@openbkn/dsh-business-context 0.1.5-rc.1

package/lib/types/business-graph-model.d.ts

@@ -0,0 +1,34 @@
+import type { ProvenanceBusinessElement, ProvenanceBusinessOperation, ProvenanceContextRelation } from './types.js';
+export interface BusinessGraphNode {
+    readonly key: string;
+    readonly element: ProvenanceBusinessElement;
+    readonly operation: ProvenanceBusinessOperation;
+    readonly x: number;
+    readonly y: number;
+}
+export interface BusinessGraphEdge {
+    readonly id: string;
+    readonly name: string;
+    readonly sourceKey: string;
+    readonly targetKey: string;
+    readonly source: BusinessGraphNode;
+    readonly target: BusinessGraphNode;
+}
+export interface BusinessGraphModel {
+    readonly nodes: readonly BusinessGraphNode[];
+    readonly edges: readonly BusinessGraphEdge[];
+    /** Formal relations whose endpoints were not disclosed as resolved objects. */
+    readonly unresolvedRelations: readonly ProvenanceContextRelation[];
+    readonly width: number;
+    readonly height: number;
+}
+/**
+ * Builds a deterministic display model from the Enterprise projection only.
+ * Missing relation endpoints stay unresolved; the client never invents nodes.
+ */
+export declare function buildBusinessGraphModel(operations: readonly ProvenanceBusinessOperation[], relations: readonly ProvenanceContextRelation[]): BusinessGraphModel;
+export declare const businessGraphGeometry: {
+    readonly nodeWidth: 180;
+    readonly nodeHeight: 86;
+};
+//# sourceMappingURL=business-graph-model.d.ts.map

package/lib/types/business-network-catalog.d.ts

@@ -0,0 +1,8 @@
+import type { BusinessNetworkSummary } from './types.js';
+/**
+ * Convert one platform response into the bounded data shape consumed by the
+ * network selector. The platform remains the authorization authority; this
+ * function only removes unneeded fields and rejects malformed rows.
+ */
+export declare function parseVisibleBusinessNetworks(value: unknown): readonly BusinessNetworkSummary[];
+//# sourceMappingURL=business-network-catalog.d.ts.map

package/lib/types/client/BoundNetworkBadge.d.ts

@@ -0,0 +1,37 @@
+import type { InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import type { BusinessNetworkBinding } from '../types.ts';
+export interface BoundNetworkBadgeInjected {
+    hooks: {
+        binding: BoundNetworkController;
+    };
+    load(): Promise<void>;
+}
+export type BoundNetworkBadgeProps = PropsRuntime<'conversation.session.header.actions'> & InjectFace<BoundNetworkBadgeInjected>;
+/** Read-only session-header label; changing networks requires a new DSH session. */
+export declare function BoundNetworkBadge({ useBinding, load }: BoundNetworkBadgeProps): import("react").JSX.Element | null;
+export type BoundNetworkBadgeState = {
+    readonly kind: 'idle';
+} | {
+    readonly kind: 'bound';
+    readonly binding: BusinessNetworkBinding;
+} | {
+    readonly kind: 'absent';
+};
+/** One Session's safe binding read, expressed in DSH's HostObservable currency. */
+export declare class BoundNetworkController {
+    private readonly read;
+    /** Retry delay for "agent not live yet" reads; injectable for deterministic tests. */
+    private readonly retryDelayMs;
+    private readonly maxRetries;
+    private state;
+    private readonly listeners;
+    private retries;
+    constructor(read: () => Promise<BusinessNetworkBinding | undefined>, 
+    /** Retry delay for "agent not live yet" reads; injectable for deterministic tests. */
+    retryDelayMs?: number, maxRetries?: number);
+    getSnapshot(): BoundNetworkBadgeState;
+    subscribe(listener: () => void): () => void;
+    load(): Promise<void>;
+    private publish;
+}
+//# sourceMappingURL=BoundNetworkBadge.d.ts.map

package/lib/types/client/OpenBknContextToolView.d.ts

@@ -0,0 +1,4 @@
+import type { ToolCallViewProps } from '@deepseek-ai/dsh-client-ui-tool/client';
+/** Safe replacement for the generic raw-output row of the fixed OpenBKN context tool. */
+export declare function OpenBknContextToolView({ block }: ToolCallViewProps): import("react").JSX.Element;
+//# sourceMappingURL=OpenBknContextToolView.d.ts.map

