@opengeni/api-router 0.26.1 → 0.30.1

package/dist/app.d.ts

@@ -18,6 +18,7 @@ export declare function createAppComposition(deps: AppDependencies): {
     routeDeps: ApiRouteDeps;
 };
 export declare function appendVary(current: string | null, value: string): string;
+export declare function workspaceActorContextExempt(method: string, pathname: string): boolean;
 export declare function httpStatusForError(error: unknown): number;
 export declare function errorCodeForStatus(status: number): ErrorCode;
 export declare function routeLabel(pathname: string): string;

package/dist/app.js

@@ -21,8 +21,9 @@ import {
   validateGitHubRepositorySelectionShapes,
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
-  workflowIdForSession
-} from "./chunk-JIKNR5YL.js";
+  workflowIdForSession,
+  workspaceActorContextExempt
+} from "./chunk-2PQMSRCB.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,
@@ -46,6 +47,7 @@ export {
   validateGitHubRepositorySelectionShapes,
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
-  workflowIdForSession
+  workflowIdForSession,
+  workspaceActorContextExempt
 };
 //# sourceMappingURL=app.js.map

package/dist/auth/canonical-human-session-admission.d.ts

@@ -0,0 +1,27 @@
+import type { CanonicalHumanIdentityStatus, CanonicalHumanLoginBindingStatus, CanonicalHumanRecoveryState } from "@opengeni/contracts/canonical-human-identities";
+export type CanonicalHumanSessionAdmissionIntent = "ordinary_session" | "binding_synchronization" | "recovery_completion";
+export type CanonicalHumanIdentityAdmissionSnapshot = {
+    readonly id: string;
+    readonly status: CanonicalHumanIdentityStatus;
+    readonly recoveryState: CanonicalHumanRecoveryState;
+    readonly activeLoginBindingId: string | null;
+};
+export type CanonicalHumanLoginBindingAdmissionSnapshot = {
+    readonly id: string;
+    readonly identityId: string;
+    readonly status: CanonicalHumanLoginBindingStatus;
+};
+export type CanonicalHumanSessionAdmissionDenialCode = "identity_binding_mismatch" | "ordinary_identity_not_active" | "ordinary_identity_not_ready" | "ordinary_binding_missing" | "ordinary_binding_not_active" | "ordinary_active_binding_missing" | "recovery_identity_not_required" | "recovery_state_not_required" | "recovery_active_binding_present" | "recovery_binding_missing" | "recovery_binding_not_pending";
+export type CanonicalHumanSessionAdmissionDecision = {
+    allowed: true;
+    intent: CanonicalHumanSessionAdmissionIntent;
+} | {
+    allowed: false;
+    intent: CanonicalHumanSessionAdmissionIntent;
+    code: CanonicalHumanSessionAdmissionDenialCode;
+};
+export declare function decideCanonicalHumanSessionAdmission(input: {
+    intent: CanonicalHumanSessionAdmissionIntent;
+    identity: CanonicalHumanIdentityAdmissionSnapshot;
+    binding: CanonicalHumanLoginBindingAdmissionSnapshot | null;
+}): CanonicalHumanSessionAdmissionDecision;

package/dist/browser-auth-broker.d.ts

@@ -0,0 +1,20 @@
+import type { BrowserProtectedAuthFieldValue, ProtectedAuthField, SiteAuthAuthority } from "@opengeni/contracts";
+type ConnectionFieldsAuthority = Extract<SiteAuthAuthority, {
+    kind: "connection_fields";
+}>;
+export declare class BrowserAuthCredentialError extends Error {
+    readonly name = "BrowserAuthCredentialError";
+}
+export declare function resolveProtectedAuthFieldValues(input: {
+    authority: ConnectionFieldsAuthority;
+    requestedFields: readonly ProtectedAuthField[];
+    credential: Readonly<Record<string, unknown>>;
+    nowMs?: number;
+}): BrowserProtectedAuthFieldValue[];
+export declare function totpCode(secretValue: string, options?: {
+    digits?: number;
+    periodSeconds?: number;
+    algorithm?: "sha1" | "sha256" | "sha512";
+    nowMs?: number;
+}): string;
+export {};

package/dist/browser-controller-authority.d.ts

@@ -1,4 +1,4 @@
-import type { InteractionPlacement } from "@opengeni/contracts";
+import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
 type BrowserControllerAuthorityScope = {
     rootSecret: string;
     accountId: string;
@@ -26,6 +26,24 @@ export declare function deriveBrowserSessionControllerTokens(scope: BrowserSessi
     controlToken: string;
     viewToken: string;
 };
+/** Secret-safe durable identity for one exact route launch. The digest binds
+ * the route snapshot and proxy credential without making a password-verifier
+ * hash available to database readers. */
+export declare function deriveBrowserNetworkRouteAuthorityDigest(scope: {
+    rootSecret: string;
+    accountId: string;
+    workspaceId: string;
+    browserSessionId: string;
+    routeId: string;
+    routeVersion: number;
+    credentialVersion: number | null;
+    configuration: NetworkRouteConfiguration;
+    consistency: NetworkRouteConsistency;
+    proxyCredential: {
+        username: string;
+        password: string;
+    } | null;
+}): string;
 export declare function deriveBrowserViewGrantToken(scope: BrowserSessionAuthorityScope & {
     grantId: string;
     expiresAt: string;

package/dist/browser-network-route.d.ts

@@ -0,0 +1,8 @@
+import type { InteractionPlacement, NetworkRouteConfiguration, NetworkRouteConsistency } from "@opengeni/contracts";
+import type { PlacementBrowserNetworkRoute } from "@opengeni/runtime/sandbox";
+/** Resolve one provider-neutral managed route into the exact private selector
+ * accepted by the chosen external browser placement. Unsupported guarantees
+ * fail before lifecycle dispatch; no provider API key enters this value. */
+export declare function managedNetworkRouteForPlacement(configuration: Extract<NetworkRouteConfiguration, {
+    kind: "managed";
+}>, consistency: NetworkRouteConsistency, placement: InteractionPlacement): NonNullable<PlacementBrowserNetworkRoute["providerRoute"]>;