@opengeni/core 3.0.1 → 3.1.2

package/dist/domain/resources.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import { mergeToolRefs, stableJson, type RepositoryResourceRef, type ResourceRef, type ToolRef, type WorkspaceSessionToolDefaults } from "@opengeni/contracts";
+import { mergeToolRefs, stableJson, type RepositoryResourceRef, type ResourceRef, type ScheduledTaskToolPolicy, type ToolRef, type WorkspaceSessionToolDefaults } from "@opengeni/contracts";
 import { type SessionRlsActorContext, type Database } from "@opengeni/db";
 export declare function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
 type McpSettings = Pick<Settings, "mcpServers">;
@@ -13,6 +13,22 @@ export declare function withDefaultEnabledCapabilityMcpTools(tools: ToolRef[], s
  * deployment + enabled-capability default.
  */
 export declare function withWorkspaceDefaultMcpTools(tools: ToolRef[], settings: McpSettings, runtimeSettings: McpSettings, defaults: WorkspaceSessionToolDefaults | null): ToolRef[];
+/**
+ * The tools a run of a schedule that starts its own session gets now. A
+ * schedule that follows the workspace defaults gets the defaults as they are
+ * at this moment (never a copy saved earlier), minus the connectors a person
+ * turned off, plus its own tools. Without a policy it gets exactly its tools.
+ * The Opengeni carrier is never excluded.
+ */
+export declare function scheduledTaskRunTools(input: {
+    agentConfig: {
+        tools: ToolRef[];
+        toolPolicy?: ScheduledTaskToolPolicy | undefined;
+    };
+    settings: McpSettings;
+    runtimeSettings: McpSettings;
+    workspaceDefaults: WorkspaceSessionToolDefaults | null;
+}): ToolRef[];
 /** Drop stored refs that are no longer present in the current runtime registry. */
 export declare function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[];
 /** A child or fixed-policy follow-up may narrow its allow-list, never widen it. */

