@opengeni/api-router 3.0.1 → 3.1.2

package/dist/mcp/child-read-evidence.d.ts

@@ -0,0 +1,9 @@
+/** Select only whole items that actually survived the model-facing envelope.
+ * A cursor is a position, never proof that preceding content was consumed. */
+export declare function completeChildReadSequences(page: {
+    view: string;
+    sourceExact: boolean;
+    events: readonly ({
+        sequence: number;
+    } & Record<string, unknown>)[];
+}): number[];

package/dist/mcp/company-profile-agent-admin.d.ts

@@ -14,6 +14,18 @@ export type RegisterCompanyProfileAgentAdminToolsInput = {
     db: Database;
     attempt: CompanyProfileAgentAttempt;
     authorize: () => Promise<void>;
+    /**
+     * The refusal for a caller that may not administer the organization
+     * profile even with the owner's authority (an agent started from a Site
+     * page), or null.
+     */
+    refuseSiteAgent: () => Promise<{
+        isError: true;
+        content: Array<{
+            type: "text";
+            text: string;
+        }>;
+    } | null>;
     json: JsonResult;
     router?: Pick<ReturnType<typeof createCompanyProfileAgentAdminRouter>, "propose" | "confirm">;
 };

package/dist/mcp/contract-input.d.ts

@@ -0,0 +1,13 @@
+import * as z from "zod/v4";
+/**
+ * Publish the input side of a contract, validate it, and retain the exact call.
+ * MCP parsing must not insert defaults, trim text, or erase omitted fields before
+ * the application applies presence-sensitive inheritance and authority rules.
+ * A narrower projection may hide host-only fields; validation retains the full
+ * contract's preprocessors and cross-field checks.
+ */
+export declare function contractToolInput<T extends z.ZodObject>(projection: T, validation?: z.ZodType, options?: {
+    jsonObjectFields?: readonly string[];
+}): z.ZodType<z.input<T>, z.input<T>>;
+/** Every named input and array element needs a schema. Dictionary values may be arbitrary JSON. */
+export declare function assertDescribedToolInput(schema: unknown, tool?: string): void;

package/dist/mcp/documents.d.ts

@@ -1,3 +1,4 @@
+import type { Settings } from "@opengeni/config";
 import type { DocumentServices } from "@opengeni/documents";
 import { type KnowledgeContext, type Database } from "@opengeni/db";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -5,4 +6,5 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  * chunk/base retrieval is retired: it cannot bypass pending Knowledge review. */
 export declare function buildDocumentsMcpServer(db: Database, accountId: string, workspaceId: string, documentServices: DocumentServices, options: {
     knowledge: KnowledgeContext;
+    settings?: Settings;
 }): McpServer;

