@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/dist/integrations/oauth-client.d.ts

@@ -2,6 +2,7 @@ import { type Settings } from "@opengeni/config";
 import { OAuthStartResponse, type ConnectionOwnership, type OAuthStartRequest } from "@opengeni/contracts";
 import type { Observability } from "@opengeni/observability";
 import { type Database } from "@opengeni/db";
+import { type McpAuthorizationServerMetadata } from "@opengeni/network";
 import { type OAuthProviderProfile } from "./oauth-profiles.js";
 export declare const oauthStateTtlMs: number;
 export { OFFICIAL_GMAIL_MCP_SCOPES, OFFICIAL_GMAIL_MCP_URL, OFFICIAL_SLACK_MCP_URL, } from "./oauth-profiles.js";
@@ -29,17 +30,7 @@ export type OAuthStartContext = {
 export type OAuthCallbackResult = {
     redirectTo: string;
 };
-type AuthorizationServerMetadata = {
-    issuer: string;
-    authorizationServer: string;
-    authorizationEndpoint: string;
-    tokenEndpoint: string;
-    registrationEndpoint?: string;
-    clientIdMetadataDocumentSupported: boolean;
-    tokenEndpointAuthMethodsSupported: string[];
-    codeChallengeMethodsSupported: string[];
-    raw: Record<string, unknown>;
-};
+type AuthorizationServerMetadata = McpAuthorizationServerMetadata;
 export declare const OAUTH_START_DEADLINE_MS = 15000;
 export declare const OAUTH_CALLBACK_DEADLINE_MS = 30000;
 export type OAuthStartStage = "connection_lookup" | "mcp_challenge" | "protected_resource_metadata" | "authorization_server_metadata" | "client_registration";

package/dist/integrations/personal-github-repositories.d.ts

@@ -1,9 +1,39 @@
 import { type PersonalGitHubRepository as PersonalGitHubRepositoryContract, type PersonalGitHubRepositorySelectionInput } from "@opengeni/contracts/personal-github";
+import { type GitHubRepositoryBranchesResponse as GitHubRepositoryBranchesResponseContract, type ListGitHubRepositoryBranchesQuery } from "@opengeni/contracts/github-repository-contracts";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { getConnectionMetadata } from "@opengeni/db";
+import { getConnectionMetadata, type PersonalGitHubRepositorySelectionState as DbPersonalGitHubRepositorySelectionState } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 export type PersonalGitHubRepositoryConnection = NonNullable<Awaited<ReturnType<typeof getConnectionMetadata>>>;
-export type PersonalGitHubRepositoryProviderErrorCode = "connection_changed" | "connection_inactive" | "invalid_provider_response" | "provider_denied" | "provider_rate_limited" | "provider_unavailable" | "repository_archived" | "repository_not_found" | "repository_read_denied" | "repository_write_denied";
+type PersonalGitHubRepositoryProviderOperation = "repositories_list" | "repository_branches_list" | "repository_verify";
+type ExpectedPersonalGitHubRepositoryAuthority = {
+    selectionGeneration: number;
+    repositoryId: string;
+    fullName: string;
+};
+type PersonalGitHubProviderJsonOptions = {
+    operation: PersonalGitHubRepositoryProviderOperation;
+    expectedRepositoryAuthority?: ExpectedPersonalGitHubRepositoryAuthority;
+    responseLabel?: string;
+    responseMaxBytes?: number;
+};
+export type PersonalGitHubRepositoryBranchServices = {
+    requireConnection: typeof requirePersonalGitHubRepositoryConnection;
+    getSelectionState: (deps: ApiRouteDeps, input: {
+        accountId: string;
+        originWorkspaceId: string;
+        subjectId: string;
+        connectionId: string;
+    }) => Promise<DbPersonalGitHubRepositorySelectionState | null>;
+    providerJson: (input: {
+        deps: ApiRouteDeps;
+        connection: PersonalGitHubRepositoryConnection;
+        subjectId: string;
+        url: URL;
+        expectedConnectionAuthorityGeneration: number;
+        options: PersonalGitHubProviderJsonOptions;
+    }) => Promise<unknown>;
+};
+export type PersonalGitHubRepositoryProviderErrorCode = "connection_changed" | "connection_inactive" | "invalid_provider_response" | "provider_denied" | "provider_rate_limited" | "provider_unavailable" | "repository_archived" | "repository_not_found" | "repository_not_selected" | "repository_read_denied" | "repository_selection_changed" | "repository_write_denied";
 export declare class PersonalGitHubRepositoryProviderError extends Error {
     readonly code: PersonalGitHubRepositoryProviderErrorCode;
     constructor(code: PersonalGitHubRepositoryProviderErrorCode);
@@ -26,6 +56,14 @@ export declare function listLivePersonalGitHubRepositories(deps: ApiRouteDeps, i
     repositories: PersonalGitHubRepositoryContract[];
     nextPage: number | null;
 }>;
+export declare function listLivePersonalGitHubRepositoryBranches(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    repositoryId: string;
+    query: ListGitHubRepositoryBranchesQuery;
+}, services?: PersonalGitHubRepositoryBranchServices): Promise<GitHubRepositoryBranchesResponseContract>;
 /** Serial by design: one bounded provider request and one authority check at a time. */
 export declare function verifyLivePersonalGitHubRepositories(deps: ApiRouteDeps, input: {
     workspaceId: string;
@@ -43,3 +81,4 @@ export declare function parsePersonalGitHubProviderJson(value: string): unknown;
 export declare function personalGitHubRepositoryCanRead(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
 export declare function personalGitHubRepositoryCanWrite(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
 export declare function parsePersonalGitHubRepository(value: unknown): PersonalGitHubRepositoryContract;
+export {};

