@opengeni/api-router 2.3.2-canary.2 → 2.5.0

package/dist/integrations/slack-interactions.d.ts

@@ -19,7 +19,7 @@ export declare const SLACK_SESSION_INSTRUCTIONS: string;
  * selection at session creation while keeping Slack mutations out of the model
  * surface; interaction delivery remains owned by the durable delivery pump.
  */
-export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "goal_wait" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "goal_wait" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
 export type NormalizedSlackInteraction = {
     providerEventId: string;
     providerMessageId: string;

package/dist/mcp/receipts.d.ts

@@ -9,6 +9,15 @@ export type McpMutationReceiptInput = Omit<McpMutationReceiptType, "receiptVersi
  * accidentally adding an unbounded entity or a copy of request fields.
  */
 export declare function mcpMutationReceipt(input: McpMutationReceiptInput): McpMutationReceiptType;
+export declare function sessionControlMutationReceipt(input: {
+    operation: "session_pause" | "session_resume";
+    sessionId: string;
+    state: string;
+    receiptId: string;
+    timestamp: string;
+    outcome: "changed" | "unchanged" | "replayed";
+    interruptionCount: number;
+}): McpMutationReceiptType;
 export type SessionCreateReceiptResult = {
     session: {
         id: string;

package/dist/mcp/server.d.ts

@@ -94,6 +94,39 @@ export declare function capSessionDiscoveryPage(page: Awaited<ReturnType<typeof
             attentionSince?: string | null | undefined;
             truncated: boolean;
         };
+        relatedWork: {
+            claims: {
+                id: string;
+                sessionId: string;
+                subject: {
+                    namespace: string;
+                    type: "artifact" | "branch" | "ci_run" | "issue" | "other" | "pull_request" | "release" | "repository";
+                    canonicalKey: string;
+                    displayLabel: string | null;
+                };
+                role: "delivering" | "monitoring" | "reviewing" | "working";
+                state: "active" | "released" | "stale" | "superseded";
+                revision: number;
+                provenance: "explicit_agent" | "session_resource" | "system_lifecycle" | "trusted_integration" | "user_api";
+                version: {
+                    kind: "artifact_version" | "branch_head" | "ci_run" | "git_commit" | "other" | "pull_request_head" | "release_version";
+                    value: string;
+                } | null;
+                observedAt: string;
+                updatedAt: string;
+                settledAt: string | null;
+            }[];
+            claimsTruncated: boolean;
+            match: {
+                class: "exact_subject" | "fuzzy" | "goal" | "title";
+                field: "claim_key" | "claim_label" | "goal" | "subject" | "title";
+                scoreBand: "exact" | "related" | "strong";
+                claimId: string | null;
+            } | null;
+            possibleOverlap: boolean;
+            advisoryOnly: true;
+            noAdditionalAccess: true;
+        };
         latestMessage?: {
             type: "agent.message.completed" | "agent.message.delta" | "agent.model.request" | "agent.model.usage" | "agent.reasoning.delta" | "agent.toolCall.created" | "agent.toolCall.output" | "agent.updated" | "artifact.created" | "codex.account.switched" | "codex.capacity.resumed" | "codex.capacity.superseded" | "codex.capacity.waiting" | "codex.credential.selected" | "codex.fleet.decision" | "credential.auth_needed" | "fs.changed" | "git.changed" | "goal.cleared" | "goal.completed" | "goal.continuation" | "goal.held" | "goal.paused" | "goal.progress" | "goal.resumed" | "goal.rewrite.proposed" | "goal.rewrite.rejected" | "goal.set" | "goal.updated" | "machine.link.lost" | "machine.link.restored" | "machine.op.failed" | "machine.op.recovered" | "machine.runner.restarted" | "memory.corrected" | "memory.saved" | "recording.available" | "recording.failed" | "recording.started" | "rig.setup.completed" | "rig.setup.failed" | "rig.setup.skipped" | "rig.setup.started" | "sandbox.box.created" | "sandbox.box.lost" | "sandbox.box.snapshot" | "sandbox.box.terminated" | "sandbox.command.output.delta" | "sandbox.env.drift" | "sandbox.operation.completed" | "sandbox.operation.failed" | "sandbox.operation.started" | "session.command.backgrounded" | "session.command.finished" | "session.context.cleared" | "session.context.compacted" | "session.context.compaction.requested" | "session.context.compaction.skipped" | "session.context.compaction.started" | "session.control.paused" | "session.control.resumed" | "session.control.steer_requested" | "session.created" | "session.event.envelope_omitted" | "session.humanInput.requested" | "session.mcp.approval_policy.updated" | "session.personal_resources.attached" | "session.queue.changed" | "session.queue.history" | "session.queue.prompt.cancelled" | "session.realtime.ended" | "session.realtime.started" | "session.requiresAction" | "session.route.reconciled" | "session.runtime.configured" | "session.status.changed" | "session.title_set" | "session.tool_policy.updated" | "session.variable_sets.updated" | "session.visibility.changed" | "stream.closed" | "stream.opened" | "stream.revoked" | "stream.url.rotated" | "system.update.cancelled" | "system.update.delivered" | "system.update.pending" | "system.update.settled" | "system.update.superseded" | "terminal.pty.exited" | "terminal.pty.output.delta" | "terminal.pty.started" | "tool.auth_needed" | "turn.cancelled" | "turn.capacity_waiting" | "turn.completed" | "turn.event.rejected_late" | "turn.failed" | "turn.queued" | "turn.recovery.requested" | "turn.started" | "turn.startup.phase.completed" | "turn.startup.phase.failed" | "turn.startup.phase.started" | "turn.superseded" | "user.approvalDecision" | "user.humanInputResponse" | "user.message" | "user.pause" | "workspace.inference.paused" | "workspace.inference.resumed" | "workspace.revision.captured" | "workspace.revision.degraded";
             preview: string | null;

