@opengeni/core 3.0.1 → 3.1.2

package/dist/domain/session-tool-policy.d.ts

@@ -1,6 +1,6 @@
-import type { Settings } from "@opengeni/config";
-import { type Session, type SessionEffectiveToolPolicy, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
+import { type Settings } from "@opengeni/config";
+import { FirstPartyMcpToolName, type AgentToolEnvironment, type AgentMediaAttachment, type Session, type SessionTurn, type SessionEffectiveToolPolicy, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+import { requireWorkspace, type Database } from "@opengeni/db";
 export type ResolvedSessionToolPolicy = {
     toolRefs: ToolRef[];
     effectivePolicy: SessionEffectiveToolPolicy;
@@ -23,9 +23,107 @@ export declare function defaultSessionMcpServerIds(servers: Iterable<{
  * `defaultMcpServerIds` is the current configured omitted-tools default.
  */
 export declare function resolveSessionToolPolicy(input: SessionToolPolicyInput): ResolvedSessionToolPolicy;
+/** Null is ordinary work; an empty list is a frozen scheduled selection. */
+export declare function scheduledTurnMcpServerIds(turn: Pick<SessionTurn, "metadata">): string[] | null;
+/** The accepted scheduled built-in selection, including an explicit empty list. */
+export declare function scheduledTurnFirstPartyMcpTools(turn: Pick<SessionTurn, "metadata">): FirstPartyMcpToolName[] | null;
+/**
+ * Execution's canonical turn selection. Ordinary turns use the durable session
+ * policy, not the queue's omitted-tools `[]`. Scheduled turns instead retain
+ * their frozen registry and refs, including an explicitly empty selection.
+ */
+export declare function resolveTurnToolPolicy(input: Omit<SessionToolPolicyInput, "sessionTools"> & {
+    session: Pick<Session, "tools">;
+    turn: Pick<SessionTurn, "tools" | "metadata">;
+}): ResolvedSessionToolPolicy;
+/** Resolve availability and defaults from the same subject-scoped registry read. */
+export declare function workspaceSessionToolPolicyContext(db: Database, workspaceId: string, settings: Settings, subjectId?: string, 
+/** An in-flight read of this exact workspace a caller already started. */
+workspaceRead?: ReturnType<typeof requireWorkspace>): Promise<{
+    workspaceServerIds: string[];
+    workspaceDefaultServerIds: string[];
+}>;
 /** Current full runtime registry IDs, including configured static servers. */
 export declare function workspaceSessionToolPolicyServerIds(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<string[]>;
 /** Current omitted-tools defaults: every configured runtime MCP is on. */
 export declare function workspaceSessionToolPolicyDefaultServerIds(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<string[]>;
+/**
+ * The omitted-tools default for one resolved runtime registry and one
+ * workspace settings bag. Pure so a caller that already holds both never has
+ * to re-query the capability registry to agree with the worker and the
+ * composer on which connectors a `workspace_default` session executes with.
+ */
+export declare function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers: Iterable<{
+    id: string;
+}>, workspaceSettings: unknown): string[];
+/** Metadata only: no MCP listing, provider probes, account selection or credentials. */
+export type SessionEffectiveToolsContext = {
+    settings: Settings;
+    humanInputEnabled: boolean;
+    hasWorkspaceSkills: boolean;
+    workspaceSettings?: unknown;
+    objectStorageAvailable: boolean;
+    activeSandboxBackends?: ReadonlyMap<string, Settings["sandboxBackend"]>;
+    /** Exact build options after adapter/credential resolution, keyed by session. No pool-readiness inference. */
+    mediaAttachments?: ReadonlyMap<string, AgentMediaAttachment>;
+    routerInHistory?: boolean;
+    routerHistorySessionIds?: ReadonlySet<string>;
+};
+/**
+ * Resolve one context for a response page, not one catalog per session. Legacy
+ * rows require no additional reads and never acquire an effectiveTools field.
