@opengeni/core 3.0.1 → 3.1.2

package/src/user-presence.ts

@@ -0,0 +1,134 @@
+import { recordUserActivityPresence, type Database } from "@opengeni/db";
+import type { Observability } from "@opengeni/observability";
+
+/**
+ * Throttled, batched server-side presence for managed humans.
+ *
+ * `touch` is called on the request path, so it only does an in-memory map
+ * check: each person is queued at most once per throttle window per process,
+ * and queued people are written in one batched database call after a short
+ * delay, never awaited by the request. API keys, services and embedded-host
+ * subjects are never passed here; anything outside the opaque `user:` shape is
+ * ignored. The database turns a new UTC day into the `user.active` lifecycle
+ * fact, and control workers read windowed counts for `opengeni_active_users`.
+ */
+export type UserPresenceRecorder = {
+  /** Note authenticated activity for one managed human. Never throws. */
+  touch(subjectId: string): void;
+  /** Write everything queued now. Resolves even when the write fails. */
+  flush(): Promise<void>;
+  /** Flush and stop scheduling further writes. */
+  close(): Promise<void>;
+};
+
+export const USER_PRESENCE_THROTTLE_MS = 60_000;
+export const USER_PRESENCE_FLUSH_DELAY_MS = 5_000;
+const USER_PRESENCE_MAX_TRACKED = 50_000;
+const USER_PRESENCE_SUBJECT = /^user:[A-Za-z0-9_-]{8,128}$/;
+
+const PRESENCE_FLUSH_METRIC = {
+  name: "opengeni_user_presence_flushes_total",
+  help: "Batched user presence writes from this API process by outcome.",
+} as const;
+
+export function createUserPresenceRecorder(options: {
+  db: Database;
+  observability?: Pick<Observability, "incrementCounter" | "warn"> | undefined;
+  throttleMs?: number;
+  flushDelayMs?: number;
+  maxTracked?: number;
+  now?: () => number;
+  record?: (db: Database, subjectIds: readonly string[]) => Promise<number>;
+}): UserPresenceRecorder {
+  const throttleMs = options.throttleMs ?? USER_PRESENCE_THROTTLE_MS;
+  const flushDelayMs = options.flushDelayMs ?? USER_PRESENCE_FLUSH_DELAY_MS;
+  const maxTracked = options.maxTracked ?? USER_PRESENCE_MAX_TRACKED;
+  const now = options.now ?? Date.now;
+  const record = options.record ?? recordUserActivityPresence;
+  const lastQueuedAt = new Map<string, number>();
+  const pending = new Set<string>();
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let closed = false;
+  let lastWarningAt = 0;
+  let tail: Promise<void> = Promise.resolve();
+
+  const count = (outcome: "ok" | "failed") => {
+    try {
+      options.observability?.incrementCounter({ ...PRESENCE_FLUSH_METRIC, labels: { outcome } });
+    } catch {
+      // Telemetry only.
+    }
+  };
+
+  const prune = (at: number) => {
+    for (const [subject, queuedAt] of lastQueuedAt) {
+      if (at - queuedAt >= throttleMs && !pending.has(subject)) lastQueuedAt.delete(subject);
+    }
+    // Still over the bound: forget the oldest entries; at worst a person is
+    // written once more than the throttle would allow.
+    if (lastQueuedAt.size > maxTracked) {
+      const excess = lastQueuedAt.size - maxTracked;
+      let removed = 0;
+      for (const subject of lastQueuedAt.keys()) {
+        if (removed >= excess) break;
+        if (pending.has(subject)) continue;
+        lastQueuedAt.delete(subject);
+        removed += 1;
+      }
+    }
+  };
+
+  const writeBatch = async (): Promise<void> => {
+    if (pending.size === 0) return;
+    const batch = [...pending];
+    pending.clear();
+    try {
+      await record(options.db, batch);
+      count("ok");
+    } catch (error) {
+      // Let the next touch retry these people instead of waiting a window.
+      for (const subject of batch) lastQueuedAt.delete(subject);
+      count("failed");
+      const at = now();
+      if (at - lastWarningAt >= throttleMs) {
+        lastWarningAt = at;
+        options.observability?.warn("user presence write failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      }
+    }
+  };
+
+  const flush = (): Promise<void> => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    tail = tail.then(writeBatch, writeBatch);
+    return tail;
+  };
+
+  return {
+    touch(subjectId) {
+      if (closed || !USER_PRESENCE_SUBJECT.test(subjectId)) return;
+      const at = now();
+      const previous = lastQueuedAt.get(subjectId);
+      if (previous !== undefined && at - previous < throttleMs) return;
+      lastQueuedAt.set(subjectId, at);
+      pending.add(subjectId);
+      if (lastQueuedAt.size > maxTracked) prune(at);
+      if (!timer) {
+        timer = setTimeout(() => {
+          timer = null;
+          void flush();
+        }, flushDelayMs);
+        (timer as ReturnType<typeof setTimeout> & { unref?: () => void }).unref?.();
+      }
+    },
+    flush,
+    async close() {
+      closed = true;
+      await flush();
+    },
+  };
+}

package/src/workflow-wake-contract.ts

@@ -1,8 +1,21 @@
-/** One global Temporal Schedule owns bounded delivery of committed session wakes. */
+/**
+ * Legacy id of the Temporal Schedule that used to start the dispatcher every
+ * period whether or not anything was due. Current control workers delete it at
+ * startup; older releases recreate it, so a rollback keeps its repair cadence.
