@opengeni/core 0.4.10 → 0.10.0

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { Settings } from '@opengeni/config';
-import { ScheduledTask, Document, Permission, AccessContext, AccessGrant, LimitAction, LimitDecision, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, GoalSpec, SessionMcpServerMetadata, Session, WorkspaceMember, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
+import { ScheduledTask, Document, GitHubAppApiPort, ConnectionCredentialsPort, SessionAuthorizationPort, Permission, AccessContext, AccessGrant, SessionAuthorizationActor, SessionAuthorizationTarget, SessionAuthorizationOperation, SessionAuthorizationSurface, SessionAuthorizationListScope, LimitAction, LimitDecision, TurnInitiator, TurnInitiatorContext, SessionTurnSource, CapabilityCatalogItem, CapabilityInstallation, CapabilityCatalogResponse, CreateCapabilityCatalogItemRequest, EnableCapabilityRequest, VariableSet, Rig, RigVersion, CreateRigRequest, RigDefinitionEditPayload, RigChange, ProposeRigChangeRequest, UpdateRigRequest, CapabilityPack, SocialConnection, ScheduledTaskAgentConfig, ToolRef, ResourceRef, SessionEffectiveToolPolicy, SessionToolPolicy, Session, CreateScheduledTaskRequest, UpdateScheduledTaskRequest, ReasoningEffort, SessionMcpCredentialUpdateInput, SessionEvent, SessionTurn, TurnExecutionPolicyV1, GoalSpec, SessionMcpServerMetadata, CreateSessionResponse, SessionMcpApprovalPolicy, UpdateSessionMcpApprovalPolicyResponse, WorkspaceMember, SessionControlRequest, SessionControlResponse, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, DeleteSessionQueueItemRequest, SessionQueueMutationResponse, EditSessionQueueItemRequest, ComposerDraft, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SteerSessionQueueItemRequest } from '@opengeni/contracts';
 export { mergeToolRefs, stableJson } from '@opengeni/contracts';
 import * as _opengeni_db from '@opengeni/db';
-import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput } from '@opengeni/db';
+import { Database, SandboxRecord, EnabledMcpCapabilityServer, UpdateScheduledTaskInput, SessionCommandActor, CreateSessionMcpServerInput, UpdateSessionMcpServerCredentialsInput } from '@opengeni/db';
 import { DocumentServices } from '@opengeni/documents';
 import { EventBus } from '@opengeni/events';
 import { Observability } from '@opengeni/observability';
@@ -136,7 +136,27 @@ type AppDependencies = {
     observability?: Observability;
     readinessChecks?: Partial<Record<"db" | "nats" | "temporal", () => Promise<void> | void>>;
     githubStateSecret?: string;
+    /**
+     * Optional host-provided GitHub App API seam. Embedded hosts can authorize
+     * users, inspect installations, and list repositories with their own GitHub
+     * App credentials; standalone deployments fall back to @opengeni/github.
+     */
+    githubAppApi?: GitHubAppApiPort;
+    /**
+     * Optional host-owned connection credential seam. API-side consumers use
+     * the MCP leg for Toolspace/Code Mode; worker consumers bind the same port
+     * for model MCP, Git, and sandbox-secret resolution.
+     */
+    connectionCredentials?: ConnectionCredentialsPort | null;
+    /**
+     * Optional embedding-host session ACL. Unset preserves standalone workspace
+     * authorization; once bound, every session-addressed surface fails closed on
+     * an unavailable or invalid host decision.
+     */
+    sessionAuthorization?: SessionAuthorizationPort | null;
     managedAuth?: ManagedAuth | null;
+    /** Injectable Codex HTTP transport for deterministic API/provider tests. */
+    codexFetch?: typeof fetch;
     sandboxClient?: ApiSandboxClient;
     /**
      * Resume a box by id from a serialized resume_state envelope (the lease's
@@ -162,7 +182,7 @@ type ApiRouteDeps = AppDependencies & {
  * the canonical admission path without constructing unrelated HTTP, document,
  * or sandbox services. The public API still passes its `ApiRouteDeps` superset.
