@opengeni/core 0.28.0 → 1.0.0

package/dist/domain/agent-config-resolution.d.ts

@@ -0,0 +1,49 @@
+import { type Settings } from "@opengeni/config";
+import { type AgentConfigCreator, type AgentConfigParent, type AgentConfigRequest, type FirstPartyMcpToolName, type ResolvedAgentCapabilities, type ResolvedAgentConfig, type Session, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+/**
+ * Run an agent-config resolution step and surface its typed failure as a 422
+ * whose `cause` keeps the `AgentConfigError` (the API renders its code as
+ * `details.code`; MCP and Slack keep the plain message).
+ */
+export declare function withAgentConfigHttpErrors<T>(fn: () => T): T;
+/** The current effective capabilities of a null-config session (the conversion/child ceiling). */
+export declare function legacySessionAgentCapabilities(settings: Settings, session: Pick<Session, "firstPartyMcpTools" | "tools" | "toolPolicy">, workspaceSettings: unknown, 
+/** The workspace's current omitted-tools default server ids, when known. */
+defaultServerIds?: Iterable<string>): ResolvedAgentCapabilities;
+/** A parent session as a resolution input: its frozen config, or its legacy ceiling. */
+export declare function agentConfigParentFor(settings: Settings, parent: Session, workspaceSettings: unknown): AgentConfigParent;
+/**
+ * Resolve the frozen agent configuration for a new session. Every creator
+ * calls this: `createSessionForRequest` (public API, MCP `session_create`,
+ * Slack, drafts), automations, and the scheduled worker. Returns `config:
+ * null` for exact legacy behavior.
+ */
+export declare function resolveSessionAgentConfigForCreate(input: {
+    settings: Settings;
+    creator: AgentConfigCreator;
+    request: AgentConfigRequest | undefined;
+    instructions: string | undefined;
+    workspaceSettings: unknown;
+    parent: Session | null;
+    goal: boolean;
+}): {
+    config: ResolvedAgentConfig | null;
+    instructions: string | undefined;
+};
+/**
+ * Write a resolved configuration through to the legacy columns the runtime
+ * reads today. `null` returns the inputs unchanged; `"all"` also does.
+ */
+export declare function applySessionAgentConfigWriteThrough(input: {
+    config: ResolvedAgentConfig | null;
+    firstPartyMcpTools: FirstPartyMcpToolName[];
+    explicitFirstPartyMcpTools?: readonly FirstPartyMcpToolName[] | undefined;
+    tools: ToolRef[];
+    toolPolicy: SessionToolPolicy;
+    productServerIds: Iterable<string>;
+    explicitServerIds?: Iterable<string> | undefined;
+}): {
+    firstPartyMcpTools: FirstPartyMcpToolName[];
+    tools: ToolRef[];
+    toolPolicy: SessionToolPolicy;
+};

package/dist/domain/automations.d.ts

@@ -0,0 +1,58 @@
+import { AutomationAcceptedExecution, AutomationNormalizedEvent, AutomationSessionTemplate, type AccessGrant, type Permission, type AutomationAdapterId, type AutomationSource, type AutomationTrigger } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+/** Canonical authenticated grant or exact server-owned originating policy only. */
+export declare function automationCredentialRestrictionForGrant(db: Database, grant: AccessGrant): Promise<AutomationSessionTemplate["credentialRestriction"]>;
+/** Explicit delegated scopes must stay within the frozen setup ceiling. */
+export declare function requireAutomationCredentialRestrictionPermissions(restriction: AutomationSessionTemplate["credentialRestriction"], permissions: readonly Permission[]): void;
+export type AutomationAdapterRenderResult = {
+    initialMessage: string;
+    sessionTemplate: AutomationSessionTemplate;
+    provenance: Record<string, unknown>;
+};
+export type AutomationAdapter = {
+    id: AutomationAdapterId;
+    verify(input: {
+        rawBody: Uint8Array;
+        headers: Headers;
+        secret: string;
+        sourceConfiguration: Record<string, unknown>;
+    }): boolean;
+    deliveryKey(input: {
+        headers: Headers;
+        requestDigest: string;
+    }): string;
+    normalize(input: {
+        rawBody: Uint8Array;
+        headers: Headers;
+        sourceConfiguration: Record<string, unknown>;
+    }): AutomationNormalizedEvent;
+    validateSourceConfiguration(configuration: Record<string, unknown>): void;
+    validateTriggerConfiguration(configuration: Record<string, unknown>): void;
+    validateTriggerParameters(parameters: Record<string, unknown>): void;
+    matches(input: {
+        event: AutomationNormalizedEvent;
+        trigger: AutomationTrigger;
+    }): boolean;
+    render(input: {
+        event: AutomationNormalizedEvent;
+        trigger: AutomationTrigger;
+        source: Pick<AutomationSource, "id" | "adapterId" | "version" | "configuration">;
+    }): AutomationAdapterRenderResult;
+};
+export declare const SIGNED_JSON_AUTOMATION_ADAPTER_ID: "signed-json.v1";
+export declare const signedJsonAutomationAdapter: AutomationAdapter;
+export declare function registerAutomationAdapter(adapter: AutomationAdapter): void;
+export declare function getAutomationAdapter(adapterId: string): AutomationAdapter | null;
+export declare function requireAutomationAdapter(adapterId: string): AutomationAdapter;
+export declare function automationRequestDigest(adapterId: string, rawBody: Uint8Array): string;
+export declare function buildAutomationAcceptedExecution(input: {
+    accountId: string;
+    workspaceId: string;
+    source: AutomationSource;
+    trigger: AutomationTrigger;
+    eventId: string;
+    event: AutomationNormalizedEvent;
+    render: AutomationAdapterRenderResult;
+    /** Trusted caller restriction from the immutable stored event, not adapter JSON. */
+    credentialRestriction?: "developer_setup";
+}): AutomationAcceptedExecution;