+ */
 export const SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID =
   "opengeni-session-workflow-wake-dispatcher";
 export const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE =
   "sessionWorkflowWakeDispatcherWorkflow";
+/**
+ * The single dispatcher execution. Immediate triggers and the control
+ * worker's repair cadence signal-with-start this id, so a request that lands
+ * while a sweep is running buffers exactly one more sweep instead of starting
+ * a second execution.
+ */
+export const SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_ID =
+  "opengeni-session-workflow-wake-dispatcher";
+export const SESSION_WORKFLOW_WAKE_DISPATCH_REQUESTED_SIGNAL = "dispatchRequested";
 export const SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 10_000;
 
 /**

package/dist/application/host-mcp-owner.d.ts

@@ -1,6 +0,0 @@
-import { type Database } from "@opengeni/db";
-import { type AccessGrantAuthorization } from "../access/index.js";
-/** Direct user admission only. Agents inherit exact accepted snapshots instead.
- * Native and externally represented users share owner semantics; service keys
- * cannot impersonate a human owner merely by naming a subject. */
-export declare function prepareHostMcpOwnerAuthorization(authorization: AccessGrantAuthorization, workspaceId: string, permission: "connections:read" | "connections:write"): (tx: Database) => Promise<import("@opengeni/db").HostMcpBindingOwner>;

package/dist/application/host-mcp-resolvers.d.ts

@@ -1,13 +0,0 @@
-import type { Context } from "hono";
-import { type AccessDeps } from "../access/index.js";
-export declare function hostMcpResolverForRequest(context: Context, deps: AccessDeps, organizationId: string, source: string, method: "get" | "put" | "revoke", raw?: unknown): Promise<{
-    id: string;
-    organizationId: string;
-    externalSource: string;
-    url: string;
-    timeoutMs: number;
-    generation: number;
-    status: "active" | "revoked";
-    createdAt: string;
-    updatedAt: string;
-}>;

package/dist/chunk-5WZYFL45.js

@@ -1,266 +0,0 @@
-// src/remote-mcp-credentials.ts
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
-import {
-  resolveHostMcpResolverRoute,
-  hostMcpResolverRouteIsCurrent
-} from "@opengeni/db";
-import {
-  McpConnectionResourceScope,
-  hostMcpCredentialUseGuard
-} from "@opengeni/contracts";
-import { pinnedFetch, readResponseJsonBounded, validateHttpUrl } from "@opengeni/network";
-import { z } from "zod";
-var configuration = z.array(
-  z.object({
-    accountId: z.string().uuid(),
-    url: z.string().max(2048),
-    bearerToken: z.string().min(1).max(8192).regex(/^[^\r\n]+$/),
-    timeoutMs: z.number().int().min(100).max(3e4).default(1e4)
-  }).strict()
-).max(128);
-var scope = {
-  accountId: z.string(),
-  workspaceId: z.string(),
-  sessionId: z.string(),
-  providerDomain: z.string(),
-  provider: z.string().optional(),
-  scopes: z.array(z.string()).max(256).optional(),
-  resource: z.string().optional(),
-  selectedResources: z.array(McpConnectionResourceScope).max(256).optional()
-};
-var resolution = z.discriminatedUnion("status", [
-  z.object({
-    ...scope,
-    status: z.literal("ok"),
-    connectionId: z.string().min(1),
-    headers: z.record(z.string(), z.string()),
-    placements: z.array(
-      z.object({
-        carrier: z.enum(["header", "query", "cookie"]),
-        name: z.string(),
-        value: z.string(),
-        prefix: z.string().optional()
-      }).strict()
-    ).max(64).optional(),
-    expiresAt: z.string().datetime({ offset: true })
-  }).strict(),
-  z.object({
-    ...scope,
-    status: z.literal("auth_needed"),
-    connectionId: z.string().optional(),
-    reason: z.enum([
-      "missing_connection",
-      "expired",
-      "insufficient_scope",
-      "refresh_failed",
-      "personal_authority_unavailable",
-      "unsupported_auth",
-      "resource_scope_unavailable"
-    ]),
-    authorizationUrl: z.string().optional()
-  }).strict()
-]);
-var gatewayResolution = z.discriminatedUnion("status", [
-  resolution.options[0].omit({ sessionId: true }).extend({ requestId: z.string().uuid() }),
-  resolution.options[1].omit({ sessionId: true }).extend({ requestId: z.string().uuid() })
-]);
-var responseEnvelope = z.object({
-  version: z.literal(1),
-  requestId: z.string().uuid(),
-  destinationUrl: z.string(),
-  resolution: z.union([resolution, gatewayResolution])
-}).strict();
-function normalizeResolution(value) {
-  const common = {
-    accountId: value.accountId,
-    workspaceId: value.workspaceId,
-    ..."sessionId" in value ? { sessionId: value.sessionId } : { requestId: value.requestId },
-    providerDomain: value.providerDomain,
-    ...value.provider !== void 0 ? { provider: value.provider } : {},
-    ...value.scopes !== void 0 ? { scopes: value.scopes } : {},
