@opengeni/core 1.4.4 → 1.4.5-canary.37458084490001

package/dist/access/index.d.ts

@@ -196,6 +196,21 @@ export declare function requireAccessGrantAuthorization(c: Context, deps: Access
  * Only use this boundary for workspace configuration, not access management.
  */
 export declare function requireWorkspaceSettingsGrant(c: Context, deps: AccessDeps, workspaceId: string): Promise<AccessGrant>;
+/**
+ * Authority for a shared workspace's own Members surface (list, candidates,
+ * add, change, remove). A holder of the requested workspace permission keeps
+ * the ordinary grant. Otherwise an active organization owner or administrator,
+ * authenticated by the canonical managed cookie, manages any shared workspace
+ * in their organization exactly as through the organization control plane,
+ * with or without an operational membership row there. Every other principal
+ * (API keys, delegated bearers, agents, services, local/configured access)
+ * and every Personal workspace keeps the original refusal. The database
+ * functions re-derive the organization role under the organization fence.
+ */
+export declare function requireWorkspaceMemberManagementAuthority(c: Context, deps: AccessDeps, workspaceId: string, permission: "members:manage" | "workspace:read"): Promise<{
+    grant: AccessGrant;
+    organizationAdministrator: boolean;
+}>;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 /**
  * Require a permission to be present literally on the grant. This deliberately

package/dist/canonical-human-identities.js

@@ -3,7 +3,7 @@ import {
   getManagedAuthRequestActorLeaseStamp,
   getManagedSession,
   markManagedAuthRequestActorTransitionApplied
-} from "./chunk-672TAJCH.js";
+} from "./chunk-TTWTXQB2.js";
 import "./chunk-QO5GVFFO.js";
 
 // src/canonical-human-identities.ts

package/dist/{chunk-672TAJCH.js → chunk-TTWTXQB2.js}

@@ -8,6 +8,7 @@ import {
 
 // src/managed-session.ts
 import { AsyncLocalStorage } from "async_hooks";
+import { createHmac } from "crypto";
 import { managedUserEmailAllowed } from "@opengeni/config";
 import {
   DatabaseUnavailableError,
@@ -82,6 +83,33 @@ async function getManagedSession(...args) {
   assertManagedUserAdmission(args[1], session?.user);
   return session;
 }
+var NATIVE_APP_CREDENTIAL_PREFIX = "ogapp_";
+async function getNativeAppManagedSession(auth, credential, db) {
+  if (!credential.startsWith(NATIVE_APP_CREDENTIAL_PREFIX)) return null;
+  const token = credential.slice(NATIVE_APP_CREDENTIAL_PREFIX.length);
+  if (!/^[A-Za-z0-9]{16,128}$/u.test(token)) return null;
+  const context = await auth.$context;
+  const signed = encodeURIComponent(
+    `${token}.${createHmac("sha256", context.secret).update(token, "utf8").digest("base64")}`
+  );
+  const session = await withManagedAuthSessionLookup(
+    () => auth.api.getSession({
+      headers: new Headers({ cookie: `${context.authCookies.sessionToken.name}=${signed}` }),
+      // Never serve a cached cookie snapshot: the app's session row is authoritative.
+      query: { disableCookieCache: true }
+    })
+  );
+  if (!session?.user) return null;
+  assertManagedUserAdmission(auth, session.user);
+  if (!db) return session;
+  const authSessionId = session.session?.id;
+  if (typeof authSessionId !== "string") return null;
+  const valid = await validateCanonicalHumanSession(db, {
+    authSessionId,
+    authUserId: session.user.id
+  });
+  return valid ? session : null;
+}
 function assertManagedUserAdmission(auth, user) {
   const emails = managedUserAllowlists.get(auth);
   if (user && emails !== void 0 && (!user.emailVerified || !managedUserEmailAllowed(emails, user.email)))
@@ -414,6 +442,8 @@ export {
   withManagedAuthSessionLookup,
   configureManagedUserAdmission,
   getManagedSession,
+  NATIVE_APP_CREDENTIAL_PREFIX,
+  getNativeAppManagedSession,
   assertManagedUserAdmission,
   getManagedAuthRequestActorEpoch,
   releaseManagedAuthRequestActorLease,
@@ -424,4 +454,4 @@ export {
   getManagedAuthRequestActorAdmissionStamp,
   getManagedAuthRequestActorLeaseStamp
 };
-//# sourceMappingURL=chunk-672TAJCH.js.map
+//# sourceMappingURL=chunk-TTWTXQB2.js.map

