@opengeni/core 0.16.2 → 0.17.1

package/dist/domain/personal-connection-delegations.d.ts

@@ -0,0 +1,48 @@
+import type { McpServerConfig, Settings } from "@opengeni/config";
+import type { AccessGrant, ConnectionMetadata, McpPersonalConnectionDelegation, SessionTurn, ToolRef } from "@opengeni/contracts";
+import { type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult } from "@opengeni/db";
+export type PersonalConnectionDelegationSource = {
+    kind: "subject";
+    subjectId: string;
+} | {
+    kind: "turn";
+    sessionId: string;
+    turnId: string;
+} | {
+    kind: "none";
+};
+export declare function directPersonalConnectionSubjectId(turn: Pick<SessionTurn, "source" | "initiator" | "initiatorContext">): string | undefined;
+export declare function personalConnectionDelegationSourceForGrant(grant: AccessGrant): PersonalConnectionDelegationSource;
+export declare function selectedPersonalConnectionServers(settings: Pick<Settings, "mcpServers">, tools: ToolRef[]): McpServerConfig[];
+export declare function personalConnectionDelegationsFromVisibleConnections(input: {
+    servers: McpServerConfig[];
+    subjectId: string;
+    connections: ConnectionMetadata[];
+}): McpPersonalConnectionDelegation[];
+export declare function personalConnectionDelegationsFromParent(input: {
+    servers: McpServerConfig[];
+    parentDelegations: McpPersonalConnectionDelegation[];
+}): McpPersonalConnectionDelegation[];
+export declare function personalConnectionDelegationsEqual(left: McpPersonalConnectionDelegation[], right: McpPersonalConnectionDelegation[]): boolean;
+export declare function personalConnectionDelegationForServer(delegations: McpPersonalConnectionDelegation[], server: Pick<McpServerConfig, "id" | "connectionRef">): McpPersonalConnectionDelegation | null;
+type ConnectionCredentialResolver = (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+/**
+ * Resolves subject-owned MCP credentials only through the exact authority
+ * frozen on the causal turn. A direct human subject, worker Toolspace caller,
+ * retry, or recovery can identify the caller, but none may widen or replace
+ * the persisted connection UUID.
+ */
+export declare function withFrozenPersonalConnectionDelegations(input: {
+    resolveCredential: ConnectionCredentialResolver;
+    settings: Pick<Settings, "mcpServers">;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    ownerHasWorkspaceMembership: (subjectId: string) => Promise<boolean>;
+}): ConnectionCredentialResolver;
+export declare function freezePersonalConnectionDelegations(input: {
+    db: Database;
+    workspaceId: string;
+    settings: Pick<Settings, "mcpServers">;
+    tools: ToolRef[];
+    source: PersonalConnectionDelegationSource;
+}): Promise<McpPersonalConnectionDelegation[]>;
+export {};

package/dist/domain/scheduled-tasks.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import type { AccessGrant, ScheduledTask, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
+import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
 import { type Database, type UpdateScheduledTaskInput } from "@opengeni/db";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
@@ -32,7 +32,12 @@ export declare function validatedScheduledTaskUpdate(input: {
     toolsProvided?: boolean;
 }): Promise<UpdateScheduledTaskInput>;
 export declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
-export declare function restoreScheduledTask(db: Database, task: ScheduledTask): Promise<ScheduledTask>;
+export type ScheduledTaskRestoreState = {
+    task: ScheduledTask;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+};
+export declare function captureScheduledTaskRestoreState(db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
+export declare function restoreScheduledTask(db: Database, previous: ScheduledTaskRestoreState): Promise<ScheduledTask>;
 export declare function syncCreatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;
@@ -41,7 +46,7 @@ export declare function syncCreatedScheduledTask(input: {
 export declare function syncUpdatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;
-    previous: ScheduledTask;
+    previous: ScheduledTaskRestoreState;
