@opengeni/core 3.0.1 → 3.1.2

package/dist/{chunk-OF65T3PM.js → chunk-TTWTXQB2.js}

@@ -7,6 +7,14 @@ import {
 } from "./chunk-QO5GVFFO.js";
 
 // src/managed-session.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { createHmac } from "crypto";
+import { managedUserEmailAllowed } from "@opengeni/config";
+import {
+  DatabaseUnavailableError,
+  isDatabaseConnectionLoss,
+  isRetryableDatabaseTransportFailure
+} from "@opengeni/db";
 import {
   acquireManagedAuthActorMutationLease,
   getManagedAuthAdoptedSessionSnapshot,
@@ -18,6 +26,36 @@ import {
 } from "@opengeni/db/managed-auth-session-sets";
 import { validateCanonicalHumanSession } from "@opengeni/db/canonical-human-identities";
 import { HTTPException } from "hono/http-exception";
+var managedAuthLookupFailures = new AsyncLocalStorage();
+var MANAGED_AUTH_LOOKUP_FAILURE_LIMIT = 8;
+function recordManagedAuthLoggedFailure(args) {
+  const store = managedAuthLookupFailures.getStore();
+  if (!store) return;
+  for (const value of args) {
+    if (store.errors.length >= MANAGED_AUTH_LOOKUP_FAILURE_LIMIT) return;
+    if (value && typeof value === "object") store.errors.push(value);
+  }
+}
+function isBetterAuthInternalServerError(error) {
+  if (!error || typeof error !== "object") return false;
+  const candidate = error;
+  return candidate.status === "INTERNAL_SERVER_ERROR" || candidate.statusCode === 500;
+}
+async function withManagedAuthSessionLookup(lookup) {
+  const store = { errors: [] };
+  try {
+    return await managedAuthLookupFailures.run(store, lookup);
+  } catch (error) {
+    if (isBetterAuthInternalServerError(error) && store.errors.some(
+      (logged) => isDatabaseConnectionLoss(logged) || isRetryableDatabaseTransportFailure(logged)
+    )) {
+      throw new DatabaseUnavailableError("managed auth session store unavailable", {
+        cause: error
+      });
+    }
+    throw error;
+  }
+}
 var ACTOR_MUTATION_LEASE_SECONDS = 15 * 60;
 var ACTOR_MUTATION_LEASE_REFRESH_MS = 5 * 60 * 1e3;
 var ACTOR_MUTATION_HANDLER_DEADLINE_MS = 10 * 60 * 1e3;
@@ -35,7 +73,49 @@ var actorMutationLeaseRuntime = productionActorMutationLeaseRuntime;
 var actorMutationLeaseByRequest = /* @__PURE__ */ new WeakMap();
 var managedActorEpochByRequest = /* @__PURE__ */ new WeakMap();
 var managedActorAdmissionByRequest = /* @__PURE__ */ new WeakMap();
-async function getManagedSession(c, auth, options) {
+var managedUserAllowlists = /* @__PURE__ */ new WeakMap();
+function configureManagedUserAdmission(auth, emails) {
+  if (emails === void 0) managedUserAllowlists.delete(auth);
+  else managedUserAllowlists.set(auth, [...emails]);
+}
+async function getManagedSession(...args) {
+  const session = await resolveManagedSession(...args);
+  assertManagedUserAdmission(args[1], session?.user);
+  return session;
+}
+var NATIVE_APP_CREDENTIAL_PREFIX = "ogapp_";
+async function getNativeAppManagedSession(auth, credential, db) {
+  if (!credential.startsWith(NATIVE_APP_CREDENTIAL_PREFIX)) return null;
+  const token = credential.slice(NATIVE_APP_CREDENTIAL_PREFIX.length);
+  if (!/^[A-Za-z0-9]{16,128}$/u.test(token)) return null;
+  const context = await auth.$context;
+  const signed = encodeURIComponent(
+    `${token}.${createHmac("sha256", context.secret).update(token, "utf8").digest("base64")}`
+  );
+  const session = await withManagedAuthSessionLookup(
+    () => auth.api.getSession({
+      headers: new Headers({ cookie: `${context.authCookies.sessionToken.name}=${signed}` }),
+      // Never serve a cached cookie snapshot: the app's session row is authoritative.