package/dist/domain/capabilities.d.ts

@@ -14,7 +14,7 @@ export declare function createCatalogItem(input: {
     workspaceId: string;
     payload: CreateCapabilityCatalogItemRequest;
 }): Promise<CapabilityCatalogItem>;
-export declare function enableCapability(input: {
+type EnableCapabilityInput = {
     db: Database;
     grant: AccessGrant;
     accountId: string;
@@ -23,19 +23,37 @@ export declare function enableCapability(input: {
     capabilityId: string;
     payload: EnableCapabilityRequest;
     probeMcpServer?: McpCapabilityProbe;
-}): Promise<CapabilityInstallation>;
+};
+export declare function enableCapability(input: EnableCapabilityInput): Promise<CapabilityInstallation>;
+/** Probe outside a durable Connect commit; persist the exact prepared settings
+ * inside the caller's authorized receipt transaction. Native enable uses this too. */
+export declare function prepareCapabilityEnable(input: EnableCapabilityInput): Promise<{
+    commit: (db: Database) => Promise<{
+        id: string;
+        accountId: string;
+        workspaceId: string;
+        capabilityId: string;
+        kind: "api" | "mcp" | "plugin" | "skill";
+        status: "active" | "disabled";
+        config: Record<string, unknown>;
+        metadata: Record<string, unknown>;
+        enabledAt: string;
+        updatedAt: string;
+    }>;
+}>;
 export type McpCapabilityProbeInput = {
     id: string;
     name: string;
     url: string;
     timeoutMs: number;
     headers?: Record<string, string>;
+    settings?: Settings;
 };
 export type McpCapabilityProbeResult = {
     toolCount: number;
 };
 export type McpCapabilityProbe = (input: McpCapabilityProbeInput) => Promise<McpCapabilityProbeResult>;
-export declare function validateMcpCapabilityConnection(item: CapabilityCatalogItem, probe?: McpCapabilityProbe, headers?: Record<string, string>): Promise<Record<string, unknown>>;
+export declare function validateMcpCapabilityConnection(item: CapabilityCatalogItem, probe?: McpCapabilityProbe, headers?: Record<string, string>, settings?: Settings): Promise<Record<string, unknown>>;
 export declare function disableCapability(input: {
     db: Database;
     accountId: string;
@@ -85,7 +103,7 @@ export declare function codexAppsCatalogItem(available: boolean): CapabilityCata
  * row for GitHub resources, Documents, schedules, or other platform features.
  */
 export declare function nativeConnectionCapabilityRecommendations(): CapabilityCatalogItem[];
-export declare function applyCapabilityEnablement(item: CapabilityCatalogItem, installation: CapabilityInstallation | undefined, activePackIds: Set<string>): CapabilityCatalogItem;
+export declare function applyCapabilityEnablement(item: CapabilityCatalogItem, installation: CapabilityInstallation | undefined): CapabilityCatalogItem;
 export type CapabilityCatalogSearchMatch = {
     item: CapabilityCatalogItem;
     score: number;

