@opengeni/core 0.4.6 → 0.4.8

package/src/domain/environments.ts

@@ -1,10 +1,6 @@
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
-import type { AccessGrant, WorkspaceEnvironment } from "@opengeni/contracts";
-import {
-  getWorkspaceEnvironment,
-  recordAuditEvent,
-  type Database,
-} from "@opengeni/db";
+import type { AccessGrant, VariableSet } from "@opengeni/contracts";
+import { getVariableSet, recordAuditEvent, type Database } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 import { requirePermission } from "../access";
 
@@ -13,8 +9,8 @@ export const MAX_VARIABLES_PER_ENVIRONMENT = 100;
 
 // Names the platform itself injects into sandboxes (sandboxEnvironmentForRun,
 // collectGitIdentityEnvironment) plus loader/startup-injection vectors. These
-// can never be set as workspace environment variables, so the run-scoped
-// GitHub auth block and git identity always win without silent collisions.
+// can never be set as variable set variables, so the run-scoped
+// git auth block and git identity always win without silent collisions.
 const reservedExactNames = new Set([
   "HOME",
   "PATH",
@@ -32,6 +28,8 @@ const reservedExactNames = new Set([
   "PERL5LIB",
   "GH_TOKEN",
   "GITHUB_TOKEN",
+  "GITLAB_TOKEN",
+  "AZURE_DEVOPS_EXT_PAT",
   "GIT_ASKPASS",
   "GIT_TERMINAL_PROMPT",
 ]);
@@ -45,70 +43,92 @@ const reservedPrefixes = [
   "DYLD_",
 ];
 
-export function assertAllowedEnvironmentVariableName(name: string): void {
+export function assertAllowedVariableSetVariableName(name: string): void {
   if (reservedExactNames.has(name) || reservedPrefixes.some((prefix) => name.startsWith(prefix))) {
-    throw new HTTPException(422, { message: `reserved environment variable name: ${name}` });
+    throw new HTTPException(422, {
+      message: `reserved variable set variable name / reserved environment variable name: ${name}`,
+    });
   }
 }
 
-export function requireEnvironmentEncryption(settings: Settings): Uint8Array {
+/** @deprecated use assertAllowedVariableSetVariableName */
+export const assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;
+
+export function requireVariableSetEncryption(settings: Settings): Uint8Array {
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
-    throw new HTTPException(503, { message: "workspace environments require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY" });
+    throw new HTTPException(503, {
+      message: "variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY",
+    });
   }
   return key;
 }
 
-export async function requireEnvironmentForApi(db: Database, workspaceId: string, environmentId: string): Promise<WorkspaceEnvironment> {
-  const environment = await getWorkspaceEnvironment(db, workspaceId, environmentId);
-  if (!environment) {
-    throw new HTTPException(404, { message: "environment not found" });
+/** @deprecated use requireVariableSetEncryption */
+export const requireEnvironmentEncryption = requireVariableSetEncryption;
+
+export async function requireVariableSetForApi(
+  db: Database,
+  workspaceId: string,
+  variableSetId: string,
+): Promise<VariableSet> {
+  const variableSet = await getVariableSet(db, workspaceId, variableSetId);
+  if (!variableSet) {
+    throw new HTTPException(404, { message: "variableSet not found" });
   }
-  return environment;
+  return variableSet;
 }
 
 /**
- * Validates an environment attachment supplied in a request payload (session
+ * Validates an variableSet attachment supplied in a request payload (session
  * create, scheduled task create/update, pack enable). Requires the
- * `environments:use` permission unless the attachment was already authorized
+ * `variable-sets:use` permission unless the attachment was already authorized
  * (pack-installation-inherited attachments), and maps a missing or
- * cross-workspace environment to 422 because the id is payload, not the route
+ * cross-variable set to 422 because the id is payload, not the route
  * target. RLS plus the workspace_id clause make cross-workspace ids
  * indistinguishable from missing ones.
  */
-export async function validateEnvironmentAttachment(
+export async function validateVariableSetAttachment(
   deps: { settings: Settings; db: Database },
   grant: AccessGrant,
   workspaceId: string,
-  environmentId: string,
+  variableSetId: string,
   options: { preauthorized?: boolean } = {},
-): Promise<WorkspaceEnvironment> {
-  requireEnvironmentEncryption(deps.settings);
+): Promise<VariableSet> {
+  requireVariableSetEncryption(deps.settings);
   if (!options.preauthorized) {
-    requirePermission(grant, "environments:use");
+    requirePermission(grant, "variable-sets:use");
   }
-  const environment = await getWorkspaceEnvironment(deps.db, workspaceId, environmentId);
-  if (!environment) {
-    throw new HTTPException(422, { message: "unknown environmentId" });
+  const variableSet = await getVariableSet(deps.db, workspaceId, variableSetId);
+  if (!variableSet) {
+    throw new HTTPException(422, { message: "unknown variableSetId" });
   }
-  return environment;
+  return variableSet;
 }
 
