@opengeni/core 0.28.1 → 1.0.0

package/src/domain/slack-bot.ts

@@ -3,10 +3,14 @@ import {
   OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   OpenGeniSlackBotConnectionMetadata,
+  SCHEDULED_SLACK_BOT_POSTING_TOOLS,
   areOpenGeniSlackBotScopesAccepted,
   type AccessGrant,
   type ConnectionMetadata,
+  type FirstPartyMcpToolName,
   type OpenGeniSlackBotConnectionMetadata as OpenGeniSlackBotMetadata,
+  type ScheduledTask,
+  type ScheduledTaskAgentConfig,
   type Session,
 } from "@opengeni/contracts";
 import {
@@ -15,7 +19,8 @@ import {
   type Database,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
-import { requirePermission } from "../access";
+import { requirePermission, type AccessGrantAuthorization } from "../access";
+import { grantHasAgentAttemptAuthority } from "../session-authorization";
 
 export function openGeniSlackBotMetadata(
   metadata: Record<string, unknown>,
@@ -72,12 +77,12 @@ export async function requireOpenGeniSlackBotConnection(
   const connection = await getConnectionMetadata(db, workspaceId, connectionId, null);
   if (!connection || !isOpenGeniSlackBotConnection(connection)) {
     throw new HTTPException(422, {
-      message: "slackBotConnectionId must reference an OpenGeni Slack bot connection",
+      message: "slackBotConnectionId must reference an Opengeni Slack bot connection",
     });
   }
   if (connection.status !== "active") {
     throw new HTTPException(422, {
-      message: `OpenGeni Slack bot connection is not active (${connection.status})`,
+      message: `Opengeni Slack bot connection is not active (${connection.status})`,
     });
   }
   return connection;
@@ -126,3 +131,123 @@ export function isTrustedScheduledSlackBotSession(
 function zUuid(value: string): boolean {
   return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
 }
+
+/**
+ * Proves, with the bot's own token, that it may post in the chosen channel:
+ * the bot is a member and the channel is active and not shared with another
+ * organization. Supplied only by the HTTP routes a person uses to edit tasks.
+ */
+export type ScheduledTaskSlackChannelVerifier = (input: {
+  connectionId: string;
+  channelId: string;
+}) => Promise<void>;
+
+/**
+ * Whether this request is a signed-in person acting for themselves: never an
+ * agent attempt, a service, an API key, or a request carrying service
+ * provenance. The same rule gates Agent learning settings.
+ */
+export function isAuthenticatedPersonAuthorization(
+  authorization: AccessGrantAuthorization | undefined,
+): boolean {
+  if (!authorization) return false;
+  const { grant } = authorization;
+  return (
+    grant.principalKind === "human_session" &&
+    authorization.contextIntegrity &&
+    authorization.authenticatedSubjectId === grant.subjectId &&
+    !grant.serviceInitiator &&
+    !grant.serviceInitiatorContext &&
+    grant.metadata?.attemptId === undefined &&
+    grant.metadata?.turnId === undefined &&
+    grant.metadata?.executionGeneration === undefined &&
+    !grantHasAgentAttemptAuthority(grant)
+  );
+}
+
+/**
+ * A scheduled task may post as the OpenGeni workspace bot only to the one
+ * Slack channel a person chose on the task. Choosing or changing that channel
+ * therefore needs a signed-in person with `connections:write`, and the bot's
+ * membership is verified at that moment. Keeping or clearing the existing
+ * channel needs neither, so an agent editing other task fields cannot redirect
+ * posts but also does not have to re-prove the person's choice. Clearing is the
+ * safe direction and is never refused, even for a task that continues one chat.
+ */
+export async function validateScheduledTaskSlackChannel(input: {
