@opengeni/api-router 0.12.12 → 0.14.3

package/dist/codex-redemption-security.d.ts

@@ -0,0 +1,15 @@
+type CodexRedemptionConfirmationClaims = {
+    version: 1;
+    attemptId: string;
+    workspaceId: string;
+    credentialId: string;
+    creditId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    expiresAt: number;
+};
+export declare function hashCodexBrowserSession(sessionId: string): Promise<string>;
+/** Five-minute, session-bound, HMAC-confirmed browser mutation token. */
+export declare function signCodexRedemptionConfirmation(secret: string, claims: CodexRedemptionConfirmationClaims): Promise<string>;
+export declare function verifyCodexRedemptionConfirmation(secret: string, token: string, now?: number): Promise<CodexRedemptionConfirmationClaims | null>;
+export type { CodexRedemptionConfirmationClaims };

package/dist/github-access.d.ts

@@ -0,0 +1,12 @@
+import type { GitHubBindingStatus, GitHubInstallationBinding, GitHubRepository } from "@opengeni/contracts";
+import { listGitHubInstallationAccessForWorkspace } from "@opengeni/db";
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare function listWorkspaceGitHubInstallationBindings(deps: ApiRouteDeps, workspaceId: string): Promise<GitHubInstallationBinding[]>;
+export declare function githubBindingStatus(configured: boolean, installations: GitHubInstallationBinding[]): GitHubBindingStatus;
+export type LiveGitHubInstallation = {
+    installationId: number;
+    accountId: number;
+    suspended: boolean;
+};
+export declare function githubInstallationBindingLifecycle(stored: Awaited<ReturnType<typeof listGitHubInstallationAccessForWorkspace>>[number], liveById: Map<number, LiveGitHubInstallation | null>, installationId: number, lifecycleVerified: boolean): GitHubInstallationBinding["lifecycle"];
+export declare function listWorkspaceGitHubRepositories(deps: ApiRouteDeps, workspaceId: string): Promise<GitHubRepository[]>;

package/dist/github-browser-flow.d.ts

@@ -0,0 +1,14 @@
+import type { Settings } from "@opengeni/config";
+import type { AccessGrant } from "@opengeni/contracts";
+import type { GitHubSignedStatePayload } from "@opengeni/github";
+/**
+ * Bounded configured-token browser handoff. These signed claims preserve only
+ * the exact OpenGeni github:manage grant across GitHub redirects; the callback
+ * independently proves current GitHub personal/organization ownership. This
+ * state must never be interpreted as GitHub installation authority.
+ */
+export declare const githubBrowserGrantMaxAgeSeconds: number;
+export declare function githubBrowserGrantClaims(settings: Pick<Settings, "productAccessMode">, grant: AccessGrant, nowSeconds?: number): Record<string, unknown>;
+export declare function continuedGitHubBrowserGrantClaims(payload: GitHubSignedStatePayload): Record<string, unknown>;
+export declare function githubBrowserGrantFromState(settings: Pick<Settings, "productAccessMode">, payload: GitHubSignedStatePayload, workspaceId: string, nowSeconds?: number): AccessGrant | null;
+export declare function githubBrowserBaseUrl(settings: Pick<Settings, "githubAppManifestBaseUrl" | "publicBaseUrl">, requestOrigin?: string | null): string;

package/dist/http/auth.d.ts

@@ -0,0 +1,3 @@
+import type { Settings } from "@opengeni/config";
+import type { MiddlewareHandler } from "hono";
+export declare function requireAccessKey(settings: Settings): MiddlewareHandler;

package/dist/http/common.d.ts

@@ -0,0 +1,3 @@
+import { type Database } from "@opengeni/db";
+export declare function boundedLimit(raw: string | undefined): number;
+export declare function assertSessionExists(db: Database, workspaceId: string, sessionId: string): Promise<void>;

