@opengeni/core 0.12.10 → 0.14.3

package/dist/index.d.ts

@@ -1,1199 +1,23 @@
-import { Settings } from '@opengeni/config';
-import { ScheduledTask, TurnInitiator, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, SessionSpawnDenial, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, SessionSkill, TurnExecutionPolicyV1, GoalSpec, FirstPartyMcpToolName, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionToolPolicyRequest, ConnectionMetadata, OpenGeniSlackBotConnectionMetadata, WorkspaceMember, NewSessionDraft, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
-export { mergeToolRefs, stableJson } from '@opengeni/contracts';
-import * as _opengeni_db from '@opengeni/db';
-import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput, ConnectionMetadataWithVerification, SessionCommandReceiptRow } from '@opengeni/db';
-import { DocumentServices } from '@opengeni/documents';
-import { EventBus } from '@opengeni/events';
-import { Observability } from '@opengeni/observability';
-import { createObjectStorage } from '@opengeni/storage';
-import { Auth } from 'better-auth';
-import { BackendUnresolvableCode, SelfhostedRelayConfig, EstablishedSandboxSession } from '@opengeni/runtime/sandbox';
-import { Context } from 'hono';
-
-type ManagedAuth = Auth<any>;
-
-type ApiSandboxSession = {
-    state?: Record<string, unknown> & {
-        sandboxId?: string;
-    };
-    running?(): Promise<boolean>;
-    exec?(args: {
-        cmd: string;
-        workdir?: string;
-        runAs?: string;
-        yieldTimeMs?: number;
-        maxOutputTokens?: number;
-    }): Promise<unknown>;
-    execCommand?(args: {
-        cmd: string;
-        workdir?: string;
-        runAs?: string;
-        yieldTimeMs?: number;
-        maxOutputTokens?: number;
-    }): Promise<string>;
-    shutdown?(options?: unknown): Promise<void>;
-    delete?(options?: unknown): Promise<void>;
-    close?(): Promise<void>;
-};
-type ApiSandboxClient = {
-    backendId: string;
-    deserializeSessionState?(state: Record<string, unknown>): Promise<Record<string, unknown>>;
-    resume?(state: Record<string, unknown>, options?: unknown): Promise<ApiSandboxSession>;
-    delete?(state: Record<string, unknown>): Promise<void>;
-};
-type ResumeBoxByIdInput = {
-    /**
-     * The backend the box was created on — the lease's `resume_backend_id`. Must
-     * match the API's configured sandbox client backendId, or the resume is
-     * rejected (a cross-backend envelope can never deserialize correctly).
-     */
-    backend: string;
-    /**
-     * The serialized resume-state envelope — the lease's `resume_state` jsonb
-     * (the record produced by `client.serializeSessionState(state)`). This is the
-     * box identity + reattach descriptor; resume() reattaches to the live box by
-     * id (warm reattach) or cold-restores from its snapshot.
-     */
-    resumeState: Record<string, unknown>;
-};
-/**
- * A live, resumed sandbox session for a SINGLE in-process op. The caller
- * resumes → uses (exec/readFile/resolvePort) → drops it; lifecycle/refcount is
- * the lease's job (P1.x), NOT this handle's. The session is non-owned by
- * construction (resume-by-id never owns the box), so dropping it does not
- * terminate the box.
- */
-type ResumedSandboxSession = ApiSandboxSession;
-
-type SessionWorkflowClient = {
-    signalUserMessage: (input: {
-        sessionId: string;
-        eventId: string;
-        workflowId: string;
-    }) => Promise<void>;
-    wakeSessionWorkflow: (input: {
-        accountId: string;
-        workspaceId: string;
-        sessionId: string;
-        workflowId: string;
-        wakeRevision: number;
-        interruptionRequested?: boolean;
-    }) => Promise<void>;
-    /** Trigger one bounded drain of already-committed workflow-wake revisions. */
-    requestSessionWorkflowWakeDispatch: () => Promise<void>;
-    signalCodexCapacity?: (input: {
-        accountId: string;
-        workspaceId: string;
-        sessionId: string;
-        workflowId: string;
-        wakeRevision: number;
-        workflowWakeRevision: number;
-    }) => Promise<void>;
-    signalApprovalDecision: (input: {
-        accountId: string;
-        workspaceId: string;
-        sessionId: string;
-        eventId: string;
-        workflowId: string;
-        workflowWakeRevision: number;
-    }) => Promise<void>;
-    syncScheduledTask: (input: {
-        task: ScheduledTask;
-    }) => Promise<void>;
-    deleteScheduledTaskSchedule: (input: {
-        temporalScheduleId: string;
-    }) => Promise<void>;
-    triggerScheduledTask: (input: {
-        task: ScheduledTask;
-        agentRunUsageIdempotencyKey: string;
-        triggerWorkflowId: string;
-        initiator: TurnInitiator;
-    }) => Promise<void>;
-    startRigVerification: (input: {
-        workspaceId: string;
-        changeId?: string;
-        versionId?: string;
-        workflowId?: string;
-    }) => Promise<void>;
-    check?: () => Promise<void>;
-};
-type DocumentIndexClient = {
-    indexDocument: (input: {
-        accountId: string;
-        workspaceId: string;
-        documentId: string;
-    }) => Promise<Document | void>;
-};
-type AppDependencies = {
-    settings: Settings;
-    db: Database;
-    bus: EventBus;
-    workflowClient: SessionWorkflowClient;
-    /** Optional provider override for deterministic API/object-storage tests. */
-    objectStorage?: ObjectStorageDependency;
-    documentIndexer?: DocumentIndexClient;
-    documentServices?: DocumentServices;
-    observability?: Observability;
-    readinessChecks?: Partial<Record<"db" | "nats" | "temporal", () => Promise<void> | void>>;
-    githubStateSecret?: string;
-    /**
-     * Optional host-provided GitHub App API seam. Embedded hosts can authorize
-     * users, inspect installations, and list repositories with their own GitHub
-     * App credentials; standalone deployments fall back to @opengeni/github.
-     */
-    githubAppApi?: GitHubAppApiPort;
-    /**
-     * Optional host-owned connection credential seam. API-side consumers use
-     * the MCP leg for Toolspace/Code Mode; worker consumers bind the same port
-     * for model MCP, Git, and sandbox-secret resolution.
-     */
-    connectionCredentials?: ConnectionCredentialsPort | null;
-    /**
-     * Optional embedding-host session ACL. Unset preserves standalone workspace
-     * authorization; once bound, every session-addressed surface fails closed on
-     * an unavailable or invalid host decision.
