@opengeni/api-router 2.3.2-canary.2 → 2.4.2-canary.0

package/src/mcp/server.ts

@@ -186,7 +186,7 @@ import {
 import {
   acceptSessionUserMessageWithOutcome,
   controlAgentSessionWorkstream,
-  controlHumanSessionWorkstream,
+  controlHumanSessionWorkstreamWithOutcome,
   createSessionForRequestWithOutcome,
   SessionSpawnDeniedError,
   sessionSpawnDenialEnvelope,
@@ -223,7 +223,11 @@ import {
   SESSION_WAIT_MAX_TARGETS,
   waitForSessionChanges,
 } from "./session-wait";
-import { mcpMutationReceipt, sessionCreateMutationReceipt } from "./receipts";
+import {
+  mcpMutationReceipt,
+  sessionControlMutationReceipt,
+  sessionCreateMutationReceipt,
+} from "./receipts";
 import {
   boundScheduledTaskDetailMcp,
   boundScheduledTaskMcpPage,
@@ -4537,27 +4541,18 @@ function registerWorkspaceOrchestrationTools(
             controlled.authorization?.relatedSessionAccess ?? "root",
           );
           return json(
-            mcpMutationReceipt({
+            sessionControlMutationReceipt({
               operation: "session_pause",
-              committed: true,
-              outcome: controlled.replay ? "replayed" : "updated",
-              changed: !controlled.replay,
-              resource: {
-                type: "session",
-                id: sessionId,
-                state: effectiveControl.state,
-              },
-              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              sessionId,
+              state: effectiveControl.state,
+              receiptId: controlled.receipt.id,
               timestamp: controlled.receipt.createdAt.toISOString(),
-              idempotency: {
-                status: controlled.replay ? "replayed" : "applied",
-              },
-              facts: { interruptionCount: controlled.interruptionCount },
-              nextAction: { tool: "session_get", arguments: { sessionId } },
+              outcome: controlled.outcome,
+              interruptionCount: controlled.interruptionCount,
             }),
           );
         }
-        const controlled = await controlHumanSessionWorkstream(
+        const controlled = await controlHumanSessionWorkstreamWithOutcome(
           deps,
           {
             accountId: grant.accountId,
@@ -4572,7 +4567,17 @@ function registerWorkspaceOrchestrationTools(
             ...(reason ? { reason } : {}),
           },
         );
-        return json(controlled);
+        return json(
+          sessionControlMutationReceipt({
+            operation: "session_pause",
+            sessionId,
+            state: controlled.response.effectiveControl.state,
+            receiptId: controlled.response.receipt.id,
+            timestamp: controlled.response.receipt.createdAt,
+            outcome: controlled.outcome,
+            interruptionCount: controlled.response.interruptionCount,
+          }),
+        );
       },
     );
 
@@ -4605,27 +4610,18 @@ function registerWorkspaceOrchestrationTools(
             controlled.authorization?.relatedSessionAccess ?? "root",
           );
           return json(
-            mcpMutationReceipt({
+            sessionControlMutationReceipt({
               operation: "session_resume",
-              committed: true,
-              outcome: controlled.replay ? "replayed" : "updated",
-              changed: !controlled.replay,
-              resource: {
-                type: "session",
-                id: sessionId,
-                state: effectiveControl.state,
-              },
-              relatedResources: [{ type: "session_command_receipt", id: controlled.receipt.id }],
+              sessionId,
+              state: effectiveControl.state,
+              receiptId: controlled.receipt.id,
               timestamp: controlled.receipt.createdAt.toISOString(),
-              idempotency: {
-                status: controlled.replay ? "replayed" : "applied",
-              },
-              facts: { interruptionCount: controlled.interruptionCount },
-              nextAction: { tool: "session_get", arguments: { sessionId } },
+              outcome: controlled.outcome,
+              interruptionCount: controlled.interruptionCount,
             }),
           );
         }
-        const controlled = await controlHumanSessionWorkstream(
+        const controlled = await controlHumanSessionWorkstreamWithOutcome(
           deps,
           {
             accountId: grant.accountId,
@@ -4640,7 +4636,17 @@ function registerWorkspaceOrchestrationTools(
             ...(reason ? { reason } : {}),
           },
         );
-        return json(controlled);
+        return json(
+          sessionControlMutationReceipt({
+            operation: "session_resume",
+            sessionId,
+            state: controlled.response.effectiveControl.state,
+            receiptId: controlled.response.receipt.id,
+            timestamp: controlled.response.receipt.createdAt,
+            outcome: controlled.outcome,
+            interruptionCount: controlled.response.interruptionCount,
+          }),
+        );
       },
     );
 
