@opengeni/api-router 2.13.0-canary.0 → 2.13.0-canary.2

package/src/routes/workspace-state.ts

@@ -1,21 +1,24 @@
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
 import {
-  WORKSPACE_STATE_MAX_BASES,
-  WORKSPACE_STATE_MAX_TOPICS,
-  WORKSPACE_STATE_TOPIC_MAX_CHARS,
+  WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT,
   WorkspaceStateQuery,
   WorkspaceStateResponse,
-  type AccessGrant,
   type WorkspaceStateQuery as WorkspaceStateQueryType,
 } from "@opengeni/contracts";
-import { hasPermission, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  hasPermission,
+  requireAccessGrantAuthorization,
+  knowledgeContextForAccess,
+  type AccessGrantAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   getWorkspace,
   getCurrentPreferenceRegistryGovernanceMetadata,
   getWorkspaceStateAcceptedAttemptGovernance,
-  listWorkspaceStateMemoryRecords,
+  listKnowledgeEntries,
   listWorkspaceInstructionPolicyRevisions,
 } from "@opengeni/db";
-import { getDocumentInventory } from "@opengeni/documents";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 
@@ -24,9 +27,10 @@ import { projectWorkspaceState } from "../workspace-state-projection";
 
 async function readWorkspaceState(
   deps: ApiRouteDeps,
-  input: { workspaceId: string; query: WorkspaceStateQueryType; grant: AccessGrant },
+  input: { workspaceId: string; query: WorkspaceStateQueryType; access: AccessGrantAuthorization },
 ) {
-  const { workspaceId, query, grant } = input;
+  const { workspaceId, query, access } = input;
+  const { grant } = access;
   const generatedAt = new Date().toISOString();
   const canInspectKnowledge = hasPermission(grant.permissions, "documents:search");
 
@@ -34,18 +38,13 @@ async function readWorkspaceState(
     getWorkspace(deps.db, workspaceId),
     listWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, { limit: 1 }),
     canInspectKnowledge
-      ? (async () => {
-          const [documents, memories] = await Promise.all([
-            getDocumentInventory(deps.db, workspaceId, {
-              baseLimit: WORKSPACE_STATE_MAX_BASES,
-              topicLimit: WORKSPACE_STATE_MAX_TOPICS,
-              topicMaxChars: WORKSPACE_STATE_TOPIC_MAX_CHARS,
-              access: { viewerSubjectId: grant.subjectId },
-            }),
-            listWorkspaceStateMemoryRecords(deps.db, workspaceId),
-          ]);
-          return { documents, memories };
-        })()
+      ? withAccessGrantSessionRlsContext(deps, grant, async () =>
+          listKnowledgeEntries(
+            deps.db,
+            await knowledgeContextForAccess(deps, access, "documents:search"),
+            { limit: WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT, view: "published" },
+          ),
+        )
       : Promise.resolve(null),
     getCurrentPreferenceRegistryGovernanceMetadata(deps.db, {
       workspaceId,
@@ -109,8 +108,13 @@ export function registerWorkspaceStateRoutes(app: Hono, deps: ApiRouteDeps): voi
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const query = WorkspaceStateQuery.parse(context.req.query());
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");
-    const state = await readWorkspaceState(deps, { workspaceId, query, grant });
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    const state = await readWorkspaceState(deps, { workspaceId, query, access });
     context.header("cache-control", "private, no-store");
     return context.json(state);
   });
@@ -118,8 +122,13 @@ export function registerWorkspaceStateRoutes(app: Hono, deps: ApiRouteDeps): voi
   app.get(`${base}/export`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const query = WorkspaceStateQuery.parse(context.req.query());
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:read");
-    const state = await readWorkspaceState(deps, { workspaceId, query, grant });
+    const access = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read",
+    );
+    const state = await readWorkspaceState(deps, { workspaceId, query, access });
     context.header("cache-control", "private, no-store");
     context.header("content-type", "application/json; charset=utf-8");
     context.header(

