@opengeni/core 3.0.1 → 3.1.2

package/dist/domain/connection-authority.js

@@ -1,169 +0,0 @@
-// src/domain/connection-authority.ts
-import {
-  ConnectionAuthorityEnvelope,
-  ConnectionUseAttribution,
-  ConnectionUseAuthoritySnapshot
-} from "@opengeni/contracts/connection-authority";
-var ConnectionAuthorityInvariantError = class extends Error {
-  constructor(code) {
-    super(`connection authority invariant failed: ${code}`);
-    this.code = code;
-    this.name = "ConnectionAuthorityInvariantError";
-  }
-};
-function captureConnectionUseAuthority(input) {
-  const authority = ConnectionAuthorityEnvelope.parse(input.authority ?? {});
-  const connection = input.connection;
-  if (connection.organizationId !== input.organizationId) {
-    throw new ConnectionAuthorityInvariantError("tenant_mismatch");
-  }
-  if (connection.status !== "active") {
-    throw new ConnectionAuthorityInvariantError("connection_status_inactive");
-  }
-  let authoritySource;
-  let userDelegation = null;
-  if (authority.scope === "workspace") {
-    if (connection.subjectId !== null || connection.ownerOrganizationMembershipId !== null) {
-      throw new ConnectionAuthorityInvariantError("workspace_borrowed_personal_connection");
-    }
-    if (connection.workspaceId !== input.targetWorkspaceId) {
-      throw new ConnectionAuthorityInvariantError("workspace_connection_scope_mismatch");
-    }
-    authoritySource = input.authorityWasOmitted ? "legacy_workspace_omission" : "explicit_workspace";
-  } else {
-    const delegation = authority.userDelegation;
-    const resourceAuthority = input.userAuthority;
-    if (!delegation || !resourceAuthority) {
-      throw new ConnectionAuthorityInvariantError("user_authority_missing");
-    }
-    if (!connection.subjectId || !connection.ownerOrganizationMembershipId) {
-      throw new ConnectionAuthorityInvariantError("personal_owner_missing");
-    }
-    if (resourceAuthority.id !== delegation.authorityId || resourceAuthority.organizationId !== input.organizationId || resourceAuthority.resourceKind !== "connection" || resourceAuthority.resourceId !== connection.id || resourceAuthority.originWorkspaceId !== connection.workspaceId || resourceAuthority.ownerSubjectId !== connection.subjectId || resourceAuthority.ownerOrganizationMembershipId !== connection.ownerOrganizationMembershipId || resourceAuthority.generation !== delegation.authorityGeneration || resourceAuthority.status !== "active") {
-      throw new ConnectionAuthorityInvariantError("user_authority_mismatch");
-    }
-    userDelegation = delegation;
-    authoritySource = "user_delegation";
-  }
-  return ConnectionUseAuthoritySnapshot.parse({
-    organizationId: input.organizationId,
-    originWorkspaceId: connection.workspaceId,
-    targetWorkspaceId: input.targetWorkspaceId,
-    targetSessionId: input.targetSessionId,
-    targetSessionVisibility: input.targetSessionVisibility,
-    targetSessionAuthorityEpoch: input.targetSessionAuthorityEpoch,
-    acceptedWork: input.acceptedWork,
-    connectionId: connection.id,
-    connectionGeneration: connection.generation,
-    connectionStatus: "active",
-    providerDomain: connection.providerDomain.toLowerCase(),
-    connectionKind: connection.kind,
-    scope: authority.scope,
-    ownerSubjectId: connection.subjectId,
-    ownerOrganizationMembershipId: connection.ownerOrganizationMembershipId,
-    ownerMembershipAuthorizationRevision: authority.scope === "user" ? input.userAuthority.ownerMembershipAuthorizationRevision : null,
-    authoritySource,
-    selectionSources: input.selectionSources,
-    userDelegation
-  });
-}
-function denied(reason) {
-  return { status: "denied", reason };
-}
-function revalidateConnectionUseAuthority(input) {
-  const snapshot = ConnectionUseAuthoritySnapshot.parse(input.snapshot);
-  const live = input.live;
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  if (live.organizationId !== snapshot.organizationId || live.targetWorkspaceId !== snapshot.targetWorkspaceId) {
-    return denied("tenant_mismatch");
-  }
-  if (!live.targetWorkspaceAccessActive) return denied("workspace_access_inactive");
-  if (!live.session.active) return denied("session_inactive");
-  if (live.session.id !== snapshot.targetSessionId || live.session.organizationId !== snapshot.organizationId || live.session.workspaceId !== snapshot.targetWorkspaceId) {
-    return denied("session_identity_changed");
-  }
-  if (live.session.visibility !== snapshot.targetSessionVisibility) {
-    return denied("session_visibility_changed");
-  }
-  if (live.session.authorityEpoch !== snapshot.targetSessionAuthorityEpoch) {
-    return denied("session_authority_epoch_changed");
-  }
-  const connection = live.connection;
-  if (!connection) return denied("connection_missing");
-  if (connection.id !== snapshot.connectionId || connection.organizationId !== snapshot.organizationId || connection.workspaceId !== snapshot.originWorkspaceId || connection.providerDomain.toLowerCase() !== snapshot.providerDomain || connection.kind !== snapshot.connectionKind) {
-    return denied("connection_identity_changed");
-  }
-  if (connection.generation !== snapshot.connectionGeneration) {
-    return denied("connection_generation_changed");
-  }
-  if (connection.status !== "active") return denied("connection_status_inactive");
-  if (connection.subjectId !== snapshot.ownerSubjectId || connection.ownerOrganizationMembershipId !== snapshot.ownerOrganizationMembershipId) {
-    return denied("connection_owner_changed");
-  }
-  if (snapshot.scope === "workspace") {
-    if (connection.subjectId !== null || connection.workspaceId !== snapshot.targetWorkspaceId) {
-      return denied("connection_owner_changed");
-    }
-    return {
-      status: "authorized",
-      attribution: ConnectionUseAttribution.parse({
-        organizationId: snapshot.organizationId,
-        workspaceId: snapshot.targetWorkspaceId,
-        sessionId: snapshot.targetSessionId,
-        connectionId: snapshot.connectionId,
-        connectionGeneration: snapshot.connectionGeneration,
-        scope: "workspace",
-        ownerSubjectId: null,
-        authorityId: null,
-        grantId: null
-      })
-    };
-  }
-  const delegation = snapshot.userDelegation;
-  const membership = live.ownerMembership;
-  if (!membership || membership.status !== "active" || membership.id !== snapshot.ownerOrganizationMembershipId || membership.organizationId !== snapshot.organizationId || membership.subjectId !== snapshot.ownerSubjectId || membership.authorizationRevision !== snapshot.ownerMembershipAuthorizationRevision) {
-    return denied("owner_membership_inactive");
-  }
-  const authority = live.userAuthority;
-  if (!authority) return denied("authority_missing");
-  if (authority.id !== delegation.authorityId || authority.organizationId !== snapshot.organizationId || authority.resourceKind !== "connection" || authority.resourceId !== snapshot.connectionId || authority.originWorkspaceId !== snapshot.originWorkspaceId || authority.ownerSubjectId !== snapshot.ownerSubjectId || authority.ownerOrganizationMembershipId !== snapshot.ownerOrganizationMembershipId) {
-    return denied("authority_identity_changed");
-  }
-  if (authority.generation !== delegation.authorityGeneration) {
-    return denied("authority_generation_changed");
-  }
-  if (authority.status !== "active") return denied("authority_status_inactive");
-  const grant = live.grant;
-  if (!grant) return denied("grant_missing");
-  if (grant.id !== delegation.grantId || grant.authorityId !== delegation.authorityId || grant.organizationId !== snapshot.organizationId || grant.workspaceId !== snapshot.targetWorkspaceId || grant.sessionId !== delegation.sessionId || grant.action !== "connection.use" || grant.mode !== delegation.mode || grant.context !== snapshot.targetSessionVisibility || grant.authorityEpoch !== delegation.authorityEpoch) {
-    return denied("grant_identity_changed");
-  }
-  if (grant.generation !== delegation.grantGeneration) {
-    return denied("grant_generation_changed");
-  }
-  if (grant.status !== "active") return denied("grant_status_inactive");
-  if (grant.expiresAt !== null && Date.parse(grant.expiresAt) <= now.getTime()) {
-    return denied("grant_expired");
-  }
-  if (grant.mode === "once" && grant.consumed) return denied("grant_already_consumed");
-  return {
-    status: "authorized",
-    attribution: ConnectionUseAttribution.parse({
-      organizationId: snapshot.organizationId,
-      workspaceId: snapshot.targetWorkspaceId,
-      sessionId: snapshot.targetSessionId,
-      connectionId: snapshot.connectionId,
-      connectionGeneration: snapshot.connectionGeneration,
-      scope: "user",
-      ownerSubjectId: snapshot.ownerSubjectId,
-      authorityId: delegation.authorityId,
-      grantId: delegation.grantId
-    })
-  };
-}
-export {
-  ConnectionAuthorityInvariantError,
-  captureConnectionUseAuthority,
-  revalidateConnectionUseAuthority
-};
-//# sourceMappingURL=connection-authority.js.map