package/dist/domain/scheduled-task-access.d.ts

@@ -0,0 +1,265 @@
+/**
+ * Scheduled-task access drift, the owner's explicit access refresh, and the
+ * in-app signal for runs that failed closed on connector access or ran without
+ * an unusable pinned account.
+ *
+ * A separate-agent task saves its connectors and (when an agent created it,
+ * migration 0428) its Opengeni tool policy. Connector accounts are never
+ * saved: every run resolves the owner's current accounts, except for accounts
+ * a person explicitly pinned. This module computes one plan: what the task's
+ * owner would get by saving it again now, and which pinned accounts can no
+ * longer be used. The refresh applies exactly that plan through the ordinary
+ * owner update path, so a refresh never widens beyond what the calling person
+ * could grant with an edit. See docs/scheduled-task-access.md.
+ */
+import { type Settings, type FirstPartyMcpToolPolicySettings } from "@opengeni/config";
+import { type AccessGrant, type ConnectionMetadata, type FirstPartyMcpToolName, type McpConnectionAccountBinding, type McpConnectionAccountSelection, type Permission, type RefreshScheduledTaskAccessRequest, type ScheduledTask, type ScheduledTaskAccountPlan, type ScheduledTaskAccessAttention, type ScheduledTaskAccessConnector, type ScheduledTaskPolicyDrift, type ScheduledTaskRun, type ScheduledTaskRunAccessFailure, type SessionAuthorizationPort, type SessionAuthorizationSurface, type ToolRef } from "@opengeni/contracts";
+import { type Database, type ScheduledTaskCreatorPolicy } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+import type { ObjectStorageDependency } from "../dependencies.js";
+import { type PersonalConnectionDelegationSource } from "./personal-connection-delegations.js";
+export type ScheduledTaskConnectorPlan = {
+    tools: ToolRef[];
+    missing: ScheduledTaskAccessConnector[];
+    unavailable: ScheduledTaskAccessConnector[];
+};
+/**
+ * Connectors: keep every connector the task already uses that still exists,
+ * drop the ones this workspace no longer sets up, and add the workspace
+ * defaults a new schedule would get, except the ones the owner chose to keep
+ * off (`leaveOut`). A refresh never removes a connector the owner deliberately
+ * kept, so it only narrows what no longer exists.
+ */
+export declare function planScheduledTaskConnectors(input: {
+    taskTools: readonly ToolRef[];
+    defaultTools: readonly ToolRef[];
+    availableServerIds: ReadonlySet<string>;
+    names: ReadonlyMap<string, string>;
+    leaveOut?: ReadonlySet<string>;
+}): ScheduledTaskConnectorPlan;
+export type ScheduledTaskPinnedAccountPlan = {
+    /** Pins that stay: their connector is still used (special surfaces always stay). */
+    kept: McpConnectionAccountSelection[];
+    /** Connectors with a pinned account the owner can no longer use. */
+    unavailable: ScheduledTaskAccessConnector[];
+    /** Connectors with a pin that the task no longer uses; saving drops the pin. */
+    dropped: ScheduledTaskAccessConnector[];
+};
+/**
+ * Person-pinned accounts against what the owner can use now. Unpinned
+ * connectors need no plan: every run resolves the owner's current accounts.
+ * A pin is unavailable when its connector is still used but the pinned
+ * account no longer resolves for the owner; runs then go without that
+ * connector, never with another account. A pin whose connector the task no
+ * longer uses is dropped by the next save. Special first-party surfaces keep
+ * their own account contract and are checked at admission.
+ */
+export declare function planScheduledTaskPinnedAccounts(input: {
+    pins: readonly McpConnectionAccountSelection[];
+    connectionServerIds: readonly string[];
+    availableBindings: ReadonlyArray<{
+        canonicalServerId: string;
+        connectionId: string;
+    }>;
+    names: ReadonlyMap<string, string>;
+}): ScheduledTaskPinnedAccountPlan;
+/**
+ * What each connector of a scheduled run would act as if the run started
+ * now. `bindings` are every account the owner can use for the task's
+ * connectors right now, resolved the way a run resolves them. A connector
+ * without pins follows those accounts (Default); a pinned connector uses only
+ * the pinned accounts that still resolve and names the ones that do not.
+ * Special first-party surfaces keep their own account contract and are not
+ * listed; neither are host-supplied connectors (absent from
+ * `connectionServerIds`).
+ */
+export declare function planScheduledTaskAccounts(input: {
+    connectionServerIds: readonly string[];
+    pins: readonly McpConnectionAccountSelection[];
+    bindings: ReadonlyArray<Pick<McpConnectionAccountBinding, "canonicalServerId" | "connectionId" | "accountLabel" | "subjectScope">>;
+    names: ReadonlyMap<string, string>;
+}): ScheduledTaskAccountPlan;
+export type ScheduledTaskOpenGeniToolPlan = {
+    missing: FirstPartyMcpToolName[];
+    policy: {
+        firstPartyMcpTools: FirstPartyMcpToolName[];
+        firstPartyMcpPermissions: Permission[];
+    } | null;
+};
+/** Permissions each first-party tool needs; the API passes its MCP registration table. */
+export type FirstPartyToolPermissionRequirements = (tools: readonly FirstPartyMcpToolName[]) => readonly Permission[];
+/**
+ * Opengeni tools of an agent-created task (migration 0428). A human- or
+ * API-created task has no frozen creator policy and already follows the
+ * deployment default at each run, so there is nothing to refresh. For a frozen
+ * policy the refresh adds the current default tools. Permissions stay
+ * least-privilege: a frozen permission is kept only while the refreshing
+ * person holds it, and the only permissions added are the ones the newly
+ * added tools need, within the default worker set and that person's grant. A
+ * refresh therefore never lifts a deliberately narrowed permission boundary
+ * for tools the task already had, and every addition follows a tool the drift
+ * report names. Default tools the owner chose to keep off (`leaveOut`) are
+ * neither reported nor added. The frozen session policy (agent access, scope,
+ * memory) is never touched.
+ */
+export declare function planScheduledTaskOpenGeniTools(input: {
+    creatorPolicy: Pick<ScheduledTaskCreatorPolicy, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null;
+    settings: FirstPartyMcpToolPolicySettings;
+    grantPermissions: readonly Permission[];
+    grantPermissionMode?: AccessGrant["permissionMode"];
+    permissionsRequiredByTools: FirstPartyToolPermissionRequirements;
+    leaveOut?: ReadonlySet<FirstPartyMcpToolName>;
+}): ScheduledTaskOpenGeniToolPlan;
+/**
+ * Fold one run's `tool.auth_needed` facts into one entry per connector and
+ * reason. An agent's recommendation to set up a new capability or custom
+ * connector is a suggestion, not a failed frozen access, and is left out.
+ */
+export declare function scheduledTaskRunAccessFailures(events: ReadonlyArray<{
+    payload: unknown;
