@opengeni/api-router 3.0.1 → 3.1.2

package/src/workspace-webhook-dispatch.ts

@@ -0,0 +1,225 @@
+import { randomUUID } from "node:crypto";
+import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
+import {
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_SIGNATURE_HEADER,
+  signOpenGeniPayload,
+} from "@opengeni/contracts";
+import {
+  claimWorkspaceWebhookDeliveries,
+  claimOrganizationWebhookDeliveries,
+  decryptEnvironmentValue,
+  maintainSessionUsageLimits,
+  maintainWorkspaceAllowances,
+  pruneOrganizationWebhookDeliveries,
+  pruneWorkspaceWebhookDeliveries,
+  settleOrganizationWebhookDelivery,
+  settleWorkspaceWebhookDelivery,
+  type ClaimedWorkspaceWebhookDelivery,
+  type Database,
+} from "@opengeni/db";
+import { pinnedFetch } from "@opengeni/network";
+import type { Observability } from "@opengeni/observability";
+import { recordSessionUsageLimitEvent } from "@opengeni/core";
+
+export const WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE = 32;
+const CLAIM_SECONDS = 60;
+const POLL_INTERVAL_MS = 2_000;
+const DELIVERY_TIMEOUT_MS = 10_000;
+const PRUNE_EVERY_TICKS = 300;
+
+export type WorkspaceWebhookDispatchDeps = {
+  db: Database;
+  settings: Settings;
+  observability?: Pick<Observability, "info" | "warn" | "error"> &
+    Partial<Pick<Observability, "incrementCounter">>;
+  fetch?: typeof pinnedFetch;
+};
+
+export type WorkspaceWebhookBatchResult = { claimed: number; delivered: number; failed: number };
+
+function errorText(error: unknown): string {
+  if (error instanceof Error) {
+    if (error.name === "TimeoutError" || error.name === "AbortError") return "timeout";
+    return `${error.name}: ${error.message}`.slice(0, 500);
+  }
+  return String(error).slice(0, 500);
+}
+
+async function deliverOne(
+  deps: WorkspaceWebhookDispatchDeps,
+  key: Uint8Array,
+  claimId: string,
+  delivery: ClaimedWorkspaceWebhookDelivery,
+  organization = false,
+): Promise<"delivered" | "failed"> {
+  let status: number | null = null;
+  let error: string | null = null;
+  try {
+    const body = JSON.stringify(delivery.payload);
+    const secret = decryptEnvironmentValue(key, delivery.secretEncrypted);
+    const response = await (deps.fetch ?? pinnedFetch)(
+      delivery.url,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "user-agent": "OpenGeni-Webhooks/1",
+          [OPENGENI_SIGNATURE_HEADER]: await signOpenGeniPayload(secret, body),
+          [OPENGENI_EVENT_ID_HEADER]: delivery.eventId,
+          [OPENGENI_DELIVERY_ID_HEADER]: delivery.deliveryId,
+        },
+        body,
+        signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS),
+      },
+      deps.settings,
+      {
+        label: organization ? "Organization webhook" : "Workspace webhook",
+        requireHttpsOutsideLocalTest: true,
+      },
+    );
+    status = response.status;
+    await response.body?.cancel().catch(() => undefined);
+    if (status < 200 || status >= 300) error = `HTTP ${status}`;
+  } catch (caught) {
+    error = errorText(caught);
+  }
+  await (organization ? settleOrganizationWebhookDelivery : settleWorkspaceWebhookDelivery)(
+    deps.db,
+    {
+      deliveryId: delivery.deliveryId,
+      claimId,
+      status,
+      error,
+    },
+  );
+  return error === null ? "delivered" : "failed";
+}
+
+/**
+ * One bounded, resumable page of the per-task usage limit legacy import.
+ * Roots created before the feature stay `preparing` (never shown or
+ * admitted as $0 for a write) until this converges them. A failure is retried
+ * on a later tick (per-root exponential backoff with its SQLSTATE kept) and
+ * never blocks webhook delivery. The same pass discloses lost single-call
+ * custody markers as unpriced so a crashed process cannot block a task forever.
+ */
+async function importLegacySessionUsage(deps: WorkspaceWebhookDispatchDeps): Promise<void> {
+  const sink = deps.observability?.incrementCounter ? deps.observability : null;
+  const metrics = sink as Pick<Observability, "incrementCounter"> | null;
+  try {
+    const result = await maintainSessionUsageLimits(deps.db);
+    recordSessionUsageLimitEvent(metrics, "import", "imported", result.processed);
+    recordSessionUsageLimitEvent(metrics, "import", "import_failed", result.failed);