-    ...value.resource !== void 0 ? { resource: value.resource } : {},
-    ...value.selectedResources !== void 0 ? { selectedResources: value.selectedResources } : {}
-  };
-  if (value.status === "auth_needed")
-    return {
-      ...common,
-      status: "auth_needed",
-      reason: value.reason,
-      ...value.connectionId !== void 0 ? { connectionId: value.connectionId } : {},
-      ...value.authorizationUrl !== void 0 ? { authorizationUrl: value.authorizationUrl } : {}
-    };
-  return {
-    ...common,
-    status: "ok",
-    connectionId: value.connectionId,
-    headers: value.headers,
-    expiresAt: value.expiresAt,
-    ...value.placements !== void 0 ? {
-      placements: value.placements.map((placement) => ({
-        carrier: placement.carrier,
-        name: placement.name,
-        value: placement.value,
-        ...placement.prefix !== void 0 ? { prefix: placement.prefix } : {}
-      }))
-    } : {}
-  };
-}
-function createRemoteMcpCredentialsPort(settings, transport = pinnedFetch, routes) {
-  if (!settings.hostMcpCredentialResolversJson && !routes) return {};
-  let entries;
-  try {
-    entries = configuration.parse(JSON.parse(settings.hostMcpCredentialResolversJson || "[]"));
-    for (const entry of entries) validateHttpUrl(entry.url);
-    if (new Set(entries.map((entry) => entry.accountId)).size !== entries.length) throw new Error();
-  } catch {
-    throw new Error("Invalid host MCP credential resolver configuration");
-  }
-  const byAccount = new Map(entries.map((entry) => [entry.accountId, entry]));
-  const active = /* @__PURE__ */ new Map();
-  let physicalRequests = 0;
-  const resolveRemote = async (input) => {
-    const serialized = JSON.stringify(input);
-    const request = JSON.parse(serialized);
-    const unavailable = (reason) => ({
-      status: "auth_needed",
-      accountId: request.accountId,
-      workspaceId: request.workspaceId,
-      ..."sessionId" in request ? { sessionId: request.sessionId } : { requestId: request.requestId },
-      providerDomain: request.connectionRef.providerDomain,
-      ...request.connectionRef.provider !== void 0 ? { provider: request.connectionRef.provider } : {},
-      ...request.connectionRef.connectionId !== void 0 ? { connectionId: request.connectionRef.connectionId } : {},
-      ...request.connectionRef.scopes !== void 0 ? { scopes: request.connectionRef.scopes } : {},
-      ...request.connectionRef.resource !== void 0 ? { resource: request.connectionRef.resource } : {},
-      ...request.connectionRef.selectedResources !== void 0 ? { selectedResources: request.connectionRef.selectedResources } : {},
-      reason
-    });
-    let route = { mode: "legacy" };
-    try {
-      if (routes) route = await routes.resolve(request);
-    } catch {
-      return unavailable("refresh_failed");
-    }
-    if (route.mode === "denied") return unavailable("unsupported_auth");
-    const config = route.mode === "namespace" ? route : byAccount.get(request.accountId);
-    if (!config || request.connectionRef.authoritySource !== "host")
-      return unavailable("unsupported_auth");
-    const current = async () => {
-      try {
-        return routes ? await routes.isCurrent(request, route) : true;
-      } catch {
-        return false;
-      }
-    };
-    const finish = async (value) => {
-      if (!await current()) return unavailable("refresh_failed");
-      const result = structuredClone(value);
-      if (result.status === "ok" && routes) result[hostMcpCredentialUseGuard] = current;
-      return result;
-    };
-    if (new TextEncoder().encode(serialized).byteLength > 65536)
-      return unavailable("refresh_failed");
-    const activeKey = JSON.stringify([
-      route.mode === "namespace" ? [route.id, route.generation] : "legacy",
-      serialized
-    ]);
-    const pending = active.get(activeKey);
-    if (pending) return finish(await pending);
-    if (physicalRequests >= 128) return unavailable("refresh_failed");
-    const run = async () => {
-      const requestId = crypto.randomUUID();
-      const controller = new AbortController();
-      let timer;
-      const deadline = new Promise((_, reject) => {
-        timer = setTimeout(() => {
-          controller.abort();
-          reject(new Error("Host resolver deadline"));
-        }, config.timeoutMs);
-      });
-      try {
-        physicalRequests++;
-        return await Promise.race([
-          deadline,
-          (async () => {
-            if (!await current()) return unavailable("refresh_failed");
-            const response = await transport(
-              config.url,
-              {
-                method: "POST",
-                redirect: "manual",
-                signal: controller.signal,
-                headers: {
-                  Authorization: `Bearer ${config.bearerToken}`,