package/dist/organization-recovery-notifications.d.ts

@@ -0,0 +1,41 @@
+import type { Database } from "@opengeni/db";
+import { prepareOrganizationRecoveryNotifications, settleOrganizationRecoveryNotification, type OrganizationRecoveryNotificationClaim, type OrganizationRecoveryNotificationSettlement } from "@opengeni/db";
+export type OrganizationRecoveryNotificationDeliveryResult = {
+    status: "sent";
+    providerMessageId: string | null;
+} | {
+    status: "failed";
+    errorClass: string;
+} | {
+    status: "outcome_unknown";
+};
+export interface OrganizationRecoveryNotificationTransport {
+    readonly provider: string;
+    send(claim: OrganizationRecoveryNotificationClaim): Promise<OrganizationRecoveryNotificationDeliveryResult>;
+}
+export type OrganizationRecoveryNotificationLifecycle = {
+    prepare: typeof prepareOrganizationRecoveryNotifications;
+    settle: typeof settleOrganizationRecoveryNotification;
+};
+export declare function dispatchOrganizationRecoveryNotifications(input: {
+    db: Database;
+    transport: OrganizationRecoveryNotificationTransport;
+    claimOwner: string;
+    limit?: number;
+    leaseSeconds?: number;
+    lifecycle?: OrganizationRecoveryNotificationLifecycle;
+}): Promise<OrganizationRecoveryNotificationSettlement[]>;
+export declare class InMemoryOrganizationRecoveryNotificationTransport implements OrganizationRecoveryNotificationTransport {
+    readonly provider = "fake";
+    readonly attempts: Array<{
+        idempotencyKey: string;
+        payloadDigest: string;
+        recipientCanonicalIdentityId: string;
+        providerMessageId: string;
+    }>;
+    private readonly deliveries;
+    private readonly scripted;
+    enqueue(...results: OrganizationRecoveryNotificationDeliveryResult[]): void;
+    logicalDeliveryCount(): number;
+    send(claim: OrganizationRecoveryNotificationClaim): Promise<OrganizationRecoveryNotificationDeliveryResult>;
+}

package/dist/routes/managed-auth-session-sets.d.ts

@@ -0,0 +1,19 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDeps): void;
+/**
+ * Better Auth 1.6.26 provider lifecycle routes retained while session-set mode
+ * owns all selected-session reads, enumeration, revocation, and user mutation.
+ * The list is intentionally exact so a dependency upgrade cannot silently add
+ * a selected-session capability under the wildcard.
+ */
+export declare function requireManagedAuthProviderRouteAllowed(method: string, pathname: string): void;
+/** Remove provider bearer/session material and enforce browser-auth cache/cookie policy. */
+export declare function scrubManagedAuthProviderResponse(response: Response, options?: {
+    replacementCookies?: readonly string[] | undefined;
+}): Promise<Response>;
+export declare function parseSupportedDeepLink(path: string): {
+    workspaceId: string | null;
+    sessionId: string | null;
+    permission: "workspace:read" | "sessions:read";
+} | null;

