@opengeni/core 0.28.0 → 1.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.28.0",
+  "version": "1.0.1",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -46,15 +46,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.16",
-    "@opengeni/config": "^0.16.1",
-    "@opengeni/contracts": "^0.50.0",
-    "@opengeni/db": "^0.36.0",
-    "@opengeni/documents": "^0.5.38",
-    "@opengeni/events": "^0.3.109",
-    "@opengeni/observability": "^0.7.5",
-    "@opengeni/runtime": "^0.23.0",
-    "@opengeni/storage": "^0.2.93",
+    "@opengeni/codex": "^0.2.17",
+    "@opengeni/config": "^0.16.4",
+    "@opengeni/contracts": "^1.0.1",
+    "@opengeni/db": "^1.0.1",
+    "@opengeni/documents": "^0.5.41",
+    "@opengeni/events": "^0.3.112",
+    "@opengeni/observability": "^0.7.7",
+    "@opengeni/runtime": "^1.0.1",
+    "@opengeni/storage": "^0.2.96",
     "hono": "^4.12.18"
   },
   "engines": {

package/src/application/new-session-drafts.ts

@@ -13,7 +13,7 @@ import {
   NewSessionDraftAccessError,
   newSessionDraftToolsProvided,
   publicNewSessionDraftOptions,
-  requireFile,
+  requireFileForSubject,
   saveNewSessionDraftInTransaction,
   withWorkspaceSubjectRls,
 } from "@opengeni/db";
@@ -88,7 +88,12 @@ async function hydrateNewSessionDraft(
       continue;
     }
     try {
-      const file = await requireFile(deps.db, workspaceId, resource.fileId);
+      const file = await requireFileForSubject(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        fileId: resource.fileId,
+      });
       if (file.status === "ready") resources.push(resource);
     } catch {
       // Missing, foreign, failed, and pending files are stale draft state.
@@ -209,7 +214,7 @@ export async function saveActorNewSessionDraft(
   if (resources.some((resource) => resource.kind === "file") && !deps.objectStorage) {
     throw new HTTPException(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(deps.db, workspaceId, resources);
+  await validateFileResources(deps.db, grant.accountId, workspaceId, grant.subjectId, resources);
   assertConfiguredModel(deps.settings, input.model);
   await assertWorkspaceModelPolicyAllows(deps.db, deps.settings, workspaceId, input.model);
 

package/src/domain/personal-connection-delegations.ts

@@ -7,6 +7,12 @@ import type {
   SocialConnection,
   ToolRef,
 } from "@opengeni/contracts";
+import {
+  GOOGLE_DRIVE_PROVIDER_DOMAIN,
+  GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+  GoogleDriveConnectionMetadata,
+  googleDriveScopesAllowCapability,
+} from "@opengeni/contracts/google-drive";
 import {
   getSessionTurnPersonalConnectionDelegations,
   getConnectionMetadata,
@@ -250,11 +256,55 @@ export function personalConnectionDelegationsFromParent(input: {
   return [
     ...mcp,
     ...input.parentDelegations
-      .filter((item) => item.connectionType === "social" || item.connectionType === "atlassian")
+      .filter(
+        (item) =>
+          item.connectionType === "social" ||
+          item.connectionType === "atlassian" ||
+          item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+      )
       .map((item) => ({ ...item })),
   ];
 }
 