+    recordSessionUsageLimitEvent(metrics, "single_call", "lost_resolved", result.resolvedLost);
+    if (result.failed > 0) {
+      deps.observability?.warn("Session usage limit import pages failed", {
+        failed: result.failed,
+        sqlstates: JSON.stringify(result.errors),
+      });
+    }
+  } catch (error) {
+    recordSessionUsageLimitEvent(metrics, "import", "import_failed");
+    deps.observability?.warn("Session usage limit import failed", { error: errorText(error) });
+  }
+}
+
+/** Claim and deliver one globally bounded batch. At-least-once: receivers dedupe on event id. */
+export async function drainWorkspaceWebhookDeliveries(
+  deps: WorkspaceWebhookDispatchDeps,
+): Promise<WorkspaceWebhookBatchResult> {
+  // Usage-limit maintenance contains its own failures, so it runs first: a
+  // failing allowance pass cannot keep lost custody markers (and the tasks
+  // they park) unresolved.
+  await importLegacySessionUsage(deps);
+  // Allowance rollover/expiry does not depend on webhook secrets, usage
+  // readers, inference or having any pending delivery.
+  await maintainWorkspaceAllowances(deps.db);
+  const key = environmentsEncryptionKeyBytes(deps.settings);
+  if (!key) return { claimed: 0, delivered: 0, failed: 0 };
+  const claimId = randomUUID();
+  const claims = await claimWorkspaceWebhookDeliveries(deps.db, {
+    claimId,
+    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,
+    claimSeconds: CLAIM_SECONDS,
+  });
+  // Each lane is bounded; the shared pump does not starve organization queues
+  // behind a sustained workspace backlog.
+  const organizationClaims = await claimOrganizationWebhookDeliveries(deps.db, {
+    claimId,
+    limit: WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE,
+    claimSeconds: CLAIM_SECONDS,
+  });
+  const outcomes = await Promise.all(
+    [
+      ...claims.map((delivery) => ({ delivery, organization: false })),
+      ...organizationClaims.map((delivery) => ({ delivery, organization: true })),
+    ].map(async ({ delivery, organization }) => {
+      try {
+        return await deliverOne(deps, key, claimId, delivery, organization);
+      } catch (error) {
+        deps.observability?.warn("Workspace webhook settlement failed", {
+          deliveryId: delivery.deliveryId,
+          error: errorText(error),
+        });
+        return "failed" as const;
+      }
+    }),
+  );
+  return {
+    claimed: claims.length + organizationClaims.length,
+    delivered: outcomes.filter((outcome) => outcome === "delivered").length,
+    failed: outcomes.filter((outcome) => outcome === "failed").length,
+  };
+}
+
+/**
+ * One non-overlapping loop per API replica. PostgreSQL claims coordinate
+ * replicas; a crash only delays a delivery until its claim expires.
+ */
+export function startWorkspaceWebhookDispatchPump(
+  deps: WorkspaceWebhookDispatchDeps,
+  options: {
+    intervalMs?: number;
+    drain?: (deps: WorkspaceWebhookDispatchDeps) => Promise<WorkspaceWebhookBatchResult>;
+  } = {},
+): () => Promise<void> {
+  const intervalMs = Math.max(100, options.intervalMs ?? POLL_INTERVAL_MS);
+  const drain = options.drain ?? drainWorkspaceWebhookDeliveries;
+  let stopped = false;
+  let running: Promise<void> | undefined;
+  let ticks = 0;
+
+  const tick = (): void => {
+    if (stopped || running) return;
+    ticks += 1;
+    // A full batch means a backlog: drain it now instead of one batch per interval.
+    let backlog = false;
+    running = (async () => {
+      const result = await drain(deps);
+      backlog = result.claimed >= WORKSPACE_WEBHOOK_DISPATCH_BATCH_SIZE;
+      if (result.claimed > 0) deps.observability?.info("Workspace webhook batch settled", result);
+      if (ticks % PRUNE_EVERY_TICKS === 0) {
+        await pruneWorkspaceWebhookDeliveries(deps.db);
+        await pruneOrganizationWebhookDeliveries(deps.db);
+      }
+    })()
+      .catch((error: unknown) => {
+        deps.observability?.error("Workspace webhook dispatch failed", { error: errorText(error) });
+      })
+      .finally(() => {
+        running = undefined;
+        if (backlog && !stopped) queueMicrotask(tick);
+      });
+  };
+
+  const timer = setInterval(tick, intervalMs);
+  queueMicrotask(tick);
+
+  return async () => {
+    stopped = true;
+    clearInterval(timer);
+    await running;
+  };
+}

