@opengeni/contracts 0.4.0 → 0.5.0

package/dist/index.d.ts

@@ -175,6 +175,7 @@ declare const Permission: z.ZodEnum<{
     "api_keys:manage": "api_keys:manage";
     "environments:manage": "environments:manage";
     "environments:use": "environments:use";
+    "mcp_servers:attach": "mcp_servers:attach";
     "goals:manage": "goals:manage";
     "enrollments:read": "enrollments:read";
     "enrollments:manage": "enrollments:manage";
@@ -267,6 +268,7 @@ declare const AccountGrant: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -307,6 +309,7 @@ declare const AccessGrant: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -359,6 +362,7 @@ declare const AccessContext: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
             "enrollments:read": "enrollments:read";
             "enrollments:manage": "enrollments:manage";
@@ -398,6 +402,7 @@ declare const AccessContext: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
             "enrollments:read": "enrollments:read";
             "enrollments:manage": "enrollments:manage";
@@ -441,6 +446,7 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -571,6 +577,7 @@ declare const ApiKey: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -613,6 +620,7 @@ declare const CreateApiKeyRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -655,6 +663,7 @@ declare const CreateApiKeyResponse: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
             "enrollments:read": "enrollments:read";
             "enrollments:manage": "enrollments:manage";
@@ -700,6 +709,7 @@ declare const WorkspaceMember: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -740,6 +750,7 @@ declare const ListWorkspaceMembersResponse: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
             "enrollments:read": "enrollments:read";
             "enrollments:manage": "enrollments:manage";
@@ -779,6 +790,7 @@ declare const AddWorkspaceMemberRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -815,6 +827,7 @@ declare const UpdateWorkspaceMemberRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
@@ -1158,6 +1171,29 @@ declare const ToolRef: z.ZodObject<{
     optional: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 type ToolRef = z.infer<typeof ToolRef>;
+declare const SessionMcpServerInput: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    cacheToolsList: z.ZodOptional<z.ZodBoolean>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;
+declare const SessionMcpCredentialUpdateInput: z.ZodObject<{
+    id: z.ZodString;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;
+declare const SessionMcpServerMetadata: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    url: z.ZodString;
+    headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    credentialVersion: z.ZodNumber;
+}, z.core.$strict>;
+type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;
 declare class ResourceRefConflictError extends Error {
     constructor(message: string);
 }
@@ -2714,10 +2750,18 @@ declare const Session: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
     }>>>;
+    mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        url: z.ZodString;
+        headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        credentialVersion: z.ZodNumber;
+    }, z.core.$strict>>>;
     parentSessionId: z.ZodNullable<z.ZodString>;
     createIdempotencyKey: z.ZodNullable<z.ZodString>;
     temporalWorkflowId: z.ZodNullable<z.ZodString>;
@@ -3622,10 +3666,20 @@ declare const CreateSessionRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
         "enrollments:read": "enrollments:read";
         "enrollments:manage": "enrollments:manage";
     }>>>;
+    mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        cacheToolsList: z.ZodOptional<z.ZodBoolean>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>;
     sandbox: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"shared">, z.ZodLiteral<"new">, z.ZodObject<{
         groupId: z.ZodString;
     }, z.core.$strip>]>>;
@@ -3663,6 +3717,10 @@ declare const ClientSessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             high: "high";
             xhigh: "xhigh";
         }>>;
+        mcpCredentialUpdates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            headers: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"user.interrupt">;
@@ -4505,4 +4563,4 @@ type HealthResponse = {
     ok: boolean;
 };
 
-export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, BillingBalance, BillingMode, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, type ConnectionCredentialsPort, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GitChangedPayload, GitCommit, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHubAppApiPort, GitHubAppManifestCreate, type GitHubInstallationSummary, GitHubRepository, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, PackInstallation, PackInstallationStatus, PageInfo, Permission, type PortExposureKind, ProductAccessMode, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, RevokeEnrollmentResponse, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionCapabilities, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionStatus, SessionStructuredCapabilities, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SwapActiveSandboxRequest, SwapActiveSandboxResponse, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceMember, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken };
+export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, BillingBalance, BillingMode, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, type ConnectionCredentialsPort, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GitChangedPayload, GitCommit, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHubAppApiPort, GitHubAppManifestCreate, type GitHubInstallationSummary, GitHubRepository, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, PackInstallation, PackInstallationStatus, PageInfo, Permission, type PortExposureKind, ProductAccessMode, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, RevokeEnrollmentResponse, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionCapabilities, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionMcpCredentialUpdateInput, SessionMcpServerInput, SessionMcpServerMetadata, SessionStatus, SessionStructuredCapabilities, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SwapActiveSandboxRequest, SwapActiveSandboxResponse, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceMember, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken };

package/dist/index.js

@@ -425,6 +425,10 @@ var Permission = z.enum([
   "api_keys:manage",
   "environments:manage",
   "environments:use",
+  // Attach or rotate per-session third-party MCP server credentials. Deliberately
+  // not part of the worker's default first-party MCP permission set: a sandboxed
+  // agent must not be able to hand itself new bearer credentials.
+  "mcp_servers:attach",
   "goals:manage",
   // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;
   // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine
@@ -936,17 +940,44 @@ var DocumentSearchRequest = z.object({
 var ToolRef = z.object({
   kind: z.literal("mcp"),
   id: z.string().min(1),
-  // Non-fatal-on-connect marker for an AUTO-ATTACHED (workspace-default)
-  // capability MCP server: when true, a connect / tools-list failure (e.g. an
-  // expired capability credential returning 401) must SKIP that server with a
-  // logged warning and let the turn proceed, rather than failing the whole
-  // turn before the model runs. Absent/false ⇒ STRICT: an unavailable server
-  // fails the turn (the contract for EXPLICITLY-requested tools). This flag is
-  // set server-side only, at the default-capability auto-attach seam; it is
-  // stripped from client-supplied tool refs so an explicit request always
-  // stays strict.
+  // Non-fatal-on-connect marker for MCP server refs that can degrade
+  // gracefully. Absent/false is STRICT: the id must be configured and an
+  // unavailable server fails the turn. `optional:true` is preserved for known
+  // servers and makes runtime connect/list failures skip that server; if the
+  // deployment does not configure the id, validation drops the ref. The server
+  // also sets this for auto-attached workspace-default capability MCPs.
   optional: z.boolean().optional()
 });
+var registryId = /^[A-Za-z0-9_-]+$/;
+var httpsUrl = z.string().url().refine((value) => {
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}, { message: "URL must use https" });
+var SessionMcpServerInput = z.object({
+  id: z.string().min(1).regex(registryId),
+  name: z.string().min(1).optional(),
+  url: httpsUrl,
+  allowedTools: z.array(z.string().min(1)).optional(),
+  timeoutMs: z.number().int().positive().optional(),
+  cacheToolsList: z.boolean().optional(),
+  // Write-only credential headers. Values are encrypted at rest and never
+  // returned in session responses or events; response metadata exposes names.
+  headers: z.record(z.string(), z.string()).optional()
+});
+var SessionMcpCredentialUpdateInput = z.object({
+  id: z.string().min(1).regex(registryId),
+  headers: z.record(z.string(), z.string())
+});
+var SessionMcpServerMetadata = z.object({
+  id: z.string().min(1).regex(registryId),
+  name: z.string().min(1).nullable(),
+  url: httpsUrl,
+  headerNames: z.array(z.string()).default([]),
+  credentialVersion: z.number().int().positive()
+}).strict();
 var ResourceRefConflictError = class extends Error {
   constructor(message) {
     super(message);
@@ -1555,6 +1586,9 @@ var Session = z.object({
   // Non-default first-party MCP token permissions (manager-style sessions);
   // null means the fixed worker default set.
   firstPartyMcpPermissions: z.array(Permission).nullable(),
+  // Per-session third-party MCP servers, metadata only. Credential values are
+  // write-only and never appear here.
+  mcpServers: z.array(SessionMcpServerMetadata).default([]),
   // The manager session that spawned this one via session_create (set only
   // when the creating grant carried a worker-signed sessionId claim); null for
   // direct API creates and scheduled-task runs. When set, this session's
@@ -2090,6 +2124,9 @@ var CreateSessionRequest = z.object({
   // the orchestration/environment/github tools. Capped at creation: every
   // requested permission must be held by the creating grant (no escalation).
   firstPartyMcpPermissions: z.array(Permission).optional(),
+  // Third-party MCP servers attached only to this session. Credential headers are
+  // write-only: create responses and events expose only SessionMcpServerMetadata.
+  mcpServers: z.array(SessionMcpServerInput).default([]),
   // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒
   // today's behavior (a context-dependent default resolved server-side: from
   // inside a session → "shared" with the creator's box, top-level → "new").
@@ -2122,7 +2159,10 @@ var ClientSessionEvent = z.discriminatedUnion("type", [
       resources: z.array(ResourceRef).default([]),
       tools: z.array(ToolRef).default([]),
       model: z.string().min(1).optional(),
-      reasoningEffort: ReasoningEffort.optional()
+      reasoningEffort: ReasoningEffort.optional(),
+      // Header-value rotation only. URL/name/tool settings are immutable after
+      // session create; persisted events expose metadata, never header values.
+      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional()
     })
   }),
   z.object({
@@ -2775,6 +2815,9 @@ export {
   SessionGoalCreatedBy,
   SessionGoalPausedReason,
   SessionGoalStatus,
+  SessionMcpCredentialUpdateInput,
+  SessionMcpServerInput,
+  SessionMcpServerMetadata,
   SessionStatus,
   SessionStructuredCapabilities,
   SessionTurn,