package/dist/chunk-TTWTXQB2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-session.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createHmac } from \"node:crypto\";\nimport { managedUserEmailAllowed } from \"@opengeni/config\";\nimport type { Context } from \"hono\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport {\n  DatabaseUnavailableError,\n  isDatabaseConnectionLoss,\n  isRetryableDatabaseTransportFailure,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  acquireManagedAuthActorMutationLease,\n  getManagedAuthAdoptedSessionSnapshot,\n  getManagedAuthSessionSetSnapshot,\n  ManagedAuthSessionSetAuthorityError,\n  ManagedAuthSessionSetGenerationConflictError,\n  releaseManagedAuthActorMutationLease,\n  validateManagedAuthActorMutationLease,\n} from \"@opengeni/db/managed-auth-session-sets\";\nimport { validateCanonicalHumanSession } from \"@opengeni/db/canonical-human-identities\";\nimport type { ManagedAuthSessionSetMode } from \"@opengeni/contracts/managed-auth-session-sets\";\nimport { HTTPException } from \"hono/http-exception\";\nimport {\n  MANAGED_AUTH_ACTOR_EPOCH_HEADER,\n  MANAGED_AUTH_SESSION_SET_COOKIE,\n  ManagedAuthActorChangeError,\n  managedAuthSha256,\n  resolveManagedAuthSelectedSession,\n  type ManagedAuthSessionAdapter,\n} from \"./managed-auth-session-sets\";\n\n/**\n * Better Auth's session endpoint replaces every non-API failure with a generic\n * INTERNAL_SERVER_ERROR and passes the original only to its logger. A lookup run\n * through `withManagedAuthSessionLookup` collects what the logger saw, so a lost\n * database connection is reported as a retryable outage instead of an opaque 500.\n */\nconst managedAuthLookupFailures = new AsyncLocalStorage<{ errors: unknown[] }>();\nconst MANAGED_AUTH_LOOKUP_FAILURE_LIMIT = 8;\n\n/** Better Auth `logger.log` sink; a no-op outside a managed-auth session lookup. */\nexport function recordManagedAuthLoggedFailure(args: readonly unknown[]): void {\n  const store = managedAuthLookupFailures.getStore();\n  if (!store) return;\n  for (const value of args) {\n    if (store.errors.length >= MANAGED_AUTH_LOOKUP_FAILURE_LIMIT) return;\n    if (value && typeof value === \"object\") store.errors.push(value);\n  }\n}\n\nfunction isBetterAuthInternalServerError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const candidate = error as { status?: unknown; statusCode?: unknown };\n  return candidate.status === \"INTERNAL_SERVER_ERROR\" || candidate.statusCode === 500;\n}\n\nexport async function withManagedAuthSessionLookup<T>(lookup: () => Promise<T>): Promise<T> {\n  const store = { errors: [] as unknown[] };\n  try {\n    return await managedAuthLookupFailures.run(store, lookup);\n  } catch (error) {\n    // Better Auth's session endpoint only reads its database adapter, so a\n    // socket failure it logged is that adapter's connection, not another service.\n    if (\n      isBetterAuthInternalServerError(error) &&\n      store.errors.some(\n        (logged) => isDatabaseConnectionLoss(logged) || isRetryableDatabaseTransportFailure(logged),\n      )\n    ) {\n      throw new DatabaseUnavailableError(\"managed auth session store unavailable\", {\n        cause: error,\n      });\n    }\n    throw error;\n  }\n}\n\nconst ACTOR_MUTATION_LEASE_SECONDS = 15 * 60;\nconst ACTOR_MUTATION_LEASE_REFRESH_MS = 5 * 60 * 1_000;\nconst ACTOR_MUTATION_HANDLER_DEADLINE_MS = 10 * 60 * 1_000;\nconst ACTOR_MUTATION_FATAL_SAFETY_MS = 5_000;\ntype ActorMutationLeaseRuntime = {\n  monotonicNow: () => number;\n  schedule: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;\n  cancel: (timer: ReturnType<typeof setTimeout>) => void;\n  terminate: () => void;\n};\nconst productionActorMutationLeaseRuntime: ActorMutationLeaseRuntime = {\n  monotonicNow: () => performance.now(),\n  schedule: (callback, delayMs) => unrefTimer(setTimeout(callback, delayMs)),\n  cancel: (timer) => clearTimeout(timer),\n  terminate: () => {\n    process.stderr.write(\"fatal: managed actor mutation outlived its durable lease\\n\");\n    process.exit(1);\n  },\n};\nlet actorMutationLeaseRuntime = productionActorMutationLeaseRuntime;\ntype ActorMutationLease = {\n  db: Database;\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n  refreshTimer: ReturnType<typeof setTimeout> | null;\n  deadlineTimer: ReturnType<typeof setTimeout> | null;\n  fatalTimer: ReturnType<typeof setTimeout> | null;\n  expiresAt: Date;\n  localFatalDeadlineMonotonicMs: number;\n  runtime: ActorMutationLeaseRuntime;\n  abortController: AbortController;\n  poisoned: unknown | null;\n  actorTransitionApplied: boolean;\n};\nconst actorMutationLeaseByRequest = new WeakMap<Request, ActorMutationLease>();\nconst managedActorEpochByRequest = new WeakMap<Request, string>();\nconst managedActorAdmissionByRequest = new WeakMap<Request, ManagedAuthActorAdmissionStamp>();\n\n/**\n * Read a Better Auth session without bypassing its sliding-cookie renewal.\n *\n * Better Auth can refresh the durable session while resolving `getSession`.\n * Programmatic callers must explicitly request and forward the returned cookie\n * headers; the HTTP handler does this automatically, but direct API calls do not.\n */\nconst managedUserAllowlists = new WeakMap<ManagedAuth, readonly string[]>();\n\n/** Bind admission to this auth instance, including all session-set modes. */\nexport function configureManagedUserAdmission(\n  auth: ManagedAuth,\n  emails: readonly string[] | undefined,\n): void {\n  if (emails === undefined) managedUserAllowlists.delete(auth);\n  else managedUserAllowlists.set(auth, [...emails]);\n}\n\nexport async function getManagedSession(...args: Parameters<typeof resolveManagedSession>) {\n  const session = await resolveManagedSession(...args);\n  assertManagedUserAdmission(args[1], session?.user);\n  return session;\n}\n\n/**\n * Bearer prefix of a native app credential. The credential is a dedicated\n * Better Auth session the person approved from a signed-in browser (see the\n * native app sign-in route); the prefix only routes it to this resolver.