@opengeni/api-router 0.22.2 → 0.26.1

package/dist/app.d.ts

@@ -1,10 +1,11 @@
 import { type ErrorCode } from "@opengeni/contracts";
 import { Hono } from "hono";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
+export { allowedCorsOrigin } from "./http/cors.js";
 export type { ApiRouteDeps, AppDependencies, DocumentIndexClient, ObjectStorageDependency, SessionWorkflowClient, } from "@opengeni/core";
 export { mergeResourceRefs, mergeToolRefs, normalizeResources, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateToolRefs, withDefaultEnabledCapabilityMcpTools, } from "@opengeni/core";
 export { workflowIdForSession } from "@opengeni/core";
-export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
+export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse.js";
 export declare const API_MAX_REQUEST_BODY_BYTES: number;
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export declare function apiRequestBodyLimitBytes(settings: {
@@ -17,7 +18,6 @@ export declare function createAppComposition(deps: AppDependencies): {
     routeDeps: ApiRouteDeps;
 };
 export declare function appendVary(current: string | null, value: string): string;
-export declare function allowedCorsOrigin(pattern: string, origin: string): boolean;
 export declare function httpStatusForError(error: unknown): number;
 export declare function errorCodeForStatus(status: number): ErrorCode;
 export declare function routeLabel(pathname: string): string;

package/dist/app.js

@@ -22,7 +22,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-HWXJW5C7.js";
+} from "./chunk-JIKNR5YL.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/auth/managed-auth.d.ts

@@ -3,33 +3,3 @@ import { type ManagedAuth } from "@opengeni/core";
 import type { Database } from "@opengeni/db";
 export type { ManagedAuth };
 export declare function createManagedAuth(settings: Settings, db: Database): ManagedAuth | null;
-export declare function managedSessionAccessContext(auth: ManagedAuth, db: Database, headers: Headers): Promise<{
-    mode: "configured" | "local" | "managed";
-    subjectId: string;
-    subjectLabel?: string | undefined;
-    accountGrants: {
-        accountId: string;
-        subjectId: string;
-        subjectLabel?: string | undefined;
-        role?: "admin" | "member" | "owner" | undefined;
-        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "toolspace:call" | "variable-sets:manage" | "variable-sets:use" | "workspace:admin" | "workspace:create" | "workspace:read")[];
-        metadata?: Record<string, unknown> | undefined;
-    }[];
-    workspaceGrants: {
-        workspaceId: string;
-        accountId: string;
-        subjectId: string;
-        subjectLabel?: string | undefined;
-        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "toolspace:call" | "variable-sets:manage" | "variable-sets:use" | "workspace:admin" | "workspace:create" | "workspace:read")[];
-        principalKind?: "agent_attempt" | "api_key" | "configured_key" | "human_session" | "service" | undefined;
-        metadata?: Record<string, unknown> | undefined;
-        serviceInitiator?: {
-            kind: "service";
-            subjectId: string;
-            label?: string | undefined;
-        } | undefined;
-        serviceInitiatorContext?: Record<string, unknown> | undefined;
-    }[];
-    defaultAccountId: string | null;
-    defaultWorkspaceId: string | null;
-} | null>;

package/dist/browser-controller-authority.d.ts

@@ -0,0 +1,43 @@
+import type { InteractionPlacement } from "@opengeni/contracts";
+type BrowserControllerAuthorityScope = {
+    rootSecret: string;
+    accountId: string;
+    workspaceId: string;
+    placement: InteractionPlacement;
+    placementInstanceId: string;
+};
+type BrowserSessionAuthorityScope = BrowserControllerAuthorityScope & {
+    browserSessionId: string;
+    controllerGeneration: string;
+    tokenGeneration: number;
+};
+type ComputerSessionAuthorityScope = BrowserControllerAuthorityScope & {
+    computerSessionId: string;
+    controllerGeneration: string;
+    tokenGeneration: number;
+};
+/** Stable placement-admin authority. This token is installed owner-only inside
+ * the exact placement and is never persisted or returned by the public API. */
+export declare function deriveBrowserControllerAdminToken(scope: BrowserControllerAuthorityScope): string;
+/** Deterministic controller credentials. The durable generations are the only
+ * stored authority; plaintext tokens can be reconstructed only by API replicas
+ * holding the deployment HMAC root. */
+export declare function deriveBrowserSessionControllerTokens(scope: BrowserSessionAuthorityScope): {
+    controlToken: string;
+    viewToken: string;
+};
+export declare function deriveBrowserViewGrantToken(scope: BrowserSessionAuthorityScope & {
+    grantId: string;
+    expiresAt: string;
+}): string;
+/** ComputerSession credentials share the placement controller root while using
+ * resource-specific domains. Browser and computer authority cannot collide. */
+export declare function deriveComputerSessionControllerTokens(scope: ComputerSessionAuthorityScope): {
+    controlToken: string;
+    viewToken: string;
+};
+export declare function deriveComputerViewGrantToken(scope: ComputerSessionAuthorityScope & {
+    grantId: string;
+    expiresAt: string;
+}): string;
+export {};

package/dist/browser-state-authority.d.ts

@@ -0,0 +1,27 @@
+export type BrowserStateOperationScope = {
+    accountId: string;
+    workspaceId: string;
+    browserSessionId: string;
+    operationId: string;
+    objectKey: string;
+};
+export type BrowserStateArtifactScope = {
+    accountId: string;
+    workspaceId: string;
+    objectKey: string;
+    artifactDigest: string;
+    contentDigest: string;
+};
+/** Deterministic only within one idempotent publication operation. This lets a
+ * control-plane retry present browserd with exactly the same secret authority
+ * without storing a plaintext key or placing it in an operation row. */
+export declare function deriveBrowserStateDataKey(rootKey: Uint8Array, scopeInput: BrowserStateOperationScope): Buffer;
+/** Associated data for the encrypted profile object. It is reproducible from
+ * durable non-secret artifact authority during restore. */
+export declare function browserStateArtifactAad(scopeInput: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">): Buffer;
+/** Wrap a 32-byte artifact data key under the operator-held root key. The
+ * ciphertext is bound to workspace, object, and both integrity digests. */
+export declare function wrapBrowserStateDataKey(rootKey: Uint8Array, dataKeyInput: Uint8Array, scopeInput: BrowserStateArtifactScope): string;
+export declare function unwrapBrowserStateDataKey(rootKey: Uint8Array, wrapped: string, scopeInput: BrowserStateArtifactScope): Buffer;
+export declare function browserStateObjectKey(workspaceIdInput: string, operationIdInput: string): string;
+export declare function browserStateManifestDigest(manifest: unknown): string;