@opengeni/core 0.21.2 → 0.21.10

package/src/domain/scheduled-tasks.ts

@@ -4,6 +4,9 @@ import type {
   McpPersonalConnectionDelegation,
   ScheduledTask,
   ScheduledTaskAgentConfig,
+  Session,
+  SessionAuthorizationPort,
+  SessionAuthorizationSurface,
   CreateScheduledTaskRequest as CreateScheduledTaskPayload,
   UpdateScheduledTaskRequest as UpdateScheduledTaskPayload,
 } from "@opengeni/contracts";
@@ -15,6 +18,7 @@ import {
   getRig,
   getScheduledTask,
   getScheduledTaskPersonalConnectionDelegations,
+  getSession,
   requireWorkspace,
   updateScheduledTask,
   type Database,
@@ -22,6 +26,11 @@ import {
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 import { hasPermission, requirePermission } from "../access";
+import {
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+} from "../session-authorization";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
@@ -38,6 +47,7 @@ import {
 } from "./sessions";
 import {
   hasReservedOpenGeniSlackBotSessionMetadata,
+  scheduledSlackBotConnectionId,
   validateOpenGeniSlackBotConnectionSelection,
 } from "./slack-bot";
 import {
@@ -81,6 +91,8 @@ export async function createValidatedScheduledTask(input: {
   // Set for pack-installation-inherited attachments that were already
   // authorized with variable-sets:use when the pack was enabled.
   variableSetPreauthorized?: boolean;
+  sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+  authorizationSurface?: SessionAuthorizationSurface | undefined;
 }): Promise<ScheduledTask> {
   const agentConfig = await validateScheduledTaskAgentConfig({
     ...input,
@@ -88,6 +100,17 @@ export async function createValidatedScheduledTask(input: {
   });
   const id = crypto.randomUUID();
   validateScheduledTaskSchedule(input.payload.schedule);
+  const target = await validateScheduledTaskTarget({
+    db: input.db,
+    sessionAuthorization: input.sessionAuthorization,
+    authorizationSurface: input.authorizationSurface,
+    grant: input.grant,
+    targetSessionId: input.payload.targetSessionId,
+    runMode: input.payload.runMode,
+    variableSetId: input.payload.variableSetId,
+    rigId: input.payload.rigId,
+    agentConfig,
+  });
   if (input.payload.variableSetId) {
     await validateVariableSetAttachment(
       { settings: input.settings, db: input.db },
@@ -132,12 +155,126 @@ export async function createValidatedScheduledTask(input: {
     ...(creationInitiator.context ? { createdByContext: creationInitiator.context } : {}),
     createdByActor: creationInitiator.actor ?? null,
     personalConnectionDelegations,
+    targetSessionId: target?.id ?? null,
     variableSetId: input.payload.variableSetId ?? null,
     rigId: input.payload.rigId ?? null,
     metadata: input.payload.metadata,
   });
 }
 