+      query: { disableCookieCache: true }
+    })
+  );
+  if (!session?.user) return null;
+  assertManagedUserAdmission(auth, session.user);
+  if (!db) return session;
+  const authSessionId = session.session?.id;
+  if (typeof authSessionId !== "string") return null;
+  const valid = await validateCanonicalHumanSession(db, {
+    authSessionId,
+    authUserId: session.user.id
+  });
+  return valid ? session : null;
+}
+function assertManagedUserAdmission(auth, user) {
+  const emails = managedUserAllowlists.get(auth);
+  if (user && emails !== void 0 && (!user.emailVerified || !managedUserEmailAllowed(emails, user.email)))
+    throw new HTTPException(403, { message: "Account is not permitted on this deployment" });
+}
+async function resolveManagedSession(c, auth, options) {
   const sessionSetMode = options?.sessionSetMode ?? "legacy";
   if (sessionSetMode !== "legacy" && options?.db && options.sessionAdapter) {
     const authority = requestCookie(c.req.raw, MANAGED_AUTH_SESSION_SET_COOKIE);
@@ -149,10 +229,12 @@ async function getManagedSession(c, auth, options) {
         throw error;
       }
   }
-  const result = await auth.api.getSession({
-    headers: c.req.raw.headers,
-    returnHeaders: true
-  });
+  const result = await withManagedAuthSessionLookup(
+    () => auth.api.getSession({
+      headers: c.req.raw.headers,
+      returnHeaders: true
+    })
+  );
   for (const cookie of setCookieHeaders(result.headers)) {
     c.header("set-cookie", cookie, { append: true });
   }
@@ -356,7 +438,13 @@ function setCookieHeaders(headers) {
 }
 
 export {
+  recordManagedAuthLoggedFailure,
+  withManagedAuthSessionLookup,
+  configureManagedUserAdmission,
   getManagedSession,
+  NATIVE_APP_CREDENTIAL_PREFIX,
+  getNativeAppManagedSession,
+  assertManagedUserAdmission,
   getManagedAuthRequestActorEpoch,
   releaseManagedAuthRequestActorLease,
   getManagedAuthRequestActorAbortSignal,
@@ -366,4 +454,4 @@ export {
   getManagedAuthRequestActorAdmissionStamp,
   getManagedAuthRequestActorLeaseStamp
 };
-//# sourceMappingURL=chunk-OF65T3PM.js.map
+//# sourceMappingURL=chunk-TTWTXQB2.js.map

package/dist/chunk-TTWTXQB2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-session.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createHmac } from \"node:crypto\";\nimport { managedUserEmailAllowed } from \"@opengeni/config\";\nimport type { Context } from \"hono\";\nimport type { ManagedAuth } from \"./managed-auth-type\";\nimport {\n  DatabaseUnavailableError,\n  isDatabaseConnectionLoss,\n  isRetryableDatabaseTransportFailure,\n  type Database,\n} from \"@opengeni/db\";\nimport {\n  acquireManagedAuthActorMutationLease,\n  getManagedAuthAdoptedSessionSnapshot,\n  getManagedAuthSessionSetSnapshot,\n  ManagedAuthSessionSetAuthorityError,\n  ManagedAuthSessionSetGenerationConflictError,\n  releaseManagedAuthActorMutationLease,\n  validateManagedAuthActorMutationLease,\n} from \"@opengeni/db/managed-auth-session-sets\";\nimport { validateCanonicalHumanSession } from \"@opengeni/db/canonical-human-identities\";\nimport type { ManagedAuthSessionSetMode } from \"@opengeni/contracts/managed-auth-session-sets\";\nimport { HTTPException } from \"hono/http-exception\";\nimport {\n  MANAGED_AUTH_ACTOR_EPOCH_HEADER,\n  MANAGED_AUTH_SESSION_SET_COOKIE,\n  ManagedAuthActorChangeError,\n  managedAuthSha256,\n  resolveManagedAuthSelectedSession,\n  type ManagedAuthSessionAdapter,\n} from \"./managed-auth-session-sets\";\n\n/**\n * Better Auth's session endpoint replaces every non-API failure with a generic\n * INTERNAL_SERVER_ERROR and passes the original only to its logger. A lookup run\n * through `withManagedAuthSessionLookup` collects what the logger saw, so a lost\n * database connection is reported as a retryable outage instead of an opaque 500.