-     */
-    sessionAuthorization?: SessionAuthorizationPort | null;
-    managedAuth?: ManagedAuth | null;
-    /** Injectable Codex HTTP transport for deterministic API/provider tests. */
-    codexFetch?: typeof fetch;
-    /** Injectable Slack Web API transport for deterministic bot-connection tests. */
-    slackFetch?: typeof fetch;
-    sandboxClient?: ApiSandboxClient;
-    /**
-     * Resume a box by id from a serialized resume_state envelope (the lease's
-     * `resume_state` + `resume_backend_id` from P1.1) and return a live session
-     * for a single in-process op. resume → use → drop; the lease owns lifecycle,
-     * the returned handle does NOT own the box. Throws SandboxResumeError on a
-     * backend mismatch or a resume failure.
-     */
-    resumeBoxById?: (input: ResumeBoxByIdInput) => Promise<ResumedSandboxSession>;
-};
-type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
-type ApiRouteDeps = AppDependencies & {
-    objectStorage: ObjectStorageDependency;
-    githubStateSecret: string;
-    documentIndexer: DocumentIndexClient;
-    getDocumentServices: () => DocumentServices;
-    resumeBoxById: (input: ResumeBoxByIdInput) => Promise<ResumedSandboxSession>;
-};
-/**
- * The exact dependency slice used by `acceptSessionUserMessage`.
- *
- * Keeping this narrower than `ApiRouteDeps` lets control-plane callers reuse
- * the canonical admission path without constructing unrelated HTTP, document,
- * or sandbox services. The public API still passes its `ApiRouteDeps` superset.
- */
-type AcceptSessionUserMessageDependencies = Pick<AppDependencies, "settings" | "db" | "bus" | "sessionAuthorization"> & {
-    workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
-    objectStorage: ObjectStorageDependency;
-};
-
-/** One global Temporal Schedule owns bounded delivery of committed session wakes. */
-declare const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
-declare const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
-declare const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10000;
-
-type FleetServices = {
-    db: Database;
-    settings: Settings;
-    bus?: EventBus;
-    /** API-direct readiness owner for the session's home group. Production wires
-     * this to the same viewer/provider verification + rematerialization path; core
-     * tests may omit it when exercising pointer mechanics only. */
-    ensureSessionGroupReady?: (ctx: FleetContext) => Promise<FleetReadinessHold>;
-};
-type FleetReadinessHold = {
-    /** Release target liveness only after route publication settles. */
-    release: () => Promise<void>;
-};
-type FleetContext = {
-    accountId: string;
-    workspaceId: string;
-    /** The calling session (the pointer the attach/swap mutates + whose group box
-     *  is the default fleet member). */
-    sessionId: string;
-    /** The session's own group sandbox backend (modal/selfhosted/…). */
-    sessionBackend: string;
-    /** The session's own group sandbox id (the lease group). */
-    sessionGroupId: string;
-};
-/**
- * Build a session-scoped {@link FleetContext}: load the session (workspace-
- * scoped), reject a session with no box (backend:none — the fleet is only
- * meaningful for a sandboxed session), and project its group backend/id. Shared
- * by the worker-signed MCP fleet tools and the user-authenticated swap REST
- * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/
- * `sessionId` come from the trusted grant/route; the backend + group id come from
- * the session row.
- */
-declare function buildFleetContextForSession(deps: {
-    db: Database;
-}, ctx: {
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-}): Promise<FleetContext>;
-/** The dominant liveness of a fleet member, surfaced to the dock + the agent. */
-type FleetLiveness = "online" | "reconnecting" | "offline";
-/**
- * A fleet member as the agent + the dock see it (the M8b/M9 UI seam — the
- * `sandboxes_list` response entry the dock renders). STABLE shape: the dock keys
- * on `id`, renders `name`/`kind`/`liveness`, and marks `active`. The session's own
- * Modal group box is a synthetic entry with `id: groupId`, `kind: "modal"`, and a
- * null `enrollmentId`; an enrolled machine carries its sandbox + enrollment ids.
- */
-type FleetSandboxEntry = {
-    /** The sandbox id used as the attach/swap/run_on `target`. For the session's
-     *  own group box this is the group id (a null active pointer == this box). */
-    id: string;
-    kind: "modal" | "selfhosted";
-    name: string;
-    liveness: FleetLiveness;
-    /** True for the session's currently-active sandbox (the routing target). */
-    active: boolean;
-    /** True for the session's own group box (the default/home sandbox). */
-    isSessionGroup: boolean;
-    enrollmentId: string | null;
-    /** Whether this target can be attached/swapped to right now (live + addressable). */
-    attachable: boolean;
-    /** Selfhosted only: whether whole-machine + screen-control consent is acked. */
-    consented?: boolean;
-    /** Selfhosted only: whether a display (real/Xvfb) is present. */
-    hasDisplay?: boolean;
-    lastSeenAt?: string | null;
-    /** Orthogonal truth dimensions. `liveness` is only their conservative UI
-     * projection and is never evidence for a specific dimension. */
-    providerStatus: "not_created" | "creating" | "exists" | "missing" | "unknown";
-    leaseLiveness: "cold" | "warming" | "warm" | "draining" | null;
-    routeStatus: "attached" | "detached";
-    archiveStatus: "none" | "available" | "unverified" | "invalid";
-    restoreStatus: "not_required" | "pending" | "restoring" | "verifying" | "ready" | "degraded" | "unrecoverable";
-    workspaceStatus: "unknown" | "not_ready" | "ready" | "degraded" | "unrecoverable";
-    leaseEpoch: number | null;
-    routeEpoch: number;
-    /** Numeric/boolean persistence truth only. Archive locations, content hashes,
-     * provider identities, and storage handles are intentionally not projected. */
-    workspaceGeneration: number | null;
-    archiveGeneration: number | null;
-    archiveComplete: boolean;
-};
-type FleetListResult = {
-    /** The session's currently-active sandbox id, or null == the group box. */
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    sandboxes: FleetSandboxEntry[];
-};
-/** A swap/attach outcome the tool returns. On a rejection, `code` carries the
- *  typed reason (issue #341 typed diagnostics) alongside the human `reason`. */
-type FleetSwapResult = {
-    swapped: boolean;
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    reason?: string;
-    code?: BackendUnresolvableCode | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
-};
-/**
- * List the fleet: the session's own Modal group box (a synthetic entry) + the
- * workspace's first-class selfhosted sandboxes (each probed for liveness), each
- * with an `active` marker derived from the session's active pointer.
- */
-declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
-/**
- * THE SWAP (and attach — identical mechanic). Validate the target's ownership +
- * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`:
- * read the current epoch, then CAS on it. A concurrent double-swap lets exactly
- * one win; the loser re-reads + may retry. The bumped epoch fences any in-flight
- * op cached against the old pointer, which then retries against the new active
- * sandbox (the routing proxy's fenced-retry role).