+export async function validateScheduledTaskTarget(input: {
+  db: Database;
+  sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+  authorizationSurface?: SessionAuthorizationSurface | undefined;
+  grant: AccessGrant;
+  targetSessionId: string | null | undefined;
+  runMode: ScheduledTask["runMode"];
+  variableSetId: string | null | undefined;
+  rigId: string | null | undefined;
+  agentConfig: ScheduledTaskAgentConfig;
+  missingTargetStatus?: 404 | 422;
+}): Promise<Session | null> {
+  if (input.runMode !== "existing_session") {
+    if (input.targetSessionId) {
+      throw new HTTPException(422, {
+        message: "targetSessionId requires runMode=existing_session",
+      });
+    }
+    return null;
+  }
+  if (!input.targetSessionId) {
+    throw new HTTPException(input.missingTargetStatus ?? 422, {
+      message:
+        input.missingTargetStatus === 404
+          ? "target session not found"
+          : "targetSessionId is required when runMode=existing_session",
+    });
+  }
+  requirePermission(input.grant, "sessions:control");
+  if (input.agentConfig.goal) {
+    throw new HTTPException(422, {
+      message: "agentConfig.goal cannot be used with an existing-session target",
+    });
+  }
+  try {
+    await requireSessionAuthorization(
+      {
+        db: input.db,
+        ...(input.sessionAuthorization !== undefined
+          ? { sessionAuthorization: input.sessionAuthorization }
+          : {}),
+      },
+      input.grant,
+      {
+        sessionId: input.targetSessionId,
+        operation: "session.control",
+        surface: input.authorizationSurface ?? "http",
+      },
+    );
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw new HTTPException(404, { message: "target session not found" });
+    }
+    if (error instanceof SessionAuthorizationUnavailableError) {
+      throw new HTTPException(503, { message: "session authorization is unavailable" });
+    }
+    throw error;
+  }
+  const session = await getSession(input.db, input.grant.workspaceId, input.targetSessionId);
+  if (!session || session.accountId !== input.grant.accountId) {
+    throw new HTTPException(404, { message: "target session not found" });
+  }
+  if (session.status === "cancelled") {
+    throw new HTTPException(409, {
+      message: "target session is cancelled; choose a revivable session",
+    });
+  }
+  if ((session.variableSetId ?? null) !== (input.variableSetId ?? null)) {
+    throw new HTTPException(422, {
+      message: "target session variableSet attachment does not match the scheduled task",
+    });
+  }
+  if (input.rigId && input.rigId !== session.rigId) {
+    throw new HTTPException(422, {
+      message: "target session rig does not match the scheduled task",
+    });
+  }
+  if (
+    input.agentConfig.sandboxBackend !== undefined &&
+    input.agentConfig.sandboxBackend !== session.sandboxBackend
+  ) {
+    throw new HTTPException(422, {
+      message: "target session sandbox backend does not match the scheduled task",
+    });
+  }
+  if (
+    scheduledSlackBotConnectionId(session.metadata) !==
+    (input.agentConfig.slackBotConnectionId ?? null)
+  ) {
+    throw new HTTPException(422, {
+      message: "target session OpenGeni Slack bot binding does not match the scheduled task",
+    });
+  }
+  return session;
+}
+
+export function scheduledTaskForGrant(task: ScheduledTask, grant: AccessGrant): ScheduledTask {
+  if (hasPermission(grant.permissions, "sessions:control") || task.targetSessionId === null) {
+    return task;
+  }
+  return { ...task, targetSessionId: null };
+}
+
+export function scheduledTaskRunForGrant<T extends { sessionId: string | null }>(
+  run: T,
+  grant: AccessGrant,
+): T {
+  if (hasPermission(grant.permissions, "sessions:control") || run.sessionId === null) {
+    return run;
+  }
+  return { ...run, sessionId: null };
+}
+
 // Validate a scheduled task's rig reference: it must name a rig in the
 // workspace. A missing/cross-workspace id is a 422 (RLS-invisible == missing).
 async function requireScheduledTaskRig(
@@ -160,8 +297,28 @@ export async function validatedScheduledTaskUpdate(input: {
   payload: UpdateScheduledTaskPayload;
   /** See createValidatedScheduledTask; only consulted when agentConfig is updated. */
   toolsProvided?: boolean;
+  sessionAuthorization?: SessionAuthorizationPort | null | undefined;
+  authorizationSurface?: SessionAuthorizationSurface | undefined;
 }): Promise<UpdateScheduledTaskInput> {
   const update: UpdateScheduledTaskInput = {};
+  const existingTarget = input.existing.targetSessionId;
+  const nextRunMode = input.payload.runMode ?? input.existing.runMode;
+  const nextTargetSessionId =
+    input.payload.targetSessionId !== undefined
+      ? input.payload.targetSessionId
+      : nextRunMode === "existing_session"
+        ? existingTarget
+        : null;
+  if (
+    input.existing.runMode === "reusable_session" &&
+    input.existing.reusableSessionId &&
+    nextRunMode === "existing_session"
+  ) {
+    throw new HTTPException(409, {
+      message:
+        "cannot target an existing session after this task created its reusable session; create a new task",
+    });
+  }
   if (input.payload.name !== undefined) {
     update.name = trimmedScheduledTaskName(input.payload.name);
   }
@@ -278,6 +435,43 @@ export async function validatedScheduledTaskUpdate(input: {
     }
     update.personalConnectionDelegations = personalConnectionDelegations;
   }
+  if (
+    existingTarget &&
+    (nextRunMode !== "existing_session" || nextTargetSessionId !== existingTarget)
+  ) {
+    await validateScheduledTaskTarget({
+      db: input.db,
+      sessionAuthorization: input.sessionAuthorization,
+      authorizationSurface: input.authorizationSurface,
+      grant: input.grant,
+      targetSessionId: existingTarget,
+      runMode: "existing_session",
+      variableSetId: input.existing.variableSetId,
+      rigId: input.existing.rigId,
+      agentConfig: input.existing.agentConfig,
+    });
+  }
+  await validateScheduledTaskTarget({
+    db: input.db,
+    sessionAuthorization: input.sessionAuthorization,
+    authorizationSurface: input.authorizationSurface,
+    grant: input.grant,
+    targetSessionId: nextTargetSessionId,
+    runMode: nextRunMode,
+    variableSetId:
+      input.payload.variableSetId !== undefined
+        ? input.payload.variableSetId
+        : input.existing.variableSetId,
+    rigId: input.payload.rigId !== undefined ? input.payload.rigId : input.existing.rigId,
+    agentConfig: update.agentConfig ?? input.existing.agentConfig,
+  });
+  if (
+    input.payload.targetSessionId !== undefined ||
+    input.existing.runMode === "existing_session" ||
+    nextRunMode === "existing_session"
+  ) {
+    update.targetSessionId = nextTargetSessionId;
+  }
   return update;
 }
 
