@opengeni/core 2.4.0-canary.1 → 2.5.2-canary.0

package/dist/chunk-ZVZJTMSV.js

@@ -0,0 +1,369 @@
+import {
+  MANAGED_AUTH_ACTOR_EPOCH_HEADER,
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  managedAuthSha256,
+  resolveManagedAuthSelectedSession
+} from "./chunk-YGOMUGYS.js";
+
+// src/managed-session.ts
+import {
+  acquireManagedAuthActorMutationLease,
+  getManagedAuthAdoptedSessionSnapshot,
+  getManagedAuthSessionSetSnapshot,
+  ManagedAuthSessionSetAuthorityError,
+  ManagedAuthSessionSetGenerationConflictError,
+  releaseManagedAuthActorMutationLease,
+  validateManagedAuthActorMutationLease
+} from "@opengeni/db/managed-auth-session-sets";
+import { validateCanonicalHumanSession } from "@opengeni/db/canonical-human-identities";
+import { HTTPException } from "hono/http-exception";
+var ACTOR_MUTATION_LEASE_SECONDS = 15 * 60;
+var ACTOR_MUTATION_LEASE_REFRESH_MS = 5 * 60 * 1e3;
+var ACTOR_MUTATION_HANDLER_DEADLINE_MS = 10 * 60 * 1e3;
+var ACTOR_MUTATION_FATAL_SAFETY_MS = 5e3;
+var productionActorMutationLeaseRuntime = {
+  monotonicNow: () => performance.now(),
+  schedule: (callback, delayMs) => unrefTimer(setTimeout(callback, delayMs)),
+  cancel: (timer) => clearTimeout(timer),
+  terminate: () => {
+    process.stderr.write("fatal: managed actor mutation outlived its durable lease\n");
+    process.exit(1);
+  }
+};
+var actorMutationLeaseRuntime = productionActorMutationLeaseRuntime;
+var actorMutationLeaseByRequest = /* @__PURE__ */ new WeakMap();
+var managedActorEpochByRequest = /* @__PURE__ */ new WeakMap();
+var managedActorAdmissionByRequest = /* @__PURE__ */ new WeakMap();
+async function getManagedSession(c, auth, options) {
+  const sessionSetMode = options?.sessionSetMode ?? "legacy";
+  if (sessionSetMode !== "legacy" && options?.db && options.sessionAdapter) {
+    const authority = requestCookie(c.req.raw, MANAGED_AUTH_SESSION_SET_COOKIE);
+    if (authority) {
+      try {
+        const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;
+        const expectedActorEpoch = admittedActorEpoch ?? c.req.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER) ?? null;
+        const legacyAmbient = sessionSetMode === "dual" && expectedActorEpoch === null ? await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers) : null;
+        const selected = await resolveManagedAuthSelectedSession({
+          db: options.db,
+          adapter: options.sessionAdapter,
+          authority,
+          mode: sessionSetMode,
+          expectedActorEpoch,
+          legacyAmbientSessionId: typeof legacyAmbient?.session?.id === "string" ? legacyAmbient.session.id : null,
+          allowRecovery: options.allowIdentityRecovery ?? false
+        });
+        if (selected) {
+          if (admittedActorEpoch === null) {
+            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, selected.projection.actorEpoch);
+            managedActorEpochByRequest.set(c.req.raw, selected.projection.actorEpoch);
+          }
+          managedActorAdmissionByRequest.set(c.req.raw, {
+            authorityHash: managedAuthSha256(authority),
+            actorEpoch: selected.projection.actorEpoch
+          });
+        }
+        if (selected && !selected.session) return null;
+        if (selected?.session) {
+          let resolvedSession = selected.session;
+          if (requestNeedsActorMutationLease(c.req.method)) {
+            await ensureActorMutationLease(
+              c.req.raw,
+              options.db,
+              authority,
+              selected.projection.actorEpoch
+            );
+            const selectedSlot = await selectedSlotForAuthority(
+              options.db,
+              authority,
+              sessionSetMode,
+              options.allowIdentityRecovery ?? false
+            );
+            if (!selectedSlot) throw new ManagedAuthActorChangeError();
+            const refreshed = await options.sessionAdapter.refreshSelectedSession(selectedSlot);
+            if (!refreshed || refreshed.session.id !== selectedSlot.authSessionId || refreshed.user.id !== selectedSlot.authUserId) {
+              throw new ManagedAuthActorChangeError();
+            }
+            resolvedSession = refreshed;
+          }
+          return resolvedSession;
+        }
+        return null;
+      } catch (error) {
+        if (error instanceof ManagedAuthActorChangeError) {
+          if (!managedActorEpochByRequest.has(c.req.raw)) {
+            c.header("x-opengeni-actor-state", "changed");
+          }
+          throw new HTTPException(409, { message: error.code, cause: error });
+        }
+        throw error;
+      }
+    }
+    if (sessionSetMode === "broker") return null;
+    const ambient = await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers);
+    if (ambient?.session?.id)
+      try {
+        const adopted = await getManagedAuthAdoptedSessionSnapshot(options.db, ambient.session.id);
+        if (adopted) {
+          const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;
+          if (adopted.actorEpoch !== "1" || admittedActorEpoch !== null && adopted.actorEpoch !== admittedActorEpoch || !adopted.selected || adopted.selected.authSessionId !== ambient.session.id || adopted.selected.authUserId !== ambient.user.id) {
+            throw new ManagedAuthActorChangeError();
+          }
+          if (admittedActorEpoch === null) {
+            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, adopted.actorEpoch);
+            managedActorEpochByRequest.set(c.req.raw, adopted.actorEpoch);
+          }
+          managedActorAdmissionByRequest.set(c.req.raw, {
+            authorityHash: adopted.authorityHash,
+            actorEpoch: adopted.actorEpoch