+ */
+export declare function workspaceSessionEffectiveToolsContext(deps: {
+    db: Database;
+    settings: Settings;
+    objectStorage?: unknown;
+}, workspaceId: string, subjectId: string, sessions: readonly Session[], 
+/** An in-flight read of this exact workspace a caller already started. */
+workspaceRead?: ReturnType<typeof requireWorkspace>): Promise<SessionEffectiveToolsContext>;
+/** The server can prove attachment policy, not successful future provider calls. */
+export declare function sessionEffectiveToolProjectionInput(session: Session & {
+    agent: NonNullable<Session["agent"]>;
+}, toolRefs: readonly ToolRef[], context?: SessionEffectiveToolsContext): {
+    config: {
+        version: 1;
+        from: "all" | "none";
+        capabilities: {
+            webSearch: boolean;
+            humanInput: boolean;
+            skills: "manage" | "read" | false;
+            goals: boolean;
+            subagents: boolean;
+            knowledge: boolean;
+            schedules: boolean;
+            artifacts: boolean;
+            browser: boolean;
+            secrets: boolean;
+            media: boolean;
+            workspaceFiles: boolean;
+            workspaceConnectors: boolean;
+            workspaceAdmin: boolean;
+        };
+        unavailable: ("artifacts" | "browser" | "goals" | "humanInput" | "knowledge" | "media" | "schedules" | "secrets" | "skills" | "subagents" | "webSearch" | "workspaceAdmin" | "workspaceConnectors" | "workspaceFiles")[];
+        unavailableReasons?: Partial<Record<"artifacts" | "browser" | "goals" | "humanInput" | "knowledge" | "media" | "schedules" | "secrets" | "skills" | "subagents" | "webSearch" | "workspaceAdmin" | "workspaceConnectors" | "workspaceFiles", string>> | undefined;
+        identity: string | null;
+        renderer: "markdown" | "opengeni";
+        source: "deployment_default" | "inherited" | "legacy_conversion" | "request" | "workspace_default";
+    };
+    firstPartyMcpTools: ("admin_action_call" | "admin_action_describe" | "admin_actions_search" | "artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enable_screen_control" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "inbox_tidy" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notification_withdraw" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "secret_delete" | "secret_get" | "secret_move" | "secret_save" | "secret_search" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_message_status" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_target_get" | "session_target_set" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "site_data_define_collection" | "site_data_describe" | "site_data_export" | "site_data_import" | "site_data_query" | "site_data_reset" | "site_data_write" | "site_files_delete" | "site_files_list" | "site_files_upload" | "site_hostname_check" | "site_publication_apply_fix" | "site_publication_get" | "site_publication_update" | "site_sql_define_query" | "site_sql_enable" | "site_sql_execute" | "site_sql_export" | "site_sql_import" | "site_sql_inspect" | "site_sql_migrate" | "site_sql_query" | "site_sql_reset" | "site_sql_run" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+    firstPartyModelNames: Map<"admin_action_call" | "admin_action_describe" | "admin_actions_search" | "artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enable_screen_control" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "inbox_tidy" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notification_withdraw" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "secret_delete" | "secret_get" | "secret_move" | "secret_save" | "secret_search" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_message_status" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_target_get" | "session_target_set" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "site_data_define_collection" | "site_data_describe" | "site_data_export" | "site_data_import" | "site_data_query" | "site_data_reset" | "site_data_write" | "site_files_delete" | "site_files_list" | "site_files_upload" | "site_hostname_check" | "site_publication_apply_fix" | "site_publication_get" | "site_publication_update" | "site_sql_define_query" | "site_sql_enable" | "site_sql_execute" | "site_sql_export" | "site_sql_import" | "site_sql_inspect" | "site_sql_migrate" | "site_sql_query" | "site_sql_reset" | "site_sql_run" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch", string>;
+    nativeComputerTools: boolean;
+    mcpServerIds: string[];
+    productServerIds: ReadonlySet<string>;
+    environment: AgentToolEnvironment;
+    runtimeToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    hostedToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    sandboxToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    routerToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    upfrontToolNames: Set<string>;
+    mediaAttachment: AgentMediaAttachment | {
+        readonly image: null;
+        readonly video: false;
+    } | undefined;
+};
 /** Add a bounded, secret-safe effective projection to a session response. */
-export declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>): Session;
+export declare function sessionWithEffectiveToolPolicy(session: Session, workspaceServerIds: Iterable<string>, workspaceDefaultServerIds?: Iterable<string>, effectiveToolsContext?: SessionEffectiveToolsContext): Session;

package/dist/domain/sessions.d.ts

@@ -1,8 +1,13 @@
