@opengeni/core 2.4.0-canary.2 → 2.5.2-canary.0

package/dist/managed-auth-session-sets.d.ts

@@ -0,0 +1,113 @@
+import type { ManagedAuthSessionSetMode, ManagedAuthSessionSetProjection } from "@opengeni/contracts/managed-auth-session-sets";
+import { type Database, type ManagedAuthDatabaseProjection, type ManagedAuthSelectedSession } from "@opengeni/db";
+export declare const MANAGED_AUTH_SESSION_SET_COOKIE: "opengeni.session_set";
+export declare const MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE: "opengeni.login_transaction";
+export declare const MANAGED_AUTH_CSRF_HEADER: "x-opengeni-session-csrf";
+export declare const MANAGED_AUTH_ACTOR_EPOCH_HEADER: "x-opengeni-actor-epoch";
+export declare const MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH: "/v1/auth/session-set/transactions";
+export type ManagedAuthResolvedSession = {
+    session: {
+        id: string;
+        userId: string;
+        [key: string]: unknown;
+    };
+    user: {
+        id: string;
+        email: string;
+        name: string;
+        emailVerified: boolean;
+        [key: string]: unknown;
+    };
+};
+/** Provider-neutral boundary; provider credentials and tokens never cross its output. */
+export interface ManagedAuthSessionAdapter {
+    authenticate(input: {
+        provider: "email_password";
+        transactionId: string;
+        credentials: {
+            email: string;
+            password: string;
+        };
+        headers: Headers;
+    }): Promise<{
+        authSessionId: string;
+    }>;
+    /** Verify an ambient provider cookie without sliding expiry or emitting cookies. */
+    resolveAmbientSession(headers: Headers): Promise<ManagedAuthResolvedSession | null>;
+    resolveSelectedSession(input: ManagedAuthSelectedSession): Promise<ManagedAuthResolvedSession | null>;
+    refreshSelectedSession(input: ManagedAuthSelectedSession): Promise<ManagedAuthResolvedSession | null>;
+    revokeSession(input: {
+        authSessionId: string;
+    }): Promise<void>;
+    /** Dual-mode exact selected-session cookie plus stale provider-cache invalidations. */
+    createLegacySelectedSessionCookies(input: ManagedAuthSelectedSession | null, currentCookieHeader?: string | null): Promise<string[]>;
+}
+export declare class ManagedAuthActorChangeError extends Error {
+    readonly name = "ManagedAuthActorChangeError";
+    readonly code = "actor_change_required";
+    constructor();
+}
+export declare class ManagedAuthRequestAdmissionError extends Error {
+    readonly name = "ManagedAuthRequestAdmissionError";
+    readonly code = "origin_rejected";
+}
+export declare class ManagedAuthCompletionOutcomeUnknownError extends Error {
+    readonly name = "ManagedAuthCompletionOutcomeUnknownError";
+    readonly code = "operation_outcome_unknown";
+    constructor(options?: ErrorOptions);
+}
+export declare function requireManagedAuthActorFence(input: {
+    mode: ManagedAuthSessionSetMode;
+    actorEpoch: string;
+    expectedActorEpoch: string | null;
+    selectedAuthSessionId: string | null;
+    legacyAmbientSessionId?: string | null;
+}): void;
+export declare function managedAuthRandomAuthority(): string;
+export declare function managedAuthSha256(value: string): string;
+export declare function managedAuthCsrfHash(authority: string): string;
+export declare function managedAuthCsrfToken(signingSecret: string, authority: string, generation: string): string;
+export declare function managedAuthTransactionSecret(signingSecret: string, authority: string, operationId: string): string;
+export declare function managedAuthDerivedUuid(namespace: string, value: string): string;
+export declare function managedAuthRequestDigest(value: unknown): string;
+export declare function managedAuthSecretRequestDigest(signingSecret: string, value: unknown): string;
+export declare function withManagedAuthCsrfToken(projection: ManagedAuthDatabaseProjection, signingSecret: string, authority: string): ManagedAuthSessionSetProjection;
+export declare function requireManagedAuthMutationAdmission(input: {
+    request: Request;
+    allowedOrigins: readonly string[];
+    authority: string;
+    signingSecret: string;
+    expectedGeneration: string;
+}): void;
+export declare function resolveManagedAuthSelectedSession(input: {
+    db: Database;
+    adapter: ManagedAuthSessionAdapter;
+    authority: string;
+    mode: ManagedAuthSessionSetMode;
+    expectedActorEpoch: string | null;
+    legacyAmbientSessionId?: string | null;
+    allowRecovery?: boolean;
+}): Promise<{
+    session: ManagedAuthResolvedSession | null;
+    projection: ManagedAuthDatabaseProjection;
+} | null>;
+export declare function authenticateAndAdoptManagedAuthSession(input: {
+    db: Database;
+    adapter: ManagedAuthSessionAdapter;
+    isolatedHeaders: Headers;
+    authority: string;
+    csrfHash: string;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+    transactionId: string;
+    transactionSecret: string;
+    email: string;
+    password: string;
+    mode: ManagedAuthSessionSetMode;
+}): Promise<{
+    projection: ManagedAuthDatabaseProjection;
+    returnIntent: string | null;
+}>;
+export declare function isolatedManagedAuthHeaders(request: Request): Headers;