+          });
+          if (requestNeedsActorMutationLease(c.req.method)) {
+            await ensureActorMutationLeaseForHash(
+              c.req.raw,
+              options.db,
+              adopted.authorityHash,
+              adopted.actorEpoch
+            );
+            const current = await getManagedAuthAdoptedSessionSnapshot(
+              options.db,
+              ambient.session.id
+            );
+            if (current?.authorityHash !== adopted.authorityHash || current.actorEpoch !== adopted.actorEpoch || !current.selected || current.selected.authSessionId !== ambient.session.id) {
+              throw new ManagedAuthActorChangeError();
+            }
+            const refreshed = await options.sessionAdapter.refreshSelectedSession(current.selected);
+            if (!refreshed || refreshed.session.id !== ambient.session.id || refreshed.user.id !== ambient.user.id) {
+              throw new ManagedAuthActorChangeError();
+            }
+            return refreshed;
+          }
+          return ambient;
+        }
+      } catch (error) {
+        if (error instanceof ManagedAuthActorChangeError) {
+          if (!managedActorEpochByRequest.has(c.req.raw)) {
+            c.header("x-opengeni-actor-state", "changed");
+          }
+          throw new HTTPException(409, { message: error.code, cause: error });
+        }
+        throw error;
+      }
+  }
+  const result = await auth.api.getSession({
+    headers: c.req.raw.headers,
+    returnHeaders: true
+  });
+  for (const cookie of setCookieHeaders(result.headers)) {
+    c.header("set-cookie", cookie, { append: true });
+  }
+  const session = result.response;
+  if (!session?.user || !options?.db) return session;
+  const authSessionId = session.session?.id;
+  if (typeof authSessionId !== "string") return null;
+  const valid = await validateCanonicalHumanSession(options.db, {
+    authSessionId,
+    authUserId: session.user.id,
+    ...options.allowIdentityRecovery === void 0 ? {} : { allowRecovery: options.allowIdentityRecovery }
+  });
+  return valid ? session : null;
+}
+function getManagedAuthRequestActorEpoch(request) {
+  return managedActorEpochByRequest.get(request) ?? null;
+}
+function selectedSlotForAuthority(db, authority, mode, allowRecovery) {
+  return getManagedAuthSessionSetSnapshot(db, {
+    authorityHash: managedAuthSha256(authority),
+    mode,
+    includeInternal: true,
+    allowRecovery,
+    readOnly: true
+  }).then((snapshot) => snapshot?.selected ?? null);
+}
+async function releaseManagedAuthRequestActorLease(request) {
+  const lease = actorMutationLeaseByRequest.get(request);
+  if (!lease) return;
+  actorMutationLeaseByRequest.delete(request);
+  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);
+  if (lease.deadlineTimer) lease.runtime.cancel(lease.deadlineTimer);
+  if (lease.fatalTimer) lease.runtime.cancel(lease.fatalTimer);
+  await releaseManagedAuthActorMutationLease(lease.db, {
+    authorityHash: lease.authorityHash,
+    requestId: lease.requestId
+  });
+}
+function getManagedAuthRequestActorAbortSignal(request) {
+  return actorMutationLeaseByRequest.get(request)?.abortController.signal ?? null;
+}
+async function validateManagedAuthRequestActorLease(request) {
+  const lease = actorMutationLeaseByRequest.get(request);
+  if (!lease) return;
+  if (lease.actorTransitionApplied) return;
+  if (lease.poisoned !== null) {
+    throw new ManagedAuthActorLeaseOutcomeUnknownError({
+      cause: lease.poisoned
+    });
+  }
+  const valid = await validateManagedAuthActorMutationLease(lease.db, {
+    authorityHash: lease.authorityHash,
+    actorEpoch: lease.actorEpoch,
+    requestId: lease.requestId
+  });
+  if (!valid) throw new ManagedAuthActorChangeError();
+}
+var ManagedAuthActorLeaseOutcomeUnknownError = class extends Error {
+  name = "ManagedAuthActorLeaseOutcomeUnknownError";
+  code = "operation_outcome_unknown";
+  constructor(options) {
+    super("The actor-scoped request outcome is unknown after its durable lease was lost", options);
+  }
+};
+function markManagedAuthRequestActorTransitionApplied(request) {
+  const lease = actorMutationLeaseByRequest.get(request);
+  if (lease) lease.actorTransitionApplied = true;
+}
+function getManagedAuthRequestActorAdmissionStamp(request) {
+  return managedActorAdmissionByRequest.get(request) ?? null;
+}
+function getManagedAuthRequestActorLeaseStamp(request) {
+  const lease = actorMutationLeaseByRequest.get(request);
+  return lease ? {
+    authorityHash: lease.authorityHash,
+    actorEpoch: lease.actorEpoch,
+    requestId: lease.requestId
+  } : null;
+}
+function requestNeedsActorMutationLease(method) {
+  return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+}
+async function ensureActorMutationLease(request, db, authority, actorEpoch) {
+  const authorityHash = managedAuthSha256(authority);
+  await ensureActorMutationLeaseForHash(request, db, authorityHash, actorEpoch);
+}
+async function ensureActorMutationLeaseForHash(request, db, authorityHash, actorEpoch) {
+  const existing = actorMutationLeaseByRequest.get(request);
+  if (existing) {
+    if (existing.authorityHash !== authorityHash || existing.actorEpoch !== actorEpoch) {
+      throw new ManagedAuthActorChangeError();
+    }
+    return;
+  }
+  const lease = {
+    db,
+    authorityHash,
+    actorEpoch,
+    requestId: crypto.randomUUID(),
+    refreshTimer: null,
+    deadlineTimer: null,
+    fatalTimer: null,
+    expiresAt: /* @__PURE__ */ new Date(0),
+    localFatalDeadlineMonotonicMs: 0,
+    runtime: actorMutationLeaseRuntime,
+    abortController: new AbortController(),
+    poisoned: null,
+    actorTransitionApplied: false
