@opengeni/core 0.24.1 → 0.28.1

package/dist/canonical-human-identities.d.ts

@@ -0,0 +1,12 @@
+import type { Database } from "@opengeni/db";
+import type { Context } from "hono";
+import type { ManagedAuth } from "./managed-auth-type.js";
+export type CanonicalHumanRequestIdentity = {
+    authUserId: string;
+    authSessionId: string;
+};
+export declare function requireCanonicalHumanRequestIdentity(context: Context, input: {
+    db: Database;
+    managedAuth?: ManagedAuth | null;
+    allowRecovery?: boolean;
+}): Promise<CanonicalHumanRequestIdentity>;

package/dist/canonical-human-identities.js

@@ -0,0 +1,23 @@
+import {
+  getManagedSession
+} from "./chunk-IBOEYG6N.js";
+
+// src/canonical-human-identities.ts
+import { HTTPException } from "hono/http-exception";
+async function requireCanonicalHumanRequestIdentity(context, input) {
+  if (!input.managedAuth) {
+    throw new HTTPException(404, { message: "Canonical human identity is unavailable" });
+  }
+  const session = await getManagedSession(context, input.managedAuth, {
+    db: input.db,
+    ...input.allowRecovery === void 0 ? {} : { allowIdentityRecovery: input.allowRecovery }
+  });
+  if (!session?.user || typeof session.session?.id !== "string") {
+    throw new HTTPException(401, { message: "Managed human authentication required" });
+  }
+  return { authUserId: session.user.id, authSessionId: session.session.id };
+}
+export {
+  requireCanonicalHumanRequestIdentity
+};
+//# sourceMappingURL=canonical-human-identities.js.map

package/dist/canonical-human-identities.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import type { Database } from \"@opengeni/db\";\nimport type { Context } from \"hono\";\nimport { HTTPException } from \"hono/http-exception\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport { getManagedSession } from \"./managed-session\";\n\nexport type CanonicalHumanRequestIdentity = {\n  authUserId: string;\n  authSessionId: string;\n};\n\nexport async function requireCanonicalHumanRequestIdentity(\n  context: Context,\n  input: { db: Database; managedAuth?: ManagedAuth | null; allowRecovery?: boolean },\n): Promise<CanonicalHumanRequestIdentity> {\n  if (!input.managedAuth) {\n    throw new HTTPException(404, { message: \"Canonical human identity is unavailable\" });\n  }\n  const session = await getManagedSession(context, input.managedAuth, {\n    db: input.db,\n    ...(input.allowRecovery === undefined ? {} : { allowIdentityRecovery: input.allowRecovery }),\n  });\n  if (!session?.user || typeof session.session?.id !== \"string\") {\n    throw new HTTPException(401, { message: \"Managed human authentication required\" });\n  }\n  return { authUserId: session.user.id, authSessionId: session.session.id };\n}\n"],"mappings":";;;;;AAEA,SAAS,qBAAqB;AAS9B,eAAsB,qCACpB,SACA,OACwC;AACxC,MAAI,CAAC,MAAM,aAAa;AACtB,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,0CAA0C,CAAC;AAAA,EACrF;AACA,QAAM,UAAU,MAAM,kBAAkB,SAAS,MAAM,aAAa;AAAA,IAClE,IAAI,MAAM;AAAA,IACV,GAAI,MAAM,kBAAkB,SAAY,CAAC,IAAI,EAAE,uBAAuB,MAAM,cAAc;AAAA,EAC5F,CAAC;AACD,MAAI,CAAC,SAAS,QAAQ,OAAO,QAAQ,SAAS,OAAO,UAAU;AAC7D,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,wCAAwC,CAAC;AAAA,EACnF;AACA,SAAO,EAAE,YAAY,QAAQ,KAAK,IAAI,eAAe,QAAQ,QAAQ,GAAG;AAC1E;","names":[]}