package/dist/managed-auth-session-sets.js

@@ -0,0 +1,49 @@
+import {
+  MANAGED_AUTH_ACTOR_EPOCH_HEADER,
+  MANAGED_AUTH_CSRF_HEADER,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH,
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  ManagedAuthCompletionOutcomeUnknownError,
+  ManagedAuthRequestAdmissionError,
+  authenticateAndAdoptManagedAuthSession,
+  isolatedManagedAuthHeaders,
+  managedAuthCsrfHash,
+  managedAuthCsrfToken,
+  managedAuthDerivedUuid,
+  managedAuthRandomAuthority,
+  managedAuthRequestDigest,
+  managedAuthSecretRequestDigest,
+  managedAuthSha256,
+  managedAuthTransactionSecret,
+  requireManagedAuthActorFence,
+  requireManagedAuthMutationAdmission,
+  resolveManagedAuthSelectedSession,
+  withManagedAuthCsrfToken
+} from "./chunk-YGOMUGYS.js";
+export {
+  MANAGED_AUTH_ACTOR_EPOCH_HEADER,
+  MANAGED_AUTH_CSRF_HEADER,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE,
+  MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE_PATH,
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  ManagedAuthCompletionOutcomeUnknownError,
+  ManagedAuthRequestAdmissionError,
+  authenticateAndAdoptManagedAuthSession,
+  isolatedManagedAuthHeaders,
+  managedAuthCsrfHash,
+  managedAuthCsrfToken,
+  managedAuthDerivedUuid,
+  managedAuthRandomAuthority,
+  managedAuthRequestDigest,
+  managedAuthSecretRequestDigest,
+  managedAuthSha256,
+  managedAuthTransactionSecret,
+  requireManagedAuthActorFence,
+  requireManagedAuthMutationAdmission,
+  resolveManagedAuthSelectedSession,
+  withManagedAuthCsrfToken
+};
+//# sourceMappingURL=managed-auth-session-sets.js.map

package/dist/managed-auth-session-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/managed-session.d.ts