-export async function recordEnvironmentAuditEvent(db: Database, input: {
-  grant: AccessGrant;
-  action: "environment.created" | "environment.updated" | "environment.deleted" | "environment.variable.set" | "environment.variable.deleted";
-  environmentId: string;
-  variableName?: string;
-}): Promise<void> {
+export async function recordVariableSetAuditEvent(
+  db: Database,
+  input: {
+    grant: AccessGrant;
+    action:
+      | "variable_set.created"
+      | "variable_set.updated"
+      | "variable_set.deleted"
+      | "variable_set.variable.set"
+      | "variable_set.variable.deleted";
+    variableSetId: string;
+    variableName?: string;
+  },
+): Promise<void> {
   await recordAuditEvent(db, {
     accountId: input.grant.accountId,
     workspaceId: input.grant.workspaceId,
     subjectId: input.grant.subjectId,
     action: input.action,
-    targetType: "workspace_environment",
-    targetId: input.environmentId,
+    targetType: "workspace_variable_set",
+    targetId: input.variableSetId,
     metadata: {
-      environmentId: input.environmentId,
+      variableSetId: input.variableSetId,
       ...(input.variableName ? { name: input.variableName } : {}),
     },
   });

package/src/domain/packs.ts

@@ -3,7 +3,12 @@ import {
   type ScheduledTaskAgentConfig,
   type SocialConnection,
 } from "@opengeni/contracts";
-import { getWorkspacePack, listPackInstallations, listWorkspacePacks, type Database } from "@opengeni/db";
+import {
+  getWorkspacePack,
+  listPackInstallations,
+  listWorkspacePacks,
+  type Database,
+} from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
 export const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
@@ -11,7 +16,8 @@ export const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
 const marketingSocialPack: CapabilityPack = {
   id: MARKETING_SOCIAL_PACK_ID,
   name: "Marketing social daily analysis",
-  description: "Connect social accounts, attach marketing knowledge, and schedule agents to produce daily media performance analysis.",
+  description:
+    "Connect social accounts, attach marketing knowledge, and schedule agents to produce daily media performance analysis.",
   role: "marketing",
   category: "social-media",
   version: "0.1.0",
@@ -54,7 +60,12 @@ const marketingSocialPack: CapabilityPack = {
       category: "social-media",
       authModel: "oauth2_authorization_code",
       providers: ["instagram", "facebook"],
-      scopes: ["instagram_basic", "instagram_manage_insights", "pages_read_engagement", "pages_show_list"],
+      scopes: [
+        "instagram_basic",
+        "instagram_manage_insights",
+        "pages_read_engagement",
+        "pages_show_list",
+      ],
       required: false,
       metadata: {
         docs: "https://developers.facebook.com/docs/instagram-platform/instagram-graph-api/",
@@ -78,7 +89,10 @@ const marketingSocialPack: CapabilityPack = {
       category: "social-media",
       authModel: "oauth2_authorization_code",
       providers: ["youtube"],
-      scopes: ["https://www.googleapis.com/auth/youtube.readonly", "https://www.googleapis.com/auth/yt-analytics.readonly"],
+      scopes: [
+        "https://www.googleapis.com/auth/youtube.readonly",
+        "https://www.googleapis.com/auth/yt-analytics.readonly",
+      ],
       required: false,
       metadata: {
         docs: "https://developers.google.com/youtube/v3",
@@ -90,7 +104,8 @@ const marketingSocialPack: CapabilityPack = {
       type: "document_base",
       id: "marketing-playbook",
       name: "Marketing playbook",
-      description: "Optional workspace document base with brand voice, campaign calendars, audience research, and reporting rules.",
+      description:
+        "Optional workspace document base with brand voice, campaign calendars, audience research, and reporting rules.",
       required: false,
     },
   ],
@@ -139,7 +154,10 @@ export function isBuiltInCapabilityPack(packId: string): boolean {
  * (for example after a contract tightening) are skipped instead of breaking
  * the whole catalog.
  */
-export async function listWorkspaceCapabilityPacks(db: Database, workspaceId: string): Promise<CapabilityPack[]> {
+export async function listWorkspaceCapabilityPacks(
+  db: Database,
+  workspaceId: string,
+): Promise<CapabilityPack[]> {
   const registered = await listWorkspacePacks(db, workspaceId);
   const builtInIds = new Set(packs.map((pack) => pack.id));
   const registeredPacks = registered
@@ -151,7 +169,11 @@ export async function listWorkspaceCapabilityPacks(db: Database, workspaceId: st
   return [...packs, ...registeredPacks];
 }
 