package/dist/integrations/slack-interactions.d.ts

@@ -19,7 +19,7 @@ export declare const SLACK_SESSION_INSTRUCTIONS: string;
  * selection at session creation while keeping Slack mutations out of the model
  * surface; interaction delivery remains owned by the durable delivery pump.
  */
-export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "goal_wait" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
 export type NormalizedSlackInteraction = {
     providerEventId: string;
     providerMessageId: string;

package/dist/mcp/server.d.ts

@@ -57,6 +57,163 @@ export declare function repositoryWithScheduledTaskResource(repository: GitHubRe
 };
 export declare function encodeSessionDiscoveryCursor(cursor: SessionDiscoveryCursor): string;
 export declare function decodeSessionDiscoveryCursor(value: string): SessionDiscoveryCursor;
+export declare function capSessionDiscoveryCompactPage(page: Awaited<ReturnType<typeof listSessionDiscoverySummaries>>, options?: {
+    includeLastMessage?: boolean;
+    includeRelatedWork?: boolean;
+}, maxBytes?: number): {
+    sessions: ({
+        id: string;
+        title: string | null;
+        status: "cancelled" | "failed" | "idle" | "queued" | "recovering" | "requires_action" | "running" | "waiting_capacity";
+        titleTruncated?: boolean;
+        parentSessionId?: string;
+        goal?: {
+            status: "active" | "completed" | "paused";
+            summary: string | null;
+            summaryTruncated?: boolean;
+        };
+        pause?: {
+            state: string;
+            source?: {
+                kind: "session" | "workspace";
+                sessionId?: string;
+                displayName: string | null;
+                displayNameTruncated?: boolean;
+                reason?: string | null;
+                reasonTruncated?: boolean;
+            };
+            additionalBlockerCount?: number;
+        };
+        attention?: {
+            requiresActionDescendants?: number;
+            pausedDescendants?: number;
+            failedDescendants?: number;
+            truncated?: boolean;
+        };
+        relatedWork?: {
+            claims: {
+                id: string;
+                sessionId: string;
+                subject: {
+                    namespace: string;
+                    type: "artifact" | "branch" | "ci_run" | "issue" | "other" | "pull_request" | "release" | "repository";
+                    canonicalKey: string;
+                    displayLabel: string | null;
+                };
+                role: "delivering" | "monitoring" | "reviewing" | "working";
+                state: "active" | "released" | "stale" | "superseded";
+                revision: number;
+                provenance: "explicit_agent" | "session_resource" | "system_lifecycle" | "trusted_integration" | "user_api";
+                version: {
+                    kind: "artifact_version" | "branch_head" | "ci_run" | "git_commit" | "other" | "pull_request_head" | "release_version";
+                    value: string;
+                } | null;
+                observedAt: string;
+                updatedAt: string;
+                settledAt: string | null;
+            }[];
+            claimsTruncated: boolean;
+            match: {
+                class: "exact_subject" | "fuzzy" | "goal" | "title";
+                field: "claim_key" | "claim_label" | "goal" | "subject" | "title";
+                scoreBand: "exact" | "related" | "strong";
+                claimId: string | null;
+            } | null;
+            possibleOverlap: boolean;
+            advisoryOnly: true;
+            noAdditionalAccess: true;
+        };
+        updatedAt: string;
+        queuedPromptCount?: number;
+    } | {
+        id: string;
+        title: string | null;
+        status: "cancelled" | "failed" | "idle" | "queued" | "recovering" | "requires_action" | "running" | "waiting_capacity";
+        titleTruncated?: boolean;