-                  "Content-Type": "application/json"
-                },
-                body: JSON.stringify({ version: 1, requestId, request })
-              },
-              settings,
-              { requireHttpsOutsideLocalTest: true, label: "Host MCP credential resolver" }
-            );
-            if (!response.ok) {
-              await response.body?.cancel();
-              return unavailable("refresh_failed");
-            }
-            const parsed = responseEnvelope.parse(
-              await readResponseJsonBounded(response, 65536, "Host MCP credential resolver", {
-                signal: controller.signal
-              })
-            );
-            if (parsed.requestId !== requestId || parsed.destinationUrl !== request.destinationUrl || parsed.resolution.accountId !== request.accountId || parsed.resolution.workspaceId !== request.workspaceId || ("sessionId" in request ? !("sessionId" in parsed.resolution) || parsed.resolution.sessionId !== request.sessionId : !("requestId" in parsed.resolution) || parsed.resolution.requestId !== request.requestId))
-              return unavailable("refresh_failed");
-            if (parsed.resolution.status === "ok" && (Date.parse(parsed.resolution.expiresAt) <= Date.now() + 5e3 || Date.parse(parsed.resolution.expiresAt) > Date.now() + 9e5)) {
-              return unavailable("refresh_failed");
-            }
-            return normalizeResolution(parsed.resolution);
-          })().finally(() => {
-            physicalRequests--;
-          })
-        ]);
-      } catch {
-        return unavailable("refresh_failed");
-      } finally {
-        clearTimeout(timer);
-      }
-    };
-    const task = run();
-    active.set(activeKey, task);
-    try {
-      return finish(await task);
-    } finally {
-      if (active.get(activeKey) === task) active.delete(activeKey);
-    }
-  };
-  return {
-    mcpAuthoritySource: "host",
-    async mcpCredentials(input) {
-      const result = await resolveRemote(input);
-      if (!("sessionId" in result)) throw new Error("Invalid host turn credential scope");
-      return result;
-    },
-    async mcpGatewayCredentials(input) {
-      const result = await resolveRemote(input);
-      if (!("requestId" in result)) throw new Error("Invalid host gateway credential scope");
-      return result;
-    }
-  };
-}
-function createNativeRemoteMcpCredentialsPort(settings, db, transport = pinnedFetch) {
-  return createRemoteMcpCredentialsPort(settings, transport, {
-    resolve: (request) => resolveHostMcpResolverRoute(db, request, environmentsEncryptionKeyBytes(settings)),
-    isCurrent: (request, route) => hostMcpResolverRouteIsCurrent(db, request, route)
-  });
-}
-function hasLegacyHostMcpResolver(settings, accountId) {
-  try {
-    return configuration.parse(JSON.parse(settings.hostMcpCredentialResolversJson || "[]")).some((entry) => entry.accountId === accountId);
-  } catch {
-    throw new Error("Invalid host MCP credential resolver configuration");
-  }
-}
-
-export {
-  createRemoteMcpCredentialsPort,
-  createNativeRemoteMcpCredentialsPort,
-  hasLegacyHostMcpResolver
-};
-//# sourceMappingURL=chunk-5WZYFL45.js.map

package/dist/chunk-5WZYFL45.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/remote-mcp-credentials.ts"],"sourcesContent":["import type { Settings } from \"@opengeni/config\";\nimport { environmentsEncryptionKeyBytes } from \"@opengeni/config\";\nimport {\n  resolveHostMcpResolverRoute,\n  hostMcpResolverRouteIsCurrent,\n  type Database,\n  type HostMcpResolverRoute,\n} from \"@opengeni/db\";\nimport {\n  McpConnectionResourceScope,\n  hostMcpCredentialUseGuard,\n  type ConnectionCredentialsPort,\n  type McpCredentialsRequest,\n  type McpCredentialResolution,\n  type McpGatewayCredentialsRequest,\n  type McpGatewayCredentialResolution,\n} from \"@opengeni/contracts\";\nimport { pinnedFetch, readResponseJsonBounded, validateHttpUrl } from \"@opengeni/network\";\nimport { z } from \"zod\";\n\nconst configuration = z\n  .array(\n    z\n      .object({\n        accountId: z.string().uuid(),\n        url: z.string().max(2048),\n        bearerToken: z\n          .string()\n          .min(1)\n          .max(8192)\n          .regex(/^[^\\r\\n]+$/),\n        timeoutMs: z.number().int().min(100).max(30_000).default(10_000),\n      })\n      .strict(),\n  )\n  .max(128);\n\nconst scope = {\n  accountId: z.string(),\n  workspaceId: z.string(),\n  sessionId: z.string(),\n  providerDomain: z.string(),\n  provider: z.string().optional(),\n  scopes: z.array(z.string()).max(256).optional(),\n  resource: z.string().optional(),\n  selectedResources: z.array(McpConnectionResourceScope).max(256).optional(),\n};\nconst resolution = z.discriminatedUnion(\"status\", [\n  z\n    .object({\n      ...scope,\n      status: z.literal(\"ok\"),\n      connectionId: z.string().min(1),\n      headers: z.record(z.string(), z.string()),\n      placements: z\n        .array(\n          z\n            .object({\n              carrier: z.enum([\"header\", \"query\", \"cookie\"]),\n              name: z.string(),\n              value: z.string(),\n              prefix: z.string().optional(),\n            })\n            .strict(),\n        )\n        .max(64)\n        .optional(),\n      expiresAt: z.string().datetime({ offset: true }),\n    })\n    .strict(),\n  z\n    .object({\n      ...scope,\n      status: z.literal(\"auth_needed\"),\n      connectionId: z.string().optional(),\n      reason: z.enum([\n        \"missing_connection\",\n        \"expired\",\n        \"insufficient_scope\",\n        \"refresh_failed\",\n        \"personal_authority_unavailable\",\n        \"unsupported_auth\",\n        \"resource_scope_unavailable\",\n      ]),\n      authorizationUrl: z.string().optional(),\n    })\n    .strict(),\n]);\nconst gatewayResolution = z.discriminatedUnion(\"status\", [\n  resolution.options[0].omit({ sessionId: true }).extend({ requestId: z.string().uuid() }),\n  resolution.options[1].omit({ sessionId: true }).extend({ requestId: z.string().uuid() }),\n]);\nconst responseEnvelope = z\n  .object({\n    version: z.literal(1),\n    requestId: z.string().uuid(),\n    destinationUrl: z.string(),\n    resolution: z.union([resolution, gatewayResolution]),\n  })\n  .strict();\n\ntype RemoteResolution = McpCredentialResolution | McpGatewayCredentialResolution;\nfunction normalizeResolution(\n  value: z.infer<typeof resolution> | z.infer<typeof gatewayResolution>,\n): RemoteResolution {\n  const common = {\n    accountId: value.accountId,\n    workspaceId: value.workspaceId,\n    ...(\"sessionId\" in value ? { sessionId: value.sessionId } : { requestId: value.requestId }),\n    providerDomain: value.providerDomain,\n    ...(value.provider !== undefined ? { provider: value.provider } : {}),\n    ...(value.scopes !== undefined ? { scopes: value.scopes } : {}),\n    ...(value.resource !== undefined ? { resource: value.resource } : {}),\n    ...(value.selectedResources !== undefined\n      ? { selectedResources: value.selectedResources }\n      : {}),\n  };\n  if (value.status === \"auth_needed\")\n    return {\n      ...common,\n      status: \"auth_needed\",\n      reason: value.reason,\n      ...(value.connectionId !== undefined ? { connectionId: value.connectionId } : {}),\n      ...(value.authorizationUrl !== undefined ? { authorizationUrl: value.authorizationUrl } : {}),\n    };\n  return {\n    ...common,\n    status: \"ok\",\n    connectionId: value.connectionId,\n    headers: value.headers,\n    expiresAt: value.expiresAt,\n    ...(value.placements !== undefined\n      ? {\n          placements: value.placements.map((placement) => ({\n            carrier: placement.carrier,\n            name: placement.name,\n            value: placement.value,\n            ...(placement.prefix !== undefined ? { prefix: placement.prefix } : {}),\n          })),\n        }\n      : {}),\n  };\n}\n\n/** Optional standalone transport for the existing request-time host port.\n * No successful credential is cached or persisted. The host must authorize\n * every immutable request context, including revocation and binding generation.\n */\nexport function createRemoteMcpCredentialsPort(\n  settings: Pick<\n    Settings,\n    \"hostMcpCredentialResolversJson\" | \"environment\" | \"integrationsAllowPrivateNetworkTargets\"\n  >,\n  transport: typeof pinnedFetch = pinnedFetch,\n  routes?: {\n    resolve: (input: { accountId: string; workspaceId: string }) => Promise<HostMcpResolverRoute>;\n    isCurrent: (\n      input: { accountId: string; workspaceId: string },\n      route: HostMcpResolverRoute,\n    ) => Promise<boolean>;\n  },\n): ConnectionCredentialsPort {\n  if (!settings.hostMcpCredentialResolversJson && !routes) return {};\n  let entries: z.infer<typeof configuration>;\n  try {\n    entries = configuration.parse(JSON.parse(settings.hostMcpCredentialResolversJson || \"[]\"));\n    for (const entry of entries) validateHttpUrl(entry.url);\n    if (new Set(entries.map((entry) => entry.accountId)).size !== entries.length) throw new Error();\n  } catch {\n    // Configuration includes credentials: never return parser input or causes.\n    throw new Error(\"Invalid host MCP credential resolver configuration\");\n  }\n  const byAccount = new Map(entries.map((entry) => [entry.accountId, entry]));\n  const active = new Map<string, Promise<RemoteResolution>>();\n  let physicalRequests = 0;\n  const resolveRemote = async (\n    input: McpCredentialsRequest | McpGatewayCredentialsRequest,\n  ): Promise<RemoteResolution> => {\n    const serialized = JSON.stringify(input);\n    const request: McpCredentialsRequest | McpGatewayCredentialsRequest = JSON.parse(serialized);\n    const unavailable = (reason: \"unsupported_auth\" | \"refresh_failed\"): RemoteResolution => ({\n      status: \"auth_needed\",\n      accountId: request.accountId,\n      workspaceId: request.workspaceId,\n      ...(\"sessionId\" in request\n        ? { sessionId: request.sessionId }\n        : { requestId: request.requestId }),\n      providerDomain: request.connectionRef.providerDomain,\n      ...(request.connectionRef.provider !== undefined\n        ? { provider: request.connectionRef.provider }\n        : {}),\n      ...(request.connectionRef.connectionId !== undefined\n        ? { connectionId: request.connectionRef.connectionId }\n        : {}),\n      ...(request.connectionRef.scopes !== undefined\n        ? { scopes: request.connectionRef.scopes }\n        : {}),\n      ...(request.connectionRef.resource !== undefined\n        ? { resource: request.connectionRef.resource }\n        : {}),\n      ...(request.connectionRef.selectedResources !== undefined\n        ? { selectedResources: request.connectionRef.selectedResources }\n        : {}),\n      reason,\n    });\n    let route: HostMcpResolverRoute = { mode: \"legacy\" };\n    try {\n      if (routes) route = await routes.resolve(request);\n    } catch {\n      return unavailable(\"refresh_failed\");\n    }\n    if (route.mode === \"denied\") return unavailable(\"unsupported_auth\");\n    const config = route.mode === \"namespace\" ? route : byAccount.get(request.accountId);\n    if (!config || request.connectionRef.authoritySource !== \"host\")\n      return unavailable(\"unsupported_auth\");\n    const current = async () => {\n      try {\n        return routes ? await routes.isCurrent(request, route) : true;\n      } catch {\n        return false;\n      }\n    };\n    const finish = async (value: RemoteResolution): Promise<RemoteResolution> => {\n      if (!(await current())) return unavailable(\"refresh_failed\");\n      const result = structuredClone(value);\n      if (result.status === \"ok\" && routes) result[hostMcpCredentialUseGuard] = current;\n      return result;\n    };\n    // Snapshot before any asynchronous operation; never retain mutable caller\n    // objects as the authority for a delayed response.\n    if (new TextEncoder().encode(serialized).byteLength > 65_536)\n      return unavailable(\"refresh_failed\");\n    const activeKey = JSON.stringify([\n      route.mode === \"namespace\" ? [route.id, route.generation] : \"legacy\",\n      serialized,\n    ]);\n    const pending = active.get(activeKey);\n    if (pending) return finish(await pending);\n    if (physicalRequests >= 128) return unavailable(\"refresh_failed\");\n    const run = async (): Promise<RemoteResolution> => {\n      const requestId = crypto.randomUUID();\n      const controller = new AbortController();\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      const deadline = new Promise<never>((_, reject) => {\n        timer = setTimeout(() => {\n          controller.abort();\n          reject(new Error(\"Host resolver deadline\"));\n        }, config.timeoutMs);\n      });\n      try {\n        physicalRequests++;\n        return await Promise.race([\n          deadline,\n          (async () => {\n            if (!(await current())) return unavailable(\"refresh_failed\");\n            const response = await transport(\n              config.url,\n              {\n                method: \"POST\",\n                redirect: \"manual\",\n                signal: controller.signal,\n                headers: {\n                  Authorization: `Bearer ${config.bearerToken}`,\n                  \"Content-Type\": \"application/json\",\n                },\n                body: JSON.stringify({ version: 1, requestId, request }),\n              },\n              settings,\n              { requireHttpsOutsideLocalTest: true, label: \"Host MCP credential resolver\" },\n            );\n            if (!response.ok) {\n              await response.body?.cancel();\n              return unavailable(\"refresh_failed\");\n            }\n            const parsed = responseEnvelope.parse(\n              await readResponseJsonBounded(response, 65_536, \"Host MCP credential resolver\", {\n                signal: controller.signal,\n              }),\n            );\n            if (\n              parsed.requestId !== requestId ||\n              parsed.destinationUrl !== request.destinationUrl ||\n              parsed.resolution.accountId !== request.accountId ||\n              parsed.resolution.workspaceId !== request.workspaceId ||\n              (\"sessionId\" in request\n                ? !(\"sessionId\" in parsed.resolution) ||\n                  parsed.resolution.sessionId !== request.sessionId\n                : !(\"requestId\" in parsed.resolution) ||\n                  parsed.resolution.requestId !== request.requestId)\n            )\n              return unavailable(\"refresh_failed\");\n            if (\n              parsed.resolution.status === \"ok\" &&\n              (Date.parse(parsed.resolution.expiresAt) <= Date.now() + 5_000 ||\n                Date.parse(parsed.resolution.expiresAt) > Date.now() + 900_000)\n            ) {\n              return unavailable(\"refresh_failed\");\n            }\n            // Existing buildHostConnectionTokenResolver validates the precise\n            // connection, provider, scopes, resources and credential placements.\n            return normalizeResolution(parsed.resolution);\n          })().finally(() => {\n            physicalRequests--;\n          }),\n        ]);\n      } catch {\n        return unavailable(\"refresh_failed\");\n      } finally {\n        clearTimeout(timer);\n      }\n    };\n    const task = run();\n    active.set(activeKey, task);\n    try {\n      return finish(await task);\n    } finally {\n      if (active.get(activeKey) === task) active.delete(activeKey);\n    }\n  };\n  return {\n    mcpAuthoritySource: \"host\",\n    async mcpCredentials(input) {\n      const result = await resolveRemote(input);\n      if (!(\"sessionId\" in result)) throw new Error(\"Invalid host turn credential scope\");\n      return result;\n    },\n    async mcpGatewayCredentials(input) {\n      const result = await resolveRemote(input);\n      if (!(\"requestId\" in result)) throw new Error(\"Invalid host gateway credential scope\");\n      return result;\n    },\n  };\n}\n\n/** Native standalone transport; the database remains authoritative on every\n * resolution/use. Embedded in-process ports retain their existing precedence. */\nexport function createNativeRemoteMcpCredentialsPort(\n  settings: Settings,\n  db: Database,\n  transport: typeof pinnedFetch = pinnedFetch,\n): ConnectionCredentialsPort {\n  return createRemoteMcpCredentialsPort(settings, transport, {\n    resolve: (request) =>\n      resolveHostMcpResolverRoute(db, request, environmentsEncryptionKeyBytes(settings)),\n    isCurrent: (request, route) => hostMcpResolverRouteIsCurrent(db, request, route),\n  });\n}\n\n/** Parses only server configuration; never return parser errors containing secrets. */\nexport function hasLegacyHostMcpResolver(\n  settings: Pick<Settings, \"hostMcpCredentialResolversJson\">,\n  accountId: string,\n): boolean {\n  try {\n    return configuration\n      .parse(JSON.parse(settings.hostMcpCredentialResolversJson || \"[]\"))\n      .some((entry) => entry.accountId === accountId);\n  } catch {\n    throw new Error(\"Invalid host MCP credential resolver configuration\");\n  }\n}\n"],"mappings":";AACA,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAMK;AACP,SAAS,aAAa,yBAAyB,uBAAuB;AACtE,SAAS,SAAS;AAElB,IAAM,gBAAgB,EACnB;AAAA,EACC,EACG,OAAO;AAAA,IACN,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,IAC3B,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI;AAAA,IACxB,aAAa,EACV,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,MAAM,YAAY;AAAA,IACrB,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAM,EAAE,QAAQ,GAAM;AAAA,EACjE,CAAC,EACA,OAAO;AACZ,EACC,IAAI,GAAG;AAEV,IAAM,QAAQ;AAAA,EACZ,WAAW,EAAE,OAAO;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,gBAAgB,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,mBAAmB,EAAE,MAAM,0BAA0B,EAAE,IAAI,GAAG,EAAE,SAAS;AAC3E;AACA,IAAM,aAAa,EAAE,mBAAmB,UAAU;AAAA,EAChD,EACG,OAAO;AAAA,IACN,GAAG;AAAA,IACH,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACtB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IAC9B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA,IACxC,YAAY,EACT;AAAA,MACC,EACG,OAAO;AAAA,QACN,SAAS,EAAE,KAAK,CAAC,UAAU,SAAS,QAAQ,CAAC;AAAA,QAC7C,MAAM,EAAE,OAAO;AAAA,QACf,OAAO,EAAE,OAAO;AAAA,QAChB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,EAAE,EACN,SAAS;AAAA,IACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,GAAG;AAAA,IACH,QAAQ,EAAE,QAAQ,aAAa;AAAA,IAC/B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,QAAQ,EAAE,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AACZ,CAAC;AACD,IAAM,oBAAoB,EAAE,mBAAmB,UAAU;AAAA,EACvD,WAAW,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACvF,WAAW,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,KAAK,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzF,CAAC;AACD,IAAM,mBAAmB,EACtB,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,gBAAgB,EAAE,OAAO;AAAA,EACzB,YAAY,EAAE,MAAM,CAAC,YAAY,iBAAiB,CAAC;AACrD,CAAC,EACA,OAAO;AAGV,SAAS,oBACP,OACkB;AAClB,QAAM,SAAS;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,GAAI,eAAe,QAAQ,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,IACzF,gBAAgB,MAAM;AAAA,IACtB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,sBAAsB,SAC5B,EAAE,mBAAmB,MAAM,kBAAkB,IAC7C,CAAC;AAAA,EACP;AACA,MAAI,MAAM,WAAW;AACnB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,MACd,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,IAC7F;AACF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,IACjB,GAAI,MAAM,eAAe,SACrB;AAAA,MACE,YAAY,MAAM,WAAW,IAAI,CAAC,eAAe;AAAA,QAC/C,SAAS,UAAU;AAAA,QACnB,MAAM,UAAU;AAAA,QAChB,OAAO,UAAU;AAAA,QACjB,GAAI,UAAU,WAAW,SAAY,EAAE,QAAQ,UAAU,OAAO,IAAI,CAAC;AAAA,MACvE,EAAE;AAAA,IACJ,IACA,CAAC;AAAA,EACP;AACF;AAMO,SAAS,+BACd,UAIA,YAAgC,aAChC,QAO2B;AAC3B,MAAI,CAAC,SAAS,kCAAkC,CAAC,OAAQ,QAAO,CAAC;AACjE,MAAI;AACJ,MAAI;AACF,cAAU,cAAc,MAAM,KAAK,MAAM,SAAS,kCAAkC,IAAI,CAAC;AACzF,eAAW,SAAS,QAAS,iBAAgB,MAAM,GAAG;AACtD,QAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,MAAM,SAAS,CAAC,EAAE,SAAS,QAAQ,OAAQ,OAAM,IAAI,MAAM;AAAA,EAChG,QAAQ;AAEN,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,WAAW,KAAK,CAAC,CAAC;AAC1E,QAAM,SAAS,oBAAI,IAAuC;AAC1D,MAAI,mBAAmB;AACvB,QAAM,gBAAgB,OACpB,UAC8B;AAC9B,UAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAM,UAAgE,KAAK,MAAM,UAAU;AAC3F,UAAM,cAAc,CAAC,YAAqE;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,GAAI,eAAe,UACf,EAAE,WAAW,QAAQ,UAAU,IAC/B,EAAE,WAAW,QAAQ,UAAU;AAAA,MACnC,gBAAgB,QAAQ,cAAc;AAAA,MACtC,GAAI,QAAQ,cAAc,aAAa,SACnC,EAAE,UAAU,QAAQ,cAAc,SAAS,IAC3C,CAAC;AAAA,MACL,GAAI,QAAQ,cAAc,iBAAiB,SACvC,EAAE,cAAc,QAAQ,cAAc,aAAa,IACnD,CAAC;AAAA,MACL,GAAI,QAAQ,cAAc,WAAW,SACjC,EAAE,QAAQ,QAAQ,cAAc,OAAO,IACvC,CAAC;AAAA,MACL,GAAI,QAAQ,cAAc,aAAa,SACnC,EAAE,UAAU,QAAQ,cAAc,SAAS,IAC3C,CAAC;AAAA,MACL,GAAI,QAAQ,cAAc,sBAAsB,SAC5C,EAAE,mBAAmB,QAAQ,cAAc,kBAAkB,IAC7D,CAAC;AAAA,MACL;AAAA,IACF;AACA,QAAI,QAA8B,EAAE,MAAM,SAAS;AACnD,QAAI;AACF,UAAI,OAAQ,SAAQ,MAAM,OAAO,QAAQ,OAAO;AAAA,IAClD,QAAQ;AACN,aAAO,YAAY,gBAAgB;AAAA,IACrC;AACA,QAAI,MAAM,SAAS,SAAU,QAAO,YAAY,kBAAkB;AAClE,UAAM,SAAS,MAAM,SAAS,cAAc,QAAQ,UAAU,IAAI,QAAQ,SAAS;AACnF,QAAI,CAAC,UAAU,QAAQ,cAAc,oBAAoB;AACvD,aAAO,YAAY,kBAAkB;AACvC,UAAM,UAAU,YAAY;AAC1B,UAAI;AACF,eAAO,SAAS,MAAM,OAAO,UAAU,SAAS,KAAK,IAAI;AAAA,MAC3D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAAS,OAAO,UAAuD;AAC3E,UAAI,CAAE,MAAM,QAAQ,EAAI,QAAO,YAAY,gBAAgB;AAC3D,YAAM,SAAS,gBAAgB,KAAK;AACpC,UAAI,OAAO,WAAW,QAAQ,OAAQ,QAAO,yBAAyB,IAAI;AAC1E,aAAO;AAAA,IACT;AAGA,QAAI,IAAI,YAAY,EAAE,OAAO,UAAU,EAAE,aAAa;AACpD,aAAO,YAAY,gBAAgB;AACrC,UAAM,YAAY,KAAK,UAAU;AAAA,MAC/B,MAAM,SAAS,cAAc,CAAC,MAAM,IAAI,MAAM,UAAU,IAAI;AAAA,MAC5D;AAAA,IACF,CAAC;AACD,UAAM,UAAU,OAAO,IAAI,SAAS;AACpC,QAAI,QAAS,QAAO,OAAO,MAAM,OAAO;AACxC,QAAI,oBAAoB,IAAK,QAAO,YAAY,gBAAgB;AAChE,UAAM,MAAM,YAAuC;AACjD,YAAM,YAAY,OAAO,WAAW;AACpC,YAAM,aAAa,IAAI,gBAAgB;AACvC,UAAI;AACJ,YAAM,WAAW,IAAI,QAAe,CAAC,GAAG,WAAW;AACjD,gBAAQ,WAAW,MAAM;AACvB,qBAAW,MAAM;AACjB,iBAAO,IAAI,MAAM,wBAAwB,CAAC;AAAA,QAC5C,GAAG,OAAO,SAAS;AAAA,MACrB,CAAC;AACD,UAAI;AACF;AACA,eAAO,MAAM,QAAQ,KAAK;AAAA,UACxB;AAAA,WACC,YAAY;AACX,gBAAI,CAAE,MAAM,QAAQ,EAAI,QAAO,YAAY,gBAAgB;AAC3D,kBAAM,WAAW,MAAM;AAAA,cACrB,OAAO;AAAA,cACP;AAAA,gBACE,QAAQ;AAAA,gBACR,UAAU;AAAA,gBACV,QAAQ,WAAW;AAAA,gBACnB,SAAS;AAAA,kBACP,eAAe,UAAU,OAAO,WAAW;AAAA,kBAC3C,gBAAgB;AAAA,gBAClB;AAAA,gBACA,MAAM,KAAK,UAAU,EAAE,SAAS,GAAG,WAAW,QAAQ,CAAC;AAAA,cACzD;AAAA,cACA;AAAA,cACA,EAAE,8BAA8B,MAAM,OAAO,+BAA+B;AAAA,YAC9E;AACA,gBAAI,CAAC,SAAS,IAAI;AAChB,oBAAM,SAAS,MAAM,OAAO;AAC5B,qBAAO,YAAY,gBAAgB;AAAA,YACrC;AACA,kBAAM,SAAS,iBAAiB;AAAA,cAC9B,MAAM,wBAAwB,UAAU,OAAQ,gCAAgC;AAAA,gBAC9E,QAAQ,WAAW;AAAA,cACrB,CAAC;AAAA,YACH;AACA,gBACE,OAAO,cAAc,aACrB,OAAO,mBAAmB,QAAQ,kBAClC,OAAO,WAAW,cAAc,QAAQ,aACxC,OAAO,WAAW,gBAAgB,QAAQ,gBACzC,eAAe,UACZ,EAAE,eAAe,OAAO,eACxB,OAAO,WAAW,cAAc,QAAQ,YACxC,EAAE,eAAe,OAAO,eACxB,OAAO,WAAW,cAAc,QAAQ;AAE5C,qBAAO,YAAY,gBAAgB;AACrC,gBACE,OAAO,WAAW,WAAW,SAC5B,KAAK,MAAM,OAAO,WAAW,SAAS,KAAK,KAAK,IAAI,IAAI,OACvD,KAAK,MAAM,OAAO,WAAW,SAAS,IAAI,KAAK,IAAI,IAAI,MACzD;AACA,qBAAO,YAAY,gBAAgB;AAAA,YACrC;AAGA,mBAAO,oBAAoB,OAAO,UAAU;AAAA,UAC9C,GAAG,EAAE,QAAQ,MAAM;AACjB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,YAAY,gBAAgB;AAAA,MACrC,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,OAAO,IAAI;AACjB,WAAO,IAAI,WAAW,IAAI;AAC1B,QAAI;AACF,aAAO,OAAO,MAAM,IAAI;AAAA,IAC1B,UAAE;AACA,UAAI,OAAO,IAAI,SAAS,MAAM,KAAM,QAAO,OAAO,SAAS;AAAA,IAC7D;AAAA,EACF;AACA,SAAO;AAAA,IACL,oBAAoB;AAAA,IACpB,MAAM,eAAe,OAAO;AAC1B,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,UAAI,EAAE,eAAe,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAClF,aAAO;AAAA,IACT;AAAA,IACA,MAAM,sBAAsB,OAAO;AACjC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,UAAI,EAAE,eAAe,QAAS,OAAM,IAAI,MAAM,uCAAuC;AACrF,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAIO,SAAS,qCACd,UACA,IACA,YAAgC,aACL;AAC3B,SAAO,+BAA+B,UAAU,WAAW;AAAA,IACzD,SAAS,CAAC,YACR,4BAA4B,IAAI,SAAS,+BAA+B,QAAQ,CAAC;AAAA,IACnF,WAAW,CAAC,SAAS,UAAU,8BAA8B,IAAI,SAAS,KAAK;AAAA,EACjF,CAAC;AACH;AAGO,SAAS,yBACd,UACA,WACS;AACT,MAAI;AACF,WAAO,cACJ,MAAM,KAAK,MAAM,SAAS,kCAAkC,IAAI,CAAC,EACjE,KAAK,CAAC,UAAU,MAAM,cAAc,SAAS;AAAA,EAClD,QAAQ;AACN,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACF;","names":[]}