@opengeni/core 0.28.1 → 1.0.2-canary.37191796234001

package/README.md

@@ -5,7 +5,7 @@
 It owns code that is not intrinsically HTTP or Temporal process bootstrapping:
 
 - access: `requireAccessContext`, `requireAccessGrant`, `requirePermission`
-- domain: session creation/follow-up, scheduled-task validation, environments, packs, capabilities, workspace members
+- domain: session creation/follow-up, scheduled-task validation, environments, capabilities, workspace members
 - billing/admission: `checkLimit`, `requireLimit`, `recordWorkspaceUsage`
 - dependencies: `AppDependencies`, `ApiRouteDeps`, `SessionWorkflowClient`
 

package/dist/access/external-actor-authority.d.ts

@@ -0,0 +1,47 @@
+import type { Permission } from "@opengeni/contracts";
+export type ExternalAuthoritySnapshot = Readonly<{
+    accountId: string;
+    externalIdentityId: string;
+    identityStatus: "active" | "disabled" | "revoked";
+    identityRevision: number;
+    membershipStatus: "active" | "provisioning" | "suspended" | "revoked";
+    workspaceId: string;
+    permissions: readonly Permission[];
+}>;
+export type ExternalLinkAuthoritySnapshot = Readonly<{
+    id: string;
+    accountId: string;
+    externalIdentityId: string;
+    revision: number;
+    nativeSubjectId: string;
+    status: "pending" | "active" | "revoked" | "expired";
+    expiresAt: number | null;
+    permissions: readonly Permission[];
+    nativeAuthority: Readonly<{
+        subjectId: string;
+        accountId: string;
+        workspaceId: string;
+        active: boolean;
+        permissions: readonly Permission[];
+    }>;
+}>;
+/** Pure permission calculation over already authenticated, live snapshots.
+ * This does not authenticate assertions or establish provenance. Callers must
+ * read snapshots under their authorization fence, never from request JSON.
+ * Linked mode uses the native lane alone: external workspace permissions must
+ * not be unioned into that lane, nor must old external resources change owner.
+ */
+export declare function externalActorPermissions(input: {
+    accountId: string;
+    workspaceId: string;
+    keyActive: boolean;
+    keyAccountId: string;
+    keyPermissions: readonly Permission[];
+    external: ExternalAuthoritySnapshot;
+    linked?: {
+        expectedId: string;
+        expectedRevision: number;
+        authority: ExternalLinkAuthoritySnapshot;
+    };
+    now: number;
+}): Permission[];