- */
-declare function swapActiveSandbox(services: FleetServices, ctx: FleetContext, target: string, workingDir?: string | null): Promise<FleetSwapResult>;
-type RunOnOp = {
-    kind: "exec";
-    cmd: string;
-    workdir?: string;
-} | {
-    kind: "read";
-    path: string;
-} | {
-    kind: "write";
-    path: string;
-    content: string;
-};
-type RunOnResult = {
-    target: string;
-    kind: string;
-    ok: boolean;
-    stdout?: string;
-    stderr?: string;
-    exitCode?: number | null;
-    content?: string;
-    bytesWritten?: number;
-    reason?: string;
-};
-/**
- * Run a ONE-OFF op against a SPECIFIC target WITHOUT changing the active pointer
- * (the design `run_on`). Only selfhosted targets are routable as a one-off here
- * (a Modal target is the session's group box, reached via the normal Channel-A /
- * turn path — `run_on` is for reaching a NON-active enrolled machine without
- * swapping). The op is fenced under the target's enrollment, addressed to its
- * agent subject; an offline machine surfaces a clear reason, never a wrong-box
- * landing.
- */
-declare function runOnSandbox(services: FleetServices, ctx: FleetContext, target: string, op: RunOnOp): Promise<RunOnResult>;
-type ProvisionResult = {
-    kind: "selfhosted";
-    instructions: string;
-    installCommandUnix: string;
-    installCommandWindows: string;
-    verificationUri: string;
-    note: string;
-} | {
-    kind: "modal";
-    sandbox: SandboxRecord;
-    note: string;
-};
-/**
- * Provision a new fleet member.
- *   - selfhosted → return the device-flow enrollment instructions (the agent
- *     surfaces them to a HUMAN, who installs the agent + enrolls — the agent
- *     cannot click the loud whole-machine consent itself).
- *   - modal → create a first-class named modal `sandboxes` record (a swap target).
- *     NOTE: the Modal BOX is materialized lazily when first swapped-to (Modal
- * lifecycle is owned by the lease — unchanged per).
- */
-declare function provisionSandbox(services: FleetServices, ctx: FleetContext, input: {
-    kind: "selfhosted" | "modal";
-    name?: string;
-}): Promise<ProvisionResult>;
-
-type ChannelARoutingServices = {
-    db: Database;
-    settings: Settings;
-    bus?: EventBus;
-};
-/** Map the deployment relay URL to the leaf's `SelfhostedRelayConfig` shape. The
- *  relay URL (`OPENGENI_SELFHOSTED_RELAY_URL`) may carry a path (the relay's wss
- *  route); a path-less URL defaults to the relay's `/stream` route (M8b). */
-declare function relayConfigFromSettings(settings: Settings): SelfhostedRelayConfig;
-/** The canonical relay dial-BASE URL (`scheme://host[:port]/stream`) handed to the
- *  agent PRODUCER. The agent's relay channel appends ONLY its routing query to
- *  this base (`channel.rs`: `format!("{relay_url}{sep}{query}")`) and relies on the
- *  base ALREADY carrying the relay's `/stream` route. `OPENGENI_SELFHOSTED_RELAY_URL`
- *  is frequently pathless (e.g. `wss://relay.<env>.app.opengeni.ai`), which made the
- *  producer dial a path-less URL the relay 400s. Derive the base from the SAME parser
- *  the CONSUMER uses (`relayConfigFromSettings`) so producer + consumer always agree
- *  on `/stream` — even when the configured URL omits it. An unconfigured relay maps to
- *  `""` (graceful degrade: the agent reports no-relay rather than dialing a synthetic
- * host). Fixes preview AND managed prod with no agent rebuild. */
-declare function relayDialBaseFromSettings(settings: Settings): string;
-/** Whether the routing proxy should wrap the Channel-A box: gated by the
- *  selfhosted flag (the active pointer + swap are only meaningful then). */
-declare function routingEnabled(settings: Settings): boolean;
-/**
- * Wrap an established home session in a `RoutingSandboxSession` so a Channel-A
- * op routes to the session's currently-active sandbox. Provider homes supply a
- * lease; machine homes supply a pinned selfhosted identity and no lease. Returns
- * the established handle with its `session` replaced by the stable proxy.
- */
-declare function wrapChannelABoxWithRouting(services: ChannelARoutingServices, ids: {
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    homeLease?: {
-        sandboxGroupId: string;
-        leaseEpoch: number;
-        instanceId: string;
-        backend: string;
-    };
-    /** A machine-home Channel-A request has no cloud/home lease. Its already
-     * established SelfhostedSession is pinned to the durable active pointer so
-     * the first command uses the exact machine instance and epoch. */
-    pinnedSelfhosted?: {
-        sandboxId: string;
-        epoch: number;
-    };
-    directRequest: {
-        requestId: string;
-        holderId: string;
-    };
-}, established: EstablishedSandboxSession): EstablishedSandboxSession;
-
-type AccessDeps = {
-    db: Database;
-    settings: Settings;
-    managedAuth?: ManagedAuth | null;
-};
-declare function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext>;
-declare function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant>;
-declare function requirePermission(grant: AccessGrant, permission: Permission): void;
-declare function hasPermission(permissions: Permission[], permission: Permission): boolean;
-
-type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
-/** Maximum time an omitted host hint leaves a live session stream unchecked. */
-declare const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15000;
-declare class SessionAuthorizationDeniedError extends Error {
-    readonly reason: "not_found" | "forbidden" | "revoked" | "caller_stale";
-    readonly code = "SESSION_NOT_FOUND_OR_DENIED";
-    constructor(reason: "not_found" | "forbidden" | "revoked" | "caller_stale");
-}
-declare class SessionAuthorizationUnavailableError extends Error {
-    readonly code = "SESSION_AUTHORIZATION_UNAVAILABLE";
-    constructor(options?: ErrorOptions);
-}
-type ResolvedSessionAuthorization = {
-    actor: SessionAuthorizationActor;
-    target: SessionAuthorizationTarget;
-    relatedSessionAccess: "target" | "root";
-    reauthorizeAfterMs: number | null;
-};
-/**
- * Resolve and enforce the host ACL for one session. The target and agent actor
- * are reconstructed from workspace-scoped durable state. A request can supply
- * an immediate target id and signed attempt claims, but can never nominate a
- * lineage root or frozen initiator.
- *
- * Returns null when no host port is bound so standalone behavior stays byte-
- * for-byte unchanged and pays no additional lineage lookup.