package/lib/types/client/OpenBknEntry.d.ts

@@ -0,0 +1,9 @@
+import type { SessionId } from '@deepseek-ai/dsh-api-remotes/client';
+import type { InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+export interface OpenBknEntryInjected {
+    open(sessionId?: SessionId): void;
+}
+export type OpenBknEntryProps = PropsRuntime<'sidebar.footer.action'> & InjectFace<OpenBknEntryInjected>;
+/** Additive sidebar-footer entry; the native DSH sidebar continues to own its shell. */
+export declare function OpenBknEntry({ wide, useSessions, open }: OpenBknEntryProps): import("react").JSX.Element;
+//# sourceMappingURL=OpenBknEntry.d.ts.map

package/lib/types/client/OpenBknOverlay.d.ts

@@ -0,0 +1,16 @@
+import type { InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import type { OpenBknUiController } from './openbkn-ui-controller.ts';
+export interface OpenBknOverlayInjected {
+    hooks: {
+        ui: OpenBknUiController;
+    };
+    close(): void;
+    refresh(): Promise<void>;
+    beginLogin(): Promise<void>;
+    configureToken(token: string): Promise<void>;
+    openNetwork(networkId: string, mode: 'continue' | 'new' | 'create-workspace'): Promise<void>;
+}
+export type OpenBknOverlayProps = PropsRuntime<'shell.overlay'> & InjectFace<OpenBknOverlayInjected>;
+/** Frame-wide, additive OpenBKN control plane. It is intentionally outside DSH chat scroll containers. */
+export declare function OpenBknOverlay({ useUi, close, refresh, beginLogin, configureToken, openNetwork }: OpenBknOverlayProps): import("react").JSX.Element | null;
+//# sourceMappingURL=OpenBknOverlay.d.ts.map

package/lib/types/client/ProvenanceOverlay.d.ts

@@ -0,0 +1,33 @@
+import type { HostObservable, InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import type { ProvenanceHandle, ProvenanceView } from '../types.ts';
+export interface ProvenanceOverlayState {
+    readonly sessionId?: string;
+    readonly messageId?: string;
+    readonly handle?: ProvenanceHandle;
+}
+interface FocusTarget {
+    focus(): void;
+}
+/** Global overlay state remains outside the transcript and its native scroll container. */
+export declare class ProvenanceOverlayController implements HostObservable<ProvenanceOverlayState> {
+    private state;
+    private readonly listeners;
+    private restoreFocus;
+    getSnapshot: () => ProvenanceOverlayState;
+    subscribe: (listener: () => void) => (() => void);
+    open(sessionId: string, messageId: string, handle: ProvenanceHandle, restoreFocus?: FocusTarget): void;
+    close(): void;
+    private publish;
+}
+export interface ProvenanceOverlayInjected {
+    hooks: {
+        provenanceOverlay: ProvenanceOverlayController;
+    };
+    load(sessionId: string, messageId: string): Promise<ProvenanceView | undefined>;
+    close(): void;
+}
+export type ProvenanceOverlayProps = PropsRuntime<'shell.overlay'> & InjectFace<ProvenanceOverlayInjected>;
+/** Provenance detail lives in an additive shell overlay, never inline in DSH chat. */
+export declare function ProvenanceOverlay({ useProvenanceOverlay, load, close }: ProvenanceOverlayProps): import("react").JSX.Element | null;
+export {};
+//# sourceMappingURL=ProvenanceOverlay.d.ts.map

package/lib/types/client/SuggestionDock.d.ts

@@ -0,0 +1,12 @@
+import type { HostObservable, InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+export interface SuggestionDockInjected {
+    hooks: {
+        suggestions: HostObservable<readonly string[]>;
+    };
+    load(): Promise<void>;
+    setDraft(prompt: string): void;
+}
+export type SuggestionDockProps = PropsRuntime<'conversation.input.dock'> & InjectFace<SuggestionDockInjected>;
+/** One bound-network empty-session entry; clicking only fills DSH's native draft. */
+export declare function SuggestionDock({ useSuggestions, load, setDraft }: SuggestionDockProps): import("react").JSX.Element | null;
+//# sourceMappingURL=SuggestionDock.d.ts.map