\n */\nconst managedAuthLookupFailures = new AsyncLocalStorage<{ errors: unknown[] }>();\nconst MANAGED_AUTH_LOOKUP_FAILURE_LIMIT = 8;\n\n/** Better Auth `logger.log` sink; a no-op outside a managed-auth session lookup. */\nexport function recordManagedAuthLoggedFailure(args: readonly unknown[]): void {\n  const store = managedAuthLookupFailures.getStore();\n  if (!store) return;\n  for (const value of args) {\n    if (store.errors.length >= MANAGED_AUTH_LOOKUP_FAILURE_LIMIT) return;\n    if (value && typeof value === \"object\") store.errors.push(value);\n  }\n}\n\nfunction isBetterAuthInternalServerError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") return false;\n  const candidate = error as { status?: unknown; statusCode?: unknown };\n  return candidate.status === \"INTERNAL_SERVER_ERROR\" || candidate.statusCode === 500;\n}\n\nexport async function withManagedAuthSessionLookup<T>(lookup: () => Promise<T>): Promise<T> {\n  const store = { errors: [] as unknown[] };\n  try {\n    return await managedAuthLookupFailures.run(store, lookup);\n  } catch (error) {\n    // Better Auth's session endpoint only reads its database adapter, so a\n    // socket failure it logged is that adapter's connection, not another service.\n    if (\n      isBetterAuthInternalServerError(error) &&\n      store.errors.some(\n        (logged) => isDatabaseConnectionLoss(logged) || isRetryableDatabaseTransportFailure(logged),\n      )\n    ) {\n      throw new DatabaseUnavailableError(\"managed auth session store unavailable\", {\n        cause: error,\n      });\n    }\n    throw error;\n  }\n}\n\nconst ACTOR_MUTATION_LEASE_SECONDS = 15 * 60;\nconst ACTOR_MUTATION_LEASE_REFRESH_MS = 5 * 60 * 1_000;\nconst ACTOR_MUTATION_HANDLER_DEADLINE_MS = 10 * 60 * 1_000;\nconst ACTOR_MUTATION_FATAL_SAFETY_MS = 5_000;\ntype ActorMutationLeaseRuntime = {\n  monotonicNow: () => number;\n  schedule: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;\n  cancel: (timer: ReturnType<typeof setTimeout>) => void;\n  terminate: () => void;\n};\nconst productionActorMutationLeaseRuntime: ActorMutationLeaseRuntime = {\n  monotonicNow: () => performance.now(),\n  schedule: (callback, delayMs) => unrefTimer(setTimeout(callback, delayMs)),\n  cancel: (timer) => clearTimeout(timer),\n  terminate: () => {\n    process.stderr.write(\"fatal: managed actor mutation outlived its durable lease\\n\");\n    process.exit(1);\n  },\n};\nlet actorMutationLeaseRuntime = productionActorMutationLeaseRuntime;\ntype ActorMutationLease = {\n  db: Database;\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n  refreshTimer: ReturnType<typeof setTimeout> | null;\n  deadlineTimer: ReturnType<typeof setTimeout> | null;\n  fatalTimer: ReturnType<typeof setTimeout> | null;\n  expiresAt: Date;\n  localFatalDeadlineMonotonicMs: number;\n  runtime: ActorMutationLeaseRuntime;\n  abortController: AbortController;\n  poisoned: unknown | null;\n  actorTransitionApplied: boolean;\n};\nconst actorMutationLeaseByRequest = new WeakMap<Request, ActorMutationLease>();\nconst managedActorEpochByRequest = new WeakMap<Request, string>();\nconst managedActorAdmissionByRequest = new WeakMap<Request, ManagedAuthActorAdmissionStamp>();\n\n/**\n * Read a Better Auth session without bypassing its sliding-cookie renewal.\n *\n * Better Auth can refresh the durable session while resolving `getSession`.\n * Programmatic callers must explicitly request and forward the returned cookie\n * headers; the HTTP handler does this automatically, but direct API calls do not.\n */\nconst managedUserAllowlists = new WeakMap<ManagedAuth, readonly string[]>();\n\n/** Bind admission to this auth instance, including all session-set modes. */\nexport function configureManagedUserAdmission(\n  auth: ManagedAuth,\n  emails: readonly string[] | undefined,\n): void {\n  if (emails === undefined) managedUserAllowlists.delete(auth);\n  else managedUserAllowlists.set(auth, [...emails]);\n}\n\nexport async function getManagedSession(...args: Parameters<typeof resolveManagedSession>) {\n  const session = await resolveManagedSession(...args);\n  assertManagedUserAdmission(args[1], session?.user);\n  return session;\n}\n\n/**\n * Bearer prefix of a native app credential. The credential is a dedicated\n * Better Auth session the person approved from a signed-in browser (see the\n * native app sign-in route); the prefix only routes it to this resolver.