+    occurredAt: string;
+}>, names: ReadonlyMap<string, string>): ScheduledTaskRunAccessFailure[];
+/**
+ * Whose access view this viewer may see: the owner's (only for the owner
+ * itself, as an entitled authenticated subject) or, for a task without an
+ * owner, the workspace's (for people who manage schedules). Null otherwise.
+ */
+export declare function scheduledTaskAccessSource(task: Pick<ScheduledTask, "ownerSubjectId">, grant: AccessGrant): Exclude<PersonalConnectionDelegationSource, {
+    kind: "turn";
+}> | null;
+/**
+ * A signed-in person: the canonical managed cookie session (or a verified
+ * external owning user) or the exact built-in local human. Provenance stamps,
+ * never grant shape; API keys, services, delegated bearers and agent attempts
+ * do not qualify.
+ */
+export declare function isScheduledTaskAccessRefreshHuman(authorization: AccessGrantAuthorization, workspaceId: string): boolean;
+export type ScheduledTaskAccessPlan = {
+    drift: Omit<ScheduledTaskPolicyDrift, "canRefresh">;
+    /** What each connector would act as if a run started now (see `planScheduledTaskAccounts`). */
+    accounts: ScheduledTaskAccountPlan;
+    /** Connectors with a pinned account the task no longer uses (see the pin plan). */
+    droppedPins: ScheduledTaskAccessConnector[];
+    tools: ToolRef[];
+    creatorFirstPartyPolicy: ScheduledTaskOpenGeniToolPlan["policy"];
+    changed: boolean;
+};
+/** Request-local reads shared by every task one viewer's list decorates. */
+export type ScheduledTaskAccessReadCache = {
+    registries: Map<string, Promise<Settings>>;
+    connections: Map<string, Promise<ConnectionMetadata[]>>;
+};
+export declare function scheduledTaskAccessReadCache(): ScheduledTaskAccessReadCache;
+/**
+ * What saving `task` again would save for its owner now, and which of its
+ * pinned accounts the owner can no longer use, read-only. The connector
+ * registry used to judge availability is the calling person's, the same
+ * registry the owner update path validates against.
+ */
+export declare function computeScheduledTaskAccessPlan(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    task: ScheduledTask;
+    source: Exclude<PersonalConnectionDelegationSource, {
+        kind: "turn";
+    }>;
+    creatorPolicy: ScheduledTaskCreatorPolicy | null;
+    permissionsRequiredByTools: FirstPartyToolPermissionRequirements;
+    cache?: ScheduledTaskAccessReadCache;
+    workspaceSettings?: unknown;
+    /** Defaults the refreshing person chose to keep off; narrows what the plan adds. */
+    leaveOut?: RefreshScheduledTaskAccessRequest["leaveOut"];
+}): Promise<ScheduledTaskAccessPlan>;
+export declare function scheduledTaskPolicyDriftHasChanges(drift: Omit<ScheduledTaskPolicyDrift, "canRefresh">): boolean;
+/**
+ * Attach `policyDrift` and `accountPlan` to each task this viewer can act on.
+ * A viewer who cannot act on a task receives it unchanged, so nobody else sees
+ * the owner's account labels. Both are advisory: a failure to compute them
+ * never fails the read, it only omits the fields.
+ */
+export declare function withScheduledTaskPolicyDrift(input: {
+    db: Database;
+    settings: Settings;
+    authorization: AccessGrantAuthorization;
+    tasks: ScheduledTask[];
+    permissionsRequiredByTools: FirstPartyToolPermissionRequirements;
+    onError?: (error: unknown) => void;
+}): Promise<ScheduledTask[]>;
+/**
+ * The owner's explicit access refresh: re-save the task's connectors and (for
+ * an agent-created task) Opengeni tool policy with the calling person's
+ * current authority. Connector accounts are not part of it: unpinned
+ * connectors already follow the owner's current accounts, and pins change only
+ * when a person edits them (a pin whose connector is dropped goes with it).
+ * It is an ordinary owner edit whose
+ * content the server computes, so the owner check, Variable Set permission,
+ * model policy, target validation, personal-resource re-authorization and
+ * execution-digest update all run exactly as for a manual edit.
+ */
+export declare function refreshScheduledTaskAccess(input: {
+    settings: Settings;
+    db: Database;
+    objectStorage: ObjectStorageDependency;
+    authorization: AccessGrantAuthorization;
+    taskId: string;
+    request: RefreshScheduledTaskAccessRequest;
+    permissionsRequiredByTools: FirstPartyToolPermissionRequirements;
+    sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+    authorizationSurface?: SessionAuthorizationSurface | undefined;
+}): Promise<ScheduledTask>;
+/** Attach `accessFailures` to runs of a task this viewer can act on. */
+export declare function withScheduledTaskRunAccessFailures<T extends ScheduledTaskRun>(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    task: ScheduledTask;
+    runs: T[];
+}): Promise<T[]>;
+/**
+ * The in-app notice: schedules whose latest run failed closed on connector
+ * access and that no later run has cleared. A person is told about the
+ * schedules they own. A task without an owner has nobody to notify, so it is
+ * listed only for an organization key, configured key or service that manages
+ * schedules (the callers that create such tasks), never for every member.
+ */
+export declare function scheduledTaskAttentionScope(grant: AccessGrant): {
+    ownerSubjectId: string | null;
+    includeOwnerless: boolean;
+} | null;
+/**
+ * Tasks among `tasks` with a person-pinned connector account that can no
+ * longer be used: the pin plan's `unavailableAccounts`, exactly what the
+ * drift reports, plus pins whose connector the workspace stopped setting up.
+ * A fresh occurrence runs without those connectors (or is
+ * skipped when the task requires its pinned accounts). Only the pin part of
+ * the plan is read, which does not depend on the creator policy. Advisory: a
+ * task whose plan cannot be computed is skipped.
+ */
+export declare function scheduledTasksWithUnavailableAccounts(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    tasks: readonly ScheduledTask[];
+    onError?: ((error: unknown) => void) | undefined;
+}): Promise<Array<{
+    task: ScheduledTask;
+    unavailableAccounts: ScheduledTaskAccessConnector[];
+}>>;
+/**
+ * The owner's in-app notice: schedules whose latest run failed closed on
+ * connector access and that no later run has cleared, plus schedules with a
+ * pinned account that can no longer be used (their runs go without that
+ * connector), named by connector. Tasks needing both appear once.
+ */
+export declare function listScheduledTaskAccessAttention(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    onError?: ((error: unknown) => void) | undefined;
+}): Promise<ScheduledTaskAccessAttention[]>;
+/**
+ * Schedules with an unusable pinned account come first, then the most recent
+ * failed runs. Ties keep a stable order by task id.
+ */
+export declare function orderScheduledTaskAccessAttention(items: readonly ScheduledTaskAccessAttention[]): ScheduledTaskAccessAttention[];