package/lib/types/client/TurnProvenanceActions.d.ts

@@ -0,0 +1,13 @@
+import type { HostObservable, InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import type { ProvenanceHandle } from '../types.ts';
+export interface TurnProvenanceActionsInjected {
+    hooks: {
+        provenance: HostObservable<ReadonlyMap<string, ProvenanceHandle>>;
+    };
+    load(messageId: string): Promise<void>;
+    open(messageId: string, handle: ProvenanceHandle, restoreFocus: HTMLElement): void;
+}
+export type TurnProvenanceActionsProps = PropsRuntime<'conversation.chat.assistant-actions'> & InjectFace<TurnProvenanceActionsInjected>;
+/** One compact, native action-row entry for a finalized message with real OpenBKN provenance. */
+export declare function TurnProvenanceActions({ messageId, useProvenance, load, open }: TurnProvenanceActionsProps): import("react").JSX.Element | null;
+//# sourceMappingURL=TurnProvenanceActions.d.ts.map

package/lib/types/client/index.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Browser-side Cordis identity. */
+export declare const name = "openbkn-business-context-client";
+/**
+ * Reserves an additive browser entry without taking ownership of any DSH
+ * shell, conversation, composer, or scrolling surface.
+ */
+export declare const inject: string[];
+/** Mount the generated Remote boundary before registering additive DSH UI slots. */
+export declare function apply(ctx: Context): Promise<() => Promise<void>>;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/client/network-directory.d.ts

@@ -0,0 +1,13 @@
+import type { BusinessNetworkSummary } from '../types.ts';
+export declare const INITIAL_NETWORK_DIRECTORY_LIMIT = 20;
+export interface NetworkDirectorySelection {
+    readonly networks: readonly BusinessNetworkSummary[];
+    readonly total: number;
+    readonly hasMore: boolean;
+}
+/**
+ * Pure browser-side presentation over the already-authorized catalogue. It
+ * neither broadens visibility nor changes the stable Host catalogue itself.
+ */
+export declare function selectNetworkDirectory(networks: readonly BusinessNetworkSummary[], query: string, limit?: number): NetworkDirectorySelection;
+//# sourceMappingURL=network-directory.d.ts.map

package/lib/types/client/openbkn-ui-controller.d.ts

@@ -0,0 +1,51 @@
+import type { AuthSnapshot, BusinessNetworkBinding, BusinessNetworkSummary } from '../types.ts';
+/** Minimal browser-safe port over the generated OpenBKN Remote contract. */
+export interface OpenBknUiPort {
+    status(signal?: AbortSignal): Promise<AuthSnapshot>;
+    beginLogin(signal?: AbortSignal): Promise<readonly BusinessNetworkSummary[]>;
+    configureToken(token: string, signal?: AbortSignal): Promise<readonly BusinessNetworkSummary[]>;
+    listNetworks(signal?: AbortSignal): Promise<readonly BusinessNetworkSummary[]>;
+    bindNetworkWorkspace(networkId: string, workspacePath: string, signal?: AbortSignal): Promise<BusinessNetworkSummary>;
+    bindNetwork(sessionId: string, networkId: string, signal?: AbortSignal): Promise<BusinessNetworkBinding>;
+}
+export type NetworkSessionMode = 'continue' | 'new' | 'create-workspace';
+export type OpenNetworkSession = (network: BusinessNetworkSummary, mode: NetworkSessionMode) => Promise<string>;
+export type OpenBknOverlayPhase = 'idle' | 'loading' | 'authentication-required' | 'ready' | 'binding' | 'error';
+/** Render state for the additive OpenBKN overlay; credentials never enter it. */
+export interface OpenBknOverlayState {
+    readonly open: boolean;
+    readonly phase: OpenBknOverlayPhase;
+    readonly auth?: AuthSnapshot;
+    readonly networks: readonly BusinessNetworkSummary[];
+    readonly message?: string;
+}
+type Listener = () => void;
+/**
+ * Keeps Remote calls and their transient UI state outside React components.
+ * The controller intentionally knows only a selected session ID and safe
+ * catalogue summaries; Host code remains authoritative for authentication,
+ * visibility and durable binding.
+ */
+export declare class OpenBknUiController {
+    private readonly port;
+    private readonly openNetworkSession;
+    private readonly refreshBoundSession?;
+    private state;
+    private readonly listeners;
+    constructor(port: OpenBknUiPort, openNetworkSession: OpenNetworkSession, refreshBoundSession?: ((sessionId: string) => void) | undefined);
+    snapshot(): OpenBknOverlayState;
+    /** Slot-renderer observable contract; kept alongside `snapshot()` for tests and callers. */
+    getSnapshot(): OpenBknOverlayState;
+    subscribe(listener: Listener): () => void;
+    open(): void;
+    close(): void;
+    refresh(signal?: AbortSignal): Promise<void>;
+    /** Save and test a token without retaining it in controller state. */
+    configureToken(token: string): Promise<void>;
+    /** Run the Host-only OpenBKN CLI login, then present its verified catalogue. */
+    beginLogin(signal?: AbortSignal): Promise<void>;
+    openNetwork(networkId: string, mode: NetworkSessionMode, signal?: AbortSignal): Promise<void>;
+    private publish;
+}
+export {};
+//# sourceMappingURL=openbkn-ui-controller.d.ts.map

