@opengeni/core 2.1.0-canary.0 → 2.2.0-canary.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js.map +1 -1
- package/package.json +10 -10
- package/src/access/index.ts +9 -3
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@opengeni/core",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.2.0-canary.0",
|
|
4
4
|
"description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -50,15 +50,15 @@
|
|
|
50
50
|
},
|
|
51
51
|
"dependencies": {
|
|
52
52
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
53
|
-
"@opengeni/codex": "^0.2.
|
|
54
|
-
"@opengeni/config": "^0.19.
|
|
55
|
-
"@opengeni/contracts": "^2.
|
|
56
|
-
"@opengeni/db": "^3.
|
|
57
|
-
"@opengeni/documents": "^0.
|
|
58
|
-
"@opengeni/events": "^0.3.
|
|
59
|
-
"@opengeni/observability": "^0.8.
|
|
60
|
-
"@opengeni/runtime": "^1.3.
|
|
61
|
-
"@opengeni/storage": "^0.2.
|
|
53
|
+
"@opengeni/codex": "^0.2.19-canary.0",
|
|
54
|
+
"@opengeni/config": "^0.19.1-canary.0",
|
|
55
|
+
"@opengeni/contracts": "^2.3.0-canary.0",
|
|
56
|
+
"@opengeni/db": "^3.2.0-canary.0",
|
|
57
|
+
"@opengeni/documents": "^0.7.0-canary.0",
|
|
58
|
+
"@opengeni/events": "^0.3.124-canary.0",
|
|
59
|
+
"@opengeni/observability": "^0.8.4-canary.0",
|
|
60
|
+
"@opengeni/runtime": "^1.3.1-canary.0",
|
|
61
|
+
"@opengeni/storage": "^0.2.106-canary.0",
|
|
62
62
|
"hono": "^4.12.18",
|
|
63
63
|
"zod": "^4.2.1"
|
|
64
64
|
},
|
package/src/access/index.ts
CHANGED
|
@@ -226,9 +226,15 @@ async function accessGrantAuthorization(
|
|
|
226
226
|
/**
|
|
227
227
|
* May this grant use the owner-only managed personal-workspace exception?
|
|
228
228
|
*
|
|
229
|
-
* A managed human's personal workspace
|
|
230
|
-
*
|
|
231
|
-
* `organization_memberships.personal_workspace_id` pointer instead.
|
|
229
|
+
* A managed human's personal workspace carries no `workspace_memberships` row,
|
|
230
|
+
* so seams that fence on one must consult the
|
|
231
|
+
* `organization_memberships.personal_workspace_id` pointer instead. That is a
|
|
232
|
+
* runtime property, not a schema one: migration 0219's `42501` is a
|
|
233
|
+
* precondition inside the provisioning function rather than a constraint, and
|
|
234
|
+
* the parity report records `personal_workspace_has_no_membership_row` as
|
|
235
|
+
* `basis: "runtime"` - its own term for something nothing in the schema
|
|
236
|
+
* prevents. It holds because every membership writer requires `members:manage`
|
|
237
|
+
* on the target, which a personal-workspace grant deliberately omits. `AGENTS.md`
|
|
232
238
|
* scopes that exception tightly: it "derives an owner-only personal-workspace
|
|
233
239
|
* grant only for the canonical managed-cookie (Better Auth) session", and
|
|
234
240
|
* "Bearer/delegated principals, API keys, and account or organization
|