@opengeni/core 0.12.10 → 0.14.4

package/dist/managed-auth-type.d.ts

@@ -0,0 +1,2 @@
+import type { Auth } from "better-auth";
+export type ManagedAuth = Auth<any>;

package/dist/rigs/index.d.ts

@@ -0,0 +1,57 @@
+import type { AccessGrant, CreateRigRequest, RigDefinitionEditPayload, ProposeRigChangeRequest, Rig, RigChange, RigVersion, UpdateRigRequest } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export declare const MAX_RIGS_PER_WORKSPACE = 50;
+export declare const MAX_CHECKS_PER_RIG = 100;
+export declare const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
+export declare const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;
+export type RigServices = {
+    db: Database;
+};
+type RigAuditAction = "rig.created" | "rig.updated" | "rig.deleted" | "rig.change.proposed" | "rig.change.verified" | "rig.change.rejected" | "rig.change.failed" | "rig.change.merged" | "rig.verification.started" | "rig.verification.passed" | "rig.verification.failed" | "rig.version.activated" | "rig.version.promoted";
+export declare function recordRigAuditEvent(db: Database, input: {
+    grant: AccessGrant;
+    action: RigAuditAction;
+    rigId: string;
+    metadata?: Record<string, unknown>;
+}): Promise<void>;
+export declare function rigActorForGrant(grant: AccessGrant): string;
+export declare function requireRigForApi(db: Database, workspaceId: string, rigId: string): Promise<Rig>;
+export declare function requireRigChangeForApi(db: Database, workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
+export declare function createRigForApi(deps: RigServices, grant: AccessGrant, payload: CreateRigRequest): Promise<Rig>;
+export declare function updateRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: UpdateRigRequest): Promise<Rig>;
+export declare function deleteRigForApi(deps: RigServices, grant: AccessGrant, rig: Rig): Promise<void>;
+export declare function proposeRigChangeForApi(deps: RigServices, grant: AccessGrant, rig: Rig, request: ProposeRigChangeRequest, options?: {
+    proposedBy?: string;
+}): Promise<RigChange>;
+export type RigVerificationClassification = {
+    status: "merged";
+    action: "auto_promote";
+} | {
+    status: "proposed";
+    action: "await_manage_promote";
+} | {
+    status: "rejected";
+    action: "reject";
+} | {
+    status: "failed";
+    action: "retryable_failure";
+};
+export declare function classifyRigVerificationOutcome(input: {
+    kind: "setup_append" | "definition_edit";
+    passed: boolean;
+    infraError?: boolean;
+}): RigVerificationClassification;
+export declare function appendRigSetupCommand(baseSetupScript: string | null | undefined, command: string): string;
+export declare function promoteSetupAppendChange(deps: RigServices, grant: AccessGrant, rig: Rig, change: RigChange): Promise<{
+    change: RigChange;
+    version: RigVersion;
+}>;
+export declare function promoteVerifiedDefinitionEditChangeForApi(deps: RigServices, grant: AccessGrant, rig: Rig, change: RigChange): Promise<{
+    change: RigChange;
+    version: RigVersion;
+}>;
+export declare function createRigVersionForApi(deps: RigServices, grant: AccessGrant, rig: Rig, payload: RigDefinitionEditPayload): Promise<RigVersion>;
+export declare function activateRigVersionForApi(deps: RigServices, grant: AccessGrant, rig: Rig, versionId: string): Promise<RigVersion>;
+export declare function listRigVersionsForApi(deps: RigServices, workspaceId: string, rigId: string): Promise<RigVersion[]>;
+export declare function listRigChangesForApi(deps: RigServices, workspaceId: string, rigId: string, limit?: number): Promise<RigChange[]>;
+export {};