  */
-type AcceptSessionUserMessageDependencies = Pick<AppDependencies, "settings" | "db" | "bus"> & {
+type AcceptSessionUserMessageDependencies = Pick<AppDependencies, "settings" | "db" | "bus" | "sessionAuthorization"> & {
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     objectStorage: ObjectStorageDependency;
 };
@@ -288,7 +308,7 @@ type RunOnResult = {
 };
 /**
  * Run a ONE-OFF op against a SPECIFIC target WITHOUT changing the active pointer
- * (the dossier `run_on`). Only selfhosted targets are routable as a one-off here
+ * (the design `run_on`). Only selfhosted targets are routable as a one-off here
  * (a Modal target is the session's group box, reached via the normal Channel-A /
  * turn path — `run_on` is for reaching a NON-active enrolled machine without
  * swapping). The op is fenced under the target's enrollment, addressed to its
@@ -315,7 +335,7 @@ type ProvisionResult = {
  *     cannot click the loud whole-machine consent itself).
  *   - modal → create a first-class named modal `sandboxes` record (a swap target).
  *     NOTE: the Modal BOX is materialized lazily when first swapped-to (Modal
- *     lifecycle is owned by the lease — unchanged per dossier §21).
+ * lifecycle is owned by the lease — unchanged per).
  */
 declare function provisionSandbox(services: FleetServices, ctx: FleetContext, input: {
     kind: "selfhosted" | "modal";
@@ -340,7 +360,7 @@ declare function relayConfigFromSettings(settings: Settings): SelfhostedRelayCon
  *  the CONSUMER uses (`relayConfigFromSettings`) so producer + consumer always agree
  *  on `/stream` — even when the configured URL omits it. An unconfigured relay maps to
  *  `""` (graceful degrade: the agent reports no-relay rather than dialing a synthetic
- *  host). Fixes preview AND managed prod with no agent rebuild (dossier §V5/§V6). */
+ * host). Fixes preview AND managed prod with no agent rebuild. */
 declare function relayDialBaseFromSettings(settings: Settings): string;
 /** Whether the routing proxy should wrap the Channel-A box: gated by the
  *  selfhosted flag (the active pointer + swap are only meaningful then). */
@@ -367,6 +387,41 @@ declare function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: s
 declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 declare function hasPermission(permissions: Permission[], permission: Permission): boolean;
 
+type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
+/** Maximum time an omitted host hint leaves a live session stream unchecked. */
+declare const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15000;
+declare class SessionAuthorizationDeniedError extends Error {
+    readonly reason: "not_found" | "forbidden" | "revoked" | "caller_stale";
+    readonly code = "SESSION_NOT_FOUND_OR_DENIED";
+    constructor(reason: "not_found" | "forbidden" | "revoked" | "caller_stale");
+}
+declare class SessionAuthorizationUnavailableError extends Error {
+    readonly code = "SESSION_AUTHORIZATION_UNAVAILABLE";
+    constructor(options?: ErrorOptions);
+}
+type ResolvedSessionAuthorization = {
+    actor: SessionAuthorizationActor;
+    target: SessionAuthorizationTarget;
+    relatedSessionAccess: "target" | "root";
+    reauthorizeAfterMs: number | null;
+};
+/**
+ * Resolve and enforce the host ACL for one session. The target and agent actor
+ * are reconstructed from workspace-scoped durable state. A request can supply
+ * an immediate target id and signed attempt claims, but can never nominate a
+ * lineage root or frozen initiator.
+ *
+ * Returns null when no host port is bound so standalone behavior stays byte-
+ * for-byte unchanged and pays no additional lineage lookup.