package/dist/chunk-IBOEYG6N.js

@@ -0,0 +1,34 @@
+// src/managed-session.ts
+import { validateCanonicalHumanSession } from "@opengeni/db/canonical-human-identities";
+async function getManagedSession(c, auth, options) {
+  const result = await auth.api.getSession({
+    headers: c.req.raw.headers,
+    returnHeaders: true
+  });
+  for (const cookie of setCookieHeaders(result.headers)) {
+    c.header("set-cookie", cookie, { append: true });
+  }
+  const session = result.response;
+  if (!session?.user || !options?.db) return session;
+  const authSessionId = session.session?.id;
+  if (typeof authSessionId !== "string") return null;
+  const valid = await validateCanonicalHumanSession(options.db, {
+    authSessionId,
+    authUserId: session.user.id,
+    ...options.allowIdentityRecovery === void 0 ? {} : { allowRecovery: options.allowIdentityRecovery }
+  });
+  return valid ? session : null;
+}
+function setCookieHeaders(headers) {
+  const getSetCookie = headers.getSetCookie;
+  if (getSetCookie) {
+    return getSetCookie.call(headers);
+  }
+  const cookie = headers.get("set-cookie");
+  return cookie ? [cookie] : [];
+}
+
+export {
+  getManagedSession
+};
+//# sourceMappingURL=chunk-IBOEYG6N.js.map

package/dist/chunk-IBOEYG6N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-session.ts"],"sourcesContent":["import type { Context } from \"hono\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport type { Database } from \"@opengeni/db\";\nimport { validateCanonicalHumanSession } from \"@opengeni/db/canonical-human-identities\";\n\n/**\n * Read a Better Auth session without bypassing its sliding-cookie renewal.\n *\n * Better Auth can refresh the durable session while resolving `getSession`.\n * Programmatic callers must explicitly request and forward the returned cookie\n * headers; the HTTP handler does this automatically, but direct API calls do not.\n */\nexport async function getManagedSession(\n  c: Context,\n  auth: ManagedAuth,\n  options?: { db?: Database; allowIdentityRecovery?: boolean },\n) {\n  const result = await auth.api.getSession({\n    headers: c.req.raw.headers,\n    returnHeaders: true,\n  });\n\n  for (const cookie of setCookieHeaders(result.headers)) {\n    c.header(\"set-cookie\", cookie, { append: true });\n  }\n\n  const session = result.response;\n  if (!session?.user || !options?.db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(options.db, {\n    authSessionId,\n    authUserId: session.user.id,\n    ...(options.allowIdentityRecovery === undefined\n      ? {}\n      : { allowRecovery: options.allowIdentityRecovery }),\n  });\n  return valid ? session : null;\n}\n\nfunction setCookieHeaders(headers: Headers): string[] {\n  const getSetCookie = (\n    headers as Headers & {\n      getSetCookie?: () => string[];\n    }\n  ).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  const cookie = headers.get(\"set-cookie\");\n  return cookie ? [cookie] : [];\n}\n"],"mappings":";AAGA,SAAS,qCAAqC;AAS9C,eAAsB,kBACpB,GACA,MACA,SACA;AACA,QAAM,SAAS,MAAM,KAAK,IAAI,WAAW;AAAA,IACvC,SAAS,EAAE,IAAI,IAAI;AAAA,IACnB,eAAe;AAAA,EACjB,CAAC;AAED,aAAW,UAAU,iBAAiB,OAAO,OAAO,GAAG;AACrD,MAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,GAAI,QAAO;AAC3C,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,QAAQ,IAAI;AAAA,IAC5D;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,IACzB,GAAI,QAAQ,0BAA0B,SAClC,CAAC,IACD,EAAE,eAAe,QAAQ,sBAAsB;AAAA,EACrD,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAEA,SAAS,iBAAiB,SAA4B;AACpD,QAAM,eACJ,QAGA;AACF,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC;AAEA,QAAM,SAAS,QAAQ,IAAI,YAAY;AACvC,SAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AAC9B;","names":[]}

package/dist/dependencies.d.ts

@@ -120,11 +120,15 @@ export type AppDependencies = {
     managedAuth?: ManagedAuth | null;
     /** Injectable Codex HTTP transport for deterministic API/provider tests. */
     codexFetch?: typeof fetch;
+    /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
+    xaiFetch?: typeof fetch;
     /** Injectable Slack Web API transport for deterministic bot-connection tests. */
     slackFetch?: typeof fetch;
     /** Injectable Google OAuth/Drive transport for deterministic connector tests. */
     googleDriveFetch?: typeof fetch;
-    /** Injectable provider-preset OAuth/API transport for deterministic integration tests. */
+    /** Injectable Fiken API transport for deterministic connector tests. */
+    fikenFetch?: typeof fetch;
+    /** Injectable Integration Definition OAuth/API transport for deterministic tests. */
     apiIntegrationOAuthFetch?: typeof fetch;
     atlassianFetch?: typeof fetch;
     /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */

package/dist/domain/conversation-integrations.d.ts

@@ -0,0 +1,225 @@
+declare const conversationProviderNamespaceBrand: unique symbol;
+declare const conversationProviderOpaqueValueBrand: unique symbol;
+declare const conversationEventIdentityBrand: unique symbol;
+declare const conversationRouteIdentityBrand: unique symbol;
+declare const conversationActorIdentityBrand: unique symbol;
+declare const conversationOperationIdentityBrand: unique symbol;
+declare const conversationRequestDigestBrand: unique symbol;
+export declare const CONVERSATION_INTEGRATION_SCHEMA_VERSION: 1;
+export declare const CONVERSATION_PROVIDER_NAMESPACE_MAX_UTF8_BYTES = 128;
+export declare const CONVERSATION_PROVIDER_OPAQUE_ID_MAX_UTF8_BYTES = 512;
+export declare const CONVERSATION_TEXT_MAX_UTF8_BYTES: number;
+export declare const CONVERSATION_ATTACHMENT_MAX_COUNT = 16;
+export declare const CONVERSATION_ATTACHMENT_NAME_MAX_UTF8_BYTES = 1024;
+export declare const CONVERSATION_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 128;
+export declare const CONVERSATION_OPERATION_KEY_MAX_UTF8_BYTES = 512;
+export declare const CONVERSATION_OUTCOME_CODE_MAX_UTF8_BYTES = 128;
+export type ConversationProviderNamespace = string & {
+    readonly [conversationProviderNamespaceBrand]: true;
+};
+export type ConversationProviderOpaqueValue = string & {
+    readonly [conversationProviderOpaqueValueBrand]: true;
+};
+export type ConversationProviderOpaqueIdKind = "installation" | "actor" | "conversation" | "thread" | "event" | "message" | "attachment" | "receipt";
+export type ConversationProviderOpaqueId<TKind extends ConversationProviderOpaqueIdKind = ConversationProviderOpaqueIdKind> = Readonly<{
+    provider: ConversationProviderNamespace;
+    kind: TKind;
+    value: ConversationProviderOpaqueValue;
+}>;
+export type ConversationInstallationIdentity = ConversationProviderOpaqueId<"installation">;
+export type ConversationEventIdentity = `ciev1_${string}` & {
+    readonly [conversationEventIdentityBrand]: true;
+};
+export type ConversationRouteIdentity = `cirt1_${string}` & {
+    readonly [conversationRouteIdentityBrand]: true;
+};
+export type ConversationActorIdentity = `ciac1_${string}` & {
+    readonly [conversationActorIdentityBrand]: true;
+};
+export type ConversationOperationIdentity = `ciop1_${string}` & {
+    readonly [conversationOperationIdentityBrand]: true;
+};
+export type ConversationRequestDigest = `sha256:${string}` & {
+    readonly [conversationRequestDigestBrand]: true;
+};
+export type ConversationActorKind = "human" | "bot" | "system";
+export type ConversationActorInput = Readonly<{
+    providerActorId: string;
+    kind: ConversationActorKind;
+}>;
+export type ConversationActor = Readonly<{
+    installation: ConversationInstallationIdentity;
+    providerActorId: ConversationProviderOpaqueId<"actor">;
+    kind: ConversationActorKind;
+    identity: ConversationActorIdentity;
+}>;
+export type ConversationRoute = Readonly<{
+    installation: ConversationInstallationIdentity;
+    providerConversationId: ConversationProviderOpaqueId<"conversation">;
+    providerThreadId: ConversationProviderOpaqueId<"thread"> | null;
+    identity: ConversationRouteIdentity;
+}>;
+export type ConversationRouteInput = Readonly<{
+    providerConversationId: string;
+    providerThreadId?: string | null;
+}>;
+export type ConversationStartSignal = Readonly<{
+    kind: "start";
+}>;
+export type ConversationContinueSignal = Readonly<{
+    kind: "continue";
+}>;
+export type ConversationControlSignal = Readonly<{
+    kind: "control";
+    control: "stop" | "resume";
+}>;
+export type ConversationSignal = ConversationStartSignal | ConversationContinueSignal | ConversationControlSignal;