package/dist/sandbox/fleet.d.ts

@@ -0,0 +1,197 @@
+import type { Settings } from "@opengeni/config";
+import { type Database, type SandboxRecord } from "@opengeni/db";
+import type { EventBus } from "@opengeni/events";
+import { type BackendUnresolvableCode, type ControlRpc, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
+export type FleetServices = {
+    db: Database;
+    settings: Settings;
+    bus?: EventBus;
+    /** API-direct readiness owner for the session's home group. Production wires
+     * this to the same viewer/provider verification + rematerialization path; core
+     * tests may omit it when exercising pointer mechanics only. */
+    ensureSessionGroupReady?: (ctx: FleetContext) => Promise<FleetReadinessHold>;
+};
+export type FleetReadinessHold = {
+    /** Release target liveness only after route publication settles. */
+    release: () => Promise<void>;
+};
+export type FleetContext = {
+    accountId: string;
+    workspaceId: string;
+    /** The calling session (the pointer the attach/swap mutates + whose group box
+     *  is the default fleet member). */
+    sessionId: string;
+    /** The session's own group sandbox backend (modal/selfhosted/…). */
+    sessionBackend: string;
+    /** The session's own group sandbox id (the lease group). */
+    sessionGroupId: string;
+};
+/**
+ * Build a session-scoped {@link FleetContext}: load the session (workspace-
+ * scoped), reject a session with no box (backend:none — the fleet is only
+ * meaningful for a sandboxed session), and project its group backend/id. Shared
+ * by the worker-signed MCP fleet tools and the user-authenticated swap REST
+ * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/
+ * `sessionId` come from the trusted grant/route; the backend + group id come from
+ * the session row.
+ */
+export declare function buildFleetContextForSession(deps: {
+    db: Database;
+}, ctx: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<FleetContext>;
+/** The dominant liveness of a fleet member, surfaced to the dock + the agent. */
+export type FleetLiveness = "online" | "reconnecting" | "offline";
+/**
+ * A fleet member as the agent + the dock see it (the M8b/M9 UI seam — the
+ * `sandboxes_list` response entry the dock renders). STABLE shape: the dock keys
+ * on `id`, renders `name`/`kind`/`liveness`, and marks `active`. The session's own
+ * Modal group box is a synthetic entry with `id: groupId`, `kind: "modal"`, and a
+ * null `enrollmentId`; an enrolled machine carries its sandbox + enrollment ids.
+ */
+export type FleetSandboxEntry = {
+    /** The sandbox id used as the attach/swap/run_on `target`. For the session's
+     *  own group box this is the group id (a null active pointer == this box). */
+    id: string;
+    kind: "modal" | "selfhosted";
+    name: string;
+    liveness: FleetLiveness;
+    /** True for the session's currently-active sandbox (the routing target). */
+    active: boolean;
+    /** True for the session's own group box (the default/home sandbox). */
+    isSessionGroup: boolean;
+    enrollmentId: string | null;
+    /** Whether this target can be attached/swapped to right now (live + addressable). */
+    attachable: boolean;
+    /** Selfhosted only: whether whole-machine + screen-control consent is acked. */
+    consented?: boolean;
+    /** Selfhosted only: whether a display (real/Xvfb) is present. */
+    hasDisplay?: boolean;
+    lastSeenAt?: string | null;
+    /** Orthogonal truth dimensions. `liveness` is only their conservative UI
+     * projection and is never evidence for a specific dimension. */
+    providerStatus: "not_created" | "creating" | "exists" | "missing" | "unknown";
+    leaseLiveness: "cold" | "warming" | "warm" | "draining" | null;
+    routeStatus: "attached" | "detached";
+    archiveStatus: "none" | "available" | "unverified" | "invalid";
+    restoreStatus: "not_required" | "pending" | "restoring" | "verifying" | "ready" | "degraded" | "unrecoverable";
+    workspaceStatus: "unknown" | "not_ready" | "ready" | "degraded" | "unrecoverable";
+    leaseEpoch: number | null;
+    routeEpoch: number;
+    /** Numeric/boolean persistence truth only. Archive locations, content hashes,
+     * provider identities, and storage handles are intentionally not projected. */
+    workspaceGeneration: number | null;
+    archiveGeneration: number | null;
+    archiveComplete: boolean;
+};
+export type FleetListResult = {
+    /** The session's currently-active sandbox id, or null == the group box. */