package/dist/domain/scheduled-task-account-audit.d.ts

@@ -0,0 +1,27 @@
+import type { AccessGrant, ScheduledTaskAgentConfig } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+/** The audit action written whenever a schedule's account or connector choices change. */
+export declare const SCHEDULED_TASK_ACCOUNT_CHOICES_AUDIT_ACTION = "scheduled_task.account_choices_changed";
+/**
+ * What changed in a schedule's account and connector choices, as audit
+ * metadata: each changed choice with its value before and after. Only the
+ * choices are recorded (server and connection ids), never a credential or an
+ * account label. Returns null when nothing changed; a new schedule without
+ * any choice records nothing.
+ */
+export declare function scheduledTaskAccountChoiceChanges(before: ScheduledTaskAgentConfig | null, after: ScheduledTaskAgentConfig): Record<string, {
+    before: unknown;
+    after: unknown;
+}> | null;
+/**
+ * Record a change to a schedule's account or connector choices in the same
+ * transaction as the change, with who made it and through which kind of
+ * caller (a person, an agent, an API key or a service).
+ */
+export declare function recordScheduledTaskAccountChoiceChanges(tx: Database, input: {
+    grant: AccessGrant;
+    taskId: string;
+    operation: "create" | "update";
+    before: ScheduledTaskAgentConfig | null;
+    after: ScheduledTaskAgentConfig;
+}): Promise<void>;