-export async function resolveCapabilityPack(db: Database, workspaceId: string, packId: string): Promise<CapabilityPack | null> {
+export async function resolveCapabilityPack(
+  db: Database,
+  workspaceId: string,
+  packId: string,
+): Promise<CapabilityPack | null> {
   const builtIn = getCapabilityPack(packId);
   if (builtIn) {
     return builtIn;
@@ -171,7 +193,11 @@ export async function resolveCapabilityPack(db: Database, workspaceId: string, p
  * generic capability enable path) and re-checked at session start by the
  * worker, which also covers manifests re-registered after enablement.
  */
-export async function assertPackSandboxImageCompatible(db: Database, workspaceId: string, pack: CapabilityPack): Promise<void> {
+export async function assertPackSandboxImageCompatible(
+  db: Database,
+  workspaceId: string,
+  pack: CapabilityPack,
+): Promise<void> {
   if (!pack.sandboxImage) {
     return;
   }
@@ -218,13 +244,18 @@ function marketingDailyAnalysisPrompt(input: {
   documentBaseIds: string[];
   promptInstructions?: string;
 }): string {
-  const connectionLines = input.connections.map((connection) => {
-    return `- ${connection.provider}: ${connection.accountHandle} (${connection.id})`;
-  }).join("\n");
-  const knowledgeLine = input.documentBaseIds.length > 0
-    ? `Use these document base IDs for brand/campaign knowledge through the docs MCP: ${input.documentBaseIds.join(", ")}.`
-    : "No document base IDs were selected; rely only on social context returned by tools.";
-  const extra = input.promptInstructions ? `\nAdditional operator instructions:\n${input.promptInstructions.trim()}\n` : "";
+  const connectionLines = input.connections
+    .map((connection) => {
+      return `- ${connection.provider}: ${connection.accountHandle} (${connection.id})`;
+    })
+    .join("\n");
+  const knowledgeLine =
+    input.documentBaseIds.length > 0
+      ? `Use these document base IDs for brand/campaign knowledge through the docs MCP: ${input.documentBaseIds.join(", ")}.`
+      : "No document base IDs were selected; rely only on social context returned by tools.";
+  const extra = input.promptInstructions
+    ? `\nAdditional operator instructions:\n${input.promptInstructions.trim()}\n`
+    : "";
 
   return [
     "Run the daily social media analysis for the selected accounts.",
@@ -237,5 +268,7 @@ function marketingDailyAnalysisPrompt(input: {
     extra,
     "Produce a concise report with these sections: executive summary, notable account changes, winning posts, underperforming posts, audience and content signals, recommended actions for the next 24 hours, and data gaps.",
     "Use only metrics and posts returned by tools or document search. Do not invent metrics, posts, or account capabilities.",
-  ].filter(Boolean).join("\n");
+  ]
+    .filter(Boolean)
+    .join("\n");
 }