package/dist/http/sse.d.ts

@@ -0,0 +1,70 @@
+import type { SessionEvent } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type EventBus } from "@opengeni/events";
+import type { Observability } from "@opengeni/observability";
+export declare const SSE_QUEUED_FRAME_MAX_COUNT = 1;
+export declare const SSE_WRITE_STALL_TIMEOUT_MS = 30000;
+export type SseDeliveryBoundObservation = {
+    reason: "desired_size_non_positive" | "stall_timeout" | "frame_too_large";
+    desiredSize: number | null;
+    queuedFrames: number;
+    queuedBytes: number;
+};
+export type ByteBoundedSseStreamOptions = {
+    maxQueuedBytes?: number;
+    stallTimeoutMs?: number;
+    onStop?: () => void;
+    onObservation?: (observation: SseDeliveryBoundObservation) => void;
+};
+export type ByteBoundedSseStream = {
+    stream: ReadableStream<Uint8Array>;
+    write: (frame: string) => Promise<boolean>;
+    close: () => void;
+    fail: (error: unknown) => void;
+    stopped: () => boolean;
+};
+/**
+ * A byte-counted SSE body. `ReadableStreamDefaultController.enqueue()` does not
+ * itself wait for a slow HTTP consumer, so replaying bounded frames without
+ * checking `desiredSize` can still accumulate an unbounded server-side queue.
+ *
+ * One writer is expected per stream. The Web Streams queue holds at most one
+ * complete frame, and that frame must fit inside the byte cap. A second write
+ * waits for consumer pull only for a bounded interval; cancellation or a stalled
+ * reader wakes it and terminates upstream delivery before another durable page is
+ * read. One frame is deliberate: it makes both queued-frame count and queued
+ * bytes independently bounded instead of relying on byte accounting alone.
+ */
+export declare function createByteBoundedSseStream(options?: ByteBoundedSseStreamOptions): ByteBoundedSseStream;
+export type LatestWinsDelivery<T extends {
+    sequence: number;
+}> = {
+    publish: (events: readonly T[]) => void;
+    stop: () => void;
+    whenIdle: () => Promise<void>;
+    pendingSequence: () => number | null;
+};
+/**
+ * Keep at most one live notification while an earlier notification is being
+ * delivered. The notification is only a cursor target: `send` gap-fills every
+ * missing durable event from Postgres, so replacing N intermediate notices with
+ * their newest sequence loses no event and prevents backpressure from migrating
+ * into the NATS subscription queue.
+ */
+export declare function createLatestWinsDelivery<T extends {
+    sequence: number;
+}>(send: (event: T) => Promise<void>, onError: (error: unknown) => void): LatestWinsDelivery<T>;
+export declare function sseSessionStream(db: Database, bus: EventBus, workspaceId: string, sessionId: string, after: number, signal: AbortSignal, options?: SessionSseDeliveryOptions): Promise<Response>;
+export declare function replaySessionEvents(loadPage: (after: number, limit: number) => Promise<SessionEvent[]>, send: (event: SessionEvent) => Promise<void>, after: number, pageSize?: number): Promise<void>;
+export declare function sseWorkspaceControlStream(db: Database, bus: EventBus, workspaceId: string, after: number, signal: AbortSignal, options?: SseDeliveryOptions): Promise<Response>;
+export type SseDeliveryOptions = {
+    maxQueuedBytes?: number;
+    stallTimeoutMs?: number;
+    observability?: Observability | undefined;
+    onObservation?: ((observation: SseDeliveryBoundObservation) => void) | undefined;
+};
+export type SessionSseDeliveryOptions = SseDeliveryOptions & {
+    /** Host ACL re-check, run even while the event stream is otherwise idle. */
+    reauthorize?: (() => Promise<void>) | undefined;
+    reauthorizeAfterMs?: number | undefined;
+};