\n */\nexport const NATIVE_APP_CREDENTIAL_PREFIX = \"ogapp_\";\n\n/**\n * Resolve a native app credential exactly as the legacy managed cookie path\n * resolves a browser session: Better Auth validates expiry and renews the\n * durable session, then the canonical human session must still be valid. A\n * native credential never reads or selects a browser session set; each app\n * account holds its own independently revocable session.\n */\nexport async function getNativeAppManagedSession(\n  auth: ManagedAuth,\n  credential: string,\n  db: Database | undefined,\n) {\n  if (!credential.startsWith(NATIVE_APP_CREDENTIAL_PREFIX)) return null;\n  const token = credential.slice(NATIVE_APP_CREDENTIAL_PREFIX.length);\n  if (!/^[A-Za-z0-9]{16,128}$/u.test(token)) return null;\n  const context = await auth.$context;\n  const signed = encodeURIComponent(\n    `${token}.${createHmac(\"sha256\", context.secret).update(token, \"utf8\").digest(\"base64\")}`,\n  );\n  const session = await withManagedAuthSessionLookup(() =>\n    auth.api.getSession({\n      headers: new Headers({ cookie: `${context.authCookies.sessionToken.name}=${signed}` }),\n      // Never serve a cached cookie snapshot: the app's session row is authoritative.\n      query: { disableCookieCache: true },\n    }),\n  );\n  if (!session?.user) return null;\n  assertManagedUserAdmission(auth, session.user);\n  if (!db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(db, {\n    authSessionId,\n    authUserId: session.user.id,\n  });\n  return valid ? session : null;\n}\n\nexport function assertManagedUserAdmission(\n  auth: ManagedAuth,\n  user: { email: string; emailVerified: boolean } | null | undefined,\n): void {\n  const emails = managedUserAllowlists.get(auth);\n  if (\n    user &&\n    emails !== undefined &&\n    (!user.emailVerified || !managedUserEmailAllowed(emails, user.email))\n  )\n    throw new HTTPException(403, { message: \"Account is not permitted on this deployment\" });\n}\n\nasync function resolveManagedSession(\n  c: Context,\n  auth: ManagedAuth,\n  options?: {\n    db?: Database | undefined;\n    allowIdentityRecovery?: boolean | undefined;\n    sessionSetMode?: ManagedAuthSessionSetMode | undefined;\n    sessionAdapter?: ManagedAuthSessionAdapter | null | undefined;\n  },\n) {\n  const sessionSetMode = options?.sessionSetMode ?? \"legacy\";\n  if (sessionSetMode !== \"legacy\" && options?.db && options.sessionAdapter) {\n    const authority = requestCookie(c.req.raw, MANAGED_AUTH_SESSION_SET_COOKIE);\n    if (authority) {\n      try {\n        // A long-lived response reuses this exact Request for periodic\n        // authorization. Once admitted, the server-owned stamp is the actor\n        // fence: a client may omit the header on its initial GET, but a later\n        // reauthorization must not follow a newly selected actor.\n        const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n        const expectedActorEpoch =\n          admittedActorEpoch ?? c.req.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER) ?? null;\n        const legacyAmbient =\n          sessionSetMode === \"dual\" && expectedActorEpoch === null\n            ? await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers)\n            : null;\n        const selected = await resolveManagedAuthSelectedSession({\n          db: options.db,\n          adapter: options.sessionAdapter,\n          authority,\n          mode: sessionSetMode,\n          expectedActorEpoch,\n          legacyAmbientSessionId:\n            typeof legacyAmbient?.session?.id === \"string\" ? legacyAmbient.session.id : null,\n          allowRecovery: options.allowIdentityRecovery ?? false,\n        });\n        if (selected) {\n          // The actor epoch is both an admission fence and response provenance.\n          // A browser must ignore a late finite response after another tab has\n          // advanced selection, even when the request itself was read-only.\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, selected.projection.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, selected.projection.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: managedAuthSha256(authority),\n            actorEpoch: selected.projection.actorEpoch,\n          });\n        }\n        if (selected && !selected.session) return null;\n        if (selected?.session) {\n          let resolvedSession = selected.session;\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLease(\n              c.req.raw,\n              options.db,\n              authority,\n              selected.projection.actorEpoch,\n            );\n            const selectedSlot = await selectedSlotForAuthority(\n              options.db,\n              authority,\n              sessionSetMode,\n              options.allowIdentityRecovery ?? false,\n            );\n            if (!selectedSlot) throw new ManagedAuthActorChangeError();\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(selectedSlot);\n            if (\n              !refreshed ||\n              refreshed.session.id !== selectedSlot.authSessionId ||\n              refreshed.user.id !== selectedSlot.authUserId\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            resolvedSession = refreshed;\n          }\n          return resolvedSession;\n        }\n        // Once a browser presents a session-set authority it is authoritative.