     task: ScheduledTask;
 }): Promise<void>;
 export declare function scheduledTaskTemporalScheduleId(taskId: string): string;

package/dist/domain/sessions.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import type { AcceptSessionUserMessageDependencies, ApiRouteDeps, SessionWorkflowClient } from "../dependencies";
@@ -40,6 +40,14 @@ export declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedErro
         };
     };
 };
+export type FrozenCreationInitiator = {
+    initiator?: TurnInitiator;
+    context?: TurnInitiatorContext;
+    actor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }>;
+};
+export declare function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator;
 export declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
 export declare function createAndStartSession(input: {
     requestedSessionId?: string;
@@ -79,6 +87,7 @@ export declare function createAndStartSession(input: {
     firstPartyMcpTools: FirstPartyMcpToolName[];
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
@@ -165,6 +174,7 @@ export declare function postUserMessageTurn(input: {
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     actor?: string;

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export * from "./domain/capabilities";
 export * from "./domain/environments";
 export * from "./rigs";
 export * from "./domain/packs";
+export * from "./domain/personal-connection-delegations";
 export * from "./domain/resources";
 export * from "./domain/session-tool-policy";
 export * from "./domain/scheduled-tasks";

package/dist/index.js

@@ -354,6 +354,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       return pointer ?? { activeSandboxId: null, activeEpoch: 0 };
     },
     resolveActiveBackend: resolver,
+    ...services.onSandboxOperation ? { onOperation: services.onSandboxOperation } : {},
     ...beforeMutation ? { beforeMutation } : {},
     ...afterMutation ? { afterMutation } : {},
     ...beforeProcessMutation ? { beforeProcessMutation } : {},
@@ -3150,6 +3151,158 @@ async function listRigChangesForApi(deps, workspaceId, rigId, limit) {
   return await listRigChanges(deps.db, workspaceId, rigId, limit);
 }
 
+// src/domain/personal-connection-delegations.ts
+import {
+  getSessionTurnPersonalConnectionDelegations,
+  getWorkspaceGrant as getWorkspaceGrant2,
+  listConnectionsMetadata as listConnectionsMetadata2
+} from "@opengeni/db";
+function directPersonalConnectionSubjectId(turn) {
+  if (turn.source !== "user" && turn.source !== "api" || turn.initiator.kind !== "subject") {
+    return void 0;
+  }
+  return ["via", "viaTruncated", "provenanceError", "backfill"].some(
+    (key) => Object.prototype.hasOwnProperty.call(turn.initiatorContext, key)
+  ) ? void 0 : turn.initiator.subjectId;
+}
+function personalConnectionDelegationSourceForGrant(grant) {
+  const callerSessionId = grant.metadata?.["sessionId"];
+  const callerTurnId = grant.metadata?.["turnId"];
+  if (typeof callerSessionId === "string" && typeof callerTurnId === "string") {
+    return { kind: "turn", sessionId: callerSessionId, turnId: callerTurnId };
+  }
+  if (grant.principalKind === "agent_attempt" || grant.principalKind === "service" || grant.serviceInitiator) {
+    return { kind: "none" };
+  }
+  return { kind: "subject", subjectId: grant.subjectId };
+}
+function selectedPersonalConnectionServers(settings, tools) {
+  const selected = new Set(tools.map((tool) => tool.id));
+  return settings.mcpServers.filter(
+    (server) => selected.has(server.id) && server.connectionRef?.subjectScope === "subject"
+  );
+}
+function canonicalPersonalConnections(connections) {
+  return [...connections].sort((left, right) => {
+    const active = Number(right.status === "active") - Number(left.status === "active");
+    if (active !== 0) return active;
+    const updated = Date.parse(right.updatedAt) - Date.parse(left.updatedAt);
+    if (updated !== 0) return updated;
+    const created = Date.parse(right.createdAt) - Date.parse(left.createdAt);
+    if (created !== 0) return created;
+    return right.id.localeCompare(left.id);
+  });
+}
+function sameProviderDomain(left, right) {
+  return left.toLowerCase() === right.toLowerCase();
+}
+function personalConnectionDelegationsFromVisibleConnections(input) {
+  const delegations = [];
+  const connections = canonicalPersonalConnections(input.connections);
+  for (const server of input.servers) {
+    const ref = server.connectionRef;
+    if (!ref || ref.subjectScope !== "subject") continue;
+    const connection = connections.find(
+      (candidate) => candidate.subjectId === input.subjectId && candidate.status === "active" && sameProviderDomain(candidate.providerDomain, ref.providerDomain) && (!ref.kind || candidate.kind === ref.kind) && (!ref.connectionId || candidate.id === ref.connectionId)
+    );
+    if (!connection) continue;
+    delegations.push({
+      serverId: server.id,
+      connectionId: connection.id,
+      ownerSubjectId: input.subjectId,
+      providerDomain: connection.providerDomain,
+      kind: connection.kind
+    });
+  }
+  return delegations;
+}
+function personalConnectionDelegationsFromParent(input) {
+  return input.servers.flatMap((server) => {
+    const ref = server.connectionRef;
+    if (!ref || ref.subjectScope !== "subject") return [];
+    const delegation = input.parentDelegations.find(
+      (candidate) => candidate.serverId === server.id && sameProviderDomain(candidate.providerDomain, ref.providerDomain) && (!ref.kind || !candidate.kind || candidate.kind === ref.kind)
+    );
+    return delegation ? [{ ...delegation }] : [];
+  });
+}
+function personalConnectionDelegationsEqual(left, right) {
+  if (left.length !== right.length) return false;
+  const byServer = new Map(right.map((delegation) => [delegation.serverId, delegation]));
+  return left.every((delegation) => {
+    const other = byServer.get(delegation.serverId);
+    return other?.connectionId === delegation.connectionId && other.ownerSubjectId === delegation.ownerSubjectId && sameProviderDomain(other.providerDomain, delegation.providerDomain) && other.kind === delegation.kind;
+  });
+}
+function personalConnectionDelegationForServer(delegations, server) {
+  const ref = server.connectionRef;
+  if (!ref || ref.subjectScope !== "subject") return null;
+  return delegations.find(
+    (delegation) => delegation.serverId === server.id && sameProviderDomain(delegation.providerDomain, ref.providerDomain) && (!ref.kind || !delegation.kind || delegation.kind === ref.kind)
+  ) ?? null;
+}
+function personalAuthorityUnavailable(request) {
+  const ref = request.connectionRef;
+  return {
+    status: "auth_needed",
+    reason: "personal_authority_unavailable",
+    providerDomain: ref.providerDomain,
+    ...ref.provider ? { provider: ref.provider } : {},
+    ...ref.scopes ? { scopes: ref.scopes } : {},
+    ...ref.resource ? { resource: ref.resource } : {},
+    ...ref.selectedResources ? { selectedResources: ref.selectedResources } : {}
+  };
+}
+function withFrozenPersonalConnectionDelegations(input) {
+  return async (request) => {
+    let effectiveRequest = request;
+    if (request.connectionRef.subjectScope === "subject") {
+      const config = input.settings.mcpServers.find((server) => server.id === request.serverId);
+      const delegation = config ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config) : null;
+      if (!delegation || !await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId)) {
+        return personalAuthorityUnavailable(request);
+      }
+      effectiveRequest = {
+        ...request,
+        subjectId: delegation.ownerSubjectId,
+        connectionRef: {
+          ...request.connectionRef,
+          providerDomain: delegation.providerDomain,
+          connectionId: delegation.connectionId,
+          ...delegation.kind ? { kind: delegation.kind } : {}
+        }
+      };
+    }
+    const result = await input.resolveCredential(effectiveRequest);
+    if (result.status === "ok" || request.connectionRef.subjectScope !== "subject") {
+      return result;
+    }
+    return personalAuthorityUnavailable(request);
+  };
+}
+async function freezePersonalConnectionDelegations(input) {
+  const servers = selectedPersonalConnectionServers(input.settings, input.tools);
+  if (servers.length === 0 || input.source.kind === "none") return [];
+  if (input.source.kind === "turn") {
+    return personalConnectionDelegationsFromParent({
+      servers,
+      parentDelegations: await getSessionTurnPersonalConnectionDelegations(
+        input.db,
+        input.workspaceId,
+        input.source.sessionId,
+        input.source.turnId
+      )
+    });
+  }
+  const membership = await getWorkspaceGrant2(input.db, input.source.subjectId, input.workspaceId);
+  if (!membership) return [];
+  return personalConnectionDelegationsFromVisibleConnections({
+    servers,
+    subjectId: input.source.subjectId,
+    connections: await listConnectionsMetadata2(input.db, input.workspaceId, input.source.subjectId)
+  });
+}
+
 // src/domain/resources.ts
 import {
   gitCredentialBindingIdForRepository,
@@ -3551,6 +3704,7 @@ import {
   getNestedAgentDepthDeploymentPolicy,
   getRig as getRig3,
   getScheduledTask,
+  getScheduledTaskPersonalConnectionDelegations,
   requireWorkspace as requireWorkspace2,
   updateScheduledTask
 } from "@opengeni/db";
@@ -4008,6 +4162,7 @@ async function createAndStartSession(input) {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
       mcpServers: input.mcpServers ?? [],
+      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null
@@ -4052,6 +4207,7 @@ async function createAndStartSession(input) {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
       mcpServers: input.mcpServers ?? [],
+      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null
@@ -4250,6 +4406,7 @@ async function postUserMessageTurn(input) {
           reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
           turnExecutionPolicy: input.turnExecutionPolicy,
           source: input.origin === "operator" ? "api" : "user",
+          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
           mcpCredentialUpdates: input.mcpCredentialUpdates ?? []
         })
       )
@@ -4404,6 +4561,13 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools,
+    source: personalConnectionDelegationSourceForGrant(grant)
+  });
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException10(503, { message: "object storage is not configured" });
@@ -4639,6 +4803,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
+      personalConnectionDelegations,
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
       maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,
@@ -4741,6 +4906,14 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     session: existingSession,
     updates: input.mcpCredentialUpdates ?? []
   });
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools: existingSession.tools,
+    source: personalConnectionDelegationSourceForGrant(grant)
+  });
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
   const { accepted, turn } = await postUserMessageTurn({
     db,
@@ -4759,6 +4932,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     reasoningEffortFallback: sessionReasoningEffort,
     turnExecutionPolicy,
     mcpCredentialUpdates,
+    personalConnectionDelegations,
     delivery: input.delivery ?? "send",
     origin: delegatedServiceInitiator ? "operator" : input.origin ?? "human",
     actor: grant.subjectId,
@@ -5100,6 +5274,19 @@ async function createValidatedScheduledTask(input) {
   if (input.payload.rigId) {
     await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);
   }
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    input.db,
+    input.grant.workspaceId,
+    input.settings
+  );
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db: input.db,
+    workspaceId: input.grant.workspaceId,
+    settings: runtimeSettings,
+    tools: agentConfig.tools,
+    source: personalConnectionDelegationSourceForGrant(input.grant)
+  });
+  const creationInitiator = creationInitiatorForGrant(input.grant);
   return await createScheduledTask(input.db, {
     id,
     accountId: input.grant.accountId,
@@ -5111,6 +5298,10 @@ async function createValidatedScheduledTask(input) {
     runMode: input.payload.runMode,
     overlapPolicy: input.payload.overlapPolicy,
     agentConfig,
+    ...creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {},