package/dist/index.d.ts

@@ -1,20 +1,18 @@
-import { getSettings } from '@opengeni/config';
-import { ScheduledTaskOverlapPolicy, ScheduledTaskScheduleSpec } from '@opengeni/contracts';
-import { Database } from '@opengeni/db';
-import { ScheduleOverlapPolicy, ScheduleSpec } from '@temporalio/client';
-import { SessionWorkflowClient, DocumentIndexClient } from '@opengeni/core';
-
-declare function createTemporalWorkflowClient(settings: ReturnType<typeof getSettings>, db: Database): Promise<{
+import { getSettings } from "@opengeni/config";
+import type { ScheduledTaskOverlapPolicy, ScheduledTaskScheduleSpec } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { ScheduleOverlapPolicy } from "@temporalio/client";
+import type { ScheduleSpec } from "@temporalio/client";
+import { type DocumentIndexClient, type SessionWorkflowClient } from "./app";
+export declare function createTemporalWorkflowClient(settings: ReturnType<typeof getSettings>, db: Database): Promise<{
     client: SessionWorkflowClient;
     documentIndexer: DocumentIndexClient;
     close: () => Promise<void>;
 }>;
-declare function startApi(): Promise<{
+export declare function startApi(): Promise<{
     server: Bun.Server<undefined>;
     close: () => Promise<void>;
 }>;
-declare function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy;
-declare function shouldCreateScheduleAfterUpdateError(error: unknown): boolean;
-declare function temporalScheduleSpec(schedule: ScheduledTaskScheduleSpec): ScheduleSpec;
-
-export { createTemporalWorkflowClient, shouldCreateScheduleAfterUpdateError, startApi, temporalOverlapPolicy, temporalScheduleSpec };
+export declare function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy;
+export declare function shouldCreateScheduleAfterUpdateError(error: unknown): boolean;
+export declare function temporalScheduleSpec(schedule: ScheduledTaskScheduleSpec): ScheduleSpec;

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "./chunk-5TULDPWX.js";
+} from "./chunk-36PW33ND.js";
 
 // src/index.ts
 import {

package/dist/integrations/google-drive.d.ts

@@ -0,0 +1,76 @@
+import { GoogleDriveOAuthStartResponse, type GoogleDriveOAuthStartRequest } from "@opengeni/contracts/google-drive";
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare function startGoogleDriveOAuth(deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    requestUrl: string;
+    payload: GoogleDriveOAuthStartRequest;
+}): Promise<GoogleDriveOAuthStartResponse>;
+export declare function completeGoogleDriveOAuthCallback(deps: ApiRouteDeps, input: {
+    code?: string | undefined;
+    state?: string | undefined;
+    error?: string | undefined;
+    requestUrl: string;
+}): Promise<{
+    redirectTo: string;
+}>;
+export declare function browseGoogleDrive(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    parentId: string;
+    pageToken?: string | undefined;
+}): Promise<{
+    connection: {
+        id: string;
+        accountId: string;
+        workspaceId: string;
+        subjectId: string | null;
+        providerDomain: string;
+        kind: "api_key" | "app_install" | "delegated" | "oauth2";
+        status: "active" | "error" | "needs_reauth" | "revoked";
+        grantedScopes: string[];
+        expiresAt: string | null;
+        lastRefreshAt: string | null;
+        lastUsedAt: string | null;
+        lastError: string | null;
+        version: number;
+        verifiedInstallAt?: string | null | undefined;
+        verifiedInstallVersion?: number | null | undefined;
+        metadata: Record<string, unknown>;
+        createdBySubjectId: string | null;
+        updatedBySubjectId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    };
+    parentId: string;
+    current: {
+        id: string;
+        name: string;
+        mimeType: string;
+        kind: "file" | "folder";
+        driveId: string | null;
+        modifiedTime: string | null;
+        size: string | null;
+        webViewLink: string | null;
+    } | null;
+    items: {
+        id: string;
+        name: string;
+        mimeType: string;
+        kind: "file" | "folder";
+        driveId: string | null;
+        modifiedTime: string | null;
+        size: string | null;
+        webViewLink: string | null;
+    }[];
+    nextPageToken: string | null;
+    incompleteSearch: boolean;
+}>;
+export declare function saveGoogleDriveSource(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    payload: unknown;
+}): Promise<import("@opengeni/db").ConnectionMetadataWithVerification>;