package/src/routes/workspaces.ts

@@ -398,16 +398,26 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     // Request-scoped: bound the exclusive control-prefix wait so a busy
     // workspace yields the retryable 503 instead of parking this request.
-    const workspace = await updateWorkspaceSettingsWithToolDefaults(
-      deps.db,
-      workspaceId,
-      parsed.data,
-      { requireWorkspace, updateWorkspaceSettings },
-      {
-        controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
-      },
-    );
-    return c.json(Workspace.parse(workspace));
+    try {
+      const workspace = await updateWorkspaceSettingsWithToolDefaults(
+        deps.db,
+        workspaceId,
+        parsed.data,
+        { requireWorkspace, updateWorkspaceSettings },
+        {
+          controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
+        },
+      );
+      return c.json(Workspace.parse(workspace));
+    } catch (error) {
+      if (nestedPostgresSqlState(error) === "0A000") {
+        throw new HTTPException(409, {
+          message:
+            "Memory settings moved to Settings > Agent learning. Refresh the app to change them.",
+        });
+      }
+      throw error;
+    }
   });
 
   // Per-workspace model/provider availability policy (the HARD blocker over

package/src/sandbox-file-artifacts.ts

@@ -8,8 +8,22 @@ import {
   type AccessGrant,
   type Session,
 } from "@opengeni/contracts";
-import { recordWorkspaceUsage, requireLimit, type ApiRouteDeps } from "@opengeni/core";
-import { completeFileUpload, getFile, prepareGeneratedWorkspaceFile } from "@opengeni/db";
+import {
+  fileOwnerContextForAccess,
+  fileOwnerContextForAgent,
+  recordWorkspaceUsage,
+  requireLimit,
+  type ApiRouteDeps,
+  type AccessGrantAuthorization,
+} from "@opengeni/core";
+import {
+  completeFileUpload,
+  getFile,
+  prepareGeneratedWorkspaceFile,
+  getSessionAuthorityProjection,
+  requireWorkspace,
+  withSessionRlsActorContext,
+} from "@opengeni/db";
 import { retryWhileMissing, type ObjectHead, type ObjectStorage } from "@opengeni/storage";
 import { HTTPException } from "hono/http-exception";
 
@@ -21,10 +35,48 @@ const UPLOAD_INTENT_TTL_MS = 60 * 60_000;
 const SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS = 4_096;
 const SANDBOX_ARTIFACT_SAFE_FILENAME_MAX_CHARS = 200;
 
+/** Original bytes inherit the already-authorized source session's ownership. */
 export async function publishSandboxFileArtifact(
+  deps: ApiRouteDeps,
+  input: Parameters<typeof publishSandboxFileArtifactInScope>[1],
+): Promise<SandboxFileArtifactReceipt> {
+  const actor = input.authorization
+    ? await fileOwnerContextForAccess(deps, input.authorization, "files:upload")
+    : input.grant.principalKind === "agent_attempt"
+      ? await fileOwnerContextForAgent(deps, input.grant, "files:upload")
+      : { subjectId: input.grant.subjectId, privateFileOwnerSubjectId: null };
+  return withSessionRlsActorContext(actor, async () => {
+    const [authority, workspace] = await Promise.all([
+      getSessionAuthorityProjection(deps.db, input.grant.workspaceId, input.session.id),
+      requireWorkspace(deps.db, input.grant.workspaceId),
+    ]);
+    if (!authority) throw new HTTPException(404, { message: "Source session is unavailable" });
+    const personal =
+      authority.visibility === "user_private" ||
+      authority.memoryScope === "user" ||
+      workspace.kind === "personal";
+    const expectedOwner =
+      authority.visibility === "user_private"
+        ? authority.ownerSubjectId
+        : authority.memoryScope === "user"
+          ? authority.scopeSubjectId
+          : actor.privateFileOwnerSubjectId;
+    if (personal && (!expectedOwner || actor.privateFileOwnerSubjectId !== expectedOwner))
+      throw new HTTPException(403, {
+        message: "Personal file publication requires the session owner's authority",
+      });
+    return withSessionRlsActorContext(
+      { ...actor, privateFileOwnerSubjectId: personal ? (expectedOwner ?? null) : null },
+      () => publishSandboxFileArtifactInScope(deps, input),
+    );
+  });
+}
+
+async function publishSandboxFileArtifactInScope(
   deps: ApiRouteDeps,
   input: {
     grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
     session: Session;
     path: string;
     signal?: AbortSignal | undefined;