+  grant: AccessGrant;
+  authorization?: AccessGrantAuthorization | undefined;
+  previous: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId"> | null;
+  next: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId">;
+  runMode: ScheduledTask["runMode"];
+  /**
+   * Null unless the task already created the reusable chat its runs continue.
+   * Otherwise reports whether that chat was created with the posting tools,
+   * which are fixed at creation.
+   */
+  reusableSessionCanPost: (() => Promise<boolean>) | null;
+  verifySlackChannel?: ScheduledTaskSlackChannelVerifier | undefined;
+}): Promise<void> {
+  const previousChannel = input.previous?.slackBotChannelId ?? null;
+  const nextChannel = input.next.slackBotChannelId ?? null;
+  // Clearing takes effect at once: the tools re-read the task and refuse.
+  if (!nextChannel) return;
+  if (!input.next.slackBotConnectionId) {
+    throw new HTTPException(422, {
+      message: "slackBotChannelId requires slackBotConnectionId",
+    });
+  }
+  if (input.runMode === "existing_session") {
+    throw new HTTPException(422, {
+      message: "Slack channel posting needs a task that starts its own chats",
+    });
+  }
+  if (
+    previousChannel === nextChannel &&
+    (input.previous?.slackBotConnectionId ?? null) === input.next.slackBotConnectionId
+  ) {
+    return;
+  }
+  if (!isAuthenticatedPersonAuthorization(input.authorization)) {
+    throw new HTTPException(403, {
+      message: "Only a person can choose the Slack channel a scheduled task posts to",
+    });
+  }
+  requirePermission(input.grant, "connections:write");
+  // A chat created without the posting tools keeps that tool set, so choosing
+  // a channel for it would silently post nothing.
+  if (input.reusableSessionCanPost && !(await input.reusableSessionCanPost())) {
+    throw new HTTPException(409, {
+      message:
+        "this task continues a chat that was created without Slack posting; recreate the task to post from it",
+    });
+  }
+  if (!input.verifySlackChannel) {
+    throw new HTTPException(422, {
+      message: "Choose the Slack channel in the schedule editor",
+    });
+  }
+  await input.verifySlackChannel({
+    connectionId: input.next.slackBotConnectionId,
+    channelId: nextChannel,
+  });
+}
+
+/**
+ * Add the bot posting tools to a generated scheduled run when, and only when,
+ * a person chose the task's Slack channel. The deployment ceiling still
+ * applies: an operator who disallowed these tools keeps them off.
+ */
+export function withScheduledSlackBotPostingTools(
+  tools: readonly FirstPartyMcpToolName[],
+  agentConfig: Pick<ScheduledTaskAgentConfig, "slackBotConnectionId" | "slackBotChannelId">,
+  allowedTools: readonly FirstPartyMcpToolName[],
+): FirstPartyMcpToolName[] {
+  if (!agentConfig.slackBotConnectionId || !agentConfig.slackBotChannelId) return [...tools];
+  const allowed = new Set(allowedTools);
+  const next = [...tools];
+  for (const tool of SCHEDULED_SLACK_BOT_POSTING_TOOLS) {
+    if (allowed.has(tool) && !next.includes(tool)) next.push(tool);
+  }
+  return next;
+}

package/src/domain/workspace-members.ts

@@ -44,7 +44,9 @@ export function assertWorkspaceMemberRemovable(input: {
 }): void {
   const { members, subjectId, callerSubjectId } = input;
   if (subjectId === callerSubjectId) {
-    throw new HTTPException(409, { message: "you cannot remove your own membership" });
+    throw new HTTPException(409, {
+      message: "you cannot remove your own membership",
+    });
   }
   const target = members.find((member) => member.subjectId === subjectId);
   if (!target) {
@@ -62,6 +64,34 @@ export function assertWorkspaceMemberRemovable(input: {
   }
 }
 
