@opengeni/core 2.8.3 → 2.9.3-canary.0

package/dist/access/external-actor-authority.d.ts

@@ -0,0 +1,47 @@
+import type { Permission } from "@opengeni/contracts";
+export type ExternalAuthoritySnapshot = Readonly<{
+    accountId: string;
+    externalIdentityId: string;
+    identityStatus: "active" | "disabled" | "revoked";
+    identityRevision: number;
+    membershipStatus: "active" | "provisioning" | "suspended" | "revoked";
+    workspaceId: string;
+    permissions: readonly Permission[];
+}>;
+export type ExternalLinkAuthoritySnapshot = Readonly<{
+    id: string;
+    accountId: string;
+    externalIdentityId: string;
+    revision: number;
+    nativeSubjectId: string;
+    status: "pending" | "active" | "revoked" | "expired";
+    expiresAt: number | null;
+    permissions: readonly Permission[];
+    nativeAuthority: Readonly<{
+        subjectId: string;
+        accountId: string;
+        workspaceId: string;
+        active: boolean;
+        permissions: readonly Permission[];
+    }>;
+}>;
+/** Pure permission calculation over already authenticated, live snapshots.
+ * This does not authenticate assertions or establish provenance. Callers must
+ * read snapshots under their authorization fence, never from request JSON.
+ * Linked mode uses the native lane alone: external workspace permissions must
+ * not be unioned into that lane, nor must old external resources change owner.
+ */
+export declare function externalActorPermissions(input: {
+    accountId: string;
+    workspaceId: string;
+    keyActive: boolean;
+    keyAccountId: string;
+    keyPermissions: readonly Permission[];
+    external: ExternalAuthoritySnapshot;
+    linked?: {
+        expectedId: string;
+        expectedRevision: number;
+        authority: ExternalLinkAuthoritySnapshot;
+    };
+    now: number;
+}): Permission[];

package/dist/access/index.d.ts

@@ -1,9 +1,19 @@
 import { type Settings } from "@opengeni/config";
-import { type AccountGrant, type AccessContext, type AccessGrant, type Permission } from "@opengeni/contracts";
+import { ExternalActorAttribution, type ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { type AccountGrant, type AccessContext, type AccessGrant, Permission, type Workspace } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";
 import type { ManagedAuth } from "../managed-auth-type.js";
 import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets.js";
+/** Creation audit only, never an authentication or delegation token. Metadata
+ * claiming to be external is insufficient; the exact resolver proof is needed. */
+export declare function externalAttributionForAuthorization(authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): ExternalActorAttribution | null;
+export declare function externalActorContinuationForAuthorization(authorization: AccessGrantAuthorization): ExternalActorContinuation | null;
+/** Dedicated owning-user proof. External admission never sets the native
+ * cookie stamp. The resource/session layer still checks the exact owner. */
+export declare function hasVerifiedOwningUserAuthorization(authorization: AccessGrantAuthorization): boolean;
+/** Request-local organization service-key proof, not a principal-kind claim. */
+export declare function isVerifiedOrganizationServiceAuthorization(authorization: AccessGrantAuthorization): boolean;
 export type AccountScopedApiKeyWorkspaceAuthority = Readonly<{
     accountId: string;
     permissions: Permission[];
@@ -32,6 +42,10 @@ export type AccessDeps = {
     managedAuth?: ManagedAuth | null;
     managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
 };
+/** null means this is not an authenticated external lane; [] means that lane
+ * has no readable inventory. Callers must not fall back from [] to service or
+ * bare-subject discovery. */
+export declare function listExternalActorWorkspaces(context: AccessContext, deps: AccessDeps): Promise<Workspace[] | null>;
 export declare function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext>;
 export declare function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant>;
 /**

package/dist/application/connect-authority.d.ts

@@ -0,0 +1,13 @@
+import type { Permission } from "@opengeni/contracts";
+import type { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { type Database } from "@opengeni/db";
+/** Accept only a verified request owner or authenticated server-minted OAuth
+ * state. The callback does not need a browser cookie: it rechecks the stored
+ * principal against current authority before claiming and committing effects. */
+export declare function requireConnectOwnerAuthority(db: Database, state: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    personalOwnerVerified?: boolean;
+    externalContinuation?: ExternalActorContinuation;
+}, permission?: Permission, origin?: ExternalActorContinuation | null): Promise<void>;

