@opengeni/core 0.28.0 → 1.0.1

package/dist/domain/personal-connection-delegations.d.ts

@@ -40,6 +40,16 @@ export declare function personalConnectionDelegationsFromParent(input: {
     servers: McpServerConfig[];
     parentDelegations: McpPersonalConnectionDelegation[];
 }): McpPersonalConnectionDelegation[];
+/**
+ * Freezes Google Drive publishing only when one exact subject-owned connection
+ * is eligible. Multiple writable Google accounts are intentionally ambiguous:
+ * callers must narrow the connection before a later turn can advertise or use
+ * the private publication tool.
+ */
+export declare function googleDrivePublicationDelegationFromVisibleConnections(input: {
+    subjectId: string;
+    connections: ConnectionMetadata[];
+}): McpPersonalConnectionDelegation | null;
 export declare function personalConnectionDelegationsEqual(left: McpPersonalConnectionDelegation[], right: McpPersonalConnectionDelegation[]): boolean;
 export declare function personalConnectionDelegationForServer(delegations: McpPersonalConnectionDelegation[], server: Pick<McpServerConfig, "id" | "connectionRef">): McpPersonalConnectionDelegation | null;
 type ConnectionCredentialResolver = (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;

package/dist/domain/resources.d.ts

@@ -28,5 +28,5 @@ export declare function validateGitHubRepositorySelection(db: Database, workspac
  * leave the result unknown and must not cause draft hydration to delete it.
  */
 export declare function isAuthoritativeGitHubRepositorySelectionError(error: unknown): boolean;
-export declare function validateFileResources(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void>;
+export declare function validateFileResources(db: Database, accountId: string, workspaceId: string, subjectId: string, resources: ResourceRef[]): Promise<void>;
 export { mergeToolRefs, stableJson };

package/dist/domain/sessions.d.ts

@@ -78,7 +78,7 @@ export declare function createAndStartSessionWithOutcome(input: {
     initialMessage: string;
     /** Create the session shell without an initial user event/agent turn. */
     deferInitialTurn?: boolean;
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources: ResourceRef[];
     skills?: SessionSkill[];
     tools: ToolRef[];
@@ -194,7 +194,7 @@ export declare function postUserMessageTurn(input: {
     sessionId: string;
     text: string;
     annotations?: TimelineAnnotation[];
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources: ResourceRef[];
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
@@ -243,7 +243,7 @@ export declare function createSessionForRequest(deps: ApiRouteDeps, grant: Acces
 export declare function acceptSessionUserMessageWithOutcome(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: {
     text: string;
     annotations?: SubmittedTimelineAnnotation[];
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources?: ResourceRef[];
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;

package/dist/index.js

@@ -4355,6 +4355,12 @@ async function listRigChangesForApi(deps, workspaceId, rigId, limit) {
 }
 