package/src/xai-realtime.ts

@@ -3,21 +3,24 @@ import type { GatewayRealtimeInitialItem } from "@opengeni/contracts";
 import {
   getActiveSessionHistoryItems,
   getSessionRealtimeContinuityEntries,
-  getXaiSessionAccountPin,
-  resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
-  setXaiSessionAccountPin,
+  readSubscriptionCoreProviderRouteForWorkspace,
+  readSubscriptionCoreSessionOwner,
+  SUBSCRIPTION_CORE_XAI,
+  SUBSCRIPTION_CORE_XAI_PROVIDER,
+  subscriptionCoreOperationConnections,
+  subscriptionCoreXaiRequestAuth,
   type Database,
+  type SubscriptionCoreFetch,
 } from "@opengeni/db";
 import {
   XAI_CLIENT_MODE,
   XAI_CLIENT_VERSION,
   XAI_PUBLIC_API_BASE_URL,
-  type XaiFetch,
+  type XaiProxyAuthContext,
 } from "@opengeni/xai-subscription";
 
 import { openGeniRealtimeInstructions } from "./codex-realtime";
 import { projectSessionRealtimeInitialItems } from "./session-realtime-context";
-import { buildXaiSubscriptionAuthorization } from "./xai-subscription-auth";
 
 const UPSTREAM_MODEL_ID = "grok-voice-think-fast-2.0";
 
@@ -61,86 +64,85 @@ export async function createXaiRealtimeConnectionSecret(input: {
       "The selected model is not a connected SuperGrok realtime model",
     );
   }
-  const authoritySnapshot = await resolveXaiProviderAccountAuthoritySnapshotForAcceptance(
-    input.db,
-    { workspaceId: input.workspaceId, subjectId: input.subjectId },
-  );
-  let pin = await getXaiSessionAccountPin(input.db, {
+  const route = await readSubscriptionCoreProviderRouteForWorkspace(input.db, {
+    accountId: input.accountId,
     workspaceId: input.workspaceId,
-    subjectId: input.subjectId,
-    sessionId: input.sessionId,
-    authoritySnapshot,
+    provider: SUBSCRIPTION_CORE_XAI_PROVIDER,
   });
-  let auth: Awaited<ReturnType<typeof buildXaiSubscriptionAuthorization>>;
-  try {
-    auth = await buildXaiSubscriptionAuthorization({
-      db: input.db,
-      settings: input.settings,
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      subjectId: input.subjectId,
-      shardKey: input.sessionId,
-      pinnedCredentialId: pin?.pinnedCredentialId ?? null,
-      pinSource: pin?.pinSource === "manual" || pin?.pinSource === "policy" ? pin.pinSource : null,
-      authoritySnapshot,
-      sessionId: input.sessionId,
-      ...(input.fetchImpl ? { fetch: input.fetchImpl as XaiFetch } : {}),
-    });
-    if (
-      auth.rotationEnabled &&
-      pin?.pinSource !== "manual" &&
-      pin?.pinnedCredentialId !== auth.credentialId
-    ) {
-      try {
-        pin = await setXaiSessionAccountPin(input.db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          subjectId: input.subjectId,
-          sessionId: input.sessionId,
-          authoritySnapshot,
-          credentialId: auth.credentialId,
-          pinSource: "policy",
-          expectedVersion: pin?.version ?? null,
-        });
-      } catch {
-        const current = await getXaiSessionAccountPin(input.db, {
-          workspaceId: input.workspaceId,
-          subjectId: input.subjectId,
-          sessionId: input.sessionId,
-          authoritySnapshot,
-        });
-        if (current?.pinSource === "manual" && current.pinnedCredentialId !== auth.credentialId) {
-          auth = await buildXaiSubscriptionAuthorization({
-            db: input.db,
-            settings: input.settings,
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            subjectId: input.subjectId,
-            shardKey: input.sessionId,
-            pinnedCredentialId: current.pinnedCredentialId,
-            pinSource: "manual",
-            authoritySnapshot,
-            sessionId: input.sessionId,
-            ...(input.fetchImpl ? { fetch: input.fetchImpl as XaiFetch } : {}),
-          });
-        }
-      }
-    }
-  } catch {
+  // SuperGrok realtime runs only on the shared core; any other route
+  // (maintenance, or no receipt) has no eligible account.
+  if (route !== "core") {
     throw new XaiRealtimeBrokerError(
       "credential_unavailable",
       "No eligible connected SuperGrok account is available",
     );
   }
+  return await createCoreXaiRealtimeConnectionSecret(input);
+}
 
