@opengeni/core 0.24.1 → 0.28.0

package/dist/managed-session.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from "hono";
 import type { ManagedAuth } from "./managed-auth-type.js";
+import type { Database } from "@opengeni/db";
 /**
  * Read a Better Auth session without bypassing its sliding-cookie renewal.
  *
@@ -7,7 +8,10 @@ import type { ManagedAuth } from "./managed-auth-type.js";
  * Programmatic callers must explicitly request and forward the returned cookie
  * headers; the HTTP handler does this automatically, but direct API calls do not.
  */
-export declare function getManagedSession(c: Context, auth: ManagedAuth): Promise<{
+export declare function getManagedSession(c: Context, auth: ManagedAuth, options?: {
+    db?: Database;
+    allowIdentityRecovery?: boolean;
+}): Promise<{
     session: {
         id: string;
         createdAt: Date;

package/dist/sandbox/fleet.d.ts

@@ -28,8 +28,9 @@ export type FleetContext = {
 };
 /**
  * Build a session-scoped {@link FleetContext}: load the session (workspace-
- * scoped), reject a session with no box (backend:none — the fleet is only
- * meaningful for a sandboxed session), and project its group backend/id. Shared
+ * scoped) and project its group backend/id. A backend:none session has no home
+ * box, but it may still discover, run on, and attach an owned Connected Machine.
+ * Shared
  * by the worker-signed MCP fleet tools and the user-authenticated swap REST
  * route so both resolve the SAME context (no drift). The `accountId`/`workspaceId`/
  * `sessionId` come from the trusted grant/route; the backend + group id come from
@@ -108,9 +109,11 @@ export type FleetSwapResult = {
     code?: BackendUnresolvableCode | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
 };
 /**
- * List the fleet: the session's own Modal group box (a synthetic entry) + the
- * workspace's first-class selfhosted sandboxes (each probed for liveness), each
- * with an `active` marker derived from the session's active pointer.
+ * List the fleet: the session's own group box when it has one (a synthetic
+ * entry) + the workspace's first-class selfhosted sandboxes (each probed for
+ * liveness), each with an `active` marker derived from the session's active
+ * pointer. A backend:none session has no synthetic home entry; a null pointer
+ * then means no compute is attached.
  */
 export declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
 /**

package/dist/session-authorization.d.ts

@@ -1,5 +1,5 @@
 import { SessionAuthorizationActor, SessionAuthorizationListScope, type AccessGrant, type SessionAuthorizationOperation, type SessionAuthorizationSurface, type SessionAuthorizationTarget } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
+import { type Database, type SessionRlsActorContext } from "@opengeni/db";
 import type { AppDependencies } from "./dependencies.js";
 export type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
 /** Maximum time an omitted host hint leaves a live session stream unchecked. */
@@ -19,6 +19,8 @@ export type ResolvedSessionAuthorization = {
     relatedSessionAccess: "target" | "root";
     reauthorizeAfterMs: number | null;
 };
+export declare function sessionRlsActorForAuthorization(authorization: ResolvedSessionAuthorization): SessionRlsActorContext;
+export declare function withResolvedSessionAuthorization<T>(authorization: ResolvedSessionAuthorization, fn: () => Promise<T>): Promise<T>;
 /**
  * Prove that a first-party request belongs to the exact currently active
  * attempt of the named caller session. Unlike the optional embedding-host ACL

package/dist/transcription.d.ts

@@ -16,6 +16,8 @@ export type TranscriptionLimits = {
 export type TranscriptionRequest = {
     workspaceId: string;
     accountId: string;
+    /** Authenticated human/service subject used for provider-account authority. */
+    subjectId: string;
     audio: Uint8Array;
     mimeType: string;
     /** Optional client-reported duration; enforced as a soft ceiling before upstream. */
@@ -48,6 +50,7 @@ export declare function statusForVoiceInputError(code: VoiceInputErrorCode): num
 /** Optional workspace scope for readiness checks during provider selection. */
 export type TranscriptionAvailabilityContext = {
     workspaceId?: string | undefined;
+    subjectId?: string | undefined;
 };
 /**
  * Extensible transcription provider port. Implementations own credentials and
@@ -69,6 +72,8 @@ export type TranscriptionProvider = {
         mimeType: string;
         filename: string;
         workspaceId: string;
+        accountId: string;
+        subjectId: string;
         requestId: string;
         signal?: AbortSignal | undefined;
     }): Promise<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.24.1",
+  "version": "0.28.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -29,6 +29,10 @@
     "./editable-artifact-live": {
       "types": "./dist/editable-artifact-live.d.ts",
       "import": "./dist/editable-artifact-live.js"
+    },
+    "./canonical-human-identities": {
+      "types": "./dist/canonical-human-identities.d.ts",
+      "import": "./dist/canonical-human-identities.js"
     }
   },
   "publishConfig": {
@@ -42,15 +46,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.15",
-    "@opengeni/config": "^0.13.2",
-    "@opengeni/contracts": "^0.44.1",
-    "@opengeni/db": "^0.31.1",
-    "@opengeni/documents": "^0.5.32",
-    "@opengeni/events": "^0.3.103",
-    "@opengeni/observability": "^0.6.2",
-    "@opengeni/runtime": "^0.19.2",
-    "@opengeni/storage": "^0.2.87",
+    "@opengeni/codex": "^0.2.16",
+    "@opengeni/config": "^0.16.1",
+    "@opengeni/contracts": "^0.50.0",
+    "@opengeni/db": "^0.36.0",
+    "@opengeni/documents": "^0.5.38",
+    "@opengeni/events": "^0.3.109",
+    "@opengeni/observability": "^0.7.5",
+    "@opengeni/runtime": "^0.23.0",
+    "@opengeni/storage": "^0.2.93",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/access/index.ts