- */
-declare function requireSessionAuthorization(deps: SessionAuthorizationDependencies, grant: AccessGrant, input: {
-    sessionId: string;
-    operation: SessionAuthorizationOperation;
-    surface: SessionAuthorizationSurface;
-}): Promise<ResolvedSessionAuthorization | null>;
-/** Resolve the host's complete current list scope for an in-database query. */
-declare function requireSessionAuthorizationListScope(deps: SessionAuthorizationDependencies, grant: AccessGrant, surface: SessionAuthorizationSurface): Promise<SessionAuthorizationListScope | null>;
-
-type LimitDependencies = Pick<ApiRouteDeps, "db" | "settings">;
-type LimitCheckInput = {
-    accountId: string;
-    workspaceId?: string;
-    action: LimitAction;
-    quantity?: number;
-    model?: string | null;
-};
-declare function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void>;
-declare function checkLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<LimitDecision>;
-declare function recordWorkspaceUsage(deps: LimitDependencies, input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId?: string | null;
-    eventType: "agent_run.created" | "file.uploaded" | "document.indexed" | "scheduled_task.fired";
-    quantity: number;
-    unit: string;
-    sourceResourceType: string;
-    sourceResourceId: string;
-    sessionId?: string | null;
-    turnId?: string | null;
-    turnAttemptId?: string | null;
-    initiator?: TurnInitiator | null;
-    initiatorContext?: TurnInitiatorContext;
-    origin?: SessionTurnSource | null;
-    idempotencyKey: string;
-}): Promise<void>;
-
-declare const officialMcpRegistryUrl = "https://registry.modelcontextprotocol.io";
-declare function buildCapabilityCatalog(input: {
-    db: Database;
-    workspaceId: string;
-    settings: Settings;
-}): Promise<CapabilityCatalogResponse>;
-declare function createCatalogItem(input: {
-    db: Database;
-    accountId: string;
-    workspaceId: string;
-    payload: CreateCapabilityCatalogItemRequest;
-}): Promise<CapabilityCatalogItem>;
-declare function enableCapability(input: {
-    db: Database;
-    grant: AccessGrant;
-    accountId: string;
-    workspaceId: string;
-    settings: Settings;
-    capabilityId: string;
-    payload: EnableCapabilityRequest;
-    probeMcpServer?: McpCapabilityProbe;
-}): Promise<CapabilityInstallation>;
-type McpCapabilityProbeInput = {
-    id: string;
-    name: string;
-    url: string;
-    timeoutMs: number;
-    headers?: Record<string, string>;
-};
-type McpCapabilityProbeResult = {
-    toolCount: number;
-};
-type McpCapabilityProbe = (input: McpCapabilityProbeInput) => Promise<McpCapabilityProbeResult>;
-declare function validateMcpCapabilityConnection(item: CapabilityCatalogItem, probe?: McpCapabilityProbe, headers?: Record<string, string>): Promise<Record<string, unknown>>;
-declare function disableCapability(input: {
-    db: Database;
-    accountId: string;
-    workspaceId: string;
-    settings: Settings;
-    capabilityId: string;
-}): Promise<CapabilityInstallation>;
-declare function settingsWithEnabledCapabilityMcpServers(db: Database, workspaceId: string, settings: Settings): Promise<Settings>;
-/**
- * Register Codex Apps as an optional runtime MCP when the deployment enables
- * it. Registration only makes the server selectable; the session tool policy
- * decides whether the model sees it, and Codex credential resolution
- * independently decides whether calls can authenticate.
- */
-declare function settingsWithCodexAppsMcpServer(settings: Settings): Settings;
-declare function settingsWithMcpCapabilityServers(settings: Settings, enabled: EnabledMcpCapabilityServer[]): Settings;
-declare function discoverMcpRegistryCapabilities(input: {
-    query?: string;
-    limit?: number;
-    fetchImpl?: McpRegistryFetch;
-    timeoutMs?: number;
-}): Promise<CapabilityCatalogItem[]>;
-
-type McpRegistryFetch = (input: URL, init?: RequestInit) => Promise<Response>;
-declare function applyCapabilityEnablement(item: CapabilityCatalogItem, installation: CapabilityInstallation | undefined, activePackIds: Set<string>): CapabilityCatalogItem;
-
-declare const MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
-declare const MAX_VARIABLES_PER_ENVIRONMENT = 100;
-declare function assertAllowedVariableSetVariableName(name: string): void;
-/** @deprecated use assertAllowedVariableSetVariableName */
-declare const assertAllowedEnvironmentVariableName: typeof assertAllowedVariableSetVariableName;
-declare function requireVariableSetEncryption(settings: Settings): Uint8Array;
-/** @deprecated use requireVariableSetEncryption */
-declare const requireEnvironmentEncryption: typeof requireVariableSetEncryption;
-declare function requireVariableSetForApi(db: Database, workspaceId: string, variableSetId: string): Promise<VariableSet>;
-/**
- * Validates an variableSet attachment supplied in a request payload (session
- * create, scheduled task create/update, pack enable). Requires the
- * `variable-sets:use` permission unless the attachment was already authorized
- * (pack-installation-inherited attachments), and maps a missing or
- * cross-variable set to 422 because the id is payload, not the route
- * target. RLS plus the workspace_id clause make cross-workspace ids
- * indistinguishable from missing ones.
- */
-declare function validateVariableSetAttachment(deps: {
-    settings: Settings;
-    db: Database;
-}, grant: AccessGrant, workspaceId: string, variableSetId: string, options?: {
-    preauthorized?: boolean;
-}): Promise<VariableSet>;
-declare function recordVariableSetAuditEvent(db: Database, input: {
-    grant: AccessGrant;
-    action: "variable_set.created" | "variable_set.updated" | "variable_set.deleted" | "variable_set.variable.set" | "variable_set.variable.deleted";
-    variableSetId: string;
-    variableName?: string;
-}): Promise<void>;
-
-declare const MAX_RIGS_PER_WORKSPACE = 50;
-declare const MAX_CHECKS_PER_RIG = 100;
-declare const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
-declare const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;
-type RigServices = {
-    db: Database;
-};
-type RigAuditAction = "rig.created" | "rig.updated" | "rig.deleted" | "rig.change.proposed" | "rig.change.verified" | "rig.change.rejected" | "rig.change.failed" | "rig.change.merged" | "rig.verification.started" | "rig.verification.passed" | "rig.verification.failed" | "rig.version.activated" | "rig.version.promoted";
-declare function recordRigAuditEvent(db: Database, input: {
-    grant: AccessGrant;
-    action: RigAuditAction;
-    rigId: string;
-    metadata?: Record<string, unknown>;
-}): Promise<void>;
-declare function rigActorForGrant(grant: AccessGrant): string;
-declare function requireRigForApi(db: Database, workspaceId: string, rigId: string): Promise<Rig>;
-declare function requireRigChangeForApi(db: Database, workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
-declare function createRigForApi(deps: RigServices, grant: AccessGrant, payload: CreateRigRequest): Promise<Rig>;
-declare function updateRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: UpdateRigRequest): Promise<Rig>;
-declare function deleteRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig): Promise<void>;
-declare function proposeRigChangeForApi(deps: RigServices, grant: AccessGrant, rig: Rig, request: ProposeRigChangeRequest, options?: {
-    proposedBy?: string;
-}): Promise<RigChange>;
-type RigVerificationClassification = {
-    status: "merged";
-    action: "auto_promote";
-} | {
-    status: "proposed";
-    action: "await_manage_promote";
-} | {
-    status: "rejected";
-    action: "reject";
-} | {
-    status: "failed";
-    action: "retryable_failure";
-};
-declare function classifyRigVerificationOutcome(input: {
-    kind: "setup_append" | "definition_edit";
-    passed: boolean;
-    infraError?: boolean;
-}): RigVerificationClassification;
-declare function appendRigSetupCommand(baseSetupScript: string | null | undefined, command: string): string;
-declare function promoteSetupAppendChange(deps: RigServices, grant: AccessGrant, rig: Rig, change: RigChange): Promise<{
-    change: RigChange;
-    version: RigVersion;
-}>;
-declare function promoteVerifiedDefinitionEditChangeForApi(deps: RigServices, grant: AccessGrant, rig: Rig, change: RigChange): Promise<{
-    change: RigChange;
-    version: RigVersion;
-}>;
-declare function createRigVersionForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: RigDefinitionEditPayload): Promise<RigVersion>;
-declare function activateRigVersionForApi(deps: RigServices, grant: AccessGrant, rig: Rig, versionId: string): Promise<RigVersion>;
-declare function listRigVersionsForApi(deps: RigServices, workspaceId: string, rigId: string): Promise<RigVersion[]>;
-declare function listRigChangesForApi(deps: RigServices, workspaceId: string, rigId: string, limit?: number): Promise<RigChange[]>;
-
-declare const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
-declare function listCapabilityPacks(): CapabilityPack[];
-declare function getCapabilityPack(packId: string): CapabilityPack | null;
-declare function isBuiltInCapabilityPack(packId: string): boolean;
-/**
- * Built-in packs plus the manifests registered for this workspace. Stored
- * manifests were validated at registration time; rows that no longer parse
- * (for example after a contract tightening) are skipped instead of breaking
- * the whole catalog.