package/dist/access/index.d.ts

@@ -1,23 +1,195 @@
 import { type Settings } from "@opengeni/config";
-import { type AccountGrant, type AccessContext, type AccessGrant, type Permission } from "@opengeni/contracts";
+import { ExternalActorAttribution, type ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { type AccountGrant, type AccessContext, type AccessGrant, type OrganizationApiKeyAccess, OrganizationWorkspaceScope, Permission, type Workspace } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";
+import { z } from "zod";
 import type { ManagedAuth } from "../managed-auth-type.js";
+import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets.js";
+import type { UserPresenceRecorder } from "../user-presence.js";
+/** Only canonical authentication can prove setup-key provenance. */
+export declare function isDeveloperSetupApiKeyContext(context: AccessContext): boolean;
+/** Provenance from canonical raw-key or verified restricted-token authentication. */
+export declare function isDeveloperSetupAuthorization(authorization: AccessGrantAuthorization | undefined): boolean;
+/** Exact grant objects resolved under authenticated setup-only provenance. */
+export declare function isDeveloperSetupGrant(grant: AccessGrant): boolean;
+/** Setup-derived credentials cannot carry literal organization or key authority. */
+export declare function isDeveloperSetupDelegatedPermissionAllowed(permission: Permission): boolean;
+/** Canonical authentication provenance, including the backing key of asUser. */
+export declare function requireApiKeyManagementContext(context: AccessContext): void;
+/** Membership is not an escape hatch for minting durable credentials. */
+export declare function requireApiKeyDelegationContext(context: AccessContext, permissions: Permission[]): void;
+/** Downstream legacy credentials cannot encode a partially selected admin. */
+export declare function requireExplicitPermissionDelegation(grant: Pick<AccessGrant, "permissions" | "permissionMode">, requested: Permission[]): void;
+export type DelegatedHumanAuthorization = Readonly<{
+    organizationId: string;
+    /** Exact native person subject, never an external identity or service. */
+    subjectId: string;
+    permissions: Permission[];
+    workspaceScope: OrganizationWorkspaceScope;
+}>;
+declare const delegatedHumanProfileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodString;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type VerifiedDelegatedHumanContext = Readonly<{
+    /** Native identity projection only, never a browser/auth session. Absence of
+     * emailVerified means the native lookup did not prove email verification. */
+    user: Readonly<z.infer<typeof delegatedHumanProfileSchema>>;
+    subjectId: string;
+    authorization: DelegatedHumanAuthorization;
+    context: AccessContext;
+}>;
+/**
+ * TRUSTED OAUTH VERIFIED DISPATCH ONLY. Before each stamp the in-process caller
+ * must validate the live OAuth grant, revocation, exact native person subject,
+ * organization, permission ceilings and workspace scope. This API does not
+ * verify OAuth and must NEVER be called with headers, metadata, token claims,
+ * a previous request's proof, or other unverified caller input.
+ *
+ * Stamp the exact raw Request that the actions dispatcher will pass to routes,
+ * before any access resolution. Cloning/wrapping a Request does not copy proof.
+ * The resolver reloads the real native person's live access on this request
+ * (and on fresh reauthorization); no session or cached grant is fabricated or
+ * transplanted. This proof never becomes managed-cookie/person-present proof.
+ */
+export declare function stampDelegatedHumanAuthorization(request: Request, input: DelegatedHumanAuthorization): void;
+/** Immutable verified dispatch bounds for this exact raw Request, not a grant. */
+export declare function verifiedDelegatedHumanAuthorizationForRequest(request: Request): DelegatedHumanAuthorization | null;
+/**
+ * Resolve the exact verified OAuth-dispatch person and constrained live native
+ * access for this raw Request. Unstamped requests (even browser cookies) fail
+ * closed; callers must not fall back to a service or subject-shaped identity.
+ * Uses the same request-local native resolution as requireAccessContext.
+ *
+ * No session, session id or managed-cookie proof is created. emailVerified is
+ * forwarded only when the native profile lookup supplies it; missing is not
+ * verified and must never be filled from OAuth claims, headers or metadata.
+ */
+export declare function requireVerifiedDelegatedHumanContext(c: Context, deps: AccessDeps): Promise<VerifiedDelegatedHumanContext>;
+/** Exact resolved owning-person authorization; clones and service claims fail.
+ * Supplying the raw Request additionally binds proof to that exact dispatch,
+ * not another request with the same native person and authorization bounds. */
+export declare function isVerifiedDelegatedHumanAuthorization(authorization: AccessGrantAuthorization, request?: Request): boolean;
+/** Creation audit only, never an authentication or delegation token. Metadata
+ * claiming to be external is insufficient; the exact resolver proof is needed. */
+export declare function externalAttributionForAuthorization(authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): ExternalActorAttribution | null;
+export declare function externalActorContinuationForAuthorization(authorization: AccessGrantAuthorization): ExternalActorContinuation | null;
+/** Dedicated owning-user proof. External/OAuth admission never sets the native
+ * cookie stamp. The resource/session layer still checks the exact owner. */
+export declare function hasVerifiedOwningUserAuthorization(authorization: AccessGrantAuthorization): boolean;
+/** Request-local organization service-key proof, not a principal-kind claim. */
+export declare function isVerifiedOrganizationServiceAuthorization(authorization: AccessGrantAuthorization): boolean;
+export type AccountScopedApiKeyWorkspaceAuthority = Readonly<{
+    accountId: string;
+    permissions: Permission[];
+    workspaceScope: OrganizationWorkspaceScope;
+    permissionMode: "legacy" | "explicit";
+}>;
+export declare function organizationWorkspaceInScope(scope: OrganizationWorkspaceScope, workspaceId: string): boolean;
+/**
+ * Return account-scoped API-key workspace authority only for the exact