-import { type HostMcpCreateSelection } from "@opengeni/contracts/host-mcp-bindings";
+import type { SessionRetryRequest, SessionRetryResponse, SessionTurnSurface } from "@opengeni/contracts";
+import { type ProductUsageMetricsSink } from "../product-usage-metrics.js";
+import { type SessionStartObservability } from "./session-start-timing.js";
 import { type Settings } from "@opengeni/config";
-import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAuthoritySelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionAgentAccess, type SessionCommandReceipt, type SessionScopeSubjectId, type SessionMemoryScope, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type SessionAuthorizationPort, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
-import { type CreateSessionMcpServerInput, type Database, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor, type NewSessionDraftSnapshot } from "@opengeni/db";
+import type { CodeSearchDeploymentPolicy } from "@opengeni/contracts/code-search";
+import { type AgentConfigCreator, type ResolvedAgentConfig, type UpdateSessionAgentRequest, type VaultPolicy } from "@opengeni/contracts";
+import { SessionSpawnDenial, type AccessGrant, type ComposerDraft, type CreateSessionResponse, type GoalSpec, type FirstPartyMcpToolName, type McpPersonalConnectionDelegation, type McpConnectionAccountBinding, type ConnectionAccountIntent, type McpConnectionAccountSelection, type Permission, type PersonalResourceAttachmentIntent, type ReasoningEffort, type ResourceRef, type Session, type SessionAgentAccess, type SessionCommandReceipt, type SessionScopeSubjectId, type SessionMemoryScope, type SessionSkill, type SessionEvent, SessionMcpApprovalPolicy, SetSessionModelRequest, type SessionMcpCredentialUpdateInput, type SessionMcpServerMetadata, type SubmittedTimelineAnnotation, type TimelineAnnotation, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionToolPolicyRequest, type UpdateSessionSkillsRequest, type SessionAuthorizationPort, type SessionAuthorizationSurface, type SessionToolPolicy, type SessionTurn, type SessionPromptRouting, type SessionGoalSnapshot, type ToolRef, type TurnInitiator, type TurnInitiatorContext, type TurnExecutionPolicyV1, type VariableSet, type XaiProviderAccountAuthoritySnapshotV1, type ClaudeProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
+import { type SetSessionKeepLiveResult, type CreateSessionMcpServerInput, type Database, type FrozenTurnInitiator, type UpdateSessionMcpServerCredentialsInput, type SessionCommandActor, type NewSessionDraftSnapshot } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
+import { HTTPException } from "hono/http-exception";
 import { type AccessGrantAuthorization } from "../access/index.js";
 import type { AcceptSessionUserMessageDependencies, ApiRouteDeps, SessionWorkflowClient } from "../dependencies.js";
 /** Transport-neutral typed denial raised only after its audit row committed. */
@@ -34,6 +39,15 @@ export declare function resolveFirstPartyMcpToolsForCreate(requested: FirstParty
     default: readonly FirstPartyMcpToolName[];
     allowed: readonly FirstPartyMcpToolName[];
 }): FirstPartyMcpToolName[];
+/**
+ * An explicit first-party tool selection is a promise, not a best-effort
+ * default: a tool the deployment disables fails the request, naming every such
+ * tool and the allowed set, instead of silently shrinking the selection.
+ * `retained` names tools the caller may echo from its stored selection; those
+ * stay deployment-filtered like any default, so a later policy change never
+ * blocks an unrelated edit.
+ */
+export declare function requireDeploymentFirstPartyMcpTools(requested: readonly FirstPartyMcpToolName[], allowed: readonly FirstPartyMcpToolName[], retained?: Iterable<FirstPartyMcpToolName>, hint?: string): void;
 export declare function sessionSpawnDenialEnvelope(error: SessionSpawnDeniedError): {
     readonly error: {
         readonly code: "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
@@ -66,9 +80,17 @@ export type FrozenCreationInitiator = {
         type: "agent_attempt";
     }>;
 };
+/** Attribution is immutable accepted-work data, never the current request principal. */
+export declare function initiatingHumanForAllowance(frozen: Pick<FrozenTurnInitiator, "initiator" | "initiatingHumanSubjectId">): string | null;
 export declare function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationInitiator;
 export declare function normalizedSessionMcpCredentialHeaders(headers: Record<string, string> | undefined): Record<string, string>;
 export declare function settingsWithSessionMcpServerMetadata(settings: Settings, servers: SessionMcpServerMetadata[]): Settings;
+export declare function validateSessionMcpCredentialUpdates(input: {
+    settings: Settings;
+    grant: AccessGrant;
+    session: Session;
+    updates: SessionMcpCredentialUpdateInput[];
+}): UpdateSessionMcpServerCredentialsInput[];
 export type CreateSessionOutcome = {
     session: CreateSessionResponse;
     /** The committed create/start effect represented by this request. */
@@ -87,6 +109,26 @@ type AgentChildSessionCreatePresentation = {
      * This is deliberately separate from the public REST request contract. */
     automaticTitleCandidate?: string | null;
 };
+/** Trusted entry-point options for creating a session outside the REST body. */
+export type SessionCreateRequestOptions = {
+    /**
+     * Product surface when the entry point knows it (for example Slack or an
+     * in-process embedding host). Omitted derives it from the grant.