+  };
+  const acquireStartedAtMonotonicMs = lease.runtime.monotonicNow();
+  try {
+    lease.expiresAt = await acquireManagedAuthActorMutationLease(db, {
+      authorityHash,
+      actorEpoch,
+      requestId: lease.requestId,
+      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS
+    });
+  } catch (error) {
+    if (error instanceof ManagedAuthSessionSetGenerationConflictError || error instanceof ManagedAuthSessionSetAuthorityError) {
+      throw new ManagedAuthActorChangeError();
+    }
+    throw error;
+  }
+  lease.localFatalDeadlineMonotonicMs = acquireStartedAtMonotonicMs + ACTOR_MUTATION_LEASE_SECONDS * 1e3 - ACTOR_MUTATION_FATAL_SAFETY_MS;
+  actorMutationLeaseByRequest.set(request, lease);
+  scheduleActorMutationLeaseRefresh(request, lease);
+  lease.deadlineTimer = lease.runtime.schedule(() => {
+    poisonActorMutationLease(
+      request,
+      lease,
+      new Error("managed actor mutation handler exceeded its bounded lifetime")
+    );
+  }, ACTOR_MUTATION_HANDLER_DEADLINE_MS);
+}
+function scheduleActorMutationLeaseRefresh(request, lease) {
+  const timer = lease.runtime.schedule(() => {
+    if (actorMutationLeaseByRequest.get(request) !== lease) return;
+    const refreshStartedAtMonotonicMs = lease.runtime.monotonicNow();
+    void acquireManagedAuthActorMutationLease(lease.db, {
+      authorityHash: lease.authorityHash,
+      actorEpoch: lease.actorEpoch,
+      requestId: lease.requestId,
+      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS
+    }).then(async (expiresAt) => {
+      if (actorMutationLeaseByRequest.get(request) !== lease) {
+        await releaseManagedAuthActorMutationLease(lease.db, {
+          authorityHash: lease.authorityHash,
+          requestId: lease.requestId
+        });
+        return;
+      }
+      lease.expiresAt = expiresAt;
+      lease.localFatalDeadlineMonotonicMs = refreshStartedAtMonotonicMs + ACTOR_MUTATION_LEASE_SECONDS * 1e3 - ACTOR_MUTATION_FATAL_SAFETY_MS;
+      scheduleActorMutationLeaseRefresh(request, lease);
+    }).catch((error) => poisonActorMutationLease(request, lease, error));
+  }, ACTOR_MUTATION_LEASE_REFRESH_MS);
+  lease.refreshTimer = timer;
+}
+function poisonActorMutationLease(request, lease, error) {
+  if (actorMutationLeaseByRequest.get(request) !== lease || lease.poisoned !== null) return;
+  lease.poisoned = error;
+  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);
+  lease.refreshTimer = null;
+  lease.abortController.abort(error);
+  const fatalAfterMs = Math.max(
+    0,
+    lease.localFatalDeadlineMonotonicMs - lease.runtime.monotonicNow()
+  );
+  lease.fatalTimer = lease.runtime.schedule(() => {
+    if (actorMutationLeaseByRequest.get(request) !== lease) return;
+    lease.runtime.terminate();
+  }, fatalAfterMs);
+}
+function unrefTimer(timer) {
+  timer.unref?.();
+  return timer;
+}
+function requestCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
+    const value = part.slice(separator + 1).trim();
+    if (!value || value.length > 512) return null;
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function setCookieHeaders(headers) {
+  const getSetCookie = headers.getSetCookie;
+  if (getSetCookie) {
+    return getSetCookie.call(headers);
+  }
+  const cookie = headers.get("set-cookie");
+  return cookie ? [cookie] : [];
+}
+
+export {
+  getManagedSession,
+  getManagedAuthRequestActorEpoch,
+  releaseManagedAuthRequestActorLease,
+  getManagedAuthRequestActorAbortSignal,
+  validateManagedAuthRequestActorLease,
+  ManagedAuthActorLeaseOutcomeUnknownError,
+  markManagedAuthRequestActorTransitionApplied,
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp
+};
+//# sourceMappingURL=chunk-ZVZJTMSV.js.map

package/dist/chunk-ZVZJTMSV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-session.ts"],"sourcesContent":["import type { Context } from \"hono\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport type { Database } from \"@opengeni/db\";\nimport {\n  acquireManagedAuthActorMutationLease,\n  getManagedAuthAdoptedSessionSnapshot,\n  getManagedAuthSessionSetSnapshot,\n  ManagedAuthSessionSetAuthorityError,\n  ManagedAuthSessionSetGenerationConflictError,\n  releaseManagedAuthActorMutationLease,\n  validateManagedAuthActorMutationLease,\n} from \"@opengeni/db/managed-auth-session-sets\";\nimport { validateCanonicalHumanSession } from \"@opengeni/db/canonical-human-identities\";\nimport type { ManagedAuthSessionSetMode } from \"@opengeni/contracts/managed-auth-session-sets\";\nimport { HTTPException } from \"hono/http-exception\";\nimport {\n  MANAGED_AUTH_ACTOR_EPOCH_HEADER,\n  MANAGED_AUTH_SESSION_SET_COOKIE,\n  ManagedAuthActorChangeError,\n  managedAuthSha256,\n  resolveManagedAuthSelectedSession,\n  type ManagedAuthSessionAdapter,\n} from \"./managed-auth-session-sets\";\n\nconst ACTOR_MUTATION_LEASE_SECONDS = 15 * 60;\nconst ACTOR_MUTATION_LEASE_REFRESH_MS = 5 * 60 * 1_000;\nconst ACTOR_MUTATION_HANDLER_DEADLINE_MS = 10 * 60 * 1_000;\nconst ACTOR_MUTATION_FATAL_SAFETY_MS = 5_000;\ntype ActorMutationLeaseRuntime = {\n  monotonicNow: () => number;\n  schedule: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;\n  cancel: (timer: ReturnType<typeof setTimeout>) => void;\n  terminate: () => void;\n};\nconst productionActorMutationLeaseRuntime: ActorMutationLeaseRuntime = {\n  monotonicNow: () => performance.now(),\n  schedule: (callback, delayMs) => unrefTimer(setTimeout(callback, delayMs)),\n  cancel: (timer) => clearTimeout(timer),\n  terminate: () => {\n    process.stderr.write(\"fatal: managed actor mutation outlived its durable lease\\n\");\n    process.exit(1);\n  },\n};\nlet actorMutationLeaseRuntime = productionActorMutationLeaseRuntime;\ntype ActorMutationLease = {\n  db: Database;\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n  refreshTimer: ReturnType<typeof setTimeout> | null;\n  deadlineTimer: ReturnType<typeof setTimeout> | null;\n  fatalTimer: ReturnType<typeof setTimeout> | null;\n  expiresAt: Date;\n  localFatalDeadlineMonotonicMs: number;\n  runtime: ActorMutationLeaseRuntime;\n  abortController: AbortController;\n  poisoned: unknown | null;\n  actorTransitionApplied: boolean;\n};\nconst actorMutationLeaseByRequest = new WeakMap<Request, ActorMutationLease>();\nconst managedActorEpochByRequest = new WeakMap<Request, string>();\nconst managedActorAdmissionByRequest = new WeakMap<Request, ManagedAuthActorAdmissionStamp>();\n\n/**\n * Read a Better Auth session without bypassing its sliding-cookie renewal.