@opengeni/core 0.20.16 → 0.21.10

package/dist/access/index.d.ts

@@ -19,4 +19,12 @@ export type AccessGrantAuthorization = {
 export declare function accessGrantAuthorizationFromContext(context: AccessContext, grant: AccessGrant): AccessGrantAuthorization;
 export declare function requireAccessGrantAuthorization(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrantAuthorization>;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
+/**
+ * Require a permission to be present literally on the grant. This deliberately
+ * does not expand workspace:admin or deprecated aliases and is reserved for
+ * authorities, such as plaintext secret reads, that old broad grants must not
+ * acquire implicitly.
+ */
+export declare function requireLiteralPermission(grant: AccessGrant, permission: Permission): void;
+export declare function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean;
 export declare function hasPermission(permissions: Permission[], permission: Permission): boolean;

package/dist/application/session-commands.d.ts

@@ -97,12 +97,17 @@ export declare function steerHumanQueuePrompt(deps: {
     bus: EventBus;
     sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, turnId: string, input: SteerSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-export declare function controlHumanSessionWorkstream(deps: {
+export declare function controlHumanSessionWorkstreamWithOutcome(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
     sessionAuthorization?: SessionAuthorizationPort | null;
-}, context: HumanSessionCommandContext, input: SessionControlRequest): Promise<SessionControlResponse>;
+}, context: HumanSessionCommandContext, input: SessionControlRequest): Promise<{
+    response: SessionControlResponse;
+    replay: boolean;
+}>;
+/** Backward-compatible response path used by the REST control route. */
+export declare function controlHumanSessionWorkstream(deps: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[0], context: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[1], input: Parameters<typeof controlHumanSessionWorkstreamWithOutcome>[2]): Promise<SessionControlResponse>;
 export declare function controlHumanWorkspace(deps: {
     db: Database;
     bus: EventBus;

package/dist/dependencies.d.ts

@@ -7,7 +7,7 @@ import type { Observability } from "@opengeni/observability";
 import type { createObjectStorage } from "@opengeni/storage";
 import type { ManagedAuth } from "./managed-auth-type";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
-import type { TranscriptionService } from "./transcription";
+import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
 export type SessionWorkflowClient = {
     signalUserMessage: (input: {
         sessionId: string;
@@ -113,6 +113,8 @@ export type AppDependencies = {
     oauthCallbackDeadlineMs?: number;
     /** Optional host-owned voice-input transcription service. */
     transcription?: TranscriptionService | null;
+    /** Optional host-owned long-form audio normalization/segmentation service. */
+    transcriptionSegmenter?: TranscriptionSegmenter | null;
     sandboxClient?: ApiSandboxClient;
     /**
      * Resume a box by id from a serialized resume_state envelope (the lease's

package/dist/domain/capabilities.d.ts

@@ -65,4 +65,11 @@ export declare function discoverMcpRegistryCapabilities(input: {
 }): Promise<CapabilityCatalogItem[]>;
 export { officialMcpRegistryUrl };
 type McpRegistryFetch = (input: URL, init?: RequestInit) => Promise<Response>;
+/**
+ * The Apps MCP is not a configured server and is not a user-installable
+ * capability. It is a deployment-gated, workspace-designated runtime surface,
+ * so project it into the same catalog the web picker already consumes while
+ * keeping its authorization state server-derived and explicit.
+ */
+export declare function codexAppsCatalogItem(available: boolean): CapabilityCatalogItem;
 export declare function applyCapabilityEnablement(item: CapabilityCatalogItem, installation: CapabilityInstallation | undefined, activePackIds: Set<string>): CapabilityCatalogItem;

package/dist/domain/memory-slack-publication.d.ts

@@ -76,13 +76,11 @@ export type MemorySlackPublicationProjection = {
     importance: MemorySlackImportance;
     deliveryMode: MemorySlackDeliveryMode;
     summary: string;
-    summaryRedacted: boolean;
     summaryTruncated: boolean;
     namespace: string;
     labels: string[];
     labelsTruncated: boolean;
     ownerLabel: string | null;
-    ownerLabelRedacted: boolean;
     ownerLabelTruncated: boolean;
     authoritativeRecord: {
         workspaceId: string;