 // src/domain/personal-connection-delegations.ts
+import {
+  GOOGLE_DRIVE_PROVIDER_DOMAIN,
+  GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+  GoogleDriveConnectionMetadata,
+  googleDriveScopesAllowCapability
+} from "@opengeni/contracts/google-drive";
 import {
   getSessionTurnPersonalConnectionDelegations,
   getConnectionMetadata as getConnectionMetadata2,
@@ -4523,9 +4529,31 @@ function personalConnectionDelegationsFromParent(input) {
   });
   return [
     ...mcp,
-    ...input.parentDelegations.filter((item) => item.connectionType === "social" || item.connectionType === "atlassian").map((item) => ({ ...item }))
+    ...input.parentDelegations.filter(
+      (item) => item.connectionType === "social" || item.connectionType === "atlassian" || item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID
+    ).map((item) => ({ ...item }))
   ];
 }
+function googleDrivePublicationDelegationFromVisibleConnections(input) {
+  const eligible = input.connections.filter((connection2) => {
+    if (connection2.subjectId !== input.subjectId || connection2.status !== "active" || connection2.kind !== "oauth2" || !sameProviderDomain(connection2.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) || !googleDriveScopesAllowCapability(connection2.grantedScopes, "publish_file")) {
+      return false;
+    }
+    const metadata = GoogleDriveConnectionMetadata.safeParse(connection2.metadata);
+    return Boolean(
+      metadata.success && metadata.data.outputDestination && metadata.data.lifecycle?.state !== "paused" && (!metadata.data.lifecycle || metadata.data.lifecycle.state === "active")
+    );
+  });
+  if (eligible.length !== 1) return null;
+  const connection = eligible[0];
+  return {
+    serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+    connectionId: connection.id,
+    ownerSubjectId: input.subjectId,
+    providerDomain: connection.providerDomain,
+    kind: connection.kind
+  };
+}
 function personalConnectionDelegationsEqual(left, right) {
   if (left.length !== right.length) return false;
   const byServer = new Map(right.map((delegation) => [delegation.serverId, delegation]));
@@ -4558,7 +4586,10 @@ function withFrozenPersonalConnectionDelegations(input) {
     let effectiveRequest = request;
     if (request.connectionRef.subjectScope === "subject") {
       const config = input.settings.mcpServers.find((server) => server.id === request.serverId);
-      const delegation = config ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config) : null;
+      const publicationDelegations = request.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID && sameProviderDomain(request.connectionRef.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) ? input.personalConnectionDelegations.filter(
+        (candidate) => candidate.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID && sameProviderDomain(candidate.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) && candidate.kind === "oauth2" && request.connectionRef.kind === "oauth2"
+      ) : [];
+      const delegation = config ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config) : publicationDelegations.length === 1 ? publicationDelegations[0] : null;
       if (!delegation || !await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId)) {
         return personalAuthorityUnavailable(request);
       }
@@ -4597,15 +4628,20 @@ async function freezePersonalConnectionDelegations(input) {
       )
     });
     return includeFirstPartyConnections ? inherited : inherited.filter(
-      (item) => item.connectionType !== "social" && item.connectionType !== "atlassian"
+      (item) => item.connectionType !== "social" && item.connectionType !== "atlassian" && item.serverId !== GOOGLE_DRIVE_PUBLICATION_SERVER_ID
     );
   }
   const membership = await getWorkspaceGrant3(input.db, input.source.subjectId, input.workspaceId);
   if (!membership) return [];
+  const visibleConnections = await listConnectionsMetadata2(
+    input.db,
+    input.workspaceId,
+    input.source.subjectId
+  );
   const mcp = personalConnectionDelegationsFromVisibleConnections({
     servers,
     subjectId: input.source.subjectId,
-    connections: await listConnectionsMetadata2(input.db, input.workspaceId, input.source.subjectId)
+    connections: visibleConnections
   });
   if (!includeFirstPartyConnections) return mcp;
   const ownerSubjectId = input.source.subjectId;
@@ -4618,11 +4654,16 @@ async function freezePersonalConnectionDelegations(input) {
     if (!prior || connection.updatedAt > prior.updatedAt)
       latest.set(connection.provider, connection);
   }
-  const personalAtlassian = (await listConnectionsMetadata2(input.db, input.workspaceId, ownerSubjectId)).filter(
+  const personalAtlassian = visibleConnections.filter(
     (connection) => connection.subjectId === ownerSubjectId && connection.status === "active" && sameProviderDomain(connection.providerDomain, "api.atlassian.com")
   );
+  const googleDrivePublication = googleDrivePublicationDelegationFromVisibleConnections({
+    subjectId: ownerSubjectId,
+    connections: visibleConnections
+  });
   return [
     ...mcp,
+    ...googleDrivePublication ? [googleDrivePublication] : [],
     ...[...latest.values()].map((connection) => ({
       serverId: `social:${connection.provider}`,
       connectionId: connection.id,
@@ -4659,7 +4700,10 @@ import {
   ResourceMountPathError,
   stableJson as stableJson3
 } from "@opengeni/contracts";
-import { areGitHubRepositoriesAllowedForWorkspace, requireFile } from "@opengeni/db";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
+  requireFileForSubject
+} from "@opengeni/db";
 import { HTTPException as HTTPException8 } from "hono/http-exception";
 function validateToolRefs(tools, settings) {