package/src/scheduled-task-deletion.ts

@@ -1,3 +1,4 @@
+import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
 import type { ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
 import { deleteScheduledTaskLifecycle, type ApiRouteDeps } from "@opengeni/core";
 import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
@@ -35,7 +36,7 @@ async function preflightConnectorAuthorization(
   task: ScheduledTaskValue,
   subjectId: string,
 ): Promise<void> {
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (task.metadata.connectorKind === "atlassian") {
     await preflightAtlassianScheduleAuthorization(deps, { task, subjectId });
     return;
@@ -54,7 +55,7 @@ async function revokeConnectorAuthorization(
   task: ScheduledTaskValue,
   subjectId: string,
 ): Promise<void> {
-  if (task.action.kind !== "knowledge_source_sync") return;
+  if (!scheduledTaskKnowledgeSource(task)) return;
   if (task.metadata.connectorKind === "atlassian") {
     await revokeAtlassianScheduleAuthorization(deps, { task, subjectId });
     return;

package/src/workspace-state-projection.ts

@@ -1,29 +1,17 @@
 import { createHash } from "node:crypto";
 import {
-  KnowledgeMemoryKind,
-  KnowledgeMemoryStatus,
-  WORKSPACE_STATE_BASE_NAME_MAX_CHARS,
   WORKSPACE_STATE_MAX_ACTIVE_POLICY_HEADS,
-  WORKSPACE_STATE_MAX_BASES,
-  WORKSPACE_STATE_MAX_GAPS,
-  WORKSPACE_STATE_MAX_TOPICS,
-  WORKSPACE_STATE_MEMORY_SAMPLE_LIMIT,
-  WORKSPACE_STATE_TOPIC_MAX_CHARS,
+  WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT,
+  type KnowledgeEntrySummary,
   WorkspaceStateResponse,
   type WorkspaceInstructionPolicyListResponse,
   type WorkspaceInstructionPolicySnapshot,
   type WorkspaceStateGovernanceDriftStatus,
-  type WorkspaceStateGap,
-  type WorkspaceStateMemoryKindCounts,
-  type WorkspaceStateMemoryStatusCounts,
   type WorkspaceStateResponse as WorkspaceStateResponseType,
 } from "@opengeni/contracts";
-import type { WorkspaceStateMemoryRecord } from "@opengeni/db";
-import type { DocumentInventory } from "@opengeni/documents";
-
 type KnowledgeProjectionInput = {
-  documents: DocumentInventory;
-  memories: WorkspaceStateMemoryRecord[];
+  entries: Pick<KnowledgeEntrySummary, "id" | "scope" | "revision" | "updatedAt">[];
+  nextCursor: string | null;
 };
 
 type PreferenceGovernanceIdentity = {
@@ -239,30 +227,6 @@ function attemptGovernanceProjection(input: WorkspaceStateProjectionInput) {
   };
 }
 
-function emptyMemoryStatusCounts(): WorkspaceStateMemoryStatusCounts {
-  return Object.fromEntries(
-    KnowledgeMemoryStatus.options.map((status) => [status, 0]),
-  ) as WorkspaceStateMemoryStatusCounts;
-}
-
-function emptyMemoryKindCounts(): WorkspaceStateMemoryKindCounts {
-  return Object.fromEntries(
-    KnowledgeMemoryKind.options.map((kind) => [kind, 0]),
-  ) as WorkspaceStateMemoryKindCounts;
-}
-
-function boundedLabel(value: string, maxChars: number, fallback: string): string {
-  const normalized = value.normalize("NFKC").trim().replace(/\s+/gu, " ");
-  return (normalized || fallback).slice(0, maxChars);
-}
-
-function newestTimestamp(values: Array<string | null>): string | null {
-  return values.reduce<string | null>((latest, value) => {
-    if (!value) return latest;
-    return latest === null || value > latest ? value : latest;
-  }, null);
-}
-
 function comparePolicyTargets(
   left: WorkspaceInstructionPolicyListResponse["activeHeads"][number],
   right: WorkspaceInstructionPolicyListResponse["activeHeads"][number],
@@ -330,116 +294,22 @@ function preferenceProjection(input: CurrentPreferenceProjectionInput) {
 }
 