+ */
+declare function requireSessionAuthorization(deps: SessionAuthorizationDependencies, grant: AccessGrant, input: {
+    sessionId: string;
+    operation: SessionAuthorizationOperation;
+    surface: SessionAuthorizationSurface;
+}): Promise<ResolvedSessionAuthorization | null>;
+/** Resolve the host's complete current list scope for an in-database query. */
+declare function requireSessionAuthorizationListScope(deps: SessionAuthorizationDependencies, grant: AccessGrant, surface: SessionAuthorizationSurface): Promise<SessionAuthorizationListScope | null>;
+
 type LimitDependencies = Pick<ApiRouteDeps, "db" | "settings">;
 type LimitCheckInput = {
     accountId: string;
@@ -386,6 +441,12 @@ declare function recordWorkspaceUsage(deps: LimitDependencies, input: {
     unit: string;
     sourceResourceType: string;
     sourceResourceId: string;
+    sessionId?: string | null;
+    turnId?: string | null;
+    turnAttemptId?: string | null;
+    initiator?: TurnInitiator | null;
+    initiatorContext?: TurnInitiatorContext;
+    origin?: SessionTurnSource | null;
     idempotencyKey: string;
 }): Promise<void>;
 
@@ -554,16 +615,57 @@ declare function buildMarketingDailyAnalysisAgentConfig(input: {
     promptInstructions?: string;
 }): ScheduledTaskAgentConfig;
 
-declare function validateToolRefs(tools: ToolRef[], settings: Settings): ToolRef[];
+declare function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
 type McpSettings = Pick<Settings, "mcpServers">;
 declare function enabledCapabilityMcpToolRefs(settings: McpSettings, runtimeSettings: McpSettings): ToolRef[];
 declare function withDefaultEnabledCapabilityMcpTools(tools: ToolRef[], settings: McpSettings, runtimeSettings: McpSettings): ToolRef[];
+/** Drop stored refs that are no longer present in the current runtime registry. */
+declare function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
+/** A child or fixed-policy follow-up may narrow its allow-list, never widen it. */
+declare function assertToolRefsSubset(requested: ToolRef[], allowed: ToolRef[], message?: string): void;
+/** Validate runtime availability and then enforce the durable policy fence. */
+declare function validateToolRefsForSessionPolicy(input: {
+    requested: ToolRef[];
+    settings: McpSettings;
+    allowedTools: ToolRef[];
+    message: string;
+}): ToolRef[];
 declare function normalizeResources(resources: ResourceRef[]): ResourceRef[];
 declare function mergeResourceRefs(existing: ResourceRef[], additions: ResourceRef[]): ResourceRef[];
+declare function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]): number[];
+/** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */
 declare function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null;
 declare function validateGitHubRepositorySelection(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
 declare function validateFileResources(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
 
+type ResolvedSessionToolPolicy = {
+    toolRefs: ToolRef[];
+    effectivePolicy: SessionEffectiveToolPolicy;
+};
+type SessionToolPolicyInput = {
+    toolPolicy?: SessionToolPolicy | null;
+    sessionTools: ToolRef[];
+    turnTools?: ToolRef[];
+    /** Undefined preserves the legacy merge path for pre-provenance callers. */
+    turnToolsProvided?: boolean;
+    availableMcpServerIds: Iterable<string>;
+    /** Current omitted-tools defaults, intentionally narrower than all servers. */
+    defaultMcpServerIds?: Iterable<string>;
+};
+/**
+ * Resolve the same ID-only policy used by API projections and worker turns.
+ * This function never receives endpoint URLs, credentials, schemas, or live
+ * probe results. `availableMcpServerIds` is the resolved runtime registry;
+ * `defaultMcpServerIds` is the capability-only omitted-tools set.
+ */
+declare function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy;
+/** Current full runtime registry IDs, including configured static servers. */
+declare function workspaceSessionToolPolicyServerIds(db: Database, workspaceId: string, settings: Settings): Promise<string[]>;
+/** Current omitted-tools defaults; this preserves capability-first behavior. */
+declare function workspaceSessionToolPolicyDefaultServerIds(db: Database, workspaceId: string, settings: Settings): Promise<string[]>;
+/** Add a bounded, secret-safe effective projection to a session response. */
+declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>): Session;
+
 /**
  * Whether a raw scheduled-task payload explicitly set agentConfig.tools.