package/dist/domain/scheduled-task-audience.d.ts

@@ -0,0 +1,70 @@
+import type { AccessGrant, PrivateScheduledTaskSummary, ScheduledTask, SessionVisibility } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type PrivacySettings } from "../application/organization-privacy.js";
+/**
+ * Who is reading schedules: the person (or the person an agent acts for),
+ * whether they administer the workspace, and whether, as an admin, they see
+ * that other people's Only me schedules exist. The organization can turn that
+ * last part off; a deployment can require it.
+ */
+export type ScheduledTaskViewer = {
+    subjectId: string | null;
+    admin: boolean;
+    seesPrivateSummaries: boolean;
+};
+/**
+ * `full`: everything. `summary`: an admin's view of someone else's Only me
+ * schedule (owner, cadence, cost) and pause. `none`: indistinguishable from a
+ * schedule that does not exist.
+ */
+export type ScheduledTaskAccess = "full" | "summary" | "none";
+export declare function scheduledTaskViewerForGrant(db: Database, grant: AccessGrant, settings: PrivacySettings): Promise<ScheduledTaskViewer>;
+export declare function scheduledTaskAccess(viewer: ScheduledTaskViewer, task: Pick<ScheduledTask, "visibility" | "ownerSubjectId">): ScheduledTaskAccess;
+/** A schedule this caller may see in full; anything else is a plain 404. */
+export declare function requireVisibleScheduledTask(db: Database, grant: AccessGrant, taskId: string, viewer?: ScheduledTaskViewer): Promise<ScheduledTask>;
+/** An admin's summary of someone else's Only me schedule, or null. */
+export declare function privateScheduledTaskSummaryForAdmin(db: Database, grant: AccessGrant, taskId: string, viewer: ScheduledTaskViewer): Promise<PrivateScheduledTaskSummary | null>;
+/**
+ * A schedule this caller may pause: one they see in full, or, for an admin,
+ * someone else's Only me schedule, which they only ever see as a summary. That
+ * schedule often posts into a chat the admin cannot see, so it is read through
+ * the summary and never loaded in full.
+ */
+export declare function requirePausableScheduledTask(db: Database, grant: AccessGrant, taskId: string, viewer: ScheduledTaskViewer): Promise<{
+    access: "full";
+    task: ScheduledTask;
+} | {
+    access: "summary";
+    summary: PrivateScheduledTaskSummary;
+}>;
+/**
+ * Pause someone else's Only me schedule as a workspace admin and return its
+ * refreshed summary. Only its owner can change, run or resume it.
+ */
+export declare function pausePrivateScheduledTaskAsAdmin(db: Database, grant: AccessGrant, taskId: string, viewer: ScheduledTaskViewer): Promise<PrivateScheduledTaskSummary>;
+export declare const SCHEDULED_TASK_PRIVATE_TARGET_MESSAGE = "This schedule posts into an Only me chat, so it is Only me too.";
+export declare const SCHEDULED_TASK_PRIVATE_OWNER_MESSAGE = "Only a person can have an Only me schedule.";
+export declare const SCHEDULED_TASK_PRIVATE_DISABLED_MESSAGE = "Only me schedules are turned off for this organization.";
+/**
+ * Whether this person may start something new as Only me in this workspace: a
+ * chat, a schedule or a Site. In their Personal workspace, whenever the
+ * platform offers private sessions; elsewhere, when the organization allows
+ * Only me and the deployment does not turn it off.
+ */
+export declare function mayStartOnlyMe(db: Database, settings: PrivacySettings, workspaceId: string, subjectId: string): Promise<boolean>;
+/**
+ * The audience to store for a created or edited schedule. A schedule that
+ * posts into an Only me chat, or writes to its owner's personal knowledge, is
+ * always Only me. Choosing Only me needs a human owner who may create Only me
+ * chats in this workspace.
+ */
+export declare function resolveScheduledTaskVisibility(input: {
+    db: Database;
+    settings: PrivacySettings;
+    grant: AccessGrant;
+    requested: SessionVisibility | undefined;
+    current: Pick<ScheduledTask, "visibility"> | null;
+    targetSessionId: string | null;
+    personalKnowledge: boolean;
+    ownerSubjectId: string | null;
+}): Promise<"user_private" | "workspace_shared">;