package/dist/integrations/oauth-client.d.ts

@@ -0,0 +1,42 @@
+import { type Settings } from "@opengeni/config";
+import { OAuthStartResponse, type OAuthStartRequest } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+import { type Database } from "@opengeni/db";
+export declare const oauthStateTtlMs: number;
+export declare const OFFICIAL_SLACK_MCP_URL: "https://mcp.slack.com/mcp";
+export { OAUTH_MAX_RESPONSE_BYTES } from "@opengeni/network";
+type OAuthClientDeps = {
+    db: Database;
+    settings: Settings;
+    observability?: Observability | undefined;
+};
+export type OAuthStartContext = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    requestUrl: string;
+    payload: OAuthStartRequest;
+};
+export type OAuthCallbackResult = {
+    redirectTo: string;
+};
+type AuthorizationServerMetadata = {
+    issuer: string;
+    authorizationServer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string;
+    clientIdMetadataDocumentSupported: boolean;
+    tokenEndpointAuthMethodsSupported: string[];
+    codeChallengeMethodsSupported: string[];
+    raw: Record<string, unknown>;
+};
+export declare function startMcpOAuth(deps: OAuthClientDeps, context: OAuthStartContext): Promise<OAuthStartResponse>;
+export declare function completeMcpOAuthCallback(deps: OAuthClientDeps, input: {
+    code?: string | undefined;
+    state?: string | undefined;
+    requestUrl: string;
+}): Promise<OAuthCallbackResult>;
+export declare function integrationBaseUrl(publicBaseUrl: string | undefined, requestUrl: string): string;
+export declare function requireIntegrationsStateSecret(settings: Settings): string;
+export declare function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void;

package/dist/integrations/provider-domain.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Canonical form of a connection's providerDomain: trimmed, lowercased, no
+ * leading "www.". Rejects a value that canonicalizes to empty (whitespace-only,
+ * or a bare "www.") — `min(1)` validation passes such input, but an empty stored
+ * domain silently breaks the enable-time connectionRef domain match.
+ */
+export declare function canonicalProviderDomain(value: string): string;

