@opengeni/core 0.28.1 → 1.0.0

package/src/editable-artifact-live/ticket.ts

@@ -1,3 +1,7 @@
+import { AccessGrant } from "@opengeni/contracts";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { z } from "zod";
+import { deflateRawSync, inflateRawSync } from "node:zlib";
 import type { EditableArtifactAuthorizationPort } from "../domain/editable-artifacts/ports";
 import {
   assertIsoTimestamp,
@@ -19,11 +23,22 @@ import {
   EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
   type EditableArtifactLiveTicket,
   type EditableArtifactLiveTicketRecord,
+  type EditableArtifactLiveSourceSessionAuthority,
 } from "./types";
 
 const DEFAULT_TTL_MS = 30_000;
 const MAX_TTL_MS = 60_000;
 const MAX_TOKEN_BYTES = 4_096;
+const SOURCE_AUTHORITY_MARKER = ".ogs1.";
+const COMPRESSED_SOURCE_AUTHORITY_MARKER = ".ogs2.";
+const MAX_SOURCE_AUTHORITY_BYTES = 16 * 1024;
+const SourceSessionAuthority = z
+  .object({
+    sessionId: z.string().uuid(),
+    grant: AccessGrant,
+    externalContinuation: ExternalActorContinuation.optional(),
+  })
+  .strict();
 
 export type EditableArtifactLiveTicketAuthorityDependencies = Readonly<{
   authorization: EditableArtifactAuthorizationPort;
@@ -31,7 +46,6 @@ export type EditableArtifactLiveTicketAuthorityDependencies = Readonly<{
   tokens: EditableArtifactLiveTokenPort;
   clock: EditableArtifactLiveClockPort;
   ttlMs?: number;
-  protocolVersion?: number;
 }>;
 
 export class EditableArtifactLiveTicketAuthority {
@@ -43,10 +57,7 @@ export class EditableArtifactLiveTicketAuthority {
     if (!Number.isSafeInteger(this.ttlMs) || this.ttlMs < 1_000 || this.ttlMs > MAX_TTL_MS) {
       throw new TypeError(`ticket ttl must be 1000-${MAX_TTL_MS} milliseconds`);
     }
-    this.protocolVersion = dependencies.protocolVersion ?? EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
-    if (!Number.isSafeInteger(this.protocolVersion) || this.protocolVersion < 1) {
-      throw new TypeError("protocol version must be a positive safe integer");
-    }
+    this.protocolVersion = EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION;
   }
 
   async mint(
@@ -56,6 +67,7 @@ export class EditableArtifactLiveTicketAuthority {
       modality: EditableArtifactModality;
       actor: EditableArtifactActor;
       allowEdit: boolean;
+      sourceSessionAuthority?: EditableArtifactLiveSourceSessionAuthority;
     }>,
   ): Promise<EditableArtifactLiveTicket> {
     const scope = editableArtifactScope(input.scope);
@@ -78,7 +90,28 @@ export class EditableArtifactLiveTicketAuthority {
         "Editable artifact read permission denied",
       );
     }
-    const token = this.dependencies.tokens.randomOpaqueToken();
+    const sourceSessionAuthority = input.sourceSessionAuthority
+      ? SourceSessionAuthority.parse(input.sourceSessionAuthority)
+      : undefined;
+    if (sourceSessionAuthority) {
+      assertSourceSessionAuthority(sourceSessionAuthority, scope, actor);
+    }
+    const sourceBytes = sourceSessionAuthority
+      ? Buffer.from(JSON.stringify(sourceSessionAuthority))
+      : null;
+    if (sourceBytes && sourceBytes.byteLength > MAX_SOURCE_AUTHORITY_BYTES) {
+      throw new EditableArtifactLiveError(
+        "invalid_ticket",
+        "Live ticket source authority is too large",
+      );
+    }
+    const nonce = this.dependencies.tokens.randomOpaqueToken();
+    // The execute-only PG store persists the digest of this COMPLETE token.
+    // Changing/removing the suffix cannot consume its record. Decode only after
+    // atomic consume authenticates it, keeping the existing fixed SQL DTO intact.
+    const token = sourceBytes
+      ? `${nonce}${COMPRESSED_SOURCE_AUTHORITY_MARKER}${deflateRawSync(sourceBytes).toString("base64url")}`
+      : nonce;
     assertToken(token);
     const tokenDigest = await this.dependencies.tokens.digestOpaqueToken(token);
     assertDigest(tokenDigest);
@@ -128,6 +161,10 @@ export class EditableArtifactLiveTicketAuthority {
       );
     }
     validateTicketRecord(record);
+    const sourceSessionAuthority = decodeSourceSessionAuthority(input.token);
+    if (sourceSessionAuthority) {
+      assertSourceSessionAuthority(sourceSessionAuthority, record.scope, record.actor);
+    }
     if (Date.parse(record.expiresAt) <= this.dependencies.clock.now().getTime()) {
       throw new EditableArtifactLiveError("ticket_expired", "Live ticket has expired", {
         retryable: true,
@@ -149,6 +186,7 @@ export class EditableArtifactLiveTicketAuthority {
       ...record,
       scope: editableArtifactScope(record.scope),
       actor: Object.freeze({ ...record.actor }) as EditableArtifactActor,
+      ...(sourceSessionAuthority ? { sourceSessionAuthority } : {}),
     });
   }
 }
@@ -198,6 +236,49 @@ function validateTicketRecord(record: EditableArtifactLiveTicketRecord): void {
   assertIsoTimestamp(record.expiresAt, "ticket expiresAt");
 }
 