-  const [history, continuity, minted] = await Promise.all([
-    getActiveSessionHistoryItems(input.db, input.workspaceId, input.sessionId),
-    getSessionRealtimeContinuityEntries(input.db, input.workspaceId, input.sessionId),
-    mintXaiClientSecret({
-      auth,
+/**
+ * SuperGrok realtime on the shared subscription core (the M3 Codex rule,
+ * EP-N05/N07/S17): the session's recorded owner (never the caller), shared
+ * organization- or workspace-scoped connections only (decision 3), a
+ * `realtime` operation lease held through the client-secret request, with
+ * refresh under the per-connection lock. The session binding is never read
+ * for placement beyond an explicit choice and never written (decision 6).
+ */
+async function createCoreXaiRealtimeConnectionSecret(input: {
+  db: Database;
+  settings: Settings;
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  fetchImpl?: typeof fetch;
+}): Promise<XaiRealtimeConnectionSecret> {
+  const unavailable = () =>
+    new XaiRealtimeBrokerError(
+      "credential_unavailable",
+      "No eligible connected SuperGrok account is available",
+    );
+  // The deployment switch for SuperGrok subscriptions, as the Codex broker checks its own.
+  if (!input.settings.supergrokSubscriptionEnabled) throw unavailable();
+  const context = {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sessionId: input.sessionId,
+  };
+  const owner = await readSubscriptionCoreSessionOwner(input.db, context);
+  if (!owner) throw unavailable();
+  const scope = {
+    kind: "session" as const,
+    ...context,
+    sessionOwnerSubjectId: owner.ownerSubjectId,
+  };
+  const connections = subscriptionCoreOperationConnections(SUBSCRIPTION_CORE_XAI);
+  const candidates = await connections.listSubscriptionCoreOperationCandidates(input.db, scope);
+  const ran = await connections.runSubscriptionCoreOperation(
+    input.db,
+    input.settings,
+    scope,
+    {
+      candidates: candidates.map((candidate) => candidate.connectionId),
+      operationKind: "realtime",
+      holderId: `realtime:${input.sessionId}`,
       fetchImpl: input.fetchImpl ?? fetch,
-    }),
-  ]);
+    },
+    async ({ resolver, fetch: requestFetch, fence }) =>
+      await Promise.all([
+        getActiveSessionHistoryItems(input.db, input.workspaceId, input.sessionId),
+        getSessionRealtimeContinuityEntries(input.db, input.workspaceId, input.sessionId),
+        mintXaiClientSecret({
+          context: subscriptionCoreXaiRequestAuth(resolver),
+          fetchImpl: async (url, init) => {
+            // Pre-dispatch fence on the exact operation lease.
+            if (!(await fence())) throw unavailable();
+            return await requestFetch(url, init);
+          },
+        }),
+      ]),
+  );
+  if (ran.kind === "unavailable") throw unavailable();
+  const [history, continuity, minted] = ran.value;
   return {
     ...minted,
     upstreamModelId: UPSTREAM_MODEL_ID,
@@ -150,8 +152,8 @@ export async function createXaiRealtimeConnectionSecret(input: {
 }
 