+export type ConversationAttachmentReference = Readonly<{
+    providerAttachmentId: ConversationProviderOpaqueId<"attachment">;
+    fileName: string | null;
+    mediaType: string | null;
+    byteSize: number | null;
+    contentSha256: string | null;
+}>;
+export type ConversationAttachmentReferenceInput = Readonly<{
+    providerAttachmentId: string;
+    fileName?: string | null;
+    mediaType?: string | null;
+    byteSize?: number | null;
+    contentSha256?: string | null;
+}>;
+export type ConversationInboundEnvelope = Readonly<{
+    schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;
+    installation: ConversationInstallationIdentity;
+    actor: ConversationActor;
+    route: ConversationRoute;
+    providerEventId: ConversationProviderOpaqueId<"event">;
+    providerMessageId: ConversationProviderOpaqueId<"message">;
+    eventIdentity: ConversationEventIdentity;
+    occurredAt: string;
+    signal: ConversationSignal;
+    text: string;
+    attachments: readonly ConversationAttachmentReference[];
+}>;
+export type ConversationInboundEnvelopeInput = Readonly<{
+    provider: string;
+    installationId: string;
+    actor: ConversationActorInput;
+    route: ConversationRouteInput;
+    providerEventId: string;
+    providerMessageId: string;
+    occurredAt: string;
+    signal: ConversationSignal;
+    text: string;
+    attachments?: readonly ConversationAttachmentReferenceInput[];
+}>;
+type ConversationDeliveryCommandBase = Readonly<{
+    schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;
+    operationId: ConversationOperationIdentity;
+    logicalOperationKey: string;
+    requestDigest: ConversationRequestDigest;
+    installation: ConversationInstallationIdentity;
+    route: ConversationRoute;
+}>;
+export type ConversationPostCommand = ConversationDeliveryCommandBase & Readonly<{
+    kind: "post";
+    targetProviderMessageId: null;
+    text: string;
+}>;
+export type ConversationUpdateCommand = ConversationDeliveryCommandBase & Readonly<{
+    kind: "update";
+    targetProviderMessageId: ConversationProviderOpaqueId<"message">;
+    text: string;
+}>;
+export type ConversationDeleteCommand = ConversationDeliveryCommandBase & Readonly<{
+    kind: "delete";
+    targetProviderMessageId: ConversationProviderOpaqueId<"message">;
+    text: null;
+}>;
+export type ConversationDeliveryCommand = ConversationPostCommand | ConversationUpdateCommand | ConversationDeleteCommand;
+export type ConversationDeliveryCommandInput = Readonly<{
+    kind: "post";
+    logicalOperationKey: string;
+    installation: ConversationInstallationIdentity;
+    route: ConversationRoute;
+    text: string;
+}> | Readonly<{
+    kind: "update";
+    logicalOperationKey: string;
+    installation: ConversationInstallationIdentity;
+    route: ConversationRoute;
+    targetProviderMessageId: string;
+    text: string;
+}> | Readonly<{
+    kind: "delete";
+    logicalOperationKey: string;
+    installation: ConversationInstallationIdentity;
+    route: ConversationRoute;
+    targetProviderMessageId: string;
+}>;
+export type ConversationProviderReceipt = Readonly<{
+    schemaVersion: typeof CONVERSATION_INTEGRATION_SCHEMA_VERSION;
+    operationId: ConversationOperationIdentity;
+    requestDigest: ConversationRequestDigest;
+    installation: ConversationInstallationIdentity;
+    providerMessageId: ConversationProviderOpaqueId<"message">;
+    providerReceiptId: ConversationProviderOpaqueId<"receipt"> | null;
+    observedAt: string;
+}>;
+export type ConversationProviderReceiptInput = Readonly<{
+    command: ConversationDeliveryCommand;
+    providerMessageId: string;
+    providerReceiptId?: string | null;
+    observedAt: string;
+}>;
+export type ConversationDeliveryNotStarted = Readonly<{