package/lib/types/client/suggestion-dock-controller.d.ts

@@ -0,0 +1,22 @@
+import type { HostObservable } from '@deepseek-ai/dsh-client-ui-slots';
+/** Per-session, browser-local cache of the Host-resolved empty-session entry. */
+export declare class SuggestionDockController implements HostObservable<readonly string[]> {
+    private readonly read;
+    private prompts;
+    private readonly listeners;
+    private revision;
+    constructor(read: () => Promise<readonly string[]>);
+    getSnapshot: () => readonly string[];
+    subscribe: (listener: () => void) => (() => void);
+    load(): Promise<void>;
+    /** Hide the entry as soon as the native DSH turn starts. */
+    beginTurn(): void;
+    /** Reload after a session binding is established. */
+    refresh(): Promise<void>;
+    private publish;
+}
+/** The entry is relevant only before the first native DSH turn. */
+export declare function synchronizeSuggestionDockForEvents(controller: Pick<SuggestionDockController, 'beginTurn' | 'refresh'>, events: readonly {
+    readonly type: string;
+}[]): void;
+//# sourceMappingURL=suggestion-dock-controller.d.ts.map

package/lib/types/client/turn-provenance-controller.d.ts

@@ -0,0 +1,14 @@
+import type { HostObservable } from '@deepseek-ai/dsh-client-ui-slots';
+import type { ProvenanceHandle } from '../types.ts';
+/** Browser-local cache of the Host-committed provenance for finalized assistant messages. */
+export declare class TurnProvenanceController implements HostObservable<ReadonlyMap<string, ProvenanceHandle>> {
+    private readonly read;
+    private view;
+    private readonly listeners;
+    constructor(read: (messageId: string) => Promise<ProvenanceHandle | undefined>);
+    getSnapshot: () => ReadonlyMap<string, ProvenanceHandle>;
+    subscribe: (listener: () => void) => (() => void);
+    /** Read once per mounted message; a transient failure never erases a committed handle. */
+    load(messageId: string): Promise<void>;
+}
+//# sourceMappingURL=turn-provenance-controller.d.ts.map

package/lib/types/config.d.ts

@@ -0,0 +1,30 @@
+import Schema from '@deepseek-ai/schemastery';
+/** Deployment settings that are safe to keep in a DSH configuration patch. */
+export interface Config {
+    /** OpenBKN platform base URL; credentials stay exclusively in DSH credentials. */
+    baseUrl: string;
+    /** Optional Context Loader MCP endpoint; defaults to the standard platform route. */
+    mcpUrl?: string;
+    /** Optional OpenBKN business domain used to constrain platform requests. */
+    businessDomain?: string;
+    /** Absolute path to the OpenBKN CLI used only for the Host login/token handshake. */
+    cliPath: string;
+    /** Upper bound for one OpenBKN request. */
+    requestTimeoutMs: number;
+    /** Maximum result payload admitted into DSH context. */
+    maxResultBytes: number;
+    /** Maximum business-context graph node count rendered for one turn. */
+    maxGraphNodes: number;
+    /** Maximum business-context graph edge count rendered for one turn. */
+    maxGraphEdges: number;
+    /**
+     * Explicit opt-in only; disabled by default for local production use.
+     * Allows plaintext http to non-loopback hosts — it does NOT relax TLS
+     * certificate validation (self-signed certs are handled by the Node trust
+     * store, e.g. NODE_EXTRA_CA_CERTS, not by this switch).
+     */
+    allowInsecureTls: boolean;
+}
+/** Runtime schema and conservative defaults for the host plugin row. */
+export declare const Config: Schema<Config>;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/dsh-session-binding.d.ts