@@ -325,13 +519,25 @@ export async function restoreScheduledTask(
     overlapPolicy: task.overlapPolicy,
     agentConfig: task.agentConfig,
     personalConnectionDelegations: previous.personalConnectionDelegations,
-    reusableSessionId: task.reusableSessionId,
+    ...(task.runMode === "existing_session"
+      ? { targetSessionId: task.targetSessionId }
+      : { reusableSessionId: task.reusableSessionId }),
     variableSetId: task.variableSetId,
     rigId: task.rigId,
     metadata: task.metadata,
   });
 }
 
+export class ScheduledTaskSyncError extends Error {
+  readonly persistenceRestored: boolean;
+
+  constructor(cause: unknown, persistenceRestored: boolean) {
+    super(cause instanceof Error ? cause.message : String(cause), { cause });
+    this.name = "ScheduledTaskSyncError";
+    this.persistenceRestored = persistenceRestored;
+  }
+}
+
 export async function syncCreatedScheduledTask(input: {
   db: Database;
   workflowClient: SessionWorkflowClient;
@@ -340,10 +546,13 @@ export async function syncCreatedScheduledTask(input: {
   try {
     await input.workflowClient.syncScheduledTask({ task: input.task });
   } catch (error) {
-    await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id).catch(
-      () => undefined,
-    );
-    throw error;
+    let persistenceRestored = true;
+    try {
+      await deleteScheduledTask(input.db, input.task.workspaceId, input.task.id);
+    } catch {
+      persistenceRestored = false;
+    }
+    throw new ScheduledTaskSyncError(error, persistenceRestored);
   }
 }
 
@@ -356,8 +565,13 @@ export async function syncUpdatedScheduledTask(input: {
   try {
     await input.workflowClient.syncScheduledTask({ task: input.task });
   } catch (error) {
-    await restoreScheduledTask(input.db, input.previous).catch(() => undefined);
-    throw error;
+    let persistenceRestored = true;
+    try {
+      await restoreScheduledTask(input.db, input.previous);
+    } catch {
+      persistenceRestored = false;
+    }
+    throw new ScheduledTaskSyncError(error, persistenceRestored);
   }
 }
 

package/src/domain/sessions.ts

@@ -506,7 +506,22 @@ function validateSessionMcpCredentialUpdates(input: {
   return encryptedUpdates;
 }
 