package/dist/application/connect-operation.d.ts

@@ -0,0 +1,28 @@
+import type { ConnectAttempt } from "@opengeni/contracts/connect";
+import { type ConnectActorScope, type ConnectOperationAuthorization, type Database } from "@opengeni/db";
+/** Provider result is deliberately not serializable: secrets can remain in its
+ * closure until encrypted credential persistence. Do not retain/log this value. */
+export type PreparedConnectOperation = {
+    commit: (tx: Database, current: ConnectAttempt) => Promise<ConnectAttempt>;
+};
+/** Internal provider-adapter boundary, not an HTTP authentication adapter.
+ *
+ * authorize is mandatory, including for a receipt replay. It must validate the
+ * exact saved key/actor/link authority and current permission under database
+ * locks. execute owns provider-specific proof, destination and cancellation.
+ * No remote effects may occur inside authorize or commit.
+ *
+ * A failed execute/authorization/commit keeps the durable claim occupied. It
+ * does not release or retry work whose provider outcome may be unknown.
+ */
+export declare function executeConnectOperation(input: {
+    db: Database;
+    scope: ConnectActorScope;
+    attemptId: string;
+    expectedRevision: number;
+    operationId: string;
+    /** Caller computes a stable keyed digest if input contains low-entropy secrets. */
+    inputDigest: string;
+    authorize: ConnectOperationAuthorization;
+    execute: (attempt: ConnectAttempt) => Promise<PreparedConnectOperation>;
+}): Promise<ConnectAttempt>;

package/dist/application/external-continuation.d.ts

@@ -0,0 +1,15 @@
+import type { Permission } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Capture verified request authority before asynchronous preflight. Invoke
+ * inside the canonical mutation transaction after its lifecycle locks, so a
+ * revoked key/generation rolls the write back without changing lock order. */
+export declare function externalContinuationCommitAuthorizer(authorization: AccessGrantAuthorization | undefined): ((tx: Database) => Promise<void>) | undefined;
+/** Caller verifies/decrypts its server-minted continuation before invoking.
+ * An open transaction retains lifecycle/key/identity locks through persistence.
+ * Historical creator audit alone must never enter this path as a credential. */
+export declare function requireExternalContinuationAuthority(tx: Database, raw: unknown, scope: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, permission: Permission | readonly Permission[]): Promise<void>;

package/dist/application/external-identity-lifecycle.d.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import { type AccessDeps } from "../access/index.js";
+/** Host service administration is separate from asUser and native-cookie
+ * administration. The database rechecks the live key and exact external target
+ * under the canonical organization lifecycle fences, including receipt replay. */
+export declare function updateExternalIdentityMembershipForRequest(context: Context, deps: AccessDeps, organizationId: string, membershipId: string, input: unknown): Promise<{
+    id: string;
+    organizationId: string;
+    subjectId: string;
+    name: string | null;
+    email: string | null;
+    role: "admin" | "member" | "owner";
+    status: "active" | "provisioning" | "revoked" | "suspended";
+    authorizationRevision: number;
+    personalWorkspaceId: string | null;
+    revokedAt: string | null;
+    personalRetentionUntil: string | null;
+    createdAt: string;
+    updatedAt: string;
+}>;

package/dist/application/external-link-work-admission.d.ts

@@ -0,0 +1,12 @@
+import type { ScheduledTask } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Closure is created only from the access resolver's object-identity proof.
+ * JSON metadata and an ordinary named native subject can never enter it. */
+export declare function prepareExternalLinkTurnAdmission(authorization: AccessGrantAuthorization | undefined): ((tx: Database, sessionId: string, turnId: string) => Promise<void>) | undefined;
+export declare function prepareExternalLinkTaskAdmission(authorization: AccessGrantAuthorization | undefined, actor?: {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+} | null): ((tx: Database, task: ScheduledTask) => Promise<void>) | undefined;