- */
-declare function listWorkspaceCapabilityPacks(db: Database, workspaceId: string): Promise<CapabilityPack[]>;
-declare function resolveCapabilityPack(db: Database, workspaceId: string, packId: string): Promise<CapabilityPack | null>;
-/**
- * v1 pack-scoped runtime rule: at most one enabled pack per workspace may
- * declare a `sandboxImage` — there is deliberately no image composition or
- * layering. Enforced when a pack is enabled (both the packs endpoint and the
- * generic capability enable path) and re-checked at session start by the
- * worker, which also covers manifests re-registered after enablement.
- */
-declare function assertPackSandboxImageCompatible(db: Database, workspaceId: string, pack: CapabilityPack): Promise<void>;
-declare function buildMarketingDailyAnalysisAgentConfig(input: {
-    connections: SocialConnection[];
-    documentBaseIds: string[];
-    promptInstructions?: string;
-}): ScheduledTaskAgentConfig;
-
-declare function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
-type McpSettings = Pick<Settings, "mcpServers">;
-declare function enabledCapabilityMcpToolRefs(settings: McpSettings, runtimeSettings: McpSettings): ToolRef[];
-declare function withDefaultEnabledCapabilityMcpTools(tools: ToolRef[], settings: McpSettings, runtimeSettings: McpSettings): ToolRef[];
-/** Drop stored refs that are no longer present in the current runtime registry. */
-declare function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
-/** A child or fixed-policy follow-up may narrow its allow-list, never widen it. */
-declare function assertToolRefsSubset(requested: ToolRef[], allowed: ToolRef[], message?: string): void;
-/** Validate runtime availability and then enforce the durable policy fence. */
-declare function validateToolRefsForSessionPolicy(input: {
-    requested: ToolRef[];
-    settings: McpSettings;
-    allowedTools: ToolRef[];
-    message: string;
-}): ToolRef[];
-declare function normalizeResources(resources: ResourceRef[]): ResourceRef[];
-declare function mergeResourceRefs(existing: ResourceRef[], additions: ResourceRef[]): ResourceRef[];
-declare function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]): number[];
-/** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */
-declare function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null;
-declare function validateGitHubRepositorySelection(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
-/**
- * A 422 from repository selection validation is an authoritative stale or
- * revoked identity. Other failures (for example a database/catalog outage)
- * leave the result unknown and must not cause draft hydration to delete it.
- */
-declare function isAuthoritativeGitHubRepositorySelectionError(error: unknown): boolean;
-declare function validateFileResources(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
-
-type ResolvedSessionToolPolicy = {
-    toolRefs: ToolRef[];
-    effectivePolicy: SessionEffectiveToolPolicy;
-};
-type SessionToolPolicyInput = {
-    toolPolicy: SessionToolPolicy;
-    sessionTools: ToolRef[];
-    availableMcpServerIds: Iterable<string>;
-    /** Current omitted-tools defaults, intentionally narrower than all servers. */
-    defaultMcpServerIds?: Iterable<string>;
-};
-/**
- * Resolve the same ID-only policy used by API projections and worker turns.
- * This function never receives endpoint URLs, credentials, schemas, or live
- * probe results. `availableMcpServerIds` is the resolved runtime registry;
- * `defaultMcpServerIds` is the capability-only omitted-tools set.
- */
-declare function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy;
-/**
- * Native provider tools that belong to the workspace-default capability set
- * follow the same omission/narrowing fence as deferred MCP tools. A durable
- * workspace-default policy receives them; fixed historical policies and an
- * explicit per-turn replacement do not. Provider support remains a separate
- * runtime gate and must also be true before a native tool is attached.
- */
-declare function sessionToolPolicyAllowsDefaultNativeTools(policy: SessionEffectiveToolPolicy): boolean;
-/** Current full runtime registry IDs, including configured static servers. */
-declare function workspaceSessionToolPolicyServerIds(db: Database, workspaceId: string, settings: Settings): Promise<string[]>;
-/** Current omitted-tools defaults; this preserves capability-first behavior. */
-declare function workspaceSessionToolPolicyDefaultServerIds(db: Database, workspaceId: string, settings: Settings): Promise<string[]>;
-/** Add a bounded, secret-safe effective projection to a session response. */
-declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>): Session;
-
-/**
- * Whether a raw scheduled-task payload explicitly set agentConfig.tools.
- * Zod's `.default([])` erases the distinction between "absent" and
- * "explicitly empty", so callers detect it on the raw payload — the same
- * contract sessions use: absent tools mean "give me the workspace defaults
- * (enabled capability MCP servers)", an explicit list (even empty) is taken
- * verbatim.