+     */
+    surface?: SessionTurnSurface;
+    /**
+     * Agent-configuration creator kind (renderer default and default-config
+     * policy). Omitted derives `slack` from a Slack surface, else the public API.
+     */
+    agentConfigCreator?: AgentConfigCreator;
+    /**
+     * Built-in tools to guarantee on top of the defaults a new session follows,
+     * for an entry point whose sessions need their own tools (a chat surface's
+     * read tools). Ignored when the request names an explicit built-in list.
+     * Trusted entry points only; not part of the public create request.
+     */
+    firstPartyMcpToolAdditions?: readonly FirstPartyMcpToolName[];
+};
 /** @internal Exported for the keyed-create repair regression. */
 export declare function freezeAgentChildAutomaticTitleInCreatorContext(context: TurnInitiatorContext | undefined, title: string | null | undefined): TurnInitiatorContext | undefined;
 /** @internal Keyed repair must use the committed winner, not the retry payload. */
@@ -106,7 +148,6 @@ export declare function createAndStartSessionWithOutcome(input: {
     captureInitialTurnAuthority?: (tx: Database, sessionId: string, turnId: string) => Promise<void>;
     /** Internal replay identity; the verified caller must also capture authority.
      * Supplying selection metadata alone never grants runtime use. */
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
     /** The custom workspace model was frozen by an earlier accepted boundary or
      * inherited from an existing session, so retirement must not invalidate it. */
     retainWorkspaceGatewayModel?: boolean;
@@ -121,6 +162,15 @@ export declare function createAndStartSessionWithOutcome(input: {
     workspaceId: string;
     visibility?: "user_private" | "workspace_shared";
     initialMessage: string;
+    /** Content-free product surface the create request entered through. */
+    surface?: SessionTurnSurface | null;
+    /**
+     * Live product usage counters: a newly created session (never a replay)
+     * counts once, and its initial user message once unless deferred.
+     */
+    metrics?: ProductUsageMetricsSink | null;
+    /** Optional content-free child spans; never a lifecycle dependency. */
+    startupObservability?: SessionStartObservability | null;
     /** Create the session shell without an initial user event/agent turn. */
     deferInitialTurn?: boolean;
     modelContext?: string | null;
@@ -158,15 +208,23 @@ export declare function createAndStartSessionWithOutcome(input: {
     policyRole?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
     firstPartyMcpTools: FirstPartyMcpToolName[];
+    agentConfig?: ResolvedAgentConfig | null;
+    vaultPolicy?: VaultPolicy;
     agentAccess?: SessionAgentAccess;
     scopeSubjectId?: SessionScopeSubjectId | null;
     memoryScope?: SessionMemoryScope;
     mcpServers?: CreateSessionMcpServerInput[];
+    mcpApprovalPolicies?: Record<string, SessionMcpApprovalPolicy>;
     sessionMcpServers?: SessionMcpServerMetadata[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
+    /** The creator's account intent, carried by work that continues the first turn. */
+    connectionAccountIntent?: ConnectionAccountIntent | null;
     initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
+    claudeProviderAccountAuthoritySnapshot?: ClaudeProviderAccountAuthoritySnapshotV1;
     parentSessionId?: string | null;
+    codeSearchDeploymentPolicy?: CodeSearchDeploymentPolicy;
     createIdempotencyKey?: string | null;
     selectedInstalledSkillIds?: string[];
     sandboxGroupId?: string | null;
@@ -202,6 +260,13 @@ export declare function createAndStartSessionWithOutcome(input: {
 /** Backward-compatible entity-returning create path used by existing callers. */
 export declare function createAndStartSession(input: Parameters<typeof createAndStartSessionWithOutcome>[0]): Promise<CreateSessionResponse>;
 export declare function workflowIdForSession(sessionId: string): string;
+/**
+ * The one 422 for a model that is not selectable in the live catalog (retired,
+ * removed, or never offered). The message keeps its historical text; the typed
+ * cause lets the API envelope add `details.code: "model_unavailable"` so
+ * clients can ask for another model instead of offering a futile retry.
