@opengeni/core 2.1.0-canary.0 → 2.4.0-canary.0

package/dist/application/session-tenancy.d.ts

@@ -1,7 +1,7 @@
 import { ForkSessionResponse, SessionTenancyCreateCapabilities, UpdateSessionVisibilityResponse, type ForkSessionRequest, type SessionAuthorizationSurface, type UpdateSessionVisibilityRequest } from "@opengeni/contracts";
 import { type AccessGrantAuthorization } from "../access/index.js";
 import type { AppDependencies } from "../dependencies.js";
-type SessionTenancyDependencies = Pick<AppDependencies, "db" | "bus" | "sessionAuthorization">;
+type SessionTenancyDependencies = Pick<AppDependencies, "db" | "bus" | "sessionAuthorization" | "settings">;
 export declare class SessionTenancyManagedHumanRequiredError extends Error {
     readonly name = "SessionTenancyManagedHumanRequiredError";
     constructor();

package/dist/dependencies.d.ts

@@ -78,6 +78,39 @@ export type DocumentIndexClient = {
         authoritySubjectId: string | null;
     }) => Promise<Document | void>;
 };
+export type ManagedEmailMessage = {
+    kind: "email_verification" | "password_reset" | "organization_user_setup";
+    from: string;
+    to: string;
+    subject: string;
+    text: string;
+    html: string;
+    idempotencyKey?: string;
+};
+export type ManagedEmailDeliveryResult = {
+    status: "sent";
+    providerMessageId: string | null;
+} | {
+    status: "failed";
+    errorClass: string;
+} | {
+    status: "outcome_unknown";
+    errorClass: string;
+};
+/** Provider-neutral, injectable boundary for every managed-auth email. */
+export type ManagedEmailTransport = {
+    /** Effective provider sender; frozen into any idempotent payload digest. */
+    readonly sender: string;
+    /**
+     * Stable non-secret provider/account/policy namespace plus the provider's
+     * guaranteed key-retention window. Both are durably fenced before I/O.
+     */
+    readonly idempotency: {
+        readonly scope: string;
+        readonly retentionSeconds: number;
+    };
+    send(message: ManagedEmailMessage): Promise<ManagedEmailDeliveryResult>;
+};
 export type AppDependencies = {
     settings: Settings;
     db: Database;
@@ -114,6 +147,8 @@ export type AppDependencies = {
      * App credentials; standalone deployments fall back to @opengeni/github.
      */
     githubAppApi?: GitHubAppApiPort;
+    /** Optional provider seam for the separately registered OpenGeni Lens App. */
+    prReviewGithubAppApi?: GitHubAppApiPort;
     /**
      * Optional host-owned connection credential seam. API-side consumers use
      * the MCP leg for Codemode/Code Mode; worker consumers bind the same port
@@ -127,6 +162,8 @@ export type AppDependencies = {
      */
     sessionAuthorization?: SessionAuthorizationPort | null;
     managedAuth?: ManagedAuth | null;
+    /** Injectable managed-email transport; standalone API defaults to Resend or local capture. */
+    managedEmailTransport?: ManagedEmailTransport;
     /** Injectable Codex HTTP transport for deterministic API/provider tests. */
     codexFetch?: typeof fetch;
     /** Injectable GitHub transport for deterministic personal-OAuth tests. */
@@ -162,6 +199,7 @@ export type AppDependencies = {
 };
 export type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
 export type ApiRouteDeps = AppDependencies & {
+    managedEmailTransport: ManagedEmailTransport;
     objectStorage: ObjectStorageDependency;
     githubStateSecret: string;
     documentIndexer: DocumentIndexClient;

