@opengeni/db 0.19.0 → 0.22.1

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 export { isCodexBilledModel } from "@opengeni/codex";
@@ -15,6 +15,7 @@ export * from "./new-session-drafts";
 export * from "./workspace-instruction-policies";
 export * from "./preference-registry";
 export * from "./memory-governance";
+export * from "./scoped-knowledge";
 export { interruptedToolCallResult } from "./session-tool-call-settlement";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
 export { decryptEnvironmentValue as decryptVariableSetValue, encryptEnvironmentValue as encryptVariableSetValue, } from "./environment-crypto";
@@ -603,6 +604,10 @@ export type CreateScheduledTaskInput = {
     runMode: ScheduledTaskRunMode;
     overlapPolicy: ScheduledTaskOverlapPolicy;
     agentConfig: ScheduledTaskAgentConfig;
+    createdBy?: TurnInitiator;
+    createdByContext?: TurnInitiatorContext;
+    createdByActor?: AgentSessionCreationActor | null;
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     variableSetId?: string | null;
     rigId?: string | null;
     metadata: Record<string, unknown>;
@@ -614,6 +619,7 @@ export type UpdateScheduledTaskInput = Partial<{
     runMode: ScheduledTaskRunMode;
     overlapPolicy: ScheduledTaskOverlapPolicy;
     agentConfig: ScheduledTaskAgentConfig;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
     reusableSessionId: string | null;
     variableSetId: string | null;
     rigId: string | null;
@@ -1002,6 +1008,7 @@ export type EnqueueSessionTurnInput = {
     lineage?: Record<string, unknown>;
     initiator: TurnInitiator;
     initiatorContext?: TurnInitiatorContext;
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     /** Steer inserts before all waiting prompts; Send appends after them. */
     placement?: "head" | "tail";
 };
@@ -1011,6 +1018,7 @@ export type EnqueueSessionTurnInput = {
  */
 export type SessionTurnForExecution = SessionTurn & {
     turnInstructions: string | null;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
 };
 export declare function createFileUpload(db: Database, input: {
     accountId: string;
@@ -1608,6 +1616,7 @@ export declare function listSocialPosts(db: Database, options: {
 export declare function createScheduledTask(db: Database, input: CreateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function updateScheduledTask(db: Database, workspaceId: string, taskId: string, input: UpdateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
+export declare function getScheduledTaskPersonalConnectionDelegations(db: Database, workspaceId: string, taskId: string): Promise<McpPersonalConnectionDelegation[]>;
 export declare function requireScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export declare function listScheduledTasks(db: Database, workspaceId: string, limit?: number): Promise<ScheduledTask[]>;
 export declare function deleteScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<void>;
@@ -2750,6 +2759,89 @@ export declare function updateSessionMcpApprovalPolicy(db: Database, input: {
     requireApproval: SessionMcpApprovalPolicy;
 }): Promise<UpdateSessionMcpApprovalPolicyResult>;
 export declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, attemptId: string, encryptionKey: Uint8Array | null): Promise<SessionMcpServerForRun[]>;
+export type ConnectorActionPolicyDecision = schema.ConnectorActionPolicyDecision;
+export type ConnectorActionPolicySnapshotEntry = schema.ConnectorActionPolicySnapshotEntry;
+export type ConnectorActionAttemptIdentity = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    initiator: Pick<TurnInitiator, "kind" | "subjectId">;
+};
+export type ConnectorActionInvocation = {
+    approvalId: string;
+    connectionId?: string | null;
+    serverId: string;
+    toolName: string;
+    arguments: unknown;
+};
+export type PrepareConnectorActionApprovalResult = {
+    managed: false;
+    decision: "unmanaged";
+} | {
+    managed: true;
+    decision: ConnectorActionPolicyDecision;
+    requestId?: string;
+    actionFingerprint: string;
+};
+export type BeginConnectorActionExecutionResult = {
+    allowed: true;
+    managed: false;
+} | {
+    allowed: true;
+    managed: true;
+    requestId: string;
+    actionFingerprint: string;
+} | {
+    allowed: false;
+    managed: true;
+    reason: "approval_required" | "blocked" | "rejected" | "already_executed" | "uncertain_retry";
+    requestId: string;
+    actionFingerprint: string;
+};
+type ResolvedConnectorActionPolicy = {
+    managed: false;
+} | {
+    managed: true;
+    source: "explicit";
+    entry: ConnectorActionPolicySnapshotEntry;
+} | {
+    managed: true;
+    source: "ambiguous";
+    entry: null;
+    decision: "block";
+};