  * Zod's `.default([])` erases the distinction between "absent" and
@@ -634,19 +736,28 @@ declare function manualScheduledTaskTriggerUsageKey(workspaceId: string, taskId:
 
 declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
 declare function createAndStartSession(input: {
+    requestedSessionId?: string;
     db: Database;
     bus: EventBus;
     workflowClient: SessionWorkflowClient;
     accountId: string;
     workspaceId: string;
     initialMessage: string;
+    turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolPolicy?: SessionToolPolicy;
     clientEventId?: string;
     model: string;
     reasoningEffort: Settings["openaiReasoningEffort"];
+    turnExecutionPolicy: TurnExecutionPolicyV1;
     sandboxBackend: Settings["sandboxBackend"];
     metadata: Record<string, unknown>;
+    createdBy?: TurnInitiator;
+    createdByContext?: TurnInitiatorContext;
+    createdByActor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }> | null;
     variableSet?: {
         id: string;
         name: string;
@@ -667,131 +778,7 @@ declare function createAndStartSession(input: {
         settings: Settings;
         workingDir?: string | null;
     } | null;
-}): Promise<{
-    id: string;
-    workspaceId: string;
-    accountId: string;
-    status: "queued" | "running" | "idle" | "requires_action" | "recovering" | "waiting_capacity" | "failed" | "cancelled";
-    initialMessage: string;
-    title: string | null;
-    titleSource: "user" | "agent" | null;
-    instructions: string | null;
-    resources: ({
-        kind: "repository";
-        uri: string;
-        ref: string;
-        mountPath?: string | undefined;
-        subpath?: string | undefined;
-        provider?: "github" | "gitlab" | "azure_devops" | undefined;
-        repositoryId?: string | number | undefined;
-        installationId?: string | number | undefined;
-        projectId?: string | number | undefined;
-        connectionId?: string | undefined;
-        githubInstallationId?: number | undefined;
-        githubRepositoryId?: number | undefined;
-    } | {
-        kind: "file";
-        fileId: string;
-        mountPath?: string | undefined;
-    })[];
-    tools: {
-        kind: "mcp";
-        id: string;
-        optional?: boolean | undefined;
-    }[];
-    metadata: Record<string, unknown>;
-    model: string;
-    sandboxBackend: "docker" | "modal" | "local" | "none" | "daytona" | "runloop" | "e2b" | "blaxel" | "cloudflare" | "vercel" | "selfhosted";
-    sandboxOs: "linux" | "macos" | "windows";
-    sandboxGroupId: string;
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    variableSetId: string | null;
-    environmentId: string | null;
-    rigId: string | null;
-    rigVersionId: string | null;
-    firstPartyMcpPermissions: ("account:read" | "account:admin" | "members:manage" | "workspace:create" | "billing:read" | "billing:manage" | "workspace:read" | "workspace:admin" | "sessions:create" | "sessions:read" | "sessions:control" | "stream:view" | "stream:control" | "stream:acknowledge" | "files:upload" | "files:read" | "files:write" | "terminal:attach" | "documents:manage" | "documents:search" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "github:manage" | "github:use" | "api_keys:manage" | "connections:read" | "connections:write" | "environments:manage" | "environments:use" | "variable-sets:manage" | "variable-sets:use" | "mcp_servers:attach" | "toolspace:call" | "goals:manage" | "enrollments:read" | "enrollments:manage" | "rigs:use" | "rigs:manage")[] | null;
-    mcpServers: {
-        id: string;
-        name: string | null;
-        url: string;
-        headerNames: string[];
-        credentialVersion: number;
-    }[];
-    parentSessionId: string | null;
-    createIdempotencyKey: string | null;
-    temporalWorkflowId: string | null;
-    activeTurnId: string | null;
-    lastInputTokens: number | null;
-    queueVersion: number;
-    queueHeadPosition: number;
-    queueTailPosition: number;
-    effectiveControl: {
-        state: "active" | "paused";
-        controlVersion: number;
-        controlEtag: string;
-        directState: "active" | "paused";
-        primaryBlocker: {
-            kind: "workspace" | "session";
-            displayName: string;
-            actor: string | null;
-            reason: string | null;
-            changedAt: string | null;
-            revision: number;
-            sessionId?: string | undefined;