package/dist/application/external-workspace-members.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from "hono";
+import { type ExternalIdentity } from "@opengeni/contracts/external-identities";
+import { type AccessDeps } from "../access/index.js";
+/** Explicit host onboarding. Ordinary asUser reads never call this operation.
+ * Existing memberships are not overwritten, including reduced permissions. */
+export declare function addExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, workspaceId: string, input: unknown): Promise<ExternalIdentity>;

package/dist/application/host-mcp-owner.d.ts

@@ -0,0 +1,6 @@
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Direct user admission only. Agents inherit exact accepted snapshots instead.
+ * Native and externally represented users share owner semantics; service keys
+ * cannot impersonate a human owner merely by naming a subject. */
+export declare function prepareHostMcpOwnerAuthorization(authorization: AccessGrantAuthorization, workspaceId: string, permission: "connections:read" | "connections:write"): (tx: Database) => Promise<import("@opengeni/db").HostMcpBindingOwner>;

package/dist/application/new-session-drafts.d.ts

@@ -1,5 +1,6 @@
 import { type AccessGrant, type NewSessionDraft as NewSessionDraftValue } from "@opengeni/contracts";
 import type { AppDependencies } from "../dependencies.js";
+import { type AccessGrantAuthorization } from "../access/index.js";
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
 /** Read the authenticated actor's server-authoritative pre-session composer state. */
 export declare function getActorNewSessionDraft(deps: Pick<NewSessionDraftDependencies, "settings" | "db">, grant: AccessGrant, workspaceId: string): Promise<NewSessionDraftValue>;
@@ -17,5 +18,5 @@ export declare function saveActorNewSessionDraft(deps: NewSessionDraftDependenci
  * Defaults to false so every caller that has not proven it fails closed onto
  * the historical bare-membership fence.
  */
-canonicalManagedHumanSession?: boolean): Promise<NewSessionDraftValue>;
+canonicalManagedHumanSession?: boolean, externalAuthorization?: AccessGrantAuthorization): Promise<NewSessionDraftValue>;
 export {};

package/dist/application/session-tenancy.d.ts

@@ -11,6 +11,7 @@ export declare class SessionTenancyPersistenceOutcomeUnknownError extends Error
     constructor(options?: ErrorOptions);
 }
 export declare function requireCanonicalManagedHuman(authorization: AccessGrantAuthorization, workspaceId: string): void;
+export declare function requireVerifiedOwningUser(authorization: AccessGrantAuthorization, workspaceId: string): void;
 export declare function getManagedHumanSessionCreateCapabilities(deps: Pick<SessionTenancyDependencies, "db">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<SessionTenancyCreateCapabilities>;
 export declare function requireManagedHumanPrivateSessionCreate(deps: Pick<SessionTenancyDependencies, "db">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<void>;
 export declare function updateManagedHumanSessionVisibility(deps: SessionTenancyDependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string, request: UpdateSessionVisibilityRequest, authorizationSurface?: SessionAuthorizationSurface): Promise<UpdateSessionVisibilityResponse>;

package/dist/dependencies.d.ts

@@ -193,6 +193,8 @@ export type AppDependencies = {
     fikenFetch?: typeof fetch;
     /** Injectable Integration Definition OAuth/API transport for deterministic tests. */
     apiIntegrationOAuthFetch?: typeof fetch;
+    /** Injectable specification/introspection transport, still network-policy checked. */
+    apiIntegrationSourceFetch?: typeof fetch;
     atlassianFetch?: typeof fetch;
     /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */
     oauthStartDeadlineMs?: number;

package/dist/domain/capabilities.d.ts

@@ -14,7 +14,7 @@ export declare function createCatalogItem(input: {
     workspaceId: string;
     payload: CreateCapabilityCatalogItemRequest;
 }): Promise<CapabilityCatalogItem>;
-export declare function enableCapability(input: {
+type EnableCapabilityInput = {
     db: Database;
     grant: AccessGrant;
     accountId: string;
@@ -23,7 +23,24 @@ export declare function enableCapability(input: {
     capabilityId: string;
     payload: EnableCapabilityRequest;
     probeMcpServer?: McpCapabilityProbe;
-}): Promise<CapabilityInstallation>;
+};
+export declare function enableCapability(input: EnableCapabilityInput): Promise<CapabilityInstallation>;
+/** Probe outside a durable Connect commit; persist the exact prepared settings
+ * inside the caller's authorized receipt transaction. Native enable uses this too. */
+export declare function prepareCapabilityEnable(input: EnableCapabilityInput): Promise<{
+    commit: (db: Database) => Promise<{
+        id: string;
+        accountId: string;
+        workspaceId: string;
+        capabilityId: string;
+        kind: "api" | "mcp" | "pack" | "plugin" | "skill";
+        status: "active" | "disabled";
+        config: Record<string, unknown>;
+        metadata: Record<string, unknown>;
+        enabledAt: string;
+        updatedAt: string;
+    }>;
+}>;
 export type McpCapabilityProbeInput = {
     id: string;
     name: string;

package/dist/domain/external-creation-attribution.d.ts

@@ -0,0 +1,6 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+export declare const EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
+/** Retained alongside session.created metadata; this is not a live permission
+ * snapshot and must never authorize a follow-up, child, or scheduled turn. */
+export declare function externalCreationMetadata(metadata: Record<string, unknown> | undefined, authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): Record<string, unknown> | undefined;

package/dist/domain/host-mcp-task-admission.d.ts

@@ -0,0 +1,18 @@
+import type { Settings } from "@opengeni/config";
+import type { ToolRef, ScheduledTask, AccessGrant } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Internal closure, not a caller-provided callback or durable key dependency. */
+export declare function prepareHostMcpTaskAdmission(input: {
+    settings: Settings;
+    tools: ToolRef[];
+    grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
+    selections: unknown;
+}): (tx: Database, task: ScheduledTask) => Promise<void>;
+export declare function prepareInheritedHostMcpTaskAdmission(settings: Settings, tools: ToolRef[], source: {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+}): (tx: Database, task: ScheduledTask) => Promise<void>;

package/dist/domain/product-integration-pack.d.ts

@@ -1,12 +1,6 @@
 export declare const OPENGENI_PRODUCT_INTEGRATION_PACK_ID = "opengeni-product-integration";
-/**
- * Version-aligned implementation guidance for customer-side coding agents.
- *
- * This is intentionally an instruction-only Pack. Installation adds no tools,
- * credentials, connectors, knowledge, compute, or customer-agent persona. Its
- * immutable Skill is installed as session-selected and enters model context
- * only when one implementation session opts in explicitly.
- */
+/** Generated from the canonical external coding-agent guide, with an explicit
+ * session-selected wrapper. Installation grants no executable capabilities. */
 export declare const OPENGENI_PRODUCT_INTEGRATION_SKILL: {
     name: string;
     description: string;
@@ -45,6 +39,6 @@ export declare const OPENGENI_PRODUCT_INTEGRATION_PACK: {
         skillActivation: string;
         installationExposure: string;
         grantsExecutableCapabilities: boolean;
-        customerRuntimeProfile: string;
+        canonicalSource: string;
     };
 };

package/dist/domain/product-integration-skill.gen.d.ts

@@ -0,0 +1,5 @@
+export declare const productIntegrationSkillDescription = "Design, implement, verify, and hand off a tenant-safe OpenGeni product integration while adapting to the customer's architecture, UI, data APIs, and desired delivery autonomy. Select only for an implementation session; installation alone does not expose it to other agents.";
+export declare const productIntegrationSkillFiles: {
+    path: string;
+    content: string;
+}[];

package/dist/domain/scheduled-tasks.d.ts

@@ -1,6 +1,7 @@
 import { type Settings } from "@opengeni/config";
 import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, ScheduledTaskAgentConfig, Session, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
 import { type Database, type TemporalScheduleCleanupClaim, type UpdateScheduledTaskInput } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
 import type { SessionWorkflowClient } from "../dependencies.js";
 import type { ObjectStorageDependency } from "../dependencies.js";
 /**
@@ -21,6 +22,7 @@ export declare function createValidatedScheduledTask(input: {
     db: Database;
     objectStorage: ObjectStorageDependency;
     grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
     payload: CreateScheduledTaskPayload;
     toolsProvided?: boolean;
     variableSetPreauthorized?: boolean;
@@ -70,6 +72,7 @@ export declare function validatedScheduledTaskUpdate(input: {
     db: Database;
     objectStorage: ObjectStorageDependency;
     grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
     existing: ScheduledTask;
     payload: UpdateScheduledTaskPayload;
     /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */

package/dist/domain/sessions.d.ts

@@ -1,5 +1,6 @@
+import { type HostMcpCreateSelection } from "@opengeni/contracts/host-mcp-bindings";
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionAgentAccess, type SessionCommandReceipt, type SessionEndUser, type SessionMemoryScope, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionAgentAccess, type SessionCommandReceipt, type SessionScopeSubjectId, type SessionMemoryScope, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor, type NewSessionDraftSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import { type AccessGrantAuthorization } from "../access/index.js";
@@ -97,6 +98,13 @@ export declare function createAndStartSessionWithOutcome(input: {
     /** Internal database-only composition seam. The exact session shell and this
      * linkage commit together before its first event/turn can be initialized. */
     beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+    /** Backend-only accepted-work composition. Recheck live caller authority
+     * here before capturing; session-shell authorization may have happened in
+     * an earlier transaction. Called only for a newly inserted initial turn. */
+    captureInitialTurnAuthority?: (tx: Database, sessionId: string, turnId: string) => Promise<void>;
+    /** Internal replay identity; the verified caller must also capture authority.
+     * Supplying selection metadata alone never grants runtime use. */
+    selectedHostMcpDelegations?: HostMcpCreateSelection[];
     /** The custom workspace model was frozen by an earlier accepted boundary or
      * inherited from an existing session, so retirement must not invalidate it. */
     retainWorkspaceGatewayModel?: boolean;
@@ -149,7 +157,7 @@ export declare function createAndStartSessionWithOutcome(input: {
     firstPartyMcpPermissions?: Permission[] | null;
     firstPartyMcpTools: FirstPartyMcpToolName[];
     agentAccess?: SessionAgentAccess;
-    endUser?: SessionEndUser | null;
+    scopeSubjectId?: SessionScopeSubjectId | null;
     memoryScope?: SessionMemoryScope;
     mcpServers?: CreateSessionMcpServerInput[];
     sessionMcpServers?: SessionMcpServerMetadata[];
@@ -271,6 +279,8 @@ type PostUserMessageTurnInput = {
     clientEventId?: string;
     mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    selectedHostMcpDelegations?: HostMcpCreateSelection[];
+    captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
     personalResourceAttachment?: PersonalResourceAttachmentIntent;
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
@@ -304,7 +314,7 @@ export declare function resolveSessionCreateVisibility(input: {
 }): "user_private" | "workspace_shared";
 export type SessionCreateScope = {
     agentAccess: SessionAgentAccess;
-    endUser: SessionEndUser | null;
+    scopeSubjectId: SessionScopeSubjectId | null;
     memoryScope: SessionMemoryScope;
 };
 /**
@@ -321,7 +331,7 @@ export declare function resolveSessionCreateScope(input: {
     requested: {
         agentAccess: SessionAgentAccess;
         agentAccessProvided: boolean;
-        endUser: SessionEndUser | null;
+        scopeSubjectId: SessionScopeSubjectId | null;
         endUserProvided: boolean;
         memoryScope: SessionMemoryScope;
         memoryScopeProvided: boolean;
@@ -353,6 +363,7 @@ export declare function acceptSessionUserMessageWithOutcome(deps: AcceptSessionU
     clientEventId?: string;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
     connectionAuthorities?: McpConnectionAuthoritySelection[];
+    selectedHostMcpDelegations?: HostMcpCreateSelection[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
     controlEtag?: string | null;

package/dist/index.d.ts

@@ -10,6 +10,13 @@ export * from "./sandbox/fleet.js";
 export * from "./sandbox/routing.js";
 export * from "./sandbox/runtime-settings.js";
 export * from "./access/index.js";
+export * from "./application/external-workspace-members.js";
+export * from "./application/external-identity-lifecycle.js";
+export * from "./application/external-continuation.js";
+export * from "./application/external-link-work-admission.js";
+export * from "./application/connect-authority.js";
+export * from "./application/host-mcp-owner.js";
+export * from "./application/connect-operation.js";
 export * from "./session-authorization.js";
 export * from "./billing/limits.js";
 export * from "./domain/capabilities.js";