+        parentSessionId?: string;
+        goal?: {
+            status: "active" | "completed" | "paused";
+            summary: string | null;
+            summaryTruncated?: boolean;
+        };
+        pause?: {
+            state: string;
+            source?: {
+                kind: "session" | "workspace";
+                sessionId?: string;
+                displayName: string | null;
+                displayNameTruncated?: boolean;
+                reason?: string | null;
+                reasonTruncated?: boolean;
+            };
+            additionalBlockerCount?: number;
+        };
+        attention?: {
+            requiresActionDescendants?: number;
+            pausedDescendants?: number;
+            failedDescendants?: number;
+            truncated?: boolean;
+        };
+        relatedWork?: {
+            claims: {
+                id: string;
+                sessionId: string;
+                subject: {
+                    namespace: string;
+                    type: "artifact" | "branch" | "ci_run" | "issue" | "other" | "pull_request" | "release" | "repository";
+                    canonicalKey: string;
+                    displayLabel: string | null;
+                };
+                role: "delivering" | "monitoring" | "reviewing" | "working";
+                state: "active" | "released" | "stale" | "superseded";
+                revision: number;
+                provenance: "explicit_agent" | "session_resource" | "system_lifecycle" | "trusted_integration" | "user_api";
+                version: {
+                    kind: "artifact_version" | "branch_head" | "ci_run" | "git_commit" | "other" | "pull_request_head" | "release_version";
+                    value: string;
+                } | null;
+                observedAt: string;
+                updatedAt: string;
+                settledAt: string | null;
+            }[];
+            claimsTruncated: boolean;
+            match: {
+                class: "exact_subject" | "fuzzy" | "goal" | "title";
+                field: "claim_key" | "claim_label" | "goal" | "subject" | "title";
+                scoreBand: "exact" | "related" | "strong";
+                claimId: string | null;
+            } | null;
+            possibleOverlap: boolean;
+            advisoryOnly: true;
+            noAdditionalAccess: true;
+        };
+        updatedAt: string;
+        queuedPromptCount?: number;
+        latestMessage: {
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            previewOmitted: boolean;
+            previewOmissionReason: "aggregatePreviewBudget";
+            previewDrillDownTool: "session_events";
+            previewDrillDownInput: {
+                direction: "before";
+                limit: 1;
+                mode: "monitoring";
+                payloadMode: "summary";
+                sessionId: string;
+                includeTypes: ("agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded")[];
+            };
+        } | {
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            preview: string | null;
+            previewTruncated?: boolean;
+        };
+    })[];
+    total: number;
+    nextCursor: string | null;
+    updatedThrough?: string | null;
+    responseTruncated?: boolean;
+    truncationReason?: string;
+};
 export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof listSessionDiscoverySummaries>>, includeLastMessage: boolean): {
     sessions: {
         id: string;
@@ -129,7 +286,7 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
             noAdditionalAccess: true;
         };
         latestMessage?: {
-            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
+            type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "session.wait.finished" | "session.wait.started" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;
             previewTruncated: boolean;
         } | null;