package/dist/mcp/first-party-tool-permissions.d.ts

@@ -1,608 +1,5 @@
-import { type FirstPartyMcpToolName, type Permission } from "@opengeni/contracts";
-export type FirstPartyToolAuthorization = {
-    sessionRequired?: true;
-    allOf?: readonly Permission[];
-    anyOf?: readonly Permission[];
-};
 /**
- * Authorization is deliberately complete and separate from visibility. The
- * `satisfies Record` check makes every catalog addition choose an explicit
- * registration predicate before it can compile.
+ * The per-tool registration predicate lives in `@opengeni/contracts` so the
+ * worker can read the same data; this module keeps the API's import path.
  */
-export declare const FIRST_PARTY_TOOL_AUTHORIZATION: {
-    set_session_title: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    goal_set: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    goal_update: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    goal_progress: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    wait_for_input: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    goal_complete: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    goal_pause: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    goal_resume: {
-        sessionRequired: true;
-        allOf: "goals:manage"[];
-    };
-    knowledge_search: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    knowledge_get: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    knowledge_browse: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    knowledge_retain_file: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "files:read")[];
-    };
-    knowledge_retain_message: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:read")[];
-    };
-    knowledge_save: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    knowledge_archive: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    instruction_policy_save: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    instruction_policy_get: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    memory_search: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    memory_save: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    memory_correct: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    preference_registry_summary: {
-        sessionRequired: true;
-        allOf: "workspace:read"[];
-    };
-    preference_registry_get: {
-        sessionRequired: true;
-        allOf: "workspace:read"[];
-    };
-    task_notes_list: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    task_note_save: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    task_note_archive: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    task_note_replace: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    work_claim_upsert: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    work_claim_release: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    knowledge_propose: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    knowledge_correct: {
-        sessionRequired: true;
-        allOf: "documents:search"[];
-    };
-    task_note_promote_knowledge: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:control")[];
-    };
-    task_note_promote_instruction_policy: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:control" | "workspace:read")[];
-    };
-    task_note_promote_preference: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:control" | "workspace:read")[];
-    };
-    instruction_policy_propose: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "workspace:read")[];
-    };
-    preference_propose: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "workspace:read")[];
-    };
-    remember: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:control" | "workspace:read")[];
-    };
-    remember_confirm: {
-        sessionRequired: true;
-        allOf: ("documents:search" | "sessions:control" | "workspace:read")[];
-    };
-    company_profile_propose: {
-        sessionRequired: true;
-        allOf: ("sessions:control" | "workspace:read")[];
-    };
-    company_profile_confirm: {
-        sessionRequired: true;
-        allOf: ("sessions:control" | "workspace:read")[];
-    };
-    sandboxes_list: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    sandbox_attach: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    sandbox_swap: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    run_on: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    sandbox_provision: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    connected_machine_remove: {
-        allOf: "enrollments:manage"[];
-    };
-    rig_list: {
-        allOf: "rigs:use"[];
-    };
-    rig_get: {
-        allOf: "rigs:use"[];
-    };
-    rig_propose_change: {
-        allOf: "rigs:use"[];
-    };
-    rig_verify: {
-        allOf: "rigs:use"[];
-    };
-    rig_promote: {
-        allOf: "rigs:manage"[];
-    };
-    sessions_list: {
-        allOf: "sessions:read"[];
-    };
-    session_get: {
-        allOf: "sessions:read"[];
-    };
-    session_events: {
-        allOf: "sessions:read"[];
-    };
-    session_wait: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    command_wait: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    command_read: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    session_create: {
-        allOf: "sessions:create"[];
-    };
-    session_send_message: {
-        allOf: "sessions:control"[];
-    };
-    session_pause: {
-        allOf: "sessions:control"[];
-    };
-    session_resume: {
-        allOf: "sessions:control"[];
-    };
-    session_steer: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    session_human_input_respond: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    set_other_session_title: {
-        allOf: "sessions:control"[];
-    };
-    interaction_discover: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    browser_open: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_tabs: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_observe: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    browser_act: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_clipboard: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    browser_debug: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    browser_auth: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    interaction_request_human: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_identity: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_publish: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    browser_lifecycle: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    computer_open: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    computer_targets: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    computer_observe: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    computer_clipboard: {
-        sessionRequired: true;
-        allOf: "sessions:read"[];
-    };
-    computer_act: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    computer_lifecycle: {
-        sessionRequired: true;
-        allOf: "sessions:control"[];
-    };
-    variable_set_list: {
-        allOf: ("secrets:list" | "variable-sets:list")[];
-    };
-    environment_list: {
-        allOf: ("secrets:list" | "variable-sets:list")[];
-    };
-    variable_set_get_variable: {
-        sessionRequired: true;
-        allOf: ("secrets:read" | "variable-sets:read")[];
-    };
-    variable_set_set_variable: {
-        allOf: ("secrets:write" | "variable-sets:write")[];
-    };
-    environment_set_variable: {
-        allOf: ("secrets:write" | "variable-sets:write")[];
-    };
-    capability_catalog_search: {
-        sessionRequired: true;
-        allOf: "workspace:read"[];
-    };
-    capability_authorization_request: {