@@ -0,0 +1,26 @@
+import type { SessionEventMap } from '@deepseek-ai/dsh-session/types';
+import { BUSINESS_NETWORK_BOUND_EVENT, type BindBusinessNetworkResult, type BusinessNetworkBinding, type SessionEventLike } from './session-binding.js';
+declare module '@deepseek-ai/dsh-session/types' {
+    interface SessionEventMap {
+        /** Immutable OpenBKN business-network identity selected for this DSH session. */
+        'openbkn/business-network-bound': BusinessNetworkBinding;
+    }
+}
+/** The small real-DSH Session capability surface needed for durable binding. */
+export interface DshSessionLog {
+    snapshotEvents(): readonly SessionEventLike[];
+}
+/** DSH Session capability surface needed when a new binding is persisted. */
+export interface DshSessionBindingLog extends DshSessionLog {
+    append(type: typeof BUSINESS_NETWORK_BOUND_EVENT, data: SessionEventMap[typeof BUSINESS_NETWORK_BOUND_EVENT], options?: {
+        readonly ignorable?: true;
+    }): void;
+}
+/** Recover the binding directly from DSH's append-only session log. */
+export declare function readDshSessionBusinessNetwork(session: DshSessionLog): BusinessNetworkBinding | undefined;
+/**
+ * Persist the selected business network as the one DSH session event. No
+ * side-store is created; reselecting the same network is idempotent.
+ */
+export declare function bindDshSessionBusinessNetwork(session: DshSessionBindingLog, requested: BusinessNetworkBinding): BindBusinessNetworkResult;
+//# sourceMappingURL=dsh-session-binding.d.ts.map

package/lib/types/dsh-session-provenance.d.ts

@@ -0,0 +1,27 @@
+import type { SessionEventMap } from '@deepseek-ai/dsh-session/types';
+import { TURN_PROVENANCE_EVENT, type TurnProvenanceEvent } from './turn-provenance.js';
+import type { ProvenanceHandle } from './types.js';
+declare module '@deepseek-ai/dsh-session/types' {
+    interface SessionEventMap {
+        /** Immutable OpenBKN references for one finalized assistant message. */
+        'openbkn/turn-provenance': TurnProvenanceEvent['data'];
+    }
+}
+/** Minimal real-DSH session surface required to read assistant-turn provenance. */
+export interface DshSessionProvenanceLog {
+    snapshotEvents(): readonly {
+        readonly type: string;
+        readonly data: unknown;
+    }[];
+}
+/** Real-DSH session surface used when a completed turn is committed. */
+export interface DshSessionProvenanceWriter extends DshSessionProvenanceLog {
+    append(type: typeof TURN_PROVENANCE_EVENT, data: SessionEventMap[typeof TURN_PROVENANCE_EVENT], options?: {
+        readonly ignorable?: true;
+    }): void;
+}
+/** Read one message's committed provenance directly from the append-only DSH log. */
+export declare function readDshSessionTurnProvenance(session: DshSessionProvenanceLog, messageId: string): ProvenanceHandle | undefined;
+/** Append a completed-turn handle once; identical retries are intentionally idempotent. */
+export declare function appendDshSessionTurnProvenance(session: DshSessionProvenanceWriter, messageId: string, handle: ProvenanceHandle): void;
+//# sourceMappingURL=dsh-session-provenance.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,33 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { Config as ConfigSchema, type Config as PluginConfig } from './config.js';
+export { ConfigSchema as Config };
+export type { PluginConfig };
+export { AuthCoordinator, OpenBknCliError } from './auth.js';
+export type { AuthSnapshot, CliResult, OpenBknCli } from './auth.js';
+export { BUSINESS_NETWORK_BOUND_EVENT, bindBusinessNetwork, BusinessNetworkBindingConflictError, readBusinessNetworkBinding, } from './session-binding.js';
+export type { BindBusinessNetworkResult, BusinessNetworkBinding, BusinessNetworkBoundEvent, SessionEventLike, } from './session-binding.js';
+export { bindDshSessionBusinessNetwork, readDshSessionBusinessNetwork } from './dsh-session-binding.js';
+export type { DshSessionBindingLog, DshSessionLog } from './dsh-session-binding.js';
+export { appendDshSessionTurnProvenance, readDshSessionTurnProvenance } from './dsh-session-provenance.js';
+export type { DshSessionProvenanceLog, DshSessionProvenanceWriter } from './dsh-session-provenance.js';
+export { TURN_PROVENANCE_EVENT, TurnProvenanceConflictError, appendTurnProvenance, readTurnProvenance } from './turn-provenance.js';
+export type { TurnProvenanceEvent } from './turn-provenance.js';
+export { normalizeProvenanceHandle } from './provenance-handle.js';
+export type { ProvenanceHandle } from './types.js';
+export { emptyBusinessSessionPrompt } from './suggested-prompts.js';
+export { buildManagedSessionPolicy, OPENBKN_DSH_INTERACTION_AGENT_NAME } from './managed-session-policy.js';
+export type { ManagedSessionPolicy } from './managed-session-policy.js';
+export { buildNetworkCapabilityProfile } from './network-capability-profile.js';
+export type { NetworkCapabilityProfile } from './network-capability-profile.js';
+export { OpenBknPlatformReader, PlatformReaderError } from './platform-reader.js';
+export type { PlatformFetch, PlatformReaderConfig, PlatformReaderErrorCode } from './platform-reader.js';
+export { OpenBknBusinessContextService } from './business-context-service.js';
+export { OpenBknWorkspaceBindingRegistry, workspaceBindingKey, workspaceBindingRecord } from './workspace-binding-registry.js';
+export type { WorkspaceBindingRecord } from './workspace-binding-registry.js';
+export { mountBoundBusinessNetworkTool } from './scoped-business-context.js';
+/** Cordis identity used by the bundle's Host row. */
+export declare const name = "openbkn-business-context";
+export declare const inject: string[];
+/** Register the host service; it contributes no model-visible tool globally. */
+export declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/interaction-references.d.ts