package/dist/mcp/session-view.d.ts

@@ -8,7 +8,7 @@
  * edge while preserving a usable cursor. It never manufactures an event or
  * advances across an event it did not return.
  */
-import type { Rig, Session, SessionEvent, SessionEventCompactResult, SessionEventPayloadMode, SessionEventReadDirection, SessionEventReadMode } from "@opengeni/contracts";
+import type { Rig, Session, SessionEvent, SessionEventCompactResult, SessionEventPayloadMode, SessionEventReadDirection, SessionEventReadMode, SessionMcpMonitoringSource, SessionQueueSnapshot } from "@opengeni/contracts";
 export declare const SESSION_EVENT_MCP_MAX_BYTES: number;
 export declare const SESSION_EVENT_MCP_FIELD_MAX_CHARS = 4000;
 export declare const DEFAULT_SESSION_DETAIL_CHARS = 6000;
@@ -69,7 +69,61 @@ type SessionDetailFieldFact = {
     deliveredCount?: number;
     measurementBounded?: boolean;
 };
-/** Purpose-built, flat, model-facing detail projection for `session_get`. */
+/** Compact management state; configuration is deliberately excluded, not truncated. */
+export declare function boundSessionCompactDetailMcp(session: Session, monitoring: SessionMcpMonitoringSource, queue: SessionQueueSnapshot | null, maxBytes?: number): {
+    id: string;
+    title: string | null;
+    status: "cancelled" | "failed" | "idle" | "queued" | "recovering" | "requires_action" | "running" | "waiting_capacity";
+    titleTruncated?: boolean;
+    parentSessionId?: string;
+    activeTurnId?: string;
+    lastSequence: number;
+    goal?: {
+        status: "active" | "completed" | "paused";
+        summary: string | null;
+        summaryTruncated?: boolean;
+        evidence?: string | null;
+        evidenceTruncated?: true;
+        pausedReason?: string | null;
+        pausedReasonTruncated?: true;
+        rationale?: string | null;
+        rationaleTruncated?: true;
+    };
+    progress?: {
+        sequence: number;
+        text: string | null;
+        occurredAt: string;
+        textTruncated?: boolean;
+    };
+    pause?: {
+        state: string;
+        source?: {
+            kind: "session" | "workspace";
+            sessionId?: string;
+            displayName: string | null;
+            displayNameTruncated?: boolean;
+            reason?: string | null;
+            reasonTruncated?: boolean;
+        };
+        additionalBlockerCount?: number;
+    };
+    wait?: {
+        reason: string | null;
+        until: string;
+        reasonTruncated?: boolean;
+    };
+    queue?: {
+        queuedTurns: number;
+        pendingInputs: number;
+        stoppingPreviousAttempt?: boolean;
+    };
+    stopping?: {
+        attempts?: number;
+        backgroundCommands?: number;
+    };
+    updatedAt: string;
+};
+/** Legacy bounded configuration projection for explicit `session_get detail=full`. */
 export declare function boundSessionDetailMcp(session: Session, effectiveControl?: unknown, maxBytes?: number): {
     id: string;
     workspaceId: string;

package/dist/mcp/session-wait.d.ts

@@ -39,7 +39,7 @@ export declare const SESSION_WAIT_EVENTS_PER_TARGET = 20;
  * changes. Raw deltas, tool receipts, sandbox/machine diagnostics, and PTY
  * noise never wake a waiter; `session_events` remains the drill-down for them.
  */
-export declare const SESSION_WAIT_EVENT_TYPES: readonly ["turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.capacity_waiting", "agent.message.completed", "session.status.changed", "session.requiresAction", "session.humanInput.requested", "session.control.paused", "session.control.resumed", "tool.auth_needed", "credential.auth_needed", "rig.setup.failed", "goal.set", "goal.updated", "goal.progress", "goal.rewrite.proposed", "goal.rewrite.rejected", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation"];
+export declare const SESSION_WAIT_EVENT_TYPES: readonly ["turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.capacity_waiting", "agent.message.completed", "session.status.changed", "session.requiresAction", "session.humanInput.requested", "session.control.paused", "session.control.resumed", "session.wait.started", "session.wait.finished", "tool.auth_needed", "session.command.finished", "credential.auth_needed", "rig.setup.failed", "goal.set", "goal.updated", "goal.progress", "goal.rewrite.proposed", "goal.rewrite.rejected", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation"];
 /**
  * Settlement and blocking events that make a child result usable.
  * Goal facts are deliberately absent: an agent can complete its durable goal

package/dist/mcp-oauth.d.ts

@@ -0,0 +1,19 @@
+import { type AccessGrant, type ToolGatewayCatalog, type ToolGatewayIdentity } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { Hono } from "hono";
+export type McpOAuthResource = {
+    resource: string;
+    workspaceId: string;
+    kind: "all" | "docs" | "files";
+};
+export type McpOAuthRouteAccess = {
+    grant: AccessGrant;
+    allowedToolIdentities: ToolGatewayIdentity[];
+};
+export declare function registerMcpOAuthRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function resolveMcpOAuthRouteAccess(deps: ApiRouteDeps, request: Request, workspaceId: string): Promise<McpOAuthRouteAccess | null>;
+export declare function mcpOAuthBearerToken(request: Request): string | null;
+export declare function isMcpOAuthResourcePath(pathname: string): boolean;
+export declare function mcpOAuthConsentToolIdentities(catalog: ToolGatewayCatalog): ToolGatewayIdentity[];
+export declare function isMcpOAuthPublicProtocolPath(pathname: string): boolean;
+export declare function mcpOAuthAuthenticateHeader(deps: ApiRouteDeps, pathname: string): string;