 function availableKnowledgeProjection(knowledge: KnowledgeProjectionInput) {
-  const inventory = knowledge.documents;
-  const selectedBases = inventory.bases.slice(0, WORKSPACE_STATE_MAX_BASES);
-  const aggregateStatuses = { ...inventory.statusCounts };
-  const aggregateSources = { ...inventory.sourceKindCounts };
-  const topicCounts = new Map<string, number>();
-  const projectedBases = selectedBases.map((base) => {
-    return {
-      id: base.id,
-      name: boundedLabel(base.name, WORKSPACE_STATE_BASE_NAME_MAX_CHARS, "Untitled base"),
-      visibleDocumentCount: base.visibleDocumentCount,
-      statusCounts: base.statusCounts,
-      latestUpdatedAt: base.latestUpdatedAt,
-    };
-  });
-
-  for (const topic of inventory.topics) {
-    const name = boundedLabel(topic.name, WORKSPACE_STATE_TOPIC_MAX_CHARS, "Unlabeled topic");
-    topicCounts.set(name, (topicCounts.get(name) ?? 0) + topic.documentCount);
-  }
-
-  const sortedTopics = [...topicCounts.entries()]
-    .sort(
-      ([leftName, leftCount], [rightName, rightCount]) =>
-        rightCount - leftCount || leftName.localeCompare(rightName),
-    )
-    .map(([name, documentCount]) => ({ name, documentCount }));
-  const topics = sortedTopics.slice(0, WORKSPACE_STATE_MAX_TOPICS);
-  const memories = knowledge.memories.slice(0, WORKSPACE_STATE_MEMORY_SAMPLE_LIMIT);
-  const memoryStatuses = emptyMemoryStatusCounts();
-  const memoryKinds = emptyMemoryKindCounts();
-  for (const memory of memories) {
-    memoryStatuses[memory.status] += 1;
-    memoryKinds[memory.kind] += 1;
-  }
-
-  const inspectedVisibleDocumentCount = inventory.visibleDocumentCount;
-  const basesTruncated = inventory.baseCount > projectedBases.length;
-  const memoryLimitReached = memories.length === WORKSPACE_STATE_MEMORY_SAMPLE_LIMIT;
-  const inventoryPartial = basesTruncated || inventory.topicsTruncated || memoryLimitReached;
-  const gaps: WorkspaceStateGap[] = [];
-  const addGap = (gap: WorkspaceStateGap): void => {
-    if (gaps.length < WORKSPACE_STATE_MAX_GAPS) gaps.push(gap);
-  };
-  if (inventory.baseCount === 0) {
-    addGap({ code: "no_document_bases", severity: "info", relatedCount: 0 });
-  } else if (inspectedVisibleDocumentCount === 0) {
-    addGap({ code: "no_visible_documents", severity: "info", relatedCount: 0 });
-  }
-  if (aggregateStatuses.failed > 0) {
-    addGap({
-      code: "failed_documents",
-      severity: "warning",
-      relatedCount: aggregateStatuses.failed,
-    });
-  }
-  const processingCount = aggregateStatuses.queued + aggregateStatuses.indexing;
-  if (processingCount > 0) {
-    addGap({
-      code: "processing_documents",
-      severity: "info",
-      relatedCount: processingCount,
-    });
-  }
-  if (aggregateStatuses.ready > 0 && sortedTopics.length === 0) {
-    addGap({
-      code: "missing_topic_coverage",
-      severity: "info",
-      relatedCount: aggregateStatuses.ready,
-    });
-  }
-  if (memories.length === 0) {
-    addGap({ code: "no_memory_records", severity: "info", relatedCount: 0 });
-  }
-  if (memoryStatuses.proposed > 0) {
-    addGap({
-      code: "pending_memory_review",
-      severity: "info",
-      relatedCount: memoryStatuses.proposed,
-    });
-  }
-  if (inventoryPartial) {
-    addGap({ code: "partial_inventory", severity: "info", relatedCount: null });
-  }
-
   return {
     availability: "available" as const,
-    coverage: inventoryPartial ? ("partial" as const) : ("complete" as const),
-    baseCount: inventory.baseCount,
-    bases: projectedBases,
-    basesTruncated,
-    inspectedVisibleDocumentCount,
-    documentStatusCounts: aggregateStatuses,
-    sourceKindCounts: aggregateSources,
-    authorityKindCounts: { ...inventory.authorityKindCounts },
-    topics,
-    topicsTruncated: inventory.topicsTruncated || sortedTopics.length > topics.length,
-    latestDocumentUpdatedAt: inventory.latestUpdatedAt,
-    memorySample: {
-      recordCount: memories.length,
-      sampleLimit: WORKSPACE_STATE_MEMORY_SAMPLE_LIMIT,
-      limitReached: memoryLimitReached,
-      statusCounts: memoryStatuses,
-      kindCounts: memoryKinds,
-      preferenceAuthority: {
-        kindCountSource: "knowledge_memories_legacy_observations" as const,
-        activeAuthority: "structured_preference_registry" as const,
-      },
-      latestUpdatedAt: newestTimestamp(memories.map((memory) => memory.updatedAt)),
-    },
-    gaps,
+    authority: "knowledge_entries" as const,
+    coverage:
+      knowledge.nextCursor || knowledge.entries.length > WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT
+        ? ("partial" as const)
+        : ("complete" as const),
+    sampleLimit: WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT,
+    entries: knowledge.entries.slice(0, WORKSPACE_STATE_KNOWLEDGE_SAMPLE_LIMIT).map((entry) => ({
+      id: entry.id,
+      revisionId: entry.revision.id,
+      title: entry.revision.title,
+      kind: entry.revision.kind,
+      scope: entry.scope,
+      updatedAt: entry.updatedAt,
+    })),
   };
 }
 

