@opengeni/api-router 2.2.0-canary.0 → 2.3.2-canary.1

package/dist/app.js

@@ -23,7 +23,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-3TP54PPX.js";
+} from "./chunk-IBV7Z6F4.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/auth/managed-auth.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import { type ManagedAuth } from "@opengeni/core";
+import { type ManagedAuth, type ManagedEmailMessage, type ManagedEmailTransport } from "@opengeni/core";
 import type { Database } from "@opengeni/db";
 export type { ManagedAuth };
 export declare function managedAuthRequiresEmailVerification(settings: Pick<Settings, "environment">): boolean;
@@ -8,4 +8,7 @@ export declare function managedAuthUserCreateOverride(settings: Pick<Settings, "
 } & Record<string, unknown>): {
     data: typeof user;
 } | undefined;
-export declare function createManagedAuth(settings: Settings, db: Database): ManagedAuth | null;
+/** Keep Better Auth password policy and storage format behind this boundary. */
+export declare function hashManagedAuthPassword(password: string): Promise<string>;
+export declare function createManagedAuth(settings: Settings, db: Database, managedEmailTransport: ManagedEmailTransport): ManagedAuth | null;
+export declare function sendManagedAuthEmail(transport: ManagedEmailTransport, input: Omit<ManagedEmailMessage, "from">): Promise<void>;

package/dist/auth/managed-email.d.ts

@@ -0,0 +1,29 @@
+import type { Settings } from "@opengeni/config";
+import type { ManagedEmailDeliveryResult, ManagedEmailMessage, ManagedEmailTransport } from "@opengeni/core";
+export type CapturedManagedEmail = ManagedEmailMessage & {
+    capturedAt: string;
+};
+/**
+ * Process-local test/development transport. Captures are count/TTL bounded and
+ * one-time readable; there is deliberately no route, disk, database, or log
+ * projection for message bodies or setup bearers.
+ */
+export declare class InMemoryManagedEmailTransport implements ManagedEmailTransport {
+    private readonly options;
+    private readonly messages;
+    readonly sender: string;
+    readonly idempotency: ManagedEmailTransport["idempotency"];
+    constructor(options?: {
+        maxMessages?: number;
+        ttlMs?: number;
+        now?: () => number;
+        sender?: string;
+        idempotency?: ManagedEmailTransport["idempotency"];
+    });
+    send(message: ManagedEmailMessage): Promise<ManagedEmailDeliveryResult>;
+    take(predicate: (message: CapturedManagedEmail) => boolean): CapturedManagedEmail | null;
+    size(): number;
+    private prune;
+    private now;
+}
+export declare function createManagedEmailTransport(settings: Settings): ManagedEmailTransport;

package/dist/auth/organization-user-setup.d.ts

@@ -0,0 +1,57 @@
+import type { Settings } from "@opengeni/config";
+import type { ManagedEmailTransport } from "@opengeni/core";
+/**
+ * Prove that the stable invited-user setup bearer can be constructed before an
+ * invitation commits. Provider availability is intentionally outside this
+ * precondition: the durable delivery journal records a failed or ambiguous
+ * transport outcome after the invitation exists.
+ */
+export declare function assertOrganizationUserSetupDeliveryConfigured(settings: Settings, transport: ManagedEmailTransport): void;
+/** Reject an invalid embedded-provider contract before any durable boundary. */
+export declare function assertManagedEmailTransportMetadata(transport: ManagedEmailTransport): void;
+export declare function deriveOrganizationUserSetupToken(settings: Settings, input: {
+    invitationId: string;
+    deliveryId: string;
+}): Promise<{
+    token: string;
+    digest: string;
+    url: string;
+}>;
+export type OrganizationUserSetupEmailSnapshot = {
+    senderEmail: string;
+    recipientEmail: string;
+    recipientName: string | null;
+    organizationName: string;
+    organizationRole: "owner" | "admin" | "member";
+    sharedWorkspaceAccess: Array<{
+        workspaceId: string;
+        workspaceName: string;
+        role: "viewer" | "member" | "admin";
+    }>;
+    setupUrl: string;
+};
+export declare function renderOrganizationUserSetupEmail(input: OrganizationUserSetupEmailSnapshot): {
+    from: string;
+    to: string;
+    subject: string;
+    text: string;
+    html: string;
+};
+export declare function organizationUserSetupPayloadDigest(input: {
+    from: string;
+    to: string;
+    subject: string;
+    text: string;
+    html: string;
+    providerIdempotencyScope: string;
+}): Promise<string>;
+export declare function organizationUserSetupRequestFingerprint(settings: Settings, input: {
+    tokenDigest: string;
+    name: string;
+    password: string;
+}): Promise<string>;
+export declare function selfServiceOrganizationSetupRequestFingerprint(input: {
+    authUserId: string;
+    organizationName: string;
+}): Promise<string>;
+export declare function organizationUserSetupTokenDigest(token: string): Promise<string>;