-export async function createAndStartSession(input: {
+export type CreateSessionOutcome = {
+  session: CreateSessionResponse;
+  /** The committed create/start effect represented by this request. */
+  outcome: "created" | "repaired" | "replayed";
+  /** Backward-compatible replay flag for existing entity-oriented callers. */
+  replay: boolean;
+  /** True when the request created/repaired start state or committed a new wake revision. */
+  changed: boolean;
+};
+
+export type CreateSessionRequestOutcome = CreateSessionOutcome & {
+  /** Billing telemetry is recorded after the committed session start. */
+  usageRecording: "recorded" | "failed";
+};
+
+export async function createAndStartSessionWithOutcome(input: {
   requestedSessionId?: string;
   db: Database;
   bus: EventBus;
@@ -597,7 +612,7 @@ export async function createAndStartSession(input: {
   maxNestedAgentDepthOverride?: number | null;
   allowNestedAgentDepthIncrease?: boolean;
   subjectId?: string | null;
-}): Promise<CreateSessionResponse> {
+}): Promise<CreateSessionOutcome> {
   const sessionMetadata = {
     ...input.metadata,
     model: input.model,
@@ -647,12 +662,24 @@ export async function createAndStartSession(input: {
     }
     const { session: keyed, created } = keyedResult;
     if (!created) {
-      return await finishStartSession(
+      const finished = await finishStartSession(
         keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
         keyed,
       );
+      return {
+        session: finished.session,
+        outcome: finished.changed ? "repaired" : "replayed",
+        replay: !finished.changed,
+        changed: finished.changed,
+      };
     }
-    return await finishStartSession(input, keyed);
+    const finished = await finishStartSession(input, keyed);
+    return {
+      session: finished.session,
+      outcome: "created",
+      replay: false,
+      changed: true,
+    };
   }
   let session: Session;
   try {
@@ -694,7 +721,20 @@ export async function createAndStartSession(input: {
     }
     throw error;
   }
-  return await finishStartSession(input, session);
+  const finished = await finishStartSession(input, session);
+  return {
+    session: finished.session,
+    outcome: "created",
+    replay: false,
+    changed: true,
+  };
+}
+
+/** Backward-compatible entity-returning create path used by existing callers. */
+export async function createAndStartSession(
+  input: Parameters<typeof createAndStartSessionWithOutcome>[0],
+): Promise<CreateSessionResponse> {
+  return (await createAndStartSessionWithOutcome(input)).session;
 }
 
 /**
@@ -730,7 +770,7 @@ async function finishStartSession(
     consumeNewSessionDraft?: { subjectId: string; expectedRevision: number } | null;
   },
   session: Session,
-): Promise<CreateSessionResponse> {
+): Promise<{ session: CreateSessionResponse; changed: boolean }> {
   // Create-time machine targeting (A-2a): seed the active-sandbox pointer BEFORE
   // the atomic initial turn transaction, so the FIRST turn routes to the chosen
   // machine. swapActiveSandbox does
@@ -806,7 +846,10 @@ async function finishStartSession(
     started.turn?.id ??
     (await listSessionTurns(input.db, session.workspaceId, session.id, 1))[0]?.id ??
     null;
-  return { ...persisted, initialTurnId };
+  return {
+    session: { ...persisted, initialTurnId },
+    changed: started.changed,
+  };
 }
 
 export function workflowIdForSession(sessionId: string): string {
@@ -997,7 +1040,7 @@ export async function postUserMessageTurn(input: {
   expectedDraftRevision?: number | null;
   reasoningEffortFallback?: Settings["openaiReasoningEffort"];
   turnExecutionPolicy: TurnExecutionPolicyV1;
-}): Promise<{ accepted: SessionEvent; turn: SessionTurn }> {
+}): Promise<{ accepted: SessionEvent; turn: SessionTurn; replay: boolean }> {
   const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
@@ -1103,13 +1146,14 @@ export async function postUserMessageTurn(input: {
         ? { interruptionRequested: true }
         : {}),
     });
-  } catch (error) {
-    console.warn(
-      `[sessions] workflow wake failed for committed prompt ${workspaceId}/${sessionId}; durable outbox will retry`,
-      error,
-    );
+  } catch {
+    console.warn("[sessions] workflow wake failed; durable outbox will retry", {
+      errorClass: "WorkflowWakeOperationError",
+      errorCode: "session_workflow_wake_failed",
+      origin: "core",
+    });
   }
-  return { accepted, turn };
+  return { accepted, turn, replay: result.replay };
 }
 