-        sessionRequired: true;
-        allOf: "workspace:read"[];
-    };
-    github_connect_link: {
-        allOf: "github:use"[];
-    };
-    github_repositories_list: {
-        allOf: "github:use"[];
-    };
-    social_connections_list: {
-        allOf: "connections:read"[];
-    };
-    social_posts_recent: {
-        allOf: "connections:read"[];
-    };
-    social_daily_analysis_context: {
-        allOf: "connections:read"[];
-    };
-    social_search_live: {
-        allOf: "connections:read"[];
-    };
-    social_mentions_live: {
-        allOf: "connections:read"[];
-    };
-    social_thread_fetch: {
-        allOf: "connections:read"[];
-    };
-    social_posts_sync: {
-        allOf: "connections:write"[];
-    };
-    social_post_reply: {
-        allOf: "connections:write"[];
-    };
-    x_accounts_list: {
-        allOf: "connections:read"[];
-    };
-    x_search_live: {
-        allOf: "connections:read"[];
-    };
-    x_mentions_live: {
-        allOf: "connections:read"[];
-    };
-    x_thread_fetch: {
-        allOf: "connections:read"[];
-    };
-    x_posts_sync: {
-        allOf: "connections:write"[];
-    };
-    x_post_reply: {
-        allOf: "connections:write"[];
-    };
-    reddit_accounts_list: {
-        allOf: "connections:read"[];
-    };
-    reddit_search_live: {
-        allOf: "connections:read"[];
-    };
-    reddit_mentions_live: {
-        allOf: "connections:read"[];
-    };
-    reddit_thread_fetch: {
-        allOf: "connections:read"[];
-    };
-    reddit_posts_sync: {
-        allOf: "connections:write"[];
-    };
-    reddit_post_reply: {
-        allOf: "connections:write"[];
-    };
-    scheduled_tasks_list: {
-        anyOf: ("scheduled_tasks:manage" | "scheduled_tasks:run")[];
-    };
-    scheduled_tasks_get: {
-        anyOf: ("scheduled_tasks:manage" | "scheduled_tasks:run")[];
-    };
-    scheduled_tasks_create: {
-        allOf: "scheduled_tasks:manage"[];
-    };
-    scheduled_tasks_update: {
-        allOf: "scheduled_tasks:manage"[];
-    };
-    scheduled_tasks_pause: {
-        allOf: "scheduled_tasks:manage"[];
-    };
-    scheduled_tasks_resume: {
-        allOf: "scheduled_tasks:manage"[];
-    };
-    scheduled_tasks_trigger: {
-        allOf: "scheduled_tasks:run"[];
-    };
-    scheduled_tasks_delete: {
-        allOf: "scheduled_tasks:manage"[];
-    };
-    scheduled_task_runs_list: {
-        anyOf: ("scheduled_tasks:manage" | "scheduled_tasks:run")[];
-    };
-    slack_bot_list_channels: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_search: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_channel_history: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_thread_replies: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_list_users: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_list_files: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_file_info: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_file_content: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_post_message: {
-        allOf: "connections:read"[];
-    };
-    slack_bot_delete_message: {
-        allOf: "connections:read"[];
-    };
-    fiken_companies_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_contacts_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_products_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_invoices_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_invoice_get: {
-        allOf: "connections:read"[];
-    };
-    fiken_bank_accounts_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_purchases_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_sales_list: {
-        allOf: "connections:read"[];
-    };
-    fiken_contact_create: {
-        allOf: "connections:write"[];
-    };
-    fiken_invoice_draft_create: {
-        allOf: "connections:write"[];
-    };
-    atlassian_sources_list: {
-        allOf: "connections:read"[];
-    };
-    atlassian_search: {
-        allOf: "connections:read"[];
-    };
-    atlassian_get: {
-        allOf: "connections:read"[];
-    };
-    artifacts_list: {
-        allOf: "artifacts:read"[];
-    };
-    artifacts_get_source: {
-        sessionRequired: true;
-        allOf: "artifacts:read"[];
-    };
-    artifacts_prepare_upload: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    artifacts_create: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    artifacts_publish: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    artifacts_rollback: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    artifacts_archive: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    artifacts_restore: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    sandbox_file_publish: {
-        sessionRequired: true;
-        allOf: ("files:read" | "files:upload")[];
-    };
-    editable_artifact_list: {
-        sessionRequired: true;
-        allOf: "artifacts:read"[];
-    };
-    editable_artifact_create: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    editable_artifact_import: {
-        sessionRequired: true;
-        allOf: ("artifacts:publish" | "files:read")[];
-    };
-    editable_artifact_get: {
-        sessionRequired: true;
-        allOf: "artifacts:read"[];
-    };
-    editable_artifact_inspect: {
-        sessionRequired: true;
-        allOf: "artifacts:read"[];
-    };
-    editable_artifact_apply: {
-        sessionRequired: true;
-        allOf: "artifacts:publish"[];
-    };
-    editable_artifact_export: {
-        sessionRequired: true;
-        allOf: "artifacts:read"[];
-    };
-    editable_artifact_export_status: {
-        sessionRequired: true;
-        allOf: ("artifacts:read" | "files:upload")[];
-    };
-    project_list: {
-        allOf: "sessions:read"[];
-    };
-    project_get: {
-        allOf: "sessions:read"[];
-    };
-    project_create: {
-        allOf: "sessions:create"[];
-    };
-    project_update: {
-        allOf: "sessions:create"[];
-    };
-    project_reorder: {
-        allOf: "sessions:create"[];
-    };
-    project_delete: {
-        allOf: "sessions:create"[];
-    };
-    session_set_project: {
-        allOf: "sessions:control"[];
-    };
-};
-/**
- * The permissions a session's first-party tool selection can possibly
- * exercise, derived from the same per-tool registration data that gates the
- * MCP surface. A caller that only proxies REST handlers on behalf of a
- * selection (the Codemode SDK proxy) must never hold more than this: a
- * selection without any session_* orchestration tool cannot need
- * sessions:create or sessions:control, so a delegated token for it must not
- * carry them either. `anyOf` alternatives are all counted because any one of
- * them could be the permission the selection actually holds.
- */
-export declare function permissionsRequiredByFirstPartyTools(tools: readonly FirstPartyMcpToolName[]): Permission[];
+export { FIRST_PARTY_TOOL_AUTHORIZATION, permissionsRequiredByFirstPartyTools, type FirstPartyToolAuthorization, } from "@opengeni/contracts";

package/dist/mcp/notification-tools.d.ts

@@ -0,0 +1,26 @@
+import { type AccessGrant } from "@opengeni/contracts";
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+type JsonResult = (value: unknown) => {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+type AttemptClaims = {
+    callerTurnId: string;
+    callerExecutionGeneration: number;
+    callerAttemptId: string;
+};
+export type RegisterNotificationToolsInput = {
+    server: McpServer;
+    deps: ApiRouteDeps;
+    grant: AccessGrant;
+    sessionId: string;
+    authorize: () => Promise<void>;
+    /** The calling attempt; notifications are fenced to it. */
+    attempt: () => AttemptClaims;
+    json: JsonResult;
+};
+export declare function registerNotificationTools(input: RegisterNotificationToolsInput): void;
+export {};