@@ -20,6 +20,7 @@ import type { ManagedAuth } from "../managed-auth-type";
 import { getManagedSession } from "../managed-session";
 
 const bearerPrefix = "Bearer ";
+const accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();
 
 export type AccessDeps = {
   db: Database;
@@ -28,7 +29,12 @@ export type AccessDeps = {
 };
 
 export async function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext> {
-  const context = await resolveAccessContext(c, deps);
+  let pending = accessContextByRequest.get(c.req.raw);
+  if (!pending) {
+    pending = resolveAccessContext(c, deps);
+    accessContextByRequest.set(c.req.raw, pending);
+  }
+  const context = await pending;
   if (!context) {
     throw new HTTPException(401, { message: "authentication required" });
   }
@@ -252,7 +258,7 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
   }
 
   if (deps.managedAuth) {
-    const session = await getManagedSession(c, deps.managedAuth);
+    const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });
     if (session?.user) {
       return await ensureManagedAccessForUser(deps.db, {
         userId: session.user.id,
@@ -355,6 +361,12 @@ async function delegatedAccessContext(
           ...(payload.firstPartyMcpTools !== undefined
             ? { firstPartyMcpTools: payload.firstPartyMcpTools }
             : {}),
+          ...(payload.nestedAgentDepth !== undefined
+            ? { nestedAgentDepth: payload.nestedAgentDepth }
+            : {}),
+          ...(payload.effectiveMaxNestedAgentDepth !== undefined
+            ? { effectiveMaxNestedAgentDepth: payload.effectiveMaxNestedAgentDepth }
+            : {}),
           // Caller identity: the turn that minted this token. Tools classify the
           // CALLER from this instead of re-reading the live active pointer.
           ...(payload.turnId ? { turnId: payload.turnId } : {}),

package/src/canonical-human-identities.ts

@@ -0,0 +1,27 @@
+import type { Database } from "@opengeni/db";
+import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { ManagedAuth } from "./managed-auth-type";
+import { getManagedSession } from "./managed-session";
+
+export type CanonicalHumanRequestIdentity = {
+  authUserId: string;
+  authSessionId: string;
+};
+
+export async function requireCanonicalHumanRequestIdentity(
+  context: Context,
+  input: { db: Database; managedAuth?: ManagedAuth | null; allowRecovery?: boolean },
+): Promise<CanonicalHumanRequestIdentity> {
+  if (!input.managedAuth) {
+    throw new HTTPException(404, { message: "Canonical human identity is unavailable" });
+  }
+  const session = await getManagedSession(context, input.managedAuth, {
+    db: input.db,
+    ...(input.allowRecovery === undefined ? {} : { allowIdentityRecovery: input.allowRecovery }),
+  });
+  if (!session?.user || typeof session.session?.id !== "string") {
+    throw new HTTPException(401, { message: "Managed human authentication required" });
+  }
+  return { authUserId: session.user.id, authSessionId: session.session.id };
+}

package/src/dependencies.ts

@@ -138,11 +138,15 @@ export type AppDependencies = {
   managedAuth?: ManagedAuth | null;
   /** Injectable Codex HTTP transport for deterministic API/provider tests. */
   codexFetch?: typeof fetch;
+  /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
+  xaiFetch?: typeof fetch;
   /** Injectable Slack Web API transport for deterministic bot-connection tests. */
   slackFetch?: typeof fetch;
   /** Injectable Google OAuth/Drive transport for deterministic connector tests. */
   googleDriveFetch?: typeof fetch;
-  /** Injectable provider-preset OAuth/API transport for deterministic integration tests. */
+  /** Injectable Fiken API transport for deterministic connector tests. */
+  fikenFetch?: typeof fetch;
+  /** Injectable Integration Definition OAuth/API transport for deterministic tests. */
   apiIntegrationOAuthFetch?: typeof fetch;
   atlassianFetch?: typeof fetch;
   /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */