@opengeni/core 0.21.10 → 0.28.0

package/dist/managed-session.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from "hono";
-import type { ManagedAuth } from "./managed-auth-type";
+import type { ManagedAuth } from "./managed-auth-type.js";
+import type { Database } from "@opengeni/db";
 /**
  * Read a Better Auth session without bypassing its sliding-cookie renewal.
  *
@@ -7,7 +8,10 @@ import type { ManagedAuth } from "./managed-auth-type";
  * Programmatic callers must explicitly request and forward the returned cookie
  * headers; the HTTP handler does this automatically, but direct API calls do not.
  */
-export declare function getManagedSession(c: Context, auth: ManagedAuth): Promise<{
+export declare function getManagedSession(c: Context, auth: ManagedAuth, options?: {
+    db?: Database;
+    allowIdentityRecovery?: boolean;
+}): Promise<{
     session: {
         id: string;
         createdAt: Date;

package/dist/rigs/index.d.ts

@@ -1,5 +1,6 @@
 import type { AccessGrant, CreateRigRequest, RigDefinitionEditPayload, ProposeRigChangeRequest, Rig, RigChange, RigVersion, UpdateRigRequest } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
+export * from "./provider-images.js";
 export declare const MAX_RIGS_PER_WORKSPACE = 50;
 export declare const MAX_CHECKS_PER_RIG = 100;
 export declare const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
@@ -54,4 +55,3 @@ export declare function createRigVersionForApi(deps: RigServices, grant: AccessG
 export declare function activateRigVersionForApi(deps: RigServices, grant: AccessGrant, rig: Rig, versionId: string): Promise<RigVersion>;
 export declare function listRigVersionsForApi(deps: RigServices, workspaceId: string, rigId: string): Promise<RigVersion[]>;
 export declare function listRigChangesForApi(deps: RigServices, workspaceId: string, rigId: string, limit?: number): Promise<RigChange[]>;
-export {};

package/dist/rigs/provider-images.d.ts

@@ -0,0 +1,31 @@
+import { type RigChangeVerification, type RigProviderImage, type RigProviderImages, type RigVersion, type SandboxBackend } from "@opengeni/contracts";
+export type RigProviderImageDefinition = Pick<RigVersion, "image" | "setupScript" | "checks" | "credentialHooks" | "defaultVariableSetIds">;
+export declare function rigProviderImageProviderBindingKeyHash(bindingKey: string): string;
+export declare function rigProviderImageSetupHash(definition: Pick<RigProviderImageDefinition, "setupScript">): string;
+/**
+ * Hash every exact rig-definition input that can affect whether a provider
+ * image may be reused. Credential values and variable-set contents are
+ * intentionally absent: verification never injects them into the build box.
+ * Their declared hook/set identities still participate so a new rig version
+ * cannot silently inherit an older build record.
+ */
+export declare function rigProviderImageContentHash(input: {
+    backend: SandboxBackend;
+    sourceImage: string | null;
+    definition: RigProviderImageDefinition;
+}): string;
+/** Modal's patched snapshot API accepts a caller-owned UUID idempotency key.
+ * v2 denotes images proven by a separate cold boot before publication. */
+export declare function rigProviderImageBuildRequestId(input: {
+    targetId: string;
+    backend: SandboxBackend;
+    contentHash: string;
+}): string;
+export declare function rigProviderImageMatchesDefinition(image: RigProviderImage, definition: RigProviderImageDefinition): boolean;
+/**
+ * Promotion copies only a finalized, structurally valid build record whose
+ * hashes match the exact version definition being inserted. A malformed or
+ * stale optimization record is discarded; the version remains correct and
+ * falls back to runtime setup.
+ */
+export declare function rigProviderImagesFromVerification(verification: RigChangeVerification | null, definition: RigProviderImageDefinition): RigProviderImages;

package/dist/sandbox/fleet.d.ts

@@ -28,8 +28,9 @@ export type FleetContext = {
 };
 /**
  * Build a session-scoped {@link FleetContext}: load the session (workspace-
- * scoped), reject a session with no box (backend:none — the fleet is only
- * meaningful for a sandboxed session), and project its group backend/id. Shared
+ * scoped) and project its group backend/id. A backend:none session has no home
+ * box, but it may still discover, run on, and attach an owned Connected Machine.
+ * Shared
  * by the worker-signed MCP fleet tools and the user-authenticated swap REST
  * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/
  * `sessionId` come from the trusted grant/route; the backend + group id come from
@@ -108,9 +109,11 @@ export type FleetSwapResult = {
     code?: BackendUnresolvableCode | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
 };
 /**
- * List the fleet: the session's own Modal group box (a synthetic entry) + the
- * workspace's first-class selfhosted sandboxes (each probed for liveness), each
- * with an `active` marker derived from the session's active pointer.
+ * List the fleet: the session's own group box when it has one (a synthetic
+ * entry) + the workspace's first-class selfhosted sandboxes (each probed for
+ * liveness), each with an `active` marker derived from the session's active
+ * pointer. A backend:none session has no synthetic home entry; a null pointer
+ * then means no compute is attached.
  */
 export declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
 /**

package/dist/sandbox/routing.d.ts

@@ -7,6 +7,7 @@ export type ChannelARoutingServices = {
     settings: Settings;
     bus?: EventBus;
     onSandboxOperation?: RoutingSandboxOperationObserver;
+    waitSignal?: AbortSignal;
 };
 /** Map the deployment relay URL to the leaf's `SelfhostedRelayConfig` shape. The
  *  relay URL (`OPENGENI_SELFHOSTED_RELAY_URL`) may carry a path (the relay's wss

package/dist/session-authorization.d.ts

@@ -1,6 +1,6 @@
 import { SessionAuthorizationActor, SessionAuthorizationListScope, type AccessGrant, type SessionAuthorizationOperation, type SessionAuthorizationSurface, type SessionAuthorizationTarget } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
-import type { AppDependencies } from "./dependencies";
+import { type Database, type SessionRlsActorContext } from "@opengeni/db";
+import type { AppDependencies } from "./dependencies.js";
 export type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
 /** Maximum time an omitted host hint leaves a live session stream unchecked. */
 export declare const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15000;
@@ -19,6 +19,8 @@ export type ResolvedSessionAuthorization = {
     relatedSessionAccess: "target" | "root";
     reauthorizeAfterMs: number | null;
 };
+export declare function sessionRlsActorForAuthorization(authorization: ResolvedSessionAuthorization): SessionRlsActorContext;
+export declare function withResolvedSessionAuthorization<T>(authorization: ResolvedSessionAuthorization, fn: () => Promise<T>): Promise<T>;
 /**
  * Prove that a first-party request belongs to the exact currently active
  * attempt of the named caller session. Unlike the optional embedding-host ACL

package/dist/transcription.d.ts

@@ -16,6 +16,8 @@ export type TranscriptionLimits = {
 export type TranscriptionRequest = {
     workspaceId: string;
     accountId: string;
+    /** Authenticated human/service subject used for provider-account authority. */
+    subjectId: string;
     audio: Uint8Array;
     mimeType: string;
     /** Optional client-reported duration; enforced as a soft ceiling before upstream. */
@@ -48,6 +50,7 @@ export declare function statusForVoiceInputError(code: VoiceInputErrorCode): num
 /** Optional workspace scope for readiness checks during provider selection. */
 export type TranscriptionAvailabilityContext = {
     workspaceId?: string | undefined;
+    subjectId?: string | undefined;
 };
 /**
  * Extensible transcription provider port. Implementations own credentials and
@@ -69,6 +72,8 @@ export type TranscriptionProvider = {
         mimeType: string;
         filename: string;
         workspaceId: string;
+        accountId: string;
+        subjectId: string;
         requestId: string;
         signal?: AbortSignal | undefined;
     }): Promise<{

package/dist/workflow-wake-contract.d.ts

@@ -2,3 +2,10 @@
 export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
 export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
 export declare const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10000;
+/**
+ * Temporal delivers activity cancellation through heartbeats. Keep both the
+ * activity's local heartbeat timer and the worker's SDK throttle at this bound
+ * so the end-to-end Pause/Steer physical-cancellation contract is not already
+ * exhausted before sandbox/tool quiescence and replacement admission begin.
+ */
+export declare const TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.21.10",
+  "version": "0.28.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -21,6 +21,18 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./editable-artifacts": {
+      "types": "./dist/editable-artifacts.d.ts",
+      "import": "./dist/editable-artifacts.js"
+    },
+    "./editable-artifact-live": {
+      "types": "./dist/editable-artifact-live.d.ts",
+      "import": "./dist/editable-artifact-live.js"
+    },
+    "./canonical-human-identities": {
+      "types": "./dist/canonical-human-identities.d.ts",
+      "import": "./dist/canonical-human-identities.js"
     }
   },
   "publishConfig": {
@@ -34,15 +46,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.13",
-    "@opengeni/config": "^0.12.1",
-    "@opengeni/contracts": "^0.40.0",
-    "@opengeni/db": "^0.28.9",
-    "@opengeni/documents": "^0.5.18",
-    "@opengeni/events": "^0.3.88",
-    "@opengeni/observability": "^0.5.6",
-    "@opengeni/runtime": "^0.18.24",
-    "@opengeni/storage": "^0.2.75",
+    "@opengeni/codex": "^0.2.16",
+    "@opengeni/config": "^0.16.1",
+    "@opengeni/contracts": "^0.50.0",
+    "@opengeni/db": "^0.36.0",
+    "@opengeni/documents": "^0.5.38",
+    "@opengeni/events": "^0.3.109",
+    "@opengeni/observability": "^0.7.5",
+    "@opengeni/runtime": "^0.23.0",
+    "@opengeni/storage": "^0.2.93",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -20,6 +20,7 @@ import type { ManagedAuth } from "../managed-auth-type";
 import { getManagedSession } from "../managed-session";
 
 const bearerPrefix = "Bearer ";
+const accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();
 
 export type AccessDeps = {
   db: Database;
@@ -28,7 +29,12 @@ export type AccessDeps = {
 };
 
 export async function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext> {
-  const context = await resolveAccessContext(c, deps);
+  let pending = accessContextByRequest.get(c.req.raw);
+  if (!pending) {
+    pending = resolveAccessContext(c, deps);
+    accessContextByRequest.set(c.req.raw, pending);
+  }
+  const context = await pending;
   if (!context) {
     throw new HTTPException(401, { message: "authentication required" });
   }
@@ -252,7 +258,7 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
   }
 
   if (deps.managedAuth) {
-    const session = await getManagedSession(c, deps.managedAuth);
+    const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });
     if (session?.user) {
       return await ensureManagedAccessForUser(deps.db, {
         userId: session.user.id,
@@ -355,6 +361,12 @@ async function delegatedAccessContext(
           ...(payload.firstPartyMcpTools !== undefined
             ? { firstPartyMcpTools: payload.firstPartyMcpTools }
             : {}),
+          ...(payload.nestedAgentDepth !== undefined
+            ? { nestedAgentDepth: payload.nestedAgentDepth }
+            : {}),
+          ...(payload.effectiveMaxNestedAgentDepth !== undefined
+            ? { effectiveMaxNestedAgentDepth: payload.effectiveMaxNestedAgentDepth }
+            : {}),
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...(payload.turnId ? { turnId: payload.turnId } : {}),

package/src/application/new-session-drafts.ts

@@ -67,6 +67,7 @@ async function hydrateNewSessionDraft(
     deps.db,
     workspaceId,
     deps.settings,
+    { subjectId: grant.subjectId },
   );
   const resources = [] as NewSessionDraftValue["resources"];
   for (const resource of mapped.resources) {
@@ -200,6 +201,7 @@ export async function saveActorNewSessionDraft(
     deps.db,
     workspaceId,
     deps.settings,
+    { subjectId: grant.subjectId },
   );
   const resources = normalizeResources(input.resources);
   const tools = toolsProvided ? validateToolRefs(input.tools, runtimeSettings) : [];