+    activeSandboxId: string | null;
+    activeEpoch: number;
+    sandboxes: FleetSandboxEntry[];
+};
+/** A swap/attach outcome the tool returns. On a rejection, `code` carries the
+ *  typed reason (issue #341 typed diagnostics) alongside the human `reason`. */
+export type FleetSwapResult = {
+    swapped: boolean;
+    activeSandboxId: string | null;
+    activeEpoch: number;
+    reason?: string;
+    code?: BackendUnresolvableCode | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
+};
+/**
+ * List the fleet: the session's own Modal group box (a synthetic entry) + the
+ * workspace's first-class selfhosted sandboxes (each probed for liveness), each
+ * with an `active` marker derived from the session's active pointer.
+ */
+export declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
+/**
+ * THE SWAP (and attach — identical mechanic). Validate the target's ownership +
+ * liveness, then repoint the session via the epoch-fenced CAS `setActiveSandbox`:
+ * read the current epoch, then CAS on it. A concurrent double-swap lets exactly
+ * one win; the loser re-reads + may retry. The bumped epoch fences any in-flight
+ * op cached against the old pointer, which then retries against the new active
+ * sandbox (the routing proxy's fenced-retry role).
+ */
+export declare function swapActiveSandbox(services: FleetServices, ctx: FleetContext, target: string, workingDir?: string | null): Promise<FleetSwapResult>;
+export type RunOnOp = {
+    kind: "exec";
+    cmd: string;
+    workdir?: string;
+} | {
+    kind: "read";
+    path: string;
+} | {
+    kind: "write";
+    path: string;
+    content: string;
+};
+export type RunOnResult = {
+    target: string;
+    kind: string;
+    ok: boolean;
+    stdout?: string;
+    stderr?: string;
+    exitCode?: number | null;
+    /** Exec only: whether the machine killed the child at its process deadline. */
+    timedOut?: boolean;
+    /** Exec only: the effective clamped process deadline enforced by the machine. */
+    deadlineMs?: number;
+    content?: string;
+    bytesWritten?: number;
+    reason?: string;
+};
+export type RunOnSelfhostedMachine = {
+    workspaceId: string;
+    agentId: string;
+    controlRpc: ControlRpc;
+    relay: SelfhostedRelayConfig;
+    /** Short request/reply deadline for read/write and other control operations. */
+    controlTimeoutMs: number;
+    /** Longer agent-side process deadline for exec. */
+    execTimeoutMs: number;
+};
+/**
+ * Execute the one-off machine operation once the workspace/enrollment lookup has
+ * succeeded. Kept separate from {@link runOnSandbox} so the command/deadline
+ * contract is deterministic against an in-memory ControlRpc without weakening
+ * the production ownership lookup or requiring a real machine.
+ */
+export declare function executeRunOnSelfhostedMachine(machine: RunOnSelfhostedMachine, target: string, op: RunOnOp): Promise<RunOnResult>;
+/**
+ * Run a ONE-OFF op against a SPECIFIC target WITHOUT changing the active pointer
+ * (the design `run_on`). Only selfhosted targets are routable as a one-off here
+ * (a Modal target is the session's group box, reached via the normal Channel-A /
+ * turn path — `run_on` is for reaching a NON-active enrolled machine without
+ * swapping). The op is fenced under the target's enrollment, addressed to its
+ * agent subject; an offline machine surfaces a clear reason, never a wrong-box
+ * landing.
+ */
+export declare function runOnSandbox(services: FleetServices, ctx: FleetContext, target: string, op: RunOnOp): Promise<RunOnResult>;
+export type ProvisionResult = {
+    kind: "selfhosted";
+    instructions: string;
+    installCommandUnix: string;
+    installCommandWindows: string;
+    verificationUri: string;
+    note: string;
+} | {
+    kind: "modal";
+    sandbox: SandboxRecord;
+    note: string;
+};
+/**
+ * Provision a new fleet member.
+ *   - selfhosted → return the device-flow enrollment instructions (the agent
+ *     surfaces them to a HUMAN, who installs the agent + enrolls — the agent
+ *     cannot click the loud whole-machine consent itself).
+ *   - modal → create a first-class named modal `sandboxes` record (a swap target).
+ *     NOTE: the Modal BOX is materialized lazily when first swapped-to (Modal
+ * lifecycle is owned by the lease — unchanged per).
+ */
+export declare function provisionSandbox(services: FleetServices, ctx: FleetContext, input: {
+    kind: "selfhosted" | "modal";
+    name?: string;
+}): Promise<ProvisionResult>;