@@ -1,6 +1,14 @@
 import type { Context } from "hono";
 import type { ManagedAuth } from "./managed-auth-type.js";
 import type { Database } from "@opengeni/db";
+import type { ManagedAuthSessionSetMode } from "@opengeni/contracts/managed-auth-session-sets";
+import { type ManagedAuthSessionAdapter } from "./managed-auth-session-sets.js";
+type ActorMutationLeaseRuntime = {
+    monotonicNow: () => number;
+    schedule: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;
+    cancel: (timer: ReturnType<typeof setTimeout>) => void;
+    terminate: () => void;
+};
 /**
  * Read a Better Auth session without bypassing its sliding-cookie renewal.
  *
@@ -9,9 +17,11 @@ import type { Database } from "@opengeni/db";
  * headers; the HTTP handler does this automatically, but direct API calls do not.
  */
 export declare function getManagedSession(c: Context, auth: ManagedAuth, options?: {
-    db?: Database;
-    allowIdentityRecovery?: boolean;
-}): Promise<{
+    db?: Database | undefined;
+    allowIdentityRecovery?: boolean | undefined;
+    sessionSetMode?: ManagedAuthSessionSetMode | undefined;
+    sessionAdapter?: ManagedAuthSessionAdapter | null | undefined;
+}): Promise<import("./managed-auth-session-sets.js").ManagedAuthResolvedSession | {
     session: {
         id: string;
         createdAt: Date;
@@ -55,3 +65,37 @@ export declare function getManagedSession(c: Context, auth: ManagedAuth, options
         image?: string | null | undefined;
     };
 } | null>;
+/** Safe response provenance for a request authenticated through session-set authority. */
+export declare function getManagedAuthRequestActorEpoch(request: Request): string | null;
+/** Release the multi-replica actor fence after the outer HTTP handler settles. */
+export declare function releaseManagedAuthRequestActorLease(request: Request): Promise<void>;
+/** Cooperative cancellation signal for actor-scoped provider/external I/O. */
+export declare function getManagedAuthRequestActorAbortSignal(request: Request): AbortSignal | null;
+/** @internal Deterministic lease-clock seam used only by direct lifecycle tests. */
+export declare function installManagedAuthActorLeaseRuntimeForTest(overrides: Partial<ActorMutationLeaseRuntime>): () => void;
+/**
+ * Exact post-handler fence. A finite unsafe response is not released unless
+ * its request-owned lease is still live at the same actor epoch.
+ */
+export declare function validateManagedAuthRequestActorLease(request: Request): Promise<void>;
+export declare class ManagedAuthActorLeaseOutcomeUnknownError extends Error {
+    readonly name = "ManagedAuthActorLeaseOutcomeUnknownError";
+    readonly code = "operation_outcome_unknown";
+    constructor(options?: ErrorOptions);
+}
+/** A known-applied same-request canonical transition intentionally consumes its lease. */
+export declare function markManagedAuthRequestActorTransitionApplied(request: Request): void;
+export type ManagedAuthActorMutationLeaseStamp = {
+    authorityHash: string;
+    actorEpoch: string;
+    requestId: string;
+};
+export type ManagedAuthActorAdmissionStamp = {
+    authorityHash: string;
+    actorEpoch: string;
+};
+/** Verified server-owned actor evidence available to both reads and mutations. */
+export declare function getManagedAuthRequestActorAdmissionStamp(request: Request): ManagedAuthActorAdmissionStamp | null;
+/** Exact request-owned fence passed into a same-transaction actor transition. */
+export declare function getManagedAuthRequestActorLeaseStamp(request: Request): ManagedAuthActorMutationLeaseStamp | null;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.4.0-canary.2",
+  "version": "2.5.2-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -34,6 +34,10 @@
       "types": "./dist/canonical-human-identities.d.ts",
       "import": "./dist/canonical-human-identities.js"
     },
+    "./managed-auth-session-sets": {
+      "types": "./dist/managed-auth-session-sets.d.ts",
+      "import": "./dist/managed-auth-session-sets.js"
+    },
     "./connection-authority": {
       "types": "./dist/domain/connection-authority.d.ts",
       "import": "./dist/domain/connection-authority.js"
@@ -50,15 +54,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.19-canary.3",
-    "@opengeni/config": "^0.20.1-canary.2",
-    "@opengeni/contracts": "^2.5.0-canary.2",
-    "@opengeni/db": "^3.4.0-canary.2",
-    "@opengeni/documents": "^0.8.2-canary.2",
-    "@opengeni/events": "^0.4.0-canary.2",
-    "@opengeni/observability": "^0.8.6-canary.2",
-    "@opengeni/runtime": "^1.4.0-canary.2",
-    "@opengeni/storage": "^0.2.108-canary.2",
+    "@opengeni/codex": "^0.2.19-canary.4",
+    "@opengeni/config": "^0.21.0-canary.0",
+    "@opengeni/contracts": "^2.6.0-canary.0",
+    "@opengeni/db": "^3.5.2-canary.0",
+    "@opengeni/documents": "^0.8.5-canary.0",
+    "@opengeni/events": "^0.4.3-canary.0",
+    "@opengeni/observability": "^0.8.8-canary.0",
+    "@opengeni/runtime": "^1.4.1-canary.0",
+    "@opengeni/storage": "^0.2.109-canary.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -18,6 +18,7 @@ import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
 import type { ManagedAuth } from "../managed-auth-type";
 import { getManagedSession } from "../managed-session";
+import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets";
 