@@ -4741,13 +4747,13 @@ function registerWorkspaceOrchestrationTools(
             });
           }
           if (accepted.action === "conflict") {
-            throw new Error(`human-input request is ${accepted.request.status}`);
+            throw new Error("human-input request is not currently actionable");
           }
           return json(
             mcpMutationReceipt({
               operation: "session_human_input_respond",
               committed: true,
-              outcome: accepted.events.length === 0 ? "replayed" : "updated",
+              outcome: accepted.action === "completed" ? "replayed" : "updated",
               changed: accepted.events.length > 0,
               resource: {
                 type: "session_human_input_request",
@@ -4757,7 +4763,7 @@ function registerWorkspaceOrchestrationTools(
               relatedResources: [{ type: "session", id: sessionId }],
               timestamp: accepted.request.respondedAt ?? new Date().toISOString(),
               idempotency: {
-                status: accepted.events.length === 0 ? "replayed" : "applied",
+                status: accepted.action === "completed" ? "replayed" : "applied",
               },
               facts: { outcome: accepted.request.response?.outcome ?? null },
               nextAction: { tool: "session_get", arguments: { sessionId } },

package/src/organization-recovery-notifications.ts

@@ -0,0 +1,103 @@
+import type { Database } from "@opengeni/db";
+import {
+  prepareOrganizationRecoveryNotifications,
+  settleOrganizationRecoveryNotification,
+  type OrganizationRecoveryNotificationClaim,
+  type OrganizationRecoveryNotificationSettlement,
+} from "@opengeni/db";
+
+export type OrganizationRecoveryNotificationDeliveryResult =
+  | { status: "sent"; providerMessageId: string | null }
+  | { status: "failed"; errorClass: string }
+  | { status: "outcome_unknown" };
+
+export interface OrganizationRecoveryNotificationTransport {
+  readonly provider: string;
+  send(
+    claim: OrganizationRecoveryNotificationClaim,
+  ): Promise<OrganizationRecoveryNotificationDeliveryResult>;
+}
+
+export type OrganizationRecoveryNotificationLifecycle = {
+  prepare: typeof prepareOrganizationRecoveryNotifications;
+  settle: typeof settleOrganizationRecoveryNotification;
+};
+
+const productionLifecycle: OrganizationRecoveryNotificationLifecycle = {
+  prepare: prepareOrganizationRecoveryNotifications,
+  settle: settleOrganizationRecoveryNotification,
+};
+
+export async function dispatchOrganizationRecoveryNotifications(input: {
+  db: Database;
+  transport: OrganizationRecoveryNotificationTransport;
+  claimOwner: string;
+  limit?: number;
+  leaseSeconds?: number;
+  lifecycle?: OrganizationRecoveryNotificationLifecycle;
+}): Promise<OrganizationRecoveryNotificationSettlement[]> {
+  const lifecycle = input.lifecycle ?? productionLifecycle;
+  const claims = await lifecycle.prepare(input.db, {
+    provider: input.transport.provider,
+    claimOwner: input.claimOwner,
+    limit: input.limit ?? 25,
+    leaseSeconds: input.leaseSeconds ?? 60,
+  });
+  return await Promise.all(
+    claims.map(async (claim) => {
+      let result: OrganizationRecoveryNotificationDeliveryResult;
+      try {
+        result = await input.transport.send(claim);
+      } catch {
+        // The provider may have accepted the stable idempotency key before the
+        // transport failed. Preserve ambiguity for explicit reconciliation.
+        result = { status: "outcome_unknown" };
+      }
+      return await lifecycle.settle(input.db, {
+        outboxId: claim.outboxId,
+        deliveryId: claim.deliveryId,
+        claimOwner: claim.claimOwner,
+        phase: result.status,
+        ...(result.status === "sent" ? { providerMessageId: result.providerMessageId } : {}),
+        ...(result.status === "failed" ? { errorClass: result.errorClass } : {}),
+      });
+    }),
+  );
+}
+
+export class InMemoryOrganizationRecoveryNotificationTransport implements OrganizationRecoveryNotificationTransport {
+  readonly provider = "fake";
+  readonly attempts: Array<{
+    idempotencyKey: string;
+    payloadDigest: string;
+    recipientCanonicalIdentityId: string;
+    providerMessageId: string;
+  }> = [];
+  private readonly deliveries = new Map<string, string>();
+  private readonly scripted: OrganizationRecoveryNotificationDeliveryResult[] = [];
+
+  enqueue(...results: OrganizationRecoveryNotificationDeliveryResult[]): void {
+    this.scripted.push(...results);
+  }
+
+  logicalDeliveryCount(): number {
+    return this.deliveries.size;
+  }
+
+  async send(
+    claim: OrganizationRecoveryNotificationClaim,
+  ): Promise<OrganizationRecoveryNotificationDeliveryResult> {
+    const scripted = this.scripted.shift();
+    if (scripted) return scripted;
+    const providerMessageId =
+      this.deliveries.get(claim.idempotencyKey) ?? `fake:${crypto.randomUUID()}`;
+    this.deliveries.set(claim.idempotencyKey, providerMessageId);
+    this.attempts.push({
+      idempotencyKey: claim.idempotencyKey,
+      payloadDigest: claim.payloadDigest,
+      recipientCanonicalIdentityId: claim.recipientCanonicalIdentityId,
+      providerMessageId,
+    });
+    return { status: "sent", providerMessageId };
+  }
+}

package/src/routes/canonical-human-identities.ts

@@ -5,7 +5,11 @@ import {
   CanonicalHumanIdentityProjection,
   LinkCanonicalHumanLoginBindingRequest,
 } from "@opengeni/contracts/canonical-human-identities";
-import { requireCanonicalHumanRequestIdentity } from "@opengeni/core/canonical-human-identities";
+import {
+  getManagedAuthRequestActorLeaseStamp,
+  markManagedAuthRequestActorTransitionApplied,
+  requireCanonicalHumanRequestIdentity,
+} from "@opengeni/core/canonical-human-identities";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   applyCanonicalHumanIdentityOperation,
@@ -13,6 +17,7 @@ import {
   CanonicalHumanIdentityConflictError,
   CanonicalHumanIdentityNotFoundError,
   CanonicalHumanIdentityOperationReuseError,
+  CanonicalHumanIdentityMutationInFlightError,
   getCanonicalHumanIdentityProjection,
 } from "@opengeni/db/canonical-human-identities";
 import type { Context, Hono } from "hono";
@@ -25,6 +30,8 @@ async function requestIdentity(context: Context, deps: ApiRouteDeps) {
   return await requireCanonicalHumanRequestIdentity(context, {
     db: deps.db,
     ...(deps.managedAuth === undefined ? {} : { managedAuth: deps.managedAuth }),
+    managedAuthSessionAdapter: deps.managedAuthSessionAdapter,
+    managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
     allowRecovery: true,
   });
 }
@@ -50,6 +57,9 @@ function identityError(context: Context, error: unknown): Response {
   if (error instanceof CanonicalHumanIdentityOperationReuseError) {
     return context.json({ code: error.code, message: error.message }, 409);
   }
+  if (error instanceof CanonicalHumanIdentityMutationInFlightError) {
+    return context.json({ code: error.code, message: error.message, retryable: true }, 409);
+  }
   if (error instanceof CanonicalHumanIdentityNotFoundError) {
     return context.json(
       { code: "CANONICAL_HUMAN_IDENTITY_NOT_FOUND", message: error.message },
@@ -79,21 +89,26 @@ async function mutate(
   },
 ): Promise<Response> {
   const identity = await requestIdentity(context, deps);
+  const actorFence = getManagedAuthRequestActorLeaseStamp(context.req.raw);
+  if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
+    throw new HTTPException(409, { message: "Managed actor mutation fence is unavailable" });
+  }
   try {
-    return context.json(
-      CanonicalHumanIdentityMutationResponse.parse(
-        await applyCanonicalHumanIdentityOperation(deps.db, {
-          operationId: input.operationId,
-          authUserId: identity.authUserId,
-          expectedIdentityRevision: input.expectedIdentityRevision,
-          operationType: input.operationType,
-          ...(input.bindingId ? { bindingId: input.bindingId } : {}),
-          ...(input.providerId ? { providerId: input.providerId } : {}),
-          ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
-          reason: input.reason,
-        }),
-      ),
+    const response = CanonicalHumanIdentityMutationResponse.parse(
+      await applyCanonicalHumanIdentityOperation(deps.db, {
+        operationId: input.operationId,
+        authUserId: identity.authUserId,
+        expectedIdentityRevision: input.expectedIdentityRevision,
+        operationType: input.operationType,
+        ...(input.bindingId ? { bindingId: input.bindingId } : {}),
+        ...(input.providerId ? { providerId: input.providerId } : {}),
+        ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
+        reason: input.reason,
+        ...(actorFence ? { actorFence } : {}),
+      }),
     );
+    if (actorFence) markManagedAuthRequestActorTransitionApplied(context.req.raw);
+    return context.json(response);
   } catch (error) {
     return identityError(context, error);
   }

package/src/routes/codex.ts

@@ -195,7 +195,11 @@ async function managedCookieHuman(
   ) {
     return null;
   }
-  const session = await getManagedSession(c, deps.managedAuth);
+  const session = await getManagedSession(c, deps.managedAuth, {
+    db: deps.db,
+    sessionAdapter: deps.managedAuthSessionAdapter,
+    sessionSetMode: deps.settings.managedAuthSessionSetMode,
+  });
   if (!session?.user?.id || !session.session?.id) return null;
   return {
     subjectId: `user:${session.user.id}`,

package/src/routes/environments.ts

@@ -1,5 +1,7 @@
 import {
   CreateVariableSetRequest,
+  ResolveVariableSetAttachmentsRequest,
+  ResolveVariableSetAttachmentsResponse,
   SetVariableSetVariableRequest,
   UpdateVariableSetRequest,
   VariableSetVariableName,
@@ -14,6 +16,7 @@ import {
   getVariableSetByName,
   listVariableSets,
   readVariableSetSecretAtomically,
+  resolveVariableSetAttachments,
   setVariableSetVariable,
   updateVariableSet,
   VariableSetAttachedError,
@@ -135,6 +138,26 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       return c.json(created, 201);
     });
 
+    if (prefix.endsWith("/variable-sets")) {
+      app.post(`${prefix}/resolve-attachments`, async (c) => {
+        const workspaceId = c.req.param("workspaceId")!;
+        const grant = await requireAccessGrant(c, deps, workspaceId);
+        requirePermission(grant, "variable-sets:attach");
+        requirePermission(grant, "variable-sets:use");
+        const payload = ResolveVariableSetAttachmentsRequest.parse(await c.req.json());
+        const variableSets = await resolveVariableSetAttachments(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          payload.variableSetIds,
+        );
+        return c.json(ResolveVariableSetAttachmentsResponse.parse({ variableSets }));
+      });
+    }
+
     app.get(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
       const grant = await requireAccessGrant(c, deps, workspaceId);

package/src/routes/interaction-resources.ts

@@ -45,6 +45,7 @@ import {
   updateSiteAuthConnection,
 } from "@opengeni/db";
 import {
+  getManagedAuthRequestActorEpoch,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
   requireAccessGrant,
@@ -74,6 +75,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       context.req.raw.signal,
       {
         observability: deps.observability,
+        actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {
           const freshGrant = await requireFreshAccessGrant(
             context,
@@ -98,6 +100,7 @@ export function registerInteractionResourceRoutes(app: Hono, deps: ApiRouteDeps)
       context.req.raw.signal,
       {
         observability: deps.observability,
+        actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? undefined,
         reauthorize: async () => {
           await requireFreshAccessGrant(context, deps, workspaceId, "sessions:read");
         },