+function decodeSourceSessionAuthority(
+  token: string,
+): EditableArtifactLiveSourceSessionAuthority | undefined {
+  const compressed = token.includes(COMPRESSED_SOURCE_AUTHORITY_MARKER);
+  const marker = compressed ? COMPRESSED_SOURCE_AUTHORITY_MARKER : SOURCE_AUTHORITY_MARKER;
+  const separator = token.lastIndexOf(marker);
+  if (separator === -1) return undefined;
+  try {
+    return SourceSessionAuthority.parse(
+      JSON.parse(
+        (compressed
+          ? inflateRawSync(Buffer.from(token.slice(separator + marker.length), "base64url"), {
+              maxOutputLength: MAX_SOURCE_AUTHORITY_BYTES,
+            })
+          : Buffer.from(token.slice(separator + marker.length), "base64url")
+        ).toString("utf8"),
+      ),
+    );
+  } catch {
+    throw new EditableArtifactLiveError(
+      "invalid_ticket",
+      "Live ticket source authority is invalid",
+    );
+  }
+}
+
+function assertSourceSessionAuthority(
+  authority: EditableArtifactLiveSourceSessionAuthority,
+  scope: EditableArtifactScope,
+  actor: EditableArtifactActor,
+): void {
+  if (
+    authority.grant.accountId !== scope.accountId ||
+    authority.grant.workspaceId !== scope.workspaceId ||
+    authority.grant.subjectId !== actor.subjectId
+  ) {
+    throw new EditableArtifactLiveError(
+      "invalid_ticket",
+      "Live ticket source scope does not match",
+    );
+  }
+}
+
 function assertModality(value: EditableArtifactModality): EditableArtifactModality {
   if (value !== "document" && value !== "spreadsheet" && value !== "presentation") {
     throw new TypeError("ticket modality is invalid");

package/src/editable-artifact-live/types.ts

@@ -1,3 +1,6 @@
+import { EDITABLE_ARTIFACT_LIVE_WIRE_VERSION } from "@opengeni/contracts/editable-artifact-live";
+import type { AccessGrant } from "@opengeni/contracts";
+import type { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type {
   EditableArtifactActor,
   EditableArtifactCausalFrontier,
@@ -11,7 +14,14 @@ import type {
   EditableArtifactTransactionId,
 } from "../domain/editable-artifacts/types";
 
