@opengeni/core 0.16.3 → 0.18.0

package/dist/index.js

@@ -2356,6 +2356,19 @@ async function requireCatalogItem(db, workspaceId, settings, capabilityId) {
   return item;
 }
 function packCatalogItem(pack, source) {
+  const customMetadata = { ...pack.metadata };
+  for (const key of [
+    "packId",
+    "version",
+    "connectors",
+    "knowledge",
+    "scheduledTaskTemplates",
+    "sandboxImage",
+    "sandboxProviderImages",
+    "skills"
+  ]) {
+    delete customMetadata[key];
+  }
   return CapabilityCatalogItem.parse({
     id: `pack:${pack.id}`,
     kind: "pack",
@@ -2370,6 +2383,7 @@ function packCatalogItem(pack, source) {
       notes: "Enables role-scoped tools, connectors, knowledge, and scheduled-task templates."
     },
     metadata: {
+      ...customMetadata,
       packId: pack.id,
       version: pack.version,
       connectors: pack.connectors,
@@ -2377,8 +2391,8 @@ function packCatalogItem(pack, source) {
       scheduledTaskTemplates: pack.scheduledTaskTemplates,
       // Runtime composition surface only: skill names, never file content.
       ...pack.sandboxImage ? { sandboxImage: pack.sandboxImage } : {},
-      ...pack.skills.length > 0 ? { skills: pack.skills.map((skill) => skill.name) } : {},
-      ...pack.metadata
+      ...pack.sandboxProviderImages ? { sandboxProviderImages: pack.sandboxProviderImages } : {},
+      ...pack.skills.length > 0 ? { skills: pack.skills.map((skill) => skill.name) } : {}
     }
   });
 }
@@ -3151,6 +3165,158 @@ async function listRigChangesForApi(deps, workspaceId, rigId, limit) {
   return await listRigChanges(deps.db, workspaceId, rigId, limit);
 }
 
+// src/domain/personal-connection-delegations.ts
+import {
+  getSessionTurnPersonalConnectionDelegations,
+  getWorkspaceGrant as getWorkspaceGrant2,
+  listConnectionsMetadata as listConnectionsMetadata2
+} from "@opengeni/db";
+function directPersonalConnectionSubjectId(turn) {
+  if (turn.source !== "user" && turn.source !== "api" || turn.initiator.kind !== "subject") {
+    return void 0;
+  }
+  return ["via", "viaTruncated", "provenanceError", "backfill"].some(
+    (key) => Object.prototype.hasOwnProperty.call(turn.initiatorContext, key)
+  ) ? void 0 : turn.initiator.subjectId;
+}
+function personalConnectionDelegationSourceForGrant(grant) {
+  const callerSessionId = grant.metadata?.["sessionId"];
+  const callerTurnId = grant.metadata?.["turnId"];
+  if (typeof callerSessionId === "string" && typeof callerTurnId === "string") {
+    return { kind: "turn", sessionId: callerSessionId, turnId: callerTurnId };
+  }
+  if (grant.principalKind === "agent_attempt" || grant.principalKind === "service" || grant.serviceInitiator) {
+    return { kind: "none" };
+  }
+  return { kind: "subject", subjectId: grant.subjectId };
+}
+function selectedPersonalConnectionServers(settings, tools) {
+  const selected = new Set(tools.map((tool) => tool.id));
+  return settings.mcpServers.filter(
+    (server) => selected.has(server.id) && server.connectionRef?.subjectScope === "subject"
+  );
+}
+function canonicalPersonalConnections(connections) {
+  return [...connections].sort((left, right) => {
+    const active = Number(right.status === "active") - Number(left.status === "active");
+    if (active !== 0) return active;
+    const updated = Date.parse(right.updatedAt) - Date.parse(left.updatedAt);
+    if (updated !== 0) return updated;
+    const created = Date.parse(right.createdAt) - Date.parse(left.createdAt);
+    if (created !== 0) return created;
+    return right.id.localeCompare(left.id);
+  });
+}
+function sameProviderDomain(left, right) {
+  return left.toLowerCase() === right.toLowerCase();
+}
+function personalConnectionDelegationsFromVisibleConnections(input) {
+  const delegations = [];
+  const connections = canonicalPersonalConnections(input.connections);
+  for (const server of input.servers) {
+    const ref = server.connectionRef;
+    if (!ref || ref.subjectScope !== "subject") continue;
+    const connection = connections.find(