\n *\n * Better Auth can refresh the durable session while resolving `getSession`.\n * Programmatic callers must explicitly request and forward the returned cookie\n * headers; the HTTP handler does this automatically, but direct API calls do not.\n */\nexport async function getManagedSession(\n  c: Context,\n  auth: ManagedAuth,\n  options?: {\n    db?: Database | undefined;\n    allowIdentityRecovery?: boolean | undefined;\n    sessionSetMode?: ManagedAuthSessionSetMode | undefined;\n    sessionAdapter?: ManagedAuthSessionAdapter | null | undefined;\n  },\n) {\n  const sessionSetMode = options?.sessionSetMode ?? \"legacy\";\n  if (sessionSetMode !== \"legacy\" && options?.db && options.sessionAdapter) {\n    const authority = requestCookie(c.req.raw, MANAGED_AUTH_SESSION_SET_COOKIE);\n    if (authority) {\n      try {\n        // A long-lived response reuses this exact Request for periodic\n        // authorization. Once admitted, the server-owned stamp is the actor\n        // fence: a client may omit the header on its initial GET, but a later\n        // reauthorization must not follow a newly selected actor.\n        const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n        const expectedActorEpoch =\n          admittedActorEpoch ?? c.req.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER) ?? null;\n        const legacyAmbient =\n          sessionSetMode === \"dual\" && expectedActorEpoch === null\n            ? await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers)\n            : null;\n        const selected = await resolveManagedAuthSelectedSession({\n          db: options.db,\n          adapter: options.sessionAdapter,\n          authority,\n          mode: sessionSetMode,\n          expectedActorEpoch,\n          legacyAmbientSessionId:\n            typeof legacyAmbient?.session?.id === \"string\" ? legacyAmbient.session.id : null,\n          allowRecovery: options.allowIdentityRecovery ?? false,\n        });\n        if (selected) {\n          // The actor epoch is both an admission fence and response provenance.\n          // A browser must ignore a late finite response after another tab has\n          // advanced selection, even when the request itself was read-only.\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, selected.projection.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, selected.projection.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: managedAuthSha256(authority),\n            actorEpoch: selected.projection.actorEpoch,\n          });\n        }\n        if (selected && !selected.session) return null;\n        if (selected?.session) {\n          let resolvedSession = selected.session;\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLease(\n              c.req.raw,\n              options.db,\n              authority,\n              selected.projection.actorEpoch,\n            );\n            const selectedSlot = await selectedSlotForAuthority(\n              options.db,\n              authority,\n              sessionSetMode,\n              options.allowIdentityRecovery ?? false,\n            );\n            if (!selectedSlot) throw new ManagedAuthActorChangeError();\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(selectedSlot);\n            if (\n              !refreshed ||\n              refreshed.session.id !== selectedSlot.authSessionId ||\n              refreshed.user.id !== selectedSlot.authUserId\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            resolvedSession = refreshed;\n          }\n          return resolvedSession;\n        }\n        // Once a browser presents a session-set authority it is authoritative.\n        // An absent/expired/rekeyed authority must never fall through to an\n        // ambient Better Auth cookie in dual mode: that would bypass the actor\n        // epoch and mutation-lease fences after another tab transitions.\n        return null;\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          // Response headers are immutable after an SSE body starts. The\n          // original response already carries its actor epoch; reauthorization\n          // closes that stream through the thrown conflict instead.\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n    }\n    if (sessionSetMode === \"broker\") return null;\n    const ambient = await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers);\n    if (ambient?.session?.id)\n      try {\n        const adopted = await getManagedAuthAdoptedSessionSnapshot(options.db, ambient.session.id);\n        if (adopted) {\n          const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n          if (\n            adopted.actorEpoch !== \"1\" ||\n            (admittedActorEpoch !== null && adopted.actorEpoch !== admittedActorEpoch) ||\n            !adopted.selected ||\n            adopted.selected.authSessionId !