 async function mintXaiClientSecret(input: {
-  auth: Awaited<ReturnType<typeof buildXaiSubscriptionAuthorization>>;
-  fetchImpl: typeof fetch;
+  context: Pick<XaiProxyAuthContext, "getToken" | "refresh">;
+  fetchImpl: SubscriptionCoreFetch;
 }): Promise<{ token: string; url: string; expiresAt: number | null }> {
   const request = async (accessToken: string) =>
     await input.fetchImpl(`${XAI_PUBLIC_API_BASE_URL}/realtime/client_secrets`, {
@@ -168,14 +170,16 @@ async function mintXaiClientSecret(input: {
     });
   let response: Response;
   try {
-    let token = await input.auth.context.getToken();
+    let token = await input.context.getToken();
     response = await request(token.accessToken);
     if (response.status === 401) {
       await response.body?.cancel().catch(() => undefined);
-      token = await input.auth.context.refresh();
+      token = await input.context.refresh();
       response = await request(token.accessToken);
     }
-  } catch {
+  } catch (error) {
+    // A core pre-dispatch fence refusal is already typed (legacy never raises one).
+    if (error instanceof XaiRealtimeBrokerError) throw error;
     throw new XaiRealtimeBrokerError("provider_error", "xAI realtime token request failed");
   }
   if (!response.ok) {