package/dist/domain/company-profile-agent-admin.d.ts

@@ -0,0 +1,25 @@
+import { type CompanyProfileAgentConfirmationReceipt, type CompanyProfileAgentProposalReceipt } from "@opengeni/contracts";
+import { confirmCompanyProfileForAgent, proposeCompanyProfileForAgent, type Database } from "@opengeni/db";
+export { CompanyProfileAgentAdminError } from "@opengeni/db";
+export type CompanyProfileAgentAdminRouterOptions = {
+    db: Database;
+    propose?: typeof proposeCompanyProfileForAgent;
+    confirm?: typeof confirmCompanyProfileForAgent;
+};
+/**
+ * Explicit organization administration is intentionally separate from derived
+ * workspace learning. The database capabilities own exact-attempt admission,
+ * current organization-owner authority, the separate organization policy,
+ * canonical review when required, tenant isolation, CAS, and immutable
+ * receipts.
+ */
+export declare function createCompanyProfileAgentAdminRouter(options: CompanyProfileAgentAdminRouterOptions): {
+    propose: (input: {
+        attempt: unknown;
+        request: unknown;
+    }) => Promise<CompanyProfileAgentProposalReceipt>;
+    confirm: (input: {
+        attempt: unknown;
+        request: unknown;
+    }) => Promise<CompanyProfileAgentConfirmationReceipt>;
+};

package/dist/domain/connection-account-selection-error.d.ts

@@ -0,0 +1,8 @@
+import { HTTPException } from "hono/http-exception";
+import { ConnectionAccountSelectionDiagnostic } from "@opengeni/contracts";
+/** An account choice needs attention; retrying the same work cannot fix it. */
+export declare class ConnectionAccountSelectionError extends HTTPException {
+    name: string;
+    readonly diagnostic: ConnectionAccountSelectionDiagnostic;
+    constructor(message: string, diagnostic?: ConnectionAccountSelectionDiagnostic);
+}

package/dist/domain/connector-tool-permissions.d.ts

@@ -0,0 +1,36 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { Settings } from "@opengeni/config";
+import type { AccessGrant, ConnectorToolPermissionsResponse, UpdateConnectorToolPermissionsRequest, ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+type Input = {
+    db: Database;
+    settings: Settings;
+    workspaceId: string;
+    grant: AccessGrant;
+    capabilityId: string;
+    personalOwnerVerified: boolean;
+};
+type ListedTool = {
+    name: string;
+    title?: string | undefined;
+    description?: string | undefined;
+    annotations?: {
+        readOnlyHint?: boolean | undefined;
+        destructiveHint?: boolean | undefined;
+        title?: string | undefined;
+    } | undefined;
+};
+export declare function connectorToolGroup(tool: ListedTool): "read" | "write" | "other";
+/** A selector can supply discovery credentials only when one visible account
+ * matches. Never apply one account's approval choices to an arbitrary sibling. */
+export declare function unpinnedConnectorToolPermissionAccount<T extends ConnectionMetadata>(ref: McpServerConnectionRef, visible: T[], subjectId: string): T | null;
+export declare function connectorToolPermissionReference(ref: McpServerConnectionRef, connectionId: string): McpServerConnectionRef;
+/** Use the same adapter-owned identities as execution for reviewed local catalogs. */
+export declare function reviewedConnectorToolCatalog(server: Pick<Settings["mcpServers"][number], "url" | "connectionRef" | "allowedTools">, grantedScopes: readonly string[]): ListedTool[] | null;
+/** Collect discovery pages without changing the caller's connection or authority. */
+export declare function collectConnectorToolPages(client: Pick<Client, "listTools">, deadline: AbortSignal): Promise<ListedTool[]>;
+export declare function getConnectorToolPermissions(input: Input): Promise<ConnectorToolPermissionsResponse>;
+export declare function updateConnectorToolPermissions(input: Input & {
+    payload: UpdateConnectorToolPermissionsRequest;
+}): Promise<void>;
+export {};

package/dist/domain/direct-model-provider.d.ts

@@ -0,0 +1,3 @@
+import { DirectModelProviderMetadata } from "@opengeni/contracts";
+/** Verify the customer's exact route without persisting their key or test response. */
+export declare function verifyDirectModelAccess(input: DirectModelProviderMetadata, apiKey: string, fetchImpl?: typeof fetch): Promise<void>;