@@ -0,0 +1,15 @@
+/** Minimal identifiers explicitly disclosed by an OpenBKN interaction response. */
+export interface InteractionReferences {
+    readonly interactionId: string;
+    /** Operation ids are for execution presentation only; they are never request or Trace ids. */
+    readonly operationIds: readonly string[];
+}
+/**
+ * Recover only identifiers that the platform response explicitly labels.
+ *
+ * In particular, this deliberately does not inspect nested operation payloads:
+ * old POC responses may contain arbitrary MCP output, while a future platform
+ * contract can add request, Trace, and receipt ids to the provenance handle.
+ */
+export declare function extractInteractionReferences(value: unknown): InteractionReferences | undefined;
+//# sourceMappingURL=interaction-references.d.ts.map

package/lib/types/managed-session-policy.d.ts

@@ -0,0 +1,18 @@
+import type { NetworkCapabilityProfile } from './network-capability-profile.js';
+import type { BusinessNetworkBinding } from './types.js';
+export interface ManagedSessionPolicy {
+    readonly governance: string;
+    readonly capabilities: string;
+}
+/**
+ * Stable lifecycle identity written by OpenBKN Trace for this plugin surface.
+ * It is not a user, workspace, model, or knowledge-network identifier.
+ */
+export declare const OPENBKN_DSH_INTERACTION_AGENT_NAME = "bkn-agent-dsh-business-context";
+/**
+ * Produce the two scoped system-prompt sections for one bound network. The
+ * fixed section renders the Host-verified identity as quoted data; the optional
+ * profile remains a projection rather than a copy of platform metadata.
+ */
+export declare function buildManagedSessionPolicy(binding: BusinessNetworkBinding, profile?: NetworkCapabilityProfile): ManagedSessionPolicy;
+//# sourceMappingURL=managed-session-policy.d.ts.map