\n */\nexport const NATIVE_APP_CREDENTIAL_PREFIX = \"ogapp_\";\n\n/**\n * Resolve a native app credential exactly as the legacy managed cookie path\n * resolves a browser session: Better Auth validates expiry and renews the\n * durable session, then the canonical human session must still be valid. A\n * native credential never reads or selects a browser session set; each app\n * account holds its own independently revocable session.\n */\nexport async function getNativeAppManagedSession(\n  auth: ManagedAuth,\n  credential: string,\n  db: Database | undefined,\n) {\n  if (!credential.startsWith(NATIVE_APP_CREDENTIAL_PREFIX)) return null;\n  const token = credential.slice(NATIVE_APP_CREDENTIAL_PREFIX.length);\n  if (!/^[A-Za-z0-9]{16,128}$/u.test(token)) return null;\n  const context = await auth.$context;\n  const signed = encodeURIComponent(\n    `${token}.${createHmac(\"sha256\", context.secret).update(token, \"utf8\").digest(\"base64\")}`,\n  );\n  const session = await withManagedAuthSessionLookup(() =>\n    auth.api.getSession({\n      headers: new Headers({ cookie: `${context.authCookies.sessionToken.name}=${signed}` }),\n      // Never serve a cached cookie snapshot: the app's session row is authoritative.\n      query: { disableCookieCache: true },\n    }),\n  );\n  if (!session?.user) return null;\n  assertManagedUserAdmission(auth, session.user);\n  if (!db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(db, {\n    authSessionId,\n    authUserId: session.user.id,\n  });\n  return valid ? session : null;\n}\n\nexport function assertManagedUserAdmission(\n  auth: ManagedAuth,\n  user: { email: string; emailVerified: boolean } | null | undefined,\n): void {\n  const emails = managedUserAllowlists.get(auth);\n  if (\n    user &&\n    emails !== undefined &&\n    (!user.emailVerified || !managedUserEmailAllowed(emails, user.email))\n  )\n    throw new HTTPException(403, { message: \"Account is not permitted on this deployment\" });\n}\n\nasync function resolveManagedSession(\n  c: Context,\n  auth: ManagedAuth,\n  options?: {\n    db?: Database | undefined;\n    allowIdentityRecovery?: boolean | undefined;\n    sessionSetMode?: ManagedAuthSessionSetMode | undefined;\n    sessionAdapter?: ManagedAuthSessionAdapter | null | undefined;\n  },\n) {\n  const sessionSetMode = options?.sessionSetMode ?? \"legacy\";\n  if (sessionSetMode !== \"legacy\" && options?.db && options.sessionAdapter) {\n    const authority = requestCookie(c.req.raw, MANAGED_AUTH_SESSION_SET_COOKIE);\n    if (authority) {\n      try {\n        // A long-lived response reuses this exact Request for periodic\n        // authorization. Once admitted, the server-owned stamp is the actor\n        // fence: a client may omit the header on its initial GET, but a later\n        // reauthorization must not follow a newly selected actor.\n        const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n        const expectedActorEpoch =\n          admittedActorEpoch ?? c.req.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER) ?? null;\n        const legacyAmbient =\n          sessionSetMode === \"dual\" && expectedActorEpoch === null\n            ? await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers)\n            : null;\n        const selected = await resolveManagedAuthSelectedSession({\n          db: options.db,\n          adapter: options.sessionAdapter,\n          authority,\n          mode: sessionSetMode,\n          expectedActorEpoch,\n          legacyAmbientSessionId:\n            typeof legacyAmbient?.session?.id === \"string\" ? legacyAmbient.session.id : null,\n          allowRecovery: options.allowIdentityRecovery ?? false,\n        });\n        if (selected) {\n          // The actor epoch is both an admission fence and response provenance.