 /**
@@ -1121,12 +1165,12 @@ export async function postUserMessageTurn(input: {
  * trusted immediate parent, while explicit arrays (including []) win. A
  * top-level create with omitted tools applies workspace-default capability MCPs.
  */
-export async function createSessionForRequest(
+export async function createSessionForRequestWithOutcome(
   deps: ApiRouteDeps,
   grant: AccessGrant,
   workspaceId: string,
   rawPayload: unknown,
-): Promise<Session> {
+): Promise<CreateSessionRequestOutcome> {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   const payload = CreateSessionRequest.parse(rawPayload);
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
@@ -1621,9 +1665,9 @@ export async function createSessionForRequest(
     });
   }
   const creationInitiator = creationInitiatorForGrant(grant);
-  let session: CreateSessionResponse;
+  let createOutcome: CreateSessionOutcome;
   try {
-    session = await createAndStartSession({
+    createOutcome = await createAndStartSessionWithOutcome({
       ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),
       db,
       bus,
@@ -1704,24 +1748,52 @@ export async function createSessionForRequest(
     }
     throw error;
   }
+  let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
   if (payload.startMode !== "realtime") {
-    await recordWorkspaceUsage(deps, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      eventType: "agent_run.created",
-      quantity: 1,
-      unit: "run",
-      sourceResourceType: "session",
-      sourceResourceId: session.id,
-      sessionId: session.id,
-      initiator: session.createdBy,
-      initiatorContext: session.createdByContext,
-      origin: creationInitiator.actor ? "system" : "user",
-      idempotencyKey: `agent_run.created:${workspaceId}:${session.id}`,
-    });
+    try {
+      await recordWorkspaceUsage(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "session",
+        sourceResourceId: createOutcome.session.id,
+        sessionId: createOutcome.session.id,
+        initiator: createOutcome.session.createdBy,
+        initiatorContext: createOutcome.session.createdByContext,
+        origin: creationInitiator.actor ? "system" : "user",
+        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`,
+      });
+    } catch (error) {
+      usageRecording = "failed";
+      reportSessionUsageRecordingFailure(error);
+    }
   }
-  return session;
+  return { ...createOutcome, usageRecording };
+}
+
+/** @internal Fixed public projection; the committed session outcome remains authoritative. */
+export function reportSessionUsageRecordingFailure(_error: unknown): void {
+  console.warn(
+    "[sessions] usage recording failed after committed session create; returning committed outcome",
+    {
+      errorClass: "UsageRecordingError",
+      errorCode: "session_create_usage_recording_failed",
+      origin: "core",
+    },
+  );
+}
+
+/** Backward-compatible entity-returning request path for REST and core callers. */
+export async function createSessionForRequest(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  workspaceId: string,
+  rawPayload: unknown,
+): Promise<CreateSessionResponse> {
+  return (await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload)).session;
 }
 