+      (candidate) => candidate.subjectId === input.subjectId && candidate.status === "active" && sameProviderDomain(candidate.providerDomain, ref.providerDomain) && (!ref.kind || candidate.kind === ref.kind) && (!ref.connectionId || candidate.id === ref.connectionId)
+    );
+    if (!connection) continue;
+    delegations.push({
+      serverId: server.id,
+      connectionId: connection.id,
+      ownerSubjectId: input.subjectId,
+      providerDomain: connection.providerDomain,
+      kind: connection.kind
+    });
+  }
+  return delegations;
+}
+function personalConnectionDelegationsFromParent(input) {
+  return input.servers.flatMap((server) => {
+    const ref = server.connectionRef;
+    if (!ref || ref.subjectScope !== "subject") return [];
+    const delegation = input.parentDelegations.find(
+      (candidate) => candidate.serverId === server.id && sameProviderDomain(candidate.providerDomain, ref.providerDomain) && (!ref.kind || !candidate.kind || candidate.kind === ref.kind)
+    );
+    return delegation ? [{ ...delegation }] : [];
+  });
+}
+function personalConnectionDelegationsEqual(left, right) {
+  if (left.length !== right.length) return false;
+  const byServer = new Map(right.map((delegation) => [delegation.serverId, delegation]));
+  return left.every((delegation) => {
+    const other = byServer.get(delegation.serverId);
+    return other?.connectionId === delegation.connectionId && other.ownerSubjectId === delegation.ownerSubjectId && sameProviderDomain(other.providerDomain, delegation.providerDomain) && other.kind === delegation.kind;
+  });
+}
+function personalConnectionDelegationForServer(delegations, server) {
+  const ref = server.connectionRef;
+  if (!ref || ref.subjectScope !== "subject") return null;
+  return delegations.find(
+    (delegation) => delegation.serverId === server.id && sameProviderDomain(delegation.providerDomain, ref.providerDomain) && (!ref.kind || !delegation.kind || delegation.kind === ref.kind)
+  ) ?? null;
+}
+function personalAuthorityUnavailable(request) {
+  const ref = request.connectionRef;
+  return {
+    status: "auth_needed",
+    reason: "personal_authority_unavailable",
+    providerDomain: ref.providerDomain,
+    ...ref.provider ? { provider: ref.provider } : {},
+    ...ref.scopes ? { scopes: ref.scopes } : {},
+    ...ref.resource ? { resource: ref.resource } : {},
+    ...ref.selectedResources ? { selectedResources: ref.selectedResources } : {}
+  };
+}
+function withFrozenPersonalConnectionDelegations(input) {
+  return async (request) => {
+    let effectiveRequest = request;
+    if (request.connectionRef.subjectScope === "subject") {
+      const config = input.settings.mcpServers.find((server) => server.id === request.serverId);
+      const delegation = config ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config) : null;
+      if (!delegation || !await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId)) {
+        return personalAuthorityUnavailable(request);
+      }
+      effectiveRequest = {
+        ...request,
+        subjectId: delegation.ownerSubjectId,
+        connectionRef: {
+          ...request.connectionRef,
+          providerDomain: delegation.providerDomain,
+          connectionId: delegation.connectionId,
+          ...delegation.kind ? { kind: delegation.kind } : {}
+        }
+      };
+    }
+    const result = await input.resolveCredential(effectiveRequest);
+    if (result.status === "ok" || request.connectionRef.subjectScope !== "subject") {
+      return result;
+    }
+    return personalAuthorityUnavailable(request);
+  };
+}
+async function freezePersonalConnectionDelegations(input) {
+  const servers = selectedPersonalConnectionServers(input.settings, input.tools);
+  if (servers.length === 0 || input.source.kind === "none") return [];
+  if (input.source.kind === "turn") {
+    return personalConnectionDelegationsFromParent({
+      servers,
+      parentDelegations: await getSessionTurnPersonalConnectionDelegations(
+        input.db,
+        input.workspaceId,
+        input.source.sessionId,
+        input.source.turnId
+      )
+    });
+  }
+  const membership = await getWorkspaceGrant2(input.db, input.source.subjectId, input.workspaceId);
+  if (!membership) return [];
+  return personalConnectionDelegationsFromVisibleConnections({
+    servers,
+    subjectId: input.source.subjectId,
+    connections: await listConnectionsMetadata2(input.db, input.workspaceId, input.source.subjectId)
+  });
+}
+
 // src/domain/resources.ts
 import {
   gitCredentialBindingIdForRepository,
@@ -3552,6 +3718,7 @@ import {
   getNestedAgentDepthDeploymentPolicy,
   getRig as getRig3,
   getScheduledTask,
+  getScheduledTaskPersonalConnectionDelegations,
   requireWorkspace as requireWorkspace2,
   updateScheduledTask
 } from "@opengeni/db";
@@ -4009,6 +4176,7 @@ async function createAndStartSession(input) {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
       mcpServers: input.mcpServers ?? [],
+      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null
@@ -4053,6 +4221,7 @@ async function createAndStartSession(input) {
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
       mcpServers: input.mcpServers ?? [],
+      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null
@@ -4251,6 +4420,7 @@ async function postUserMessageTurn(input) {
           reasoningEffortFallback: input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
           turnExecutionPolicy: input.turnExecutionPolicy,
           source: input.origin === "operator" ? "api" : "user",
+          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
           mcpCredentialUpdates: input.mcpCredentialUpdates ?? []
         })
       )
@@ -4405,6 +4575,13 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools,
+    source: personalConnectionDelegationSourceForGrant(grant)
+  });
   await validateGitHubRepositorySelection(db, workspaceId, resources);
   if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
     throw new HTTPException10(503, { message: "object storage is not configured" });
@@ -4640,6 +4817,7 @@ async function createSessionForRequest(deps, grant, workspaceId, rawPayload) {
       firstPartyMcpTools,
       mcpServers: sessionMcpServers.dbServers,
       sessionMcpServers: sessionMcpServers.metadata,
+      personalConnectionDelegations,
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
       maxNestedAgentDepthOverride: payload.maxNestedAgentDepth ?? null,
@@ -4742,6 +4920,14 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     session: existingSession,
     updates: input.mcpCredentialUpdates ?? []
   });
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings);
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db,
+    workspaceId,
+    settings: runtimeSettings,
+    tools: existingSession.tools,
+    source: personalConnectionDelegationSourceForGrant(grant)
+  });
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
   const { accepted, turn } = await postUserMessageTurn({
     db,
@@ -4760,6 +4946,7 @@ async function acceptSessionUserMessage(deps, grant, workspaceId, sessionId, inp
     reasoningEffortFallback: sessionReasoningEffort,
     turnExecutionPolicy,
     mcpCredentialUpdates,
+    personalConnectionDelegations,
     delivery: input.delivery ?? "send",
     origin: delegatedServiceInitiator ? "operator" : input.origin ?? "human",
     actor: grant.subjectId,
@@ -5101,6 +5288,19 @@ async function createValidatedScheduledTask(input) {
   if (input.payload.rigId) {
     await requireScheduledTaskRig(input.db, input.grant.workspaceId, input.payload.rigId);
   }
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    input.db,
+    input.grant.workspaceId,
+    input.settings
+  );
+  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+    db: input.db,
+    workspaceId: input.grant.workspaceId,
+    settings: runtimeSettings,
+    tools: agentConfig.tools,
+    source: personalConnectionDelegationSourceForGrant(input.grant)
+  });
+  const creationInitiator = creationInitiatorForGrant(input.grant);
   return await createScheduledTask(input.db, {
     id,
     accountId: input.grant.accountId,
@@ -5112,6 +5312,10 @@ async function createValidatedScheduledTask(input) {
     runMode: input.payload.runMode,
     overlapPolicy: input.payload.overlapPolicy,