package/dist/domain/scheduled-tasks.d.ts

@@ -1,19 +1,14 @@
-import { type Settings } from "@opengeni/config";
-import type { AccessGrant, McpPersonalConnectionDelegation, ScheduledTask, ScheduledTaskAgentConfig, Session, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
-import { type KnowledgeContext, type Database, type TemporalScheduleCleanupClaim, type UpdateScheduledTaskInput } from "@opengeni/db";
+import { type FirstPartyMcpToolPolicySettings, type Settings } from "@opengeni/config";
+import type { AccessGrant, ScheduledTask, ScheduledTaskAgentConfig, Session, ToolRef, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
+import { type KnowledgeContext, type Database, type ScheduledTaskCreatorPolicy, type SessionCommandActor, type TemporalScheduleCleanupClaim, type UpdateScheduledTaskInput } from "@opengeni/db";
 import { type AccessGrantAuthorization } from "../access/index.js";
 import type { SessionWorkflowClient } from "../dependencies.js";
 import type { ObjectStorageDependency } from "../dependencies.js";
-/**
- * Whether a raw scheduled-task payload explicitly set agentConfig.tools.
- * Zod's `.default([])` erases the distinction between "absent" and
- * "explicitly empty", so callers detect it on the raw payload — the same
- * contract sessions use: absent tools mean "give me the workspace defaults
- * (enabled capability MCP servers)", an explicit list (even empty) is taken
- * verbatim.
- */
+import { type ScheduledTaskSlackChannelVerifier } from "./slack-bot.js";
 export declare function scheduledTaskToolsProvided(rawPayload: unknown): boolean;
-export declare function scheduledConnectionSurfaceEligibility(settings: Settings, target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null): {
+/** Resolve the target's current tool policy before choosing its owner's accounts. */
+export declare function scheduledConnectionTools(db: Database, workspaceId: string, settings: Settings, target: Session | null, taskTools: ToolRef[], subjectId?: string): Promise<ToolRef[]>;
+export declare function scheduledConnectionSurfaceEligibility(settings: Settings, target: (Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> & Partial<Pick<Session, "toolPolicy" | "agent">>) | null, workspaceSettings?: unknown): {
     googleDrivePublicationEnabled: boolean;
     atlassianEnabled: boolean;
 };
@@ -25,10 +20,32 @@ export declare function createValidatedScheduledTask(input: {
     authorization?: AccessGrantAuthorization;
     payload: CreateScheduledTaskPayload;
     toolsProvided?: boolean;
-    variableSetPreauthorized?: boolean;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
     authorizationSurface?: SessionAuthorizationSurface | undefined;
+    /** Proves the bot may post in a newly chosen task Slack channel. */
+    verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<ScheduledTask>;
+/**
+ * Freeze authenticated credential restrictions for every creation lane, and
+ * the creating session's boundary onto an agent-created task so the
+ * sessions generated for it inherit exactly what the creator could see and
+ * do, never the deployment default. Tools are the session's effective
+ * model-visible selection under the deployment ceiling; permissions are the
+ * session's effective first-party set intersected with what the calling
+ * grant actually holds (a narrowly delegated spawn token cannot hand a
+ * schedule more than itself). The session access policy is copied from the
+ * projection when it exposes those facts; each absent fact is stored as null
+ * so a generated session keeps its own default for that key.
+ */
+export declare function frozenScheduledTaskCreatorPolicy(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    authorization?: AccessGrantAuthorization | undefined;
+    actor: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }> | null;
+}): Promise<ScheduledTaskCreatorPolicy | null>;
 /**
  * Scheduled-task authority writes fail closed inside SECURITY DEFINER seams
  * (42501): a non-human writer delegating resources, an authorizer without
@@ -37,11 +54,19 @@ export declare function createValidatedScheduledTask(input: {
  */
 export declare function withScheduledTaskAuthorityWriteErrors<T>(run: () => Promise<T>): Promise<T>;
 /** API/MCP-facing update that maps authority-write denials to 409. */
-export declare function updateScheduledTaskForApi(db: Database, workspaceId: string, taskId: string, update: UpdateScheduledTaskInput, learning?: {
+export declare function updateScheduledTaskForApi(db: Database, grant: AccessGrant, taskId: string, update: UpdateScheduledTaskInput, learning?: {
     authorization: AccessGrantAuthorization;
     request: NonNullable<UpdateScheduledTaskPayload["agentLearning"]>;
     restoreState: ScheduledTaskRestoreState;
 }): Promise<ScheduledTask>;
+export declare function assertScheduledTaskMutationOwner(db: Database, grant: AccessGrant, taskId: string): Promise<void>;
+/**
+ * An admin's pause of a schedule they do not own. Pausing is reversible and
+ * changes nothing else; only the owner can change, run or resume it again.
+ */