package/dist/routes/organization-recovery.d.ts

@@ -0,0 +1,19 @@
+import { getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorLeaseStamp, requireCanonicalHumanRequestIdentity } from "@opengeni/core/canonical-human-identities";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { acceptOrganizationRecoveryCustody, approveOrganizationRecoveryOperation, cancelOrganizationRecoveryOperation, configureOrganizationRecoveryPolicy, disableOrganizationRecoveryPolicy, executeOrganizationRecoveryOperation, getOrganizationRecoveryOverview, startOrganizationRecoveryOperation } from "@opengeni/db";
+import type { Hono } from "hono";
+export type OrganizationRecoveryRouteServices = {
+    requireCanonicalHumanRequestIdentity: typeof requireCanonicalHumanRequestIdentity;
+    getManagedAuthRequestActorAdmissionStamp: typeof getManagedAuthRequestActorAdmissionStamp;
+    getManagedAuthRequestActorLeaseStamp: typeof getManagedAuthRequestActorLeaseStamp;
+    getOrganizationRecoveryOverview: typeof getOrganizationRecoveryOverview;
+    configureOrganizationRecoveryPolicy: typeof configureOrganizationRecoveryPolicy;
+    acceptOrganizationRecoveryCustody: typeof acceptOrganizationRecoveryCustody;
+    disableOrganizationRecoveryPolicy: typeof disableOrganizationRecoveryPolicy;
+    startOrganizationRecoveryOperation: typeof startOrganizationRecoveryOperation;
+    approveOrganizationRecoveryOperation: typeof approveOrganizationRecoveryOperation;
+    cancelOrganizationRecoveryOperation: typeof cancelOrganizationRecoveryOperation;
+    executeOrganizationRecoveryOperation: typeof executeOrganizationRecoveryOperation;
+};
+export declare function organizationRecoveryHttpError(error: unknown): Error;
+export declare function registerOrganizationRecoveryRoutes(app: Hono, deps: ApiRouteDeps, services?: OrganizationRecoveryRouteServices): void;

package/dist/routes/sessions.d.ts

@@ -1,4 +1,4 @@
-import { ClientSessionEvent, SteerSessionMessageRequest, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
+import { ClientSessionEvent, SteerSessionMessageRequest, type SessionStatus, type WorkClaimSubjectFilter, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
 import { type SessionDiscoveryCursor } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -15,14 +15,26 @@ export declare function sessionAuthorizationOperationForHttp(method: string, pat
 export declare function sessionTenancyHttpError(error: unknown): Error;
 export type AgentTopologyCursorEnvelope = {
     cursor: SessionDiscoveryCursor;
-    parentSessionId: string | null;
-    search: string | null;
+    parentSessionId: string | null | "all";
+    rootSessionId: string | null;
+    query: string | null;
+    statuses: SessionStatus[];
+    activeOnly: boolean;
+    recentHours: number | null;
+    subject: WorkClaimSubjectFilter | null;
+    claimLimit: number | null;
 };
 export declare function encodeAgentTopologyCursor(value: AgentTopologyCursorEnvelope): string;
 export declare function agentTopologyQuery(query: Record<string, string>): {
     limit: number;
-    parentSessionId: string | null;
-    search: string | undefined;
+    parentSessionId: string | null | undefined;
+    rootSessionId: string | undefined;
+    query: string | undefined;
+    statuses: SessionStatus[] | undefined;
+    activeOnly: boolean;
+    recentHours: number | undefined;
+    subject: WorkClaimSubjectFilter | undefined;
+    claimLimit: number | undefined;
     cursor: SessionDiscoveryCursor | undefined;
 };
 /** Stable, value-free JSON errors for only the create-session boundary. */

