     private result;
     private json;
     private empty;
-    static ɵfac: i0.ɵɵFactoryDeclaration<NhAssistantMockBackend, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<NhAssistantMockBackend>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantMockBackend, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<NhAssistantMockBackend>;
 }
 
-type NhAssistantLiveSurface = Pick<NhAssistantLiveService, 'changed$' | 'read$' | 'removed$' | 'events$' | 'agentWork$' | 'resync$' | 'state' | 'connect' | 'stop'>;
+type NhAssistantLiveSurface = Pick<NhAssistantLiveService, 'changed$' | 'read$' | 'removed$' | 'events$' | 'agentWork$' | 'resync$' | 'state' | 'connect' | 'stop' | 'watchAgentWork'>;
 /**
  * Stands in for the SignalR live service: it delivers the mock back-end's live updates in
- * memory, so shared conversations, other tabs and parallel turns behave as with a real hub.
+ * memory, so shared conversations, other tabs and parallel turns behave as with a real hub. The work
+ * of agents for the whole application arrives only while a screen watches it, as on the hub.
  */
 declare class NhAssistantMockLiveService implements NhAssistantLiveSurface {
     private readonly backend;
@@ -272,32 +634,39 @@ declare class NhAssistantMockLiveService implements NhAssistantLiveSurface {
     private readonly readSubject;
     private readonly removedSubject;
     private readonly eventSubject;
+    private readonly agentWorkSubject;
     private readonly resyncSubject;
+    private readonly watchers;
     private readonly stateSignal;
     private subscription?;
     readonly changed$: Observable<LiveConversationChanged>;
     readonly read$: Observable<LiveConversationRead>;
     readonly removed$: Observable<LiveConversationRemoved>;
     readonly events$: Observable<LiveConversationEvent>;
-    /** Agents of the mock never run on their own, so their work never changes. */
+    /** The work of agents that changed: runs by hand, decisions and `NhAssistantMockBackend.publishAgentWork`. */
     readonly agentWork$: Observable<LiveAgentWorkChanged>;
+    /** Whether a screen watches the work of agents for the whole application. */
+    readonly watching: _angular_core.Signal<boolean>;
     readonly resync$: Observable<void>;
-    readonly state: i0.Signal<NhAssistantLiveState>;
+    readonly state: _angular_core.Signal<NhAssistantLiveState>;
     constructor();
     connect(hubPath: string | null): Promise<void>;
+    /** Follows the work of agents for the whole application until the returned function is called. */
+    watchAgentWork(): () => void;
     stop(): Promise<void>;
-    static ɵfac: i0.ɵɵFactoryDeclaration<NhAssistantMockLiveService, never>;
-    static ɵprov: i0.ɵɵInjectableDeclaration<NhAssistantMockLiveService>;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NhAssistantMockLiveService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<NhAssistantMockLiveService>;
 }
 
 /**
  * Replaces the assistant transport with an in-memory back-end that plays `script`.
  * Register it after `provideNhAssistant(...)` in the same injector. Every client feature
  * (status, agents, conversations, streamed turns, approvals, cancellation, sharing, read
- * state and live updates) then works without a server. Inject `NhAssistantMockBackend` to
- * switch the feature flag, simulate a colleague or inspect the received requests.
+ * state, live updates and MCP authorizations) then works without a server. Inject
+ * `NhAssistantMockBackend` to switch the feature flag, simulate a colleague or inspect the
+ * received requests.
  */
 declare function provideNhAssistantMockApi(script: NhAssistantMockScenario): EnvironmentProviders;
 
-export { NH_ASSISTANT_MOCK_HUB_PATH, NH_ASSISTANT_MOCK_SCENARIO, NhAssistantMockBackend, NhAssistantMockLiveService, provideNhAssistantMockApi };
-export type { NhAssistantMockAdminAgent, NhAssistantMockAdminScenario, NhAssistantMockApprovalStep, NhAssistantMockCollaboration, NhAssistantMockErrorStep, NhAssistantMockFailStep, NhAssistantMockLiveMessage, NhAssistantMockMcpServer, NhAssistantMockPerson, NhAssistantMockRemoteTool, NhAssistantMockRequest, NhAssistantMockScenario, NhAssistantMockStep, NhAssistantMockTextStep, NhAssistantMockTiming, NhAssistantMockToolStep, NhAssistantMockTurn };
+export { NH_ASSISTANT_MOCK_HUB_PATH, NH_ASSISTANT_MOCK_SCENARIO, NhAssistantMockAuthorizationWindow, NhAssistantMockBackend, NhAssistantMockLiveService, provideNhAssistantMockApi };
+export type { NhAssistantMockAdminAgent, NhAssistantMockAdminScenario, NhAssistantMockAgentGroup, NhAssistantMockApprovalStep, NhAssistantMockCollaboration, NhAssistantMockConnectionStep, NhAssistantMockDataSkill, NhAssistantMockDataTrigger, NhAssistantMockDivision, NhAssistantMockErrorStep, NhAssistantMockFailStep, NhAssistantMockLiveMessage, NhAssistantMockMcpServer, NhAssistantMockPerson, NhAssistantMockProposal, NhAssistantMockRemoteTool, NhAssistantMockRequest, NhAssistantMockRun, NhAssistantMockRunConfigurationPreset, NhAssistantMockRunNow, NhAssistantMockScenario, NhAssistantMockStep, NhAssistantMockSubject, NhAssistantMockSubjectType, NhAssistantMockTextStep, NhAssistantMockTiming, NhAssistantMockToolStep, NhAssistantMockTurn };