package/dist/domain/editable-artifacts/agent-application.d.ts

@@ -1,5 +1,5 @@
 import { type DocumentArtifactCommand, type DocumentArtifactQuery, type PresentationArtifactCommand, type PresentationArtifactQuery, type SpreadsheetArtifactCommand, type SpreadsheetArtifactKernelQuery } from "@opengeni/contracts/editable-artifacts";
-import type { EditableArtifactDurableExportService, EditableArtifactMaterializationFormat, EditableArtifactMaterializationJob } from "./durable-export.js";
+import { type EditableArtifactDurableExportService, type EditableArtifactMaterializationFormat, type EditableArtifactMaterializationJob } from "./durable-export.js";
 import type { EditableArtifactService } from "./service.js";
 import { type EditableArtifact, type EditableArtifactActor, type EditableArtifactClientTransactionId, type EditableArtifactId, type EditableArtifactModality, type EditableArtifactOriginalImport, type EditableArtifactScope, type ImportEditableArtifactRequest } from "./types.js";
 import type { EditableArtifactKernelState } from "./ports.js";
@@ -30,6 +30,7 @@ export type EditableArtifactAgentContext = Readonly<{
 }>;
 export type EditableArtifactAgentMetadata = Readonly<{
     id: string;
+    artifactReference: string;
     modality: EditableArtifactModality;
     title: string;
     lifecycle: EditableArtifact["lifecycle"];
@@ -116,6 +117,12 @@ export type EditableArtifactAgentApplicationDependencies = Readonly<{
     exports: EditableArtifactDurableExportService;
     associations: EditableArtifactAgentAssociationPort;
     inspector: EditableArtifactAgentInspectionKernelPort;
+    /** Production persists proof only after a successful native query. */
+    recordInspection?: (input: EditableArtifactAgentContext & {
+        artifact: EditableArtifactAgentMetadata;
+        queryHash: string;
+        queryKind: string;
+    }) => Promise<string>;
     officeImports: EditableArtifactOfficeImportPort;
     workspaceFiles: EditableArtifactAgentWorkspaceFilePort;
 }>;
@@ -125,6 +132,7 @@ export type EditableArtifactAgentApplicationDependencies = Readonly<{
  */
 export declare class EditableArtifactAgentApplication {
     private readonly dependencies;
+    describeExportFormats(): string;
     constructor(dependencies: EditableArtifactAgentApplicationDependencies);
     list(input: EditableArtifactAgentContext & Readonly<{
         limit?: number;
@@ -151,6 +159,7 @@ export declare class EditableArtifactAgentApplication {
     }>): Promise<Readonly<{
         artifact: EditableArtifactAgentMetadata;
         projection: unknown;
+        inspectionReceiptId?: string;
     }>>;
     apply(input: EditableArtifactAgentContext & Readonly<{
         artifactId: EditableArtifactId;

package/dist/domain/editable-artifacts/durable-export.d.ts

@@ -4,6 +4,17 @@ import { type EditableArtifactActor, type EditableArtifactCausalFrontier, type E
 export declare const EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES: number;
 export declare const EDITABLE_ARTIFACT_EXPORT_MAX_OPTIONS_BYTES: number;
 export type EditableArtifactMaterializationFormat = "xlsx" | "pptx" | "docx" | "pdf" | "png" | "webp";
+/**
+ * Stock production export formats. Custom deployments advertise their own
+ * capabilities on the profile port; this list never overrides their resolver.
+ * Extend the stock list only together with a real deployed codec.
+ */
+export declare const EDITABLE_ARTIFACT_EXPORT_FORMATS: Readonly<Record<EditableArtifactModality, readonly EditableArtifactMaterializationFormat[]>>;
+/** Human/agent-readable summary of {@link EDITABLE_ARTIFACT_EXPORT_FORMATS}. */
+export declare function describeEditableArtifactExportFormats(): string;
+export declare function describeConfiguredExportFormats(configuredFormats: Readonly<Record<EditableArtifactModality, readonly EditableArtifactMaterializationFormat[]>>): string;
+/** Typed refusal that tells the caller which formats do exist. */
+export declare function unsupportedEditableArtifactExport(modality: EditableArtifactModality, format: string, formats?: Readonly<Record<EditableArtifactModality, readonly EditableArtifactMaterializationFormat[]>>): EditableArtifactDurableExportError;
 export type EditableArtifactMaterializationMimeType = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" | "application/vnd.openxmlformats-officedocument.presentationml.presentation" | "application/vnd.openxmlformats-officedocument.wordprocessingml.document" | "application/pdf" | "image/png" | "image/webp";
 export type EditableArtifactPinnedVersion = Readonly<{
     scope: EditableArtifactScope;
@@ -58,6 +69,9 @@ export type EditableArtifactMaterializationProfile = Readonly<{
 }>;
 /** Server-owned profile lookup. Clients never supply executable identity facts. */
 export interface EditableArtifactMaterializationProfilePort {
+    /** Deployment-owned discovery; resolve remains the authority for exact options.
+     * Optional for existing custom adapters, whose support is resolved dynamically. */
+    supportedFormats?: Readonly<Record<EditableArtifactModality, readonly EditableArtifactMaterializationFormat[]>>;
     resolve(input: Readonly<{
         modality: EditableArtifactModality;
         format: EditableArtifactMaterializationFormat;
@@ -165,7 +179,7 @@ export type EditableArtifactMaterializationDownload = Readonly<{
 export type EditableArtifactDurableExportErrorCode = "invalid_request" | "not_found" | "forbidden" | "conflict" | "unsupported_format" | "not_ready" | "unavailable";
 export declare class EditableArtifactDurableExportError extends Error {
     readonly code: EditableArtifactDurableExportErrorCode;
-    constructor(code: EditableArtifactDurableExportErrorCode);
+    constructor(code: EditableArtifactDurableExportErrorCode, message?: string);
 }
 export type EditableArtifactDurableExportServiceDependencies = Readonly<{
     authorization: EditableArtifactAuthorizationPort;
@@ -178,6 +192,13 @@ export type EditableArtifactDurableExportServiceDependencies = Readonly<{
 export declare class EditableArtifactDurableExportService {
     private readonly dependencies;
     constructor(dependencies: EditableArtifactDurableExportServiceDependencies);
+    describeFormats(): string;
+    /** Read-only exact preflight: no snapshot, ID allocation, or store write. */
+    preflight(input: {
+        modality: EditableArtifactModality;
+        format: EditableArtifactMaterializationFormat;
+        options?: Readonly<Record<string, unknown>>;
+    }): Promise<EditableArtifactMaterializationProfile>;
     pinVersion(input: DurableExportContext & {
         idempotencyKey: string;
         name: string;