     agentConfig,
+    ...creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {},
+    ...creationInitiator.context ? { createdByContext: creationInitiator.context } : {},
+    createdByActor: creationInitiator.actor ?? null,
+    personalConnectionDelegations,
     variableSetId: input.payload.variableSetId ?? null,
     rigId: input.payload.rigId ?? null,
     metadata: input.payload.metadata
@@ -5192,6 +5396,31 @@ async function validatedScheduledTaskUpdate(input) {
       });
     }
     update.agentConfig = nextAgentConfig;
+    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      input.db,
+      input.existing.workspaceId,
+      input.settings
+    );
+    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db: input.db,
+      workspaceId: input.existing.workspaceId,
+      settings: runtimeSettings,
+      tools: nextAgentConfig.tools,
+      source: personalConnectionDelegationSourceForGrant(input.grant)
+    });
+    if (input.existing.reusableSessionId && input.existing.runMode === "reusable_session") {
+      const existingDelegations = await getScheduledTaskPersonalConnectionDelegations(
+        input.db,
+        input.existing.workspaceId,
+        input.existing.id
+      );
+      if (!personalConnectionDelegationsEqual(existingDelegations, personalConnectionDelegations)) {
+        throw new HTTPException11(409, {
+          message: "cannot change personal MCP connections of a task with a live reusable session; recreate the task"
+        });
+      }
+    }
+    update.personalConnectionDelegations = personalConnectionDelegations;
   }
   return update;
 }
@@ -5202,7 +5431,18 @@ async function requireScheduledTaskForApi(db, workspaceId, taskId) {
   }
   return task;
 }
-async function restoreScheduledTask(db, task) {
+async function captureScheduledTaskRestoreState(db, task) {
+  return {
+    task,
+    personalConnectionDelegations: await getScheduledTaskPersonalConnectionDelegations(
+      db,
+      task.workspaceId,
+      task.id
+    )
+  };
+}
+async function restoreScheduledTask(db, previous) {
+  const { task } = previous;
   return await updateScheduledTask(db, task.workspaceId, task.id, {
     name: task.name,
     status: task.status,
@@ -5210,8 +5450,10 @@ async function restoreScheduledTask(db, task) {
     runMode: task.runMode,
     overlapPolicy: task.overlapPolicy,
     agentConfig: task.agentConfig,
+    personalConnectionDelegations: previous.personalConnectionDelegations,
     reusableSessionId: task.reusableSessionId,
     variableSetId: task.variableSetId,
+    rigId: task.rigId,
     metadata: task.metadata
   });
 }
@@ -5737,6 +5979,236 @@ async function getWorkspaceInsights(db, settings, input) {
   return { snapshot };
 }
 
+// src/domain/memory-slack-publication.ts
+import { createHash } from "crypto";
+import {
+  redactSensitiveText,
+  stableJson as stableJson3
+} from "@opengeni/contracts";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var SELECTOR_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MEMORY_SLACK_PROJECTION_VERSION = 1;
+var MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES = 512;
+var MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES = 128;
+var MEMORY_SLACK_LABEL_MAX_UTF8_BYTES = 64;
+var MEMORY_SLACK_LABEL_MAX_COUNT = 8;
+var MEMORY_SLACK_OWNER_MAX_UTF8_BYTES = 96;
+var MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES = 4096;
+var DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY = {
+  enabled: false,
+  autoImportances: ["major"],
+  reviewImportances: ["normal"]
+};
+var IMPORTANCES = /* @__PURE__ */ new Set(["major", "normal", "minor"]);
+var REQUESTED_MODES = /* @__PURE__ */ new Set(["auto", "review", "never"]);
+var CHANGE_KINDS = /* @__PURE__ */ new Set(["created", "corrected", "superseded"]);
+var ORIGINS = /* @__PURE__ */ new Set(["native", "slack_derived"]);
+var AUDIENCES = /* @__PURE__ */ new Set(["workspace", "restricted"]);
+var SCOPE_TYPES = /* @__PURE__ */ new Set([
+  "workspace",
+  "user",
+  "role",
+  "session",
+  "ephemeral",
+  "legacy"
+]);
+var MEMORY_STATUSES = /* @__PURE__ */ new Set([
+  "proposed",