- */
-declare function scheduledTaskToolsProvided(rawPayload: unknown): boolean;
-declare function createValidatedScheduledTask(input: {
-    settings: Settings;
-    db: Database;
-    objectStorage: ObjectStorageDependency;
-    grant: AccessGrant;
-    payload: CreateScheduledTaskRequest;
-    toolsProvided?: boolean;
-    variableSetPreauthorized?: boolean;
-}): Promise<ScheduledTask>;
-declare function validatedScheduledTaskUpdate(input: {
-    settings: Settings;
-    db: Database;
-    objectStorage: ObjectStorageDependency;
-    grant: AccessGrant;
-    existing: ScheduledTask;
-    payload: UpdateScheduledTaskRequest;
-    /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */
-    toolsProvided?: boolean;
-}): Promise<UpdateScheduledTaskInput>;
-declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
-declare function restoreScheduledTask(db: Database, task: ScheduledTask): Promise<ScheduledTask>;
-declare function syncCreatedScheduledTask(input: {
-    db: Database;
-    workflowClient: SessionWorkflowClient;
-    task: ScheduledTask;
-}): Promise<void>;
-declare function syncUpdatedScheduledTask(input: {
-    db: Database;
-    workflowClient: SessionWorkflowClient;
-    previous: ScheduledTask;
-    task: ScheduledTask;
-}): Promise<void>;
-declare function scheduledTaskTemporalScheduleId(taskId: string): string;
-/**
- * Stable token that identifies a single logical manual trigger. A client that
- * retries a `/trigger` POST (network blip, lambda re-invocation) passes the
- * SAME token so the retry is idempotent — one usage charge, one workflow run.
- * When the client supplies nothing we mint one UUID PER REQUEST and reuse it
- * for both the idempotency key and the workflowId, so a single request stays
- * internally consistent while two genuinely-distinct manual triggers (no token,
- * fired a second apart) still each get their own run. The token is sanitized to
- * the Temporal workflow-id-safe charset so a client value cannot smuggle a
- * collision into a different task's id space.
- */
-declare function scheduledTaskTriggerToken(clientTriggerId?: string | null): string;
-/**
- * Deterministic Temporal workflow id for a manual trigger. Derived purely from
- * the task id and the stable trigger token, so a retry with the same token maps
- * to the same id and `workflowIdReusePolicy: "REJECT_DUPLICATE"` collapses the
- * second start into a no-op instead of spawning a second run.
- */
-declare function manualScheduledTaskTriggerWorkflowId(taskId: string, triggerToken: string): string;
-/**
- * Deterministic usage idempotency key for a manual trigger's agent_run.created
- * charge. Shares the stable trigger token with the workflow id so the charge
- * and the run dedupe together under retry.
- */
-declare function manualScheduledTaskTriggerUsageKey(workspaceId: string, taskId: string, triggerToken: string): string;
-
-/** Transport-neutral typed denial raised only after its audit row committed. */
-declare class SessionSpawnDeniedError extends Error {
-    readonly denial: SessionSpawnDenial;
-    constructor(denial: SessionSpawnDenial);
-}
-/**
- * Resolve per-session first-party tool visibility without consulting
- * authorization. Top-level omission uses the minimal runtime default (stored
- * as null); child omission snapshots the parent's exact effective selection.
- * Explicit [] is authoritative and must never widen.
- */
-declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[];
-declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
-    readonly error: {
-        readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
-        readonly message: string;
-        readonly details: {
-            readonly denial: {
-                id: string;
-                accountId: string;
-                workspaceId: string;
-                parentSessionId: string | null;
-                rootSessionId: string | null;
-                currentDepth: number;
-                attemptedDepth: number;
-                effectiveMaxNestedAgentDepth: number;
-                requestedMaxNestedAgentDepthOverride: number | null;
-                policySource: "default" | "session" | "workspace" | "deployment";
-                policySessionId: string | null;
-                subjectId: string | null;
-                code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
-                idempotencyKey: string | null;
-                createdAt: string;
-            };
-        };
-    };
-};
-declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
-declare function createAndStartSession(input: {
-    requestedSessionId?: string;
-    db: Database;
-    bus: EventBus;
-    workflowClient: SessionWorkflowClient;
-    accountId: string;
-    workspaceId: string;
-    initialMessage: string;
-    turnInstructions?: string | null;
-    resources: ResourceRef[];
-    skills?: SessionSkill[];
-    tools: ToolRef[];
-    toolPolicy: SessionToolPolicy;
-    clientEventId?: string;
-    model: string;
-    reasoningEffort: Settings["openaiReasoningEffort"];
-    turnExecutionPolicy: TurnExecutionPolicyV1;
-    sandboxBackend: Settings["sandboxBackend"];
-    metadata: Record<string, unknown>;
-    createdBy?: TurnInitiator;
-    createdByContext?: TurnInitiatorContext;
-    createdByActor?: Extract<SessionCommandActor, {
-        type: "agent_attempt";
-    }> | null;
-    variableSet?: {
-        id: string;
-        name: string;
-    } | null;
-    rigId?: string | null;
-    rigVersionId?: string | null;
-    goal?: GoalSpec | null;
-    instructions?: string | null;
-    firstPartyMcpPermissions?: Permission[] | null;
-    firstPartyMcpTools: FirstPartyMcpToolName[];
-    mcpServers?: CreateSessionMcpServerInput[];
-    sessionMcpServers?: SessionMcpServerMetadata[];
-    parentSessionId?: string | null;
-    createIdempotencyKey?: string | null;
-    sandboxGroupId?: string | null;
-    sandboxOs?: Session["sandboxOs"];
-    seedTargetSandbox?: {
-        sandboxId: string;
-        settings: Settings;
-        workingDir?: string | null;
-    } | null;
-    consumeNewSessionDraft?: {
-        subjectId: string;
-        expectedRevision: number;
-    } | null;
-    maxNestedAgentDepthOverride?: number | null;
-    allowNestedAgentDepthIncrease?: boolean;
-    subjectId?: string | null;
-}): Promise<CreateSessionResponse>;
-declare function workflowIdForSession(sessionId: string): string;
-/**
- * Reject an explicit model that the host does not expose. The set of usable
- * models is the union surfaced by `configuredAllowedModels` (the built-in
- * provider's allow-list plus every registry provider's ids); a `model` outside
- * it cannot be resolved to a provider at run time, so we fail the request at
- * the API edge with 422 rather than enqueuing a turn the worker can't honor.
- *
- * `model` is the explicit, caller-supplied value (null/undefined when omitted).
- * An omitted model defaults to `settings.openaiModel` downstream — which is
- * always first in `configuredAllowedModels` — so only an explicit value is
- * checked. Centralized here so every model-carrying choke point
- * (create-session, user-message/turn-accept, queued-turn update, and
- * scheduled-task agentConfig — a scheduled task is a session the worker runs
- * later) and the MCP surfaces that share them validate identically and cannot
- * drift.