package/dist/domain/insights.d.ts

@@ -1,6 +1,16 @@
 import { type Settings } from "@opengeni/config";
 import { type InsightsRange, type WorkspaceInsightsResponse } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
+export declare const WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES = 256;
+export declare const WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES = 512;
+export type WorkspaceInsightsFilterField = "provider" | "model";
+export declare class WorkspaceInsightsFilterValidationError extends Error {
+    readonly field: WorkspaceInsightsFilterField;
+    readonly maxUtf8Bytes: number;
+    constructor(field: WorkspaceInsightsFilterField, maxUtf8Bytes: number);
+}
+/** Normalize the public filter sentinel and enforce the database authority envelope. */
+export declare function normalizeWorkspaceInsightsFilter(value: string | null | undefined, field: WorkspaceInsightsFilterField): string | null;
 export type GetWorkspaceInsightsInput = {
     workspaceId: string;
     range: InsightsRange;
@@ -8,4 +18,9 @@ export type GetWorkspaceInsightsInput = {
     model?: string | null;
     now?: Date;
 };
+export declare function insightsSessionLabel(input: {
+    id: string;
+    title: string | null;
+    depth?: number | null;
+}): string;
 export declare function getWorkspaceInsights(db: Database, settings: Settings, input: GetWorkspaceInsightsInput): Promise<WorkspaceInsightsResponse>;

package/dist/domain/remember.d.ts

@@ -1,5 +1,5 @@
 import { type RememberLane, type GovernedLearningActivationReceipt, type RememberConfirmReceipt as RememberConfirmReceiptType, type RememberReceipt as RememberReceiptType } from "@opengeni/contracts";
-import { type Database, activateHumanConfirmedLearningDecision, archiveTaskNote, confirmRememberKnowledgeClaim, createTaskNote, getWorkspaceInstructionPolicyBaseline, getWorkspaceKnowledgeChangeProposalSummary, getWorkspaceKnowledgeClaimInitiatingHuman, rebaselineWorkspaceInstructionPolicyKnowledgeProposal } from "@opengeni/db";
+import { type Database, activateHumanConfirmedLearningDecision, archiveTaskNote, confirmRememberKnowledgeClaim, createTaskNote, getWorkspaceInstructionPolicyBaseline, getWorkspaceKnowledgeChangeProposalSummary, getWorkspaceKnowledgeClaimInitiatingHuman, materializeConfirmedRememberKnowledgeMemory, rebaselineWorkspaceInstructionPolicyKnowledgeProposal } from "@opengeni/db";
 import { createCompanyBrainLearningPolicyRouter } from "./company-brain-governed-writes.js";
 export declare class RememberError extends Error {
     readonly code: "proposal_unavailable" | "proposal_not_confirmable" | "human_confirmation_unavailable" | "baseline_stale";
@@ -14,6 +14,7 @@ export type RememberRouterOptions = {
     rebaselineProposal?: typeof rebaselineWorkspaceInstructionPolicyKnowledgeProposal;
     activateHumanConfirmed?: typeof activateHumanConfirmedLearningDecision;
     confirmKnowledgeClaim?: typeof confirmRememberKnowledgeClaim;
+    materializeKnowledgeMemory?: typeof materializeConfirmedRememberKnowledgeMemory;
     proposalSummary?: typeof getWorkspaceKnowledgeChangeProposalSummary;
     claimInitiatingHuman?: typeof getWorkspaceKnowledgeClaimInitiatingHuman;
     instructionPolicyBaseline?: typeof getWorkspaceInstructionPolicyBaseline;
@@ -56,6 +57,8 @@ export declare function rememberConfirmationLabel(input: {
  * and the result is either an immediate activation (automatic policy), a
  * proposal for the human Knowledge review lifecycle, or a durable proposal that
  * still needs one bound human confirmation through `request_human_input`.
+ * A confirmed Knowledge claim is then materialized as a keyword-searchable
+ * Memory record from its exact approved Task-note text.
  */
 export declare function createRememberRouter(options: RememberRouterOptions): {
     remember: (input: {

package/dist/domain/sessions.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionCommandReceipt, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionCommandReceipt, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor, type NewSessionDraftSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type AccessGrantAuthorization } from "../access/index.js";
@@ -98,10 +98,11 @@ export declare function createAndStartSessionWithOutcome(input: {
     createdByActor?: Extract<SessionCommandActor, {
         type: "agent_attempt";
     }> | null;
-    variableSet?: {
+    variableSets?: Array<{
         id: string;
         name: string;
-    } | null;
+        scope: VariableSet["scope"];
+    }>;
     rigId?: string | null;
     rigVersionId?: string | null;
     channelId?: string | null;