package/dist/domain/connection-authority.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/domain/connection-authority.ts"],"sourcesContent":["import type {\n  ConnectionKind,\n  ConnectionStatus,\n  SessionTenancyVisibility,\n  UserResourceDelegation,\n  UserResourceGrantMode,\n  UserResourceGrantStatus,\n} from \"@opengeni/contracts\";\nimport {\n  ConnectionAuthorityEnvelope,\n  ConnectionUseAttribution,\n  ConnectionUseAuthoritySnapshot,\n  type ConnectionUseAuthorizationResult,\n  type ConnectionAuthoritySelectionSource,\n  type ConnectionUseDenialReason,\n  type ConnectionUseSelectionSource,\n} from \"@opengeni/contracts/connection-authority\";\n\nexport type ConnectionAuthorityCandidate = {\n  id: string;\n  organizationId: string;\n  workspaceId: string;\n  generation: number;\n  status: ConnectionStatus;\n  providerDomain: string;\n  kind: ConnectionKind;\n  subjectId: string | null;\n  ownerOrganizationMembershipId: string | null;\n};\n\nexport type UserConnectionAuthorityCandidate = {\n  id: string;\n  organizationId: string;\n  resourceKind: \"connection\";\n  resourceId: string;\n  originWorkspaceId: string;\n  ownerSubjectId: string;\n  ownerOrganizationMembershipId: string;\n  ownerMembershipAuthorizationRevision: number;\n  generation: number;\n  status: \"active\" | \"retained\" | \"revoked\";\n};\n\nexport class ConnectionAuthorityInvariantError extends Error {\n  constructor(readonly code: string) {\n    super(`connection authority invariant failed: ${code}`);\n    this.name = \"ConnectionAuthorityInvariantError\";\n  }\n}\n\nexport function captureConnectionUseAuthority(input: {\n  organizationId: string;\n  targetWorkspaceId: string;\n  targetSessionId: string;\n  targetSessionVisibility: SessionTenancyVisibility;\n  targetSessionAuthorityEpoch: number;\n  acceptedWork:\n    | { kind: \"turn\"; turnId: string }\n    | {\n        kind: \"scheduled_task\";\n        taskId: string;\n        taskAuthorityRevision: number;\n        runId: string;\n      };\n  connection: ConnectionAuthorityCandidate;\n  authority?: unknown;\n  authorityWasOmitted?: boolean;\n  userAuthority?: UserConnectionAuthorityCandidate | null;\n  selectionSources: ConnectionUseSelectionSource[];\n}): ConnectionUseAuthoritySnapshot {\n  const authority = ConnectionAuthorityEnvelope.parse(input.authority ?? {});\n  const connection = input.connection;\n  if (connection.organizationId !== input.organizationId) {\n    throw new ConnectionAuthorityInvariantError(\"tenant_mismatch\");\n  }\n  if (connection.status !== \"active\") {\n    throw new ConnectionAuthorityInvariantError(\"connection_status_inactive\");\n  }\n\n  let authoritySource: ConnectionAuthoritySelectionSource;\n  let userDelegation: UserResourceDelegation | null = null;\n  if (authority.scope === \"workspace\") {\n    if (connection.subjectId !== null || connection.ownerOrganizationMembershipId !== null) {\n      throw new ConnectionAuthorityInvariantError(\"workspace_borrowed_personal_connection\");\n    }\n    if (connection.workspaceId !== input.targetWorkspaceId) {\n      throw new ConnectionAuthorityInvariantError(\"workspace_connection_scope_mismatch\");\n    }\n    authoritySource = input.authorityWasOmitted\n      ? \"legacy_workspace_omission\"\n      : \"explicit_workspace\";\n  } else {\n    const delegation = authority.userDelegation;\n    const resourceAuthority = input.userAuthority;\n    if (!delegation || !resourceAuthority) {\n      throw new ConnectionAuthorityInvariantError(\"user_authority_missing\");\n    }\n    if (!connection.subjectId || !connection.ownerOrganizationMembershipId) {\n      throw new ConnectionAuthorityInvariantError(\"personal_owner_missing\");\n    }\n    if (\n      resourceAuthority.id !== delegation.authorityId ||\n      resourceAuthority.organizationId !== input.organizationId ||\n      resourceAuthority.resourceKind !== \"connection\" ||\n      resourceAuthority.resourceId !== connection.id ||\n      resourceAuthority.originWorkspaceId !== connection.workspaceId ||\n      resourceAuthority.ownerSubjectId !== connection.subjectId ||\n      resourceAuthority.ownerOrganizationMembershipId !==\n        connection.ownerOrganizationMembershipId ||\n      resourceAuthority.generation !== delegation.authorityGeneration ||\n      resourceAuthority.status !== \"active\"\n    ) {\n      throw new ConnectionAuthorityInvariantError(\"user_authority_mismatch\");\n    }\n    userDelegation = delegation;\n    authoritySource = \"user_delegation\";\n  }\n\n  return ConnectionUseAuthoritySnapshot.parse({\n    organizationId: input.organizationId,\n    originWorkspaceId: connection.workspaceId,\n    targetWorkspaceId: input.targetWorkspaceId,\n    targetSessionId: input.targetSessionId,\n    targetSessionVisibility: input.targetSessionVisibility,\n    targetSessionAuthorityEpoch: input.targetSessionAuthorityEpoch,\n    acceptedWork: input.acceptedWork,\n    connectionId: connection.id,\n    connectionGeneration: connection.generation,\n    connectionStatus: \"active\",\n    providerDomain: connection.providerDomain.toLowerCase(),\n    connectionKind: connection.kind,\n    scope: authority.scope,\n    ownerSubjectId: connection.subjectId,\n    ownerOrganizationMembershipId: connection.ownerOrganizationMembershipId,\n    ownerMembershipAuthorizationRevision:\n      authority.scope === \"user\" ? input.userAuthority!.ownerMembershipAuthorizationRevision : null,\n    authoritySource,\n    selectionSources: input.selectionSources,\n    userDelegation,\n  });\n}\n\nexport type LiveConnectionUseState = {\n  organizationId: string;\n  targetWorkspaceId: string;\n  targetWorkspaceAccessActive: boolean;\n  session: {\n    id: string;\n    organizationId: string;\n    workspaceId: string;\n    visibility: SessionTenancyVisibility;\n    authorityEpoch: number;\n    active: boolean;\n  };\n  connection: ConnectionAuthorityCandidate | null;\n  ownerMembership: {\n    id: string;\n    organizationId: string;\n    subjectId: string;\n    status: \"provisioning\" | \"active\" | \"suspended\" | \"revoked\";\n    authorizationRevision: number;\n  } | null;\n  userAuthority: UserConnectionAuthorityCandidate | null;\n  grant: {\n    id: string;\n    authorityId: string;\n    organizationId: string;\n    workspaceId: string;\n    sessionId: string | null;\n    action: string;\n    mode: UserResourceGrantMode;\n    context: SessionTenancyVisibility;\n    authorityEpoch: number | null;\n    generation: number;\n    status: UserResourceGrantStatus;\n    expiresAt: string | null;\n    consumed: boolean;\n  } | null;\n};\n\nfunction denied(reason: ConnectionUseDenialReason): ConnectionUseAuthorizationResult {\n  return { status: \"denied\", reason };\n}\n\n/**\n * Revalidates every mutable fence immediately before provider use. Callers must\n * resolve the live state in one DB authority boundary; this pure function does\n * not cache, refresh, decrypt, or invoke a provider.\n */\nexport function revalidateConnectionUseAuthority(input: {\n  snapshot: ConnectionUseAuthoritySnapshot;\n  live: LiveConnectionUseState;\n  now?: Date;\n}): ConnectionUseAuthorizationResult {\n  const snapshot = ConnectionUseAuthoritySnapshot.parse(input.snapshot);\n  const live = input.live;\n  const now = input.now ?? new Date();\n  if (\n    live.organizationId !== snapshot.organizationId ||\n    live.targetWorkspaceId !== snapshot.targetWorkspaceId\n  ) {\n    return denied(\"tenant_mismatch\");\n  }\n  if (!live.targetWorkspaceAccessActive) return denied(\"workspace_access_inactive\");\n  if (!live.session.active) return denied(\"session_inactive\");\n  if (\n    live.session.id !== snapshot.targetSessionId ||\n    live.session.organizationId !== snapshot.organizationId ||\n    live.session.workspaceId !== snapshot.targetWorkspaceId\n  ) {\n    return denied(\"session_identity_changed\");\n  }\n  if (live.session.visibility !== snapshot.targetSessionVisibility) {\n    return denied(\"session_visibility_changed\");\n  }\n  if (live.session.authorityEpoch !== snapshot.targetSessionAuthorityEpoch) {\n    return denied(\"session_authority_epoch_changed\");\n  }\n  const connection = live.connection;\n  if (!connection) return denied(\"connection_missing\");\n  if (\n    connection.id !== snapshot.connectionId ||\n    connection.organizationId !== snapshot.organizationId ||\n    connection.workspaceId !== snapshot.originWorkspaceId ||\n    connection.providerDomain.toLowerCase() !== snapshot.providerDomain ||\n    connection.kind !== snapshot.connectionKind\n  ) {\n    return denied(\"connection_identity_changed\");\n  }\n  if (connection.generation !== snapshot.connectionGeneration) {\n    return denied(\"connection_generation_changed\");\n  }\n  if (connection.status !== \"active\") return denied(\"connection_status_inactive\");\n  if (\n    connection.subjectId !== snapshot.ownerSubjectId ||\n    connection.ownerOrganizationMembershipId !== snapshot.ownerOrganizationMembershipId\n  ) {\n    return denied(\"connection_owner_changed\");\n  }\n\n  if (snapshot.scope === \"workspace\") {\n    if (connection.subjectId !== null || connection.workspaceId !== snapshot.targetWorkspaceId) {\n      return denied(\"connection_owner_changed\");\n    }\n    return {\n      status: \"authorized\",\n      attribution: ConnectionUseAttribution.parse({\n        organizationId: snapshot.organizationId,\n        workspaceId: snapshot.targetWorkspaceId,\n        sessionId: snapshot.targetSessionId,\n        connectionId: snapshot.connectionId,\n        connectionGeneration: snapshot.connectionGeneration,\n        scope: \"workspace\",\n        ownerSubjectId: null,\n        authorityId: null,\n        grantId: null,\n      }),\n    };\n  }\n\n  const delegation = snapshot.userDelegation!;\n  const membership = live.ownerMembership;\n  if (\n    !membership ||\n    membership.status !== \"active\" ||\n    membership.id !== snapshot.ownerOrganizationMembershipId ||\n    membership.organizationId !== snapshot.organizationId ||\n    membership.subjectId !== snapshot.ownerSubjectId ||\n    membership.authorizationRevision !== snapshot.ownerMembershipAuthorizationRevision\n  ) {\n    return denied(\"owner_membership_inactive\");\n  }\n  const authority = live.userAuthority;\n  if (!authority) return denied(\"authority_missing\");\n  if (\n    authority.id !== delegation.authorityId ||\n    authority.organizationId !== snapshot.organizationId ||\n    authority.resourceKind !== \"connection\" ||\n    authority.resourceId !== snapshot.connectionId ||\n    authority.originWorkspaceId !== snapshot.originWorkspaceId ||\n    authority.ownerSubjectId !== snapshot.ownerSubjectId ||\n    authority.ownerOrganizationMembershipId !== snapshot.ownerOrganizationMembershipId\n  ) {\n    return denied(\"authority_identity_changed\");\n  }\n  if (authority.generation !== delegation.authorityGeneration) {\n    return denied(\"authority_generation_changed\");\n  }\n  if (authority.status !== \"active\") return denied(\"authority_status_inactive\");\n\n  const grant = live.grant;\n  if (!grant) return denied(\"grant_missing\");\n  if (\n    grant.id !== delegation.grantId ||\n    grant.authorityId !== delegation.authorityId ||\n    grant.organizationId !== snapshot.organizationId ||\n    grant.workspaceId !== snapshot.targetWorkspaceId ||\n    grant.sessionId !== delegation.sessionId ||\n    grant.action !== \"connection.use\" ||\n    grant.mode !