\n          // A browser must ignore a late finite response after another tab has\n          // advanced selection, even when the request itself was read-only.\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, selected.projection.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, selected.projection.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: managedAuthSha256(authority),\n            actorEpoch: selected.projection.actorEpoch,\n          });\n        }\n        if (selected && !selected.session) return null;\n        if (selected?.session) {\n          let resolvedSession = selected.session;\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLease(\n              c.req.raw,\n              options.db,\n              authority,\n              selected.projection.actorEpoch,\n            );\n            const selectedSlot = await selectedSlotForAuthority(\n              options.db,\n              authority,\n              sessionSetMode,\n              options.allowIdentityRecovery ?? false,\n            );\n            if (!selectedSlot) throw new ManagedAuthActorChangeError();\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(selectedSlot);\n            if (\n              !refreshed ||\n              refreshed.session.id !== selectedSlot.authSessionId ||\n              refreshed.user.id !== selectedSlot.authUserId\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            resolvedSession = refreshed;\n          }\n          return resolvedSession;\n        }\n        // Once a browser presents a session-set authority it is authoritative.\n        // An absent/expired/rekeyed authority must never fall through to an\n        // ambient Better Auth cookie in dual mode: that would bypass the actor\n        // epoch and mutation-lease fences after another tab transitions.\n        return null;\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          // Response headers are immutable after an SSE body starts. The\n          // original response already carries its actor epoch; reauthorization\n          // closes that stream through the thrown conflict instead.\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n    }\n    if (sessionSetMode === \"broker\") return null;\n    const ambient = await options.sessionAdapter.resolveAmbientSession(c.req.raw.headers);\n    if (ambient?.session?.id)\n      try {\n        const adopted = await getManagedAuthAdoptedSessionSnapshot(options.db, ambient.session.id);\n        if (adopted) {\n          const admittedActorEpoch = managedActorEpochByRequest.get(c.req.raw) ?? null;\n          if (\n            adopted.actorEpoch !== \"1\" ||\n            (admittedActorEpoch !== null && adopted.actorEpoch !== admittedActorEpoch) ||\n            !adopted.selected ||\n            adopted.selected.authSessionId !== ambient.session.id ||\n            adopted.selected.authUserId !== ambient.user.id\n          ) {\n            throw new ManagedAuthActorChangeError();\n          }\n          if (admittedActorEpoch === null) {\n            c.header(MANAGED_AUTH_ACTOR_EPOCH_HEADER, adopted.actorEpoch);\n            managedActorEpochByRequest.set(c.req.raw, adopted.actorEpoch);\n          }\n          managedActorAdmissionByRequest.set(c.req.raw, {\n            authorityHash: adopted.authorityHash,\n            actorEpoch: adopted.actorEpoch,\n          });\n          if (requestNeedsActorMutationLease(c.req.method)) {\n            await ensureActorMutationLeaseForHash(\n              c.req.raw,\n              options.db,\n              adopted.authorityHash,\n              adopted.actorEpoch,\n            );\n            const current = await getManagedAuthAdoptedSessionSnapshot(\n              options.db,\n              ambient.session.id,\n            );\n            if (\n              current?.authorityHash !