package/src/workspace-tool-gateway.ts

@@ -1,3 +1,4 @@
+import { knowledgeContextForGateway } from "@opengeni/core";
 import { createHash, randomBytes } from "node:crypto";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
@@ -48,12 +49,11 @@ import {
   requireWorkspace,
   withCodexAppsRequestAuthorization,
   consumeToolGatewayApproval,
-  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
   issueToolGatewayApproval,
   ToolGatewayApprovalOperationStartedError,
   ToolGatewayApprovalRateLimitError,
   WorkspaceArtifactNotFoundError,
-  resolveSessionMemoryAgentScope,
   type ApiIntegrationRuntime,
 } from "@opengeni/db";
 import {
@@ -288,7 +288,7 @@ async function prepareWorkspaceToolGatewayForGrantInternal(
     ...(gatewayServerIds.has("files")
       ? [inMemoryMcpRegistration("files", buildFilesMcpServer(deps, grant))]
       : []),
-    ...(gatewayServerIds.has("docs")
+    ...(gatewayServerIds.has("docs") && hasPermission(grant.permissions, "documents:search")
       ? [
           inMemoryMcpRegistration(
             "docs",
@@ -298,19 +298,7 @@ async function prepareWorkspaceToolGatewayForGrantInternal(
               grant.workspaceId,
               routeDeps.getDocumentServices(),
               {
-                initiatingSubjectId: grant.subjectId,
-                // A session-bound gateway caller reads Memory through that
-                // session's frozen selector; a sessionless caller keeps the
-                // workspace layer.
-                memory:
-                  typeof grant.metadata?.["sessionId"] === "string"
-                    ? ((await resolveSessionMemoryAgentScope(
-                        routeDeps.db,
-                        grant.workspaceId,
-                        grant.metadata["sessionId"],
-                        grant.metadata,
-                      )) ?? { mode: "off" as const, userSubjectId: null, rootSessionId: null })
-                    : null,
+                knowledge: await knowledgeContextForGateway(routeDeps, grant),
               },
             ),
           ),
@@ -719,24 +707,25 @@ function throwWorkspaceToolGatewayHttpError(error: unknown): never {
   throw error;
 }
 