package/dist/routes/workspaces.d.ts

@@ -20,5 +20,6 @@ export declare function workspaceMembersResponse(members: readonly WorkspaceMemb
         createdAt: string;
     }[];
 };
+export declare function workspaceUpdateRequestsAccountTransfer(value: unknown): boolean;
 export declare function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void;
 export {};

package/dist/work-discovery-observability.d.ts

@@ -0,0 +1,33 @@
+import type { WorkDiscoveryMatchClass } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+export type WorkDiscoverySurface = "first_party_mcp" | "agent_topology";
+export type WorkDiscoveryMode = "browse" | "query" | "subject";
+export type WorkDiscoveryOutcome = "ok" | "empty" | "disabled" | "error";
+export type WorkDiscoveryAuthorizationScope = "workspace" | "scoped";
+export type WorkDiscoveryObservation = {
+    surface: WorkDiscoverySurface;
+    mode: WorkDiscoveryMode;
+    outcome: WorkDiscoveryOutcome;
+    authorizationScope: WorkDiscoveryAuthorizationScope;
+    durationMs: number;
+    responseBytes: number;
+    resultCount: number;
+    overlapCount: number;
+    matchCounts: Partial<Record<WorkDiscoveryMatchClass, number>>;
+};
+type WorkDiscoveryObservedRow = {
+    relatedWork: {
+        match: {
+            class: WorkDiscoveryMatchClass;
+        } | null;
+        possibleOverlap: boolean;
+    };
+};
+export declare function summarizeWorkDiscoveryRows(rows: readonly WorkDiscoveryObservedRow[]): Pick<WorkDiscoveryObservation, "resultCount" | "overlapCount" | "matchCounts">;
+/**
+ * Low-cardinality work-discovery telemetry. Identifiers, search text, subject
+ * keys, titles, goals, claim labels, versions, and provenance are excluded by
+ * construction. An observability failure never changes product behavior.
+ */
+export declare function observeWorkDiscovery(observability: Observability | null | undefined, observation: WorkDiscoveryObservation): void;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.3.2-canary.2",
+  "version": "2.5.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,23 +43,23 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "^1.5.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.4",
-    "@opengeni/artifact-tool": "^0.3.7-canary.2",
-    "@opengeni/capabilities": "^0.3.1-canary.3",
-    "@opengeni/codemode": "^0.4.15-canary.2",
-    "@opengeni/codex": "^0.2.19-canary.3",
-    "@opengeni/config": "^0.20.1-canary.2",
-    "@opengeni/contracts": "^2.5.0-canary.2",
-    "@opengeni/core": "^2.4.0-canary.2",
-    "@opengeni/db": "^3.4.0-canary.2",
-    "@opengeni/documents": "^0.8.2-canary.2",
-    "@opengeni/events": "^0.4.0-canary.2",
-    "@opengeni/github": "^0.5.5-canary.2",
-    "@opengeni/network": "^0.2.3-canary.3",
-    "@opengeni/observability": "^0.8.6-canary.2",
-    "@opengeni/runtime": "^1.4.0-canary.2",
-    "@opengeni/storage": "^0.2.108-canary.2",
-    "@opengeni/xai-subscription": "^0.1.2-canary.3",
+    "@opengeni/agent-proto": "^0.5.1",
+    "@opengeni/artifact-tool": "^0.3.9",
+    "@opengeni/capabilities": "^0.3.1",
+    "@opengeni/codemode": "^0.4.17",
+    "@opengeni/codex": "^0.2.19",
+    "@opengeni/config": "^0.22.0",
+    "@opengeni/contracts": "^2.7.0",
+    "@opengeni/core": "^2.5.3",
+    "@opengeni/db": "^3.6.0",
+    "@opengeni/documents": "^0.8.6",
+    "@opengeni/events": "^0.4.4",
+    "@opengeni/github": "^0.6.1",
+    "@opengeni/network": "^0.2.3",
+    "@opengeni/observability": "^0.8.9",
+    "@opengeni/runtime": "^1.4.2",
+    "@opengeni/storage": "^0.2.110",
+    "@opengeni/xai-subscription": "^0.1.2",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -36,7 +36,10 @@ import {
   configureChildLifecycleNotices,
   configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
+  getManagedAuthSessionSetSnapshot,
   getWorkspace,
+  reapManagedAuthIsolatedSessions,
+  reapExpiredManagedAuthSessionSets,
   rlsContextForWorkspace,
   withSessionRlsActorContext,
 } from "@opengeni/db";
@@ -49,21 +52,32 @@ import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
+import { getCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
   CodexCompactionV2ProviderLockedError,
+  ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission,
   requireAccessGrant,
   requireLiveAgentAttemptAuthorization,
   requirePermission,
+  releaseManagedAuthRequestActorLease,
+  validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
 } from "@opengeni/core";
 import { createManagedAuth } from "./auth/managed-auth";
+import {
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  managedAuthSha256,
+} from "@opengeni/core/managed-auth-session-sets";
+import { createBetterAuthSessionAdapter } from "./auth/managed-auth-session-adapter";
+import { runManagedAuthDiscardedProviderSession } from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
 import { assertManagedEmailTransportMetadata } from "./auth/organization-user-setup";
 import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
@@ -135,7 +149,13 @@ import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
+import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
 import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedAuthSessionSetRoutes,
+  requireManagedAuthProviderRouteAllowed,
+  scrubManagedAuthProviderResponse,
+} from "./routes/managed-auth-session-sets";
 import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
 import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
@@ -167,6 +187,8 @@ export { workflowIdForSession } from "@opengeni/core";
 export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
 
 export const API_MAX_REQUEST_BODY_BYTES = 32 * 1024 * 1024;
+const managedAuthReaperDatabases = new WeakSet<object>();
+const MANAGED_AUTH_REAPER_INTERVAL_MS = 60_000;
 
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export function apiRequestBodyLimitBytes(settings: {
@@ -202,6 +224,9 @@ export function createAppComposition(deps: AppDependencies): {
   assertManagedEmailTransportMetadata(managedEmailTransport);
   const managedAuth =
     deps.managedAuth ?? createManagedAuth(deps.settings, deps.db, managedEmailTransport);
+  const managedAuthSessionAdapter =
+    deps.managedAuthSessionAdapter ??
+    (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -284,6 +309,24 @@ export function createAppComposition(deps: AppDependencies): {
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
   const observability =
     deps.observability ?? createObservability(deps.settings, { component: "api" });
+  if (
+    managedAuth &&
+    deps.settings.managedAuthSessionSetMode !== "legacy" &&
+    !managedAuthReaperDatabases.has(deps.db as object)
+  ) {
+    managedAuthReaperDatabases.add(deps.db as object);
+    const timer = setInterval(() => {
+      void Promise.all([
+        reapManagedAuthIsolatedSessions(deps.db, 100),
+        reapExpiredManagedAuthSessionSets(deps.db, 100),
+      ]).catch((error) => {
+        observability.error("Managed isolated-auth orphan reap failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }, MANAGED_AUTH_REAPER_INTERVAL_MS);
+    (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
+  }
   const transcription =
     deps.transcription === undefined
       ? createTranscriptionService({
@@ -304,6 +347,7 @@ export function createAppComposition(deps: AppDependencies): {
     githubStateSecret:
       deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
     managedAuth,
+    managedAuthSessionAdapter,
     managedEmailTransport,
     objectStorage,
     documentIndexer,
@@ -332,13 +376,17 @@ export function createAppComposition(deps: AppDependencies): {
       "Range",
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Session-Csrf",
       "X-OpenGeni-Subject",
     ],
     exposeHeaders: [
       "Accept-Ranges",
       "Content-Range",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
+      "X-OpenGeni-Actor-State",
       "X-OpenGeni-Correlation-Id",
     ],
   };
@@ -495,11 +543,93 @@ export function createAppComposition(deps: AppDependencies): {
     await next();
   });
 
+  app.use("/v1/*", async (c, next) => {
+    try {
+      await next();
+      try {
+        await validateManagedAuthRequestActorLease(c.req.raw);
+      } catch (error) {
+        if (error instanceof ManagedAuthActorChangeError) {
+          c.header("x-opengeni-actor-state", "changed");
+          throw new HTTPException(409, { message: error.code, cause: error });
+        }
+        if (error instanceof ManagedAuthActorLeaseOutcomeUnknownError) {
+          throw new ApiHttpError(503, {
+            code: "upstream_unavailable",
+            message: error.code,
+            retryable: true,
+            outcomeUnknown: true,
+            details: { managedAuthCode: error.code },
+          });
+        }
+        throw error;
+      }
+    } finally {
+      await releaseManagedAuthRequestActorLease(c.req.raw).catch((error) => {
+        observability.error("Managed actor mutation lease release failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }
+  });
+
   // These product-owned auth routes must be registered before Better Auth's
   // wildcard handler or the provider returns its own 404 first.
   registerManagedOnboardingRoutes(app, routeDeps);
+  registerManagedAuthSessionSetRoutes(app, routeDeps);
   if (managedAuth) {
-    app.on(["GET", "POST"], "/v1/auth/*", (c) => managedAuth.handler(c.req.raw));
+    app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
+      if (deps.settings.managedAuthSessionSetMode === "legacy") {
+        return await managedAuth.handler(c.req.raw);
+      }
+      requireManagedAuthProviderRouteAllowed(c.req.method, new URL(c.req.url).pathname);
+      // Provider authentication/recovery is isolated from whichever actor the
+      // browser currently renders. Selected-session capabilities are all
+      // product-owned above this wildcard and generation/epoch fenced.
+      const headers = new Headers(c.req.raw.headers);
+      headers.delete("cookie");
+      headers.delete("authorization");
+      headers.delete("x-forwarded-user");
+      const providerRequest = new Request(c.req.raw, { headers });
+      const authority = getCookie(c, MANAGED_AUTH_SESSION_SET_COOKIE);
+      const discardProviderSession =
+        deps.settings.managedAuthSessionSetMode === "broker" || authority !== undefined;
+      const providerResponse = discardProviderSession
+        ? await runManagedAuthDiscardedProviderSession(
+            async () => await managedAuth.handler(providerRequest),
+          )
+        : await managedAuth.handler(providerRequest);
+      let replacementCookies: readonly string[] | undefined;
+      if (deps.settings.managedAuthSessionSetMode === "broker") {
+        replacementCookies = await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+          null,
+          c.req.header("cookie") ?? null,
+        );
+      } else {
+        if (authority !== undefined) {
+          const snapshot = await getManagedAuthSessionSetSnapshot(deps.db, {
+            authorityHash: managedAuthSha256(authority),
+            mode: "dual",
+            includeInternal: true,
+            readOnly: true,
+          });
+          if (snapshot) {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                snapshot.selected,
+                c.req.header("cookie") ?? null,
+              );
+          } else {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                null,
+                c.req.header("cookie") ?? null,
+              );
+          }
+        }
+      }
+      return await scrubManagedAuthProviderResponse(providerResponse, { replacementCookies });
+    });
   }
 
   app.get("/healthz", (c) =>
@@ -585,6 +715,7 @@ export function createAppComposition(deps: AppDependencies): {
             : {}),
         },
         productAccessMode: deps.settings.productAccessMode,
+        managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
         auth: clientAuthConfig(deps.settings),
         analytics: clientAnalyticsConfig(deps.settings),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
@@ -765,6 +896,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
   registerOrganizationMembershipRoutes(app, routeDeps);
+  registerOrganizationRecoveryRoutes(app, routeDeps);
   registerUserResourceAuthorityRoutes(app, routeDeps);
   registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);

package/src/auth/managed-auth-attempt-context.ts

@@ -0,0 +1,24 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+type ManagedAuthAttemptContext =
+  | { kind: "isolated_transaction"; transactionId: string }
+  | { kind: "discard_provider_session" };
+
+const managedAuthAttemptStorage = new AsyncLocalStorage<ManagedAuthAttemptContext>();
+
+export function runManagedAuthAttempt<T>(transactionId: string, action: () => T): T {
+  return managedAuthAttemptStorage.run({ kind: "isolated_transaction", transactionId }, action);
+}
+
+export function runManagedAuthDiscardedProviderSession<T>(action: () => T): T {
+  return managedAuthAttemptStorage.run({ kind: "discard_provider_session" }, action);
+}
+
+export function currentManagedAuthAttemptId(): string | null {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" ? context.transactionId : null;
+}
+
+export function shouldDiscardCurrentManagedAuthProviderSession(): boolean {
+  return managedAuthAttemptStorage.getStore()?.kind === "discard_provider_session";
+}