@opengeni/core 0.16.3 → 0.18.0

package/dist/domain/memory-slack-publication.d.ts

@@ -0,0 +1,107 @@
+import { type KnowledgeMemoryKind, type KnowledgeMemoryStatus } from "@opengeni/contracts";
+export declare const MEMORY_SLACK_PROJECTION_VERSION = 1;
+export declare const MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES = 512;
+export declare const MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES = 128;
+export declare const MEMORY_SLACK_LABEL_MAX_UTF8_BYTES = 64;
+export declare const MEMORY_SLACK_LABEL_MAX_COUNT = 8;
+export declare const MEMORY_SLACK_OWNER_MAX_UTF8_BYTES = 96;
+export declare const MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES = 4096;
+export type MemorySlackImportance = "major" | "normal" | "minor";
+export type MemorySlackRequestedMode = "auto" | "review" | "never";
+export type MemorySlackDeliveryMode = Exclude<MemorySlackRequestedMode, "never">;
+export type MemorySlackChangeKind = "created" | "corrected" | "superseded";
+export type MemorySlackOrigin = "native" | "slack_derived";
+export type MemorySlackAudience = "workspace" | "restricted";
+export type MemorySlackPublicationPolicy = {
+    enabled: boolean;
+    autoImportances: readonly MemorySlackImportance[];
+    reviewImportances: readonly MemorySlackImportance[];
+};
+/**
+ * Nothing publishes without an explicit workspace-admin enablement. When
+ * enabled without tuning, major changes may publish automatically, normal
+ * changes require review, and minor changes stay quiet.
+ */
+export declare const DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY: {
+    readonly enabled: false;
+    readonly autoImportances: readonly ["major"];
+    readonly reviewImportances: readonly ["normal"];
+};
+export type MemorySlackPublicationInput = {
+    context: {
+        accountId: string;
+        workspaceId: string;
+        now: string;
+    };
+    policy?: MemorySlackPublicationPolicy | undefined;
+    memory: {
+        sourceType: "workspace_memory";
+        accountId: string;
+        workspaceId: string;
+        id: string;
+        version: number;
+        status: KnowledgeMemoryStatus;
+        kind: KnowledgeMemoryKind;
+        scopeType: "workspace" | "user" | "role" | "session" | "ephemeral" | "legacy";
+        namespace: string;
+        labels: readonly string[];
+        validFrom: string;
+        validUntil: string | null;
+        supersedesId: string | null;
+        supersededById: string | null;
+    };
+    change: {
+        kind: MemorySlackChangeKind;
+        relatedMemoryId: string | null;
+        occurredAt: string;
+        origin: MemorySlackOrigin;
+        ownerLabel?: string | null | undefined;
+    };
+    distribution: {
+        importance: MemorySlackImportance;
+        audience: MemorySlackAudience;
+        slackMode: MemorySlackRequestedMode;
+        shareSummary: string;
+    };
+};
+export type MemorySlackPublicationDenialReason = "disabled" | "invalid_input" | "unsupported_source" | "tenant_mismatch" | "not_decision" | "status_ineligible" | "restricted_scope" | "restricted_audience" | "not_yet_valid" | "expired" | "slack_origin_loop" | "mode_never" | "below_noise_policy" | "missing_summary" | "invalid_change_lineage";
+export type MemorySlackPublicationProjection = {
+    version: typeof MEMORY_SLACK_PROJECTION_VERSION;
+    workspaceId: string;
+    memoryId: string;
+    memoryVersion: number;
+    changeKind: MemorySlackChangeKind;
+    relatedMemoryId: string | null;
+    occurredAt: string;
+    importance: MemorySlackImportance;
+    deliveryMode: MemorySlackDeliveryMode;
+    summary: string;
+    summaryRedacted: boolean;
+    summaryTruncated: boolean;
+    namespace: string;
+    labels: string[];
+    labelsTruncated: boolean;
+    ownerLabel: string | null;
+    ownerLabelRedacted: boolean;
+    ownerLabelTruncated: boolean;
+    authoritativeRecord: {
+        workspaceId: string;
+        memoryId: string;
+    };
+};
+export type MemorySlackPublicationDecision = {
+    eligible: false;
+    reason: MemorySlackPublicationDenialReason;
+} | {
+    eligible: true;
+    deliveryMode: MemorySlackDeliveryMode;
+    idempotencyKey: string;
+    projection: MemorySlackPublicationProjection;
+};
+/**
+ * Produce the only data shape a later delivery slice may persist or
+ * render. This is a deterministic policy/security boundary, not a persistence
+ * hook: callers must durably bind the returned projection and key in a later
+ * transaction/outbox slice.
+ */
+export declare function evaluateMemorySlackPublication(input: MemorySlackPublicationInput): MemorySlackPublicationDecision;

package/dist/domain/personal-connection-delegations.d.ts

@@ -0,0 +1,48 @@
+import type { McpServerConfig, Settings } from "@opengeni/config";
+import type { AccessGrant, ConnectionMetadata, McpPersonalConnectionDelegation, SessionTurn, ToolRef } from "@opengeni/contracts";
+import { type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult } from "@opengeni/db";
+export type PersonalConnectionDelegationSource = {
+    kind: "subject";
+    subjectId: string;
+} | {
+    kind: "turn";
+    sessionId: string;
+    turnId: string;
+} | {
+    kind: "none";
+};
+export declare function directPersonalConnectionSubjectId(turn: Pick<SessionTurn, "source" | "initiator" | "initiatorContext">): string | undefined;
+export declare function personalConnectionDelegationSourceForGrant(grant: AccessGrant): PersonalConnectionDelegationSource;
+export declare function selectedPersonalConnectionServers(settings: Pick<Settings, "mcpServers">, tools: ToolRef[]): McpServerConfig[];
+export declare function personalConnectionDelegationsFromVisibleConnections(input: {
+    servers: McpServerConfig[];
+    subjectId: string;
+    connections: ConnectionMetadata[];
+}): McpPersonalConnectionDelegation[];
+export declare function personalConnectionDelegationsFromParent(input: {
+    servers: McpServerConfig[];
+    parentDelegations: McpPersonalConnectionDelegation[];
+}): McpPersonalConnectionDelegation[];
+export declare function personalConnectionDelegationsEqual(left: McpPersonalConnectionDelegation[], right: McpPersonalConnectionDelegation[]): boolean;
+export declare function personalConnectionDelegationForServer(delegations: McpPersonalConnectionDelegation[], server: Pick<McpServerConfig, "id" | "connectionRef">): McpPersonalConnectionDelegation | null;
+type ConnectionCredentialResolver = (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+/**
+ * Resolves subject-owned MCP credentials only through the exact authority
+ * frozen on the causal turn. A direct human subject, worker Toolspace caller,
+ * retry, or recovery can identify the caller, but none may widen or replace
+ * the persisted connection UUID.
+ */
+export declare function withFrozenPersonalConnectionDelegations(input: {
+    resolveCredential: ConnectionCredentialResolver;
+    settings: Pick<Settings, "mcpServers">;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    ownerHasWorkspaceMembership: (subjectId: string) => Promise<boolean>;
+}): ConnectionCredentialResolver;
+export declare function freezePersonalConnectionDelegations(input: {
+    db: Database;
+    workspaceId: string;
+    settings: Pick<Settings, "mcpServers">;
+    tools: ToolRef[];
+    source: PersonalConnectionDelegationSource;
+}): Promise<McpPersonalConnectionDelegation[]>;
+export {};

package/dist/domain/scheduled-tasks.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import type { AccessGrant, ScheduledTask, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
+import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
 import { type Database, type UpdateScheduledTaskInput } from "@opengeni/db";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
@@ -32,7 +32,12 @@ export declare function validatedScheduledTaskUpdate(input: {
     toolsProvided?: boolean;
 }): Promise<UpdateScheduledTaskInput>;
 export declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
-export declare function restoreScheduledTask(db: Database, task: ScheduledTask): Promise<ScheduledTask>;
+export type ScheduledTaskRestoreState = {
+    task: ScheduledTask;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+};
+export declare function captureScheduledTaskRestoreState(db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
+export declare function restoreScheduledTask(db: Database, previous: ScheduledTaskRestoreState): Promise<ScheduledTask>;
 export declare function syncCreatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;
@@ -41,7 +46,7 @@ export declare function syncCreatedScheduledTask(input: {
 export declare function syncUpdatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;
-    previous: ScheduledTask;
+    previous: ScheduledTaskRestoreState;
     task: ScheduledTask;
 }): Promise<void>;
 export declare function scheduledTaskTemporalScheduleId(taskId: string): string;

package/dist/domain/sessions.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import type { AcceptSessionUserMessageDependencies, ApiRouteDeps, SessionWorkflowClient } from "../dependencies";
@@ -40,6 +40,14 @@ export declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedErro
         };
     };
 };
+export type FrozenCreationInitiator = {
+    initiator?: TurnInitiator;
+    context?: TurnInitiatorContext;
+    actor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }>;
+};
+export declare function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator;
 export declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
 export declare function createAndStartSession(input: {
     requestedSessionId?: string;
@@ -79,6 +87,7 @@ export declare function createAndStartSession(input: {
     firstPartyMcpTools: FirstPartyMcpToolName[];
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
@@ -165,6 +174,7 @@ export declare function postUserMessageTurn(input: {
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     actor?: string;

package/dist/index.d.ts

@@ -12,11 +12,13 @@ export * from "./domain/capabilities";
 export * from "./domain/environments";
 export * from "./rigs";
 export * from "./domain/packs";
+export * from "./domain/personal-connection-delegations";
 export * from "./domain/resources";
 export * from "./domain/session-tool-policy";
 export * from "./domain/scheduled-tasks";
 export * from "./domain/sessions";
 export * from "./domain/insights";
+export * from "./domain/memory-slack-publication";
 export * from "./domain/slack-bot";
 export * from "./domain/workspace-members";
 export * from "./application/new-session-drafts";