== ambient.session.id ||\n            adopted.selected.authUserId !== ambient.user.id\n          ) {\n            throw new ManagedAuthActorChangeError();\n          }\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, adopted.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, adopted.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: adopted.authorityHash,\n            actorEpoch: adopted.actorEpoch,\n          });\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLeaseForHash(\n              c.req.raw,\n              options.db,\n              adopted.authorityHash,\n              adopted.actorEpoch,\n            );\n            const current = await getManagedAuthAdoptedSessionSnapshot(\n              options.db,\n              ambient.session.id,\n            );\n            if (\n              current?.authorityHash !== adopted.authorityHash ||\n              current.actorEpoch !== adopted.actorEpoch ||\n              !current.selected ||\n              current.selected.authSessionId !== ambient.session.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(current.selected);\n            if (\n              !refreshed ||\n              refreshed.session.id !== ambient.session.id ||\n              refreshed.user.id !== ambient.user.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            return refreshed;\n          }\n          return ambient;\n        }\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n  }\n  const result = await auth.api.getSession({\n    headers: c.req.raw.headers,\n    returnHeaders: true,\n  });\n\n  for (const cookie of setCookieHeaders(result.headers)) {\n    c.header(\"set-cookie\", cookie, { append: true });\n  }\n\n  const session = result.response;\n  if (!session?.user || !options?.db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(options.db, {\n    authSessionId,\n    authUserId: session.user.id,\n    ...(options.allowIdentityRecovery === undefined\n      ? {}\n      : { allowRecovery: options.allowIdentityRecovery }),\n  });\n  return valid ? session : null;\n}\n\n/** Safe response provenance for a request authenticated through session-set authority. */\nexport function getManagedAuthRequestActorEpoch(request: Request): string | null {\n  return managedActorEpochByRequest.get(request) ?? null;\n}\n\nfunction selectedSlotForAuthority(\n  db: Database,\n  authority: string,\n  mode: ManagedAuthSessionSetMode,\n  allowRecovery: boolean,\n) {\n  return getManagedAuthSessionSetSnapshot(db, {\n    authorityHash: managedAuthSha256(authority),\n    mode,\n    includeInternal: true,\n    allowRecovery,\n    readOnly: true,\n  }).then((snapshot) => snapshot?.selected ?? null);\n}\n\n/** Release the multi-replica actor fence after the outer HTTP handler settles. */\nexport async function releaseManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  actorMutationLeaseByRequest.delete(request);\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  if (lease.deadlineTimer) lease.runtime.cancel(lease.deadlineTimer);\n  if (lease.fatalTimer) lease.runtime.cancel(lease.fatalTimer);\n  await releaseManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    requestId: lease.requestId,\n  });\n}\n\n/** Cooperative cancellation signal for actor-scoped provider/external I/O. */\nexport function getManagedAuthRequestActorAbortSignal(request: Request): AbortSignal | null {\n  return actorMutationLeaseByRequest.get(request)?.abortController.signal ?? null;\n}\n\n/** @internal Deterministic lease-clock seam used only by direct lifecycle tests. */\nexport function installManagedAuthActorLeaseRuntimeForTest(\n  overrides: Partial<ActorMutationLeaseRuntime>,\n): () => void {\n  const previous = actorMutationLeaseRuntime;\n  actorMutationLeaseRuntime = {\n    ...productionActorMutationLeaseRuntime,\n    ...overrides,\n  };\n  return () => {\n    actorMutationLeaseRuntime = previous;\n  };\n}\n\n/**\n * Exact post-handler fence. A finite unsafe response is not released unless\n * its request-owned lease is still live at the same actor epoch.\n */\nexport async function validateManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  if (lease.actorTransitionApplied) return;\n  if (lease.poisoned !== null) {\n    throw new ManagedAuthActorLeaseOutcomeUnknownError({\n      cause: lease.poisoned,\n    });\n  }\n  const valid = await validateManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    actorEpoch: lease.actorEpoch,\n    requestId: lease.requestId,\n  });\n  if (!valid) throw new ManagedAuthActorChangeError();\n}\n\nexport class ManagedAuthActorLeaseOutcomeUnknownError extends Error {\n  readonly name = \"ManagedAuthActorLeaseOutcomeUnknownError\";\n  readonly code = \"operation_outcome_unknown\";\n  constructor(options?: ErrorOptions) {\n    super(\"The actor-scoped request outcome is unknown after its durable lease was lost\", options);\n  }\n}\n\n/** A known-applied same-request canonical transition intentionally consumes its lease. */\nexport function markManagedAuthRequestActorTransitionApplied(request: Request): void {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (lease) lease.actorTransitionApplied = true;\n}\n\nexport type ManagedAuthActorMutationLeaseStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n};\n\nexport type ManagedAuthActorAdmissionStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n};\n\n/** Verified server-owned actor evidence available to both reads and mutations. */\nexport function getManagedAuthRequestActorAdmissionStamp(\n  request: Request,\n): ManagedAuthActorAdmissionStamp | null {\n  return managedActorAdmissionByRequest.get(request) ?? null;\n}\n\n/** Exact request-owned fence passed into a same-transaction actor transition. */\nexport