+/**
+ * Freezes Google Drive publishing only when one exact subject-owned connection
+ * is eligible. Multiple writable Google accounts are intentionally ambiguous:
+ * callers must narrow the connection before a later turn can advertise or use
+ * the private publication tool.
+ */
+export function googleDrivePublicationDelegationFromVisibleConnections(input: {
+  subjectId: string;
+  connections: ConnectionMetadata[];
+}): McpPersonalConnectionDelegation | null {
+  const eligible = input.connections.filter((connection) => {
+    if (
+      connection.subjectId !== input.subjectId ||
+      connection.status !== "active" ||
+      connection.kind !== "oauth2" ||
+      !sameProviderDomain(connection.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) ||
+      !googleDriveScopesAllowCapability(connection.grantedScopes, "publish_file")
+    ) {
+      return false;
+    }
+    const metadata = GoogleDriveConnectionMetadata.safeParse(connection.metadata);
+    return Boolean(
+      metadata.success &&
+      metadata.data.outputDestination &&
+      metadata.data.lifecycle?.state !== "paused" &&
+      (!metadata.data.lifecycle || metadata.data.lifecycle.state === "active"),
+    );
+  });
+  if (eligible.length !== 1) return null;
+  const connection = eligible[0]!;
+  return {
+    serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+    connectionId: connection.id,
+    ownerSubjectId: input.subjectId,
+    providerDomain: connection.providerDomain,
+    kind: connection.kind,
+  };
+}
+
 export function personalConnectionDelegationsEqual(
   left: McpPersonalConnectionDelegation[],
   right: McpPersonalConnectionDelegation[],
@@ -324,9 +374,22 @@ export function withFrozenPersonalConnectionDelegations(input: {
     let effectiveRequest = request;
     if (request.connectionRef.subjectScope === "subject") {
       const config = input.settings.mcpServers.find((server) => server.id === request.serverId);
+      const publicationDelegations =
+        request.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID &&
+        sameProviderDomain(request.connectionRef.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN)
+          ? input.personalConnectionDelegations.filter(
+              (candidate) =>
+                candidate.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID &&
+                sameProviderDomain(candidate.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) &&
+                candidate.kind === "oauth2" &&
+                request.connectionRef.kind === "oauth2",
+            )
+          : [];
       const delegation = config
         ? personalConnectionDelegationForServer(input.personalConnectionDelegations, config)
-        : null;
+        : publicationDelegations.length === 1
+          ? publicationDelegations[0]!
+          : null;
       if (!delegation || !(await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId))) {
         return personalAuthorityUnavailable(request);
       }
@@ -374,15 +437,23 @@ export async function freezePersonalConnectionDelegations(input: {
     return includeFirstPartyConnections
       ? inherited
       : inherited.filter(
-          (item) => item.connectionType !== "social" && item.connectionType !== "atlassian",
+          (item) =>
+            item.connectionType !== "social" &&
+            item.connectionType !== "atlassian" &&
+            item.serverId !== GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
         );
   }
   const membership = await getWorkspaceGrant(input.db, input.source.subjectId, input.workspaceId);
   if (!membership) return [];
+  const visibleConnections = await listConnectionsMetadata(
+    input.db,
+    input.workspaceId,
+    input.source.subjectId,
+  );
   const mcp = personalConnectionDelegationsFromVisibleConnections({
     servers,
     subjectId: input.source.subjectId,
-    connections: await listConnectionsMetadata(input.db, input.workspaceId, input.source.subjectId),
+    connections: visibleConnections,
   });
   if (!includeFirstPartyConnections) return mcp;
   const ownerSubjectId = input.source.subjectId;
@@ -399,16 +470,19 @@ export async function freezePersonalConnectionDelegations(input: {
     if (!prior || connection.updatedAt > prior.updatedAt)
       latest.set(connection.provider, connection);
   }
-  const personalAtlassian = (
-    await listConnectionsMetadata(input.db, input.workspaceId, ownerSubjectId)
-  ).filter(
+  const personalAtlassian = visibleConnections.filter(
     (connection) =>
       connection.subjectId === ownerSubjectId &&
       connection.status === "active" &&
       sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
   );
+  const googleDrivePublication = googleDrivePublicationDelegationFromVisibleConnections({
+    subjectId: ownerSubjectId,
+    connections: visibleConnections,
+  });
   return [
     ...mcp,
+    ...(googleDrivePublication ? [googleDrivePublication] : []),
     ...[...latest.values()].map((connection) => ({
       serverId: `social:${connection.provider}`,
       connectionId: connection.id,

package/src/domain/resources.ts

@@ -17,7 +17,11 @@ import {
   type ResourceRef,
   type ToolRef,
 } from "@opengeni/contracts";
-import { areGitHubRepositoriesAllowedForWorkspace, requireFile, type Database } from "@opengeni/db";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
+  requireFileForSubject,
+  type Database,
+} from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
 export function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {
@@ -311,7 +315,9 @@ export function isAuthoritativeGitHubRepositorySelectionError(error: unknown): b
 
 export async function validateFileResources(
   db: Database,
+  accountId: string,
   workspaceId: string,
+  subjectId: string,
   resources: ResourceRef[],
 ): Promise<void> {
   const fileIds = new Set<string>();
@@ -323,7 +329,12 @@ export async function validateFileResources(
       throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });
     }
     fileIds.add(resource.fileId);
-    const file = await requireFile(db, workspaceId, resource.fileId).catch(() => null);
+    const file = await requireFileForSubject(db, {
+      accountId,
+      workspaceId,
+      subjectId,
+      fileId: resource.fileId,
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });
     }