+/** Keep scoped member edits from orphaning the workspace or changing the caller's own grant. */
+export function assertWorkspaceMemberUpdateAllowed(input: {
+  members: WorkspaceMember[];
+  subjectId: string;
+  callerSubjectId: string;
+  nextPermissions: Permission[];
+}): void {
+  const { members, subjectId, callerSubjectId, nextPermissions } = input;
+  if (subjectId === callerSubjectId) {
+    throw new HTTPException(409, {
+      message: "you cannot change your own workspace access",
+    });
+  }
+  const target = members.find((member) => member.subjectId === subjectId);
+  if (!target) {
+    throw new HTTPException(404, { message: "member not found" });
+  }
+  if (
+    memberCanAdminister(target) &&
+    !memberCanAdminister({ permissions: nextPermissions }) &&
+    !members.some((member) => member.subjectId !== subjectId && memberCanAdminister(member))
+  ) {
+    throw new HTTPException(409, {
+      message: "the workspace must keep at least one administrator",
+    });
+  }
+}
+
 /**
  * Guard the workspace-delete path before any external/DB mutation. Refuses
  * (409) to delete the account's last workspace, and refuses while any session
@@ -74,7 +104,9 @@ export function assertWorkspaceDeletable(input: {
   activeSessionCount: number;
 }): void {
   if (input.workspaceCountForAccount <= 1) {
-    throw new HTTPException(409, { message: "cannot delete the account's only workspace" });
+    throw new HTTPException(409, {
+      message: "cannot delete the account's only workspace",
+    });
   }
   if (input.activeSessionCount > 0) {
     throw new HTTPException(409, {

package/src/editable-artifact-live/application.ts

@@ -19,13 +19,20 @@ import type {
   EditableArtifactLiveServer,
   OpenEditableArtifactLiveInput,
 } from "./server";
-import type { EditableArtifactLiveTicket } from "./types";
+import type {
+  EditableArtifactLiveSourceSessionAuthority,
+  EditableArtifactLiveTicket,
+} from "./types";
 
 export type EditableArtifactLiveCompatibilityRequest = Readonly<{
   artifact: EditableArtifact;
-  protocolVersion: number;
+  modality: EditableArtifactModality;
+  liveProtocolVersion: number;
   kernelVersion: string;
   modelSchemaVersion: number;
+  snapshotVersion: number;
+  commandProtocolVersion: number;
+  committedTransactionProtocolVersion: number;
 }>;
 
 /** A client/runtime protocol tuple cannot be served by the loaded kernel. */
@@ -71,10 +78,15 @@ export type ReadEditableArtifactApplicationInput = Readonly<{
 
 export type MintEditableArtifactApplicationTicketInput = ReadEditableArtifactApplicationInput &
   Readonly<{
-    protocolVersion: number;
+    modality: EditableArtifactModality;
+    liveProtocolVersion: number;
     kernelVersion: string;
     modelSchemaVersion: number;
+    snapshotVersion: number;
+    commandProtocolVersion: number;
+    committedTransactionProtocolVersion: number;
     allowEdit: boolean;
+    sourceSessionAuthority?: EditableArtifactLiveSourceSessionAuthority;
   }>;
 
 /** Exact application seam used by standalone API and embedding hosts. */
@@ -148,9 +160,19 @@ export class EditableArtifactApplication implements EditableArtifactApplicationP
     const artifact = await this.readArtifact(input);
     await this.dependencies.compatibility.assertCompatible({
       artifact,
-      protocolVersion: positiveInteger(input.protocolVersion, "protocolVersion"),
+      modality: input.modality,
+      liveProtocolVersion: positiveInteger(input.liveProtocolVersion, "liveProtocolVersion"),
       kernelVersion: boundedVersion(input.kernelVersion, "kernelVersion"),
       modelSchemaVersion: positiveInteger(input.modelSchemaVersion, "modelSchemaVersion"),
+      snapshotVersion: positiveInteger(input.snapshotVersion, "snapshotVersion"),
+      commandProtocolVersion: positiveInteger(
+        input.commandProtocolVersion,
+        "commandProtocolVersion",
+      ),
+      committedTransactionProtocolVersion: positiveInteger(
+        input.committedTransactionProtocolVersion,
+        "committedTransactionProtocolVersion",
+      ),
     });
     return await this.dependencies.live.mintTicket({
       scope: artifact.scope,
@@ -158,6 +180,9 @@ export class EditableArtifactApplication implements EditableArtifactApplicationP
       modality: artifact.modality,
       actor: input.actor,
       allowEdit: input.allowEdit,
+      ...(input.sourceSessionAuthority
+        ? { sourceSessionAuthority: input.sourceSessionAuthority }
+        : {}),
     });
   }
 