function getManagedAuthRequestActorLeaseStamp(\n  request: Request,\n): ManagedAuthActorMutationLeaseStamp | null {\n  const lease = actorMutationLeaseByRequest.get(request);\n  return lease\n    ? {\n        authorityHash: lease.authorityHash,\n        actorEpoch: lease.actorEpoch,\n        requestId: lease.requestId,\n      }\n    : null;\n}\n\nfunction requestNeedsActorMutationLease(method: string): boolean {\n  return method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nasync function ensureActorMutationLease(\n  request: Request,\n  db: Database,\n  authority: string,\n  actorEpoch: string,\n): Promise<void> {\n  const authorityHash = managedAuthSha256(authority);\n  await ensureActorMutationLeaseForHash(request, db, authorityHash, actorEpoch);\n}\n\nasync function ensureActorMutationLeaseForHash(\n  request: Request,\n  db: Database,\n  authorityHash: string,\n  actorEpoch: string,\n): Promise<void> {\n  const existing = actorMutationLeaseByRequest.get(request);\n  if (existing) {\n    if (existing.authorityHash !== authorityHash || existing.actorEpoch !== actorEpoch) {\n      throw new ManagedAuthActorChangeError();\n    }\n    return;\n  }\n  const lease: ActorMutationLease = {\n    db,\n    authorityHash,\n    actorEpoch,\n    requestId: crypto.randomUUID(),\n    refreshTimer: null,\n    deadlineTimer: null,\n    fatalTimer: null,\n    expiresAt: new Date(0),\n    localFatalDeadlineMonotonicMs: 0,\n    runtime: actorMutationLeaseRuntime,\n    abortController: new AbortController(),\n    poisoned: null,\n    actorTransitionApplied: false,\n  };\n  const acquireStartedAtMonotonicMs = lease.runtime.monotonicNow();\n  try {\n    lease.expiresAt = await acquireManagedAuthActorMutationLease(db, {\n      authorityHash,\n      actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    });\n  } catch (error) {\n    if (\n      error instanceof ManagedAuthSessionSetGenerationConflictError ||\n      error instanceof ManagedAuthSessionSetAuthorityError\n    ) {\n      throw new ManagedAuthActorChangeError();\n    }\n    throw error;\n  }\n  lease.localFatalDeadlineMonotonicMs =\n    acquireStartedAtMonotonicMs +\n    ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n    ACTOR_MUTATION_FATAL_SAFETY_MS;\n  actorMutationLeaseByRequest.set(request, lease);\n  scheduleActorMutationLeaseRefresh(request, lease);\n  lease.deadlineTimer = lease.runtime.schedule(() => {\n    poisonActorMutationLease(\n      request,\n      lease,\n      new Error(\"managed actor mutation handler exceeded its bounded lifetime\"),\n    );\n  }, ACTOR_MUTATION_HANDLER_DEADLINE_MS);\n}\n\nfunction scheduleActorMutationLeaseRefresh(request: Request, lease: ActorMutationLease): void {\n  const timer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    const refreshStartedAtMonotonicMs = lease.runtime.monotonicNow();\n    void acquireManagedAuthActorMutationLease(lease.db, {\n      authorityHash: lease.authorityHash,\n      actorEpoch: lease.actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    })\n      .then(async (expiresAt) => {\n        if (actorMutationLeaseByRequest.get(request) !== lease) {\n          // Release may have won while this pooled acquire statement was in\n          // flight. Converge the just-renewed row immediately; never resurrect\n          // a request-owned fence after the outer handler has settled.\n          await releaseManagedAuthActorMutationLease(lease.db, {\n            authorityHash: lease.authorityHash,\n            requestId: lease.requestId,\n          });\n          return;\n        }\n        lease.expiresAt = expiresAt;\n        lease.localFatalDeadlineMonotonicMs =\n          refreshStartedAtMonotonicMs +\n          ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n          ACTOR_MUTATION_FATAL_SAFETY_MS;\n        scheduleActorMutationLeaseRefresh(request, lease);\n      })\n      .catch((error) => poisonActorMutationLease(request, lease, error));\n  }, ACTOR_MUTATION_LEASE_REFRESH_MS);\n  lease.refreshTimer = timer;\n}\n\nfunction poisonActorMutationLease(\n  request: Request,\n  lease: ActorMutationLease,\n  error: unknown,\n): void {\n  if (actorMutationLeaseByRequest.get(request) !== lease || lease.poisoned !== null) return;\n  lease.poisoned = error;\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  lease.refreshTimer = null;\n  lease.abortController.abort(error);\n  const fatalAfterMs = Math.max(\n    0,\n    lease.localFatalDeadlineMonotonicMs - lease.runtime.monotonicNow(),\n  );\n  lease.fatalTimer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    // A handler that ignored cooperative cancellation must not outlive the\n    // durable fence and resume under a later actor. Terminate this API\n    // instance before PostgreSQL can expire the lease; process death is the\n    // final multi-replica-safe cancellation boundary.\n    lease.runtime.terminate();\n  }, fatalAfterMs);\n}\n\nfunction unrefTimer<T extends ReturnType<typeof setTimeout>>(timer: T): T {\n  (timer as T & { unref?: () => void }).unref?.();\n  return timer;\n}\n\nfunction requestCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\");\n    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;\n    const value = part.slice(separator + 1).trim();\n    if (!value || value.length > 512) return null;\n    try {\n      return decodeURIComponent(value);\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\nfunction setCookieHeaders(headers: Headers): string[] {\n  const getSetCookie = (\n    headers as Headers & {\n      getSetCookie?: () => string[];\n    }\n  ).