@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/dist/workspace-tool-gateway.d.ts

@@ -0,0 +1,118 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { Settings } from "@opengeni/config";
+import { ToolGatewayDeclarationsResponse, type AccessGrant, type ToolGatewayCatalog, type ToolGatewayIdentity } from "@opengeni/contracts";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
+import { consumeToolGatewayApproval, issueToolGatewayApproval } from "@opengeni/db";
+import { type PreparedWorkspaceToolGatewayTools } from "@opengeni/runtime/workspace-tool-gateway";
+import { type ToolGatewayDefinition } from "@opengeni/tool-gateway";
+import type { Observability } from "@opengeni/observability";
+export type PreparedWorkspaceToolGateway = Pick<PreparedWorkspaceToolGatewayTools, "toolGateway" | "toolGatewayCatalog" | "close"> & {
+    toolGateway: NonNullable<PreparedWorkspaceToolGatewayTools["toolGateway"]>;
+    toolGatewayCatalog: NonNullable<PreparedWorkspaceToolGatewayTools["toolGatewayCatalog"]>;
+};
+type WorkspaceSiteToolContext = {
+    siteArtifactId: string;
+    siteVersionId: string;
+    identity: {
+        serverId: string;
+        toolName: string;
+    };
+};
+type AuthorizeWorkspaceSiteTool = (db: ApiRouteDeps["db"], grant: AccessGrant, context: WorkspaceSiteToolContext) => Promise<void>;
+export declare function grantUsesAttemptScopedMcp(grant: AccessGrant): boolean;
+export declare function requireWorkspaceToolGatewayGrant(grant: AccessGrant): void;
+export declare function requireWorkspaceToolGatewayAuthorization(authorization: AccessGrantAuthorization): AccessGrant;
+export declare function prepareWorkspaceToolGateway(routeDeps: ApiRouteDeps, authorization: AccessGrantAuthorization): Promise<PreparedWorkspaceToolGateway>;
+export declare function prepareMcpOAuthWorkspaceToolGateway(routeDeps: ApiRouteDeps, grant: AccessGrant, allowedIdentities: readonly {
+    serverId: string;
+    toolName: string;
+}[]): Promise<PreparedWorkspaceToolGateway>;
+export declare function prepareWorkspaceToolGatewayForGrant(routeDeps: ApiRouteDeps, grant: AccessGrant, allowedIdentities?: readonly {
+    serverId: string;
+    toolName: string;
+}[]): Promise<PreparedWorkspaceToolGateway>;
+export declare function workspaceToolGatewayDefinitionFilter(settings: Pick<Settings, "allowedFirstPartyMcpTools">, allowedIdentities?: readonly ToolGatewayIdentity[]): (definition: ToolGatewayDefinition) => boolean;
+export declare function workspaceToolGatewaySettingsForGrant(settings: Settings, grant: AccessGrant, allowedIdentities?: readonly {
+    serverId: string;
+    toolName: string;
+}[]): Settings;
+export declare function buildWorkspaceToolGatewayMcpServer(prepared: PreparedWorkspaceToolGateway, grant: AccessGrant, observability?: Observability): Server;
+export declare function callWorkspaceToolGateway(prepared: PreparedWorkspaceToolGateway, grant: AccessGrant, input: unknown, db?: ApiRouteDeps["db"], consumeApproval?: typeof consumeToolGatewayApproval, observability?: Observability, authorizeSiteTool?: AuthorizeWorkspaceSiteTool): Promise<{
+    operationId: string;
+    catalogDigest: string;
+    result: {
+        [x: string]: unknown;
+        content: ({
+            [x: string]: unknown;
+            type: "text";
+            text: string;
+            annotations?: Record<string, import("zod").JSONType> | undefined;
+            _meta?: Record<string, import("zod").JSONType> | undefined;
+        } | {
+            [x: string]: unknown;
+            type: "image";
+            data: string;
+            mimeType: string;
+            annotations?: Record<string, import("zod").JSONType> | undefined;
+            _meta?: Record<string, import("zod").JSONType> | undefined;
+        } | {
+            [x: string]: unknown;
+            type: "audio";
+            data: string;
+            mimeType: string;
+            annotations?: Record<string, import("zod").JSONType> | undefined;
+            _meta?: Record<string, import("zod").JSONType> | undefined;
+        } | {
+            [x: string]: unknown;
+            type: "resource_link";
+            name: string;
+            title?: string | undefined;
+            uri: string;
+            description?: string | undefined;
+            mimeType?: string | undefined;
+            size?: number | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "dark" | "light" | undefined;
+            }[] | undefined;
+            annotations?: Record<string, import("zod").JSONType> | undefined;
+            _meta?: Record<string, import("zod").JSONType> | undefined;
