@opengeni/core 0.12.1 → 0.12.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.12.1",
+  "version": "0.12.5",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -35,14 +35,14 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.8",
-    "@opengeni/contracts": "^0.20.1",
-    "@opengeni/db": "^0.13.1",
-    "@opengeni/documents": "^0.2.38",
-    "@opengeni/events": "^0.3.29",
+    "@opengeni/config": "^0.7.10",
+    "@opengeni/contracts": "^0.21.0",
+    "@opengeni/db": "^0.13.4",
+    "@opengeni/documents": "^0.2.41",
+    "@opengeni/events": "^0.3.32",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.13.12",
-    "@opengeni/storage": "^0.2.32",
+    "@opengeni/runtime": "^0.14.0",
+    "@opengeni/storage": "^0.2.34",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -86,6 +86,10 @@ export function hasPermission(permissions: Permission[], permission: Permission)
 
 async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {
   if (deps.settings.productAccessMode === "local") {
+    const delegated = await delegatedAccessContext(c, deps, "local");
+    if (delegated) {
+      return delegated;
+    }
     return await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
@@ -198,7 +202,7 @@ async function apiKeyAccessContext(
 async function delegatedAccessContext(
   c: Context,
   deps: AccessDeps,
-  mode: "configured" | "managed",
+  mode: "local" | "configured" | "managed",
   token = bearerToken(c),
 ): Promise<AccessContext | null> {
   if (!token || !deps.settings.delegationSecret) {

package/src/domain/capabilities.ts

@@ -27,6 +27,7 @@ import {
   getVariableSet,
   listCapabilityCatalogItems,
   listCapabilityInstallations,
+  listConnectionsMetadata,
   listEnabledMcpCapabilityServers,
   listPackInstallations,
   mcpServerIdForCapability,
@@ -424,14 +425,10 @@ async function validateMcpCapabilityConnectionRef(
   item: CapabilityCatalogItem,
   ref: McpServerConnectionRef,
 ): Promise<McpServerConnectionRef> {
-  if (ref.subjectScope === "subject") {
-    throw new HTTPException(422, {
-      message: "subject-owned connection refs are not supported for agent runtime use yet",
-    });
-  }
+  const subjectScope = ref.subjectScope ?? "workspace";
   const normalized: McpServerConnectionRef = {
     providerDomain: ref.providerDomain.trim(),
-    subjectScope: "workspace",
+    subjectScope,
     ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),
     ...(ref.provider ? { provider: ref.provider.trim() } : {}),
     ...(ref.kind ? { kind: ref.kind } : {}),
@@ -450,23 +447,41 @@ async function validateMcpCapabilityConnectionRef(
         "MCP capabilities need a remote streamable HTTP endpoint before they can use a connectionRef",
     });
   }
-  if (!normalized.connectionId) {
-    return normalized;
+
+  let connection = normalized.connectionId
+    ? await getConnectionMetadata(
+        input.db,
+        input.workspaceId,
+        normalized.connectionId,
+        input.grant.subjectId,
+      )
+    : null;
+  if (!connection && subjectScope === "subject" && !normalized.connectionId) {
+    const visible = await listConnectionsMetadata(
+      input.db,
+      input.workspaceId,
+      input.grant.subjectId,
+    );
+    connection =
+      visible.find(
+        (candidate) =>
+          candidate.subjectId === input.grant.subjectId &&
+          candidate.providerDomain === normalized.providerDomain &&
+          (!normalized.kind || candidate.kind === normalized.kind) &&
+          candidate.status === "active",
+      ) ?? null;
   }
-  const connection = await getConnectionMetadata(
-    input.db,
-    input.workspaceId,
-    normalized.connectionId,
-    input.grant.subjectId,
-  );
   if (!connection) {
     throw new HTTPException(422, {
-      message: "connectionRef.connectionId does not reference a visible connection",
+      message: "connectionRef does not reference a visible active connection",
     });
   }
-  if (connection.subjectId !== null) {
+  if (
+    (subjectScope === "subject" && connection.subjectId !== input.grant.subjectId) ||
+    (subjectScope === "workspace" && connection.subjectId !== null)
+  ) {
     throw new HTTPException(422, {
-      message: "agent runtime connection refs must reference workspace-shared connections in I1",
+      message: `connectionRef does not reference a ${subjectScope}-owned connection`,
     });
   }
   if (connection.status !== "active") {
@@ -484,6 +499,11 @@ async function validateMcpCapabilityConnectionRef(
       message: "connectionRef.kind does not match the referenced connection",
     });
   }
+  if (subjectScope === "subject") {
+    const genericSubjectRef = { ...normalized, kind: connection.kind };
+    delete genericSubjectRef.connectionId;
+    return genericSubjectRef;
+  }
   return normalized;
 }
 
@@ -1157,12 +1177,16 @@ function installationConnectionRef(
   if (!ref || typeof ref !== "object") {
     return null;
   }
-  const { connectionId, providerDomain, kind } = ref as Record<string, unknown>;
-  if (
-    typeof connectionId !== "string" ||
-    typeof providerDomain !== "string" ||
-    typeof kind !== "string"
-  ) {
+  const { connectionId, providerDomain, kind, subjectScope } = ref as Record<string, unknown>;
+  if (typeof providerDomain !== "string" || typeof kind !== "string") {
+    return null;
+  }
+  if (subjectScope === "subject") {
+    // Never project a personal connection UUID through workspace-visible
+    // capability configuration, including legacy rows that still contain one.
+    return { providerDomain, kind, subjectScope: "subject" };
+  }
+  if (typeof connectionId !== "string") {
     return null;
   }
   return { connectionId, providerDomain, kind };

package/src/domain/sessions.ts

@@ -23,6 +23,7 @@ import {
   type ReasoningEffort,
   type ResourceRef,
   type Session,
+  type SessionSkill,
   type SessionEvent,
   SessionMcpApprovalPolicy,
   type SessionMcpCredentialUpdateInput,
@@ -491,6 +492,7 @@ export async function createAndStartSession(input: {
   initialMessage: string;
   turnInstructions?: string | null;
   resources: ResourceRef[];
+  skills?: SessionSkill[];
   tools: ToolRef[];
   // Public admission always supplies provenance; optional keeps internal
   // callers that predate durable tool-policy provenance source-compatible
@@ -578,6 +580,7 @@ export async function createAndStartSession(input: {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...(input.toolPolicy ? { toolPolicy: input.toolPolicy } : {}),
       metadata: sessionMetadata,
@@ -621,6 +624,7 @@ export async function createAndStartSession(input: {
       initialMessage: input.initialMessage,
       initialTurnInstructions: input.turnInstructions ?? null,
       resources: input.resources,
+      skills: input.skills ?? [],
       tools: input.tools,
       ...(input.toolPolicy ? { toolPolicy: input.toolPolicy } : {}),
       metadata: sessionMetadata,
@@ -1090,6 +1094,9 @@ export async function createSessionForRequest(
       ? payload.resources
       : (parentSession?.resources ?? payload.resources),
   );
+  const skills = hasOwnProperty(rawPayload, "skills")
+    ? payload.skills
+    : (parentSession?.skills ?? payload.skills);
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
   const requestedTools = validateToolRefs(
     toolsProvided ? payload.tools : (parentSession?.tools ?? payload.tools),
@@ -1501,6 +1508,7 @@ export async function createSessionForRequest(
       initialMessage: payload.initialMessage,
       turnInstructions: payload.turnInstructions ?? null,
       resources,
+      skills,
       tools,
       toolPolicy,
       ...(payload.clientEventId ? { clientEventId: payload.clientEventId } : {}),