@opengeni/api-router 0.23.1 → 0.30.0

package/dist/app.d.ts

@@ -1,10 +1,11 @@
 import { type ErrorCode } from "@opengeni/contracts";
 import { Hono } from "hono";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
+export { allowedCorsOrigin } from "./http/cors.js";
 export type { ApiRouteDeps, AppDependencies, DocumentIndexClient, ObjectStorageDependency, SessionWorkflowClient, } from "@opengeni/core";
 export { mergeResourceRefs, mergeToolRefs, normalizeResources, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateToolRefs, withDefaultEnabledCapabilityMcpTools, } from "@opengeni/core";
 export { workflowIdForSession } from "@opengeni/core";
-export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
+export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse.js";
 export declare const API_MAX_REQUEST_BODY_BYTES: number;
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export declare function apiRequestBodyLimitBytes(settings: {
@@ -17,7 +18,7 @@ export declare function createAppComposition(deps: AppDependencies): {
     routeDeps: ApiRouteDeps;
 };
 export declare function appendVary(current: string | null, value: string): string;
-export declare function allowedCorsOrigin(pattern: string, origin: string): boolean;
+export declare function workspaceActorContextExempt(method: string, pathname: string): boolean;
 export declare function httpStatusForError(error: unknown): number;
 export declare function errorCodeForStatus(status: number): ErrorCode;
 export declare function routeLabel(pathname: string): string;

package/dist/app.js

@@ -21,8 +21,9 @@ import {
   validateGitHubRepositorySelectionShapes,
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
-  workflowIdForSession
-} from "./chunk-T4T2PGU4.js";
+  workflowIdForSession,
+  workspaceActorContextExempt
+} from "./chunk-2PQMSRCB.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,
@@ -46,6 +47,7 @@ export {
   validateGitHubRepositorySelectionShapes,
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
-  workflowIdForSession
+  workflowIdForSession,
+  workspaceActorContextExempt
 };
 //# sourceMappingURL=app.js.map

package/dist/auth/canonical-human-session-admission.d.ts

@@ -0,0 +1,27 @@
+import type { CanonicalHumanIdentityStatus, CanonicalHumanLoginBindingStatus, CanonicalHumanRecoveryState } from "@opengeni/contracts/canonical-human-identities";
+export type CanonicalHumanSessionAdmissionIntent = "ordinary_session" | "binding_synchronization" | "recovery_completion";
+export type CanonicalHumanIdentityAdmissionSnapshot = {
+    readonly id: string;
+    readonly status: CanonicalHumanIdentityStatus;
+    readonly recoveryState: CanonicalHumanRecoveryState;
+    readonly activeLoginBindingId: string | null;
+};
+export type CanonicalHumanLoginBindingAdmissionSnapshot = {
+    readonly id: string;
+    readonly identityId: string;
+    readonly status: CanonicalHumanLoginBindingStatus;
+};
+export type CanonicalHumanSessionAdmissionDenialCode = "identity_binding_mismatch" | "ordinary_identity_not_active" | "ordinary_identity_not_ready" | "ordinary_binding_missing" | "ordinary_binding_not_active" | "ordinary_active_binding_missing" | "recovery_identity_not_required" | "recovery_state_not_required" | "recovery_active_binding_present" | "recovery_binding_missing" | "recovery_binding_not_pending";
+export type CanonicalHumanSessionAdmissionDecision = {
+    allowed: true;
+    intent: CanonicalHumanSessionAdmissionIntent;
+} | {
+    allowed: false;
+    intent: CanonicalHumanSessionAdmissionIntent;
+    code: CanonicalHumanSessionAdmissionDenialCode;
+};
+export declare function decideCanonicalHumanSessionAdmission(input: {
+    intent: CanonicalHumanSessionAdmissionIntent;
+    identity: CanonicalHumanIdentityAdmissionSnapshot;
+    binding: CanonicalHumanLoginBindingAdmissionSnapshot | null;
+}): CanonicalHumanSessionAdmissionDecision;

package/dist/browser-auth-broker.d.ts

@@ -0,0 +1,20 @@
+import type { BrowserProtectedAuthFieldValue, ProtectedAuthField, SiteAuthAuthority } from "@opengeni/contracts";
+type ConnectionFieldsAuthority = Extract<SiteAuthAuthority, {
+    kind: "connection_fields";
+}>;
+export declare class BrowserAuthCredentialError extends Error {
+    readonly name = "BrowserAuthCredentialError";
+}
+export declare function resolveProtectedAuthFieldValues(input: {
+    authority: ConnectionFieldsAuthority;
+    requestedFields: readonly ProtectedAuthField[];
+    credential: Readonly<Record<string, unknown>>;
+    nowMs?: number;
+}): BrowserProtectedAuthFieldValue[];
+export declare function totpCode(secretValue: string, options?: {
+    digits?: number;
+    periodSeconds?: number;
+    algorithm?: "sha1" | "sha256" | "sha512";
+    nowMs?: number;
+}): string;
+export {};