package/lib/types/native-mcp-provenance.d.ts

@@ -0,0 +1,17 @@
+import type { ProvenanceHandle } from './types.js';
+interface EventLike {
+    readonly type: string;
+    readonly data: unknown;
+}
+export interface NativeMcpTurnProvenance {
+    readonly messageId: string;
+    readonly handle: ProvenanceHandle;
+}
+/**
+ * Recover provenance only from a completed interaction explicitly returned by
+ * the OpenBKN MCP finish call in the same DSH turn. No model text, tool args,
+ * or unrelated MCP output participates in this association.
+ */
+export declare function findCompletedNativeMcpProvenance(events: readonly EventLike[], turn: number): NativeMcpTurnProvenance | undefined;
+export {};
+//# sourceMappingURL=native-mcp-provenance.d.ts.map

package/lib/types/network-capability-profile.d.ts

@@ -0,0 +1,26 @@
+import type { BusinessNetworkBinding } from './types.js';
+export interface NetworkCapabilityProfile {
+    readonly schemaVersion: 1;
+    readonly profileVersion: string;
+    readonly knowledgeNetworkId: string;
+    readonly conceptGroups: readonly NamedCapability[];
+    readonly objectTypes: readonly NamedCapability[];
+    readonly relationTypes: readonly RelationCapability[];
+    readonly actionTypes: readonly NamedCapability[];
+}
+export interface NamedCapability {
+    readonly id: string;
+    readonly name?: string;
+}
+export interface RelationCapability {
+    readonly id: string;
+    readonly sourceObjectTypeId: string;
+    readonly targetObjectTypeId: string;
+}
+/**
+ * Project the platform summary into the small, non-instructional index the
+ * managed-session policy may expose to an Agent. The original platform payload
+ * is deliberately not retained.
+ */
+export declare function buildNetworkCapabilityProfile(binding: BusinessNetworkBinding, payload: unknown): NetworkCapabilityProfile;
+//# sourceMappingURL=network-capability-profile.d.ts.map

package/lib/types/openbkn-cli-subprocess.d.ts

@@ -0,0 +1,50 @@
+import type { CliResult, OpenBknCli } from './auth.js';
+/** Structural subset of DSH subprocess used for the fixed OpenBKN CLI contract. */
+export interface CliSubprocess {
+    spawn(spec: {
+        readonly argv: readonly string[];
+        readonly cwd: string;
+        readonly stdio: {
+            readonly stdin: {
+                readonly data: string;
+            };
+            readonly stdout: {
+                readonly maxBytes: number;
+            };
+            readonly stderr: {
+                readonly maxBytes: number;
+            };
+        };
+        readonly graceMs: number;
+        readonly signal?: AbortSignal;
+    }): {
+        readonly done: Promise<{
+            readonly exitCode: number | null;
+        }>;
+        readonly collected: {
+            readonly stdout?: {
+                readFrom(fromByte: number): {
+                    readonly text: string;
+                    readonly lossy: boolean;
+                };
+            };
+            readonly stderr?: {
+                readFrom(fromByte: number): {
+                    readonly text: string;
+                    readonly lossy: boolean;
+                };
+            };
+        };
+    };
+}
+/** DSH-managed invocation of the OpenBKN CLI with a fixed authentication contract. */
+export declare class OpenBknCliSubprocess implements OpenBknCli {
+    private readonly subprocess;
+    private readonly cwd;
+    private readonly cliPath;
+    private readonly baseUrl;
+    constructor(subprocess: CliSubprocess, cwd: string, baseUrl: string, cliPath?: string);
+    run(args: readonly string[], signal?: AbortSignal): Promise<CliResult>;
+    private resolveArgv;
+}
+//# sourceMappingURL=openbkn-cli-subprocess.d.ts.map

package/lib/types/openbkn-mcp-manager.d.ts

@@ -0,0 +1,32 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Config } from './config.js';
+export declare const OPENBKN_MCP_TOKEN_REF = "OPENBKN_MCP_TOKEN";
+/**
+ * Mounts the standard DSH MCP client once the user has stored an OpenBKN
+ * token. It resolves the credential immediately before mounting, and passes it
+ * only to the in-memory standard MCP client configuration. An explicitly configured client with the same public tool
+ * namespace is treated as the deployment-owned instance.
+ */
+export declare class OpenBknMcpManager {
+    private readonly ctx;
+    private readonly config;
+    private readonly resolveToken;
+    private starting;
+    private fiber;
+    constructor(ctx: Context, config: Config, resolveToken: () => Promise<string | undefined>);
+    private reloading;
+    ensure(): Promise<void>;
+    private ensureMounted;
+    /** Reconnect the client after DSH rotates the managed credential. */
+    refresh(): Promise<void>;
+    private start;
+}
+/**
+ * Resolve the stable Context Loader endpoint from the deployment platform URL.
+ * An explicitly configured mcpUrl gets the same scheme fence as the control
+ * plane plus an origin fence: the Bearer token mounted on this client may
+ * only ever be sent to the configured platform (or an explicitly allowed
+ * plaintext loopback), never to an arbitrary host.
+ */
+export declare function resolveMcpUrl(config: Pick<Config, 'baseUrl' | 'mcpUrl' | 'allowInsecureTls'>): string;
+//# sourceMappingURL=openbkn-mcp-manager.d.ts.map

