@opengeni/api-router 0.23.1 → 0.30.0

package/dist/mcp/scheduled-task-view.d.ts

@@ -11,6 +11,15 @@ type Utf8Projection = {
 };
 export type ScheduledTaskUtf8ProjectionFact = Omit<Utf8Projection, "value">;
 type ScheduledTaskScheduleProjection = {
+    schedule: Extract<ScheduledTaskScheduleSpec, {
+        type: "manual";
+    }>;
+    projection: {
+        type: "manual";
+        truncated: false;
+        fields: Record<string, never>;
+    };
+} | {
     schedule: Extract<ScheduledTaskScheduleSpec, {
         type: "once";
     }>;
@@ -53,6 +62,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     name: string;
     status: "active" | "paused";
     schedule: {
+        type: "manual";
+    } | {
         type: "once";
         runAt: string;
         timeZone: string;
@@ -70,6 +81,53 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     };
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
+    action: {
+        kind: "agent_turn";
+        sourceId?: never;
+        sourceGeneration?: never;
+        sourceLifecycleGeneration?: never;
+        destination?: never;
+        initiatingSubjectId?: never;
+        allDescendants?: never;
+        connection?: never;
+        limits?: never;
+    } | {
+        kind: "knowledge_source_sync";
+        sourceId: string;
+        sourceGeneration: number;
+        sourceLifecycleGeneration: number;
+        destination: {
+            kind: "organization";
+            workspaceId: null;
+            subjectId: null;
+        } | {
+            kind: "workspace";
+            workspaceId: string;
+            subjectId: null;
+        } | {
+            kind: "personal";
+            workspaceId: string | null;
+            subjectId: string;
+        };
+        initiatingSubjectId: string;
+        allDescendants: boolean;
+        connection: {
+            connectionId: string;
+            connectionVersion: number;
+            providerDomain: string;
+            kind: "api_key" | "app_install" | "delegated" | "oauth2";
+            ownerSubjectId: string;
+        };
+        limits: {
+            maxItems: number;
+            maxBytes: number;
+            maxFileBytes: number;
+            maxProviderRequests: number;
+            maxElapsedSeconds: number;
+            maxConcurrency: number;
+            maxFailureDetails: number;
+        };
+    };
     targetSessionId: string | null;
     reusableSessionId: string | null;
     variableSetId: string | null;
@@ -91,6 +149,10 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
         bounded: boolean;
         name: ScheduledTaskUtf8ProjectionFact;
         schedule: {
+            type: "manual";
+            truncated: false;
+            fields: Record<string, never>;
+        } | {
             type: "once";
             truncated: boolean;
             fields: {
@@ -123,6 +185,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     name: string;
     status: "active" | "paused";
     schedule: {
+        type: "manual";
+    } | {
         type: "once";
         runAt: string;
         timeZone: string;
@@ -140,6 +204,53 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     };
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
+    action: {
+        kind: "agent_turn";
+        sourceId?: never;
+        sourceGeneration?: never;
+        sourceLifecycleGeneration?: never;
+        destination?: never;
+        initiatingSubjectId?: never;
+        allDescendants?: never;
+        connection?: never;
+        limits?: never;
+    } | {
+        kind: "knowledge_source_sync";
+        sourceId: string;
+        sourceGeneration: number;
+        sourceLifecycleGeneration: number;
+        destination: {
+            kind: "organization";
+            workspaceId: null;
+            subjectId: null;
+        } | {
+            kind: "workspace";
+            workspaceId: string;
+            subjectId: null;
+        } | {
+            kind: "personal";
+            workspaceId: string | null;
+            subjectId: string;
+        };
+        initiatingSubjectId: string;
+        allDescendants: boolean;
+        connection: {
+            connectionId: string;
+            connectionVersion: number;
+            providerDomain: string;
+            kind: "api_key" | "app_install" | "delegated" | "oauth2";
+            ownerSubjectId: string;
+        };
+        limits: {
+            maxItems: number;
+            maxBytes: number;
+            maxFileBytes: number;
+            maxProviderRequests: number;
+            maxElapsedSeconds: number;
+            maxConcurrency: number;
+            maxFailureDetails: number;
+        };
+    };
     targetSessionId: string | null;
     reusableSessionId: string | null;
     variableSetId: string | null;
@@ -161,6 +272,10 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
         bounded: boolean;
         name: ScheduledTaskUtf8ProjectionFact;
         schedule: {
+            type: "manual";
+            truncated: false;
+            fields: Record<string, never>;
+        } | {
             type: "once";
             truncated: boolean;
             fields: {
@@ -254,6 +369,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         name: string;
         status: "active" | "paused";
         schedule: {
+            type: "manual";
+        } | {
             type: "once";
             runAt: string;
             timeZone: string;
@@ -271,6 +388,53 @@ export declare function boundScheduledTaskMcpPage(input: {
         };
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
+        action: {
+            kind: "agent_turn";
+            sourceId?: never;
+            sourceGeneration?: never;
+            sourceLifecycleGeneration?: never;
+            destination?: never;
+            initiatingSubjectId?: never;
+            allDescendants?: never;
+            connection?: never;
+            limits?: never;
+        } | {
+            kind: "knowledge_source_sync";
+            sourceId: string;
+            sourceGeneration: number;
+            sourceLifecycleGeneration: number;
+            destination: {
+                kind: "organization";
+                workspaceId: null;
+                subjectId: null;
+            } | {
+                kind: "workspace";
+                workspaceId: string;
+                subjectId: null;
+            } | {
+                kind: "personal";
+                workspaceId: string | null;
+                subjectId: string;
+            };
+            initiatingSubjectId: string;
+            allDescendants: boolean;
+            connection: {
+                connectionId: string;
+                connectionVersion: number;
+                providerDomain: string;
+                kind: "api_key" | "app_install" | "delegated" | "oauth2";
+                ownerSubjectId: string;
+            };
+            limits: {
+                maxItems: number;
+                maxBytes: number;
+                maxFileBytes: number;
+                maxProviderRequests: number;
+                maxElapsedSeconds: number;
+                maxConcurrency: number;
+                maxFailureDetails: number;
+            };
+        };
         targetSessionId: string | null;
         reusableSessionId: string | null;
         variableSetId: string | null;
@@ -292,6 +456,10 @@ export declare function boundScheduledTaskMcpPage(input: {
             bounded: boolean;
             name: ScheduledTaskUtf8ProjectionFact;
             schedule: {
+                type: "manual";
+                truncated: false;
+                fields: Record<string, never>;
+            } | {
                 type: "once";
                 truncated: boolean;
                 fields: {