package/dist/integrations/slack-bot.d.ts

@@ -0,0 +1,343 @@
+import { type Settings } from "@opengeni/config";
+import { OPENGENI_SLACK_BOT_CREDENTIAL_LABEL, OPENGENI_SLACK_BOT_CREDENTIAL_ROLE, type AccessGrant, type ConnectionMetadata, type OpenGeniSlackBotConnectionMetadata } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type FetchLike } from "@opengeni/network";
+import { HTTPException } from "hono/http-exception";
+type SlackPayload = Record<string, unknown> & {
+    ok?: unknown;
+    error?: unknown;
+};
+export type SlackFilesListPage = {
+    count: number;
+    page: number;
+};
+export type SlackFilesCursorContext = {
+    connectionId: string;
+    key: Uint8Array;
+};
+export type VerifiedOpenGeniSlackBot = {
+    grantedScopes: string[];
+    metadata: OpenGeniSlackBotConnectionMetadata;
+};
+export declare function exchangeOpenGeniSlackAuthorizationCode(input: {
+    code: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+}, fetchImpl?: FetchLike): Promise<string>;
+export type SlackBotReceipt = {
+    credentialRole: typeof OPENGENI_SLACK_BOT_CREDENTIAL_ROLE;
+    credentialLabel: typeof OPENGENI_SLACK_BOT_CREDENTIAL_LABEL;
+    connectionId: string;
+    slackTeamId: string;
+    operation: SlackBotOperation;
+    operationId?: string;
+    clientMessageId?: string;
+};
+type SlackBotOperation = "channels.list" | "channel_history.read" | "thread_replies.read" | "users.list" | "files.list" | "file.info" | "file.content.read" | "message.post" | "message.delete";
+type SlackBotContext = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    sessionId?: string | null;
+    scheduledTaskId?: string | null;
+};
+export declare class SlackBotProviderError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export type SlackBotCredentialVerificationFailureReason = "scope_mismatch" | "identity_mismatch";
+export declare class SlackBotCredentialVerificationError extends HTTPException {
+    readonly failureReason: SlackBotCredentialVerificationFailureReason;
+    constructor(failureReason: SlackBotCredentialVerificationFailureReason, message: string);
+}
+/**
+ * Validates a write-only xoxb credential before it can enter encrypted storage.
+ * Slack does not expose the app's display_information name to this scope set;
+ * users.info provides the authoritative installed bot display name, while the
+ * documented manifest fixes the app name itself to the same exact value.
+ */
+export declare function verifyOpenGeniSlackBotCredential(token: string, fetchImpl?: FetchLike, now?: Date): Promise<VerifiedOpenGeniSlackBot>;
+export declare function resolveSlackBotConnectionForTool(input: {
+    db: Database;
+    grant: AccessGrant;
+    sessionId: string | null;
+    requestedConnectionId?: string;
+}): Promise<{
+    connection: ConnectionMetadata;
+    metadata: OpenGeniSlackBotConnectionMetadata;
+    context: SlackBotContext;
+}>;
+export declare class OpenGeniSlackBotClient {
+    private readonly db;
+    private readonly settings;
+    private readonly connection;
+    private readonly metadata;
+    private readonly context;
+    private readonly fetchImpl;
+    private readonly resolveCredential;
+    constructor(db: Database, settings: Settings, connection: ConnectionMetadata, metadata: OpenGeniSlackBotConnectionMetadata, context: SlackBotContext, fetchImpl?: FetchLike);
+    listChannels(input?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        channels: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        }[];
+        nextCursor: string | null;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    channelHistory(input: {
+        channelId: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        channel: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        };
+        messages: {
+            timestamp: string;
+            userId: string;
+            botId: string;
+            threadTimestamp: string;
+            text: string;
+            files: {
+                id: string;
+                name: string;
+                title: string;
+                mimetype: string;
+                filetype: string;
+                mode: string;
+                size: number | null;
+                originatingHuddleId: string;
+                huddleTranscriptFileId: string;
+            }[];
+        }[];
+        nextCursor: string | null;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    threadReplies(input: {
+        channelId: string;
+        threadTimestamp: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        channel: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        };
+        threadTimestamp: string;
+        messages: {
+            timestamp: string;
+            userId: string;
+            botId: string;
+            threadTimestamp: string;
+            text: string;
+            files: {
+                id: string;
+                name: string;
+                title: string;
+                mimetype: string;
+                filetype: string;
+                mode: string;
+                size: number | null;
+                originatingHuddleId: string;
+                huddleTranscriptFileId: string;
+            }[];
+        }[];
