@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/dist/access-grant-rls.d.ts

@@ -0,0 +1,3 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+export declare function withAccessGrantSessionRlsContext<T>(deps: ApiRouteDeps, grant: AccessGrant, fn: () => Promise<T>): Promise<T>;

package/dist/app.d.ts

@@ -1,4 +1,4 @@
-import { type ErrorCode } from "@opengeni/contracts";
+import { type AccessGrant, type ErrorCode } from "@opengeni/contracts";
 import { Hono } from "hono";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 export { allowedCorsOrigin } from "./http/cors.js";
@@ -13,6 +13,7 @@ export declare function apiRequestBodyLimitBytes(settings: {
     voiceInputResumableMaxChunkSizeBytes?: number;
 }): number;
 export declare function createApp(deps: AppDependencies): Hono;
+export declare function resolveWorkspaceMcpRouteDeps(routeDeps: ApiRouteDeps, grant: AccessGrant): Promise<ApiRouteDeps>;
 export declare function createAppComposition(deps: AppDependencies): {
     app: Hono;
     routeDeps: ApiRouteDeps;

package/dist/app.js

@@ -12,6 +12,7 @@ import {
   mergeToolRefs,
   normalizeResources,
   replaySessionEvents,
+  resolveWorkspaceMcpRouteDeps,
   routeLabel,
   sseSessionStream,
   sseWorkspaceControlStream,
@@ -23,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-XTLI3CBH.js";
+} from "./chunk-XXH7DW34.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,
@@ -38,6 +39,7 @@ export {
   mergeToolRefs,
   normalizeResources,
   replaySessionEvents,
+  resolveWorkspaceMcpRouteDeps,
   routeLabel,
   sseSessionStream,
   sseWorkspaceControlStream,

package/dist/auth/organization-user-setup.d.ts

@@ -1,5 +1,6 @@
 import type { Settings } from "@opengeni/config";
 import type { ManagedEmailTransport } from "@opengeni/core";
+export type OrganizationUserSetupEmailTokenTransport = "fragment" | "query";
 /**
  * Prove that the stable invited-user setup bearer can be constructed before an
  * invitation commits. Provider availability is intentionally outside this
@@ -7,11 +8,14 @@ import type { ManagedEmailTransport } from "@opengeni/core";
  * transport outcome after the invitation exists.
  */
 export declare function assertOrganizationUserSetupDeliveryConfigured(settings: Settings, transport: ManagedEmailTransport): void;
+/** Enforce the query-bearing edge proof for env and embedded settings alike. */
+export declare function assertOrganizationUserSetupQueryTransportConfigured(settings: Pick<Settings, "organizationUserSetupEmailTokenTransport" | "organizationUserSetupQueryEdgeSanitizationConfirmed">): void;
 /** Reject an invalid embedded-provider contract before any durable boundary. */
 export declare function assertManagedEmailTransportMetadata(transport: ManagedEmailTransport): void;
 export declare function deriveOrganizationUserSetupToken(settings: Settings, input: {
     invitationId: string;
     deliveryId: string;
+    transport?: OrganizationUserSetupEmailTokenTransport;
 }): Promise<{
     token: string;
     digest: string;
@@ -45,6 +49,25 @@ export declare function organizationUserSetupPayloadDigest(input: {
     html: string;
     providerIdempotencyScope: string;
 }): Promise<string>;
+export declare function resolveOrganizationUserSetupDeliveryEmail(settings: Settings, input: {
+    invitationId: string;
+    deliveryId: string;
+    senderEmail: string;
+    recipientEmail: string;
+    recipientName: string | null;
+    organizationName: string;
+    organizationRole: "owner" | "admin" | "member";
+    sharedWorkspaceAccess: OrganizationUserSetupEmailSnapshot["sharedWorkspaceAccess"];
+    providerIdempotencyScope: string;
+    frozenTransport: OrganizationUserSetupEmailTokenTransport | null;
+    frozenPayloadDigest: string | null;
+}): Promise<{
+    transport: OrganizationUserSetupEmailTokenTransport;
+    token: string;
+    tokenDigest: string;
+    payloadDigest: string;
+    message: ReturnType<typeof renderOrganizationUserSetupEmail>;
+}>;
 export declare function organizationUserSetupRequestFingerprint(settings: Settings, input: {
     tokenDigest: string;
     name: string;