package/dist/mcp/server.d.ts

@@ -1,12 +1,11 @@
-import { type AccessGrant } from "@opengeni/contracts";
+import { type AccessGrant, type SessionAuthorizationActor, type WorkspaceMemoryPromptMode } from "@opengeni/contracts";
 import { listSessionDiscoverySummaries, type SessionDiscoveryCursor, type SessionDiscoveryOrderBy } from "@opengeni/db";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { ApiRouteDeps } from "@opengeni/core";
-import type { ToolspaceMcpSurface } from "./toolspace";
 export type McpServerOptions = {
     requestOrigin?: string | null;
-    toolspace?: ToolspaceMcpSurface | null;
     workspaceMemoryEnabled?: boolean | undefined;
+    workspaceMemoryPromptMode?: WorkspaceMemoryPromptMode | undefined;
 };
 export declare function buildOpenGeniMcpServer(deps: ApiRouteDeps, grant: AccessGrant, options?: McpServerOptions): McpServer;
 /** Only a prompt explicitly supplied through the human/API channel may redirect a user-paused goal. */
@@ -33,6 +32,19 @@ export declare function isHumanDirectedTurn(turn: {
  * identified machine child-notification caller is refused).
  */
 export declare function assertGoalReactivationAllowed(deps: ApiRouteDeps, workspaceId: string, sessionId: string, callerTurnId: string | null): Promise<void>;
+export declare function memorySlackPublicationActor(actor: Extract<SessionAuthorizationActor, {
+    kind: "agent_attempt";
+}>, sessionId: string, fallbackOwnerLabel: string | null): {
+    actor: {
+        kind: "human" | "service";
+        subjectId: string;
+        initiatingHumanSubjectId: string | null;
+        sessionId: string;
+        turnId: string;
+        attemptId: string;
+    };
+    ownerLabel: string | null;
+};
 export declare function encodeSessionDiscoveryCursor(cursor: SessionDiscoveryCursor): string;
 export declare function decodeSessionDiscoveryCursor(value: string): SessionDiscoveryCursor;
 export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof listSessionDiscoverySummaries>>, includeLastMessage: boolean): {
@@ -70,7 +82,7 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
             truncated: boolean;
         };
         latestMessage?: {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.paused" | "goal.resumed" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.visibility.changed" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;
             previewTruncated: boolean;
         } | null;