package/src/domain/scheduled-tasks.ts

@@ -813,7 +813,13 @@ async function validateScheduledTaskAgentConfig(input: {
   if (resources.some((resource) => resource.kind === "file") && !input.objectStorage) {
     throw new HTTPException(503, { message: "object storage is not configured" });
   }
-  await validateFileResources(input.db, input.workspaceId, resources);
+  await validateFileResources(
+    input.db,
+    input.grant.accountId,
+    input.workspaceId,
+    input.grant.subjectId,
+    resources,
+  );
   if (input.payload.agentConfig.slackBotConnectionId) {
     await validateOpenGeniSlackBotConnectionSelection(
       input.db,

package/src/domain/sessions.ts

@@ -565,7 +565,7 @@ export async function createAndStartSessionWithOutcome(input: {
   initialMessage: string;
   /** Create the session shell without an initial user event/agent turn. */
   deferInitialTurn?: boolean;
-  turnInstructions?: string | null;
+  modelContext?: string | null;
   resources: ResourceRef[];
   skills?: SessionSkill[];
   tools: ToolRef[];
@@ -674,7 +674,7 @@ export async function createAndStartSessionWithOutcome(input: {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       initialMessage: input.initialMessage,
-      initialTurnInstructions: input.turnInstructions ?? null,
+      initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
@@ -740,7 +740,7 @@ export async function createAndStartSessionWithOutcome(input: {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       initialMessage: input.initialMessage,
-      initialTurnInstructions: input.turnInstructions ?? null,
+      initialModelContext: input.modelContext ?? null,
       resources: input.resources,
       skills: input.skills ?? [],
       tools: input.tools,
@@ -809,7 +809,7 @@ async function finishStartSession(
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     initialMessage: string;
     deferInitialTurn?: boolean;
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
     toolPolicy: SessionToolPolicy;
@@ -1103,7 +1103,7 @@ export async function postUserMessageTurn(input: {
   sessionId: string;
   text: string;
   annotations?: TimelineAnnotation[];
-  turnInstructions?: string | null;
+  modelContext?: string | null;
   resources: ResourceRef[];
   model?: string | null;
   reasoningEffort?: Settings["openaiReasoningEffort"] | null;
@@ -1176,7 +1176,7 @@ export async function postUserMessageTurn(input: {
               expectedDraftRevision: input.expectedDraftRevision ?? null,
               text: input.text,
               annotations: input.annotations ?? [],
-              turnInstructions: input.turnInstructions ?? null,
+              modelContext: input.modelContext ?? null,
               resources: input.resources,
               model: requestedModel,
               reasoningEffort: requestedReasoningEffort,
@@ -1451,7 +1451,7 @@ export async function createSessionForRequestWithOutcome(
       message: "object storage is not configured",
     });
   }
-  await validateFileResources(db, workspaceId, resources);
+  await validateFileResources(db, grant.accountId, workspaceId, grant.subjectId, resources);
   // VariableSet attachment requires variable-sets:use on the calling grant
   // (validateVariableSetAttachment enforces it), preserving the invariant
   // that sandboxed agents cannot self-attach workspace secrets.
@@ -1883,7 +1883,7 @@ export async function createSessionForRequestWithOutcome(
       workspaceId,
       initialMessage: payload.initialMessage ?? "",
       deferInitialTurn: payload.startMode === "realtime",
-      turnInstructions: payload.turnInstructions ?? null,
+      modelContext: payload.modelContext ?? null,
       resources,
       skills,
       tools,
@@ -2024,7 +2024,7 @@ export async function acceptSessionUserMessageWithOutcome(
   input: {
     text: string;
     annotations?: SubmittedTimelineAnnotation[];
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources?: ResourceRef[];
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
@@ -2102,7 +2102,13 @@ export async function acceptSessionUserMessageWithOutcome(
       message: "object storage is not configured",
     });
   }
-  await validateFileResources(db, workspaceId, requestedResources);
+  await validateFileResources(
+    db,
+    grant.accountId,
+    workspaceId,
+    grant.subjectId,
+    requestedResources,
+  );
   await validateGitHubRepositorySelection(db, workspaceId, [
     ...existingSession.resources,
     ...requestedResources,
@@ -2133,7 +2139,7 @@ export async function acceptSessionUserMessageWithOutcome(
     sessionId,
     text: input.text,
     annotations,
-    turnInstructions: input.turnInstructions ?? null,
+    modelContext: input.modelContext ?? null,
     resources: requestedResources,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,