== adopted.authorityHash ||\n              current.actorEpoch !== adopted.actorEpoch ||\n              !current.selected ||\n              current.selected.authSessionId !== ambient.session.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            const refreshed = await options.sessionAdapter.refreshSelectedSession(current.selected);\n            if (\n              !refreshed ||\n              refreshed.session.id !== ambient.session.id ||\n              refreshed.user.id !== ambient.user.id\n            ) {\n              throw new ManagedAuthActorChangeError();\n            }\n            return refreshed;\n          }\n          return ambient;\n        }\n      } catch (error) {\n        if (error instanceof ManagedAuthActorChangeError) {\n          if (!managedActorEpochByRequest.has(c.req.raw)) {\n            c.header(\"x-opengeni-actor-state\", \"changed\");\n          }\n          throw new HTTPException(409, { message: error.code, cause: error });\n        }\n        throw error;\n      }\n  }\n  const result = await withManagedAuthSessionLookup(() =>\n    auth.api.getSession({\n      headers: c.req.raw.headers,\n      returnHeaders: true,\n    }),\n  );\n\n  for (const cookie of setCookieHeaders(result.headers)) {\n    c.header(\"set-cookie\", cookie, { append: true });\n  }\n\n  const session = result.response;\n  if (!session?.user || !options?.db) return session;\n  const authSessionId = session.session?.id;\n  if (typeof authSessionId !== \"string\") return null;\n  const valid = await validateCanonicalHumanSession(options.db, {\n    authSessionId,\n    authUserId: session.user.id,\n    ...(options.allowIdentityRecovery === undefined\n      ? {}\n      : { allowRecovery: options.allowIdentityRecovery }),\n  });\n  return valid ? session : null;\n}\n\n/** Safe response provenance for a request authenticated through session-set authority. */\nexport function getManagedAuthRequestActorEpoch(request: Request): string | null {\n  return managedActorEpochByRequest.get(request) ?? null;\n}\n\nfunction selectedSlotForAuthority(\n  db: Database,\n  authority: string,\n  mode: ManagedAuthSessionSetMode,\n  allowRecovery: boolean,\n) {\n  return getManagedAuthSessionSetSnapshot(db, {\n    authorityHash: managedAuthSha256(authority),\n    mode,\n    includeInternal: true,\n    allowRecovery,\n    readOnly: true,\n  }).then((snapshot) => snapshot?.selected ?? null);\n}\n\n/** Release the multi-replica actor fence after the outer HTTP handler settles. */\nexport async function releaseManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  actorMutationLeaseByRequest.delete(request);\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  if (lease.deadlineTimer) lease.runtime.cancel(lease.deadlineTimer);\n  if (lease.fatalTimer) lease.runtime.cancel(lease.fatalTimer);\n  await releaseManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    requestId: lease.requestId,\n  });\n}\n\n/** Cooperative cancellation signal for actor-scoped provider/external I/O. */\nexport function getManagedAuthRequestActorAbortSignal(request: Request): AbortSignal | null {\n  return actorMutationLeaseByRequest.get(request)?.abortController.signal ?? null;\n}\n\n/** @internal Deterministic lease-clock seam used only by direct lifecycle tests. */\nexport function installManagedAuthActorLeaseRuntimeForTest(\n  overrides: Partial<ActorMutationLeaseRuntime>,\n): () => void {\n  const previous = actorMutationLeaseRuntime;\n  actorMutationLeaseRuntime = {\n    ...productionActorMutationLeaseRuntime,\n    ...overrides,\n  };\n  return () => {\n    actorMutationLeaseRuntime = previous;\n  };\n}\n\n/**\n * Exact post-handler fence. A finite unsafe response is not released unless\n * its request-owned lease is still live at the same actor epoch.