package/dist/memory-slack-delivery.d.ts

@@ -0,0 +1,9 @@
+import { type ClaimedMemorySlackPublication } from "@opengeni/db";
+import { type ApiRouteDeps } from "@opengeni/core";
+export declare function drainMemorySlackPublicationsOnce(deps: ApiRouteDeps): Promise<boolean>;
+export declare function startMemorySlackPublicationPump(deps: ApiRouteDeps, options?: {
+    intervalMs?: number;
+    maxPerTick?: number;
+}): () => Promise<void>;
+export declare function formatMemorySlackPublicationMessage(deps: Pick<ApiRouteDeps, "settings">, publication: ClaimedMemorySlackPublication): string;
+export declare function memorySlackDestinationDrift(error: unknown): boolean;

package/dist/model-catalog.d.ts

@@ -32,6 +32,7 @@ export declare function buildWorkspaceModelCatalog(input: {
     settings: Settings;
     policy: WorkspaceModelPolicyContract | null;
     codexSubscriptionActive: boolean;
+    xaiSubscriptionActive?: boolean;
     workspaceGatewayConnectionActive?: boolean;
     credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
     observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;

package/dist/routes/api-integrations.d.ts

@@ -0,0 +1,8 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { FetchLike } from "@opengeni/network";
+import type { Hono } from "hono";
+export type ApiIntegrationRouteOverrides = Readonly<{
+    fetchImpl?: FetchLike;
+}>;
+export declare function apiIntegrationRequiresConnection(authScheme: Record<string, unknown>): boolean;
+export declare function registerApiIntegrationRoutes(app: Hono, deps: ApiRouteDeps, overrides?: ApiIntegrationRouteOverrides): void;

package/dist/routes/browser-identities.d.ts

@@ -0,0 +1,5 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+export declare function registerBrowserIdentityRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function browserIdentityRouteError(error: unknown): HTTPException;

package/dist/routes/browser-sessions.d.ts

@@ -0,0 +1,6 @@
+import { InteractionActor, type AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function validateBrowserRequestOrigin(value: string | undefined, allowedPattern: string): string | null;
+export declare function interactionActorForGrant(grant: AccessGrant): ReturnType<typeof InteractionActor.parse>;

package/dist/routes/canonical-human-identities.d.ts

@@ -0,0 +1,3 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/channels.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from "hono";
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare function registerChannelRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/company-profile.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerCompanyProfileRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/computer-sessions.d.ts

@@ -0,0 +1,6 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Public ComputerSession resource surface. Physical app/window authority stays
+ * in the same placement controller used by BrowserSession; this route owns only
+ * durable authorization, placement fencing, lifecycle receipts, and routing. */
+export declare function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/editable-artifacts.d.ts