 const bearerPrefix = "Bearer ";
 const accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null>>();
@@ -61,6 +62,7 @@ export type AccessDeps = {
   db: Database;
   settings: Settings;
   managedAuth?: ManagedAuth | null;
+  managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
 };
 
 export async function requireAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext> {
@@ -377,7 +379,11 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
   }
 
   if (deps.managedAuth) {
-    const session = await getManagedSession(c, deps.managedAuth, { db: deps.db });
+    const session = await getManagedSession(c, deps.managedAuth, {
+      db: deps.db,
+      sessionSetMode: deps.settings.managedAuthSessionSetMode,
+      sessionAdapter: deps.managedAuthSessionAdapter,
+    });
     if (session?.user) {
       // THE canonical managed-cookie (Better Auth) branch, and the only place
       // that may stamp a context as such. Every `return` above this point leaves
@@ -389,6 +395,7 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
         name: session.user.name,
         emailVerified: session.user.emailVerified,
         provisionFallbackOrganization: false,
+        bindPendingInvitations: false,
       });
       canonicalManagedCookieContexts.add(context);
       return context;

package/src/application/composer-submit.ts

@@ -0,0 +1,76 @@
+import type {
+  AccessGrant,
+  ResourceRef,
+  SubmitComposerDraftRequest,
+  SubmitComposerDraftResponse,
+} from "@opengeni/contracts";
+import type { AccessGrantAuthorization } from "../access";
+import type { AcceptSessionUserMessageDependencies } from "../dependencies";
+import { acceptSessionUserMessageWithOutcome } from "../domain/sessions";
+
+export type SubmitComposerDraftForRequestOptions = {
+  authorization?: AccessGrantAuthorization | undefined;
+  /**
+   * Trusted host-owned resources admitted with this command without writing
+   * them into the actor's browser-visible draft first. The saved draft remains
+   * the exact content fence for actor-owned text, annotations, resources, and
+   * execution policy; these resources participate in the accepted command's
+   * idempotency hash, validation, turn, and durable session resource set.
+   */
+  additionalResources?: ResourceRef[] | undefined;
+};
+
+/**
+ * Atomically accept one established-session composer draft.
+ *
+ * This is the application boundary shared by the stock HTTP adapter and an
+ * in-process embedding host. A host may prepare its own durable business state
+ * before calling this function and project the returned receipt afterward, but
+ * OpenGeni remains the sole authority for draft validation/rotation, event
+ * append, turn creation, routing, and idempotent replay.
+ */
+export async function submitComposerDraftForRequest(
+  deps: AcceptSessionUserMessageDependencies,
+  grant: AccessGrant,
+  workspaceId: string,
+  sessionId: string,
+  input: SubmitComposerDraftRequest,
+  options: SubmitComposerDraftForRequestOptions = {},
+): Promise<SubmitComposerDraftResponse> {
+  const additionalResources = options.additionalResources ?? [];
+  const result = await acceptSessionUserMessageWithOutcome(deps, grant, workspaceId, sessionId, {
+    text: input.text,
+    annotations: input.annotations,
+    modelContext: input.modelContext ?? null,
+    resources: [...input.resources, ...additionalResources],
+    ...(additionalResources.length > 0 ? { composerDraftResources: input.resources } : {}),
+    model: input.model,
+    reasoningEffort: input.reasoningEffort,
+    latencyMode: input.latencyMode,
+    mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+    connectionAuthorities: input.connectionAuthorities,
+    ...(input.personalResourceAttachment
+      ? { personalResourceAttachment: input.personalResourceAttachment }
+      : {}),
+    ...(options.authorization ? { authorization: options.authorization } : {}),
+    delivery: input.delivery,
+    origin: "human",
+    expectedDraftRevision: input.expectedDraftRevision,
+    clientEventId: input.clientEventId,
+    ...(input.controlEtag ? { controlEtag: input.controlEtag } : {}),
+  });
+
+  if (!result.draft) {
+    throw new Error("Accepted composer draft submission did not return its next draft");
+  }
+
+  return {
+    accepted: result.accepted,
+    turn: result.turn,
+    draft: result.draft,
+    receipt: result.receipt,
+    routing: result.routing,
+    interruptionCount: result.interruptionCount,
+    replay: result.replay,
+  };
+}