package/lib/types/platform-reader.d.ts

@@ -0,0 +1,51 @@
+import type { JsonValue } from '@deepseek-ai/dsh-util-values';
+import type { BusinessNetworkBinding } from './session-binding.js';
+export type PlatformReaderErrorCode = 'AUTHENTICATION_REQUIRED' | 'LICENSE_REQUIRED' | 'PLATFORM_MISMATCH' | 'PLATFORM_UNAVAILABLE' | 'REQUEST_ABORTED' | 'OUTPUT_OVERFLOW' | 'INVALID_RESPONSE';
+/** A bounded Host-side error. It never includes platform response bodies. */
+export declare class PlatformReaderError extends Error {
+    readonly code: PlatformReaderErrorCode;
+    constructor(code: PlatformReaderErrorCode, message: string, options?: ErrorOptions);
+}
+export interface PlatformReaderConfig {
+    readonly baseUrl: string;
+    readonly requestTimeoutMs: number;
+    /** Maximum projected payload sent from Host to the DSH browser. */
+    readonly maxResultBytes: number;
+    readonly allowInsecureTls: boolean;
+    /** Business domain header sent on platform requests; defaults to the platform default `bd_public`. */
+    readonly businessDomain?: string;
+    readonly resolveToken?: () => Promise<string | undefined>;
+}
+export type PlatformFetch = (input: URL, init: RequestInit) => Promise<Response>;
+/**
+ * A fixed-route Host reader for plugin control-plane data. It is deliberately
+ * separate from the model path: agents use Context Loader MCP; this reader
+ * only obtains the catalog, schema profile, and safe Trace projections.
+ */
+export declare class OpenBknPlatformReader {
+    private readonly config;
+    private readonly fetcher;
+    constructor(config: PlatformReaderConfig, fetcher?: PlatformFetch);
+    listKnowledgeNetworks(signal: AbortSignal, _cwd?: string): Promise<JsonValue>;
+    getKnowledgeNetworkDetail(binding: BusinessNetworkBinding, signal: AbortSignal, _cwd?: string): Promise<JsonValue>;
+    getInteractionOperations(interactionId: string, signal: AbortSignal, _cwd?: string): Promise<JsonValue>;
+    getInteractionBusinessGraph(interactionId: string, signal: AbortSignal, _cwd?: string): Promise<JsonValue>;
+    /** Resolve the deployment's license edition so license-gated failures can explain themselves. */
+    getLicenseEdition(signal: AbortSignal): Promise<{
+        edition?: string;
+        licensed?: boolean;
+    } | undefined>;
+    private get;
+    private post;
+    private request;
+    private admit;
+}
+/** Hosts for which plaintext http is tolerated regardless of the insecure switch. */
+export declare function isLoopbackHost(hostname: string): boolean;
+/**
+ * Scheme fence shared by every outbound OpenBKN path so the Bearer token can
+ * never be configured onto a plaintext or unexpected endpoint: https is
+ * required outside loopback unless plaintext was explicitly allowed.
+ */
+export declare function assertHttpsEndpoint(url: URL, allowPlaintext: boolean): void;
+//# sourceMappingURL=platform-reader.d.ts.map

package/lib/types/provenance-handle.d.ts

@@ -0,0 +1,5 @@
+import type { ProvenanceHandle } from './types.js';
+export type { ProvenanceHandle } from './types.js';
+/** Validate untrusted platform metadata before it becomes a Client-visible provenance reference. */
+export declare function normalizeProvenanceHandle(value: unknown): ProvenanceHandle;
+//# sourceMappingURL=provenance-handle.d.ts.map