-        } | null;
-        additionalBlockerCount: number;
-        blockers: {
-            kind: "workspace" | "session";
-            displayName: string;
-            actor: string | null;
-            reason: string | null;
-            changedAt: string | null;
-            revision: number;
-            sessionId?: string | undefined;
-        }[];
-        resumeOptions: {
-            scope: "workspace" | "session" | "selected";
-            selectedStateAfter: "active" | "paused";
-            impactCopy: string;
-            targetId?: string | undefined;
-            remainingPrimaryBlocker?: {
-                kind: "workspace" | "session";
-                displayName: string;
-                actor: string | null;
-                reason: string | null;
-                changedAt: string | null;
-                revision: number;
-                sessionId?: string | undefined;
-            } | undefined;
-        }[];
-        override: {
-            rootSessionId: string;
-            revision: number;
-        } | null;
-        settlement: {
-            state: "stopping";
-            attemptCount: number;
-        } | null;
-    };
-    lastSequence: number;
-    codexPinnedCredentialId: string | null;
-    codexLastCredentialId: string | null;
-    pinned: boolean;
-    pinnedAt: string | null;
-    pinVersion: number;
-    createdAt: string;
-    updatedAt: string;
-    treeStats?: {
-        directChildren: number;
-        totalDescendants: number;
-        runningDescendants: number;
-        queuedDescendants: number;
-        attentionDescendants: number;
-        pausedDescendants: number;
-        failedDescendants: number;
-    } | undefined;
-}>;
+}): Promise<CreateSessionResponse>;
 declare function workflowIdForSession(sessionId: string): string;
 /**
  * Reject an explicit model that the host does not expose. The set of usable
@@ -809,6 +796,7 @@ declare function workflowIdForSession(sessionId: string): string;
  * later) and the MCP surfaces that share them validate identically and cannot
  * drift.
  */
+declare function canonicalConfiguredModel(settings: Settings, model: string | null | undefined): string | null | undefined;
 declare function assertConfiguredModel(settings: Settings, model: string | null | undefined): void;
 /**
  * Reject a model the WORKSPACE's model policy blocks, at the same choke points
@@ -840,8 +828,10 @@ declare function postUserMessageTurn(input: {
     workspaceId: string;
     sessionId: string;
     text: string;
+    turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
     clientEventId?: string;
@@ -849,8 +839,12 @@ declare function postUserMessageTurn(input: {
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     actor?: string;
+    actorLabel?: string;
+    commandActor?: SessionCommandActor;
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
+    reasoningEffortFallback?: Settings["openaiReasoningEffort"];
+    turnExecutionPolicy: TurnExecutionPolicyV1;
 }): Promise<{
     accepted: SessionEvent;
     turn: SessionTurn;
@@ -859,19 +853,23 @@ declare function postUserMessageTurn(input: {
  * Full create-session flow shared by `POST /sessions` and the first-party MCP
  * `session_create` tool: payload validation, resource/tool/variableSet
  * checks, usage limits, session start, and usage recording. `rawPayload` is
- * the unparsed request body so absent-vs-empty `tools` keeps its meaning
- * (absent applies the workspace's default capability MCP tools).
+ * the unparsed request body so absent-vs-empty execution-context fields keep
+ * their meaning: a child inherits omitted resources/tools/mcpServers from its
+ * trusted immediate parent, while explicit arrays (including []) win. A
+ * top-level create with omitted tools applies workspace-default capability MCPs.
  */
 declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown): Promise<Session>;
 /**
  * Full accept-user-message flow shared by the `user.message` branch of
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
  * tool: resource/tool validation, usage limits, the locked append + turn
- * enqueue, and usage recording. `toolsProvided: false` applies the
- * workspace's default capability MCP tools, matching an absent `tools` key.
+ * enqueue, and usage recording. `toolsProvided: false` durably preserves an
+ * absent `tools` key so execution inherits the session policy; an explicit
+ * empty array is a deliberate per-turn narrowing.