\n        // An absent/expired/rekeyed authority must never fall through to an\n        // ambient Better Auth cookie in dual mode: that would bypass the actor\n        // epoch and mutation-lease fences after another tab transitions.\n        return null;\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          // Response headers are immutable after an SSE body starts. The\n          // original response already carries its actor epoch; reauthorization\n          // closes that stream through the thrown conflict instead.\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n    }\n    if (sessionSetMode === \"broker\") return null;\n    const ambient = await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers);\n    if (ambient?.session?.id)\n      try {\n        const adopted = await getManagedAuthAdoptedSessionSnapshot(options.db, ambient.session.id);\n        if (adopted) {\n          const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n          if (\n            adopted.actorEpoch !== \"1\" ||\n            (admittedActorEpoch !== null && adopted.actorEpoch !== admittedActorEpoch) ||\n            !adopted.selected ||\n            adopted.selected.authSessionId !== ambient.session.id ||\n            adopted.selected.authUserId !== ambient.user.id\n          ) {\n            throw new ManagedAuthActorChangeError();\n          }\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, adopted.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, adopted.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: adopted.authorityHash,\n            actorEpoch: adopted.actorEpoch,\n          });\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLeaseForHash(\n              c.req.raw,\n              options.db,\n              adopted.authorityHash,\n              adopted.actorEpoch,\n            );\n            const current = await getManagedAuthAdoptedSessionSnapshot(\n              options.db,\n              ambient.session.id,\n            );\n            if (\n              current?.authorityHash !== adopted.authorityHash ||\n              current.actorEpoch !== adopted.actorEpoch ||\n              !current.selected ||\n              current.selected.authSessionId !== ambient.session.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(current.selected);\n            if (\n              !refreshed ||\n              refreshed.session.id !== ambient.session.id ||\n              refreshed.user.id !== ambient.user.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            return refreshed;\n          }\n          return ambient;\n        }\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n  }\n  const result = await withManagedAuthSessionLookup(() =>\n    auth.api.getSession({\n      headers: c.req.raw.headers,\n      returnHeaders: true,\n    }),\n  );\n\n  for (const cookie of setCookieHeaders(result.headers)) {\n    c.header(\"set-cookie\", cookie, { append: true });\n  }\n\n  const session = result.response;\n  if (!session?.user || !options?.db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(options.db, {\n    authSessionId,\n    authUserId: session.user.id,\n    ...(options.allowIdentityRecovery === undefined\n      ? {}\n      : { allowRecovery: options.allowIdentityRecovery }),\n  });\n  return valid ? session : null;\n}\n\n/** Safe response provenance for a request authenticated through session-set authority. */\nexport function getManagedAuthRequestActorEpoch(request: Request): string | null {\n  return managedActorEpochByRequest.get(request) ?? null;\n}\n\nfunction selectedSlotForAuthority(\n  db: Database,\n  authority: string,\n  mode: ManagedAuthSessionSetMode,\n  allowRecovery: boolean,\n) {\n  return getManagedAuthSessionSetSnapshot(db, {\n    authorityHash: managedAuthSha256(authority),\n    mode,\n    includeInternal: true,\n    allowRecovery,\n    readOnly: true,\n  }).then((snapshot) => snapshot?.selected ?? null);\n}\n\n/** Release the multi-replica actor fence after the outer HTTP handler settles. */\nexport async function releaseManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  actorMutationLeaseByRequest.delete(request);\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  if (lease.deadlineTimer) lease.runtime.cancel(lease.deadlineTimer);\n  if (lease.fatalTimer) lease.runtime.cancel(lease.fatalTimer);\n  await releaseManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    requestId: lease.requestId,\n  });\n}\n\n/** Cooperative cancellation signal for actor-scoped provider/external I/O. */\nexport function getManagedAuthRequestActorAbortSignal(request: Request): AbortSignal | null {\n  return actorMutationLeaseByRequest.get(request)?.abortController.signal ?? null;\n}\n\n/** @internal Deterministic lease-clock seam used only by direct lifecycle tests. */\nexport function installManagedAuthActorLeaseRuntimeForTest(\n  overrides: Partial<ActorMutationLeaseRuntime>,\n): () => void {\n  const previous = actorMutationLeaseRuntime;\n  actorMutationLeaseRuntime = {\n    ...productionActorMutationLeaseRuntime,\n    ...overrides,\n  };\n  return () => {\n    actorMutationLeaseRuntime = previous;\n  };\n}\n\n/**\n * Exact post-handler fence. A finite unsafe response is not released unless\n * its request-owned lease is still live at the same actor epoch.\n */\nexport async function validateManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  if (lease.actorTransitionApplied) return;\n  if (lease.poisoned !