+/** Resolve one immutable attempt snapshot with exact-over-wildcard precedence. */
+export declare function resolveConnectorActionPolicy(snapshot: readonly ConnectorActionPolicySnapshotEntry[], input: {
+    connectionId: string;
+    serverId: string;
+    toolName: string;
+    actionName: string;
+}): ResolvedConnectorActionPolicy;
+export declare function upsertConnectorActionPolicy(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    serverId: string;
+    toolName: string;
+    actionName: string;
+    policy: ConnectorActionPolicyDecision;
+}): Promise<{
+    policy: typeof schema.connectorActionPolicies.$inferSelect;
+    changed: boolean;
+}>;
+export declare function prepareConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
+export declare function beginConnectorActionExecution(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<BeginConnectorActionExecutionResult>;
+export declare function completeConnectorActionExecution(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    requestId: string;
+    attemptId: string;
+    outcome: "completed" | "uncertain";
+}): Promise<void>;
 /** Read the persisted deployment fallback; process configuration is not policy authority. */
 export declare function getNestedAgentDepthDeploymentPolicy(db: Database): Promise<NestedAgentDepthDeploymentPolicy>;
 type AgentSessionCreationActor = Extract<SessionCommandActor, {
@@ -2787,6 +2879,7 @@ export type SessionCreateInput = {
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
     mcpServers?: CreateSessionMcpServerInput[];
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     maxNestedAgentDepthOverride?: number | null;
     allowNestedAgentDepthIncrease?: boolean;
     subjectId?: string | null;
@@ -2815,6 +2908,8 @@ export declare function createSessionWithIdempotencyKey(db: Database, input: Ses
 }): Promise<SessionCreateSuccessResult>;
 export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
 export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+export declare function getSessionTurnPersonalConnectionDelegations(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<McpPersonalConnectionDelegation[]>;
+export declare function getSessionParentPersonalConnectionDelegations(db: Database, workspaceId: string, childSessionId: string): Promise<McpPersonalConnectionDelegation[]>;
 export declare function getSessionSpawnDenial(db: Database, workspaceId: string, denialId: string): Promise<SessionSpawnDenial | null>;
 export declare function getSessionSpawnDenialByIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<SessionSpawnDenial | null>;
 export declare function listSessionSpawnDenials(db: Database, workspaceId: string, options?: {
@@ -2943,6 +3038,15 @@ export declare function setSessionPin(db: Database, input: {
 }): Promise<Session | null>;
 export declare function listSessions(db: Database, workspaceId: string, limit?: number): Promise<Session[]>;
 export declare function listSessions(db: Database, workspaceId: string, options?: ListSessionsOptions): Promise<Session[]>;
+/**
+ * Return the model most recently chosen by one human subject in their own
+ * workspace sessions. A later subject-initiated turn supersedes the session's
+ * creation-time default; sessions with no such turn fall back to sessions.model.
+ * Turn timestamp ties use queue position then UUID, and session ties use the
+ * immutable session timestamp/UUID. Other subjects' turns never influence the
+ * result. The workspace filter remains authoritative under FORCE RLS.
+ */
+export declare function getLatestSessionModelForSubject(db: Database, workspaceId: string, subjectId: string): Promise<string | null>;
 export type SessionDiscoveryOrderBy = "createdAt" | "updatedAt";
 export type SessionDiscoveryCursor = {
     orderBy: SessionDiscoveryOrderBy;
@@ -6247,6 +6351,7 @@ export type SessionSystemUpdateOutboxDelivery = {
     summary: string;
     payload: ChildTerminalResultPayload;
     lineage: Record<string, unknown>;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
 };
 /**
  * Read the exact durable parent-update row created by terminal turn settlement.
@@ -6349,6 +6454,7 @@ export type AddSessionSystemUpdateInput = {
     dedupeKey: string;
     summary: string;
     lineage?: Record<string, unknown>;
+    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
 } & SessionSystemUpdateInputVariant;
 export type AddSessionSystemUpdateResult = {
     added: false;
@@ -6391,6 +6497,7 @@ export declare function acceptSessionApprovalDecision(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    subjectId: string;
     payload: Record<string, unknown>;
     clientEventId?: string | null;
 }): Promise<AcceptSessionApprovalDecisionResult>;