package/dist/model-catalog.d.ts

@@ -1,23 +1,7 @@
-import { type ConfiguredModel, type Settings } from "@opengeni/config";
-import { ClientModel, type WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponseType, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
-export type ModelAvailabilityObservation = {
-    status: "available" | "degraded" | "unavailable";
-    reason: "not_entitled" | "provider_unhealthy" | null;
-    checkedAt: string;
-};
-export type ModelCredentialReadinessObservation = {
-    status: "ready";
-    checkedAt: string;
-} | {
-    status: "not_ready";
-    reason: "prerequisites_missing" | "needs_reauth";
-    checkedAt: string;
-} | {
-    status: "error";
-    reason: "resolver_error";
-    checkedAt: string;
-};
-export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
+import { type ConfiguredModel } from "@opengeni/config";
+import { ClientModel, type WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponseType } from "@opengeni/contracts";
+import { type WorkspaceModelSelectionInput } from "@opengeni/core";
+export { MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS, type ModelAvailabilityObservation, type ModelCredentialReadinessObservation, } from "@opengeni/core";
 /** Static, client-safe definition projection. No provider secret is reachable. */
 export declare function projectClientModel(model: ConfiguredModel): ClientModel;
 /**
@@ -28,14 +12,4 @@ export declare function projectClientModel(model: ConfiguredModel): ClientModel;
  * successful typed resolver observation; credential health and provider health
  * are separate inputs and neither is fabricated.
  */
-export declare function buildWorkspaceModelCatalog(input: {
-    settings: Settings;
-    policy: WorkspaceModelPolicyContract | null;
-    codexSubscriptionActive: boolean;
-    xaiSubscriptionActive?: boolean;
-    workspaceGatewayConnectionActive?: boolean;
-    credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
-    observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
-    now?: Date | undefined;
-    credentialReadinessMaxAgeMs?: number | undefined;
-}): WorkspaceModelCatalogResponseType;
+export declare function buildWorkspaceModelCatalog(input: WorkspaceModelSelectionInput): WorkspaceModelCatalogResponseType;

package/dist/routes/codex.d.ts

@@ -1,4 +1,22 @@
-export declare function codexModelsForPicker(liveSlugs: readonly string[]): Array<{
+import { type CodexAccountStatus } from "@opengeni/db";
+/**
+ * Derive the two distinct cached worker-readiness meanings exposed by the
+ * status route. `poolReady` means at least one effective-pool account passes
+ * the worker's cached admission predicate. `workerRoutable` additionally
+ * honors rotation-off's active-pointer-only rule; it says nothing about a
+ * session-specific manual pin.
+ */
+export declare function codexWorkerReadiness(input: {
+    effectiveSource: "workspace" | "organization" | "disabled";
+    rotationEnabled: boolean;
+    activeCredentialId: string | null;
+    accounts: ReadonlyArray<Pick<CodexAccountStatus, "id" | "status" | "allocatorEnabled" | "primaryUsedPercent" | "primaryResetAt" | "secondaryUsedPercent" | "secondaryResetAt" | "exhaustedUntil">>;
+    now: Date;
+}): {
+    poolReady: boolean;
+    workerRoutable: boolean;
+};
+export declare function codexModelsForPicker(): Array<{
     id: string;
     label: string;
     provider: string;
@@ -6,5 +24,12 @@ export declare function codexModelsForPicker(liveSlugs: readonly string[]): Arra
     api: "responses";
 }>;
 import { type ApiRouteDeps } from "@opengeni/core";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
+type ManagedCookieHuman = {
+    subjectId: string;
+    browserSessionHash: string;
+};
+export declare function requireOrganizationCodexHuman(c: Context, deps: ApiRouteDeps, organizationId: string): Promise<ManagedCookieHuman>;
+export declare function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void;
 export declare function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/github.d.ts

@@ -1,3 +1,5 @@
+import { type AccessGrant } from "@opengeni/contracts";
 import type { Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
 export declare function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function requirePublicGitHubRepositoryVerificationPermission(grant: Pick<AccessGrant, "permissions">): void;

package/dist/routes/organization-model-providers.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/workspace-artifacts.d.ts