+  "approved",
+  "rejected",
+  "active",
+  "superseded",
+  "archived"
+]);
+var MEMORY_KINDS = /* @__PURE__ */ new Set([
+  "semantic",
+  "episodic",
+  "procedural",
+  "decision",
+  "preference"
+]);
+var VISIBLE_STATUSES = /* @__PURE__ */ new Set(["active", "approved"]);
+function evaluateMemorySlackPublication(input) {
+  const policy = input.policy ?? DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY;
+  if (!validPolicy(policy)) return denied("invalid_input");
+  if (!policy.enabled) return denied("disabled");
+  if (input.memory.sourceType !== "workspace_memory") return denied("unsupported_source");
+  if (!validIdentity(input)) return denied("invalid_input");
+  if (input.memory.accountId !== input.context.accountId || input.memory.workspaceId !== input.context.workspaceId) {
+    return denied("tenant_mismatch");
+  }
+  if (input.memory.kind !== "decision") return denied("not_decision");
+  if (input.memory.scopeType !== "workspace") return denied("restricted_scope");
+  if (input.distribution.audience !== "workspace") return denied("restricted_audience");
+  if (input.change.origin === "slack_derived") return denied("slack_origin_loop");
+  if (input.distribution.slackMode === "never") return denied("mode_never");
+  const timeDecision = evaluateValidity(input);
+  if (timeDecision) return denied(timeDecision);
+  if (!statusEligibleForChange(input)) return denied("status_ineligible");
+  if (!validChangeLineage(input)) return denied("invalid_change_lineage");
+  const deliveryMode = effectiveDeliveryMode(policy, input.distribution);
+  if (!deliveryMode) return denied("below_noise_policy");
+  const collapsedSummary = collapseText(input.distribution.shareSummary);
+  const redactedSummary = redactSensitiveText(collapsedSummary);
+  if (!redactedSummary) return denied("missing_summary");
+  const summary = truncateUtf8(redactedSummary, MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES);
+  const namespace = normalizeNamespace(input.memory.namespace);
+  const labels = normalizeLabels(input.memory.labels);
+  if (!namespace || !labels) return denied("invalid_input");
+  const owner = boundedOptionalText(input.change.ownerLabel, MEMORY_SLACK_OWNER_MAX_UTF8_BYTES);
+  const projection = {
+    version: MEMORY_SLACK_PROJECTION_VERSION,
+    workspaceId: input.context.workspaceId,
+    memoryId: input.memory.id,
+    memoryVersion: input.memory.version,
+    changeKind: input.change.kind,
+    relatedMemoryId: input.change.relatedMemoryId,
+    occurredAt: new Date(input.change.occurredAt).toISOString(),
+    importance: input.distribution.importance,
+    deliveryMode,
+    summary: summary.value,
+    summaryRedacted: redactedSummary !== collapsedSummary,
+    summaryTruncated: summary.truncated,
+    namespace,
+    labels: labels.values,
+    labelsTruncated: labels.truncated,
+    ownerLabel: owner.value,
+    ownerLabelRedacted: owner.redacted,
+    ownerLabelTruncated: owner.truncated,
+    authoritativeRecord: {
+      workspaceId: input.context.workspaceId,
+      memoryId: input.memory.id
+    }
+  };
+  if (utf8Bytes(stableJson3(projection)) > MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES) {
+    return denied("invalid_input");
+  }
+  const digest = createHash("sha256").update(stableJson3(projection), "utf8").digest("hex");
+  return {
+    eligible: true,
+    deliveryMode,
+    idempotencyKey: `memory-slack:v${MEMORY_SLACK_PROJECTION_VERSION}:${digest}`,
+    projection
+  };
+}
+function validPolicy(policy) {
+  return typeof policy.enabled === "boolean" && Array.isArray(policy.autoImportances) && Array.isArray(policy.reviewImportances) && policy.autoImportances.every((importance) => IMPORTANCES.has(importance)) && policy.reviewImportances.every((importance) => IMPORTANCES.has(importance));
+}
+function validIdentity(input) {
+  const uuids = [
+    input.context.accountId,
+    input.context.workspaceId,
+    input.memory.accountId,
+    input.memory.workspaceId,
+    input.memory.id,
+    input.memory.supersedesId,
+    input.memory.supersededById,
+    input.change.relatedMemoryId