== delegation.mode ||\n    grant.context !== snapshot.targetSessionVisibility ||\n    grant.authorityEpoch !== delegation.authorityEpoch\n  ) {\n    return denied(\"grant_identity_changed\");\n  }\n  if (grant.generation !== delegation.grantGeneration) {\n    return denied(\"grant_generation_changed\");\n  }\n  if (grant.status !== \"active\") return denied(\"grant_status_inactive\");\n  if (grant.expiresAt !== null && Date.parse(grant.expiresAt) <= now.getTime()) {\n    return denied(\"grant_expired\");\n  }\n  if (grant.mode === \"once\" && grant.consumed) return denied(\"grant_already_consumed\");\n\n  return {\n    status: \"authorized\",\n    attribution: ConnectionUseAttribution.parse({\n      organizationId: snapshot.organizationId,\n      workspaceId: snapshot.targetWorkspaceId,\n      sessionId: snapshot.targetSessionId,\n      connectionId: snapshot.connectionId,\n      connectionGeneration: snapshot.connectionGeneration,\n      scope: \"user\",\n      ownerSubjectId: snapshot.ownerSubjectId,\n      authorityId: delegation.authorityId,\n      grantId: delegation.grantId,\n    }),\n  };\n}\n"],"mappings":";AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AA2BA,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAC3D,YAAqB,MAAc;AACjC,UAAM,0CAA0C,IAAI,EAAE;AADnC;AAEnB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,8BAA8B,OAmBX;AACjC,QAAM,YAAY,4BAA4B,MAAM,MAAM,aAAa,CAAC,CAAC;AACzE,QAAM,aAAa,MAAM;AACzB,MAAI,WAAW,mBAAmB,MAAM,gBAAgB;AACtD,UAAM,IAAI,kCAAkC,iBAAiB;AAAA,EAC/D;AACA,MAAI,WAAW,WAAW,UAAU;AAClC,UAAM,IAAI,kCAAkC,4BAA4B;AAAA,EAC1E;AAEA,MAAI;AACJ,MAAI,iBAAgD;AACpD,MAAI,UAAU,UAAU,aAAa;AACnC,QAAI,WAAW,cAAc,QAAQ,WAAW,kCAAkC,MAAM;AACtF,YAAM,IAAI,kCAAkC,wCAAwC;AAAA,IACtF;AACA,QAAI,WAAW,gBAAgB,MAAM,mBAAmB;AACtD,YAAM,IAAI,kCAAkC,qCAAqC;AAAA,IACnF;AACA,sBAAkB,MAAM,sBACpB,8BACA;AAAA,EACN,OAAO;AACL,UAAM,aAAa,UAAU;AAC7B,UAAM,oBAAoB,MAAM;AAChC,QAAI,CAAC,cAAc,CAAC,mBAAmB;AACrC,YAAM,IAAI,kCAAkC,wBAAwB;AAAA,IACtE;AACA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,+BAA+B;AACtE,YAAM,IAAI,kCAAkC,wBAAwB;AAAA,IACtE;AACA,QACE,kBAAkB,OAAO,WAAW,eACpC,kBAAkB,mBAAmB,MAAM,kBAC3C,kBAAkB,iBAAiB,gBACnC,kBAAkB,eAAe,WAAW,MAC5C,kBAAkB,sBAAsB,WAAW,eACnD,kBAAkB,mBAAmB,WAAW,aAChD,kBAAkB,kCAChB,WAAW,iCACb,kBAAkB,eAAe,WAAW,uBAC5C,kBAAkB,WAAW,UAC7B;AACA,YAAM,IAAI,kCAAkC,yBAAyB;AAAA,IACvE;AACA,qBAAiB;AACjB,sBAAkB;AAAA,EACpB;AAEA,SAAO,+BAA+B,MAAM;AAAA,IAC1C,gBAAgB,MAAM;AAAA,IACtB,mBAAmB,WAAW;AAAA,IAC9B,mBAAmB,MAAM;AAAA,IACzB,iBAAiB,MAAM;AAAA,IACvB,yBAAyB,MAAM;AAAA,IAC/B,6BAA6B,MAAM;AAAA,IACnC,cAAc,MAAM;AAAA,IACpB,cAAc,WAAW;AAAA,IACzB,sBAAsB,WAAW;AAAA,IACjC,kBAAkB;AAAA,IAClB,gBAAgB,WAAW,eAAe,YAAY;AAAA,IACtD,gBAAgB,WAAW;AAAA,IAC3B,OAAO,UAAU;AAAA,IACjB,gBAAgB,WAAW;AAAA,IAC3B,+BAA+B,WAAW;AAAA,IAC1C,sCACE,UAAU,UAAU,SAAS,MAAM,cAAe,uCAAuC;AAAA,IAC3F;AAAA,IACA,kBAAkB,MAAM;AAAA,IACxB;AAAA,EACF,CAAC;AACH;AAwCA,SAAS,OAAO,QAAqE;AACnF,SAAO,EAAE,QAAQ,UAAU,OAAO;AACpC;AAOO,SAAS,iCAAiC,OAIZ;AACnC,QAAM,WAAW,+BAA+B,MAAM,MAAM,QAAQ;AACpE,QAAM,OAAO,MAAM;AACnB,QAAM,MAAM,MAAM,OAAO,oBAAI,KAAK;AAClC,MACE,KAAK,mBAAmB,SAAS,kBACjC,KAAK,sBAAsB,SAAS,mBACpC;AACA,WAAO,OAAO,iBAAiB;AAAA,EACjC;AACA,MAAI,CAAC,KAAK,4BAA6B,QAAO,OAAO,2BAA2B;AAChF,MAAI,CAAC,KAAK,QAAQ,OAAQ,QAAO,OAAO,kBAAkB;AAC1D,MACE,KAAK,QAAQ,OAAO,SAAS,mBAC7B,KAAK,QAAQ,mBAAmB,SAAS,kBACzC,KAAK,QAAQ,gBAAgB,SAAS,mBACtC;AACA,WAAO,OAAO,0BAA0B;AAAA,EAC1C;AACA,MAAI,KAAK,QAAQ,eAAe,SAAS,yBAAyB;AAChE,WAAO,OAAO,4BAA4B;AAAA,EAC5C;AACA,MAAI,KAAK,QAAQ,mBAAmB,SAAS,6BAA6B;AACxE,WAAO,OAAO,iCAAiC;AAAA,EACjD;AACA,QAAM,aAAa,KAAK;AACxB,MAAI,CAAC,WAAY,QAAO,OAAO,oBAAoB;AACnD,MACE,WAAW,OAAO,SAAS,gBAC3B,WAAW,mBAAmB,SAAS,kBACvC,WAAW,gBAAgB,SAAS,qBACpC,WAAW,eAAe,YAAY,MAAM,SAAS,kBACrD,WAAW,SAAS,SAAS,gBAC7B;AACA,WAAO,OAAO,6BAA6B;AAAA,EAC7C;AACA,MAAI,WAAW,eAAe,SAAS,sBAAsB;AAC3D,WAAO,OAAO,+BAA+B;AAAA,EAC/C;AACA,MAAI,WAAW,WAAW,SAAU,QAAO,OAAO,4BAA4B;AAC9E,MACE,WAAW,cAAc,SAAS,kBAClC,WAAW,kCAAkC,SAAS,+BACtD;AACA,WAAO,OAAO,0BAA0B;AAAA,EAC1C;AAEA,MAAI,SAAS,UAAU,aAAa;AAClC,QAAI,WAAW,cAAc,QAAQ,WAAW,gBAAgB,SAAS,mBAAmB;AAC1F,aAAO,OAAO,0BAA0B;AAAA,IAC1C;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,aAAa,yBAAyB,MAAM;AAAA,QAC1C,gBAAgB,SAAS;AAAA,QACzB,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB,cAAc,SAAS;AAAA,QACvB,sBAAsB,SAAS;AAAA,QAC/B,OAAO;AAAA,QACP,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,aAAa,SAAS;AAC5B,QAAM,aAAa,KAAK;AACxB,MACE,CAAC,cACD,WAAW,WAAW,YACtB,WAAW,OAAO,SAAS,iCAC3B,WAAW,mBAAmB,SAAS,kBACvC,WAAW,cAAc,SAAS,kBAClC,WAAW,0BAA0B,SAAS,sCAC9C;AACA,WAAO,OAAO,2BAA2B;AAAA,EAC3C;AACA,QAAM,YAAY,KAAK;AACvB,MAAI,CAAC,UAAW,QAAO,OAAO,mBAAmB;AACjD,MACE,UAAU,OAAO,WAAW,eAC5B,UAAU,mBAAmB,SAAS,kBACtC,UAAU,iBAAiB,gBAC3B,UAAU,eAAe,SAAS,gBAClC,UAAU,sBAAsB,SAAS,qBACzC,UAAU,mBAAmB,SAAS,kBACtC,UAAU,kCAAkC,SAAS,+BACrD;AACA,WAAO,OAAO,4BAA4B;AAAA,EAC5C;AACA,MAAI,UAAU,eAAe,WAAW,qBAAqB;AAC3D,WAAO,OAAO,8BAA8B;AAAA,EAC9C;AACA,MAAI,UAAU,WAAW,SAAU,QAAO,OAAO,2BAA2B;AAE5E,QAAM,QAAQ,KAAK;AACnB,MAAI,CAAC,MAAO,QAAO,OAAO,eAAe;AACzC,MACE,MAAM,OAAO,WAAW,WACxB,MAAM,gBAAgB,WAAW,eACjC,MAAM,mBAAmB,SAAS,kBAClC,MAAM,gBAAgB,SAAS,qBAC/B,MAAM,cAAc,WAAW,aAC/B,MAAM,WAAW,oBACjB,MAAM,SAAS,WAAW,QAC1B,MAAM,YAAY,SAAS,2BAC3B,MAAM,mBAAmB,WAAW,gBACpC;AACA,WAAO,OAAO,wBAAwB;AAAA,EACxC;AACA,MAAI,MAAM,eAAe,WAAW,iBAAiB;AACnD,WAAO,OAAO,0BAA0B;AAAA,EAC1C;AACA,MAAI,MAAM,WAAW,SAAU,QAAO,OAAO,uBAAuB;AACpE,MAAI,MAAM,cAAc,QAAQ,KAAK,MAAM,MAAM,SAAS,KAAK,IAAI,QAAQ,GAAG;AAC5E,WAAO,OAAO,eAAe;AAAA,EAC/B;AACA,MAAI,MAAM,SAAS,UAAU,MAAM,SAAU,QAAO,OAAO,wBAAwB;AAEnF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,yBAAyB,MAAM;AAAA,MAC1C,gBAAgB,SAAS;AAAA,MACzB,aAAa,SAAS;AAAA,MACtB,WAAW,SAAS;AAAA,MACpB,cAAc,SAAS;AAAA,MACvB,sBAAsB,SAAS;AAAA,MAC/B,OAAO;AAAA,MACP,gBAAgB,SAAS;AAAA,MACzB,aAAa,WAAW;AAAA,MACxB,SAAS,WAAW;AAAA,IACtB,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/domain/environments.d.ts

@@ -1,33 +0,0 @@
-import { type Settings } from "@opengeni/config";
-import { type AccessGrant, type VariableSet } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
-export declare const MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
-export declare const MAX_VARIABLES_PER_ENVIRONMENT = 100;
-export declare function assertAllowedVariableSetVariableName(name: string): void;
-/** @deprecated use assertAllowedVariableSetVariableName */
-export declare const assertAllowedEnvironmentVariableName: typeof assertAllowedVariableSetVariableName;
-export declare function requireVariableSetEncryption(settings: Settings): Uint8Array;
-/** @deprecated use requireVariableSetEncryption */
-export declare const requireEnvironmentEncryption: typeof requireVariableSetEncryption;
-export declare function requireVariableSetForApi(db: Database, grant: AccessGrant, variableSetId: string): Promise<VariableSet>;
-/**
- * Validates an variableSet attachment supplied in a request payload (session
- * create, scheduled task create/update, pack enable). Requires the
- * `variable-sets:use` permission unless the attachment was already authorized
- * (pack-installation-inherited attachments), and maps a missing or
- * cross-variable set to 422 because the id is payload, not the route
- * target. RLS plus the workspace_id clause make cross-workspace ids
- * indistinguishable from missing ones.
- */
-export declare function validateVariableSetAttachment(deps: {
-    settings: Settings;
-    db: Database;
-}, grant: AccessGrant, workspaceId: string, variableSetId: string, options?: {
-    preauthorized?: boolean;
-}): Promise<VariableSet>;
-export declare function recordVariableSetAuditEvent(db: Database, input: {
-    grant: AccessGrant;
-    action: "variable_set.created" | "variable_set.updated" | "variable_set.deleted" | "variable_set.variable.set" | "variable_set.variable.deleted";
-    variableSetId: string;
-    variableName?: string;
-}): Promise<void>;

package/dist/domain/host-mcp-authority-source-admission.d.ts

@@ -1,10 +0,0 @@
-import type { Settings } from "@opengeni/config";
-import type { McpServerConnectionRef } from "@opengeni/contracts";
-/**
- * Explicit host-owned MCP refs change which credential authority executes an
- * opaque connection id. Admit new external refs only after the operator has
- * completed the two-phase fleet rollout. Readers and inheritance remain
- * tolerant regardless of this switch, and markerless legacy refs retain their
- * bounded non-UUID compatibility path.
- */
-export declare function assertHostMcpAuthoritySourceAdmissionEnabled(settings: Pick<Settings, "hostMcpAuthoritySourceAdmissionEnabled">, connectionRef: McpServerConnectionRef | null | undefined): void;

package/dist/domain/host-mcp-task-admission.d.ts

@@ -1,18 +0,0 @@
-import type { Settings } from "@opengeni/config";
-import type { ToolRef, ScheduledTask, AccessGrant } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
-import { type AccessGrantAuthorization } from "../access/index.js";
-/** Internal closure, not a caller-provided callback or durable key dependency. */
-export declare function prepareHostMcpTaskAdmission(input: {
-    settings: Settings;
-    tools: ToolRef[];
-    grant: AccessGrant;
-    authorization?: AccessGrantAuthorization;
-    selections: unknown;
-}): (tx: Database, task: ScheduledTask) => Promise<void>;
-export declare function prepareInheritedHostMcpTaskAdmission(settings: Settings, tools: ToolRef[], source: {
-    sessionId: string;
-    turnId: string;
-    attemptId: string;
-    executionGeneration: number;
-}): (tx: Database, task: ScheduledTask) => Promise<void>;

package/dist/domain/packs.d.ts

@@ -1,59 +0,0 @@
-import { CapabilityPack, type CapabilityPackSkill, type PackInstallationPreview, type ScheduledTaskAgentConfig, type SocialConnection } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
-export declare const MARKETING_SOCIAL_PACK_ID = "marketing-social-daily-analysis";
-export declare function listCapabilityPacks(): CapabilityPack[];
-export declare function getCapabilityPack(packId: string): CapabilityPack | null;
-export declare function isBuiltInCapabilityPack(packId: string): boolean;
-/**
- * Built-in packs plus the manifests registered for this workspace. Stored
- * manifests retain exact historical bytes. Execution views derive Skill labels
- * from their files, but malformed content needs explicit repair, not omission.
- */
-export declare function listWorkspaceCapabilityPacks(db: Database, workspaceId: string): Promise<CapabilityPack[]>;
-export declare function resolveCapabilityPack(db: Database, workspaceId: string, packId: string): Promise<CapabilityPack | null>;
-export declare function capabilityPackManifestDigest(pack: CapabilityPack): string;
-/** True when the Pack must use the owner-aware V2 preview/install lifecycle. */
-export declare function capabilityPackRequiresInstallationPlan(pack: CapabilityPack): boolean;
-export type InlinePackSkillInstall = {
-    componentKey: string;
-    capabilityId: string;
-    pluginKey: string;
-    sourceUrl: string;
-    repositoryUrl: string;
-    sourceCommit: string;
-    sourcePath: string;
-    name: string;
-    description: string;
-    activationMode: "workspace_managed" | "session_selected";
-    contentSha256: string;
-    totalBytes: number;
-    files: Array<{
-        path: string;
-        content: string;
-        byteSize: number;
-        contentSha256: string;
-    }>;
-};
-/** Convert a legacy inline Pack Skill into the ordinary immutable Skill model. */
-export declare function inlinePackSkillInstall(pack: CapabilityPack, skill: CapabilityPackSkill): InlinePackSkillInstall;
-export declare function previewCapabilityPackInstallation(db: Database, access: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-}, pack: CapabilityPack, options?: {
-    rigId?: string;
-    variableSetId?: string;
-}): Promise<PackInstallationPreview>;
-/**
- * v1 pack-scoped runtime rule: at most one enabled pack per workspace may
- * declare a `sandboxImage` — there is deliberately no image composition or
- * layering. Enforced when a pack is enabled (both the packs endpoint and the
- * generic capability enable path) and re-checked at session start by the
- * worker, which also covers manifests re-registered after enablement.
- */
-export declare function assertPackSandboxImageCompatible(db: Database, workspaceId: string, pack: CapabilityPack): Promise<void>;
-export declare function buildMarketingDailyAnalysisAgentConfig(input: {
-    connections: SocialConnection[];
-    documentBaseIds: string[];
-    promptInstructions?: string;
-}): ScheduledTaskAgentConfig;

package/dist/domain/product-integration-pack.d.ts

@@ -1,44 +0,0 @@
-export declare const OPENGENI_PRODUCT_INTEGRATION_PACK_ID = "opengeni-product-integration";
-/** Generated from the canonical external coding-agent guide, with an explicit
- * session-selected wrapper. Installation grants no executable capabilities. */
-export declare const OPENGENI_PRODUCT_INTEGRATION_SKILL: {
-    name: string;
-    description: string;
-    activationMode: "session_selected";
-    files: {
-        path: string;
-        content: string;
-    }[];
-};
-export declare const OPENGENI_PRODUCT_INTEGRATION_PACK: {
-    id: string;
-    name: string;
-    description: string;
-    role: string;
-    category: string;
-    version: string;
-    skills: {
-        name: string;
-        description: string;
-        activationMode: "session_selected";
-        files: {
-            path: string;
-            content: string;
-        }[];
-    }[];
-    components: never[];
-    tools: never[];
-    connectors: never[];
-    knowledge: never[];
-    scheduledTaskTemplates: never[];
-    automationTemplates: never[];
-    metadata: {
-        audience: string;
-        purpose: string;
-        implementationOnly: boolean;
-        skillActivation: string;
-        installationExposure: string;
-        grantsExecutableCapabilities: boolean;
-        canonicalSource: string;
-    };
-};

package/dist/domain/product-integration-skill.gen.d.ts

@@ -1,5 +0,0 @@
-export declare const productIntegrationSkillDescription = "Design, implement, verify, and hand off a tenant-safe OpenGeni product integration while adapting to the customer's architecture, UI, data APIs, and desired delivery autonomy. Select only for an implementation session; installation alone does not expose it to other agents.";
-export declare const productIntegrationSkillFiles: {
-    path: string;
-    content: string;
-}[];

package/dist/remote-mcp-credentials.d.ts

@@ -1,23 +0,0 @@
-import type { Settings } from "@opengeni/config";
-import { type Database, type HostMcpResolverRoute } from "@opengeni/db";
-import { type ConnectionCredentialsPort } from "@opengeni/contracts";
-import { pinnedFetch } from "@opengeni/network";
-/** Optional standalone transport for the existing request-time host port.
- * No successful credential is cached or persisted. The host must authorize
- * every immutable request context, including revocation and binding generation.
- */
-export declare function createRemoteMcpCredentialsPort(settings: Pick<Settings, "hostMcpCredentialResolversJson" | "environment" | "integrationsAllowPrivateNetworkTargets">, transport?: typeof pinnedFetch, routes?: {
-    resolve: (input: {
-        accountId: string;
-        workspaceId: string;
-    }) => Promise<HostMcpResolverRoute>;
-    isCurrent: (input: {
-        accountId: string;
-        workspaceId: string;
-    }, route: HostMcpResolverRoute) => Promise<boolean>;
-}): ConnectionCredentialsPort;
-/** Native standalone transport; the database remains authoritative on every
- * resolution/use. Embedded in-process ports retain their existing precedence. */
-export declare function createNativeRemoteMcpCredentialsPort(settings: Settings, db: Database, transport?: typeof pinnedFetch): ConnectionCredentialsPort;
-/** Parses only server configuration; never return parser errors containing secrets. */
-export declare function hasLegacyHostMcpResolver(settings: Pick<Settings, "hostMcpCredentialResolversJson">, accountId: string): boolean;

package/dist/remote-mcp-credentials.js

@@ -1,11 +0,0 @@
-import {
-  createNativeRemoteMcpCredentialsPort,
-  createRemoteMcpCredentialsPort,
-  hasLegacyHostMcpResolver
-} from "./chunk-5WZYFL45.js";
-export {
-  createNativeRemoteMcpCredentialsPort,
-  createRemoteMcpCredentialsPort,
-  hasLegacyHostMcpResolver
-};
-//# sourceMappingURL=remote-mcp-credentials.js.map

package/dist/remote-mcp-credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/src/application/host-mcp-owner.ts