package/src/application/session-commands.ts

@@ -511,26 +511,38 @@ export async function controlAgentSessionWorkstream(
     },
   );
   scheduleSessionCommandPostCommit(deps, "agent_control", [
-    {
-      kind: "session_event_fanout",
-      run: async () =>
-        await publishSessionEventIds(deps, context.workspaceId, input.targetSessionId, [
-          result.sessionControlEventId,
-        ]),
-    },
-    {
-      kind: "workspace_control_fanout",
-      run: async () =>
-        await publishWorkspaceControlEvent(
-          deps,
-          context.workspaceId,
-          result.workspaceControlEventId,
-        ),
-    },
-    {
-      kind: "workflow_wake",
-      run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
-    },
+    ...(result.sessionControlEventId
+      ? [
+          {
+            kind: "session_event_fanout" as const,
+            run: async () =>
+              await publishSessionEventIds(deps, context.workspaceId, input.targetSessionId, [
+                result.sessionControlEventId!,
+              ]),
+          },
+        ]
+      : []),
+    ...(result.workspaceControlEventId
+      ? [
+          {
+            kind: "workspace_control_fanout" as const,
+            run: async () =>
+              await publishWorkspaceControlEvent(
+                deps,
+                context.workspaceId,
+                result.workspaceControlEventId!,
+              ),
+          },
+        ]
+      : []),
+    ...(result.wakeCount > 0
+      ? [
+          {
+            kind: "workflow_wake" as const,
+            run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
+          },
+        ]
+      : []),
     {
       kind: "workflow_wake",
       run: async () => {
@@ -832,7 +844,11 @@ export async function controlHumanSessionWorkstreamWithOutcome(
   } & SessionCommandPostCommitDeps,
   context: HumanSessionCommandContext,
   input: SessionControlRequest,
-): Promise<{ response: SessionControlResponse; replay: boolean }> {
+): Promise<{
+  response: SessionControlResponse;
+  outcome: "changed" | "unchanged" | "replayed";
+  replay: boolean;
+}> {
   const authorization = await authorizeHumanSessionCommand(deps, context, "session.control");
   const result = await runSessionCommandPersistenceTransaction(
     deps,
@@ -879,19 +895,27 @@ export async function controlHumanSessionWorkstreamWithOutcome(
           affected.eventIds,
         ),
     })),
-    {
-      kind: "workspace_control_fanout",
-      run: async () =>
-        await publishWorkspaceControlEvent(
-          deps,
-          context.workspaceId,
-          result.workspaceControlEventId,
-        ),
-    },
-    {
-      kind: "workflow_wake",
-      run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
-    },
+    ...(result.workspaceControlEventId
+      ? [
+          {
+            kind: "workspace_control_fanout" as const,
+            run: async () =>
+              await publishWorkspaceControlEvent(
+                deps,
+                context.workspaceId,
+                result.workspaceControlEventId!,
+              ),
+          },
+        ]
+      : []),
+    ...(result.wakeCount > 0
+      ? [
+          {
+            kind: "workflow_wake" as const,
+            run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
+          },
+        ]
+      : []),
     {
       kind: "workflow_wake",
       run: async () => {
@@ -909,7 +933,7 @@ export async function controlHumanSessionWorkstreamWithOutcome(
       },
     },
   ]);
-  return { response, replay: result.replay };
+  return { response, outcome: result.outcome, replay: result.replay };
 }
 
