@opengeni/api-router 1.4.5-canary.38533006839001 → 2.0.1

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-LWJIMOGC.js";
+} from "./chunk-ZDTWXRFX.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/attached-browser-viewer.d.ts

@@ -0,0 +1,11 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { AttachedBrowserViewer } from "@opengeni/db";
+/**
+ * The person whose machine access decides which attached browsers a caller
+ * may see and control. Personal (Only me) machines belong to one person, so a
+ * human sees and controls their own; an agent acts for the person who started
+ * its turn (never merely for the workspace). Other callers (keys, services)
+ * reach only machines that are not personal.
+ */
+export declare function attachedBrowserViewer(deps: Pick<ApiRouteDeps, "db">, grant: AccessGrant, workspaceId: string): Promise<AttachedBrowserViewer>;

package/dist/auth/managed-auth-session-adapter.d.ts

@@ -4,3 +4,9 @@ import { type ManagedAuth } from "@opengeni/core";
 /** Server-only proof for a product-owned endpoint; never returned to a browser. */
 export declare function managedAuthSelectedProofHeaders(auth: ManagedAuth, token: string): Promise<Headers>;
 export declare function createBetterAuthSessionAdapter(auth: ManagedAuth, db: Database): ManagedAuthSessionAdapter;
+/**
+ * The provider's own session cookie for an exact session token (or its
+ * expiry when `token` is null), plus invalidation of stale provider cache
+ * cookies, exactly as a browser sign-in would set them.
+ */
+export declare function managedAuthSessionCookieHeaders(auth: ManagedAuth, token: string | null, currentCookieHeader?: string | null): Promise<string[]>;