@@ -0,0 +1,44 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type AccessDeps, type EditableArtifactActor, type EditableArtifactApplicationPort, type EditableArtifactDurableExportService, type EditableArtifactOfficeImportPort, type EditableArtifactModality } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare const EDITABLE_ARTIFACT_HTTP_REQUEST_MAX_BYTES: number;
+export declare const EDITABLE_ARTIFACT_EXPORT_REQUEST_MAX_BYTES: number;
+export declare const EDITABLE_ARTIFACT_LIVE_TICKET_REQUEST_MAX_BYTES: number;
+export type EditableArtifactRouteScope = Readonly<{
+    accountId: string;
+    workspaceId: string;
+}>;
+export type EditableArtifactRouteActor = EditableArtifactActor;
+/**
+ * Authenticated transport context. Until a distinct editable-artifact
+ * capability is introduced, the existing workspace `artifacts:read` and
+ * `artifacts:publish` capabilities intentionally gate read and write here too;
+ * the application still performs the durable per-artifact authorization.
+ */
+export type EditableArtifactRouteAuthority = Readonly<{
+    scope: EditableArtifactRouteScope;
+    actor: EditableArtifactRouteActor;
+}>;
+export type MintEditableArtifactLiveTicketOutput = Readonly<{
+    artifactId: string;
+    modality: EditableArtifactModality;
+    replicaId: string;
+    token: string;
+    expiresAt: string;
+    protocolVersion: number;
+}>;
+export type EditableArtifactRouteDependencies = AccessDeps & Readonly<{
+    editableArtifacts?: EditableArtifactApplicationPort;
+    editableArtifactExports?: EditableArtifactDurableExportService;
+    editableArtifactOfficeImports?: EditableArtifactOfficeImportPort;
+    /** Test/embedding seam; returned ids are still authorized one by one. */
+    editableArtifactSessionArtifactIds?: (scope: EditableArtifactRouteScope, sourceSessionId: string, limit: number) => Promise<readonly string[]>;
+}>;
+export type EditableArtifactApplicationErrorCode = "not_found" | "forbidden" | "conflict" | "unsupported_protocol" | "limit_exceeded" | "unavailable";
+/** A bounded, deliberate failure emitted by the injected application boundary. */
+export declare class EditableArtifactApplicationError extends Error {
+    readonly code: EditableArtifactApplicationErrorCode;
+    constructor(code: EditableArtifactApplicationErrorCode);
+}
+export declare function registerEditableArtifactRoutes(app: Hono, deps: EditableArtifactRouteDependencies): void;
+export declare function editableArtifactActorForGrant(grant: AccessGrant, rawReplicaId: string): EditableArtifactRouteActor;

package/dist/routes/integration-facets.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/interaction-resources.d.ts

@@ -0,0 +1,5 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+export declare function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function interactionResourceRouteError(error: unknown): HTTPException;

package/dist/routes/memory-slack-publications.d.ts

@@ -0,0 +1,6 @@
+import { type MemorySlackPublication as MemorySlackPublicationRecord } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerMemorySlackPublicationRoutes(app: Hono, deps: ApiRouteDeps): void;
+/** Defensively protects legacy rows without rewriting their durable projection. */
+export declare function sanitizeMemorySlackPublicationHistory(publication: MemorySlackPublicationRecord): MemorySlackPublicationRecord;

package/dist/routes/organization-memberships.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/plugins.d.ts

@@ -0,0 +1,8 @@
+import { type ApiRouteDeps, type GitHubSkillSourceClient } from "@opengeni/core";
+import type { FetchLike } from "@opengeni/network";
+import type { Hono } from "hono";
+export type PluginRouteOverrides = Readonly<{
+    fetchImpl?: FetchLike;
+    github?: GitHubSkillSourceClient;
+}>;
+export declare function registerPluginRoutes(app: Hono, deps: ApiRouteDeps, overrides?: PluginRouteOverrides): void;