package/src/editable-artifact-live/ports.ts

@@ -40,7 +40,6 @@ export type EditableArtifactLiveBootstrapRead = Readonly<{
   scope: EditableArtifactScope;
   artifactId: EditableArtifactId;
   resume: EditableArtifactLiveResume;
-  protocolVersion: number;
 }>;
 
 export type EditableArtifactLiveTransactionPage = Readonly<{

package/src/editable-artifact-live/server.ts

@@ -1,5 +1,6 @@
 import type { EditableArtifactAuthorizationPort } from "../domain/editable-artifacts/ports";
 import type { EditableArtifactService } from "../domain/editable-artifacts/service";
+import type { Database } from "@opengeni/db";
 import {
   EDITABLE_ARTIFACT_COMMAND_MAX_BYTES,
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
@@ -54,9 +55,13 @@ import {
   type EditableArtifactLiveSnapshot,
   type EditableArtifactLiveTicket,
   type EditableArtifactLiveTicketRecord,
+  type EditableArtifactLiveSourceSessionAuthority,
 } from "./types";
 
 const textEncoder = new TextEncoder();
+// Source-bound sockets must renew through the product proxy's live host check.
+// Unbound native console sockets retain their existing artifact-only lifecycle.
+const SOURCE_SESSION_LIVE_LEASE_MS = 15_000;
 const strictDecoder = new TextDecoder("utf-8", { fatal: true });
 
 // Shared OGATX is bounded at 5 MiB and whole OGACO at 8 MiB. Transport
@@ -81,7 +86,6 @@ const MAX_IDENTIFIER_BYTES = 512;
 const MAX_CAUSAL_ACTORS = 1_024;
 
 export type EditableArtifactLiveServerOptions = Readonly<{
-  protocolVersion?: number;
   ticketTtlMs?: number;
   maxClientFrameBytes?: number;
   maxOutboundFrameBytes?: number;
@@ -101,7 +105,10 @@ export type EditableArtifactLiveServerOptions = Readonly<{
 }>;
 
 type NormalizedOptions = Required<Omit<EditableArtifactLiveServerOptions, "ticketTtlMs">> &
-  Readonly<{ ticketTtlMs?: number }>;
+  Readonly<{
+    protocolVersion: typeof EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
+    ticketTtlMs?: number;
+  }>;
 
 export type OpenEditableArtifactLiveInput = Readonly<{
   token: string;
@@ -110,6 +117,13 @@ export type OpenEditableArtifactLiveInput = Readonly<{
   resume: EditableArtifactLiveResume;
   sink: EditableArtifactLiveSinkPort;
   signal?: AbortSignal;
+  /** API-owned canonical source session authorization, including live revocation. */
+  authorizeSourceSession?: (
+    ticket: EditableArtifactLiveTicketRecord,
+    permission: "read" | "edit",
+    transaction?: Database,
+    signal?: AbortSignal,
+  ) => Promise<boolean>;
 }>;
 