+    ...creationInitiator.context ? { createdByContext: creationInitiator.context } : {},
+    createdByActor: creationInitiator.actor ?? null,
+    personalConnectionDelegations,
     variableSetId: input.payload.variableSetId ?? null,
     rigId: input.payload.rigId ?? null,
     metadata: input.payload.metadata
@@ -5191,6 +5382,31 @@ async function validatedScheduledTaskUpdate(input) {
       });
     }
     update.agentConfig = nextAgentConfig;
+    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      input.db,
+      input.existing.workspaceId,
+      input.settings
+    );
+    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db: input.db,
+      workspaceId: input.existing.workspaceId,
+      settings: runtimeSettings,
+      tools: nextAgentConfig.tools,
+      source: personalConnectionDelegationSourceForGrant(input.grant)
+    });
+    if (input.existing.reusableSessionId && input.existing.runMode === "reusable_session") {
+      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.id
+      );
+      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {
+        throw new HTTPException11(409, {
+          message: "cannot change personal MCP connections of a task with a live reusable session; recreate the task"
+        });
+      }
+    }
+    update.personalConnectionDelegations = personalConnectionDelegations;
   }
   return update;
 }
@@ -5201,7 +5417,18 @@ async function requireScheduledTaskForApi(db, workspaceId, taskId) {
   }
   return task;
 }
-async function restoreScheduledTask(db, task) {
+async function captureScheduledTaskRestoreState(db, task) {
+  return {
+    task,
+    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(
+      db,
+      task.workspaceId,
+      task.id
+    )
+  };
+}
+async function restoreScheduledTask(db, previous) {
+  const { task } = previous;
   return await updateScheduledTask(db, task.workspaceId, task.id, {
     name: task.name,
     status: task.status,
@@ -5209,8 +5436,10 @@ async function restoreScheduledTask(db, task) {
     runMode: task.runMode,
     overlapPolicy: task.overlapPolicy,
     agentConfig: task.agentConfig,
+    personalConnectionDelegations: previous.personalConnectionDelegations,
     reusableSessionId: task.reusableSessionId,
     variableSetId: task.variableSetId,
+    rigId: task.rigId,
     metadata: task.metadata
   });
 }
@@ -6483,6 +6712,7 @@ export {
   buildFleetContextForSession,
   buildMarketingDailyAnalysisAgentConfig,
   canonicalConfiguredModel,
+  captureScheduledTaskRestoreState,
   checkLimit,
   classifyRigVerificationOutcome,
   controlAgentSessionWorkstream,
@@ -6494,9 +6724,11 @@ export {
   createRigVersionForApi,
   createSessionForRequest,
   createValidatedScheduledTask,
+  creationInitiatorForGrant,
   defaultSessionMcpServerIds,
   deleteHumanQueuePrompt,
   deleteRigForApi,
+  directPersonalConnectionSubjectId,
   disableCapability,
   discoverMcpRegistryCapabilities,
   editHumanQueuePrompt,
@@ -6504,6 +6736,7 @@ export {
   enabledCapabilityMcpToolRefs,
   executeRunOnSelfhostedMachine,
   filenameForMimeType,
+  freezePersonalConnectionDelegations,
   getActorNewSessionDraft,
   getCapabilityPack,
   getHumanComposerDraft,
@@ -6533,6 +6766,11 @@ export {
   normalizeResources,
   officialMcpRegistryUrl,
   openGeniSlackBotMetadata,
+  personalConnectionDelegationForServer,
+  personalConnectionDelegationSourceForGrant,
+  personalConnectionDelegationsEqual,
+  personalConnectionDelegationsFromParent,
+  personalConnectionDelegationsFromVisibleConnections,
   postUserMessageTurn,
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
@@ -6574,6 +6812,7 @@ export {
   scheduledTaskTemporalScheduleId,
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
+  selectedPersonalConnectionServers,
   sendAgentSessionMessage,
   sessionSpawnDenialEnvelope,
   sessionWithEffectiveToolPolicy,
@@ -6603,6 +6842,7 @@ export {
   validateVariableSetAttachment,
   validatedScheduledTaskUpdate,
   withDefaultEnabledCapabilityMcpTools,
+  withFrozenPersonalConnectionDelegations,
   workflowIdForSession,
   workspaceSessionToolPolicyDefaultServerIds,
   workspaceSessionToolPolicyServerIds,