 /**
@@ -1731,7 +1803,7 @@ export async function createSessionForRequest(
  * enqueue, and usage recording. `toolsProvided: false` durably preserves an
  * Tool selection is durable session state and never rides a follow-up prompt.
  */
-export async function acceptSessionUserMessage(
+export async function acceptSessionUserMessageWithOutcome(
   deps: AcceptSessionUserMessageDependencies,
   grant: AccessGrant,
   workspaceId: string,
@@ -1750,7 +1822,7 @@ export async function acceptSessionUserMessage(
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
   },
-): Promise<{ accepted: SessionEvent; turn: SessionTurn }> {
+): Promise<{ accepted: SessionEvent; turn: SessionTurn; replay: boolean }> {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   await requireSessionAuthorization(deps, grant, {
     sessionId,
@@ -1822,7 +1894,7 @@ export async function acceptSessionUserMessage(
     source: personalConnectionDelegationSourceForGrant(grant),
   });
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
-  const { accepted, turn } = await postUserMessageTurn({
+  const { accepted, turn, replay } = await postUserMessageTurn({
     db,
     bus,
     workflowClient,
@@ -1878,6 +1950,24 @@ export async function acceptSessionUserMessage(
     origin: turn.source,
     idempotencyKey: `agent_run.created:${workspaceId}:${turn.id}`,
   });
+  return { accepted, turn, replay };
+}
+
+/** Backward-compatible entity-returning path used by existing REST callers. */
+export async function acceptSessionUserMessage(
+  deps: Parameters<typeof acceptSessionUserMessageWithOutcome>[0],
+  grant: Parameters<typeof acceptSessionUserMessageWithOutcome>[1],
+  workspaceId: Parameters<typeof acceptSessionUserMessageWithOutcome>[2],
+  sessionId: Parameters<typeof acceptSessionUserMessageWithOutcome>[3],
+  input: Parameters<typeof acceptSessionUserMessageWithOutcome>[4],
+): Promise<{ accepted: SessionEvent; turn: SessionTurn }> {
+  const { accepted, turn } = await acceptSessionUserMessageWithOutcome(
+    deps,
+    grant,
+    workspaceId,
+    sessionId,
+    input,
+  );
   return { accepted, turn };
 }
 

package/src/index.ts

@@ -35,6 +35,7 @@ export * from "./workflow-wake-contract";
 // structural TYPES live here.
 export * from "./sandbox-types";
 export * from "./managed-auth-type";
+export * from "./managed-session";
 export * from "./transcription";
 
 // Sandbox fleet/routing service — the closure of `domain/sessions.ts`

package/src/managed-auth-type.ts

@@ -1,9 +1,10 @@
 // @opengeni/core ManagedAuth TYPE alias.
 //
 // WHY THIS MODULE LIVES IN CORE: `dependencies.ts` carries a `managedAuth?:
-// ManagedAuth | null` passthrough slot and the access layer calls
-// `managedAuth.api.getSession({ headers })`. Both are framework-agnostic, so
-// they belong in @opengeni/core. The CONSTRUCTION of a real Better Auth
+// ManagedAuth | null` passthrough slot and the access layer resolves managed
+// sessions through the cookie-renewing bridge in `managed-session.ts`. The
+// auth type is framework-agnostic, so it belongs in @opengeni/core. The
+// CONSTRUCTION of a real Better Auth
 // instance — `createManagedAuth`, which opens its own `pg.Pool` and wires
 // Resend — stays in `apps/api/src/auth/managed-auth.ts` (it pulls the `pg`
 // driver, which must NEVER enter @opengeni/core).

package/src/managed-session.ts

@@ -0,0 +1,36 @@
+import type { Context } from "hono";
+import type { ManagedAuth } from "./managed-auth-type";
+
+/**
+ * Read a Better Auth session without bypassing its sliding-cookie renewal.
+ *
+ * Better Auth can refresh the durable session while resolving `getSession`.
+ * Programmatic callers must explicitly request and forward the returned cookie
+ * headers; the HTTP handler does this automatically, but direct API calls do not.
+ */
+export async function getManagedSession(c: Context, auth: ManagedAuth) {
+  const result = await auth.api.getSession({
+    headers: c.req.raw.headers,
+    returnHeaders: true,
+  });
+
+  for (const cookie of setCookieHeaders(result.headers)) {
+    c.header("set-cookie", cookie, { append: true });
+  }
+
+  return result.response;
+}
+
+function setCookieHeaders(headers: Headers): string[] {
+  const getSetCookie = (
+    headers as Headers & {
+      getSetCookie?: () => string[];
+    }
+  ).getSetCookie;
+  if (getSetCookie) {
+    return getSetCookie.call(headers);
+  }
+
+  const cookie = headers.get("set-cookie");
+  return cookie ? [cookie] : [];
+}