+ * AccessContext object stamped by successful API-key authentication. Subject
+ * shape alone is deliberately insufficient.
+ */
+export declare function accountScopedApiKeyWorkspaceAuthority(context: AccessContext): AccountScopedApiKeyWorkspaceAuthority | null;
+/** Classify stored scopes without changing the legacy full/read permission sets. */
+export declare function organizationApiKeyAccess(permissions: Permission[]): OrganizationApiKeyAccess;
+/**
+ * Opaque, request-local proof that the canonical access resolver authorized the
+ * exact account administrator named by the stamp. The random id is audit and
+ * replay provenance only; object identity is what prevents a caller from
+ * manufacturing this proof inside the API process.
+ */
+export type AccountAdminAuthorizationStamp = Readonly<{
+    authorizationId: string;
+    accountId: string;
+    actorSubjectId: string;
+    permission: "account:admin";
+}>;
 export type AccessDeps = {
     db: Database;
     settings: Settings;
     managedAuth?: ManagedAuth | null;
+    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
+    /** Analytics only: notes canonical managed-cookie activity, never authority. */
+    userPresence?: UserPresenceRecorder | null;
 };
+/** null means this is not an authenticated external lane; [] means that lane
+ * has no readable inventory. Callers must not fall back from [] to service or
+ * bare-subject discovery. */
+export declare function listExternalActorWorkspaces(context: AccessContext, deps: AccessDeps): Promise<Workspace[] | null>;
 export declare function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext>;
 export declare function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant>;
+/**
+ * Re-resolve the authenticated principal and its current grants without using
+ * the request-local access cache. Long-lived responses use this to ensure a
+ * membership suspension or revocation takes effect while the connection is
+ * still open.
+ */
+export declare function requireFreshAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant>;
 export type AccessGrantAuthorization = {
     grant: AccessGrant;
     accountGrant: AccountGrant | null;
     authenticatedSubjectId: string;
     contextIntegrity: boolean;
+    /**
+     * Did this request authenticate as the canonical managed-cookie (Better Auth)
+     * session that OWNS this grant's subject? Cookie/person-present ceremonies
+     * retain this strict gate; owning-user boundaries use
+     * `hasVerifiedOwningUserAuthorization` instead.
+     * False for every bearer, API-key, delegated, service, local, and configured
+     * principal, and for any future path that does not verify a cookie.
+     */
+    canonicalManagedHumanSession: boolean;
+    /** Exact in-process single-user local bootstrap, never a delegated bearer. */
+    canonicalLocalHumanSession: boolean;
 };
 export declare function accessGrantAuthorizationFromContext(context: AccessContext, grant: AccessGrant): AccessGrantAuthorization;
+/**
+ * Mint the capability passed to an account-admin database lifecycle.
+ *
+ * This deliberately accepts every canonical access mode (managed,
+ * local/configured, and signed delegation). Organization-membership rows are
+ * one possible source of account authority, not the definition of it. A plain
+ * object with matching fields is rejected because only values returned by the
+ * access resolver are present in `resolvedAccessGrantAuthorizations`.
+ */
+export declare function requireAccountAdminAuthorizationStamp(authorization: AccessGrantAuthorization): AccountAdminAuthorizationStamp;
+/**
+ * Verify that an access authorization was minted by the canonical request
+ * resolver for this exact subject and workspace.
+ *
+ * This is the protocol-neutral boundary for request-local services that need
+ * the authenticated grant rather than a caller-supplied grant-shaped object.
+ * Object identity is intentional: matching fields alone are not proof that the
+ * request authenticated the named subject.
+ */
+export declare function requireResolvedAccessGrantAuthorization(authorization: AccessGrantAuthorization, workspaceId: string): AccessGrant;
+/**
+ * Resolve the exact built-in single-user local administrator for an account.
+ *
+ * This is intentionally narrower than checking `context.mode === "local"` or
+ * the `dev` subject name. Only the in-process local bootstrap branch can place
+ * the resolved context in `canonicalLocalHumanContexts`, so delegated bearer
+ * tokens and caller-constructed contexts cannot borrow this authority.
+ */
+export declare function requireCanonicalLocalAccountAdministrator(c: Context, deps: AccessDeps, accountId: string): Promise<{
+    subjectId: string;
+    authorization: AccessGrantAuthorization;
+}>;
 export declare function requireAccessGrantAuthorization(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrantAuthorization>;
+/**
+ * Settings administration is narrower than workspace administration. The
+ * verified owning user may configure their Personal workspace, but
+ * never acquires the admin wildcard (and its membership/delegation powers).
+ * Delegated owners also need workspace:admin in their verified dispatch/key
+ * ceiling: a read-only delegation cannot turn ownership into a settings write.
+ * Only use this boundary for workspace configuration, not access management.
+ */
+export declare function requireWorkspaceSettingsGrant(c: Context, deps: AccessDeps, workspaceId: string): Promise<AccessGrant>;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 /**
  * Require a permission to be present literally on the grant. This deliberately
@@ -26,5 +198,6 @@ export declare function requirePermission(grant: AccessGrant, permission: Permis
  * acquire implicitly.
  */
 export declare function requireLiteralPermission(grant: AccessGrant, permission: Permission): void;
-export declare function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean;
-export declare function hasPermission(permissions: Permission[], permission: Permission): boolean;
+export declare function hasLiteralPermission(permissions: readonly Permission[], permission: Permission): boolean;
+export declare function hasPermission(permissions: readonly Permission[], permission: Permission, permissionMode?: AccessGrant["permissionMode"]): boolean;
+export {};