+ */
+export declare function modelUnavailableHttpException(model: string): HTTPException;
 /**
  * Reject an explicit model that the host does not expose. The set of usable
  * models is the union surfaced by `configuredAllowedModels` (the built-in
@@ -210,8 +275,9 @@ export declare function workflowIdForSession(sessionId: string): string;
  * the API edge with 422 rather than enqueuing a turn the worker can't honor.
  *
  * `model` is the effective value selected by the caller's boundary. Top-level
- * omission defaults to `settings.openaiModel`; child-session omission inherits
- * the worker-signed calling turn before reaching this helper. Centralized here
+ * omission resolves the new-chat default (`resolveDefaultSessionModel`);
+ * child-session omission inherits the worker-signed calling turn before
+ * reaching this helper. Centralized here
  * so every model-carrying choke point
  * (create-session, user-message/turn-accept, queued-turn update, and
  * scheduled-task agentConfig — a scheduled task is a session the worker runs
@@ -238,10 +304,10 @@ export declare function assertSessionAllowsProductModel(session: Pick<Session, "
  * worker's authoritative post-resolution gate would fail. `model` is the
  * EFFECTIVE value the caller is about to persist: pass the explicit value at
  * message/turn-update/scheduled-task edges (omitted inherits an
- * already-validated stored default), but at session CREATION pass
- * `payload.model ?? settings.openaiModel` — an omitted model stamps the
- * deployment default onto the session, and under a restricted policy that
- * default may be exactly the provider the policy exists to block.
+ * already-validated stored default), but at session CREATION pass the
+ * effective model: an omitted model stamps the resolved default onto the
+ * session, and under a restricted policy that default may be exactly the
+ * provider the policy exists to block.
  */
 export declare function assertWorkspaceModelPolicyAllows(db: Database, settings: Settings, workspaceId: string, model: string | null | undefined): Promise<void>;
 export declare function requireQueuedTurnForApi(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<SessionTurn>;
@@ -281,11 +347,15 @@ type PostUserMessageTurnInput = {
     clientEventId?: string;
     mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
+    /** The sender's account intent, carried by work that continues this turn. */
+    connectionAccountIntent?: ConnectionAccountIntent | null;
     captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
     personalResourceAttachment?: PersonalResourceAttachmentIntent;
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
+    /** Content-free product surface the request entered through. */
+    surface?: SessionTurnSurface | null;
     actor?: string;
     actorLabel?: string;
     commandActor?: SessionCommandActor;
@@ -340,11 +410,13 @@ export declare function resolveSessionCreateScope(input: {
     };
     parent: SessionCreateScope | null;
 }): SessionCreateScope;
-declare function createSessionForRequestInFileScope(unresolvedDeps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown, authorization?: AccessGrantAuthorization, agentChildPresentation?: AgentChildSessionCreatePresentation): Promise<CreateSessionRequestOutcome>;
+/** Explicit recovery, never a new prompt or a Pause/Resume command. */
+export declare function retryFailedSession(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, sessionId: string, request: SessionRetryRequest): Promise<SessionRetryResponse>;
+declare function createSessionForRequestInFileScope(unresolvedDeps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown, authorization?: AccessGrantAuthorization, agentChildPresentation?: AgentChildSessionCreatePresentation, requestOptions?: SessionCreateRequestOptions): Promise<CreateSessionRequestOutcome>;
 /** @internal Fixed public projection; the committed session outcome remains authoritative. */
 export declare function reportSessionUsageRecordingFailure(_error: unknown): void;
 /** Backward-compatible entity-returning request path for REST and core callers. */
-export declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown, authorization?: AccessGrantAuthorization): Promise<CreateSessionResponse>;
+export declare function createSessionForRequest(deps: ApiRouteDeps, grant: AccessGrant, workspaceId: string, rawPayload: unknown, authorization?: AccessGrantAuthorization, requestOptions?: SessionCreateRequestOptions): Promise<CreateSessionResponse>;
 /**
  * Full accept-user-message flow shared by the `user.message` branch of
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
@@ -364,10 +436,14 @@ declare function acceptSessionUserMessageInFileScope(deps: AcceptSessionUserMess
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
-    connectionAuthorities?: McpConnectionAuthoritySelection[];
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
+    connectionAccounts?: McpConnectionAccountSelection[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
+    /**
+     * Product surface when the entry point knows it (for example Slack or an
+     * in-process embedding host). Omitted derives it from the grant.