  */
 declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
     text: string;
+    turnInstructions?: string | null;
     resources?: ResourceRef[];
     tools?: ToolRef[];
     toolsProvided: boolean;
@@ -899,11 +897,24 @@ declare function acceptSessionUserMessage(deps: AcceptSessionUserMessageDependen
 declare function updateSessionTitle(deps: {
     db: Database;
     bus: EventBus;
-}, workspaceId: string, sessionId: string, title: string, source: "user" | "agent"): Promise<{
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, title: string, source: "user" | "agent"): Promise<{
     updated: boolean;
     title: string | null;
+    relatedSessionAccess: "target" | "root";
 }>;
-declare function readSessionLineage(db: Database, workspaceId: string, sessionId: string): Promise<_opengeni_db.SessionLineage>;
+/**
+ * Update one existing session MCP server's approval policy. The database
+ * serializes this write with attempt claim under the session lock: an already
+ * claimed attempt retains its immutable snapshot, while the next claim captures
+ * this value. No attempt is cancelled, restarted, or reinterpreted.
+ */
+declare function updateSessionMcpApprovalPolicy(deps: {
+    db: Database;
+    bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, serverId: string, requireApproval: SessionMcpApprovalPolicy): Promise<UpdateSessionMcpApprovalPolicyResponse>;
+declare function readSessionLineage(deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">, grant: AccessGrant, sessionId: string): Promise<_opengeni_db.SessionLineage>;
 
 /** A member can manage other members (directly or via the admin wildcard). */
 declare function memberCanAdminister(member: Pick<WorkspaceMember, "permissions">): boolean;
@@ -948,15 +959,21 @@ type HumanSessionCommandContext = {
 type AgentSessionCommandContext = {
     accountId: string;
     workspaceId: string;
+    subjectId: string;
     callerSessionId: string;
     callerTurnId: string;
     callerAttemptId: string;
     callerExecutionGeneration: number;
 };
+type SessionAuthorizationCommandDeps = {
+    db: Database;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+};
 declare function sendAgentSessionMessage(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: AgentSessionCommandContext, input: {
     targetSessionId: string;
     text: string;
@@ -966,6 +983,7 @@ declare function steerAgentSession(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: AgentSessionCommandContext, input: {
     targetSessionId: string;
     instruction: string;
@@ -975,6 +993,7 @@ declare function controlAgentSessionWorkstream(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: AgentSessionCommandContext, input: {
     targetSessionId: string;
     action: "pause" | "resume";
@@ -984,30 +1003,35 @@ declare function controlAgentSessionWorkstream(deps: {
 declare function moveHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, turnId: string, input: MoveSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
 declare function deleteHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, turnId: string, input: DeleteSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
 declare function editHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, turnId: string, input: EditSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
 declare function steerHumanQueuePrompt(deps: {
     db: Database;
     bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, turnId: string, input: SteerSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
 declare function controlHumanSessionWorkstream(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
+    sessionAuthorization?: SessionAuthorizationPort | null;
 }, context: HumanSessionCommandContext, input: SessionControlRequest): Promise<SessionControlResponse>;
 declare function controlHumanWorkspace(deps: {
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
 }, context: Omit<HumanSessionCommandContext, "sessionId">, input: WorkspaceInferenceControlRequest): Promise<WorkspaceInferenceControlResponse>;
-declare function getHumanComposerDraft(db: Database, context: HumanSessionCommandContext): Promise<ComposerDraft>;
-declare function saveHumanComposerDraft(db: Database, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
+declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
+declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
 