+export declare function pauseScheduledTaskAsAdmin(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
+export declare const SCHEDULED_TASK_PAUSED_TRIGGER_MESSAGE = "This schedule is paused, so it cannot run now. Resume it first, then trigger it.";
+export declare function triggerScheduledTaskForGrant(db: Database, grant: AccessGrant, workflowClient: SessionWorkflowClient, input: Parameters<SessionWorkflowClient["triggerScheduledTask"]>[0]): Promise<void>;
 export declare function validateScheduledTaskTarget(input: {
     db: Database;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
@@ -53,13 +78,22 @@ export declare function validateScheduledTaskTarget(input: {
     rigId: string | null | undefined;
     agentConfig: ScheduledTaskAgentConfig;
     missingTargetStatus?: 404 | 422;
+    /** Leaving a cancelled chat still requires control, but not revivability. */
+    departingTarget?: boolean;
 }): Promise<Session | null>;
+export declare const PERSONAL_MACHINE_SCHEDULE_AUDIENCE_MESSAGE = "Your personal machine can only run schedules that only you can see. Set Who can see it to Only me, or pick a shared machine.";
 export declare function validateScheduledTaskMachineTarget(input: {
     settings: Settings;
     db: Database;
     grant: AccessGrant;
     runMode: ScheduledTask["runMode"];
     agentConfig: ScheduledTaskAgentConfig;
+    /**
+     * Who can see the schedule. A personal machine runs only an Only me schedule
+     * of its owner; the owner check is the scoped lookup itself, which returns a
+     * personal machine to nobody else.
+     */
+    audience: "user_private" | "workspace_shared";
     requireOnline?: boolean;
 }): Promise<{
     sandboxId: string;
@@ -71,7 +105,13 @@ export declare function scheduledTaskRunForGrant<T extends {
     sessionId: string | null;
 }>(run: T, grant: AccessGrant): T;
 export declare function scheduledTaskAuthorityUpdateForGrant(grant: AccessGrant): Pick<UpdateScheduledTaskInput, "refreshPersonalResourceAuthority" | "authorityUpdatedBy" | "authorityUpdatedByContext" | "authorityUpdatedByActor">;
-export declare function validatedScheduledTaskUpdate(input: {
+/**
+ * The validated update for a schedule edit, including its audience: a schedule
+ * that ends up posting into an Only me chat is Only me, and only its owner can
+ * change who sees it (the update itself is owner-only).
+ */
+export declare function validatedScheduledTaskUpdate(input: Parameters<typeof validatedScheduledTaskUpdateWithoutAudience>[0]): Promise<UpdateScheduledTaskInput>;
+declare function validatedScheduledTaskUpdateWithoutAudience(input: {
     settings: Settings;
     db: Database;
     objectStorage: ObjectStorageDependency;
@@ -83,11 +123,12 @@ export declare function validatedScheduledTaskUpdate(input: {
     toolsProvided?: boolean;
     sessionAuthorization?: SessionAuthorizationPort | null | undefined;
     authorizationSurface?: SessionAuthorizationSurface | undefined;
+    /** Proves the bot may post in a newly chosen task Slack channel. */
+    verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
 }): Promise<UpdateScheduledTaskInput>;
 export declare function requireScheduledTaskForApi(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export type ScheduledTaskRestoreState = {
     task: ScheduledTask;
-    personalConnectionDelegations: McpPersonalConnectionDelegation[];
     learning?: {
         context: KnowledgeContext;
         scope: "workspace" | "personal";
@@ -95,7 +136,7 @@ export type ScheduledTaskRestoreState = {
         expectedVersion: number;
     };
 };
-export declare function captureScheduledTaskRestoreState(db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
+export declare function captureScheduledTaskRestoreState(_db: Database, task: ScheduledTask): Promise<ScheduledTaskRestoreState>;
 export declare function restoreScheduledTask(db: Database, previous: ScheduledTaskRestoreState): Promise<ScheduledTask>;
 export declare class ScheduledTaskSyncError extends Error {
     readonly persistenceRestored: boolean;
@@ -113,6 +154,7 @@ export declare function deleteScheduledTaskLifecycle(input: {
     workspaceId: string;
     taskId: string;
     subjectId: string;
+    beforeDeleteCommit?: (tx: Database) => Promise<void>;
     preflightConnectorAuthorization: (task: ScheduledTask) => Promise<void>;
     cleanupConnectorAuthorization: (db: Database, task: ScheduledTask) => Promise<void>;
     processCleanupClaims?: (claims: readonly TemporalScheduleCleanupClaim[]) => Promise<void>;
@@ -164,4 +206,5 @@ export declare function manualScheduledTaskTriggerUsageKey(workspaceId: string,
  * provider, or treats ambient worker credentials as responder capability.
  * Mutable rig/variable-set metadata is revalidated again at dispatch.
  */
-export declare function validateIncidentTelemetryPreflightSelection(settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">, agentConfig: ScheduledTaskAgentConfig): void;
+export declare function validateIncidentTelemetryPreflightSelection(settings: FirstPartyMcpToolPolicySettings, agentConfig: ScheduledTaskAgentConfig): void;
+export {};