package/dist/routes/sessions.d.ts

@@ -1,15 +1,31 @@
-import { type SessionAuthorizationOperation } from "@opengeni/contracts";
+import { ClientSessionEvent, SteerSessionMessageRequest, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
+import { type SessionDiscoveryCursor } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { type ViewerServices } from "../sandbox/viewer";
+import { type ViewerServices } from "../sandbox/viewer.js";
 type SessionRouteDeps = ApiRouteDeps & Pick<ViewerServices, "establishSandboxSession">;
 export declare function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void;
+export declare function goalProposalMatchesExpectedRevision(revision: Pick<SessionGoalRevision, "baseObjectiveRevision">, expectedObjectiveRevision: number): boolean;
 /**
  * Map every mounted session-addressed HTTP path to the host-neutral operation
  * the embedding port authorizes. Returning null is deliberately fail-closed in
  * host-managed mode; standalone deployments never consult this classifier.
  */
 export declare function sessionAuthorizationOperationForHttp(method: string, pathname: string, sessionId: string): SessionAuthorizationOperation | null;
+export type AgentTopologyCursorEnvelope = {
+    cursor: SessionDiscoveryCursor;
+    parentSessionId: string | null;
+    search: string | null;
+};
+export declare function encodeAgentTopologyCursor(value: AgentTopologyCursorEnvelope): string;
+export declare function agentTopologyQuery(query: Record<string, string>): {
+    limit: number;
+    parentSessionId: string | null;
+    search: string | undefined;
+    cursor: SessionDiscoveryCursor | undefined;
+};
 /** Stable, value-free JSON errors for only the create-session boundary. */
 export declare function sessionCreateErrorResponse(c: Context, error: unknown): Response;
+export declare function parseSessionEventAdmission(raw: unknown): ClientSessionEvent;
+export declare function parseSteerSessionAdmission(raw: unknown): SteerSessionMessageRequest;
 export {};

package/dist/routes/skills.d.ts

@@ -0,0 +1,6 @@
+import { type ApiRouteDeps, type GitHubSkillSourceClient } from "@opengeni/core";
+import type { Hono } from "hono";
+export type SkillRouteOverrides = Readonly<{
+    github?: GitHubSkillSourceClient;
+}>;
+export declare function registerSkillRoutes(app: Hono, deps: ApiRouteDeps, overrides?: SkillRouteOverrides): void;

package/dist/routes/slack-task-policy.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerSlackTaskPolicyRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/supergrok.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/video-generation.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/sandbox/channel-a.d.ts

@@ -3,31 +3,80 @@ import type { Session } from "@opengeni/contracts";
 import { type Database, type LeaseSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type Observability } from "@opengeni/observability";
-import { SandboxChannelAService, type EstablishedSandboxSession, type RoutingSandboxSession } from "@opengeni/runtime/sandbox";
+import { SandboxChannelAService, type ChannelASession, type EstablishedSandboxSession, type RoutingSandboxSession } from "@opengeni/runtime/sandbox";
 export type ChannelAServices = {
     db: Database;
     settings: Settings;
     bus: EventBus;
     observability?: Observability | undefined;
 };
+export type ChannelAOperation = "fs.list" | "fs.list-batch" | "fs.read" | "fs.write" | "fs.delete" | "fs.move" | "fs.mkdir" | "git.status" | "git.diff" | "git.read-batch" | "git.log" | "git.show" | "terminal.exec" | "terminal.pty.open" | "terminal.pty.write" | "terminal.pty.resize" | "terminal.pty.close" | "browser.create" | "browser.resume" | "browser.suspend" | "browser.end" | "browser.read" | "browser.action" | "browser.control" | "browser.download.save" | "browser.attach" | "computer.create" | "computer.end" | "computer.read" | "computer.action" | "computer.control" | "computer.attach";
 export type ChannelAContext = {
     accountId: string;
     workspaceId: string;
     session: Session;
     subjectId: string;
+    /** Cancel lifecycle waiting when the originating HTTP request disconnects. */
+    waitSignal?: AbortSignal | undefined;
+    /** Bounded route identity for metrics and safe operator diagnostics. */
+    operation?: ChannelAOperation | undefined;
+    /** The callback is an interaction-controller read or an exactly-once action.
+     * A controller transport failure may therefore rebuild the exact fenced
+     * provider handle and replay the request. Tab/lifecycle mutations that lack
+     * a controller operation id must never opt into this recovery. */
+    retryControllerTransport?: boolean | undefined;
+};
+export type ChannelAOperationFailureReason = "request_cancelled" | "provider_read_busy" | "provider_unavailable" | "lifecycle_conflict" | "request_rejected" | "unexpected";
+export type ChannelAOperationFailureDiagnostic = {
+    reason: ChannelAOperationFailureReason;
+    status: number;
+    errorCode: "sandbox_channel_a_cancelled" | "sandbox_channel_a_provider_busy" | "sandbox_channel_a_provider_unavailable" | "sandbox_channel_a_lifecycle_conflict" | "sandbox_channel_a_operation_failed";
 };
 export type ChannelAHandle = {
     service: SandboxChannelAService;
     /** Connected Machine homes deliberately have no cloud lease. Durable PTYs
      * require a real home-provider lease and reject this null case. */
     lease: LeaseSnapshot | null;
+    /** Exact placement-home session established under this request's lease or
+     * Connected Machine fence. Unlike routingSession, this never follows a later
+     * active-sandbox pointer and is safe for placement-bound controllers. */
+    homeSession: ChannelASession;
     routingSession: RoutingSandboxSession;
     requestId: string;
 };
+export type EstablishedHandleCacheKind = "read" | "process" | "none";
+export declare function isChannelAHandleCacheEntryFresh(lastUsedAtMonotonicMs: number, nowMonotonicMs: number, idleTtlMs?: number): boolean;
+export declare function isChannelAProcessHandleCacheEntryFresh(lastUsedAtMonotonicMs: number, nowMonotonicMs: number, idleTtlMs?: number): boolean;
 /** Reuse the exact lease-fenced provider handle across API-direct surfaces.
  * Stream capability negotiation and the first Files/Changes reads commonly run
  * back-to-back; sharing this handle avoids paying the same Modal resume twice. */
 export declare function establishCachedChannelAHandle(workspaceId: string, sessionId: string, lease: LeaseSnapshot, establish: () => Promise<EstablishedSandboxSession>): Promise<EstablishedSandboxSession>;
+/**
+ * Run independent, side-effect-free Channel-A reads concurrently without
+ * releasing the direct-request holder while sibling provider commands are
+ * still settling. A typed temporary-unavailable failure is retried exactly
+ * once after every first attempt has settled; validation, conflict, not-found,
+ * and unknown failures are never replayed.
+ */
+export declare function runConcurrentChannelAReads<T>(operations: readonly (() => Promise<T>)[]): Promise<T[]>;
+type ChannelAReadRecoveryOptions = {
+    /** Modal may expose one more stale command-router route after the first
+     * successful handle rebuild. Keep this closed and statically bounded. */
+    maxFreshHandleRetries?: 1 | 2;
+    /** Never start another provider attempt after the originating request ends. */
+    waitSignal?: AbortSignal | undefined;
+    /** Additional callback-specific failure that is safe to replay. */
+    retryableError?: ((error: unknown) => boolean) | undefined;
+};
+/** Retry a side-effect-free Channel-A read only after the caller has discarded
+ * and freshly re-established its provider handle. The ordinary provider-neutral
+ * contract allows one retry; Modal opts into one additional rebuild because a
+ * command-router rollover can outlive the first replacement handle. Provider
+ * commands are never replayed for validation/conflict/unknown errors, mutation
+ * routes never call this helper, and request cancellation stops recovery before
+ * another provider command begins. */
+export declare function runChannelAReadWithFreshHandleRetry<T>(run: () => Promise<T>, refreshHandle: (attempt: 1 | 2) => Promise<void>, options?: ChannelAReadRecoveryOptions): Promise<T>;
+export declare function shouldEvictChannelAHandleAfterError(error: unknown, cacheKind: EstablishedHandleCacheKind): boolean;
 /**
  * Run a Channel-A op against a live box, API-direct. Acquires an exact direct holder
  * (warming the box when cold), resumes by id, builds the service, runs `fn`, and
@@ -38,6 +87,17 @@ export declare function establishCachedChannelAHandle(workspaceId: string, sessi
  * otherwise). A `backend:none` session has no box -> 409 before touching it.
  */
 export declare function withChannelA<T>(services: ChannelAServices, ctx: ChannelAContext, fn: (handle: ChannelAHandle) => Promise<T>): Promise<T>;
+/** Read-only API-direct seam. Separate requests for the same exact live Modal
+ * instance are serialized across API replicas; each request's batched reads
+ * remain concurrent behind that one distributed boundary. A typed temporary
+ * provider-channel failure gets one retry only after rebuilding the exact
+ * lease-fenced handle. */
+export declare function withChannelARead<T>(services: ChannelAServices, ctx: ChannelAContext, fn: (handle: ChannelAHandle) => Promise<T>): Promise<T>;
 /** Map the service's typed errors to HTTP status (the §5.3 matrix). Re-throws an
  *  already-HTTPException unchanged. */
-export declare function mapChannelAError(error: unknown): unknown;
+export declare function mapChannelAError(error: unknown, waitSignal?: AbortSignal): unknown;
+export declare function isChannelARequestCancellation(error: unknown, waitSignal?: AbortSignal): boolean;
+/** Structural classification only: exact provider exception text, codes, URLs,
+ * and identifiers never cross the telemetry boundary. */
+export declare function channelAOperationFailureDiagnostic(error: unknown, waitSignal?: AbortSignal): ChannelAOperationFailureDiagnostic;
+export {};

package/dist/sandbox/machines.d.ts

@@ -18,8 +18,8 @@ export type MachinesServices = {
 export declare function metricRowToSample(row: MachineMetricsRow): MetricSample;
 /**
  * Build the Machines dashboard response for a workspace. When `sessionId` is
- * supplied (an in-session view) the session's synthetic Modal group box is
- * prepended (`isSessionGroup:true`) and the active-sandbox pointer is echoed;
+ * supplied (an in-session view) the session's synthetic home group box is
+ * prepended when one exists (`isSessionGroup:true`) and the active-sandbox pointer is echoed;
  * without it (the pure workspace dashboard) `activeSandboxId` is null and only
  * the enrolled machines are listed.
  */

package/dist/sandbox/metrics-ingestion.d.ts

@@ -1,7 +1,8 @@
 import { type Database, type MachineMetricsSample } from "@opengeni/db";
+import { type AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContractValue } from "@opengeni/contracts";
 import { type EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
-import { Hello, type MetricsSample } from "@opengeni/agent-proto";
+import { Hello, type AttachedBrowserInventorySnapshot as WireAttachedBrowserInventorySnapshot, type MetricsSample } from "@opengeni/agent-proto";
 /** The wildcard subject the agent event plane publishes heartbeats on. */
 export declare const AGENT_EVENTS_SUBJECT = "agent.*.*.events";
 /** The wildcard subject the agent publishes its connect Hello on. */
@@ -27,6 +28,10 @@ export declare function parseAgentHelloSubject(subject: string): {
  * GPU plane; cpu/mem/disk 0 is a legitimate reading the dashboard shows as 0).
  */
 export declare function wireSampleToDbSample(wire: MetricsSample): MachineMetricsSample;
+/** Validate and project one wire inventory before it reaches durable browser
+ *  discovery. Unknown enum values and unsafe uint64 counters reject the whole
+ *  authoritative snapshot instead of partially disconnecting good endpoints. */
+export declare function wireAttachedBrowserInventoryToContract(wire: WireAttachedBrowserInventorySnapshot): AttachedBrowserInventoryContractValue;
 /**
  * Ingest ONE decoded heartbeat for an enrolled machine. Resolves the enrollment's
  * accountId (needed for the RLS-scoped writes) from the enrollment row; an