package/dist/browser-controller-authority.d.ts

@@ -0,0 +1,61 @@
+import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
+type BrowserControllerAuthorityScope = {
+    rootSecret: string;
+    accountId: string;
+    workspaceId: string;
+    placement: InteractionPlacement;
+    placementInstanceId: string;
+};
+type BrowserSessionAuthorityScope = BrowserControllerAuthorityScope & {
+    browserSessionId: string;
+    controllerGeneration: string;
+    tokenGeneration: number;
+};
+type ComputerSessionAuthorityScope = BrowserControllerAuthorityScope & {
+    computerSessionId: string;
+    controllerGeneration: string;
+    tokenGeneration: number;
+};
+/** Stable placement-admin authority. This token is installed owner-only inside
+ * the exact placement and is never persisted or returned by the public API. */
+export declare function deriveBrowserControllerAdminToken(scope: BrowserControllerAuthorityScope): string;
+/** Deterministic controller credentials. The durable generations are the only
+ * stored authority; plaintext tokens can be reconstructed only by API replicas
+ * holding the deployment HMAC root. */
+export declare function deriveBrowserSessionControllerTokens(scope: BrowserSessionAuthorityScope): {
+    controlToken: string;
+    viewToken: string;
+};
+/** Secret-safe durable identity for one exact route launch. The digest binds
+ * the route snapshot and proxy credential without making a password-verifier
+ * hash available to database readers. */
+export declare function deriveBrowserNetworkRouteAuthorityDigest(scope: {
+    rootSecret: string;
+    accountId: string;
+    workspaceId: string;
+    browserSessionId: string;
+    routeId: string;
+    routeVersion: number;
+    credentialVersion: number | null;
+    configuration: NetworkRouteConfiguration;
+    consistency: NetworkRouteConsistency;
+    proxyCredential: {
+        username: string;
+        password: string;
+    } | null;
+}): string;
+export declare function deriveBrowserViewGrantToken(scope: BrowserSessionAuthorityScope & {
+    grantId: string;
+    expiresAt: string;
+}): string;
+/** ComputerSession credentials share the placement controller root while using
+ * resource-specific domains. Browser and computer authority cannot collide. */
+export declare function deriveComputerSessionControllerTokens(scope: ComputerSessionAuthorityScope): {
+    controlToken: string;
+    viewToken: string;
+};
+export declare function deriveComputerViewGrantToken(scope: ComputerSessionAuthorityScope & {
+    grantId: string;
+    expiresAt: string;
+}): string;
+export {};

package/dist/browser-network-route.d.ts

@@ -0,0 +1,8 @@
+import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
+import type { PlacementBrowserNetworkRoute } from "@opengeni/runtime/sandbox";
+/** Resolve one provider-neutral managed route into the exact private selector
+ * accepted by the chosen external browser placement. Unsupported guarantees
+ * fail before lifecycle dispatch; no provider API key enters this value. */
+export declare function managedNetworkRouteForPlacement(configuration: Extract<NetworkRouteConfiguration, {
+    kind: "managed";
+}>, consistency: NetworkRouteConsistency, placement: InteractionPlacement): NonNullable<PlacementBrowserNetworkRoute["providerRoute"]>;

package/dist/browser-state-authority.d.ts

@@ -0,0 +1,27 @@
+export type BrowserStateOperationScope = {
+    accountId: string;
+    workspaceId: string;
+    browserSessionId: string;
+    operationId: string;
+    objectKey: string;
+};
+export type BrowserStateArtifactScope = {
+    accountId: string;
+    workspaceId: string;
+    objectKey: string;
+    artifactDigest: string;
+    contentDigest: string;
+};
+/** Deterministic only within one idempotent publication operation. This lets a
+ * control-plane retry present browserd with exactly the same secret authority
+ * without storing a plaintext key or placing it in an operation row. */
+export declare function deriveBrowserStateDataKey(rootKey: Uint8Array, scopeInput: BrowserStateOperationScope): Buffer;
+/** Associated data for the encrypted profile object. It is reproducible from
+ * durable non-secret artifact authority during restore. */
+export declare function browserStateArtifactAad(scopeInput: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">): Buffer;
+/** Wrap a 32-byte artifact data key under the operator-held root key. The
+ * ciphertext is bound to workspace, object, and both integrity digests. */
+export declare function wrapBrowserStateDataKey(rootKey: Uint8Array, dataKeyInput: Uint8Array, scopeInput: BrowserStateArtifactScope): string;
+export declare function unwrapBrowserStateDataKey(rootKey: Uint8Array, wrapped: string, scopeInput: BrowserStateArtifactScope): Buffer;
+export declare function browserStateObjectKey(workspaceIdInput: string, operationIdInput: string): string;
+export declare function browserStateManifestDigest(manifest: unknown): string;