 /** Backward-compatible response path used by the REST control route. */
@@ -952,19 +976,27 @@ export async function controlHumanWorkspace(
     wakeCount: result.wakeCount,
   };
   scheduleSessionCommandPostCommit(deps, "human_workspace_control", [
-    {
-      kind: "workspace_control_fanout",
-      run: async () =>
-        await publishWorkspaceControlEvent(
-          deps,
-          context.workspaceId,
-          result.workspaceControlEventId,
-        ),
-    },
-    {
-      kind: "workflow_wake",
-      run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
-    },
+    ...(result.workspaceControlEventId
+      ? [
+          {
+            kind: "workspace_control_fanout" as const,
+            run: async () =>
+              await publishWorkspaceControlEvent(
+                deps,
+                context.workspaceId,
+                result.workspaceControlEventId!,
+              ),
+          },
+        ]
+      : []),
+    ...(result.wakeCount > 0
+      ? [
+          {
+            kind: "workflow_wake" as const,
+            run: async () => await requestControlWakeDispatch(deps, result.wakeCount),
+          },
+        ]
+      : []),
   ]);
   return response;
 }

package/src/canonical-human-identities.ts

@@ -3,6 +3,13 @@ import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
 import type { ManagedAuth } from "./managed-auth-type";
 import { getManagedSession } from "./managed-session";
+export {
+  getManagedAuthRequestActorAdmissionStamp,
+  getManagedAuthRequestActorLeaseStamp,
+  markManagedAuthRequestActorTransitionApplied,
+} from "./managed-session";
+import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
+import type { ManagedAuthSessionSetMode } from "@opengeni/contracts/managed-auth-session-sets";
 
 export type CanonicalHumanRequestIdentity = {
   authUserId: string;
@@ -11,17 +18,29 @@ export type CanonicalHumanRequestIdentity = {
 
 export async function requireCanonicalHumanRequestIdentity(
   context: Context,
-  input: { db: Database; managedAuth?: ManagedAuth | null; allowRecovery?: boolean },
+  input: {
+    db: Database;
+    managedAuth?: ManagedAuth | null | undefined;
+    managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null | undefined;
+    managedAuthSessionSetMode?: ManagedAuthSessionSetMode | undefined;
+    allowRecovery?: boolean | undefined;
+  },
 ): Promise<CanonicalHumanRequestIdentity> {
   if (!input.managedAuth) {
-    throw new HTTPException(404, { message: "Canonical human identity is unavailable" });
+    throw new HTTPException(404, {
+      message: "Canonical human identity is unavailable",
+    });
   }
   const session = await getManagedSession(context, input.managedAuth, {
     db: input.db,
+    sessionAdapter: input.managedAuthSessionAdapter,
+    sessionSetMode: input.managedAuthSessionSetMode,
     ...(input.allowRecovery === undefined ? {} : { allowIdentityRecovery: input.allowRecovery }),
   });
   if (!session?.user || typeof session.session?.id !== "string") {
-    throw new HTTPException(401, { message: "Managed human authentication required" });
+    throw new HTTPException(401, {
+      message: "Managed human authentication required",
+    });
   }
   return { authUserId: session.user.id, authSessionId: session.session.id };
 }

package/src/dependencies.ts

@@ -15,6 +15,7 @@ import type { EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
 import type { createObjectStorage } from "@opengeni/storage";
 import type { ManagedAuth } from "./managed-auth-type";
+import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live";
@@ -177,6 +178,8 @@ export type AppDependencies = {
    */
   sessionAuthorization?: SessionAuthorizationPort | null;
   managedAuth?: ManagedAuth | null;
+  /** Provider-neutral browser login-slot adapter; required by dual/broker managed auth. */
+  managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
   /** Injectable managed-email transport; standalone API defaults to Resend or local capture. */
   managedEmailTransport?: ManagedEmailTransport;
   /** Injectable Codex HTTP transport for deterministic API/provider tests. */