\n */\nexport async function validateManagedAuthRequestActorLease(request: Request): Promise<void> {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (!lease) return;\n  if (lease.actorTransitionApplied) return;\n  if (lease.poisoned !== null) {\n    throw new ManagedAuthActorLeaseOutcomeUnknownError({\n      cause: lease.poisoned,\n    });\n  }\n  const valid = await validateManagedAuthActorMutationLease(lease.db, {\n    authorityHash: lease.authorityHash,\n    actorEpoch: lease.actorEpoch,\n    requestId: lease.requestId,\n  });\n  if (!valid) throw new ManagedAuthActorChangeError();\n}\n\nexport class ManagedAuthActorLeaseOutcomeUnknownError extends Error {\n  readonly name = \"ManagedAuthActorLeaseOutcomeUnknownError\";\n  readonly code = \"operation_outcome_unknown\";\n  constructor(options?: ErrorOptions) {\n    super(\"The actor-scoped request outcome is unknown after its durable lease was lost\", options);\n  }\n}\n\n/** A known-applied same-request canonical transition intentionally consumes its lease. */\nexport function markManagedAuthRequestActorTransitionApplied(request: Request): void {\n  const lease = actorMutationLeaseByRequest.get(request);\n  if (lease) lease.actorTransitionApplied = true;\n}\n\nexport type ManagedAuthActorMutationLeaseStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n  requestId: string;\n};\n\nexport type ManagedAuthActorAdmissionStamp = {\n  authorityHash: string;\n  actorEpoch: string;\n};\n\n/** Verified server-owned actor evidence available to both reads and mutations. */\nexport function getManagedAuthRequestActorAdmissionStamp(\n  request: Request,\n): ManagedAuthActorAdmissionStamp | null {\n  return managedActorAdmissionByRequest.get(request) ?? null;\n}\n\n/** Exact request-owned fence passed into a same-transaction actor transition. */\nexport function getManagedAuthRequestActorLeaseStamp(\n  request: Request,\n): ManagedAuthActorMutationLeaseStamp | null {\n  const lease = actorMutationLeaseByRequest.get(request);\n  return lease\n    ? {\n        authorityHash: lease.authorityHash,\n        actorEpoch: lease.actorEpoch,\n        requestId: lease.requestId,\n      }\n    : null;\n}\n\nfunction requestNeedsActorMutationLease(method: string): boolean {\n  return method !== \"GET\" && method !== \"HEAD\" && method !== \"OPTIONS\";\n}\n\nasync function ensureActorMutationLease(\n  request: Request,\n  db: Database,\n  authority: string,\n  actorEpoch: string,\n): Promise<void> {\n  const authorityHash = managedAuthSha256(authority);\n  await ensureActorMutationLeaseForHash(request, db, authorityHash, actorEpoch);\n}\n\nasync function ensureActorMutationLeaseForHash(\n  request: Request,\n  db: Database,\n  authorityHash: string,\n  actorEpoch: string,\n): Promise<void> {\n  const existing = actorMutationLeaseByRequest.get(request);\n  if (existing) {\n    if (existing.authorityHash !== authorityHash || existing.actorEpoch !== actorEpoch) {\n      throw new ManagedAuthActorChangeError();\n    }\n    return;\n  }\n  const lease: ActorMutationLease = {\n    db,\n    authorityHash,\n    actorEpoch,\n    requestId: crypto.randomUUID(),\n    refreshTimer: null,\n    deadlineTimer: null,\n    fatalTimer: null,\n    expiresAt: new Date(0),\n    localFatalDeadlineMonotonicMs: 0,\n    runtime: actorMutationLeaseRuntime,\n    abortController: new AbortController(),\n    poisoned: null,\n    actorTransitionApplied: false,\n  };\n  const acquireStartedAtMonotonicMs = lease.runtime.monotonicNow();\n  try {\n    lease.expiresAt = await acquireManagedAuthActorMutationLease(db, {\n      authorityHash,\n      actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    });\n  } catch (error) {\n    if (\n      error instanceof ManagedAuthSessionSetGenerationConflictError ||\n      error instanceof ManagedAuthSessionSetAuthorityError\n    ) {\n      throw new ManagedAuthActorChangeError();\n    }\n    