package/dist/access/service-initiator.d.ts

@@ -0,0 +1,3 @@
+import { type AccessGrant } from "@opengeni/contracts";
+/** Validated provenance only. The API key remains the authenticated principal. */
+export declare function serviceInitiatorFromHeaders(headers: Headers): Pick<AccessGrant, "serviceInitiator" | "serviceInitiatorContext"> | null;

package/dist/application/api-integration-servers.d.ts

@@ -0,0 +1,20 @@
+import { type IntegrationInvocationAuthority } from "@opengeni/capabilities";
+import type { Settings } from "@opengeni/config";
+import type { ToolAuthNeededPayload } from "@opengeni/contracts";
+import type { ApiIntegrationRuntime, ResolveConnectionCredentialInput, ResolveConnectionCredentialResult } from "@opengeni/db";
+import type { FetchLike } from "@opengeni/network";
+import type { LocalMcpServerRegistration } from "@opengeni/runtime";
+export type BuildApiIntegrationServersInput = {
+    settings: Settings;
+    integrations: readonly ApiIntegrationRuntime[];
+    authority: Omit<IntegrationInvocationAuthority, "connectionRef">;
+    resolveCredential: (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+    onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
+    fetchImpl?: FetchLike;
+};
+/**
+ * Compile active persisted API facets into ordinary in-process MCP providers.
+ * The caller supplies its authority resolver, so agent attempts and current
+ * humans use the same provider assembly without sharing credentials or policy.
+ */
+export declare function buildApiIntegrationMcpServers(input: BuildApiIntegrationServersInput): LocalMcpServerRegistration[];

package/dist/application/archived-session-imports.d.ts

@@ -0,0 +1,6 @@
+import { AppendArchivedSessionEventsResponse, ImportArchivedSessionResponse } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+import type { ApiRouteDeps } from "../dependencies.js";
+export { ArchivedSessionImportError } from "@opengeni/db";
+export declare function importArchivedSessionForRequest(deps: ApiRouteDeps, authorization: AccessGrantAuthorization, workspaceId: string, rawPayload: unknown): Promise<ImportArchivedSessionResponse>;
+export declare function appendArchivedSessionEventsForRequest(deps: ApiRouteDeps, authorization: AccessGrantAuthorization, workspaceId: string, importId: string, rawPayload: unknown): Promise<AppendArchivedSessionEventsResponse>;