+  ].filter((value) => value !== null);
+  return uuids.every((value) => UUID_PATTERN.test(value)) && Number.isSafeInteger(input.memory.version) && input.memory.version > 0 && typeof input.memory.namespace === "string" && Array.isArray(input.memory.labels) && input.memory.labels.every((label) => typeof label === "string") && (input.change.ownerLabel === void 0 || input.change.ownerLabel === null || typeof input.change.ownerLabel === "string") && typeof input.distribution.shareSummary === "string" && IMPORTANCES.has(input.distribution.importance) && REQUESTED_MODES.has(input.distribution.slackMode) && CHANGE_KINDS.has(input.change.kind) && ORIGINS.has(input.change.origin) && AUDIENCES.has(input.distribution.audience) && SCOPE_TYPES.has(input.memory.scopeType) && MEMORY_STATUSES.has(input.memory.status) && MEMORY_KINDS.has(input.memory.kind);
+}
+function evaluateValidity(input) {
+  const now = Date.parse(input.context.now);
+  const occurredAt = Date.parse(input.change.occurredAt);
+  const validFrom = Date.parse(input.memory.validFrom);
+  const validUntil = input.memory.validUntil === null ? null : Date.parse(input.memory.validUntil);
+  if (!Number.isFinite(now) || !Number.isFinite(occurredAt) || !Number.isFinite(validFrom) || validUntil !== null && !Number.isFinite(validUntil) || validUntil !== null && validUntil <= validFrom) {
+    return "invalid_input";
+  }
+  if (now < validFrom) return "not_yet_valid";
+  if (validUntil !== null && now >= validUntil) return "expired";
+  return null;
+}
+function validChangeLineage(input) {
+  if (input.memory.supersedesId === input.memory.id || input.memory.supersededById === input.memory.id || input.change.relatedMemoryId === input.memory.id) {
+    return false;
+  }
+  switch (input.change.kind) {
+    case "created":
+      return input.change.relatedMemoryId === null && input.memory.supersedesId === null && input.memory.supersededById === null;
+    case "corrected":
+      return input.change.relatedMemoryId !== null && input.change.relatedMemoryId !== input.memory.id && input.memory.supersedesId === input.change.relatedMemoryId && input.memory.supersededById === null;
+    case "superseded":
+      return input.change.relatedMemoryId !== null && input.change.relatedMemoryId !== input.memory.id && input.memory.supersededById === input.change.relatedMemoryId;
+  }
+}
+function statusEligibleForChange(input) {
+  return input.change.kind === "superseded" ? input.memory.status === "superseded" : VISIBLE_STATUSES.has(input.memory.status);
+}
+function effectiveDeliveryMode(policy, distribution) {
+  const auto = new Set(policy.autoImportances);
+  const review = new Set(policy.reviewImportances);
+  if (distribution.slackMode === "review") {
+    return auto.has(distribution.importance) || review.has(distribution.importance) ? "review" : null;
+  }
+  if (auto.has(distribution.importance)) return "auto";
+  if (review.has(distribution.importance)) return "review";
+  return null;
+}
+function normalizeNamespace(value) {
+  const trimmed = value.trim();
+  if (redactSensitiveText(trimmed) !== trimmed) return null;
+  const namespace = trimmed.toLowerCase();
+  if (!namespace || utf8Bytes(namespace) > MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES) return null;
+  if (redactSensitiveText(namespace) !== namespace) return null;
+  const segments = namespace.split("/");
+  if (segments.some((segment) => !SELECTOR_SEGMENT_PATTERN.test(segment))) return null;
+  return segments.join("/");
+}
+function normalizeLabels(values) {
+  if (!Array.isArray(values)) return null;
+  const labels = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (typeof value !== "string") return null;
+    const trimmed = value.trim();
+    if (redactSensitiveText(trimmed) !== trimmed) return null;
+    const label = trimmed.toLowerCase();
+    if (redactSensitiveText(label) !== label || !SELECTOR_SEGMENT_PATTERN.test(label) || utf8Bytes(label) > MEMORY_SLACK_LABEL_MAX_UTF8_BYTES) {
+      return null;
+    }
+    labels.add(label);
+  }
+  const sorted = [...labels].sort();
+  return {
+    values: sorted.slice(0, MEMORY_SLACK_LABEL_MAX_COUNT),