-export const EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION = 1;
+export const EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION = EDITABLE_ARTIFACT_LIVE_WIRE_VERSION;
+
+/** Authenticated by the digest of the complete one-use token, never client claims. */
+export type EditableArtifactLiveSourceSessionAuthority = Readonly<{
+  sessionId: string;
+  grant: AccessGrant;
+  externalContinuation?: ExternalActorContinuation | undefined;
+}>;
 
 export type EditableArtifactLiveTicket = Readonly<{
   artifactId: EditableArtifactId;
@@ -29,6 +39,7 @@ export type EditableArtifactLiveTicketRecord = Readonly<{
   artifactId: EditableArtifactId;
   modality: EditableArtifactModality;
   actor: EditableArtifactActor;
+  sourceSessionAuthority?: EditableArtifactLiveSourceSessionAuthority;
   /** Delegated ceiling captured by the authenticated ticket-minting request. */
   allowEdit: boolean;
   protocolVersion: number;
@@ -52,6 +63,7 @@ export type EditableArtifactLiveSnapshot =
         modality: "spreadsheet";
         causalFrontier: EditableArtifactCausalFrontier;
         operationProtocolVersion: number;
+        snapshotVersion: number;
       }>)
   | (EditableArtifactLiveSnapshotCommon &
       Readonly<{
@@ -120,7 +132,7 @@ type EditableArtifactLiveResumeCommon = Readonly<{
 export type EditableArtifactLiveResume =
   | (EditableArtifactLiveResumeCommon &
       Readonly<{
-        modality?: "spreadsheet";
+        modality: "spreadsheet";
         localCausalFrontier: EditableArtifactCausalFrontier;
       }>)
   | (EditableArtifactLiveResumeCommon &
@@ -166,6 +178,8 @@ export type EditableArtifactLiveServerFrame =
         | Readonly<{
             modality: "spreadsheet";
             causalFrontier: EditableArtifactCausalFrontier;
+            operationProtocolVersion: number;
+            snapshotVersion: number;
           }>
         | Readonly<{
             modality: "document" | "presentation";

package/src/editable-artifact-live/wire.ts

@@ -81,15 +81,5 @@ export function encodeEditableArtifactLiveMutationWireFrame(
 export function encodeEditableArtifactLiveServerWireFrame(
   frame: EditableArtifactLiveServerFrame,
 ): Uint8Array {
-  if (frame.type === "transaction" && frame.transaction.modality === "spreadsheet") {
-    const { operationProtocolVersion, modality: _modality, ...transaction } = frame.transaction;
-    return encodeContractServerFrame({
-      ...frame,
-      transaction: {
-        ...transaction,
-        protocolVersion: operationProtocolVersion,
-      },
-    } as unknown as ContractServerFrame);
-  }
   return encodeContractServerFrame(frame as unknown as ContractServerFrame);
 }

package/src/index.ts

@@ -1,3 +1,12 @@
+export { readSessionAttachmentFiles } from "./domain/session-file-access";
+export { verifyDirectModelAccess } from "./domain/direct-model-provider";
+export * from "./domain/skills";
+export * from "./domain/mcp-account-bindings";
+export * from "./domain/mcp-account-routes";
+export * from "./domain/session-connection-accounts";
+export * from "./domain/organization-integration-catalog";
+export * from "./domain/knowledge";
+export * from "./domain/knowledge-search";
 // @opengeni/core — the framework-agnostic OpenGeni core.
 //
 // WHAT THIS PACKAGE IS: the OpenGeni domain, access, and billing layers carved
@@ -28,6 +37,8 @@
 // SessionWorkflowClient, DocumentIndexClient, ObjectStorageDependency).
 export * from "./dependencies";
 export * from "./workflow-wake-contract";
+export * from "./user-presence";
+export * from "./product-usage-metrics";
 
 // Boundary type slots referenced by dependencies.ts. The IMPLEMENTATIONS that
 // construct these (the real sandbox client / Better Auth instance) stay in
@@ -35,52 +46,106 @@ export * from "./workflow-wake-contract";
 // structural TYPES live here.
 export * from "./sandbox-types";
 export * from "./managed-auth-type";
-export * from "./managed-session";
+export {
+  getManagedAuthRequestActorAbortSignal,
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorEpoch,
+  getManagedAuthRequestActorLeaseStamp,
+  getManagedSession,
+  configureManagedUserAdmission,
+  assertManagedUserAdmission,
+  ManagedAuthActorLeaseOutcomeUnknownError,
+  markManagedAuthRequestActorTransitionApplied,
+  releaseManagedAuthRequestActorLease,
+  validateManagedAuthRequestActorLease,
+  type ManagedAuthActorAdmissionStamp,
+  type ManagedAuthActorMutationLeaseStamp,
+} from "./managed-session";
 export * from "./transcription";
+export * from "./model-catalog";
+export * from "./codex-model-availability";
+export * from "./default-session-model";
 