package/dist/domain/scheduled-tasks.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
+import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, ScheduledTaskAgentConfig, Session, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
 import { type Database, type UpdateScheduledTaskInput } from "@opengeni/db";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
@@ -20,7 +20,25 @@ export declare function createValidatedScheduledTask(input: {
     payload: CreateScheduledTaskPayload;
     toolsProvided?: boolean;
     variableSetPreauthorized?: boolean;
+    sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+    authorizationSurface?: SessionAuthorizationSurface | undefined;
 }): Promise<ScheduledTask>;
+export declare function validateScheduledTaskTarget(input: {
+    db: Database;
+    sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+    authorizationSurface?: SessionAuthorizationSurface | undefined;
+    grant: AccessGrant;
+    targetSessionId: string | null | undefined;
+    runMode: ScheduledTask["runMode"];
+    variableSetId: string | null | undefined;
+    rigId: string | null | undefined;
+    agentConfig: ScheduledTaskAgentConfig;
+    missingTargetStatus?: 404 | 422;
+}): Promise<Session | null>;
+export declare function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask;
+export declare function scheduledTaskRunForGrant<T extends {
+    sessionId: string | null;
+}>(run: T, grant: AccessGrant): T;
 export declare function validatedScheduledTaskUpdate(input: {
     settings: Settings;
     db: Database;
@@ -30,6 +48,8 @@ export declare function validatedScheduledTaskUpdate(input: {
     payload: UpdateScheduledTaskPayload;
     /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */
     toolsProvided?: boolean;
+    sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+    authorizationSurface?: SessionAuthorizationSurface | undefined;
 }): Promise<UpdateScheduledTaskInput>;
 export declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export type ScheduledTaskRestoreState = {
@@ -38,6 +58,10 @@ export type ScheduledTaskRestoreState = {
 };
 export declare function captureScheduledTaskRestoreState(db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
 export declare function restoreScheduledTask(db: Database, previous: ScheduledTaskRestoreState): Promise<ScheduledTask>;
+export declare class ScheduledTaskSyncError extends Error {
+    readonly persistenceRestored: boolean;
+    constructor(cause: unknown, persistenceRestored: boolean);
+}
 export declare function syncCreatedScheduledTask(input: {
     db: Database;
     workflowClient: SessionWorkflowClient;

package/dist/domain/sessions.d.ts

@@ -49,7 +49,20 @@ export type FrozenCreationInitiator = {
 };
 export declare function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator;
 export declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
-export declare function createAndStartSession(input: {
+export type CreateSessionOutcome = {
+    session: CreateSessionResponse;
+    /** The committed create/start effect represented by this request. */
+    outcome: "created" | "repaired" | "replayed";
+    /** Backward-compatible replay flag for existing entity-oriented callers. */
+    replay: boolean;
+    /** True when the request created/repaired start state or committed a new wake revision. */
+    changed: boolean;
+};
+export type CreateSessionRequestOutcome = CreateSessionOutcome & {
+    /** Billing telemetry is recorded after the committed session start. */
+    usageRecording: "recorded" | "failed";
+};
+export declare function createAndStartSessionWithOutcome(input: {
     requestedSessionId?: string;
     db: Database;
     bus: EventBus;
@@ -107,7 +120,9 @@ export declare function createAndStartSession(input: {
     maxNestedAgentDepthOverride?: number | null;
     allowNestedAgentDepthIncrease?: boolean;
     subjectId?: string | null;
-}): Promise<CreateSessionResponse>;
+}): Promise<CreateSessionOutcome>;
+/** Backward-compatible entity-returning create path used by existing callers. */
+export declare function createAndStartSession(input: Parameters<typeof createAndStartSessionWithOutcome>[0]): Promise<CreateSessionResponse>;
 export declare function workflowIdForSession(sessionId: string): string;
 /**
  * Reject an explicit model that the host does not expose. The set of usable
@@ -190,6 +205,7 @@ export declare function postUserMessageTurn(input: {
 }): Promise<{
     accepted: SessionEvent;
     turn: SessionTurn;
+    replay: boolean;
 }>;
 /**
  * Full create-session flow shared by `POST /sessions` and the first-party MCP
@@ -200,7 +216,11 @@ export declare function postUserMessageTurn(input: {
  * trusted immediate parent, while explicit arrays (including []) win. A
  * top-level create with omitted tools applies workspace-default capability MCPs.
  */
-export declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown): Promise<Session>;
+export declare function createSessionForRequestWithOutcome(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown): Promise<CreateSessionRequestOutcome>;
+/** @internal Fixed public projection; the committed session outcome remains authoritative. */
+export declare function reportSessionUsageRecordingFailure(_error: unknown): void;
+/** Backward-compatible entity-returning request path for REST and core callers. */
+export declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown): Promise<CreateSessionResponse>;
 /**
  * Full accept-user-message flow shared by the `user.message` branch of
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
@@ -208,7 +228,7 @@ export declare function createSessionForRequest(deps: ApiRouteDeps, grant: Acces
  * enqueue, and usage recording. `toolsProvided: false` durably preserves an
  * Tool selection is durable session state and never rides a follow-up prompt.
  */
-export declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
+export declare function acceptSessionUserMessageWithOutcome(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
     text: string;
     turnInstructions?: string | null;
     resources?: ResourceRef[];
@@ -224,6 +244,12 @@ export declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageD
 }): Promise<{
     accepted: SessionEvent;
     turn: SessionTurn;
+    replay: boolean;
+}>;
+/** Backward-compatible entity-returning path used by existing REST callers. */
+export declare function acceptSessionUserMessage(deps: Parameters<typeof acceptSessionUserMessageWithOutcome>[0], grant: Parameters<typeof acceptSessionUserMessageWithOutcome>[1], workspaceId: Parameters<typeof acceptSessionUserMessageWithOutcome>[2], sessionId: Parameters<typeof acceptSessionUserMessageWithOutcome>[3], input: Parameters<typeof acceptSessionUserMessageWithOutcome>[4]): Promise<{
+    accepted: SessionEvent;
+    turn: SessionTurn;
 }>;
 /**
  * Shared title-write path for the manual rename route AND both MCP tools

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from "./dependencies";
 export * from "./workflow-wake-contract";
 export * from "./sandbox-types";
 export * from "./managed-auth-type";
+export * from "./managed-session";
 export * from "./transcription";
 export * from "./sandbox/fleet";
 export * from "./sandbox/routing";