@@ -1,3 +1,4 @@
 import { type ApiRouteDeps } from "@opengeni/core";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
+export declare function workspaceArtifactErrorResponse(context: Context, error: unknown): Response;
 export declare function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/work-discovery-observability.d.ts

@@ -16,7 +16,7 @@ export type WorkDiscoveryObservation = {
     matchCounts: Partial<Record<WorkDiscoveryMatchClass, number>>;
 };
 type WorkDiscoveryObservedRow = {
-    relatedWork: {
+    relatedWork?: {
         match: {
             class: WorkDiscoveryMatchClass;
         } | null;

package/dist/workspace-artifact-content.d.ts

@@ -0,0 +1,28 @@
+import { type ToolGatewayIdentity, type WorkspaceArtifactSourceBundle as WorkspaceArtifactSourceBundleValue, type WorkspaceArtifactVersion } from "@opengeni/contracts";
+import type { ObjectStorageDependency } from "@opengeni/core";
+export type PreparedWorkspaceArtifactContent = {
+    contentKey: string;
+    contentSha256: string;
+    sizeBytes: number;
+    sourceKey: string;
+    sourceSha256: string;
+    sourceSizeBytes: number;
+    requestedTools?: ToolGatewayIdentity[];
+    persistContent: () => Promise<void>;
+    discardContent: () => Promise<void>;
+};
+export declare function prepareWorkspaceArtifactContent(objectStorage: NonNullable<ObjectStorageDependency>, workspaceId: string, input: {
+    html: string;
+    source?: WorkspaceArtifactSourceBundleValue;
+    requestedTools?: ToolGatewayIdentity[];
+}): PreparedWorkspaceArtifactContent;
+export declare function readWorkspaceArtifactContent(objectStorage: NonNullable<ObjectStorageDependency>, input: {
+    contentKey: string;
+    sourceKey: string | null;
+    version: WorkspaceArtifactVersion;
+}): Promise<{
+    html: string;
+    source: WorkspaceArtifactSourceBundleValue;
+    requestedTools: ToolGatewayIdentity[];
+}>;
+export declare function sourceBundleFromHtml(html: string): WorkspaceArtifactSourceBundleValue;

package/dist/workspace-artifact-provenance.d.ts

@@ -0,0 +1,7 @@
+import type { WorkspaceArtifactDetailResponse, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse, WorkspaceArtifactVersion } from "@opengeni/contracts";
+type CanReadSession = (sessionId: string) => Promise<boolean>;
+export declare function redactWorkspaceArtifactListProvenance(response: WorkspaceArtifactListResponse): WorkspaceArtifactListResponse;
+export declare function projectWorkspaceArtifactVersionProvenance(version: WorkspaceArtifactVersion, canReadSession: CanReadSession): Promise<WorkspaceArtifactVersion>;
+export declare function projectWorkspaceArtifactDetailProvenance(detail: WorkspaceArtifactDetailResponse, canReadSession: CanReadSession): Promise<WorkspaceArtifactDetailResponse>;
+export declare function projectWorkspaceArtifactMutationProvenance(response: WorkspaceArtifactMutationResponse, canReadSession: CanReadSession): Promise<WorkspaceArtifactMutationResponse>;
+export {};

package/dist/workspace-deletion.d.ts

@@ -0,0 +1,6 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare function deleteWorkspaceForRequest(deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    organizationAdministratorSubjectId?: string;
+}): Promise<void>;

package/dist/workspace-tool-gateway-observability.d.ts

@@ -0,0 +1,17 @@
+import type { ToolGatewayCatalogEntry } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+export type WorkspaceToolGatewayAdapter = "http" | "mcp";
+export type WorkspaceToolGatewayOperation = "approval" | "call";
+export type WorkspaceToolGatewayOutcome = "ok" | "tool_error" | "approval_required" | "catalog_stale" | "invalid_input" | "not_found" | "rate_limited" | "failed";
+/**
+ * Low-cardinality gateway telemetry shared by HTTP/SDK/Site and aggregate MCP
+ * adapters. Tool names, workspace/subject ids, arguments, results, credentials,
+ * and approval tokens are excluded by construction.
+ */
+export declare function startWorkspaceToolGatewayObservation(observability: Observability | null | undefined, input: {
+    adapter: WorkspaceToolGatewayAdapter;
+    operation: WorkspaceToolGatewayOperation;
+    source: ToolGatewayCatalogEntry["source"] | "aggregate";
+}): {
+    end: (outcome: WorkspaceToolGatewayOutcome) => void;
+};