package/dist/application/composer-submit.d.ts

@@ -0,0 +1,24 @@
+import type { AccessGrant, ResourceRef, SubmitComposerDraftRequest, SubmitComposerDraftResponse } from "@opengeni/contracts";
+import type { AccessGrantAuthorization } from "../access/index.js";
+import type { AcceptSessionUserMessageDependencies } from "../dependencies.js";
+export type SubmitComposerDraftForRequestOptions = {
+    authorization?: AccessGrantAuthorization | undefined;
+    /**
+     * Trusted host-owned resources admitted with this command without writing
+     * them into the actor's browser-visible draft first. The saved draft remains
+     * the exact content fence for actor-owned text, annotations, resources, and
+     * execution policy; these resources participate in the accepted command's
+     * idempotency hash, validation, turn, and durable session resource set.
+     */
+    additionalResources?: ResourceRef[] | undefined;
+};
+/**
+ * Atomically accept one established-session composer draft.
+ *
+ * This is the application boundary shared by the stock HTTP adapter and an
+ * in-process embedding host. A host may prepare its own durable business state
+ * before calling this function and project the returned receipt afterward, but
+ * OpenGeni remains the sole authority for draft validation/rotation, event
+ * append, turn creation, routing, and idempotent replay.
+ */
+export declare function submitComposerDraftForRequest(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: SubmitComposerDraftRequest, options?: SubmitComposerDraftForRequestOptions): Promise<SubmitComposerDraftResponse>;

package/dist/application/connect-authority.d.ts

@@ -0,0 +1,13 @@
+import type { Permission } from "@opengeni/contracts";
+import type { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { type Database } from "@opengeni/db";
+/** Accept only a verified request owner or authenticated server-minted OAuth
+ * state. The callback does not need a browser cookie: it rechecks the stored
+ * principal against current authority before claiming and committing effects. */
+export declare function requireConnectOwnerAuthority(db: Database, state: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    personalOwnerVerified?: boolean;
+    externalContinuation?: ExternalActorContinuation;
+}, permission?: Permission, origin?: ExternalActorContinuation | null): Promise<void>;

package/dist/application/connect-operation.d.ts

@@ -0,0 +1,31 @@
+import type { ConnectAttempt } from "@opengeni/contracts/connect";
+import { type ConnectActorScope, type ConnectOperationAuthorization, type Database } from "@opengeni/db";
+/** Provider result is deliberately not serializable: secrets can remain in its
+ * closure until encrypted credential persistence. Do not retain/log this value. */
+export type PreparedConnectOperation = {
+    commit: (tx: Database, current: ConnectAttempt) => Promise<ConnectAttempt>;
+};
+/** Internal provider-adapter boundary, not an HTTP authentication adapter.
+ *
+ * authorize is mandatory, including for a receipt replay. It must validate the
+ * exact saved key/actor/link authority and current permission under database
+ * locks. execute owns provider-specific proof, destination and cancellation.
+ * No remote effects may occur inside authorize or commit.
+ *
+ * A failed execute/authorization/commit keeps the durable claim occupied. It
+ * does not release or retry work whose provider outcome may be unknown.
+ */
+export declare function executeConnectOperation(input: {
+    db: Database;
+    scope: ConnectActorScope;
+    attemptId: string;
+    expectedRevision: number;
+    operationId: string;
+    /** Caller computes a stable keyed digest if input contains low-entropy secrets. */
+    inputDigest: string;
+    /** Trusted server adapter classification, never derived from request data.
+     * Cancellation releases pending setup; it acquires no integration authority. */
+    purpose?: "acquisition" | "cancellation";
+    authorize: ConnectOperationAuthorization;
+    execute: (attempt: ConnectAttempt) => Promise<PreparedConnectOperation>;
+}): Promise<ConnectAttempt>;