== null) {\n    throw new ManagedAuthActorLeaseOutcomeUnknownError({\n      cause: lease.poisoned,\n    });\n  }\n  const valid = await validateManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    actorEpoch: lease.actorEpoch,\n    requestId: lease.requestId,\n  });\n  if (!valid) throw new ManagedAuthActorChangeError();\n}\n\nexport class ManagedAuthActorLeaseOutcomeUnknownError extends Error {\n  readonly name = \"ManagedAuthActorLeaseOutcomeUnknownError\";\n  readonly code = \"operation_outcome_unknown\";\n  constructor(options?: ErrorOptions) {\n    super(\"The actor-scoped request outcome is unknown after its durable lease was lost\", options);\n  }\n}\n\n/** A known-applied same-request canonical transition intentionally consumes its lease. */\nexport function markManagedAuthRequestActorTransitionApplied(request: Request): void {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (lease) lease.actorTransitionApplied = true;\n}\n\nexport type ManagedAuthActorMutationLeaseStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n};\n\nexport type ManagedAuthActorAdmissionStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n};\n\n/** Verified server-owned actor evidence available to both reads and mutations. */\nexport function getManagedAuthRequestActorAdmissionStamp(\n  request: Request,\n): ManagedAuthActorAdmissionStamp | null {\n  return managedActorAdmissionByRequest.get(request) ?? null;\n}\n\n/** Exact request-owned fence passed into a same-transaction actor transition. */\nexport function getManagedAuthRequestActorLeaseStamp(\n  request: Request,\n): ManagedAuthActorMutationLeaseStamp | null {\n  const lease = actorMutationLeaseByRequest.get(request);\n  return lease\n    ? {\n        authorityHash: lease.authorityHash,\n        actorEpoch: lease.actorEpoch,\n        requestId: lease.requestId,\n      }\n    : null;\n}\n\nfunction requestNeedsActorMutationLease(method: string): boolean {\n  return method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nasync function ensureActorMutationLease(\n  request: Request,\n  db: Database,\n  authority: string,\n  actorEpoch: string,\n): Promise<void> {\n  const authorityHash = managedAuthSha256(authority);\n  await ensureActorMutationLeaseForHash(request, db, authorityHash, actorEpoch);\n}\n\nasync function ensureActorMutationLeaseForHash(\n  request: Request,\n  db: Database,\n  authorityHash: string,\n  actorEpoch: string,\n): Promise<void> {\n  const existing = actorMutationLeaseByRequest.get(request);\n  if (existing) {\n    if (existing.authorityHash !== authorityHash || existing.actorEpoch !== actorEpoch) {\n      throw new ManagedAuthActorChangeError();\n    }\n    return;\n  }\n  const lease: ActorMutationLease = {\n    db,\n    authorityHash,\n    actorEpoch,\n    requestId: crypto.randomUUID(),\n    refreshTimer: null,\n    deadlineTimer: null,\n    fatalTimer: null,\n    expiresAt: new Date(0),\n    localFatalDeadlineMonotonicMs: 0,\n    runtime: actorMutationLeaseRuntime,\n    abortController: new AbortController(),\n    poisoned: null,\n    actorTransitionApplied: false,\n  };\n  const acquireStartedAtMonotonicMs = lease.runtime.monotonicNow();\n  try {\n    lease.expiresAt = await acquireManagedAuthActorMutationLease(db, {\n      authorityHash,\n      actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    });\n  } catch (error) {\n    if (\n      error instanceof ManagedAuthSessionSetGenerationConflictError ||\n      error instanceof ManagedAuthSessionSetAuthorityError\n    ) {\n      throw new ManagedAuthActorChangeError();\n    }\n    throw error;\n  }\n  lease.localFatalDeadlineMonotonicMs =\n    acquireStartedAtMonotonicMs +\n    ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n    ACTOR_MUTATION_FATAL_SAFETY_MS;\n  actorMutationLeaseByRequest.set(request, lease);\n  scheduleActorMutationLeaseRefresh(request, lease);\n  lease.deadlineTimer = lease.runtime.schedule(() => {\n    poisonActorMutationLease(\n      request,\n      lease,\n      new Error(\"managed actor mutation handler exceeded its bounded lifetime\"),\n    );\n  }, ACTOR_MUTATION_HANDLER_DEADLINE_MS);\n}\n\nfunction scheduleActorMutationLeaseRefresh(request: Request, lease: ActorMutationLease): void {\n  const timer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    const refreshStartedAtMonotonicMs = lease.runtime.monotonicNow();\n    void acquireManagedAuthActorMutationLease(lease.db, {\n      authorityHash: lease.authorityHash,\n      actorEpoch: lease.actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    })\n      .then(async (expiresAt) => {\n        if (actorMutationLeaseByRequest.get(request) !== lease) {\n          // Release may have won while this pooled acquire statement was in\n          // flight. Converge the just-renewed row immediately; never resurrect\n          // a request-owned fence after the outer handler has settled.\n          await releaseManagedAuthActorMutationLease(lease.db, {\n            authorityHash: lease.authorityHash,\n            requestId: lease.requestId,\n          });\n          return;\n        }\n        lease.expiresAt = expiresAt;\n        lease.localFatalDeadlineMonotonicMs =\n          refreshStartedAtMonotonicMs +\n          ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n          ACTOR_MUTATION_FATAL_SAFETY_MS;\n        scheduleActorMutationLeaseRefresh(request, lease);\n      })\n      .catch((error) => poisonActorMutationLease(request, lease, error));\n  }, ACTOR_MUTATION_LEASE_REFRESH_MS);\n  lease.refreshTimer = timer;\n}\n\nfunction poisonActorMutationLease(\n  request: Request,\n  lease: ActorMutationLease,\n  error: unknown,\n): void {\n  if (actorMutationLeaseByRequest.get(request) !== lease || lease.poisoned !