package/src/domain/resources.ts

@@ -8,11 +8,7 @@ import {
   type ResourceRef,
   type ToolRef,
 } from "@opengeni/contracts";
-import {
-  listGitHubInstallationIdsForWorkspace,
-  requireFile,
-  type Database,
-} from "@opengeni/db";
+import { listGitHubInstallationIdsForWorkspace, requireFile, type Database } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
 export function validateToolRefs(tools: ToolRef[], settings: Settings): ToolRef[] {
@@ -20,7 +16,9 @@ export function validateToolRefs(tools: ToolRef[], settings: Settings): ToolRef[
   const out: ToolRef[] = [];
   for (const tool of tools) {
     if (tool.kind !== "mcp") {
-      throw new HTTPException(422, { message: `unsupported tool kind: ${(tool as { kind?: string }).kind}` });
+      throw new HTTPException(422, {
+        message: `unsupported tool kind: ${(tool as { kind?: string }).kind}`,
+      });
     }
     const optional = tool.optional === true;
     if (!mcpServerIds.has(tool.id)) {
@@ -37,25 +35,36 @@ export function validateToolRefs(tools: ToolRef[], settings: Settings): ToolRef[
     //  - optional:true + unknown id is skipped above: the client explicitly
     //    opted into graceful degradation for MCPs (for example docs servers
     //    like context7) that only some deployments configure.
-    out.push(optional ? { kind: "mcp", id: tool.id, optional: true } : { kind: "mcp", id: tool.id });
+    out.push(
+      optional ? { kind: "mcp", id: tool.id, optional: true } : { kind: "mcp", id: tool.id },
+    );
   }
   return mergeToolRefs([], out);
 }
 
 type McpSettings = Pick<Settings, "mcpServers">;
 
-export function enabledCapabilityMcpToolRefs(settings: McpSettings, runtimeSettings: McpSettings): ToolRef[] {
+export function enabledCapabilityMcpToolRefs(
+  settings: McpSettings,
+  runtimeSettings: McpSettings,
+): ToolRef[] {
   const configuredIds = new Set(settings.mcpServers.map((server) => server.id));
-  return runtimeSettings.mcpServers
-    .filter((server) => !configuredIds.has(server.id))
-    // AUTO-ATTACHED (workspace-default) capability servers are marked optional:
-    // one of them having a broken/expired credential must SKIP that server, not
-    // fail the whole turn before the model runs. The caller only reaches here
-    // when the request omitted `tools`; an explicit list is never defaulted.
-    .map((server) => ({ kind: "mcp", id: server.id, optional: true }));
+  return (
+    runtimeSettings.mcpServers
+      .filter((server) => !configuredIds.has(server.id))
+      // AUTO-ATTACHED (workspace-default) capability servers are marked optional:
+      // one of them having a broken/expired credential must SKIP that server, not
+      // fail the whole turn before the model runs. The caller only reaches here
+      // when the request omitted `tools`; an explicit list is never defaulted.
+      .map((server) => ({ kind: "mcp", id: server.id, optional: true }))
+  );
 }
 
-export function withDefaultEnabledCapabilityMcpTools(tools: ToolRef[], settings: McpSettings, runtimeSettings: McpSettings): ToolRef[] {
+export function withDefaultEnabledCapabilityMcpTools(
+  tools: ToolRef[],
+  settings: McpSettings,
+  runtimeSettings: McpSettings,
+): ToolRef[] {
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 
@@ -91,14 +100,25 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
         ref: resource.ref.trim(),
         mountPath,
         ...(resource.subpath ? { subpath: normalizeMountPath(resource.subpath) } : {}),
-        ...(resource.githubInstallationId ? { githubInstallationId: resource.githubInstallationId } : {}),
+        ...(resource.provider ? { provider: resource.provider } : {}),
+        ...(resource.repositoryId !== undefined ? { repositoryId: resource.repositoryId } : {}),
+        ...(resource.installationId !== undefined
+          ? { installationId: resource.installationId }
+          : {}),
+        ...(resource.projectId !== undefined ? { projectId: resource.projectId } : {}),
+        ...(resource.connectionId ? { connectionId: resource.connectionId } : {}),
+        ...(resource.githubInstallationId
+          ? { githubInstallationId: resource.githubInstallationId }
+          : {}),
         ...(resource.githubRepositoryId ? { githubRepositoryId: resource.githubRepositoryId } : {}),
       };
     }
     const key = stableJson(normalized);
     const mounted = normalized.mountPath ? mountPaths.get(normalized.mountPath) : undefined;
     if (mounted && mounted !== key) {
-      throw new HTTPException(422, { message: `duplicate resource mount path: ${normalized.mountPath}` });
+      throw new HTTPException(422, {
+        message: `duplicate resource mount path: ${normalized.mountPath}`,
+      });
     }
     if (normalized.mountPath) {
       mountPaths.set(normalized.mountPath, key);
@@ -106,7 +126,9 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
     const identity = resourceIdentityKey(normalized);
     const seenIdentity = identities.get(identity);
     if (seenIdentity && seenIdentity !== key) {
-      throw new HTTPException(422, { message: `duplicate resource with different settings: ${identity}` });
+      throw new HTTPException(422, {
+        message: `duplicate resource with different settings: ${identity}`,
+      });
     }
     identities.set(identity, key);
     if (!seenResources.has(key)) {
@@ -117,7 +139,10 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
   return out;
 }
 