 export interface EditableArtifactLiveSession {
@@ -147,7 +161,6 @@ export class EditableArtifactLiveServer {
       tickets: dependencies.tickets,
       tokens: dependencies.tokens,
       clock: dependencies.clock,
-      protocolVersion: this.options.protocolVersion,
       ...(this.options.ticketTtlMs === undefined ? {} : { ttlMs: this.options.ticketTtlMs }),
     });
   }
@@ -159,6 +172,7 @@ export class EditableArtifactLiveServer {
       modality: EditableArtifactModality;
       actor: EditableArtifactActor;
       allowEdit: boolean;
+      sourceSessionAuthority?: EditableArtifactLiveSourceSessionAuthority;
     }>,
   ): Promise<EditableArtifactLiveTicket> {
     return this.ticketAuthority.mint(input);
@@ -182,6 +196,9 @@ export class EditableArtifactLiveServer {
       resume: input.resume,
       sink: input.sink,
       ...(input.signal === undefined ? {} : { parentSignal: input.signal }),
+      ...(input.authorizeSourceSession
+        ? { authorizeSourceSession: input.authorizeSourceSession }
+        : {}),
     });
     await session.start();
     return session;
@@ -196,6 +213,7 @@ type SessionConstructor = Readonly<{
   resume: EditableArtifactLiveResume;
   sink: EditableArtifactLiveSinkPort;
   parentSignal?: AbortSignal;
+  authorizeSourceSession?: OpenEditableArtifactLiveInput["authorizeSourceSession"];
 }>;
 
 type InFlight = Readonly<{
@@ -213,6 +231,8 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
   private readonly dependencies: EditableArtifactLiveServerDependencies;
   private readonly options: NormalizedOptions;
   private readonly ticket: EditableArtifactLiveTicketRecord;
+  private readonly authorizeSourceSession: OpenEditableArtifactLiveInput["authorizeSourceSession"];
+  private readonly sourceSessionLeaseExpiresAt: number | null;
   private readonly resume: EditableArtifactLiveResume;
   private readonly sink: EditableArtifactLiveSinkPort;
   private readonly abort = new AbortController();
@@ -246,6 +266,10 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
     this.dependencies = input.dependencies;
     this.options = input.options;
     this.ticket = input.ticket;
+    this.authorizeSourceSession = input.authorizeSourceSession;
+    this.sourceSessionLeaseExpiresAt = input.ticket.sourceSessionAuthority
+      ? Date.parse(input.ticket.issuedAt) + SOURCE_SESSION_LIVE_LEASE_MS
+      : null;
     this.artifactId = input.ticket.artifactId;
     this.modality = input.ticket.modality;
     this.streamEpoch = input.streamEpoch;
@@ -267,6 +291,13 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
   async start(): Promise<void> {
     try {
       this.assertOpen();
+      // Deadline enforcement owns no work-queue slot and starts before any
+      // bootstrap/authorization await. A hung callback cannot retain a socket.
+      if (this.sourceSessionLeaseExpiresAt !== null) {
+        void this.runSourceSessionLease().catch((error: unknown) => {
+          if (!this.abort.signal.aborted) void this.fail(error);
+        });
+      }
       this.authorizationRevision = await this.requireRead();
       this.assertOpen();
 
@@ -312,7 +343,6 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
         scope: this.ticket.scope,
         artifactId: this.artifactId,
         resume: this.resume,
-        protocolVersion: this.options.protocolVersion,
       });
       this.assertOpen();
       validateBootstrap(bootstrap, this.artifactId, this.modality, this.resume, this.options);
@@ -527,6 +557,7 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
   }
 