package/src/xai-subscription-core.ts

@@ -0,0 +1,172 @@
+import type { Settings } from "@opengeni/config";
+import {
+  deliverSubscriptionCoreProviderWake,
+  readSubscriptionCoreProviderRouteForWorkspace,
+  SUBSCRIPTION_CORE_XAI,
+  SUBSCRIPTION_CORE_XAI_PROVIDER,
+  subscriptionCoreAdministeredConnections,
+  subscriptionCoreOperationConnections,
+  subscriptionCorePersonalConnections,
+  type Database,
+} from "@opengeni/db";
+
+/**
+ * Whether SuperGrok can serve a workspace-level operation (video funding,
+ * realtime catalog, transcription): "a shared xAI candidate exists for
+ * this workspace" on the shared core, organization- or workspace-scoped
+ * shared connections only, never the viewer's personal accounts (design 5.3,
+ * EP-N11). Any route other than `core` (maintenance, or no receipt, which
+ * this binary's readiness check refuses) serves nothing.
+ */
+export async function workspaceXaiOperationAvailable(
+  db: Database,
+  settings: Settings,
+  input: { accountId: string; workspaceId: string; subjectId: string },
+): Promise<boolean> {
+  const route = await readSubscriptionCoreProviderRouteForWorkspace(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    provider: SUBSCRIPTION_CORE_XAI_PROVIDER,
+  });
+  if (route !== "core" || !settings.supergrokSubscriptionEnabled) return false;
+  const candidates = await subscriptionCoreOperationConnections(
+    SUBSCRIPTION_CORE_XAI,
+  ).listSubscriptionCoreOperationCandidates(db, { kind: "workspace", ...input });
+  return candidates.length > 0;
+}
+
+/** The SuperGrok status payload. */
+export type XaiStatusPayload<Model> = {
+  connected: boolean;
+  valid: boolean;
+  accountCount: number;
+  models?: Model[];
+  activeAccount?: {
+    id: string;
+    label: string | null;
+    subject: string | null;
+    scope: "workspace" | "organization" | "user";
+  };
+};
+
+/**
+ * The SuperGrok status after the cutover receipt (design 5.3, status
+ * probe): the workspace's shared pool and its effective primary, validated
+ * by one live model read through the adapter on that connection. Any route
+ * other than the shared core reports nothing usable.
+ *
+ * The viewer's own personal connections count as connected wherever the
+ * owner-only reader shows them. Only in the viewer's own Personal workspace,
+ * only without a shared primary, and only for a caller who passes the
+ * owner check of a private account (`ownerVerified`: the verified owning
+ * person with `connections:write`, by browser sign-in, a verified
+ * external-identity assertion linked to them, or an agent acting with their
+ * full access; never a read-only agent, a plain bearer or the person's own
+ * API keys), is a personal connection the effective account (legacy scope
+ * `user`),
+ * validated by one live usage read as its owner there; that read also
+ * applies the organization's personal-connections rule (0735). Any other
+ * caller gets the stored count only, with no live read and no wake.
+ * Another person's personal connections are never listed.
+ */
+export async function readXaiCoreStatus<Model>(
+  deps: { db: Database; settings: Settings },
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    models: () => Promise<Model[]>;
+    /** Asked only before a live personal read; false refuses it. */
+    ownerVerified: () => Promise<boolean>;
+    fetch?: unknown;
+  },
+): Promise<XaiStatusPayload<Model>> {
+  const scope = {
+    kind: "workspace" as const,
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId,
+  };
+  const route = await readSubscriptionCoreProviderRouteForWorkspace(deps.db, {
+    ...scope,
+    provider: SUBSCRIPTION_CORE_XAI_PROVIDER,
+  });
+  if (route !== "core") return { connected: false, valid: false, accountCount: 0 };
+  const connections = subscriptionCoreOperationConnections(SUBSCRIPTION_CORE_XAI);
+  const [pool, personal] = await Promise.all([
+    connections.readSubscriptionCoreWorkspaceConnections(deps.db, scope),
+    subscriptionCorePersonalConnections(
+      SUBSCRIPTION_CORE_XAI,
+    ).readSubscriptionCorePersonalConnections(deps.db, scope),
+  ]);
+  const accountCount = pool.connections.length + personal.connections.length;
+  const fetchDeps = input.fetch ? { fetchImpl: input.fetch as typeof fetch } : {};
+  const active = pool.connections.find(
+    (connection) => connection.connectionId === pool.primaryConnectionId,
+  );
+  const ownActive = personal.ownPersonalWorkspace
+    ? personal.connections.find((connection) => connection.status === "active")
+    : undefined;
+  if (!active && ownActive && (await input.ownerVerified())) {
+    const probe = await subscriptionCoreAdministeredConnections(
+      SUBSCRIPTION_CORE_XAI,
+    ).probeSubscriptionCoreAdministeredConnectionUsage(
+      deps.db,
+      deps.settings,
+      {
+        kind: "personal_owner",
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+      },
+      ownActive.connectionId,
+      fetchDeps,
+    );
+    const valid = probe.kind === "read";
+    if (probe.kind === "read" && probe.recovered) {
+      // The reading is stored and may have ended an exhaustion: wake the
+      // organization's SuperGrok core waiters. The reading already
+      // committed, so a failed wake hint never fails the status (every core
+      // waiter has its own recheck).
+      await deliverSubscriptionCoreProviderWake(deps.db, SUBSCRIPTION_CORE_XAI_PROVIDER, {
+        accountId: input.accountId,
+        reason: "usage_recovered",
+      }).catch(() => undefined);
+    }
+    return {
+      connected: true,
+      valid,
+      accountCount,
+      models: valid ? await input.models() : [],
+      activeAccount: {
+        id: ownActive.connectionId,
+        label: ownActive.label,
+        subject: ownActive.providerAccountId,
+        scope: "user",
+      },
+    };
+  }
+  if (!active) {
+    return { connected: accountCount > 0, valid: false, accountCount };
+  }
+  const probe = await connections.probeSubscriptionCoreConnectionLiveModels(
+    deps.db,
+    deps.settings,
+    scope,
+    active.connectionId,
+    fetchDeps,
+  );
+  const valid = probe.kind === "read";
+  return {
+    connected: true,
+    valid,
+    accountCount,
+    models: valid ? await input.models() : [],
+    activeAccount: {
+      id: active.connectionId,
+      label: active.label,
+      subject: active.providerAccountId,
+      scope: active.source,
+    },
+  };
+}

package/dist/browser-auth-broker.d.ts

@@ -1,20 +0,0 @@
-import type { BrowserProtectedAuthFieldValue, ProtectedAuthField, SiteAuthAuthority } from "@opengeni/contracts";
-type ConnectionFieldsAuthority = Extract<SiteAuthAuthority, {
-    kind: "connection_fields";
-}>;
-export declare class BrowserAuthCredentialError extends Error {
-    readonly name = "BrowserAuthCredentialError";
-}
-export declare function resolveProtectedAuthFieldValues(input: {
-    authority: ConnectionFieldsAuthority;
-    requestedFields: readonly ProtectedAuthField[];
-    credential: Readonly<Record<string, unknown>>;
-    nowMs?: number;
-}): BrowserProtectedAuthFieldValue[];
-export declare function totpCode(secretValue: string, options?: {
-    digits?: number;
-    periodSeconds?: number;
-    algorithm?: "sha1" | "sha256" | "sha512";
-    nowMs?: number;
-}): string;
-export {};