+     */
+    surface?: SessionTurnSurface;
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
     personalResourceAttachment?: PersonalResourceAttachmentIntent;
@@ -408,6 +484,29 @@ export declare function updateSessionTitle(deps: {
     title: string | null;
     relatedSessionAccess: "target" | "root";
 }>;
+/**
+ * Set or clear the session's keep-live exemption from the idle-session archive.
+ * Archived sessions are read-only and reject the change.
+ */
+export declare function setSessionRetention(deps: {
+    db: Database;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, keepLive: boolean): Promise<{
+    result: SetSessionKeepLiveResult;
+    relatedSessionAccess: "target" | "root";
+}>;
+/** Change future defaults without accepting a prompt or touching accepted work. */
+export declare function setSessionModel(deps: Pick<ApiRouteDeps, "db" | "bus" | "settings" | "catalogSourceSettings" | "sessionAuthorization">, grant: AccessGrant, sessionId: string, request: SetSessionModelRequest, surface?: SessionAuthorizationSurface): Promise<{
+    model: string;
+    reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
+    latencyMode: "fast" | "priority" | "standard";
+    eventId: string;
+    receiptId: string;
+    timestamp: string;
+    replay: boolean;
+    sessionId: string;
+    effectiveFrom: "future_turns";
+}>;
 /**
  * Update one existing session MCP server's approval policy. The database
  * serializes this write with attempt claim under the session lock: an already
@@ -431,7 +530,72 @@ export declare function updateSessionToolPolicy(deps: {
     settings: Settings;
     sessionAuthorization?: SessionAuthorizationPort | null;
 }, grant: AccessGrant, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
+/**
+ * Replace a running session's agent configuration (`PUT .../agent`). Omitted
+ * request fields keep their current values; a legacy (null) session converts
+ * from its current effective state without widening. The configuration and
+ * its write-through to the legacy tool columns (and the instructions alias)
+ * commit under the same tool-policy version CAS, so tool-policy and agent
+ * updates cannot race. Effective from the next attempt. Agent callers may only
+ * narrow; a child never widens past its parent.
+ */
+export declare function updateSessionAgent(deps: {
+    db: Database;
+    bus: EventBus;
+    settings: Settings;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, request: UpdateSessionAgentRequest): Promise<Session>;
+/**
+ * Replace the Skills a session carries itself. The worker reads them at the
+ * start of every attempt, so the change applies from the next attempt; work
+ * already running keeps the Skill index it started with. Shares the
+ * tool-policy version (409 when stale) with the other agent-configuration
+ * writes. An agent may only remove Skills, never add or change one.
+ */
+export declare function updateSessionSkills(deps: {
+    db: Database;
+    bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+}, grant: AccessGrant, sessionId: string, request: UpdateSessionSkillsRequest): Promise<Session>;
 export declare function readSessionLineage(deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">, grant: AccessGrant, sessionId: string): Promise<import("@opengeni/db").SessionLineage>;
+/**
+ * A server attached in the same root create request is selected by that
+ * attachment. Neither `tools` (an allow-list over the workspace/deployment
+ * registry) nor the workspace-default expansion can name it, so without this
+ * the attached endpoint was stored but never contacted and the model saw no
+ * tools. This grants nothing beyond the attach itself: the caller already
+ * passed `mcp_servers:attach` for exactly this endpoint, and the server's own
+ * approval policy still governs every call. An explicit ref for the same id
+ * wins unchanged so a caller can still mark it `eager` or `optional`; the
+ * added ref is strict, exactly like listing `{ kind: "mcp", id }` explicitly.
+ * Child creates never reach here: an inherited snapshot keeps the parent's
+ * selection and a child may only narrow it.
+ */
+export declare function withSameRequestSessionMcpServerTools(tools: ToolRef[], attachedServers: ReadonlyArray<{
+    id: string;
+}>): ToolRef[];
+/**
+ * The executable MCP tool list a follow-up on an existing session freezes
+ * connector accounts against.
+ *
+ * A `workspace_default` session stores only the tool snapshot taken when it
+ * was created and expands the current workspace defaults at run time, so a
+ * connector enabled after creation never enters the stored column. The
+ * composer projects that same expansion and submits account selections for
+ * it, so freezing against the stored column rejected every such selection as
+ * unmatched and never froze its personal delegation. Resolve through the one
+ * ID-only policy resolver the API projection and the worker use, with the
+ * same omitted-tools default, so all three agree on the executable set.