-export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getCapabilityPack, getHumanComposerDraft, hasPermission, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveHumanComposerDraft, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionTitle, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateMcpCapabilityConnection, validateToolRefs, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, wrapChannelABoxWithRouting };
+export { type AcceptSessionUserMessageDependencies, type AccessDeps, type AgentSessionCommandContext, type ApiRouteDeps, type ApiSandboxClient, type ApiSandboxSession, type AppDependencies, type ChannelARoutingServices, type DocumentIndexClient, type FleetContext, type FleetListResult, type FleetLiveness, type FleetSandboxEntry, type FleetServices, type FleetSwapResult, type HumanSessionCommandContext, type LimitCheckInput, type LimitDependencies, MARKETING_SOCIAL_PACK_ID, MAX_CHECKS_PER_RIG, MAX_CREDENTIAL_HOOKS_PER_RIG, MAX_DEFAULT_VARIABLE_SETS_PER_RIG, MAX_ENVIRONMENTS_PER_WORKSPACE, MAX_RIGS_PER_WORKSPACE, MAX_VARIABLES_PER_ENVIRONMENT, type ManagedAuth, type McpCapabilityProbe, type McpCapabilityProbeInput, type McpCapabilityProbeResult, type ObjectStorageDependency, type ProvisionResult, type ResolvedSessionAuthorization, type ResolvedSessionToolPolicy, type ResumeBoxByIdInput, type ResumedSandboxSession, type RigServices, type RigVerificationClassification, type RunOnOp, type RunOnResult, SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS, SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID, SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE, SessionAuthorizationDeniedError, type SessionAuthorizationDependencies, SessionAuthorizationUnavailableError, type SessionToolPolicyInput, type SessionWorkflowClient, acceptSessionUserMessage, activateRigVersionForApi, appendRigSetupCommand, applyCapabilityEnablement, assertAllowedEnvironmentVariableName, assertAllowedVariableSetVariableName, assertConfiguredModel, assertPackSandboxImageCompatible, assertToolRefsSubset, assertWorkspaceDeletable, assertWorkspaceMemberRemovable, assertWorkspaceModelPolicyAllows, availableToolRefs, buildCapabilityCatalog, buildFleetContextForSession, buildMarketingDailyAnalysisAgentConfig, canonicalConfiguredModel, checkLimit, classifyRigVerificationOutcome, controlAgentSessionWorkstream, controlHumanSessionWorkstream, controlHumanWorkspace, createAndStartSession, createCatalogItem, createRigForApi, createRigVersionForApi, createSessionForRequest, createValidatedScheduledTask, deleteHumanQueuePrompt, deleteRigForApi, disableCapability, discoverMcpRegistryCapabilities, editHumanQueuePrompt, enableCapability, enabledCapabilityMcpToolRefs, getCapabilityPack, getHumanComposerDraft, hasPermission, isBuiltInCapabilityPack, isUserMember, listCapabilityPacks, listFleet, listRigChangesForApi, listRigVersionsForApi, listWorkspaceCapabilityPacks, manualScheduledTaskTriggerUsageKey, manualScheduledTaskTriggerWorkflowId, memberCanAdminister, mergeResourceRefs, moveHumanQueuePrompt, normalizeResources, officialMcpRegistryUrl, postUserMessageTurn, promoteSetupAppendChange, promoteVerifiedDefinitionEditChangeForApi, proposeRigChangeForApi, provisionSandbox, readSessionLineage, reasoningEffortForSession, recordRigAuditEvent, recordVariableSetAuditEvent, recordWorkspaceUsage, relayConfigFromSettings, relayDialBaseFromSettings, requireAccessContext, requireAccessGrant, requireEnvironmentEncryption, requireLimit, requirePermission, requireQueuedTurnForApi, requireRigChangeForApi, requireRigForApi, requireScheduledTaskForApi, requireSessionAuthorization, requireSessionAuthorizationListScope, requireVariableSetEncryption, requireVariableSetForApi, resolveCapabilityPack, resolveMemberSubjectId, resolveSessionToolPolicy, restoreScheduledTask, rigActorForGrant, routingEnabled, runOnSandbox, saveHumanComposerDraft, scheduledTaskTemporalScheduleId, scheduledTaskToolsProvided, scheduledTaskTriggerToken, sendAgentSessionMessage, sessionWithEffectiveToolPolicy, settingsWithEnabledCapabilityMcpServers, settingsWithMcpCapabilityServers, settingsWithSessionMcpServerMetadata, steerAgentSession, steerHumanQueuePrompt, swapActiveSandbox, syncCreatedScheduledTask, syncUpdatedScheduledTask, updateRigForApi, updateSessionMcpApprovalPolicy, updateSessionTitle, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateMcpCapabilityConnection, validateToolRefs, validateToolRefsForSessionPolicy, validateVariableSetAttachment, validatedScheduledTaskUpdate, withDefaultEnabledCapabilityMcpTools, workflowIdForSession, workspaceSessionToolPolicyDefaultServerIds, workspaceSessionToolPolicyServerIds, wrapChannelABoxWithRouting };