package/dist/domain/editable-artifacts/ports.d.ts

@@ -1,3 +1,4 @@
+import type { Database } from "@opengeni/db";
 import type { EditableArtifact, EditableArtifactActor, EditableArtifactCausalFrontier, EditableArtifactId, EditableArtifactLiveOutboxRecord, EditableArtifactMutationIntent, EditableArtifactOperationId, EditableArtifactOperationRecord, EditableArtifactOriginOperation, EditableArtifactOriginalImport, EditableArtifactOutboxId, EditableArtifactOutboxRetryFailureCode, EditableArtifactOutboxDeadLetterFailureCode, EditableArtifactPermission, EditableArtifactReceipt, EditableArtifactScope, EditableArtifactSequenceCheckpoint, EditableArtifactSnapshotId, EditableArtifactSnapshotMetadata, EditableArtifactStableId, EditableArtifactStateHash, EditableArtifactTransactionId, EditableArtifactClientTransactionId, EditableArtifactCommittedTransactionRecord, EditableArtifactModality, EditableArtifactRequestHash, EditableArtifactSerialized, EditableArtifactSerializedCommittedTransactionRecord, EditableArtifactSerializedSnapshotMetadata, EditableArtifactSpreadsheet, EditableArtifactSpreadsheetCommittedTransactionRecord, EditableArtifactSpreadsheetSnapshotMetadata, CreateEditableArtifactResult, PublishEditableArtifactSnapshotRequest, ValidatedEditableArtifactMutationIntent } from "./types.js";
 export type EditableArtifactAuthorizationRequest = Readonly<{
     scope: EditableArtifactScope;
@@ -202,6 +203,8 @@ export type ReadEditableArtifactTransactionBasisRequest = Readonly<{
     clientTransactionId: EditableArtifactReceipt["clientTransactionId"];
     previousLocalTransactionId: EditableArtifactReceipt["previousLocalTransactionId"];
     selectiveUndoOperationIds: readonly EditableArtifactOperationId[];
+    /** Backend-only live authority; checked transactionally even on receipt replay. */
+    authorizeCommit?: EditableArtifactCommitAuthorizer;
 }>;
 export type EditableArtifactTransactionUndoBasis = Readonly<{
     operationId: EditableArtifactOperationId;
@@ -232,6 +235,12 @@ export type ExpectedEditableArtifactPredecessor = Readonly<{
     replicaId: EditableArtifactReceipt["replicaId"];
     replicaCounter: number;
 }>;
+/**
+ * Receives the actual persistence transaction, never a separate pool handle.
+ * May run repeatedly for replay, lock admission and final persistence; must not
+ * perform external mutations. Stores without this transaction capability deny.
+ */
+export type EditableArtifactCommitAuthorizer = (tx: Database) => Promise<void>;
 export type TryCommitAppliedEditableArtifactTransactionRequest = CommitAppliedEditableArtifactTransaction & Readonly<{
     scope: EditableArtifactScope;
     artifactId: EditableArtifactId;
@@ -239,6 +248,7 @@ export type TryCommitAppliedEditableArtifactTransactionRequest = CommitAppliedEd
     expectedAuthorizationRevision: number;
     /** Rechecked by durable production stores in the commit transaction. */
     authorizationActor: EditableArtifactActor;
+    authorizeCommit?: EditableArtifactCommitAuthorizer;
     actorKey: string;
     clientTransactionId: EditableArtifactReceipt["clientTransactionId"];
     requestHash: EditableArtifactReceipt["requestHash"];