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  const cookie = headers.get(\"set-cookie\");\n  return cookie ? [cookie] : [];\n}\n"],"mappings":";;;;;;;;;AAGA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C,SAAS,qBAAqB;AAU9B,IAAM,+BAA+B,KAAK;AAC1C,IAAM,kCAAkC,IAAI,KAAK;AACjD,IAAM,qCAAqC,KAAK,KAAK;AACrD,IAAM,iCAAiC;AAOvC,IAAM,sCAAiE;AAAA,EACrE,cAAc,MAAM,YAAY,IAAI;AAAA,EACpC,UAAU,CAAC,UAAU,YAAY,WAAW,WAAW,UAAU,OAAO,CAAC;AAAA,EACzE,QAAQ,CAAC,UAAU,aAAa,KAAK;AAAA,EACrC,WAAW,MAAM;AACf,YAAQ,OAAO,MAAM,4DAA4D;AACjF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AACA,IAAI,4BAA4B;AAgBhC,IAAM,8BAA8B,oBAAI,QAAqC;AAC7E,IAAM,6BAA6B,oBAAI,QAAyB;AAChE,IAAM,iCAAiC,oBAAI,QAAiD;AAS5F,eAAsB,kBACpB,GACA,MACA,SAMA;AACA,QAAM,iBAAiB,SAAS,kBAAkB;AAClD,MAAI,mBAAmB,YAAY,SAAS,MAAM,QAAQ,gBAAgB;AACxE,UAAM,YAAY,cAAc,EAAE,IAAI,KAAK,+BAA+B;AAC1E,QAAI,WAAW;AACb,UAAI;AAKF,cAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cAAM,qBACJ,sBAAsB,EAAE,IAAI,OAAO,+BAA+B,KAAK;AACzE,cAAM,gBACJ,mBAAmB,UAAU,uBAAuB,OAChD,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO,IACpE;AACN,cAAM,WAAW,MAAM,kCAAkC;AAAA,UACvD,IAAI,QAAQ;AAAA,UACZ,SAAS,QAAQ;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,wBACE,OAAO,eAAe,SAAS,OAAO,WAAW,cAAc,QAAQ,KAAK;AAAA,UAC9E,eAAe,QAAQ,yBAAyB;AAAA,QAClD,CAAC;AACD,YAAI,UAAU;AAIZ,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,SAAS,WAAW,UAAU;AACxE,uCAA2B,IAAI,EAAE,IAAI,KAAK,SAAS,WAAW,UAAU;AAAA,UAC1E;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,kBAAkB,SAAS;AAAA,YAC1C,YAAY,SAAS,WAAW;AAAA,UAClC,CAAC;AAAA,QACH;AACA,YAAI,YAAY,CAAC,SAAS,QAAS,QAAO;AAC1C,YAAI,UAAU,SAAS;AACrB,cAAI,kBAAkB,SAAS;AAC/B,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR;AAAA,cACA,SAAS,WAAW;AAAA,YACtB;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,QAAQ;AAAA,cACR;AAAA,cACA;AAAA,cACA,QAAQ,yBAAyB;AAAA,YACnC;AACA,gBAAI,CAAC,aAAc,OAAM,IAAI,4BAA4B;AACzD,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,YAAY;AAClF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,aAAa,iBACtC,UAAU,KAAK,OAAO,aAAa,YACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,8BAAkB;AAAA,UACpB;AACA,iBAAO;AAAA,QACT;AAKA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAIhD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,QAAI,mBAAmB,SAAU,QAAO;AACxC,UAAM,UAAU,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO;AACpF,QAAI,SAAS,SAAS;AACpB,UAAI;AACF,cAAM,UAAU,MAAM,qCAAqC,QAAQ,IAAI,QAAQ,QAAQ,EAAE;AACzF,YAAI,SAAS;AACX,gBAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cACE,QAAQ,eAAe,OACtB,uBAAuB,QAAQ,QAAQ,eAAe,sBACvD,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,MACnD,QAAQ,SAAS,eAAe,QAAQ,KAAK,IAC7C;AACA,kBAAM,IAAI,4BAA4B;AAAA,UACxC;AACA,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,QAAQ,UAAU;AAC5D,uCAA2B,IAAI,EAAE,IAAI,KAAK,QAAQ,UAAU;AAAA,UAC9D;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,QAAQ;AAAA,YACvB,YAAY,QAAQ;AAAA,UACtB,CAAC;AACD,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AACA,kBAAM,UAAU,MAAM;AAAA,cACpB,QAAQ;AAAA,cACR,QAAQ,QAAQ;AAAA,YAClB;AACA,gBACE,SAAS,kBAAkB,QAAQ,iBACnC,QAAQ,eAAe,QAAQ,cAC/B,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,IACnD;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,QAAQ,QAAQ;AACtF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,QAAQ,QAAQ,MACzC,UAAU,KAAK,OAAO,QAAQ,KAAK,IACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,mBAAO;AAAA,UACT;AACA,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAChD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,EACJ;AACA,QAAM,SAAS,MAAM,KAAK,IAAI,WAAW;AAAA,IACvC,SAAS,EAAE,IAAI,IAAI;AAAA,IACnB,eAAe;AAAA,EACjB,CAAC;AAED,aAAW,UAAU,iBAAiB,OAAO,OAAO,GAAG;AACrD,MAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,GAAI,QAAO;AAC3C,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,QAAQ,IAAI;AAAA,IAC5D;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,IACzB,GAAI,QAAQ,0BAA0B,SAClC,CAAC,IACD,EAAE,eAAe,QAAQ,sBAAsB;AAAA,EACrD,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAGO,SAAS,gCAAgC,SAAiC;AAC/E,SAAO,2BAA2B,IAAI,OAAO,KAAK;AACpD;AAEA,SAAS,yBACP,IACA,WACA,MACA,eACA;AACA,SAAO,iCAAiC,IAAI;AAAA,IAC1C,eAAe,kBAAkB,SAAS;AAAA,IAC1C;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA,UAAU;AAAA,EACZ,CAAC,EAAE,KAAK,CAAC,aAAa,UAAU,YAAY,IAAI;AAClD;AAGA,eAAsB,oCAAoC,SAAiC;AACzF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,8BAA4B,OAAO,OAAO;AAC1C,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,MAAI,MAAM,cAAe,OAAM,QAAQ,OAAO,MAAM,aAAa;AACjE,MAAI,MAAM,WAAY,OAAM,QAAQ,OAAO,MAAM,UAAU;AAC3D,QAAM,qCAAqC,MAAM,IAAI;AAAA,IACnD,eAAe,MAAM;AAAA,IACrB,WAAW,MAAM;AAAA,EACnB,CAAC;AACH;AAGO,SAAS,sCAAsC,SAAsC;AAC1F,SAAO,4BAA4B,IAAI,OAAO,GAAG,gBAAgB,UAAU;AAC7E;AAoBA,eAAsB,qCAAqC,SAAiC;AAC1F,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,uBAAwB;AAClC,MAAI,MAAM,aAAa,MAAM;AAC3B,UAAM,IAAI,yCAAyC;AAAA,MACjD,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,sCAAsC,MAAM,IAAI;AAAA,IAClE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,4BAA4B;AACpD;AAEO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EACzD,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,gFAAgF,OAAO;AAAA,EAC/F;AACF;AAGO,SAAS,6CAA6C,SAAwB;AACnF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,MAAO,OAAM,yBAAyB;AAC5C;AAcO,SAAS,yCACd,SACuC;AACvC,SAAO,+BAA+B,IAAI,OAAO,KAAK;AACxD;AAGO,SAAS,qCACd,SAC2C;AAC3C,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,SAAO,QACH;AAAA,IACE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,IACA;AACN;AAEA,SAAS,+BAA+B,QAAyB;AAC/D,SAAO,WAAW,SAAS,WAAW,UAAU,WAAW;AAC7D;AAEA,eAAe,yBACb,SACA,IACA,WACA,YACe;AACf,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,QAAM,gCAAgC,SAAS,IAAI,eAAe,UAAU;AAC9E;AAEA,eAAe,gCACb,SACA,IACA,eACA,YACe;AACf,QAAM,WAAW,4BAA4B,IAAI,OAAO;AACxD,MAAI,UAAU;AACZ,QAAI,SAAS,kBAAkB,iBAAiB,SAAS,eAAe,YAAY;AAClF,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA;AAAA,EACF;AACA,QAAM,QAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,OAAO,WAAW;AAAA,IAC7B,cAAc;AAAA,IACd,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,WAAW,oBAAI,KAAK,CAAC;AAAA,IACrB,+BAA+B;AAAA,IAC/B,SAAS;AAAA,IACT,iBAAiB,IAAI,gBAAgB;AAAA,IACrC,UAAU;AAAA,IACV,wBAAwB;AAAA,EAC1B;AACA,QAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,MAAI;AACF,UAAM,YAAY,MAAM,qCAAqC,IAAI;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QACE,iBAAiB,gDACjB,iBAAiB,qCACjB;AACA,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA,UAAM;AAAA,EACR;AACA,QAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,8BAA4B,IAAI,SAAS,KAAK;AAC9C,oCAAkC,SAAS,KAAK;AAChD,QAAM,gBAAgB,MAAM,QAAQ,SAAS,MAAM;AACjD;AAAA,MACE;AAAA,MACA;AAAA,MACA,IAAI,MAAM,8DAA8D;AAAA,IAC1E;AAAA,EACF,GAAG,kCAAkC;AACvC;AAEA,SAAS,kCAAkC,SAAkB,OAAiC;AAC5F,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AACzC,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AACxD,UAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,SAAK,qCAAqC,MAAM,IAAI;AAAA,MAClD,eAAe,MAAM;AAAA,MACrB,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC,EACE,KAAK,OAAO,cAAc;AACzB,UAAI,4BAA4B,IAAI,OAAO,MAAM,OAAO;AAItD,cAAM,qCAAqC,MAAM,IAAI;AAAA,UACnD,eAAe,MAAM;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB,CAAC;AACD;AAAA,MACF;AACA,YAAM,YAAY;AAClB,YAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,wCAAkC,SAAS,KAAK;AAAA,IAClD,CAAC,EACA,MAAM,CAAC,UAAU,yBAAyB,SAAS,OAAO,KAAK,CAAC;AAAA,EACrE,GAAG,+BAA+B;AAClC,QAAM,eAAe;AACvB;AAEA,SAAS,yBACP,SACA,OACA,OACM;AACN,MAAI,4BAA4B,IAAI,OAAO,MAAM,SAAS,MAAM,aAAa,KAAM;AACnF,QAAM,WAAW;AACjB,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,QAAM,eAAe;AACrB,QAAM,gBAAgB,MAAM,KAAK;AACjC,QAAM,eAAe,KAAK;AAAA,IACxB;AAAA,IACA,MAAM,gCAAgC,MAAM,QAAQ,aAAa;AAAA,EACnE;AACA,QAAM,aAAa,MAAM,QAAQ,SAAS,MAAM;AAC9C,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AAKxD,UAAM,QAAQ,UAAU;AAAA,EAC1B,GAAG,YAAY;AACjB;AAEA,SAAS,WAAoD,OAAa;AACxE,EAAC,MAAqC,QAAQ;AAC9C,SAAO;AACT;AAEA,SAAS,cAAc,SAAkB,MAA6B;AACpE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,YAAY,KAAK,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,MAAM,KAAM;AAC/D,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,CAAC,SAAS,MAAM,SAAS,IAAK,QAAO;AACzC,QAAI;AACF,aAAO,mBAAmB,KAAK;AAAA,IACjC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA4B;AACpD,QAAM,eACJ,QAGA;AACF,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC;AAEA,QAAM,SAAS,QAAQ,IAAI,YAAY;AACvC,SAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AAC9B;","names":[]}

package/dist/dependencies.d.ts

@@ -6,6 +6,7 @@ import type { EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
 import type { createObjectStorage } from "@opengeni/storage";
 import type { ManagedAuth } from "./managed-auth-type.js";
+import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets.js";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types.js";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription.js";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live.js";
@@ -162,6 +163,8 @@ export type AppDependencies = {
      */
     sessionAuthorization?: SessionAuthorizationPort | null;
     managedAuth?: ManagedAuth | null;
+    /** Provider-neutral browser login-slot adapter; required by dual/broker managed auth. */
+    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
     /** Injectable managed-email transport; standalone API defaults to Resend or local capture. */
     managedEmailTransport?: ManagedEmailTransport;
     /** Injectable Codex HTTP transport for deterministic API/provider tests. */

package/dist/domain/sessions.d.ts

@@ -213,6 +213,8 @@ export declare function postUserMessageTurn(input: {
     annotations?: TimelineAnnotation[];
     modelContext?: string | null;
     resources: ResourceRef[];
+    /** Actor-owned resources used only for the exact durable-draft fence. */
+    composerDraftResources?: ResourceRef[];
     model?: string | null;
     reasoningEffort?: Settings["openaiReasoningEffort"] | null;
     latencyMode?: "standard" | "priority" | "fast" | null;
@@ -272,6 +274,8 @@ export declare function acceptSessionUserMessageWithOutcome(deps: AcceptSessionU
     annotations?: SubmittedTimelineAnnotation[];
     modelContext?: string | null;
     resources?: ResourceRef[];
+    /** Actor-owned resources used only for the exact durable-draft fence. */
+    composerDraftResources?: ResourceRef[];
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     latencyMode?: "standard" | "priority" | "fast" | null;

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from "./dependencies.js";
 export * from "./workflow-wake-contract.js";
 export * from "./sandbox-types.js";
 export * from "./managed-auth-type.js";
-export * from "./managed-session.js";
+export { getManagedAuthRequestActorAbortSignal, getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorEpoch, getManagedAuthRequestActorLeaseStamp, getManagedSession, ManagedAuthActorLeaseOutcomeUnknownError, markManagedAuthRequestActorTransitionApplied, releaseManagedAuthRequestActorLease, validateManagedAuthRequestActorLease, type ManagedAuthActorAdmissionStamp, type ManagedAuthActorMutationLeaseStamp, } from "./managed-session.js";
 export * from "./transcription.js";
 export * from "./sandbox/fleet.js";
 export * from "./sandbox/routing.js";
@@ -42,6 +42,7 @@ export * from "./domain/video-generation.js";
 export * from "./domain/video-generation-capabilities.js";
 export * from "./domain/organization-membership-lifecycle.js";
 export * from "./application/new-session-drafts.js";
+export * from "./application/composer-submit.js";
 export * from "./application/session-commands.js";
 export * from "./application/session-tenancy.js";
 export * from "./application/user-resource-grants.js";