 // Sandbox fleet/routing service — the closure of `domain/sessions.ts`
 // (`swapActiveSandbox` + `FleetContext`). apps/api re-imports these for its MCP
 // fleet tools, the machines REST route, and the rest of the sandbox layer.
 export * from "./sandbox/fleet";
 export * from "./sandbox/routing";
+export * from "./sandbox/runtime-settings";
 
 // Access layer (transport-neutral grant resolution + permission checks).
 export * from "./access";
+export * from "./application/external-workspace-members";
+export * from "./application/external-identity-lifecycle";
+export * from "./application/external-continuation";
+export * from "./application/session-mcp-credential-rotation";
+export * from "./application/external-link-work-admission";
+export * from "./application/connect-authority";
+export * from "./application/connect-operation";
 export * from "./session-authorization";
 
 // Billing / usage-limit admission (checkLimit / requireLimit / recordWorkspaceUsage).
 export * from "./billing/limits";
 
 // Domain layer — the off-HTTP V2 surface (createSessionForRequest,
-// postUserMessageTurn, createAndStartSession, capability/pack/environment/
+
 // scheduled-task/workspace-member logic, …).
 export * from "./domain/capabilities";
+export * from "./domain/native-mcp-connection-admission";
 export * from "./domain/skill-imports";
+export * from "./domain/skill-search";
+export * from "./domain/github-skill-source";
 export * from "./domain/environments";
 export * from "./rigs";
-export * from "./domain/packs";
+export * from "./domain/automations";
+export * from "./domain/pr-review";
+
 export * from "./domain/personal-connection-delegations";
 export * from "./domain/resources";
+export * from "./domain/github-repository-bindings";
+export * from "./domain/github-action-policies";
 export * from "./domain/session-tool-policy";
+export * from "./domain/agent-config-resolution";
 export * from "./domain/scheduled-tasks";
+export * from "./domain/scheduled-task-access";
 export * from "./domain/sessions";
 export * from "./domain/insights";
+export * from "./domain/insights-usage";
 export * from "./domain/memory-slack-publication";
 export * from "./domain/memory-slack-delivery";
-export * from "./domain/durable-learning-slack-publication";
+export * from "./domain/governed-learning-slack-publication";
 export * from "./domain/slack-publication-secret-safety";
 export * from "./domain/company-profile-durable-learning-adapter";
+export * from "./domain/company-profile-agent-admin";
 export * from "./domain/slack-bot";
 export * from "./domain/conversation-integrations";
 export * from "./domain/fiken";
 export * from "./domain/workspace-members";
 export * from "./domain/video-generation";
 export * from "./domain/video-generation-capabilities";
+export * from "./domain/organization-membership-lifecycle";
 export * from "./application/new-session-drafts";
+export * from "./application/composer-submit";
 export * from "./application/session-commands";
+export * from "./application/archived-session-imports";
+export * from "./application/session-tenancy";
+export * from "./application/sandbox-recovery";
+export * from "./application/user-resource-grants";
+export * from "./application/api-integration-servers";
 
 // Durable editable-artifact live broker, ticket, ports, and projection types.
 export * from "./editable-artifact-live";
 
 // Transport-neutral editable-artifact domain service, ports, and contracts.
 export * from "./editable-artifacts";
+export { withSiteSessionOrigin } from "./site-session-origin";
+export { resolveTurnSurface } from "./turn-surface";
+
+export { fileOwnerContextForAccess, fileOwnerContextForAgent } from "./domain/file-owner";
+
+export { prepareKnowledgeFile } from "./domain/knowledge-files";
+export { prepareKnowledgeSave } from "./domain/knowledge-preparation";
+
+export { retainKnowledgeMessage } from "./domain/knowledge-messages";
+
+export * from "./domain/connector-tool-permissions";