   const mcpServerIds = new Set(settings.mcpServers.map((server) => server.id));
@@ -4864,7 +4908,7 @@ async function validateGitHubRepositorySelection(db, workspaceId, resources) {
 function isAuthoritativeGitHubRepositorySelectionError(error) {
   return error instanceof HTTPException8 && error.status === 422;
 }
-async function validateFileResources(db, workspaceId, resources) {
+async function validateFileResources(db, accountId, workspaceId, subjectId, resources) {
   const fileIds = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     if (resource.kind !== "file") {
@@ -4874,7 +4918,12 @@ async function validateFileResources(db, workspaceId, resources) {
       throw new HTTPException8(422, { message: `duplicate file resource: ${resource.fileId}` });
     }
     fileIds.add(resource.fileId);
-    const file = await requireFile(db, workspaceId, resource.fileId).catch(() => null);
+    const file = await requireFileForSubject(db, {
+      accountId,
+      workspaceId,
+      subjectId,
+      fileId: resource.fileId
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException8(422, { message: `unknown file resource: ${resource.fileId}` });
     }
@@ -5652,7 +5701,7 @@ async function createAndStartSessionWithOutcome(input) {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       initialMessage: input.initialMessage,
-      initialTurnInstructions: input.turnInstructions ?? null,
+      initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
@@ -5716,7 +5765,7 @@ async function createAndStartSessionWithOutcome(input) {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       initialMessage: input.initialMessage,
-      initialTurnInstructions: input.turnInstructions ?? null,
+      initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
@@ -5966,7 +6015,7 @@ async function postUserMessageTurn(input) {
           expectedDraftRevision: input.expectedDraftRevision ?? null,
           text: input.text,
           annotations: input.annotations ?? [],
-          turnInstructions: input.turnInstructions ?? null,
+          modelContext: input.modelContext ?? null,
           resources: input.resources,
           model: requestedModel,
           reasoningEffort: requestedReasoningEffort,
@@ -6182,7 +6231,7 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       message: "object storage is not configured"
     });
   }
-  await validateFileResources(db, workspaceId, resources);
+  await validateFileResources(db, grant.accountId, workspaceId, grant.subjectId, resources);
   const variableSet = payload.variableSetId ? await validateVariableSetAttachment(
     { settings, db },
     grant,
@@ -6401,7 +6450,7 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       workspaceId,
       initialMessage: payload.initialMessage ?? "",
       deferInitialTurn: payload.startMode === "realtime",
-      turnInstructions: payload.turnInstructions ?? null,
+      modelContext: payload.modelContext ?? null,
       resources,
       skills,
       tools,
@@ -6568,7 +6617,13 @@ async function acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, ses
       message: "object storage is not configured"
     });
   }
-  await validateFileResources(db, workspaceId, requestedResources);
+  await validateFileResources(
+    db,
+    grant.accountId,
+    workspaceId,
+    grant.subjectId,
+    requestedResources
+  );
   await validateGitHubRepositorySelection(db, workspaceId, [
     ...existingSession.resources,
     ...requestedResources
@@ -6599,7 +6654,7 @@ async function acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, ses
     sessionId,
     text: input.text,
     annotations,
-    turnInstructions: input.turnInstructions ?? null,
+    modelContext: input.modelContext ?? null,
     resources: requestedResources,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
@@ -7444,7 +7499,13 @@ async function validateScheduledTaskAgentConfig(input) {
   if (resources.some((resource) => resource.kind === "file") && !input.objectStorage) {
     throw new HTTPException12(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(input.db, input.workspaceId, resources);
+  await validateFileResources(
+    input.db,
+    input.grant.accountId,
+    input.workspaceId,
+    input.grant.subjectId,
+    resources
+  );
   if (input.payload.agentConfig.slackBotConnectionId) {
     await validateOpenGeniSlackBotConnectionSelection(
       input.db,
@@ -9722,7 +9783,7 @@ import {
   NewSessionDraftAccessError,
   newSessionDraftToolsProvided,
   publicNewSessionDraftOptions,
-  requireFile as requireFile2,
+  requireFileForSubject as requireFileForSubject2,
   saveNewSessionDraftInTransaction,
   withWorkspaceSubjectRls
 } from "@opengeni/db";
@@ -9770,7 +9831,12 @@ async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
       continue;
     }
     try {
-      const file = await requireFile2(deps.db, workspaceId, resource.fileId);
+      const file = await requireFileForSubject2(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        fileId: resource.fileId
+      });
       if (file.status === "ready") resources.push(resource);
     } catch {
     }
@@ -9854,7 +9920,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput) {
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
     throw new HTTPException14(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(deps.db, workspaceId, resources);
+  await validateFileResources(deps.db, grant.accountId, workspaceId, grant.subjectId, resources);
   assertConfiguredModel(deps.settings, input.model);
   await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);
   try {
@@ -10655,6 +10721,7 @@ export {
   getHumanComposerDraft,
   getManagedSession,
   getWorkspaceInsights,
+  googleDrivePublicationDelegationFromVisibleConnections,
   hasLiteralPermission,
   hasPermission,
   hasReservedFikenMetadata,