@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/dist/mcp/request-abort.d.ts

@@ -0,0 +1,19 @@
+import type { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+/**
+ * Serve one first-party MCP POST and bind the tool handlers' `extra.signal` to
+ * the HTTP client's connection.
+ *
+ * The API builds a fresh transport plus `McpServer` per POST, so an MCP
+ * `notifications/cancelled` from the worker would land on a different Protocol
+ * instance and never reach the handler. The only cancellation evidence this
+ * process can observe is the HTTP request's own abort (`Request.signal`, which
+ * Bun fires when the client disconnects). Closing the transport runs the SDK
+ * `Protocol._onclose`, which aborts every in-flight request handler's
+ * controller, so a blocking tool such as `session_wait` stops promptly when the
+ * worker drops the call (Steer, Pause, turn interruption).
+ *
+ * In JSON-response mode the SDK's `handleRequest` promise never settles once
+ * its stream mapping is cleared, so the race resolves a client-gone response
+ * instead of leaving the route handler pending.
+ */
+export declare function handleMcpRequestWithClientAbort(transport: Pick<WebStandardStreamableHTTPServerTransport, "handleRequest" | "close">, request: Request, clientSignal: AbortSignal | undefined): Promise<Response>;

package/dist/mcp/scheduled-task-view.d.ts

@@ -137,7 +137,7 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     configuration: {
         model: string | null;
         reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
-        sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "runloop" | "selfhosted" | "vercel" | null;
+        sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
         hasGoal: boolean;
         promptBytes: number;
         resourceCount: number;
@@ -260,7 +260,7 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     configuration: {
         model: string | null;
         reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
-        sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "runloop" | "selfhosted" | "vercel" | null;
+        sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
         hasGoal: boolean;
         promptBytes: number;
         resourceCount: number;
@@ -310,7 +310,7 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
             metadataKeys: string[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
-            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "runloop" | "selfhosted" | "vercel" | null;
+            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
             goal: {
                 text: string;
                 successCriteria: string | null;
@@ -444,7 +444,7 @@ export declare function boundScheduledTaskMcpPage(input: {
         configuration: {
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
-            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "runloop" | "selfhosted" | "vercel" | null;
+            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
             hasGoal: boolean;
             promptBytes: number;
             resourceCount: number;

package/dist/mcp/server.d.ts

@@ -1,4 +1,4 @@
-import { type AccessGrant, type SessionAuthorizationActor, type WorkspaceMemoryPromptMode } from "@opengeni/contracts";
+import { type AccessGrant, type GitHubRepository, type ResourceRef, type SessionAuthorizationActor, type WorkspaceMemoryPromptMode } from "@opengeni/contracts";
 import { listSessionDiscoverySummaries, type SessionDiscoveryCursor, type SessionDiscoveryOrderBy } from "@opengeni/db";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -45,6 +45,16 @@ export declare function memorySlackPublicationActor(actor: Extract<SessionAuthor
     };
     ownerLabel: string | null;
 };
+/**
+ * Project one allowlisted GitHub App repository into the resource an agent or
+ * scheduled task attaches. Every listed repository is in the workspace
+ * allowlist, public or private, so every resource carries the stable ids
+ * that mint the scoped installation token; a bare URI would clone anonymously
+ * and could never push.
+ */
+export declare function repositoryWithScheduledTaskResource(repository: GitHubRepository): GitHubRepository & {
+    resource: ResourceRef;
+};
 export declare function encodeSessionDiscoveryCursor(cursor: SessionDiscoveryCursor): string;
 export declare function decodeSessionDiscoveryCursor(value: string): SessionDiscoveryCursor;
 export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof listSessionDiscoverySummaries>>, includeLastMessage: boolean): {
@@ -79,10 +89,13 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
             attentionDescendants: number;
             pausedDescendants: number;
             failedDescendants: number;
+            unreadDescendants?: number | undefined;
+            activelyWorkingDescendants?: number | undefined;
+            attentionSince?: string | null | undefined;
             truncated: boolean;
         };
         latestMessage?: {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.visibility.changed" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.visibility.changed" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;
             previewTruncated: boolean;
         } | null;

package/dist/mcp/session-view.d.ts

@@ -93,6 +93,7 @@ export declare function boundSessionDetailMcp(session: Session, effectiveControl
     rigId: string | null;
     rigVersionId: string | null;
     firstPartyMcpPermissions: unknown;
+    effectiveToolPolicy: unknown;
     mcpServers: unknown;
     parentSessionId: string | null;
     createIdempotencyKey: string | null;
@@ -118,6 +119,9 @@ export declare function boundSessionDetailMcp(session: Session, effectiveControl
         attentionDescendants: number;
         pausedDescendants: number;
         failedDescendants: number;
+        unreadDescendants?: number | undefined;
+        activelyWorkingDescendants?: number | undefined;
+        attentionSince?: string | null | undefined;
         truncated: boolean;
     };
     createdAt: string;

package/dist/mcp/session-wait.d.ts

@@ -0,0 +1,137 @@
+/**
+ * `session_wait`: one blocking first-party MCP call that replaces the
+ * `sleep 55` plus three or four `session_events`/`session_get` probes an agent
+ * otherwise runs per loop while it waits for a child or peer session.
+ *
+ * The durable `session_events` table is the only authority. The NATS event bus
+ * is live fanout only, so every wake (bus, deadline, or the initial call) is
+ * followed by a database read and the returned rows are always the exact
+ * durable events, never the bus payload. Subscriptions are opened before the
+ * first read so an event committed between the read and the subscription
+ * cannot be missed.
+ *
+ * Timing facts: the built-in `opengeni` MCP server entry carries no
+ * `timeoutMs`, so the worker's MCP client uses the SDK default request timeout
+ * of 60 s and a longer call would surface as a `-32001` tool error. The wait is
+ * therefore capped at {@link SESSION_WAIT_MAX_SECONDS} both in the tool schema
+ * and inside {@link waitForSessionChanges}. The API's `Bun.serve`
+ * `idleTimeout` is 255 s, far above that cap.
+ *
+ * Cancellation: the API serves one transport per POST, so the worker's MCP
+ * `notifications/cancelled` never reaches this handler; instead the route binds
+ * the HTTP request's own abort to `transport.close()` (`request-abort.ts`),
+ * which aborts `extra.signal`. A worker that drops the call on Steer/Pause
+ * therefore ends the server-side wait promptly; the deadline bounds it anyway.
+ *
+ * The live bus is best-effort: a failed subscription degrades the wait to the
+ * durable pre-check plus the deadline re-check and is reported as
+ * `liveFanout: false` rather than failing the tool.
+ */
+import type { SessionEvent, SessionEventSemanticClass, SessionEventType } from "@opengeni/contracts";
+export declare const SESSION_WAIT_MAX_TARGETS = 16;
+export declare const SESSION_WAIT_MAX_SECONDS = 50;
+export declare const SESSION_WAIT_DEFAULT_SECONDS = 45;
+/** Newest-first durable rows read per target on every database check. */
+export declare const SESSION_WAIT_EVENTS_PER_TARGET = 20;
+/**
+ * The durable event types that matter to a waiter: turn lifecycle, completed
+ * agent messages, blocking failures, goal facts, and session status/control
+ * changes. Raw deltas, tool receipts, sandbox/machine diagnostics, and PTY
+ * noise never wake a waiter; `session_events` remains the drill-down for them.
+ */
+export declare const SESSION_WAIT_EVENT_TYPES: readonly ["turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.capacity_waiting", "agent.message.completed", "session.status.changed", "session.requiresAction", "session.humanInput.requested", "session.control.paused", "session.control.resumed", "tool.auth_needed", "credential.auth_needed", "rig.setup.failed", "goal.set", "goal.updated", "goal.progress", "goal.rewrite.proposed", "goal.rewrite.rejected", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation"];
+/** The self-session event that announces a newly pending machine input. */
+export declare const SESSION_WAIT_OWN_PENDING_EVENT_TYPE = "system.update.pending";
+/**
+ * Whether a pending own machine input of this kind ends the wait. Every
+ * pre-existing kind and `child_requires_action` are `immediate`; deferred
+ * child notices are reported but do not end the wait by themselves.
+ */
+export declare function ownPendingKindWakes(kind: string): boolean;
+export declare function sessionWaitSemanticClass(type: SessionEventType): SessionEventSemanticClass;
+export type SessionWaitTarget = {
+    sessionId: string;
+    afterSequence: number;
+};
+export type SessionWaitEventSummary = {
+    id: string;
+    sequence: number;
+    type: SessionEventType;
+    occurredAt: string;
+    turnId: string | null;
+    turnGeneration: number | null;
+    status: string;
+    text: string | null;
+    failure: {
+        error: string | null;
+        code: string | null;
+        retryable: boolean | null;
+        recovery: string | null;
+    } | null;
+    result?: unknown;
+};
+export type SessionWaitTargetResult = {
+    sessionId: string;
+    afterSequence: number;
+    /** Cursor for the next `session_wait`/`session_events after=` call. */
+    latestSequence: number;
+    hasMore: boolean;
+    events: SessionWaitEventSummary[];
+};
+export type SessionWaitResult = {
+    changed: SessionWaitTargetResult[];
+    ownPendingUpdates: number;
+    ownPendingUpdateKinds: string[];
+    /**
+     * Pending own inputs whose kind wakes the session by itself (every
+     * pre-existing kind plus `child_requires_action`). Only these end the wait;
+     * `deferred` child notices (resolution, pause, capacity wait, progress) are
+     * reported but keep the wait on the targets.
+     */
+    ownPendingImmediateUpdates: number;
+    ownPendingDeferredUpdateKinds: string[];
+    waitedMs: number;
+    timedOut: boolean;
+    aborted: boolean;
+    /** False when at least one live-fanout subscription failed; the wait then relied on the deadline re-check. */
+    liveFanout: boolean;
+    truncated: boolean;
+    bytes: number;
+    maxBytes: number;
+};
+export type SessionWaitTargetRead = {
+    events: readonly SessionEvent[];
+    hasMore: boolean;
+};
+export type SessionWaitSource = {
+    /** Durable forward read of matching events strictly after the target cursor. */
+    readTargetEvents: (target: SessionWaitTarget) => Promise<SessionWaitTargetRead>;
+    /** Kinds of the caller's own pending machine inputs; null disables self tracking. */
+    readOwnPendingUpdateKinds: (() => Promise<readonly string[]>) | null;
+    /** Live fanout subscription for one session; the returned function unsubscribes. */
+    subscribe: (sessionId: string, onEvents: (events: SessionEvent[]) => void | Promise<void>) => Promise<() => void>;
+    /**
+     * Re-run target authorization for the sessions about to be returned after a
+     * wait (parity with SSE re-authorization). Throws to refuse the result.
+     */
+    reauthorizeTargets?: ((sessionIds: readonly string[]) => Promise<void>) | undefined;
+};
+export type SessionWaitInput = {
+    targets: readonly SessionWaitTarget[];
+    ownSessionId: string | null;
+    maxWaitMs: number;
+    source: SessionWaitSource;
+    signal?: AbortSignal | undefined;
+    now?: (() => number) | undefined;
+    maxBytes?: number | undefined;
+};
+export declare function waitForSessionChanges(input: SessionWaitInput): Promise<SessionWaitResult>;
+/** One bounded, result-bearing summary of a durable event for a waiter. */
+export declare function summarizeSessionWaitEvent(event: SessionEvent, textChars?: number): SessionWaitEventSummary;
+/**
+ * Keep the whole model-visible result at or below the `session_events` MCP
+ * envelope. Text is tightened first; only then are newest rows dropped from the
+ * largest target, which keeps each target's `latestSequence` an exact cursor
+ * for the rows actually delivered and marks the remainder as `hasMore`.
+ */
+export declare function boundSessionWaitResult(input: Omit<SessionWaitResult, "truncated" | "bytes" | "maxBytes">, maxBytes?: number): SessionWaitResult;

package/dist/routes/automations.d.ts

@@ -0,0 +1,4 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function readAutomationWebhookBody(request: Request, maxBytes: number): Promise<Uint8Array>;

package/dist/routes/billing.d.ts

@@ -13,4 +13,9 @@ export declare function stripeCheckoutSessionCreateParams(input: {
     cancelUrl?: string | undefined;
     idempotencyKey: string;
 }): Stripe.Checkout.SessionCreateParams;
+export declare function stripeBillingPortalSessionCreateParams(input: {
+    customerId: string;
+    publicBaseUrl?: string | undefined;
+    returnUrl?: string | undefined;
+}): Stripe.BillingPortal.SessionCreateParams;
 export declare function stripeCustomerProvider(input: ApiRouteDeps | Stripe.Event): "stripe:live" | "stripe:test";

package/dist/routes/browser-sessions.d.ts

@@ -2,7 +2,10 @@ import { InteractionActor, type AccessGrant, type FileAsset } from "@opengeni/co
 import { type ApiRouteDeps, type ResolvedSessionAuthorization } from "@opengeni/core";
 import type { Hono } from "hono";
 export declare function registerBrowserSessionRoutes(app: Hono, deps: ApiRouteDeps): void;
-export declare function validateBrowserRequestOrigin(value: string | undefined, allowedPattern: string): string | null;
+export declare function browserNeedsStandaloneDisplayStack(input: {
+    headless: boolean;
+    linkedComputer: boolean;
+}): boolean;
 export declare function interactionActorForGrant(grant: AccessGrant): ReturnType<typeof InteractionActor.parse>;
 /** Resolve Drive authority from the same immutable session authorization that
  * admitted the browser action. Agent-attempt subjects are technical worker

package/dist/routes/company-brain.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerCompanyBrainRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/company-profile.d.ts

@@ -1,3 +1,4 @@
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
 import type { Hono } from "hono";
+export declare function requireDirectAccountAdmin(access: AccessGrantAuthorization): void;
 export declare function registerCompanyProfileRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/connection-authorities.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerConnectionAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/personal-github-git-broker.d.ts

@@ -0,0 +1,29 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import { type PersonalGitHubGitBrokerClaims, type PersonalGitHubGitBrokerRepositoryClaim } from "@opengeni/github";
+import type { Hono } from "hono";
+export declare const PERSONAL_GITHUB_GIT_BROKER_PATH_PREFIX = "/v1/git/personal/";
+type BrokerOperation = "info_refs" | "upload_pack" | "receive_pack";
+type BrokerRepository = Omit<PersonalGitHubGitBrokerRepositoryClaim, "routeId">;
+type BrokerAuthority = {
+    claims: PersonalGitHubGitBrokerClaims;
+    repository: BrokerRepository;
+    providerPrincipalId: string;
+};
+export type PersonalGitHubGitBrokerServices = {
+    openClaims: (token: string) => PersonalGitHubGitBrokerClaims | null;
+    resolveAuthority: (claims: PersonalGitHubGitBrokerClaims, routeId: string) => Promise<BrokerAuthority>;
+    authorizeProviderRequest: (authority: BrokerAuthority, destinationUrl: string, operation: "identity_verify" | "repository_verify" | BrokerOperation) => Promise<string>;
+    fetch: typeof fetch;
+    idleTimeoutMs?: number;
+};
+/**
+ * Register the three closed Git smart-HTTP operations. These routes are not a
+ * product-auth bypass: their only credential is the short-lived encrypted,
+ * exact-attempt broker bearer and every physical provider request is fenced
+ * again against current database authority.
+ */
+export declare function registerPersonalGitHubGitBrokerRoutes(app: Hono, deps: ApiRouteDeps, services?: PersonalGitHubGitBrokerServices): void;
+export declare function isPersonalGitHubGitBrokerPath(pathname: string): boolean;
+export declare function isPersonalGitHubGitBrokerRequest(method: string, pathname: string): boolean;
+export declare function handlePersonalGitHubGitBrokerRequest(request: Request, routeId: string, operation: BrokerOperation, services: PersonalGitHubGitBrokerServices): Promise<Response>;
+export {};

package/dist/routes/personal-github.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/pr-review.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/sessions.d.ts

@@ -12,6 +12,7 @@ export declare function goalProposalMatchesExpectedRevision(revision: Pick<Sessi
  * host-managed mode; standalone deployments never consult this classifier.
  */
 export declare function sessionAuthorizationOperationForHttp(method: string, pathname: string, sessionId: string): SessionAuthorizationOperation | null;
+export declare function sessionTenancyHttpError(error: unknown): Error;
 export type AgentTopologyCursorEnvelope = {
     cursor: SessionDiscoveryCursor;
     parentSessionId: string | null;

package/dist/routes/user-resource-authorities.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerUserResourceAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/workspace-capture.d.ts

@@ -46,7 +46,15 @@ export declare class WorkspaceCaptureManifestCache {
  * manifest blob has been GC'd (all graceful cold-fallback states — never errors).
  * Inline manifest for ≤2MB, signed URL above.
  */
-export declare function serveWorkspaceCapture(row: WorkspaceCaptureRow | null, storage: CaptureStoragePort, cache?: WorkspaceCaptureManifestCache): Promise<GetWorkspaceCaptureResponse>;
+/** Awaited before a signed capture URL is returned to the caller: the route
+ *  records the metadata-only issuance audit fact. A throwing recorder fails
+ *  the serve closed - no recorded fact, no bearer capability. */
+export type CaptureSignedUrlIssuanceRecorder = (fact: {
+    kind: "capture_manifest" | "capture_file";
+    revision: number;
+    expiresAt: string;
+}) => Promise<void>;
+export declare function serveWorkspaceCapture(row: WorkspaceCaptureRow | null, storage: CaptureStoragePort, cache?: WorkspaceCaptureManifestCache, onSignedUrlIssued?: CaptureSignedUrlIssuanceRecorder): Promise<GetWorkspaceCaptureResponse>;
 /**
  * Shape the GET …/workspace/capture/file response from a loaded row (the row
  * already resolved to the requested revision, or the latest). Throws
@@ -55,5 +63,5 @@ export declare function serveWorkspaceCapture(row: WorkspaceCaptureRow | null, s
  * a captured file whose after-image blob is missing). Inline content for ≤256KB,
  * signed URL above.
  */
-export declare function serveWorkspaceCaptureFile(row: WorkspaceCaptureRow | null, path: string, storage: CaptureStoragePort): Promise<GetWorkspaceCaptureFileResponse>;
+export declare function serveWorkspaceCaptureFile(row: WorkspaceCaptureRow | null, path: string, storage: CaptureStoragePort, onSignedUrlIssued?: CaptureSignedUrlIssuanceRecorder): Promise<GetWorkspaceCaptureFileResponse>;
 export {};

package/dist/routes/workspace-learning.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/workspaces.d.ts

@@ -1,5 +1,24 @@
+import { type WorkspaceMember as WorkspaceMemberValue } from "@opengeni/contracts";
 import type { Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { type Settings } from "@opengeni/config";
 export declare function canonicalWorkspacePolicyModelIds(settings: Settings, modelIds: string[] | null | undefined): string[] | null;
+type WorkspaceMemberProjectionInput = Omit<WorkspaceMemberValue, "permissions"> & {
+    permissions: unknown;
+};
+/**
+ * Keep the roster readable across stored-permission contract changes. Unknown
+ * values are never re-authorized: they are omitted from the public projection,
+ * while every currently recognized permission is preserved in stored order.
+ */
+export declare function workspaceMembersResponse(members: readonly WorkspaceMemberProjectionInput[]): {
+    members: {
+        subjectId: string;
+        subjectLabel: string | null;
+        role: string;
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        createdAt: string;
+    }[];
+};
 export declare function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/sandbox/channel-a.d.ts

@@ -10,7 +10,7 @@ export type ChannelAServices = {
     bus: EventBus;
     observability?: Observability | undefined;
 };
-export type ChannelAOperation = "fs.list" | "fs.list-batch" | "fs.read" | "fs.write" | "fs.delete" | "fs.move" | "fs.mkdir" | "git.status" | "git.diff" | "git.read-batch" | "git.log" | "git.show" | "terminal.exec" | "terminal.pty.open" | "terminal.pty.write" | "terminal.pty.resize" | "terminal.pty.close" | "browser.create" | "browser.resume" | "browser.suspend" | "browser.end" | "browser.read" | "browser.action" | "browser.control" | "browser.download.save" | "browser.attach" | "computer.create" | "computer.end" | "computer.read" | "computer.action" | "computer.control" | "computer.attach";
+export type ChannelAOperation = "fs.list" | "fs.list-batch" | "fs.read" | "artifact.publish" | "fs.write" | "fs.delete" | "fs.move" | "fs.mkdir" | "git.status" | "git.diff" | "git.read-batch" | "git.log" | "git.show" | "terminal.exec" | "terminal.pty.open" | "terminal.pty.write" | "terminal.pty.resize" | "terminal.pty.close" | "browser.create" | "browser.resume" | "browser.suspend" | "browser.end" | "browser.read" | "browser.action" | "browser.control" | "browser.download.save" | "browser.attach" | "computer.create" | "computer.end" | "computer.read" | "computer.action" | "computer.control" | "computer.attach";
 export type ChannelAContext = {
     accountId: string;
     workspaceId: string;
@@ -100,4 +100,14 @@ export declare function isChannelARequestCancellation(error: unknown, waitSignal
 /** Structural classification only: exact provider exception text, codes, URLs,
  * and identifiers never cross the telemetry boundary. */
 export declare function channelAOperationFailureDiagnostic(error: unknown, waitSignal?: AbortSignal): ChannelAOperationFailureDiagnostic;
+/** Exported for the telemetry contract tests; not a route surface. */
+export declare function observeChannelAOperationFailure(services: ChannelAServices, input: {
+    workspaceId: string;
+    sandboxGroupId: string;
+    backend: string;
+    operation: string;
+    durationMs: number;
+    error: unknown;
+    waitSignal?: AbortSignal | undefined;
+}): void;
 export {};

package/dist/sandbox/connection-authority.d.ts

@@ -0,0 +1,3 @@
+/** Five-second heartbeats get four missed intervals before another daemon may
+ * claim the enrollment. Server time is authoritative. */
+export declare const AGENT_CONNECTION_LEASE_MS = 20000;

package/dist/sandbox/enrollment.d.ts

@@ -35,6 +35,8 @@ export declare function startDeviceEnrollment(services: EnrollmentServices, inpu
 export declare function approveDeviceEnrollment(services: EnrollmentServices, input: {
     accountId: string;
     workspaceId: string;
+    scope?: "organization" | "workspace" | "user";
+    allowOrganization?: boolean;
     userCode: string;
     allowScreenControl: boolean;
     approvedBySubjectId: string;

package/dist/sandbox/machines.d.ts

@@ -1,11 +1,9 @@
 import type { Settings } from "@opengeni/config";
 import { type Database, type MachineMetricsRow } from "@opengeni/db";
-import type { EventBus } from "@opengeni/events";
 import { MetricSample, type MachinesResponse } from "@opengeni/contracts";
 export type MachinesServices = {
     db: Database;
     settings: Settings;
-    bus?: EventBus;
 };
 /**
  * Project a stored `machine_metrics_latest` row to the contract `MetricSample`.
@@ -24,6 +22,8 @@ export declare function metricRowToSample(row: MachineMetricsRow): MetricSample;
  * the enrolled machines are listed.
  */
 export declare function listMachines(services: MachinesServices, input: {
+    accountId?: string;
     workspaceId: string;
+    subjectId?: string;
     sessionId?: string | null;
 }): Promise<MachinesResponse>;

package/dist/sandbox/metrics-ingestion.d.ts

@@ -4,18 +4,20 @@ import { type EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
 import { Hello, type AttachedBrowserInventorySnapshot as WireAttachedBrowserInventorySnapshot, type MetricsSample } from "@opengeni/agent-proto";
 /** The wildcard subject the agent event plane publishes heartbeats on. */
-export declare const AGENT_EVENTS_SUBJECT = "agent.*.*.events";
+export declare const AGENT_EVENTS_SUBJECT = "agent.*.*.connection.*.events";
 /** The wildcard subject the agent publishes its connect Hello on. */
-export declare const AGENT_HELLO_SUBJECT = "agent.*.*.hello";
-/** Parse `agent.<ws>.<id>.events` → `{ workspaceId, agentId }` (heartbeat plane). */
+export declare const AGENT_HELLO_SUBJECT = "agent.*.*.connection.*.hello";
+/** Parse the exact process events subject (heartbeat plane). */
 export declare function parseAgentEventSubject(subject: string): {
     workspaceId: string;
     agentId: string;
+    connectionInstanceId: string;
 } | null;
-/** Parse `agent.<ws>.<id>.hello` → `{ workspaceId, agentId }` (connect plane). */
+/** Parse the exact process hello subject (connect plane). */
 export declare function parseAgentHelloSubject(subject: string): {
     workspaceId: string;
     agentId: string;
+    connectionInstanceId: string;
 } | null;
 /**
  * Project a wire `MetricsSample` (proto, ms-stamped, GPU as a repeated list) to
@@ -32,20 +34,6 @@ export declare function wireSampleToDbSample(wire: MetricsSample): MachineMetric
  *  discovery. Unknown enum values and unsafe uint64 counters reject the whole
  *  authoritative snapshot instead of partially disconnecting good endpoints. */
 export declare function wireAttachedBrowserInventoryToContract(wire: WireAttachedBrowserInventorySnapshot): AttachedBrowserInventoryContractValue;
-/**
- * Ingest ONE decoded heartbeat for an enrolled machine. Resolves the enrollment's
- * accountId (needed for the RLS-scoped writes) from the enrollment row; an
- * unknown/cross-workspace agentId is ignored (no row → no write). Touches
- * last-seen + upserts latest + downsamples the series.
- */
-export declare function ingestHeartbeat(db: Database, input: {
-    workspaceId: string;
-    agentId: string;
-    sample: MetricsSample;
-}): Promise<{
-    ingested: boolean;
-    seriesAppended: boolean;
-}>;
 /**
  * Decode a raw `AgentEvent` payload + ingest it (the per-message handler). A
  * heartbeat carrying a metrics sample is ingested; a going-offline records the
@@ -55,7 +43,7 @@ export declare function ingestHeartbeat(db: Database, input: {
  */
 export declare function handleAgentEventPayload(db: Database, observability: Observability | undefined, payload: Uint8Array, subject: string, bus?: EventBus): Promise<void>;
 /**
- * Start the metrics-ingestion consumer: subscribe `agent.*.*.events` and ingest
+ * Start the metrics-ingestion consumer: subscribe exact process events and ingest
  * every heartbeat. Gated by sandboxSelfhostedEnabled (the caller checks the flag;
  * a disabled deployment never starts the consumer). Returns the unsubscribe fn.
  */
@@ -95,6 +83,7 @@ export declare function refreshEnrollmentDisplay(db: Database, input: {
     agentId: string;
     hasDisplay: boolean;
     desktopUnavailableReason?: string | null;
+    connectionInstanceId?: string;
 }): Promise<{
     updated: boolean;
 }>;
@@ -108,6 +97,7 @@ export declare function refreshEnrollmentOpStream(db: Database, input: {
     workspaceId: string;
     agentId: string;
     opStream: boolean;
+    connectionInstanceId?: string;
 }): Promise<{
     updated: boolean;
 }>;
@@ -121,7 +111,7 @@ export declare function refreshEnrollmentOpStream(db: Database, input: {
  */
 export declare function handleHelloPayload(db: Database, observability: Observability | undefined, payload: Uint8Array, subject: string, bus?: EventBus): Promise<void>;
 /**
- * Start the Hello display-refresh consumer: subscribe `agent.*.*.hello` and
+ * Start the Hello display-refresh consumer: subscribe exact process hellos and
  * reconcile `has_display` to the live capability the agent reports on every
  * connect. Gated by sandboxSelfhostedEnabled (the caller checks the flag). Returns
  * the unsubscribe fn.