package/dist/sandbox/routing.d.ts

@@ -0,0 +1,55 @@
+import { type Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+import { type EventBus } from "@opengeni/events";
+import { type EstablishedSandboxSession, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
+export type ChannelARoutingServices = {
+    db: Database;
+    settings: Settings;
+    bus?: EventBus;
+};
+/** Map the deployment relay URL to the leaf's `SelfhostedRelayConfig` shape. The
+ *  relay URL (`OPENGENI_SELFHOSTED_RELAY_URL`) may carry a path (the relay's wss
+ *  route); a path-less URL defaults to the relay's `/stream` route (M8b). */
+export declare function relayConfigFromSettings(settings: Settings): SelfhostedRelayConfig;
+/** The canonical relay dial-BASE URL (`scheme://host[:port]/stream`) handed to the
+ *  agent PRODUCER. The agent's relay channel appends ONLY its routing query to
+ *  this base (`channel.rs`: `format!("{relay_url}{sep}{query}")`) and relies on the
+ *  base ALREADY carrying the relay's `/stream` route. `OPENGENI_SELFHOSTED_RELAY_URL`
+ *  is frequently pathless (e.g. `wss://relay.<env>.app.opengeni.ai`), which made the
+ *  producer dial a path-less URL the relay 400s. Derive the base from the SAME parser
+ *  the CONSUMER uses (`relayConfigFromSettings`) so producer + consumer always agree
+ *  on `/stream` — even when the configured URL omits it. An unconfigured relay maps to
+ *  `""` (graceful degrade: the agent reports no-relay rather than dialing a synthetic
+ * host). Fixes preview AND managed prod with no agent rebuild. */
+export declare function relayDialBaseFromSettings(settings: Settings): string;
+/** Whether the routing proxy should wrap the Channel-A box: gated by the
+ *  selfhosted flag (the active pointer + swap are only meaningful then). */
+export declare function routingEnabled(settings: Settings): boolean;
+/**
+ * Wrap an established home session in a `RoutingSandboxSession` so a Channel-A
+ * op routes to the session's currently-active sandbox. Provider homes supply a
+ * lease; machine homes supply a pinned selfhosted identity and no lease. Returns
+ * the established handle with its `session` replaced by the stable proxy.
+ */
+export declare function wrapChannelABoxWithRouting(services: ChannelARoutingServices, ids: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    homeLease?: {
+        sandboxGroupId: string;
+        leaseEpoch: number;
+        instanceId: string;
+        backend: string;
+    };
+    /** A machine-home Channel-A request has no cloud/home lease. Its already
+     * established SelfhostedSession is pinned to the durable active pointer so
+     * the first command uses the exact machine instance and epoch. */
+    pinnedSelfhosted?: {
+        sandboxId: string;
+        epoch: number;
+    };
+    directRequest: {
+        requestId: string;
+        holderId: string;
+    };
+}, established: EstablishedSandboxSession): EstablishedSandboxSession;

package/dist/sandbox-types.d.ts

@@ -0,0 +1,52 @@
+export type ApiSandboxSession = {
+    state?: Record<string, unknown> & {
+        sandboxId?: string;
+    };
+    running?(): Promise<boolean>;
+    exec?(args: {
+        cmd: string;
+        workdir?: string;
+        runAs?: string;
+        yieldTimeMs?: number;
+        maxOutputTokens?: number;
+    }): Promise<unknown>;
+    execCommand?(args: {
+        cmd: string;
+        workdir?: string;
+        runAs?: string;
+        yieldTimeMs?: number;
+        maxOutputTokens?: number;
+    }): Promise<string>;
+    shutdown?(options?: unknown): Promise<void>;
+    delete?(options?: unknown): Promise<void>;
+    close?(): Promise<void>;
+};
+export type ApiSandboxClient = {
+    backendId: string;
+    deserializeSessionState?(state: Record<string, unknown>): Promise<Record<string, unknown>>;
+    resume?(state: Record<string, unknown>, options?: unknown): Promise<ApiSandboxSession>;
+    delete?(state: Record<string, unknown>): Promise<void>;
+};
+export type ResumeBoxByIdInput = {
+    /**
+     * The backend the box was created on — the lease's `resume_backend_id`. Must
+     * match the API's configured sandbox client backendId, or the resume is
+     * rejected (a cross-backend envelope can never deserialize correctly).
+     */
+    backend: string;
+    /**
+     * The serialized resume-state envelope — the lease's `resume_state` jsonb
+     * (the record produced by `client.serializeSessionState(state)`). This is the
+     * box identity + reattach descriptor; resume() reattaches to the live box by
+     * id (warm reattach) or cold-restores from its snapshot.
+     */
+    resumeState: Record<string, unknown>;
+};
+/**
+ * A live, resumed sandbox session for a SINGLE in-process op. The caller
+ * resumes → uses (exec/readFile/resolvePort) → drops it; lifecycle/refcount is
+ * the lease's job (P1.x), NOT this handle's. The session is non-owned by
+ * construction (resume-by-id never owns the box), so dropping it does not
+ * terminate the box.
+ */
+export type ResumedSandboxSession = ApiSandboxSession;

package/dist/session-authorization.d.ts

@@ -0,0 +1,36 @@
+import { SessionAuthorizationActor, SessionAuthorizationListScope, type AccessGrant, type SessionAuthorizationOperation, type SessionAuthorizationSurface, type SessionAuthorizationTarget } from "@opengeni/contracts";
+import type { AppDependencies } from "./dependencies";
+export type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
+/** Maximum time an omitted host hint leaves a live session stream unchecked. */
+export declare const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15000;
+export declare class SessionAuthorizationDeniedError extends Error {
+    readonly reason: "not_found" | "forbidden" | "revoked" | "caller_stale";
+    readonly code = "SESSION_NOT_FOUND_OR_DENIED";
+    constructor(reason: "not_found" | "forbidden" | "revoked" | "caller_stale");
+}
+export declare class SessionAuthorizationUnavailableError extends Error {
+    readonly code = "SESSION_AUTHORIZATION_UNAVAILABLE";
+    constructor(options?: ErrorOptions);
+}
+export type ResolvedSessionAuthorization = {
+    actor: SessionAuthorizationActor;
+    target: SessionAuthorizationTarget;
+    relatedSessionAccess: "target" | "root";
+    reauthorizeAfterMs: number | null;
+};
+/**
+ * Resolve and enforce the host ACL for one session. The target and agent actor
+ * are reconstructed from workspace-scoped durable state. A request can supply
+ * an immediate target id and signed attempt claims, but can never nominate a
+ * lineage root or frozen initiator.
+ *
+ * Returns null when no host port is bound so standalone behavior stays byte-
+ * for-byte unchanged and pays no additional lineage lookup.
+ */
+export declare function requireSessionAuthorization(deps: SessionAuthorizationDependencies, grant: AccessGrant, input: {
+    sessionId: string;
+    operation: SessionAuthorizationOperation;
+    surface: SessionAuthorizationSurface;
+}): Promise<ResolvedSessionAuthorization | null>;
+/** Resolve the host's complete current list scope for an in-database query. */
+export declare function requireSessionAuthorizationListScope(deps: SessionAuthorizationDependencies, grant: AccessGrant, surface: SessionAuthorizationSurface): Promise<SessionAuthorizationListScope | null>;

package/dist/transcription.d.ts

@@ -0,0 +1,71 @@
+import type { TranscribeAudioResponse, VoiceInputErrorCode } from "@opengeni/contracts";
+export type TranscriptionLimits = {
+    maxDurationSeconds: number;
+    maxSizeBytes: number;
+    acceptedMimeTypes: readonly string[];
+};
+export type TranscriptionRequest = {
+    workspaceId: string;
+    accountId: string;
+    audio: Uint8Array;
+    mimeType: string;
+    /** Optional client-reported duration; enforced as a soft ceiling before upstream. */
+    durationSeconds?: number | undefined;
+    signal?: AbortSignal | undefined;
+    requestId: string;
+};
+export type TranscriptionResult = TranscribeAudioResponse & {
+    /** Server-private provider id for operational metrics only. Never returned to clients. */
+    providerId: string;
+    audioSeconds: number;
+    latencyMs: number;
+};
+export declare class TranscriptionServiceError extends Error {
+    readonly code: VoiceInputErrorCode;
+    readonly status: number;
+    readonly retryable: boolean;
+    constructor(input: {
+        code: VoiceInputErrorCode;
+        message: string;
+        status?: number;
+        retryable?: boolean;
+    });
+}
+export declare function statusForVoiceInputError(code: VoiceInputErrorCode): number;
+/** Optional workspace scope for readiness checks during provider selection. */
+export type TranscriptionAvailabilityContext = {
+    workspaceId?: string | undefined;
+};
+/**
+ * Extensible transcription provider port. Implementations own credentials and
+ * upstream request shape. Selection happens before audio is sent; providers must
+ * not fall back to another vendor after an upstream request may have started.
+ */
+export type TranscriptionProvider = {
+    readonly id: string;
+    readonly experimental?: boolean | undefined;
+    /**
+     * Deployment readiness when called without a workspace. When `workspaceId` is
+     * provided, providers may require a workspace-attached credential (e.g. Codex).
+     */
+    available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;
+    transcribe(input: {
+        audio: Uint8Array;
+        mimeType: string;
+        filename: string;
+        workspaceId: string;
+        signal?: AbortSignal | undefined;
+    }): Promise<{
+        text: string;
+        languages: string[];
+    }>;
+};
+export type TranscriptionService = {
+    limits(): TranscriptionLimits;
+    /** True when at least one ready provider can serve requests. */
+    available(context?: TranscriptionAvailabilityContext): boolean | Promise<boolean>;
+    transcribe(request: TranscriptionRequest): Promise<TranscriptionResult>;
+};
+export declare function normalizeMimeType(mimeType: string): string;
+export declare function isAcceptedMimeType(mimeType: string, accepted: readonly string[]): boolean;
+export declare function filenameForMimeType(mimeType: string): string;

package/dist/workflow-wake-contract.d.ts

@@ -0,0 +1,4 @@
+/** One global Temporal Schedule owns bounded delivery of committed session wakes. */
+export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
+export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
+export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.12.10",
+  "version": "0.14.4",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -28,21 +28,21 @@
     "provenance": true
   },
   "scripts": {
-    "typecheck": "tsgo --noEmit",
-    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "build": "bun ../../scripts/build-typescript-package.ts",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.13",
-    "@opengeni/contracts": "^0.23.0",
-    "@opengeni/db": "^0.14.3",
-    "@opengeni/documents": "^0.2.45",
-    "@opengeni/events": "^0.3.36",
+    "@opengeni/codex": "^0.2.9",
+    "@opengeni/config": "^0.7.22",
+    "@opengeni/contracts": "^0.26.1",
+    "@opengeni/db": "^0.16.2",
+    "@opengeni/documents": "^0.2.59",
+    "@opengeni/events": "^0.3.50",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.14.3",
-    "@opengeni/storage": "^0.2.37",
+    "@opengeni/runtime": "^0.14.16",
+    "@opengeni/storage": "^0.2.46",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -1,6 +1,7 @@
 import type { Settings } from "@opengeni/config";
 import {
   verifyDelegatedAccessToken,
+  type AccountGrant,
   type AccessContext,
   type AccessGrant,
   type Permission,
@@ -39,10 +40,64 @@ export async function requireAccessGrant(
   workspaceId: string,
   permission?: Permission,
 ): Promise<AccessGrant> {
+  return (await requireAccessGrantAuthorization(c, deps, workspaceId, permission)).grant;
+}
+
+export type AccessGrantAuthorization = {
+  grant: AccessGrant;
+  accountGrant: AccountGrant | null;
+  authenticatedSubjectId: string;
+  contextIntegrity: boolean;
+};
+
+export function accessGrantAuthorizationFromContext(
+  context: AccessContext,
+  grant: AccessGrant,
+): AccessGrantAuthorization {
+  const matchingAccountGrants = context.accountGrants.filter(
+    (candidate) => candidate.accountId === grant.accountId,
+  );
+  const delegated = grant.metadata?.delegated === true;
+  const contextIntegrity =
+    context.subjectId === grant.subjectId &&
+    context.accountGrants.every((candidate) => candidate.subjectId === context.subjectId) &&
+    context.workspaceGrants.every(
+      (candidate) =>
+        candidate.subjectId === context.subjectId &&
+        candidate.principalKind === grant.principalKind &&
+        (candidate.metadata?.delegated === true) === delegated &&
+        Boolean(candidate.serviceInitiator) === Boolean(grant.serviceInitiator) &&
+        Boolean(candidate.serviceInitiatorContext) === Boolean(grant.serviceInitiatorContext) &&
+        context.accountGrants.filter(
+          (accountGrant) => accountGrant.accountId === candidate.accountId,
+        ).length === 1,
+    ) &&
+    matchingAccountGrants.length === 1 &&
+    matchingAccountGrants[0]?.subjectId === context.subjectId;
+  return {
+    grant,
+    accountGrant: contextIntegrity ? matchingAccountGrants[0]! : null,
+    authenticatedSubjectId: context.subjectId,
+    contextIntegrity,
+  };
+}
+
+export async function requireAccessGrantAuthorization(
+  c: Context,
+  deps: AccessDeps,
+  workspaceId: string,
+  permission?: Permission,
+): Promise<AccessGrantAuthorization> {
   const context = await requireAccessContext(c, deps);
+  const principalKind = hostedHumanSessionPrincipalKind(context);
   const grant =
     context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??
-    (await getWorkspaceGrant(deps.db, context.subjectId, workspaceId));
+    (await getWorkspaceGrant(
+      deps.db,
+      context.subjectId,
+      workspaceId,
+      principalKind ? { principalKind } : undefined,
+    ));
   if (!grant) {
     const workspace = await requireWorkspace(deps.db, workspaceId).catch(() => null);
     if (!workspace) {
@@ -53,7 +108,21 @@ export async function requireAccessGrant(
   if (permission) {
     requirePermission(grant, permission);
   }
-  return grant;
+  return accessGrantAuthorizationFromContext(context, grant);
+}
+
+function hostedHumanSessionPrincipalKind(context: AccessContext): "human_session" | undefined {
+  if (context.mode !== "managed" || context.workspaceGrants.length === 0) {
+    return undefined;
+  }
+  return context.workspaceGrants.every(
+    (grant) =>
+      grant.principalKind === "human_session" &&
+      grant.metadata?.delegated !== true &&
+      !grant.serviceInitiator,
+  )
+    ? "human_session"
+    : undefined;
 }
 
 export function requirePermission(grant: AccessGrant, permission: Permission): void {
@@ -191,6 +260,7 @@ async function apiKeyAccessContext(
             subjectId,
             subjectLabel: apiKey.name,
             permissions: apiKey.permissions,
+            principalKind: "api_key",
           },
         ]
       : [],
@@ -231,6 +301,7 @@ async function delegatedAccessContext(
         subjectId: payload.subjectId,
         ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
         permissions: payload.permissions,
+        principalKind: payload.principalKind,
         // sessionId is worker-asserted (HMAC-signed token claim), not agent
         // controlled; it scopes session-bound MCP tools such as goal management.
         metadata: {

package/src/application/new-session-drafts.ts

@@ -48,6 +48,7 @@ function mapNewSessionDraft(
     toolsProvided: newSessionDraftToolsProvided(row),
     model: row.model,
     reasoningEffort: row.reasoningEffort,
+    latencyMode: row.latencyMode,
     options: publicNewSessionDraftOptions(row),
     updatedAt: row.updatedAt.toISOString(),
   });
@@ -169,6 +170,7 @@ export async function getActorNewSessionDraft(
       toolsProvided: false,
       model: deps.settings.openaiModel,
       reasoningEffort: deps.settings.openaiReasoningEffort,
+      latencyMode: "standard",
       options: {},
       updatedAt: null,
     }
@@ -223,6 +225,7 @@ export async function saveActorNewSessionDraft(
           toolsProvided,
           model: input.model,
           reasoningEffort: input.reasoningEffort,
+          latencyMode: input.latencyMode,
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
           // API keys and delegated service actors (for example the first-party