+    truncated: sorted.length > MEMORY_SLACK_LABEL_MAX_COUNT
+  };
+}
+function boundedOptionalText(value, maxBytes) {
+  const collapsed = collapseText(value ?? "");
+  if (!collapsed) return { value: null, redacted: false, truncated: false };
+  const redacted = redactSensitiveText(collapsed);
+  const bounded = truncateUtf8(redacted, maxBytes);
+  return {
+    value: bounded.value || null,
+    redacted: redacted !== collapsed,
+    truncated: bounded.truncated
+  };
+}
+function collapseText(value) {
+  return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, " ").replace(/\s+/g, " ").trim();
+}
+function truncateUtf8(value, maxBytes) {
+  const bytes = encoder.encode(value);
+  if (bytes.byteLength <= maxBytes) return { value, truncated: false };
+  const marker = "\u2026";
+  const markerBytes = encoder.encode(marker);
+  let end = Math.max(0, maxBytes - markerBytes.byteLength);
+  while (end > 0 && (bytes[end] & 192) === 128) end -= 1;
+  return {
+    value: `${decoder.decode(bytes.subarray(0, end)).trimEnd()}${marker}`,
+    truncated: true
+  };
+}
+function utf8Bytes(value) {
+  return encoder.encode(value).byteLength;
+}
+function denied(reason) {
+  return { eligible: false, reason };
+}
+
 // src/domain/workspace-members.ts
 import { HTTPException as HTTPException12 } from "hono/http-exception";
 var MEMBER_ADMIN_PERMISSIONS = ["workspace:admin", "members:manage"];
@@ -6450,6 +6922,7 @@ async function saveHumanComposerDraft(deps, context, input) {
 export {
   CODEX_COMPACTION_V2_PROVIDER_LOCKED,
   CodexCompactionV2ProviderLockedError,
+  DEFAULT_MEMORY_SLACK_PUBLICATION_POLICY,
   MARKETING_SOCIAL_PACK_ID,
   MAX_CHECKS_PER_RIG,
   MAX_CREDENTIAL_HOOKS_PER_RIG,
@@ -6457,6 +6930,13 @@ export {
   MAX_ENVIRONMENTS_PER_WORKSPACE,
   MAX_RIGS_PER_WORKSPACE,
   MAX_VARIABLES_PER_ENVIRONMENT,
+  MEMORY_SLACK_LABEL_MAX_COUNT,
+  MEMORY_SLACK_LABEL_MAX_UTF8_BYTES,
+  MEMORY_SLACK_NAMESPACE_MAX_UTF8_BYTES,
+  MEMORY_SLACK_OWNER_MAX_UTF8_BYTES,
+  MEMORY_SLACK_PROJECTION_MAX_UTF8_BYTES,
+  MEMORY_SLACK_PROJECTION_VERSION,
+  MEMORY_SLACK_SUMMARY_MAX_UTF8_BYTES,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
   SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS,
   SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID,
@@ -6484,6 +6964,7 @@ export {
   buildFleetContextForSession,
   buildMarketingDailyAnalysisAgentConfig,
   canonicalConfiguredModel,
+  captureScheduledTaskRestoreState,
   checkLimit,
   classifyRigVerificationOutcome,
   controlAgentSessionWorkstream,
@@ -6495,16 +6976,20 @@ export {
   createRigVersionForApi,
   createSessionForRequest,
   createValidatedScheduledTask,
+  creationInitiatorForGrant,
   defaultSessionMcpServerIds,
   deleteHumanQueuePrompt,
   deleteRigForApi,
+  directPersonalConnectionSubjectId,
   disableCapability,
   discoverMcpRegistryCapabilities,
   editHumanQueuePrompt,
   enableCapability,
   enabledCapabilityMcpToolRefs,
+  evaluateMemorySlackPublication,
   executeRunOnSelfhostedMachine,
   filenameForMimeType,
+  freezePersonalConnectionDelegations,
   getActorNewSessionDraft,
   getCapabilityPack,
   getHumanComposerDraft,
@@ -6534,6 +7019,11 @@ export {
   normalizeResources,
   officialMcpRegistryUrl,
   openGeniSlackBotMetadata,
+  personalConnectionDelegationForServer,
+  personalConnectionDelegationSourceForGrant,
+  personalConnectionDelegationsEqual,
+  personalConnectionDelegationsFromParent,
+  personalConnectionDelegationsFromVisibleConnections,
   postUserMessageTurn,
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
@@ -6575,6 +7065,7 @@ export {
   scheduledTaskTemporalScheduleId,
   scheduledTaskToolsProvided,
   scheduledTaskTriggerToken,
+  selectedPersonalConnectionServers,
   sendAgentSessionMessage,
   sessionSpawnDenialEnvelope,
   sessionWithEffectiveToolPolicy,
@@ -6604,6 +7095,7 @@ export {
   validateVariableSetAttachment,
   validatedScheduledTaskUpdate,
   withDefaultEnabledCapabilityMcpTools,
+  withFrozenPersonalConnectionDelegations,
   workflowIdForSession,
   workspaceSessionToolPolicyDefaultServerIds,
   workspaceSessionToolPolicyServerIds,