== null) return;\n  lease.poisoned = error;\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  lease.refreshTimer = null;\n  lease.abortController.abort(error);\n  const fatalAfterMs = Math.max(\n    0,\n    lease.localFatalDeadlineMonotonicMs - lease.runtime.monotonicNow(),\n  );\n  lease.fatalTimer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    // A handler that ignored cooperative cancellation must not outlive the\n    // durable fence and resume under a later actor. Terminate this API\n    // instance before PostgreSQL can expire the lease; process death is the\n    // final multi-replica-safe cancellation boundary.\n    lease.runtime.terminate();\n  }, fatalAfterMs);\n}\n\nfunction unrefTimer<T extends ReturnType<typeof setTimeout>>(timer: T): T {\n  (timer as T & { unref?: () => void }).unref?.();\n  return timer;\n}\n\nfunction requestCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\");\n    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;\n    const value = part.slice(separator + 1).trim();\n    if (!value || value.length > 512) return null;\n    try {\n      return decodeURIComponent(value);\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\nfunction setCookieHeaders(headers: Headers): string[] {\n  const getSetCookie = (\n    headers as Headers & {\n      getSetCookie?: () => string[];\n    }\n  ).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  const cookie = headers.get(\"set-cookie\");\n  return cookie ? [cookie] : [];\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAC3B,SAAS,+BAA+B;AAGxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C,SAAS,qBAAqB;AAgB9B,IAAM,4BAA4B,IAAI,kBAAyC;AAC/E,IAAM,oCAAoC;AAGnC,SAAS,+BAA+B,MAAgC;AAC7E,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,MAAO;AACZ,aAAW,SAAS,MAAM;AACxB,QAAI,MAAM,OAAO,UAAU,kCAAmC;AAC9D,QAAI,SAAS,OAAO,UAAU,SAAU,OAAM,OAAO,KAAK,KAAK;AAAA,EACjE;AACF;AAEA,SAAS,gCAAgC,OAAyB;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAClB,SAAO,UAAU,WAAW,2BAA2B,UAAU,eAAe;AAClF;AAEA,eAAsB,6BAAgC,QAAsC;AAC1F,QAAM,QAAQ,EAAE,QAAQ,CAAC,EAAe;AACxC,MAAI;AACF,WAAO,MAAM,0BAA0B,IAAI,OAAO,MAAM;AAAA,EAC1D,SAAS,OAAO;AAGd,QACE,gCAAgC,KAAK,KACrC,MAAM,OAAO;AAAA,MACX,CAAC,WAAW,yBAAyB,MAAM,KAAK,oCAAoC,MAAM;AAAA,IAC5F,GACA;AACA,YAAM,IAAI,yBAAyB,0CAA0C;AAAA,QAC3E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,IAAM,+BAA+B,KAAK;AAC1C,IAAM,kCAAkC,IAAI,KAAK;AACjD,IAAM,qCAAqC,KAAK,KAAK;AACrD,IAAM,iCAAiC;AAOvC,IAAM,sCAAiE;AAAA,EACrE,cAAc,MAAM,YAAY,IAAI;AAAA,EACpC,UAAU,CAAC,UAAU,YAAY,WAAW,WAAW,UAAU,OAAO,CAAC;AAAA,EACzE,QAAQ,CAAC,UAAU,aAAa,KAAK;AAAA,EACrC,WAAW,MAAM;AACf,YAAQ,OAAO,MAAM,4DAA4D;AACjF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AACA,IAAI,4BAA4B;AAgBhC,IAAM,8BAA8B,oBAAI,QAAqC;AAC7E,IAAM,6BAA6B,oBAAI,QAAyB;AAChE,IAAM,iCAAiC,oBAAI,QAAiD;AAS5F,IAAM,wBAAwB,oBAAI,QAAwC;AAGnE,SAAS,8BACd,MACA,QACM;AACN,MAAI,WAAW,OAAW,uBAAsB,OAAO,IAAI;AAAA,MACtD,uBAAsB,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC;AAClD;AAEA,eAAsB,qBAAqB,MAAgD;AACzF,QAAM,UAAU,MAAM,sBAAsB,GAAG,IAAI;AACnD,6BAA2B,KAAK,CAAC,GAAG,SAAS,IAAI;AACjD,SAAO;AACT;AAOO,IAAM,+BAA+B;AAS5C,eAAsB,2BACpB,MACA,YACA,IACA;AACA,MAAI,CAAC,WAAW,WAAW,4BAA4B,EAAG,QAAO;AACjE,QAAM,QAAQ,WAAW,MAAM,6BAA6B,MAAM;AAClE,MAAI,CAAC,yBAAyB,KAAK,KAAK,EAAG,QAAO;AAClD,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,SAAS;AAAA,IACb,GAAG,KAAK,IAAI,WAAW,UAAU,QAAQ,MAAM,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,QAAQ,CAAC;AAAA,EACzF;AACA,QAAM,UAAU,MAAM;AAAA,IAA6B,MACjD,KAAK,IAAI,WAAW;AAAA,MAClB,SAAS,IAAI,QAAQ,EAAE,QAAQ,GAAG,QAAQ,YAAY,aAAa,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA;AAAA,MAErF,OAAO,EAAE,oBAAoB,KAAK;AAAA,IACpC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,6BAA2B,MAAM,QAAQ,IAAI;AAC7C,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,IAAI;AAAA,IACpD;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,EAC3B,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAEO,SAAS,2BACd,MACA,MACM;AACN,QAAM,SAAS,sBAAsB,IAAI,IAAI;AAC7C,MACE,QACA,WAAW,WACV,CAAC,KAAK,iBAAiB,CAAC,wBAAwB,QAAQ,KAAK,KAAK;AAEnE,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8CAA8C,CAAC;AAC3F;AAEA,eAAe,sBACb,GACA,MACA,SAMA;AACA,QAAM,iBAAiB,SAAS,kBAAkB;AAClD,MAAI,mBAAmB,YAAY,SAAS,MAAM,QAAQ,gBAAgB;AACxE,UAAM,YAAY,cAAc,EAAE,IAAI,KAAK,+BAA+B;AAC1E,QAAI,WAAW;AACb,UAAI;AAKF,cAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cAAM,qBACJ,sBAAsB,EAAE,IAAI,OAAO,+BAA+B,KAAK;AACzE,cAAM,gBACJ,mBAAmB,UAAU,uBAAuB,OAChD,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO,IACpE;AACN,cAAM,WAAW,MAAM,kCAAkC;AAAA,UACvD,IAAI,QAAQ;AAAA,UACZ,SAAS,QAAQ;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,wBACE,OAAO,eAAe,SAAS,OAAO,WAAW,cAAc,QAAQ,KAAK;AAAA,UAC9E,eAAe,QAAQ,yBAAyB;AAAA,QAClD,CAAC;AACD,YAAI,UAAU;AAIZ,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,SAAS,WAAW,UAAU;AACxE,uCAA2B,IAAI,EAAE,IAAI,KAAK,SAAS,WAAW,UAAU;AAAA,UAC1E;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,kBAAkB,SAAS;AAAA,YAC1C,YAAY,SAAS,WAAW;AAAA,UAClC,CAAC;AAAA,QACH;AACA,YAAI,YAAY,CAAC,SAAS,QAAS,QAAO;AAC1C,YAAI,UAAU,SAAS;AACrB,cAAI,kBAAkB,SAAS;AAC/B,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR;AAAA,cACA,SAAS,WAAW;AAAA,YACtB;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,QAAQ;AAAA,cACR;AAAA,cACA;AAAA,cACA,QAAQ,yBAAyB;AAAA,YACnC;AACA,gBAAI,CAAC,aAAc,OAAM,IAAI,4BAA4B;AACzD,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,YAAY;AAClF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,aAAa,iBACtC,UAAU,KAAK,OAAO,aAAa,YACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,8BAAkB;AAAA,UACpB;AACA,iBAAO;AAAA,QACT;AAKA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAIhD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,QAAI,mBAAmB,SAAU,QAAO;AACxC,UAAM,UAAU,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO;AACpF,QAAI,SAAS,SAAS;AACpB,UAAI;AACF,cAAM,UAAU,MAAM,qCAAqC,QAAQ,IAAI,QAAQ,QAAQ,EAAE;AACzF,YAAI,SAAS;AACX,gBAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cACE,QAAQ,eAAe,OACtB,uBAAuB,QAAQ,QAAQ,eAAe,sBACvD,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,MACnD,QAAQ,SAAS,eAAe,QAAQ,KAAK,IAC7C;AACA,kBAAM,IAAI,4BAA4B;AAAA,UACxC;AACA,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,QAAQ,UAAU;AAC5D,uCAA2B,IAAI,EAAE,IAAI,KAAK,QAAQ,UAAU;AAAA,UAC9D;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,QAAQ;AAAA,YACvB,YAAY,QAAQ;AAAA,UACtB,CAAC;AACD,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AACA,kBAAM,UAAU,MAAM;AAAA,cACpB,QAAQ;AAAA,cACR,QAAQ,QAAQ;AAAA,YAClB;AACA,gBACE,SAAS,kBAAkB,QAAQ,iBACnC,QAAQ,eAAe,QAAQ,cAC/B,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,IACnD;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,QAAQ,QAAQ;AACtF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,QAAQ,QAAQ,MACzC,UAAU,KAAK,OAAO,QAAQ,KAAK,IACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,mBAAO;AAAA,UACT;AACA,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAChD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,EACJ;AACA,QAAM,SAAS,MAAM;AAAA,IAA6B,MAChD,KAAK,IAAI,WAAW;AAAA,MAClB,SAAS,EAAE,IAAI,IAAI;AAAA,MACnB,eAAe;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,aAAW,UAAU,iBAAiB,OAAO,OAAO,GAAG;AACrD,MAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,GAAI,QAAO;AAC3C,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,QAAQ,IAAI;AAAA,IAC5D;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,IACzB,GAAI,QAAQ,0BAA0B,SAClC,CAAC,IACD,EAAE,eAAe,QAAQ,sBAAsB;AAAA,EACrD,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAGO,SAAS,gCAAgC,SAAiC;AAC/E,SAAO,2BAA2B,IAAI,OAAO,KAAK;AACpD;AAEA,SAAS,yBACP,IACA,WACA,MACA,eACA;AACA,SAAO,iCAAiC,IAAI;AAAA,IAC1C,eAAe,kBAAkB,SAAS;AAAA,IAC1C;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA,UAAU;AAAA,EACZ,CAAC,EAAE,KAAK,CAAC,aAAa,UAAU,YAAY,IAAI;AAClD;AAGA,eAAsB,oCAAoC,SAAiC;AACzF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,8BAA4B,OAAO,OAAO;AAC1C,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,MAAI,MAAM,cAAe,OAAM,QAAQ,OAAO,MAAM,aAAa;AACjE,MAAI,MAAM,WAAY,OAAM,QAAQ,OAAO,MAAM,UAAU;AAC3D,QAAM,qCAAqC,MAAM,IAAI;AAAA,IACnD,eAAe,MAAM;AAAA,IACrB,WAAW,MAAM;AAAA,EACnB,CAAC;AACH;AAGO,SAAS,sCAAsC,SAAsC;AAC1F,SAAO,4BAA4B,IAAI,OAAO,GAAG,gBAAgB,UAAU;AAC7E;AAoBA,eAAsB,qCAAqC,SAAiC;AAC1F,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,uBAAwB;AAClC,MAAI,MAAM,aAAa,MAAM;AAC3B,UAAM,IAAI,yCAAyC;AAAA,MACjD,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,sCAAsC,MAAM,IAAI;AAAA,IAClE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,4BAA4B;AACpD;AAEO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EACzD,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,gFAAgF,OAAO;AAAA,EAC/F;AACF;AAGO,SAAS,6CAA6C,SAAwB;AACnF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,MAAO,OAAM,yBAAyB;AAC5C;AAcO,SAAS,yCACd,SACuC;AACvC,SAAO,+BAA+B,IAAI,OAAO,KAAK;AACxD;AAGO,SAAS,qCACd,SAC2C;AAC3C,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,SAAO,QACH;AAAA,IACE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,IACA;AACN;AAEA,SAAS,+BAA+B,QAAyB;AAC/D,SAAO,WAAW,SAAS,WAAW,UAAU,WAAW;AAC7D;AAEA,eAAe,yBACb,SACA,IACA,WACA,YACe;AACf,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,QAAM,gCAAgC,SAAS,IAAI,eAAe,UAAU;AAC9E;AAEA,eAAe,gCACb,SACA,IACA,eACA,YACe;AACf,QAAM,WAAW,4BAA4B,IAAI,OAAO;AACxD,MAAI,UAAU;AACZ,QAAI,SAAS,kBAAkB,iBAAiB,SAAS,eAAe,YAAY;AAClF,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA;AAAA,EACF;AACA,QAAM,QAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,OAAO,WAAW;AAAA,IAC7B,cAAc;AAAA,IACd,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,WAAW,oBAAI,KAAK,CAAC;AAAA,IACrB,+BAA+B;AAAA,IAC/B,SAAS;AAAA,IACT,iBAAiB,IAAI,gBAAgB;AAAA,IACrC,UAAU;AAAA,IACV,wBAAwB;AAAA,EAC1B;AACA,QAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,MAAI;AACF,UAAM,YAAY,MAAM,qCAAqC,IAAI;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QACE,iBAAiB,gDACjB,iBAAiB,qCACjB;AACA,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA,UAAM;AAAA,EACR;AACA,QAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,8BAA4B,IAAI,SAAS,KAAK;AAC9C,oCAAkC,SAAS,KAAK;AAChD,QAAM,gBAAgB,MAAM,QAAQ,SAAS,MAAM;AACjD;AAAA,MACE;AAAA,MACA;AAAA,MACA,IAAI,MAAM,8DAA8D;AAAA,IAC1E;AAAA,EACF,GAAG,kCAAkC;AACvC;AAEA,SAAS,kCAAkC,SAAkB,OAAiC;AAC5F,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AACzC,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AACxD,UAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,SAAK,qCAAqC,MAAM,IAAI;AAAA,MAClD,eAAe,MAAM;AAAA,MACrB,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC,EACE,KAAK,OAAO,cAAc;AACzB,UAAI,4BAA4B,IAAI,OAAO,MAAM,OAAO;AAItD,cAAM,qCAAqC,MAAM,IAAI;AAAA,UACnD,eAAe,MAAM;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB,CAAC;AACD;AAAA,MACF;AACA,YAAM,YAAY;AAClB,YAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,wCAAkC,SAAS,KAAK;AAAA,IAClD,CAAC,EACA,MAAM,CAAC,UAAU,yBAAyB,SAAS,OAAO,KAAK,CAAC;AAAA,EACrE,GAAG,+BAA+B;AAClC,QAAM,eAAe;AACvB;AAEA,SAAS,yBACP,SACA,OACA,OACM;AACN,MAAI,4BAA4B,IAAI,OAAO,MAAM,SAAS,MAAM,aAAa,KAAM;AACnF,QAAM,WAAW;AACjB,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,QAAM,eAAe;AACrB,QAAM,gBAAgB,MAAM,KAAK;AACjC,QAAM,eAAe,KAAK;AAAA,IACxB;AAAA,IACA,MAAM,gCAAgC,MAAM,QAAQ,aAAa;AAAA,EACnE;AACA,QAAM,aAAa,MAAM,QAAQ,SAAS,MAAM;AAC9C,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AAKxD,UAAM,QAAQ,UAAU;AAAA,EAC1B,GAAG,YAAY;AACjB;AAEA,SAAS,WAAoD,OAAa;AACxE,EAAC,MAAqC,QAAQ;AAC9C,SAAO;AACT;AAEA,SAAS,cAAc,SAAkB,MAA6B;AACpE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,YAAY,KAAK,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,MAAM,KAAM;AAC/D,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,CAAC,SAAS,MAAM,SAAS,IAAK,QAAO;AACzC,QAAI;AACF,aAAO,mBAAmB,KAAK;AAAA,IACjC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA4B;AACpD,QAAM,eACJ,QAGA;AACF,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC;AAEA,QAAM,SAAS,QAAQ,IAAI,YAAY;AACvC,SAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AAC9B;","names":[]}