package/dist/domain/session-connection-accounts.d.ts

@@ -0,0 +1,53 @@
+import type { AccessGrant, ConnectionAccountIntent, McpConnectionAccountBinding, McpPersonalConnectionDelegation } from "@opengeni/contracts";
+import { type Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+/** Freeze the authenticated request's eligible accounts before starting voice.
+ * The resulting lease snapshot, not a later participant or ambient connection,
+ * supplies authority to both live delegations and automatic transcript handoff. */
+export declare function freezeSessionRealtimeConnectionAccounts(input: {
+    db: Database;
+    settings: Settings;
+    grant: AccessGrant;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<{
+    mcpAccountBindings: McpConnectionAccountBinding[] | null;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    connectionAccountIntent: ConnectionAccountIntent | null;
+}>;
+/** One connector a continued turn runs without, and why. */
+export type ContinuedConnectionAccountGap = {
+    serverId: string;
+    /** The picked account that can no longer be used; null when none was picked. */
+    connectionId: string | null;
+    reason: string;
+};
+/**
+ * Accounts for a turn that continues earlier work in this session: a goal
+ * continuation, a wait wake-up, a command or child result, or informational
+ * input delivered into the person's last message. It resolves the carried
+ * intent exactly as that person's next message with the same picks would be
+ * resolved now, against the session's current connectors and the person's
+ * current accounts. Nothing from an earlier turn's accounts is copied.
+ *
+ * A picked account that can no longer be used is never replaced by another
+ * account: its connector is left out of this turn. The same applies to a
+ * connector whose account can no longer be chosen automatically (for example
+ * several accounts now match and none was picked). Every other connector is
+ * unaffected.
+ *
+ * `db` is the claim transaction, so every read runs one at a time.
+ */
+export declare function resolveContinuedConnectionAccounts(input: {
+    db: Database;
+    settings: Settings;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    intent: ConnectionAccountIntent;
+}): Promise<{
+    mcpAccountBindings: McpConnectionAccountBinding[] | null;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    /** Connectors the turn runs without, because their account cannot be used. */
+    gaps: ContinuedConnectionAccountGap[];
+}>;

package/dist/domain/session-file-access.d.ts

@@ -0,0 +1,4 @@
+import type { AccessGrant, FileAsset } from "@opengeni/contracts";
+import type { SessionAuthorizationDependencies } from "../session-authorization.js";
+/** A session attachment grant is never a generic file/Knowledge grant. */
+export declare function readSessionAttachmentFiles(deps: SessionAuthorizationDependencies, grant: AccessGrant, sessionId: string, fileIds: readonly string[]): Promise<FileAsset[]>;

package/dist/domain/session-native-connection-replacement.d.ts

@@ -0,0 +1,14 @@
+import type { ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
+/** Selection is restricted to the caller's already-authorized inventory. This
+ * projection grants no execution authority: subsequent admission and physical
+ * credential use still validate the exact native account normally. */
+export declare function nativeSessionConnectionReplacement(input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    serverUrl: string;
+    replacementServerUrl?: string;
+    currentRef: McpServerConnectionRef | null;
+    nativeConnectionId: string;
+    connections: ConnectionMetadata[];
+}): McpServerConnectionRef;

package/dist/domain/session-start-timing.d.ts

@@ -0,0 +1,7 @@
+import { type Observability } from "@opengeni/observability";
+type SessionStartPhase = "workspace_read" | "idempotent_replay" | "model_catalog_initial" | "default_model" | "model_catalog_effective" | "capability_settings" | "resource_validation" | "rig_binding" | "model_admission" | "connection_freeze" | "initiator_freeze" | "allowance" | "shell_insert" | "initialize" | "event_fanout" | "workflow_wake" | "session_reload";
+export type SessionStartObservability = Pick<Observability, "startSpan">;
+/** Content-free child spans around existing work; export is never joined and
+ * diagnostic failures cannot alter the lifecycle or its exact error. */
+export declare function measureSessionStartPhase<T>(observability: SessionStartObservability | null | undefined, phase: SessionStartPhase, work: () => Promise<T>): Promise<T>;
+export {};