- */
-declare function canonicalConfiguredModel(settings: Settings, model: string | null | undefined): string | null | undefined;
-declare function assertConfiguredModel(settings: Settings, model: string | null | undefined): void;
-/**
- * Reject a model the WORKSPACE's model policy blocks, at the same choke points
- * as assertConfiguredModel — a 422 at the edge instead of a queued turn the
- * worker's authoritative post-resolution gate would fail. `model` is the
- * EFFECTIVE value the caller is about to persist: pass the explicit value at
- * message/turn-update/scheduled-task edges (omitted inherits an
- * already-validated stored default), but at session CREATION pass
- * `payload.model ?? settings.openaiModel` — an omitted model stamps the
- * deployment default onto the session, and under a restricted policy that
- * default may be exactly the provider the policy exists to block.
- */
-declare function assertWorkspaceModelPolicyAllows(db: Database, settings: Settings, workspaceId: string, model: string | null | undefined): Promise<void>;
-declare function requireQueuedTurnForApi(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<SessionTurn>;
-declare function reasoningEffortForSession(metadata: Record<string, unknown>, fallback: Settings["openaiReasoningEffort"]): Settings["openaiReasoningEffort"];
-/**
- * Appends a `user.message` to an existing session and enqueues the resulting
- * turn, merging requested resources/tools into the session and waking the
- * workflow. Shared by the public events route and the first-party MCP
- * `session_send_message` tool so the two surfaces cannot drift. Callers own
- * resource/tool validation and the per-message usage limit before calling.
- */
-declare function postUserMessageTurn(input: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
-    settings: Settings;
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    text: string;
-    turnInstructions?: string | null;
-    resources: ResourceRef[];
-    model?: string | null;
-    reasoningEffort?: Settings["openaiReasoningEffort"] | null;
-    clientEventId?: string;
-    mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
-    delivery?: "send" | "steer";
-    origin?: "human" | "operator";
-    actor?: string;
-    actorLabel?: string;
-    commandActor?: SessionCommandActor;
-    controlEtag?: string | null;
-    expectedDraftRevision?: number | null;
-    reasoningEffortFallback?: Settings["openaiReasoningEffort"];
-    turnExecutionPolicy: TurnExecutionPolicyV1;
-}): Promise<{
-    accepted: SessionEvent;
-    turn: SessionTurn;
-}>;
-/**
- * Full create-session flow shared by `POST /sessions` and the first-party MCP
- * `session_create` tool: payload validation, resource/tool/variableSet
- * checks, usage limits, session start, and usage recording. `rawPayload` is
- * the unparsed request body so absent-vs-empty execution-context fields keep
- * their meaning: a child inherits omitted resources/tools/mcpServers from its
- * trusted immediate parent, while explicit arrays (including []) win. A
- * top-level create with omitted tools applies workspace-default capability MCPs.
- */
-declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown): Promise<Session>;
-/**
- * Full accept-user-message flow shared by the `user.message` branch of
- * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
- * tool: resource/tool validation, usage limits, the locked append + turn
- * enqueue, and usage recording. `toolsProvided: false` durably preserves an
- * Tool selection is durable session state and never rides a follow-up prompt.
- */
-declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
-    text: string;
-    turnInstructions?: string | null;
-    resources?: ResourceRef[];
-    model?: string | null;
-    reasoningEffort?: ReasoningEffort | null;
-    clientEventId?: string;
-    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
-    delivery?: "send" | "steer";
-    origin?: "human" | "operator";
-    controlEtag?: string | null;
-    expectedDraftRevision?: number | null;
-}): Promise<{
-    accepted: SessionEvent;
-    turn: SessionTurn;
-}>;
-/**
- * Shared title-write path for the manual rename route AND both MCP tools
- * (set_session_title / set_other_session_title). The clobber guard lives in
- * the db `updateSessionTitle` UPDATE: an agent write is skipped when a user
- * title already pinned the session. On a real write we emit `session.title_set`
- * exactly like goal mutations emit their events; when nothing changed (agent
- * write blocked by the user lock) we emit nothing. Returns whether a write
- * happened so callers can avoid double work.
- */
-declare function updateSessionTitle(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, grant: AccessGrant, sessionId: string, title: string, source: "user" | "agent"): Promise<{
-    updated: boolean;
-    title: string | null;
-    relatedSessionAccess: "target" | "root";
-}>;
-/**
- * Update one existing session MCP server's approval policy. The database
- * serializes this write with attempt claim under the session lock: an already
- * claimed attempt retains its immutable snapshot, while the next claim captures
- * this value. No attempt is cancelled, restarted, or reinterpreted.
- */
-declare function updateSessionMcpApprovalPolicy(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, grant: AccessGrant, sessionId: string, serverId: string, requireApproval: SessionMcpApprovalPolicy): Promise<UpdateSessionMcpApprovalPolicyResponse>;
-/**
- * Replace the durable session tool policy. The target and its parent (when
- * present) are locked by the DB event-writer helper, and the update/event are
- * committed under one version-fenced transaction. An already claimed turn
- * keeps its immutable snapshot; the next attempt observes this policy.
- */
-declare function updateSessionToolPolicy(deps: {
-    db: Database;
-    bus: EventBus;
-    settings: Settings;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, grant: AccessGrant, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
-declare function readSessionLineage(deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">, grant: AccessGrant, sessionId: string): Promise<_opengeni_db.SessionLineage>;
-
-declare function openGeniSlackBotMetadata(metadata: Record<string, unknown>): OpenGeniSlackBotConnectionMetadata | null;
-declare function isOpenGeniSlackBotConnection(connection: ConnectionMetadata & Partial<Pick<ConnectionMetadataWithVerification, "verifiedInstallAt" | "verifiedInstallVersion">>): boolean;
-declare function hasReservedOpenGeniSlackBotMetadata(metadata: Record<string, unknown> | null | undefined): boolean;
-declare function hasReservedOpenGeniSlackBotSessionMetadata(metadata: Record<string, unknown> | null | undefined): boolean;
-/**
- * Internal, pre-authorized lookup used by the scheduler and Slack tool adapter.
- * Public callers must perform their permission check before calling this helper.
- */
-declare function requireOpenGeniSlackBotConnection(db: Database, workspaceId: string, connectionId: string): Promise<ConnectionMetadata>;
-declare function validateOpenGeniSlackBotConnectionSelection(db: Database, grant: AccessGrant, workspaceId: string, connectionId: string): Promise<ConnectionMetadata>;
-declare function scheduledSlackBotConnectionId(metadata: Record<string, unknown> | null | undefined): string | null;
-/**
- * The scheduler writes the connection pointer together with immutable creator
- * provenance. Requiring both prevents ordinary session metadata from becoming
- * an authorization mechanism for a workspace-shared bot credential.