+ */
+export declare function sessionToolsForConnectionAccounts(input: {
+    session: Pick<Session, "tools" | "toolPolicy">;
+    /** The resolved runtime registry, including session-local servers. */
+    runtimeMcpServers: Iterable<{
+        id: string;
+    }>;
+    /** The current omitted-tools default for this workspace. */
+    defaultMcpServerIds: Iterable<string>;
+}): ToolRef[];
 /** Keep original-file ownership scoped across admission, history hydration and setup. */
 export declare function createSessionForRequestWithOutcome(...args: Parameters<typeof createSessionForRequestInFileScope>): Promise<CreateSessionRequestOutcome>;
 export declare function acceptSessionUserMessageWithOutcome(...args: Parameters<typeof acceptSessionUserMessageInFileScope>): ReturnType<typeof acceptSessionUserMessageInFileScope>;

package/dist/domain/site-audience.d.ts

@@ -0,0 +1,52 @@
+import type { AccessGrant, WorkspaceArtifactVisibility } from "@opengeni/contracts";
+import { type Database, type WorkspaceArtifactViewer } from "@opengeni/db";
+import type { PrivacySettings } from "../application/organization-privacy.js";
+/**
+ * A Site has an audience, like a chat and a schedule: the whole workspace, or
+ * only its owner ("Only me"). Everyone with workspace access sees workspace
+ * Sites. An Only me Site is visible to its owner alone; admins cannot see it,
+ * exactly like an Only me chat. Only the owner changes the audience.
+ *
+ * Every surface that reads or changes Sites (HTTP, agent tools, the artifact
+ * library, Site tools and Site conversations) resolves its viewer here and
+ * passes it to the database layer, which filters by it.
+ */
+export declare const SITE_PRIVATE_OWNER_MESSAGE = "Only a person can have an Only me Site.";
+export declare const SITE_PRIVATE_DISABLED_MESSAGE = "Only me is turned off for this organization.";
+export declare const SITE_AUDIENCE_HUMAN_MESSAGE = "Only the Site's owner can change who can see it, from Opengeni.";
+/**
+ * The person a request reads Sites as: the human caller, or the human an exact
+ * agent attempt acts for. Keys, services and runs without a person see
+ * workspace Sites only.
+ */
+export declare function siteViewerForGrant(db: Database, grant: AccessGrant): Promise<WorkspaceArtifactViewer>;
+/**
+ * The audience and owner to store for a new Site. An explicit choice wins;
+ * Only me needs a person who may start Only me work here. Without one, a Site
+ * published from a chat starts with that chat's audience, so a Site made in an
+ * Only me chat stays Only me until its owner shares it. Anything else starts
+ * shared with the workspace, as every Site did before audiences existed.
+ */
+export declare function resolveNewSiteAudience(input: {
+    db: Database;
+    settings: PrivacySettings;
+    grant: AccessGrant;
+    viewer: WorkspaceArtifactViewer;
+    requested: WorkspaceArtifactVisibility | undefined;
+    sourceSessionId: string | null;
+}): Promise<{
+    visibility: "user_private" | "workspace_shared";
+    ownerSubjectId: string | null;
+}>;
+/**
+ * The stored audience for an owner's change. Sharing with the workspace is
+ * always allowed; limiting to Only me needs Only me to be allowed for them.
+ * Whether the caller owns the Site is checked atomically by the database.