+    status: "not_started";
+    code: string;
+}>;
+export type ConversationDeliveryUnknown = Readonly<{
+    status: "unknown";
+    code: string;
+}>;
+export type ConversationDeliveryRetryableFailure = Readonly<{
+    status: "retryable_failure";
+    code: string;
+    retryAfterMs: number | null;
+}>;
+export type ConversationDeliveryPermanentFailure = Readonly<{
+    status: "permanent_failure";
+    code: string;
+}>;
+export type ConversationDeliverySuccess = Readonly<{
+    status: "success";
+    receipt: ConversationProviderReceipt;
+}>;
+export type ConversationDeliveryOutcome = ConversationDeliveryNotStarted | ConversationDeliveryUnknown | ConversationDeliveryRetryableFailure | ConversationDeliveryPermanentFailure | ConversationDeliverySuccess;
+export type ConversationDeliveryOutcomeInput = ConversationDeliveryNotStarted | ConversationDeliveryUnknown | Readonly<{
+    status: "retryable_failure";
+    code: string;
+    retryAfterMs?: number | null;
+}> | ConversationDeliveryPermanentFailure | ConversationDeliverySuccess;
+export type ConversationDeliveryNextAction = "retry_same_operation" | "reconcile" | "stop" | "complete";
+export declare function normalizeConversationInboundEnvelope(input: ConversationInboundEnvelopeInput): ConversationInboundEnvelope;
+export declare function normalizeConversationProviderNamespace(value: string): ConversationProviderNamespace;
+export declare function normalizeConversationInstallationIdentity(input: {
+    provider: string | ConversationProviderNamespace;
+    providerInstallationId: string;
+}): ConversationInstallationIdentity;
+export declare function normalizeConversationActor(installation: ConversationInstallationIdentity, input: ConversationActorInput): ConversationActor;
+export declare function normalizeConversationRoute(installation: ConversationInstallationIdentity, input: ConversationRouteInput): ConversationRoute;
+export declare function normalizeConversationDeliveryCommand(input: ConversationDeliveryCommandInput): ConversationDeliveryCommand;
+export declare function normalizeConversationProviderReceipt(input: ConversationProviderReceiptInput): ConversationProviderReceipt;
+export declare function normalizeConversationDeliveryOutcome(input: ConversationDeliveryOutcomeInput): ConversationDeliveryOutcome;
+export declare function conversationDeliveryNextAction(outcome: ConversationDeliveryOutcome): ConversationDeliveryNextAction;
+export declare function assertConversationDeliveryMayRetry(outcome: ConversationDeliveryOutcome): asserts outcome is ConversationDeliveryNotStarted | ConversationDeliveryRetryableFailure;
+export declare function assertConversationDeliveryCommandMatches(expected: ConversationDeliveryCommand, candidate: ConversationDeliveryCommand): void;
+export declare function assertConversationInboundEnvelope(value: unknown): asserts value is ConversationInboundEnvelope;
+export declare function assertConversationDeliveryCommand(value: unknown): asserts value is ConversationDeliveryCommand;
+export declare function assertConversationProviderReceipt(value: unknown): asserts value is ConversationProviderReceipt;
+export declare function assertConversationDeliveryOutcome(value: unknown): asserts value is ConversationDeliveryOutcome;
+export declare function canonicalConversationInboundEnvelopeJson(envelope: ConversationInboundEnvelope): string;
+export declare function canonicalConversationDeliveryCommandJson(command: ConversationDeliveryCommand): string;
+export declare function canonicalConversationProviderReceiptJson(receipt: ConversationProviderReceipt): string;
+export declare function canonicalConversationDeliveryOutcomeJson(outcome: ConversationDeliveryOutcome): string;
+export {};