@@ -1,41 +0,0 @@
-import { HTTPException } from "hono/http-exception";
-import { resolveHostMcpBindingOwner, type Database } from "@opengeni/db";
-import {
-  externalActorContinuationForAuthorization,
-  hasPermission,
-  hasVerifiedOwningUserAuthorization,
-  requireResolvedAccessGrantAuthorization,
-  type AccessGrantAuthorization,
-} from "../access";
-import { requireConnectOwnerAuthority } from "./connect-authority";
-
-/** Direct user admission only. Agents inherit exact accepted snapshots instead.
- * Native and externally represented users share owner semantics; service keys
- * cannot impersonate a human owner merely by naming a subject. */
-export function prepareHostMcpOwnerAuthorization(
-  authorization: AccessGrantAuthorization,
-  workspaceId: string,
-  permission: "connections:read" | "connections:write",
-) {
-  const grant = requireResolvedAccessGrantAuthorization(authorization, workspaceId);
-  if (
-    !hasVerifiedOwningUserAuthorization(authorization) ||
-    grant.metadata?.sessionId ||
-    !hasPermission(grant.permissions, permission)
-  )
-    throw new HTTPException(403, {
-      message: "Host binding requires verified owning-user authority",
-    });
-  const continuation = externalActorContinuationForAuthorization(authorization);
-  const scope = {
-    accountId: grant.accountId,
-    workspaceId,
-    subjectId: grant.subjectId,
-    personalOwnerVerified: authorization.canonicalManagedHumanSession,
-    ...(continuation ? { externalContinuation: continuation } : {}),
-  };
-  return async (tx: Database) => {
-    await requireConnectOwnerAuthority(tx, scope, permission);
-    return resolveHostMcpBindingOwner(tx, scope);
-  };
-}

package/src/application/host-mcp-resolvers.ts

@@ -1,84 +0,0 @@
-import type { Context } from "hono";
-import { HTTPException } from "hono/http-exception";
-import { z } from "zod";
-import {
-  HostMcpResolverSource,
-  PutHostMcpResolverRequest,
-  RevokeHostMcpResolverRequest,
-} from "@opengeni/contracts/host-mcp-resolvers";
-import { getHostMcpResolver, mutateHostMcpResolver, HostMcpResolverError } from "@opengeni/db";
-import { isLocalTestEnvironment, validateHttpUrl } from "@opengeni/network";
-import {
-  accountScopedApiKeyWorkspaceAuthority,
-  requireAccessContext,
-  type AccessDeps,
-} from "../access";
-import { requireVariableSetEncryption } from "../domain/environments";
-import { hasLegacyHostMcpResolver } from "../remote-mcp-credentials";
-
-export async function hostMcpResolverForRequest(
-  context: Context,
-  deps: AccessDeps,
-  organizationId: string,
-  source: string,
-  method: "get" | "put" | "revoke",
-  raw?: unknown,
-) {
-  const id = z.string().uuid().safeParse(organizationId);
-  const externalSource = HostMcpResolverSource.safeParse(source);
-  if (!id.success || !externalSource.success)
-    throw new HTTPException(422, { message: "invalid resolver identity" });
-  const access = await requireAccessContext(context, deps);
-  const service = accountScopedApiKeyWorkspaceAuthority(access);
-  // Full organization keys carry workspace:admin, not human account:admin.
-  // The stamped authority proves the exact organization service-key lane.
-  if (!service || service.accountId !== id.data || !service.permissions.includes("workspace:admin"))
-    throw new HTTPException(403, {
-      message: "resolver administration requires an organization service key",
-    });
-  const actor = { accountId: id.data, subjectId: access.subjectId };
-  try {
-    if (method === "get") return await getHostMcpResolver(deps.db, actor, externalSource.data);
-    const common = {
-      externalSource: externalSource.data,
-      encryptionKey: requireVariableSetEncryption(deps.settings),
-      legacyConfigured: hasLegacyHostMcpResolver(deps.settings, id.data),
-    };
-    if (method === "put") {
-      const parsed = PutHostMcpResolverRequest.safeParse(raw);
-      if (!parsed.success) throw new HTTPException(422, { message: "invalid resolver operation" });
-      let url: string;
-      try {
-        url = validateHttpUrl(parsed.data.url, {
-          allowLoopbackHttp: isLocalTestEnvironment(deps.settings.environment),
-        });
-        if (
-          new URL(url).protocol !== "https:" &&
-          !isLocalTestEnvironment(deps.settings.environment)
-        )
-          throw new Error();
-      } catch {
-        throw new HTTPException(422, { message: "invalid resolver URL" });
-      }
-      return await mutateHostMcpResolver(deps.db, actor, {
-        ...common,
-        kind: "put",
-        request: { ...parsed.data, url },
-      });
-    }
-    const parsed = RevokeHostMcpResolverRequest.safeParse(raw);
-    if (!parsed.success) throw new HTTPException(422, { message: "invalid resolver operation" });
-    return await mutateHostMcpResolver(deps.db, actor, {
-      ...common,
-      kind: "revoke",
-      request: parsed.data,
-    });
-  } catch (error) {
-    if (error instanceof HostMcpResolverError)
-      throw new HTTPException(error.status, { message: error.message });
-    if (error instanceof HTTPException) throw error;
-    // Database/encryption errors can carry SQL parameters. Never expose or log
-    // the underlying credential-bearing cause at the public route boundary.
-    throw new HTTPException(503, { message: "resolver administration unavailable" });
-  }
-}