package/dist/application/external-continuation.d.ts

@@ -0,0 +1,15 @@
+import type { Permission } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Capture verified request authority before asynchronous preflight. Invoke
+ * inside the canonical mutation transaction after its lifecycle locks, so a
+ * revoked key/generation rolls the write back without changing lock order. */
+export declare function externalContinuationCommitAuthorizer(authorization: AccessGrantAuthorization | undefined): ((tx: Database) => Promise<void>) | undefined;
+/** Caller verifies/decrypts its server-minted continuation before invoking.
+ * An open transaction retains lifecycle/key/identity locks through persistence.
+ * Historical creator audit alone must never enter this path as a credential. */
+export declare function requireExternalContinuationAuthority(tx: Database, raw: unknown, scope: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, permission: Permission | readonly Permission[]): Promise<void>;

package/dist/application/external-identity-lifecycle.d.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import { type AccessDeps } from "../access/index.js";
+/** Host service administration is separate from asUser and native-cookie
+ * administration. The database rechecks the live key and exact external target
+ * under the canonical organization lifecycle fences, including receipt replay. */
+export declare function updateExternalIdentityMembershipForRequest(context: Context, deps: AccessDeps, organizationId: string, membershipId: string, input: unknown): Promise<{
+    id: string;
+    organizationId: string;
+    subjectId: string;
+    name: string | null;
+    email: string | null;
+    role: "admin" | "member" | "owner";
+    status: "active" | "provisioning" | "revoked" | "suspended";
+    authorizationRevision: number;
+    personalWorkspaceId: string | null;
+    revokedAt: string | null;
+    personalRetentionUntil: string | null;
+    createdAt: string;
+    updatedAt: string;
+}>;

package/dist/application/external-link-work-admission.d.ts

@@ -0,0 +1,12 @@
+import type { ScheduledTask } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+import { type AccessGrantAuthorization } from "../access/index.js";
+/** Closure is created only from the access resolver's object-identity proof.
+ * JSON metadata and an ordinary named native subject can never enter it. */
+export declare function prepareExternalLinkTurnAdmission(authorization: AccessGrantAuthorization | undefined): ((tx: Database, sessionId: string, turnId: string) => Promise<void>) | undefined;
+export declare function prepareExternalLinkTaskAdmission(authorization: AccessGrantAuthorization | undefined, actor?: {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+} | null): ((tx: Database, task: ScheduledTask) => Promise<void>) | undefined;

package/dist/application/external-workspace-members.d.ts

@@ -0,0 +1,32 @@
+import type { Context } from "hono";
+import { type ExternalIdentity } from "@opengeni/contracts/external-identities";
+import { type AccessDeps } from "../access/index.js";
+/** Explicit host onboarding. Ordinary asUser reads never call this operation.
+ * Existing memberships are not overwritten, including reduced permissions. */
+export declare function addExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, workspaceId: string, input: unknown): Promise<ExternalIdentity>;
+export declare function lookupExternalIdentityForRequest(c: Context, deps: AccessDeps, organizationId: string, input: unknown): Promise<{
+    found: false;
+} | {
+    found: true;
+    subjectId: string;
+    organizationMembershipId: string;
+    identityStatus: "active" | "disabled" | "revoked";
+    identityAuthorizationRevision: number;
+    membershipStatus: "active" | "provisioning" | "revoked" | "suspended";
+    membershipAuthorizationRevision: number;
+}>;
+export declare function cancelExternalWorkspaceMemberGrantForRequest(c: Context, deps: AccessDeps, organizationId: string, workspaceId: string, membershipId: string, input: unknown): Promise<{
+    removed: boolean;
+    replay: boolean;
+    fencedGrantOperationId: string;
+}>;
+/** Keyed permission change for an existing external member. Widening only
+ * rewrites the set; narrowing also advances the member's authorization
+ * revision so live authority re-checks. Never cancels or tears down work. */
+export declare function updateExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, organizationId: string, workspaceId: string, membershipId: string, input: unknown): Promise<{
+    subjectId: string;
+    organizationMembershipId: string;
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    narrowed: boolean;
+    replay: boolean;
+}>;