+ */
+export declare function resolveSiteAudienceChange(input: {
+    db: Database;
+    settings: PrivacySettings;
+    grant: AccessGrant;
+    viewer: WorkspaceArtifactViewer;
+    requested: WorkspaceArtifactVisibility;
+}): Promise<"user_private" | "workspace_shared">;

package/dist/domain/skills.d.ts

@@ -1,4 +1,4 @@
-import type { SkillFile, SkillInstallInput, SkillRevisionInput, SkillSaveInput } from "@opengeni/contracts";
+import type { SkillFile, SkillInstallInput, SkillRevisionInput, SkillSaveInput, SkillRemoveInput } from "@opengeni/contracts";
 import { listSkillRecords, type Database, type SkillReadContext } from "@opengeni/db";
 export { replayPortableSkillInstall } from "@opengeni/db";
 /** Canonical text-only folder; rejects invalid Unicode before PostgreSQL conversion. */
@@ -6,8 +6,27 @@ export declare function validateSkillFiles(files: readonly SkillFile[]): SkillFi
 /** Separate from the historical SKILL.md hash, which must never be rewritten. */
 export declare function skillBundleHash(files: readonly SkillFile[]): string;
 export declare const listSkills: typeof listSkillRecords;
+export declare function removeSkill(db: Database, input: SkillRemoveInput): Promise<{
+    removed?: boolean | undefined;
+    operationId: string;
+    skillId: string;
+    revisionId: string;
+    outcome: "applied" | "pending" | "preserved";
+    decision?: "rejected" | undefined;
+    pendingReason?: "approval" | "source_finalization" | undefined;
+    skillReview?: {
+        removalOperationId?: string | undefined;
+        sourceOperationId: string;
+        skillId: string;
+        revisionId: string;
+        expectedRevisionId: string | null;
+        expectedScopeVersion: number;
+    } | undefined;
+    replayed: boolean;
+}>;
 export declare function readSkill(db: Database, context: SkillReadContext, skillId: string, revisionId?: string): Promise<import("@opengeni/contracts").SkillRecord | null>;
 export declare function saveSkill(db: Database, input: SkillSaveInput): Promise<{
+    removed?: boolean | undefined;
     operationId: string;
     skillId: string;
     revisionId: string;
@@ -15,6 +34,7 @@ export declare function saveSkill(db: Database, input: SkillSaveInput): Promise<
     decision?: "rejected" | undefined;
     pendingReason?: "approval" | "source_finalization" | undefined;
     skillReview?: {
+        removalOperationId?: string | undefined;
         sourceOperationId: string;
         skillId: string;
         revisionId: string;
@@ -24,6 +44,7 @@ export declare function saveSkill(db: Database, input: SkillSaveInput): Promise<
     replayed: boolean;
 }>;
 export declare function installSkill(db: Database, input: SkillInstallInput): Promise<{
+    removed?: boolean | undefined;
     operationId: string;
     skillId: string;
     revisionId: string;
@@ -31,6 +52,7 @@ export declare function installSkill(db: Database, input: SkillInstallInput): Pr
     decision?: "rejected" | undefined;
     pendingReason?: "approval" | "source_finalization" | undefined;
     skillReview?: {
+        removalOperationId?: string | undefined;
         sourceOperationId: string;
         skillId: string;
         revisionId: string;
@@ -40,6 +62,7 @@ export declare function installSkill(db: Database, input: SkillInstallInput): Pr
     replayed: boolean;
 }>;
 export declare function approveSkill(db: Database, input: SkillRevisionInput): Promise<{
+    removed?: boolean | undefined;
     operationId: string;
     skillId: string;
     revisionId: string;
@@ -47,6 +70,7 @@ export declare function approveSkill(db: Database, input: SkillRevisionInput): P
     decision?: "rejected" | undefined;
     pendingReason?: "approval" | "source_finalization" | undefined;
     skillReview?: {
+        removalOperationId?: string | undefined;
         sourceOperationId: string;
         skillId: string;
         revisionId: string;
@@ -56,6 +80,7 @@ export declare function approveSkill(db: Database, input: SkillRevisionInput): P
     replayed: boolean;
 }>;
 export declare function rejectSkill(db: Database, input: SkillRevisionInput): Promise<{
+    removed?: boolean | undefined;
     operationId: string;
     skillId: string;
     revisionId: string;
@@ -63,6 +88,7 @@ export declare function rejectSkill(db: Database, input: SkillRevisionInput): Pr
     decision?: "rejected" | undefined;
     pendingReason?: "approval" | "source_finalization" | undefined;
     skillReview?: {
+        removalOperationId?: string | undefined;
         sourceOperationId: string;
         skillId: string;
         revisionId: string;
@@ -72,6 +98,7 @@ export declare function rejectSkill(db: Database, input: SkillRevisionInput): Pr
     replayed: boolean;
 }>;
 export declare function restoreSkill(db: Database, input: SkillRevisionInput): Promise<{
+    removed?: boolean | undefined;
     operationId: string;
     skillId: string;
     revisionId: string;
@@ -79,6 +106,7 @@ export declare function restoreSkill(db: Database, input: SkillRevisionInput): P
     decision?: "rejected" | undefined;
     pendingReason?: "approval" | "source_finalization" | undefined;
     skillReview?: {
+        removalOperationId?: string | undefined;
         sourceOperationId: string;
         skillId: string;
         revisionId: string;