-async function requireWorkspaceSiteToolAuthorization(
+export async function requireWorkspaceSiteToolAuthorization(
   db: ApiRouteDeps["db"],
   grant: AccessGrant,
   context: WorkspaceSiteToolContext,
+  resolveVersion = getWorkspaceArtifactContentRef,
 ): Promise<void> {
   try {
-    const detail = await getWorkspaceArtifact(db, grant.workspaceId, context.siteArtifactId);
-    const currentVersion = detail.artifact.currentVersion;
-    const requested = currentVersion?.requestedTools.some(
+    const { status, version } = await resolveVersion(
+      db,
+      grant.workspaceId,
+      context.siteArtifactId,
+      context.siteVersionId,
+    );
+    const requested = version.requestedTools.some(
       (identity) =>
         identity.serverId === context.identity.serverId &&
         identity.toolName === context.identity.toolName,
     );
-    if (
-      detail.artifact.status !== "active" ||
-      currentVersion?.id !== context.siteVersionId ||
-      !requested
-    ) {
+    if (status !== "active" || version.id !== context.siteVersionId || !requested) {
       throw new HTTPException(403, { message: "site_tool_not_authorized" });
     }
   } catch (error) {

package/dist/mcp/company-brain-governed-writes.d.ts

@@ -1,26 +0,0 @@
-import { type CompanyBrainGovernedWriteAttempt } from "@opengeni/contracts";
-import { createCompanyBrainLearningPolicyRouter } from "@opengeni/core";
-import { type Database } from "@opengeni/db";
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-type JsonResult = (value: unknown) => {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-};
-export type RegisterCompanyBrainGovernedWriteToolsInput = {
-    server: McpServer;
-    db: Database;
-    attempt: CompanyBrainGovernedWriteAttempt;
-    authorize: () => Promise<void>;
-    json: JsonResult;
-    router?: Pick<ReturnType<typeof createCompanyBrainLearningPolicyRouter>, "write">;
-};
-/**
- * Register explicit proposal-only Company Brain tools. The signed host attempt
- * owns tenant/session authority and the exact evidence id owns the learning
- * policy source override. Tool input cannot select scope, active authority, or
- * another policy source.
- */
-export declare function registerCompanyBrainGovernedWriteTools(input: RegisterCompanyBrainGovernedWriteToolsInput): void;
-export {};

package/dist/mcp/remember.d.ts

@@ -1,28 +0,0 @@
-import { type CompanyBrainGovernedWriteAttempt } from "@opengeni/contracts";
-import { createRememberRouter } from "@opengeni/core";
-import { type Database } from "@opengeni/db";
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-type JsonResult = (value: unknown) => {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-};
-export type RegisterRememberToolsInput = {
-    server: McpServer;
-    db: Database;
-    attempt: CompanyBrainGovernedWriteAttempt;
-    authorize: () => Promise<void>;
-    json: JsonResult;
-    router?: Pick<ReturnType<typeof createRememberRouter>, "remember" | "confirm">;
-};
-/**
- * Explicit user-directed remember. Content becomes exact task-note evidence,
- * promotion runs through the frozen workspace learning policy, and activation
- * is either automatic (instruction under Automatic mode) or requires exactly one
- * bound human confirmation through the built-in `request_human_input` tool.
- * Tool input cannot select scope beyond the workspace, active authority, or
- * another learning-policy source.
- */
-export declare function registerRememberTools(input: RegisterRememberToolsInput): void;
-export {};