+        nextCursor: string | null;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    listUsers(input?: {
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        users: {
+            id: string;
+            name: string;
+            displayName: string;
+            realName: string;
+            isBot: boolean;
+            deleted: boolean;
+        }[];
+        nextCursor: string | null;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    listFiles(input: {
+        channelId: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        channel: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        };
+        files: {
+            id: string;
+            name: string;
+            title: string;
+            mimetype: string;
+            filetype: string;
+            mode: string;
+            size: number | null;
+            originatingHuddleId: string;
+            huddleTranscriptFileId: string;
+        }[];
+        nextCursor: string | null;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    fileInfo(input: {
+        channelId: string;
+        fileId: string;
+        parentFileId?: string;
+    }): Promise<{
+        channel: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        };
+        file: {
+            id: string;
+            name: string;
+            title: string;
+            mimetype: string;
+            filetype: string;
+            mode: string;
+            size: number | null;
+            originatingHuddleId: string;
+            huddleTranscriptFileId: string;
+        };
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    fileContent(input: {
+        channelId: string;
+        fileId: string;
+        parentFileId?: string;
+        offset?: number;
+    }): Promise<{
+        channel: {
+            id: string;
+            name: string;
+            isPrivate: boolean;
+            isMember: boolean;
+            isArchived: boolean;
+            topic: string;
+            purpose: string;
+            numMembers: number | null;
+        };
+        file: {
+            id: string;
+            name: string;
+            title: string;
+            mimetype: string;
+            filetype: string;
+            mode: string;
+            size: number | null;
+            originatingHuddleId: string;
+            huddleTranscriptFileId: string;
+        };
+        contentType: string;
+        offset: number;
+        content: string;
+        nextOffset: number | null;
+        truncated: boolean;
+    } & {
+        receipt: SlackBotReceipt;
+    }>;
+    postMessage(input: {
+        operationId: string;
+        channelId?: string;
+        userId?: string;
+        threadTimestamp?: string;
+        text: string;
+    }): Promise<{
+        channelId: string;
+        timestamp: string;
+        threadTimestamp: string | null;
+        receipt: SlackBotReceipt;
+    }>;
+    deleteMessage(input: {
+        operationId: string;
+        channelId: string;
+        timestamp: string;
+    }): Promise<{
+        channelId: string;
+        timestamp: string;
+        deleted: boolean;
+        receipt: SlackBotReceipt;
+    }>;
+    private slackMessageExists;
+    private requireMemberChannel;
+    private requireFileForChannel;
+    private readPrivateFileText;
+    private call;
+    private withAudit;
+    private headersFor;
+    private headersForDestination;
+    private fetchPrivateFile;
+    private fetchPrivateFileOnce;
+    private receipt;
+    private completedPostResult;
+    private completedDeleteResult;
+    private postRequestDigest;
+    private deleteRequestDigest;
+    private deletePrincipal;
+    private fileListPage;
+    private fileListCursor;
+    private recordAudit;
+    private auditMetadata;
+}
+export declare function createOpenGeniSlackBotClient(deps: {
+    db: Database;
+    settings: Settings;
+    slackFetch?: typeof fetch;
+}, resolved: Awaited<ReturnType<typeof resolveSlackBotConnectionForTool>>): OpenGeniSlackBotClient;
+export declare function resolveSlackFilesListPage(input: {
+    channelId: string;
+    limit?: number;
+    cursor?: string;
+}, context: SlackFilesCursorContext): SlackFilesListPage;
+export declare function createSlackFilesListCursor(input: {
+    channelId: string;
+    count: number;
+    page: number;
+}, context: SlackFilesCursorContext): string;
+export declare function nextSlackFilesListPage(payload: SlackPayload, requested: SlackFilesListPage, returnedFileCount: number): number | null;
+export {};

package/dist/mcp/documents.d.ts

@@ -0,0 +1,8 @@
+import { type DocumentServices } from "@opengeni/documents";
+import { type Database } from "@opengeni/db";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function buildDocumentsMcpServer(db: Database, accountId: string, workspaceId: string, documentServices: DocumentServices, options?: {
+    createdBySessionId?: string | undefined;
+    /** The human subject whose agent is making this retrieval request. */
+    viewerSubjectId?: string | undefined;
+}): McpServer;

package/dist/mcp/files.d.ts

@@ -0,0 +1,5 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** Dedicated file MCP surface. The broad `opengeni` server never registers it. */
+export declare function buildFilesMcpServer(deps: ApiRouteDeps, grant: AccessGrant): McpServer;