package/dist/domain/editable-artifacts/service.d.ts

@@ -1,14 +1,13 @@
-import type { AuthoritativeEditableArtifactKernelPort, EditableArtifactAuthorizationPort, EditableArtifactClockPort, EditableArtifactCompactionPort, EditableArtifactGenesisPort, EditableArtifactKernelState, EditableArtifactMutationIntentCodecPort, EditableArtifactSnapshotVerifierPort, EditableArtifactStableIdFactoryPort, EditableArtifactStorePort } from "./ports.js";
+import type { EditableArtifactCommitAuthorizer, AuthoritativeEditableArtifactKernelPort, EditableArtifactAuthorizationPort, EditableArtifactClockPort, EditableArtifactCompactionPort, EditableArtifactGenesisPort, EditableArtifactKernelState, EditableArtifactMutationIntentCodecPort, EditableArtifactSnapshotVerifierPort, EditableArtifactStableIdFactoryPort, EditableArtifactStorePort } from "./ports.js";
 import { type ApplyEditableArtifactTransactionRequest, type ApplyEditableArtifactTransactionResult, type CreateEditableArtifactRequest, type CreateEditableArtifactResult, type ImportEditableArtifactRequest, type EditableArtifact, type EditableArtifactActor, type EditableArtifactClientTransactionId, type EditableArtifactReceipt, type EditableArtifactScope, type EditableArtifactSnapshotMetadata, type PublishEditableArtifactSnapshotRequest } from "./types.js";
 export declare const EDITABLE_ARTIFACT_MAX_OPERATIONS_PER_TRANSACTION = 4096;
 export declare const EDITABLE_ARTIFACT_MAX_UNDO_TARGETS_PER_TRANSACTION: number;
 export declare const EDITABLE_ARTIFACT_MAX_COMMAND_BYTES_PER_TRANSACTION: number;
 export declare const EDITABLE_ARTIFACT_MAX_INTENT_BYTES_PER_TRANSACTION: number;
-export declare const EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION = 1;
 export declare const EDITABLE_ARTIFACT_MAX_OPERATION_BYTES_PER_TRANSACTION: number;
 /** Canonical OGACO envelope bound. Kept as an alias for existing consumers. */
 export declare const EDITABLE_ARTIFACT_MAX_COMMITTED_TRANSACTION_BYTES: number;
-export declare const EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION: 1;
+export declare const EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION: 2;
 export declare const EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS = 4;
 /** Compact well before hard replay ceilings so one maximum transaction cannot cross them. */
 export declare const EDITABLE_ARTIFACT_COMPACTION_TRANSACTION_THRESHOLD = 1024;
@@ -81,6 +80,8 @@ export declare class EditableArtifactService {
         artifactId: EditableArtifact["id"];
         actor: EditableArtifactActor;
         request: ApplyEditableArtifactTransactionRequest;
+        /** Authenticated backend authority, not part of the client mutation envelope. */
+        authorizeCommit?: EditableArtifactCommitAuthorizer;
     }): Promise<ApplyEditableArtifactTransactionResult>;
     private applyTransactionOptimistically;
     compactCurrentHead(input: {

package/dist/domain/environments.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import type { AccessGrant, VariableSet } from "@opengeni/contracts";
+import { type AccessGrant, type VariableSet } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 export declare const MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
 export declare const MAX_VARIABLES_PER_ENVIRONMENT = 100;
@@ -9,12 +9,10 @@ export declare const assertAllowedEnvironmentVariableName: typeof assertAllowedV
 export declare function requireVariableSetEncryption(settings: Settings): Uint8Array;
 /** @deprecated use requireVariableSetEncryption */
 export declare const requireEnvironmentEncryption: typeof requireVariableSetEncryption;
-export declare function requireVariableSetForApi(db: Database, workspaceId: string, variableSetId: string): Promise<VariableSet>;
+export declare function requireVariableSetForApi(db: Database, grant: AccessGrant, variableSetId: string): Promise<VariableSet>;
 /**
- * Validates an variableSet attachment supplied in a request payload (session
- * create, scheduled task create/update, pack enable). Requires the
- * `variable-sets:use` permission unless the attachment was already authorized
- * (pack-installation-inherited attachments), and maps a missing or
+ * Validates a Variable Set attachment supplied in a session or task request.
+ * Requires attach and use permissions, and maps a missing or
  * cross-variable set to 422 because the id is payload, not the route
  * target. RLS plus the workspace_id clause make cross-workspace ids
  * indistinguishable from missing ones.
@@ -22,9 +20,7 @@ export declare function requireVariableSetForApi(db: Database, workspaceId: stri
 export declare function validateVariableSetAttachment(deps: {
     settings: Settings;
     db: Database;
-}, grant: AccessGrant, workspaceId: string, variableSetId: string, options?: {
-    preauthorized?: boolean;
-}): Promise<VariableSet>;
+}, grant: AccessGrant, workspaceId: string, variableSetId: string): Promise<VariableSet>;
 export declare function recordVariableSetAuditEvent(db: Database, input: {
     grant: AccessGrant;
     action: "variable_set.created" | "variable_set.updated" | "variable_set.deleted" | "variable_set.variable.set" | "variable_set.variable.deleted";

package/dist/domain/external-creation-attribution.d.ts

@@ -0,0 +1,6 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+export declare const EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
+/** Retained alongside session.created metadata; this is not a live permission
+ * snapshot and must never authorize a follow-up, child, or scheduled turn. */
+export declare function externalCreationMetadata(metadata: Record<string, unknown> | undefined, authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): Record<string, unknown> | undefined;

package/dist/domain/file-owner.d.ts

@@ -0,0 +1,8 @@
+import { type SessionRlsActorContext } from "@opengeni/db";
+import type { AccessGrant, Permission } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+import type { ApiRouteDeps } from "../dependencies.js";
+/** Personal original-file access follows verified ownership, never a subject-shaped bearer. */
+export declare function fileOwnerContextForAccess(deps: Pick<ApiRouteDeps, "db">, access: AccessGrantAuthorization, permission: Permission): Promise<SessionRlsActorContext>;
+/** Internal MCP/core callers can prove an agent attempt without inventing a human authorization. */
+export declare function fileOwnerContextForAgent(deps: Pick<ApiRouteDeps, "db">, grant: AccessGrant, permission: Permission): Promise<SessionRlsActorContext>;

package/dist/domain/github-action-policies.d.ts

@@ -0,0 +1,36 @@
+import type { GitHubActionPolicyActor, GitHubActionPolicyActorState, GitHubActionPolicyDecision, GitHubActionPolicyGroup } from "@opengeni/contracts";
+import { type ConnectorActionPolicySnapshotEntry, type Database } from "@opengeni/db";
+import { GITHUB_REST_MCP_APP_SERVER_ID, GITHUB_REST_MCP_PERSONAL_SERVER_ID } from "@opengeni/runtime/github-rest-mcp";
+export declare const GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES: {
+    readonly routine: ("issue_comment" | "issue_create" | "issue_update" | "pull_request_comment" | "pull_request_create" | "pull_request_request_review" | "pull_request_update" | "ref_create")[];
+    readonly review: readonly ["pull_request_review_submit"];
+    readonly merge: readonly ["pull_request_merge"];
+};
+export type GitHubActionPolicyActorBinding = {
+    actor: GitHubActionPolicyActor;
+    label: string;
+    connectionId: string;
+    serverId: typeof GITHUB_REST_MCP_APP_SERVER_ID | typeof GITHUB_REST_MCP_PERSONAL_SERVER_ID;
+};
+export declare function projectGitHubActionPolicyActor(policies: readonly ConnectorActionPolicySnapshotEntry[], binding: GitHubActionPolicyActorBinding): GitHubActionPolicyActorState;
+export declare function listGitHubActionPolicyActors(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    actors: readonly GitHubActionPolicyActorBinding[];
+}): Promise<GitHubActionPolicyActorState[]>;
+export declare function updateGitHubActionPolicyGroup(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    actor: GitHubActionPolicyActorBinding;
+    group: GitHubActionPolicyGroup;
+    decision: GitHubActionPolicyDecision;
+}): Promise<GitHubActionPolicyActorState>;
+export declare function githubAppActionPolicyActor(input: {
+    installationId: number;
+    accountLogin: string | null;
+}): GitHubActionPolicyActorBinding;
+export declare function personalGitHubActionPolicyActor(input: {
+    connectionId: string;
+    githubLogin: string;
+}): GitHubActionPolicyActorBinding;

package/dist/domain/github-repository-bindings.d.ts

@@ -0,0 +1,117 @@
+import type { RepositoryResourceRef, ResourceRef } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+/**
+ * GitHub App repository-binding resolution for bare repository resources.
+ *
+ * A repository resource that names a GitHub repository by URI alone (no
+ * `githubInstallationId`/`githubRepositoryId`) never mints an installation
+ * token, so the sandbox clones it anonymously and cannot push or use `gh`.
+ * The workspace allowlist (`github_installation_repositories`) stores only
+ * numeric repository ids, so resolving a URI needs the installation's owner
+ * login from the durable binding plus one provider read for the repository id.
+ * This module owns the pure parts: URI parsing, candidate selection under the
+ * workspace's auditable bindings, and the exactly-one-match stamping rule. The
+ * provider read is injected so the worker can supply the live GitHub lookup
+ * while tests stay deterministic.
+ */
+export type GitHubRepositoryCoordinates = {
+    owner: string;
+    name: string;
+};
+/**
+ * Parse a GitHub repository reference into owner/name, else null. Accepts
+ * `https://github.com/<owner>/<repo>[.git][/]`, `www.github.com`,
+ * `ssh://git@github.com/<owner>/<repo>[.git]`, and the scp-like
+ * `git@github.com:<owner>/<repo>[.git]`.
+ */
+export declare function parseGitHubRepositoryCoordinates(uri: string): GitHubRepositoryCoordinates | null;
+export type UnboundGitHubRepositoryResource = {
+    resource: RepositoryResourceRef;
+    owner: string;
+    name: string;
+};
+/**
+ * Repository resources that name a github.com repository without any
+ * platform identity: no GitHub App ids, no credential binding, no personal
+ * connection, and either the explicit `github` provider or no provider at all.
+ * Resources that already carry ids, legacy provider ids, a binding, or a
+ * connection are someone else's authority and are never rewritten here.
+ */
+export declare function unboundGitHubRepositoryResources(resources: readonly ResourceRef[]): UnboundGitHubRepositoryResource[];
+export type GitHubRepositoryBindingCandidate = {
+    installationId: number;
+    accountLogin: string;
+    repositoryIds: number[];
+};
+/**
+ * The workspace's auditable GitHub App bindings, under workspace RLS. Only
+ * bindings that could authorize a token mint are candidates; legacy
+ * `unverified` rows never resolve a URI.
+ */
+export declare function listGitHubRepositoryBindingCandidates(db: Database, workspaceId: string): Promise<GitHubRepositoryBindingCandidate[]>;
+export type GitHubRepositoryBindingLookup = (input: {
+    installationId: number;
+    owner: string;
+    name: string;
+}) => Promise<{
+    id: number;
+} | null>;
+export type GitHubRepositoryBinding = {
+    installationId: number;
+    repositoryId: number;
+};
+export type GitHubRepositoryBindingOutcome = {
+    status: "resolved";
+    binding: GitHubRepositoryBinding;
+}
+/** No workspace binding owns this repository's account: anonymous, as before. */
+ | {
+    status: "unbound";
+}
+/** The account is bound, but no installation's allowlist holds this repository. */
+ | {
+    status: "not_allowlisted";
+    installationIds: number[];
+}
+/** More than one bound installation's allowlist holds this repository. */
+ | {
+    status: "ambiguous";
+    installationIds: number[];
+}
+/** The provider lookup failed (suspended/deleted installation, outage). */
+ | {
+    status: "unavailable";
+    installationIds: number[];
+    message: string;
+};
+export type GitHubRepositoryBindingResolution = {
+    uri: string;
+    owner: string;
+    name: string;
+    outcome: GitHubRepositoryBindingOutcome;
+};
+export type GitHubRepositoryBindingResolutionResult = {
+    resources: ResourceRef[];
+    bindings: Map<string, GitHubRepositoryBinding>;
+    resolutions: GitHubRepositoryBindingResolution[];
+};
+/**
+ * Resolve every bare github.com repository resource against the workspace's
+ * auditable bindings. A resource is stamped only when exactly one bound
+ * installation's allowlist contains the repository id GitHub reports for that
+ * URI through that installation. Every other case leaves the resource bare
+ * and reports why, so the caller can surface a warning without ever failing
+ * the turn or the session. Distinct URIs resolve concurrently, as do the
+ * candidate installations of one owner.
+ */
+export declare function resolveGitHubRepositoryBindings(input: {
+    resources: readonly ResourceRef[];
+    candidates: readonly GitHubRepositoryBindingCandidate[];
+    lookup: GitHubRepositoryBindingLookup;
+}): Promise<GitHubRepositoryBindingResolutionResult>;
+/**
+ * Stamp resolved GitHub App ids onto the matching bare resources of any
+ * resource list (turn resources and runtime resources must agree, because the
+ * credential binding id and token filename derive from the installation id).
+ */
+export declare function applyGitHubRepositoryBindings(resources: readonly ResourceRef[], bindings: ReadonlyMap<string, GitHubRepositoryBinding>): ResourceRef[];

package/dist/domain/github-skill-source.d.ts

@@ -0,0 +1,5 @@
+import type { Settings } from "@opengeni/config";
+import type { GitHubSkillSourceClient } from "./skill-imports.js";
+type GitHubJsonRequest = (path: string, maxBytes: number, label: string) => Promise<unknown>;
+export declare function createGitHubSkillSourceClient(settings: Settings, requestJson?: GitHubJsonRequest): GitHubSkillSourceClient;
+export {};