package/dist/domain/knowledge-messages.d.ts

@@ -1,18 +1,18 @@
 import { type Database, type KnowledgeContext } from "@opengeni/db";
 /** Retain actual message bytes, never a model-authored reconstruction of a confirmation. */
 export declare function retainKnowledgeMessage(db: Database, context: KnowledgeContext, messageId?: string): Promise<{
-    revisionId?: never;
     retained: boolean;
     reason: string;
     entryId?: never;
+    revisionId?: never;
     outcome?: never;
     messageId?: never;
     reused?: never;
 } | {
-    revisionId?: never;
     retained: boolean;
     reason: string;
     entryId: string;
+    revisionId?: never;
     outcome?: never;
     messageId?: never;
     reused?: never;

package/dist/domain/pr-review.d.ts

@@ -48,7 +48,7 @@ export declare const PR_REVIEW_AUTOMATION_SETUP: {
             eager?: boolean | undefined;
             optional?: boolean | undefined;
         }[];
-        firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+        firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
         firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
         model: string | null;
         reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
@@ -159,7 +159,7 @@ export declare const prReviewAutomationAdapter: {
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/domain/session-tool-policy.d.ts

@@ -105,8 +105,8 @@ export declare function sessionEffectiveToolProjectionInput(session: Session & {
         renderer: "markdown" | "opengeni";
         source: "deployment_default" | "inherited" | "legacy_conversion" | "request" | "workspace_default";
     };
-    firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
-    firstPartyModelNames: Map<"artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch", string>;
+    firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+    firstPartyModelNames: Map<"artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch", string>;
     mcpServerIds: string[];
     productServerIds: ReadonlySet<string>;
     environment: AgentToolEnvironment;

package/dist/goal-admission.d.ts

@@ -100,8 +100,8 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         staticEntitlementsJson: string;
         staticUsageLimitsJson: string;
         delegationSecret?: string | undefined;
-        defaultFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
-        allowedFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
+        defaultFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
+        allowedFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
         artifactMaterializerDeployed: boolean;
         streamTokenSecret?: string | undefined;
         streamControlEnabled: boolean;
@@ -222,8 +222,11 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         modelCostPolicyJson: string;
         modelNotesJson: string;
         openrouterApiKey?: string | undefined;
+        opperApiKey?: string | undefined;
+        managedModelsJson?: string | undefined;
         resolvedGatewayModelsJson?: string | undefined;
         resolvedOpenRouterModelsJson?: string | undefined;
+        resolvedOpperModelsJson?: string | undefined;
         resolvedCodexModelsJson?: string | undefined;
         modelProvidersJson: string;
         codexSubscriptionEnabled: boolean;
@@ -455,6 +458,12 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         managedAuthGithubClientSecret?: string | undefined;
         allowedUserEmails?: string[] | undefined;
         managedAuthSessionSetMode: "broker" | "dual" | "legacy";
+        nativeAppSchemes: string[];
+        nativeAppIds: string[];
+        apnsKeyId?: string | undefined;
+        apnsTeamId?: string | undefined;
+        apnsPrivateKey?: string | undefined;
+        fcmServiceAccountJson?: string | undefined;
         managedAuthNewSignupsEnabled: boolean;
         organizationUserSetupEmailTokenTransport: "fragment" | "query";
         organizationUserSetupQueryEdgeSanitizationConfirmed: boolean;

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export * from "./user-presence.js";
 export * from "./product-usage-metrics.js";
 export * from "./sandbox-types.js";
 export * from "./managed-auth-type.js";
-export { getManagedAuthRequestActorAbortSignal, getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorEpoch, getManagedAuthRequestActorLeaseStamp, getManagedSession, recordManagedAuthLoggedFailure, withManagedAuthSessionLookup, configureManagedUserAdmission, assertManagedUserAdmission, ManagedAuthActorLeaseOutcomeUnknownError, markManagedAuthRequestActorTransitionApplied, releaseManagedAuthRequestActorLease, validateManagedAuthRequestActorLease, type ManagedAuthActorAdmissionStamp, type ManagedAuthActorMutationLeaseStamp, } from "./managed-session.js";
+export { getManagedAuthRequestActorAbortSignal, getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorEpoch, getManagedAuthRequestActorLeaseStamp, getManagedSession, getNativeAppManagedSession, NATIVE_APP_CREDENTIAL_PREFIX, recordManagedAuthLoggedFailure, withManagedAuthSessionLookup, configureManagedUserAdmission, assertManagedUserAdmission, ManagedAuthActorLeaseOutcomeUnknownError, markManagedAuthRequestActorTransitionApplied, releaseManagedAuthRequestActorLease, validateManagedAuthRequestActorLease, type ManagedAuthActorAdmissionStamp, type ManagedAuthActorMutationLeaseStamp, } from "./managed-session.js";
 export * from "./transcription.js";
 export * from "./model-catalog.js";
 export * from "./goal-admission.js";