package/dist/domain/fiken.d.ts

@@ -0,0 +1,35 @@
+import { type ConnectionMetadata, type FikenCompanySummary, type FikenConnectionMetadata as FikenMetadata } from "@opengeni/contracts";
+export declare function fikenConnectionMetadata(metadata: Record<string, unknown>): FikenMetadata | null;
+/**
+ * A workspace-shared Fiken connection created through one of the verified
+ * install paths: the pasted personal API token (`api_key`) or the Fiken OAuth
+ * app flow (`oauth2`). Both are deliberately workspace-owned; personal
+ * ("Connect only for me") ownership needs the delegation-snapshot lane and is
+ * not yet wired for the first-party fiken tools.
+ */
+export declare function isFikenConnection(connection: ConnectionMetadata): boolean;
+/**
+ * The Fiken credential role is reserved for the verified install routes.
+ * Generic connection create/update must reject it so a caller cannot forge a
+ * "verified" Fiken row (with attacker-chosen companies metadata) that the
+ * first-party fiken tools would then bind to. Mirrors the Slack bot guard.
+ */
+export declare function hasReservedFikenMetadata(metadata: Record<string, unknown> | null | undefined): boolean;
+/**
+ * One default-company rule for both verified lanes: an explicit request wins
+ * when the credential can access it, then a still-accessible previous default
+ * survives reconnect, then a single-company credential auto-selects. Returns
+ * null (caller decides whether that is an error) when a requested slug is not
+ * among the verified companies.
+ */
+export declare function resolveFikenDefaultCompanySlug(input: {
+    requested: string | null;
+    previous: string | null;
+    companies: readonly FikenCompanySummary[];
+}): string | null;
+/**
+ * The row a capability tile or tool default should bind to when several Fiken
+ * connections exist: usable status first, then newest update, then immutable
+ * UUID descending as the stable tie-breaker.
+ */
+export declare function preferredFikenConnection<T extends Pick<ConnectionMetadata, "status" | "updatedAt" | "id">>(connections: readonly T[]): T | null;

package/dist/domain/sessions.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type Permission, type ReasoningEffort, type ResourceRef, type Session, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import type { AcceptSessionUserMessageDependencies, ApiRouteDeps, SessionWorkflowClient } from "../dependencies.js";
@@ -14,7 +14,10 @@ export declare class SessionSpawnDeniedError extends Error {
  * child omission snapshots the parent's exact effective selection. Explicit
  * [] is authoritative and must never widen.
  */
-export declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined): FirstPartyMcpToolName[];
+export declare function resolveFirstPartyMcpToolsForCreate(requested: FirstPartyMcpToolName[] | undefined, parentStored: FirstPartyMcpToolName[] | null | undefined, policy?: {
+    default: readonly FirstPartyMcpToolName[];
+    allowed: readonly FirstPartyMcpToolName[];
+}): FirstPartyMcpToolName[];
 export declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
     readonly error: {
         readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
@@ -66,7 +69,10 @@ export declare function createAndStartSessionWithOutcome(input: {
     requestedSessionId?: string;
     db: Database;
     bus: EventBus;
-    workflowClient: SessionWorkflowClient;
+    workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
+    /** Internal database-only composition seam. The exact session shell and this
+     * linkage commit together before its first event/turn can be initialized. */
+    beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
     accountId: string;
     workspaceId: string;
     initialMessage: string;
@@ -96,6 +102,7 @@ export declare function createAndStartSessionWithOutcome(input: {
     } | null;
     rigId?: string | null;
     rigVersionId?: string | null;
+    channelId?: string | null;
     goal?: GoalSpec | null;
     instructions?: string | null;
     policyRole?: string | null;
@@ -104,6 +111,7 @@ export declare function createAndStartSessionWithOutcome(input: {
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;

package/dist/domain/video-generation-capabilities.d.ts

@@ -1,6 +1,7 @@
 import { VideoGenerationCapabilities, type VideoGenerationModelCapability, type VideoGenerationPolicy as VideoGenerationPolicyType } from "@opengeni/contracts";
 /** Reviewed executable catalog. Dynamic workspace policy never mutates tool schemas. */
 export declare const VIDEO_GENERATION_MODEL_CATALOG: readonly VideoGenerationModelCapability[];
+export declare function videoGenerationModelSupportsFundingSource(modelId: string, fundingSource: VideoGenerationPolicyType["fundingSource"]): boolean;
 export declare function defaultVideoGenerationPolicy(): VideoGenerationPolicyType;
 export declare function videoGenerationCapabilitiesForPolicy(input: {
     policy: VideoGenerationPolicyType;

package/dist/index.d.ts

@@ -26,6 +26,8 @@ export * from "./domain/durable-learning-slack-publication.js";
 export * from "./domain/slack-publication-secret-safety.js";
 export * from "./domain/company-profile-durable-learning-adapter.js";
 export * from "./domain/slack-bot.js";
+export * from "./domain/conversation-integrations.js";
+export * from "./domain/fiken.js";
 export * from "./domain/workspace-members.js";
 export * from "./domain/video-generation.js";
 export * from "./domain/video-generation-capabilities.js";