-export function mergeResourceRefs(existing: ResourceRef[], additions: ResourceRef[]): ResourceRef[] {
+export function mergeResourceRefs(
+  existing: ResourceRef[],
+  additions: ResourceRef[],
+): ResourceRef[] {
   try {
     return mergeContractResourceRefs(existing, additions, { rejectConflicts: true });
   } catch (error) {
@@ -133,8 +158,12 @@ export function validateGitHubRepositorySelectionShape(resources: ResourceRef[])
     if (resource.kind !== "repository") {
       return [];
     }
-    const installationRaw = resource.githubInstallationId;
-    const repositoryRaw = resource.githubRepositoryId;
+    const installationRaw =
+      resource.githubInstallationId ??
+      (resource.provider === "github" ? resource.installationId : undefined);
+    const repositoryRaw =
+      resource.githubRepositoryId ??
+      (resource.provider === "github" ? resource.repositoryId : undefined);
     if (installationRaw === null && repositoryRaw === null) {
       return [];
     }
@@ -145,7 +174,8 @@ export function validateGitHubRepositorySelectionShape(resources: ResourceRef[])
     const repositoryId = positiveInteger(repositoryRaw);
     if (!installationId || !repositoryId) {
       throw new HTTPException(422, {
-        message: "GitHub App repository resources require positive github_installation_id and github_repository_id",
+        message:
+          "GitHub App repository resources require positive github_installation_id and github_repository_id",
       });
     }
     return [{ installationId, repositoryId }];
@@ -162,20 +192,31 @@ export function validateGitHubRepositorySelectionShape(resources: ResourceRef[])
   return installationId;
 }
 
-export async function validateGitHubRepositorySelection(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void> {
+export async function validateGitHubRepositorySelection(
+  db: Database,
+  workspaceId: string,
+  resources: ResourceRef[],
+): Promise<void> {
   const installationId = validateGitHubRepositorySelectionShape(resources);
   if (installationId === null) {
     return;
   }
-  const linkedInstallationIds = new Set(await listGitHubInstallationIdsForWorkspace(db, workspaceId));
+  const linkedInstallationIds = new Set(
+    await listGitHubInstallationIdsForWorkspace(db, workspaceId),
+  );
   if (!linkedInstallationIds.has(installationId)) {
     throw new HTTPException(422, {
-      message: "GitHub App repository resources must belong to a GitHub App installation linked to this workspace",
+      message:
+        "GitHub App repository resources must belong to a GitHub App installation linked to this workspace",
     });
   }
 }
 
-export async function validateFileResources(db: Database, workspaceId: string, resources: ResourceRef[]): Promise<void> {
+export async function validateFileResources(
+  db: Database,
+  workspaceId: string,
+  resources: ResourceRef[],
+): Promise<void> {
   const fileIds = new Set<string>();
   for (const resource of resources) {
     if (resource.kind !== "file") {
@@ -190,7 +231,9 @@ export async function validateFileResources(db: Database, workspaceId: string, r
       throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });
     }
     if (file.status !== "ready") {
-      throw new HTTPException(422, { message: `file resource ${resource.fileId} is ${file.status}` });
+      throw new HTTPException(422, {
+        message: `file resource ${resource.fileId} is ${file.status}`,
+      });
     }
   }
 }