- */
-declare function isTrustedScheduledSlackBotSession(session: Pick<Session, "createdBy" | "createdByContext" | "metadata">): boolean;
-
-/** A member can manage other members (directly or via the admin wildcard). */
-declare function memberCanAdminister(member: Pick<WorkspaceMember, "permissions">): boolean;
-/** Only `user:` subjects are people; `api_key:` subjects belong to API keys. */
-declare function isUserMember(member: Pick<WorkspaceMember, "subjectId">): boolean;
-/**
- * Turn an email lookup result into the membership subject id. A null id means
- * no registered user matched the email — email invites for not-yet-registered
- * users are deferred, so that is a 404 (not a 400) at the API surface.
- */
-declare function resolveMemberSubjectId(userId: string | null): string;
-/**
- * Guard the member-remove path. Refuses (409) to remove the caller's own
- * membership and refuses to remove the last member that still holds an admin
- * permission, so a workspace can never be orphaned with no one able to manage
- * it. `members` is the full roster (every subject, including api_key ones —
- * an api_key with workspace:admin still counts as an administering subject).
- */
-declare function assertWorkspaceMemberRemovable(input: {
-    members: WorkspaceMember[];
-    subjectId: string;
-    callerSubjectId: string;
-}): void;
-/**
- * Guard the workspace-delete path before any external/DB mutation. Refuses
- * (409) to delete the account's last workspace, and refuses while any session
- * could still be running in Temporal (there is no clean per-session terminate
- * to call first, so we will not orphan a workflow — the operator must stop the
- * sessions first).
- */
-declare function assertWorkspaceDeletable(input: {
-    workspaceCountForAccount: number;
-    activeSessionCount: number;
-}): void;
-
-type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
-/** Read the authenticated actor's server-authoritative pre-session composer state. */
-declare function getActorNewSessionDraft(deps: Pick<NewSessionDraftDependencies, "settings" | "db">, grant: AccessGrant, workspaceId: string): Promise<NewSessionDraft>;
-/**
- * Validate and save one exact actor-private draft revision. Create-time-only
- * checks (live machine target, rig/variable-set state, and permission
- * delegation) intentionally remain in createSessionForRequest: a recoverable
- * draft may represent incomplete options, while no invalid option can become a
- * session without passing that single canonical create boundary.
- */
-declare function saveActorNewSessionDraft(deps: NewSessionDraftDependencies, grant: AccessGrant, workspaceId: string, rawInput: unknown): Promise<NewSessionDraft>;
-
-type HumanSessionCommandContext = {
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    subjectId: string;
-    /** See AgentSessionCommandContext.authorizationSurface. */
-    authorizationSurface?: SessionAuthorizationSurface;
-};
-type AgentSessionCommandContext = {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-    callerSessionId: string;
-    callerTurnId: string;
-    callerAttemptId: string;
-    callerExecutionGeneration: number;
-    /**
-     * The trusted adapter surface that owns this command's one authorization
-     * decision. Direct core callers omit it and retain the canonical `core`
-     * surface; adapters that delegate the complete command set it explicitly so
-     * they do not authorize once at the edge and then repeat the host call here.
-     */
-    authorizationSurface?: SessionAuthorizationSurface;
-};
-type SessionAuthorizationCommandDeps = {
-    db: Database;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-};
-declare function sendAgentSessionMessage(deps: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: AgentSessionCommandContext, input: {
-    targetSessionId: string;
-    text: string;
-    idempotencyKey: string;
-}): Promise<_opengeni_db.AgentInternalUpdateCommandResult>;
-declare function steerAgentSession(deps: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: AgentSessionCommandContext, input: {
-    targetSessionId: string;
-    instruction: string;
-    idempotencyKey: string;
-}): Promise<_opengeni_db.AgentInternalUpdateCommandResult>;
-declare function controlAgentSessionWorkstream(deps: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: AgentSessionCommandContext, input: {
-    targetSessionId: string;
-    action: "pause" | "resume";
-    idempotencyKey: string;
-    reason?: string | null;
-}): Promise<{
-    authorization: ResolvedSessionAuthorization | null;
-    receipt: SessionCommandReceiptRow;
-    control: _opengeni_db.EffectiveSessionControl;
-    sessionControlEventId: string;
-    workspaceControlEventId: string;
-    interruptionCount: number;
-    wakeCount: number;
-    replay: boolean;
-}>;
-declare function moveHumanQueuePrompt(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, turnId: string, input: MoveSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-declare function deleteHumanQueuePrompt(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, turnId: string, input: DeleteSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-declare function editHumanQueuePrompt(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, turnId: string, input: EditSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-declare function steerHumanQueuePrompt(deps: {
-    db: Database;
-    bus: EventBus;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, turnId: string, input: SteerSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-declare function controlHumanSessionWorkstream(deps: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
-    sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, input: SessionControlRequest): Promise<SessionControlResponse>;
-declare function controlHumanWorkspace(deps: {
-    db: Database;
-    bus: EventBus;
-    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
-}, context: Omit<HumanSessionCommandContext, "sessionId">, input: WorkspaceInferenceControlRequest): Promise<WorkspaceInferenceControlResponse>;
-declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
-declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
-
-export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetReadinessHold, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, SessionSpawnDeniedError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getActorNewSessionDraft, getCapabilityPack, getHumanComposerDraft, hasPermission, hasReservedOpenGeniSlackBotMetadata, hasReservedOpenGeniSlackBotSessionMetadata, isAuthoritativeGitHubRepositorySelectionError, isBuiltInCapabilityPack, isOpenGeniSlackBotConnection, isTrustedScheduledSlackBotSession, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, openGeniSlackBotMetadata, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requireOpenGeniSlackBotConnection, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveFirstPartyMcpToolsForCreate, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveActorNewSessionDraft, saveHumanComposerDraft, scheduledSlackBotConnectionId, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionSpawnDenialEnvelope, sessionToolPolicyAllowsDefaultNativeTools, sessionWithEffectiveToolPolicy, settingsWithCodexAppsMcpServer, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, updateSessionToolPolicy, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateOpenGeniSlackBotConnectionSelection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };
+export * from "./dependencies";
+export * from "./workflow-wake-contract";
+export * from "./sandbox-types";
+export * from "./managed-auth-type";
+export * from "./transcription";
+export * from "./sandbox/fleet";
+export * from "./sandbox/routing";
+export * from "./access";
+export * from "./session-authorization";
+export * from "./billing/limits";
+export * from "./domain/capabilities";
+export * from "./domain/environments";
+export * from "./rigs";
+export * from "./domain/packs";
+export * from "./domain/resources";
+export * from "./domain/session-tool-policy";
+export * from "./domain/scheduled-tasks";
+export * from "./domain/sessions";
+export * from "./domain/insights";
+export * from "./domain/slack-bot";
+export * from "./domain/workspace-members";
+export * from "./application/new-session-drafts";
+export * from "./application/session-commands";