   private assertOpen(): void {
+    this.assertSourceSessionLease();
     if (this.closedValue) {
       throw new EditableArtifactLiveError("closed", "Live session is closed");
     }
@@ -706,7 +737,13 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
       } as const;
       await this.send(
         snapshot.modality === "spreadsheet"
-          ? { ...common, modality: snapshot.modality, causalFrontier: causalFrontier! }
+          ? {
+              ...common,
+              modality: snapshot.modality,
+              causalFrontier: causalFrontier!,
+              operationProtocolVersion: snapshot.operationProtocolVersion,
+              snapshotVersion: snapshot.snapshotVersion,
+            }
           : {
               ...common,
               modality: snapshot.modality,
@@ -919,6 +956,25 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
         scope: this.ticket.scope,
         artifactId: this.artifactId,
         actor: this.ticket.actor,
+        ...(this.ticket.sourceSessionAuthority
+          ? {
+              authorizeCommit: async (transaction) => {
+                this.assertOpen();
+                if (
+                  !this.authorizeSourceSession ||
+                  !(await this.withBoundedAuthorization((signal) =>
+                    this.authorizeSourceSession!(this.ticket, "edit", transaction, signal),
+                  ))
+                ) {
+                  throw new EditableArtifactLiveError(
+                    "permission_changed",
+                    "Editable artifact source session permission changed",
+                  );
+                }
+                this.assertOpen();
+              },
+            }
+          : {}),
         request: {
           intentBytes: frame.intentBytes.slice(),
           requestHash: frame.requestHash,
@@ -1029,11 +1085,22 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
   private async checkPermission(
     permission: "read" | "edit",
   ): Promise<Awaited<ReturnType<EditableArtifactAuthorizationPort["authorize"]>>> {
-    const decision = await this.dependencies.authorization.authorize({
-      scope: this.ticket.scope,
-      artifactId: this.artifactId,
-      actor: this.ticket.actor,
-      permission,
+    const decision = await this.withBoundedAuthorization(async (signal) => {
+      if (this.ticket.sourceSessionAuthority) {
+        if (
+          !this.authorizeSourceSession ||
+          !(await this.authorizeSourceSession(this.ticket, permission, undefined, signal))
+        ) {
+          return Object.freeze({ allowed: false, revision: this.authorizationRevision });
+        }
+      }
+      signal.throwIfAborted();
+      return await this.dependencies.authorization.authorize({
+        scope: this.ticket.scope,
+        artifactId: this.artifactId,
+        actor: this.ticket.actor,
+        permission,
+      });
     });
     if (permission === "edit" && !this.ticket.allowEdit) {
       return Object.freeze({ ...decision, allowed: false });
@@ -1041,6 +1108,57 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
     return decision;
   }
 
+  private async withBoundedAuthorization<T>(
+    operation: (signal: AbortSignal) => Promise<T>,
+  ): Promise<T> {
+    this.assertSourceSessionLease();
+    const timeout = new AbortController();
+    const signal = AbortSignal.any([this.abort.signal, timeout.signal]);
+    // Native artifact-only sockets retain their authorization timing. Only
+    // source-bound sockets have a renewable product-session lease.
+    if (this.sourceSessionLeaseExpiresAt !== null) {
+      const budget = this.sourceSessionLeaseExpiresAt - this.dependencies.clock.now().getTime();
+      void this.dependencies.scheduler.sleep(budget, signal).then(
+        () =>
+          timeout.abort(
+            new EditableArtifactLiveError("ticket_expired", "Live authorization lease expired", {
+              retryable: true,
+            }),
+          ),
+        () => undefined,
+      );
+    }
+    try {
+      const result = await awaitLiveAuthorization(operation(signal), signal);
+      this.assertOpen();
+      return result;
+    } finally {
+      timeout.abort();
+    }
+  }
+
+  private async runSourceSessionLease(): Promise<void> {
+    while (!this.abort.signal.aborted && this.sourceSessionLeaseExpiresAt !== null) {
+      const remaining = this.sourceSessionLeaseExpiresAt - this.dependencies.clock.now().getTime();
+      if (remaining <= 0) {
+        await this.close("ticket_expired");
+        return;
+      }
+      await this.dependencies.scheduler.sleep(remaining, this.abort.signal);
+    }
+  }
+  private assertSourceSessionLease(): void {
+    if (
+      this.sourceSessionLeaseExpiresAt !== null &&
+      this.dependencies.clock.now().getTime() >= this.sourceSessionLeaseExpiresAt
+    ) {
+      void this.close("ticket_expired");
+      throw new EditableArtifactLiveError("ticket_expired", "Source session lease expired", {
+        retryable: true,
+      });
+    }
+  }
+
   private async sendBarrier(): Promise<void> {
     if (!this.sentStateHash)
       throw new EditableArtifactLiveError("durable_gap", "Bootstrap has no state boundary");
@@ -1056,6 +1174,7 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
 