+        } | {
+            [x: string]: unknown;
+            type: "resource";
+            resource: {
+                [x: string]: unknown;
+                uri: string;
+                mimeType?: string | undefined;
+                text: string;
+                _meta?: Record<string, import("zod").JSONType> | undefined;
+            } | {
+                [x: string]: unknown;
+                uri: string;
+                mimeType?: string | undefined;
+                blob: string;
+                _meta?: Record<string, import("zod").JSONType> | undefined;
+            };
+            annotations?: Record<string, import("zod").JSONType> | undefined;
+            _meta?: Record<string, import("zod").JSONType> | undefined;
+        })[];
+        structuredContent?: Record<string, import("zod").JSONType> | undefined;
+        isError?: boolean | undefined;
+        _meta?: Record<string, import("zod").JSONType> | undefined;
+    };
+}>;
+export declare function approveWorkspaceToolGatewayCall(prepared: PreparedWorkspaceToolGateway, grant: AccessGrant, db: ApiRouteDeps["db"], input: unknown, issueApproval?: typeof issueToolGatewayApproval, observability?: Observability): Promise<{
+    operationId: string;
+    catalogDigest: string;
+    identity: {
+        serverId: string;
+        toolName: string;
+    };
+    approvalToken: string;
+    expiresAt: string;
+}>;
+export declare function toolGatewayCatalogResponse(catalog: ToolGatewayCatalog): ToolGatewayCatalog;
+export declare function workspaceToolGatewayDeclarations(prepared: PreparedWorkspaceToolGateway): ToolGatewayDeclarationsResponse;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.6.4",
+  "version": "2.10.0-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,23 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1",
-    "@opengeni/artifact-tool": "^0.3.14",
-    "@opengeni/capabilities": "^0.3.1",
-    "@opengeni/codemode": "^0.4.22",
-    "@opengeni/codex": "^0.2.20",
-    "@opengeni/config": "^0.22.5",
-    "@opengeni/contracts": "^2.9.2",
-    "@opengeni/core": "^2.6.4",
-    "@opengeni/db": "^3.7.4",
-    "@opengeni/documents": "^0.8.14",
-    "@opengeni/events": "^0.4.12",
-    "@opengeni/github": "^0.6.7",
-    "@opengeni/network": "^0.2.3",
-    "@opengeni/observability": "^0.8.14",
-    "@opengeni/runtime": "^2.0.1",
-    "@opengeni/storage": "^0.2.115",
-    "@opengeni/xai-subscription": "^0.1.2",
+    "@opengeni/agent-proto": "^0.5.1-canary.9",
+    "@opengeni/artifact-tool": "^0.3.19-canary.0",
+    "@opengeni/capabilities": "^0.3.2-canary.0",
+    "@opengeni/codemode": "^0.4.27-canary.0",
+    "@opengeni/codex": "^0.2.21-canary.0",
+    "@opengeni/config": "^1.0.0-canary.0",
+    "@opengeni/contracts": "^2.13.0-canary.0",
+    "@opengeni/core": "^2.7.5-canary.0",
+    "@opengeni/db": "^4.0.0-canary.0",
+    "@opengeni/documents": "^0.8.19-canary.0",
+    "@opengeni/events": "^0.4.17-canary.0",
+    "@opengeni/github": "^0.7.3-canary.0",
+    "@opengeni/network": "^0.3.0-canary.0",
+    "@opengeni/observability": "^0.8.19-canary.0",
+    "@opengeni/runtime": "^2.3.0-canary.0",
+    "@opengeni/storage": "^0.2.120-canary.0",
+    "@opengeni/tool-gateway": "^0.1.0-canary.0",
+    "@opengeni/xai-subscription": "^0.1.3-canary.0",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/access-grant-rls.ts

@@ -0,0 +1,40 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import {
+  requireLiveAgentAttemptAuthorization,
+  SessionAuthorizationDeniedError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import { withSessionRlsActorContext } from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+
+export async function withAccessGrantSessionRlsContext<T>(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  fn: () => Promise<T>,
+): Promise<T> {
+  if (grant.principalKind !== "agent_attempt") {
+    return await withSessionRlsActorContext({ subjectId: grant.subjectId }, fn);
+  }
+  const callerSessionId = grant.metadata?.sessionId;
+  if (typeof callerSessionId !== "string") {
+    throw new HTTPException(403, { message: "agent attempt authority is invalid" });
+  }
+  try {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId);
+    return await withSessionRlsActorContext(
+      {
+        subjectId: actor.subjectId,
+        initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      },
+      fn,
+    );
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw new HTTPException(403, {
+        message: "agent attempt authority is invalid",
+        cause: error,
+      });
+    }
+    throw error;
+  }
+}