package/dist/sandbox/viewer.d.ts

@@ -51,7 +51,10 @@ export type ViewerAttachResult = {
  * cannot change manifest environment variables" whenever a viewer attach (an open
  * session page) won the cold-create race against the first turn.
  */
-export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session): Promise<Record<string, string>>;
+export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session, 
+/** The authenticated route subject driving this attach (0282); recorded on
+ *  the materialization audit fact. Null records the legacy service sentinel. */
+attachSubjectId: string | null): Promise<Record<string, string>>;
 /**
  * Acquire a `viewer` holder on the group lease, spinning up the box IN-PROCESS
  * when cold. Mirrors the worker's resumeBoxForTurn spawner/attached branches,
@@ -65,6 +68,9 @@ export declare function attachViewer(services: ViewerServices, input: {
     workspaceId: string;
     session: Session;
     viewerId?: string;
+    /** The authenticated subject attaching this viewer (0281): recorded on
+     *  the holder row together with the live session authority epoch. */
+    viewerSubjectId?: string;
     /** Cancel lifecycle waiting when the originating HTTP request disconnects. */
     waitSignal?: AbortSignal;
 }): Promise<ViewerAttachResult>;
@@ -84,6 +90,10 @@ export declare function ensureSessionGroupReady(services: ViewerServices, input:
     accountId: string;
     workspaceId: string;
     session: Session;
+    /** The authenticated subject driving the fleet attach/swap (0282): recorded
+     *  on the viewer holder and the materialization audit fact. Omitting it
+     *  records the explicit service sentinel, so forward the route subject. */
+    subjectId?: string | null;
 }): Promise<SessionGroupReadinessHold>;
 /**
  * Refresh a viewer holder's TTL (the app-level viewer heartbeat). Epoch-fenced:
@@ -148,6 +158,11 @@ export type DesktopStreamMint = {
 export type MintDesktopStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** True when the route grant is a signed delegated token (metadata.delegated):
+     *  its authority is the token, not membership rows, so the mint-time
+     *  live-authority recheck does not apply. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder id the scoped token is minted for. */
     viewerId: string;
@@ -197,6 +212,9 @@ type SelfhostedStreamMint = Omit<TerminalStreamMint, "transport">;
 export type MintTerminalStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** See MintDesktopStreamInput.resourceSubjectDelegated. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder / principal id the scoped token is minted for. */
     viewerId: string;
@@ -233,6 +251,11 @@ export type MintSelfhostedStreamInput = {
      *  THIS as its leaseEpoch claim so the relay rejects a stale-epoch (swapped-away)
      *  viewer. */
     activeEpoch: number;
+    /** 0281 viewer authority claims stamped into the relay stream token. */
+    viewerAuthority?: {
+        subjectId?: string;
+        authorityEpoch: number;
+    };
     /** The exposed stream port (6080 desktop / 7681 terminal). */
     port: number;
     /** The resolvable selfhosted session (the routing proxy resolves the active