   private async send(frame: EditableArtifactLiveServerFrame): Promise<void> {
     if (this.closedValue) return;
+    this.assertSourceSessionLease();
     const bytes = estimateFrameBytes(frame);
     if (bytes > this.options.maxOutboundFrameBytes) {
       throw new EditableArtifactLiveError(
@@ -1125,9 +1244,21 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
       ),
     );
     while (!this.abort.signal.aborted) {
-      await this.dependencies.scheduler.sleep(tick, this.abort.signal);
+      const leaseRemaining =
+        this.sourceSessionLeaseExpiresAt === null
+          ? tick
+          : this.sourceSessionLeaseExpiresAt - this.dependencies.clock.now().getTime();
+      if (leaseRemaining <= 0) {
+        await this.close("ticket_expired");
+        return;
+      }
+      await this.dependencies.scheduler.sleep(Math.min(tick, leaseRemaining), this.abort.signal);
       if (this.abort.signal.aborted || this.closedValue) return;
       const now = this.dependencies.clock.now().getTime();
+      if (this.sourceSessionLeaseExpiresAt !== null && now >= this.sourceSessionLeaseExpiresAt) {
+        await this.close("ticket_expired");
+        return;
+      }
       if (this.oldestInFlightAt !== 0 && now - this.oldestInFlightAt >= this.options.ackTimeoutMs) {
         await this.enqueue(() => this.requireResync("slow_client", this.targetHead));
         return;
@@ -1171,6 +1302,29 @@ class EditableArtifactLiveSessionImpl implements EditableArtifactLiveSession {
   }
 }
 
+/** Settle callers on cancellation even when an embedding callback ignores it. */
+function awaitLiveAuthorization<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const abort = () => {
+      signal.removeEventListener("abort", abort);
+      reject(signal.reason);
+    };
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", abort);
+        if (signal.aborted) reject(signal.reason);
+        else resolve(value);
+      },
+      (error: unknown) => {
+        signal.removeEventListener("abort", abort);
+        reject(error);
+      },
+    );
+    if (signal.aborted) abort();
+    else signal.addEventListener("abort", abort, { once: true });
+  });
+}
+
 function decodeClientFrame(
   bytes: Uint8Array,
   artifactId: EditableArtifactId,
@@ -1264,7 +1418,7 @@ function validateResume(
   resume: EditableArtifactLiveResume,
   durableModality: EditableArtifactModality,
 ): void {
-  const resumeModality = resume.modality ?? "spreadsheet";
+  const resumeModality = resume.modality;
   if (resumeModality !== durableModality) {
     throw new EditableArtifactLiveError(
       "invalid_frame",
@@ -1608,7 +1762,7 @@ function boundedString(value: string, label: string, maxBytes: number): void {
 
 function normalizeOptions(options: EditableArtifactLiveServerOptions): NormalizedOptions {
   const normalized = {
-    protocolVersion: options.protocolVersion ?? EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
+    protocolVersion: EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
     maxClientFrameBytes: options.maxClientFrameBytes ?? DEFAULT_MAX_CLIENT_FRAME_BYTES,
     maxOutboundFrameBytes: options.maxOutboundFrameBytes ?? DEFAULT_MAX_OUTBOUND_FRAME_BYTES,
     maxSnapshotBytes: options.maxSnapshotBytes ?? DEFAULT_MAX_SNAPSHOT_BYTES,