throw error;\n  }\n  lease.localFatalDeadlineMonotonicMs =\n    acquireStartedAtMonotonicMs +\n    ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n    ACTOR_MUTATION_FATAL_SAFETY_MS;\n  actorMutationLeaseByRequest.set(request, lease);\n  scheduleActorMutationLeaseRefresh(request, lease);\n  lease.deadlineTimer = lease.runtime.schedule(() => {\n    poisonActorMutationLease(\n      request,\n      lease,\n      new Error(\"managed actor mutation handler exceeded its bounded lifetime\"),\n    );\n  }, ACTOR_MUTATION_HANDLER_DEADLINE_MS);\n}\n\nfunction scheduleActorMutationLeaseRefresh(request: Request, lease: ActorMutationLease): void {\n  const timer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    const refreshStartedAtMonotonicMs = lease.runtime.monotonicNow();\n    void acquireManagedAuthActorMutationLease(lease.db, {\n      authorityHash: lease.authorityHash,\n      actorEpoch: lease.actorEpoch,\n      requestId: lease.requestId,\n      leaseSeconds: ACTOR_MUTATION_LEASE_SECONDS,\n    })\n      .then(async (expiresAt) => {\n        if (actorMutationLeaseByRequest.get(request) !== lease) {\n          // Release may have won while this pooled acquire statement was in\n          // flight. Converge the just-renewed row immediately; never resurrect\n          // a request-owned fence after the outer handler has settled.\n          await releaseManagedAuthActorMutationLease(lease.db, {\n            authorityHash: lease.authorityHash,\n            requestId: lease.requestId,\n          });\n          return;\n        }\n        lease.expiresAt = expiresAt;\n        lease.localFatalDeadlineMonotonicMs =\n          refreshStartedAtMonotonicMs +\n          ACTOR_MUTATION_LEASE_SECONDS * 1_000 -\n          ACTOR_MUTATION_FATAL_SAFETY_MS;\n        scheduleActorMutationLeaseRefresh(request, lease);\n      })\n      .catch((error) => poisonActorMutationLease(request, lease, error));\n  }, ACTOR_MUTATION_LEASE_REFRESH_MS);\n  lease.refreshTimer = timer;\n}\n\nfunction poisonActorMutationLease(\n  request: Request,\n  lease: ActorMutationLease,\n  error: unknown,\n): void {\n  if (actorMutationLeaseByRequest.get(request) !== lease || lease.poisoned !== null) return;\n  lease.poisoned = error;\n  if (lease.refreshTimer) lease.runtime.cancel(lease.refreshTimer);\n  lease.refreshTimer = null;\n  lease.abortController.abort(error);\n  const fatalAfterMs = Math.max(\n    0,\n    lease.localFatalDeadlineMonotonicMs - lease.runtime.monotonicNow(),\n  );\n  lease.fatalTimer = lease.runtime.schedule(() => {\n    if (actorMutationLeaseByRequest.get(request) !== lease) return;\n    // A handler that ignored cooperative cancellation must not outlive the\n    // durable fence and resume under a later actor. Terminate this API\n    // instance before PostgreSQL can expire the lease; process death is the\n    // final multi-replica-safe cancellation boundary.\n    lease.runtime.terminate();\n  }, fatalAfterMs);\n}\n\nfunction unrefTimer<T extends ReturnType<typeof setTimeout>>(timer: T): T {\n  (timer as T & { unref?: () => void }).unref?.();\n  return timer;\n}\n\nfunction requestCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\");\n    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;\n    const value = part.slice(separator + 1).trim();\n    if (!value || value.length > 512) return null;\n    try {\n      return decodeURIComponent(value);\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\nfunction setCookieHeaders(headers: Headers): string[] {\n  const getSetCookie = (\n    headers as Headers & {\n      getSetCookie?: () => string[];\n    }\n  ).getSetCookie;\n  if (getSetCookie) {\n    return getSetCookie.call(headers);\n  }\n\n  const cookie = headers.get(\"set-cookie\");\n  return cookie ? [cookie] : [];\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAC3B,SAAS,+BAA+B;AAGxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C,SAAS,qBAAqB;AAgB9B,IAAM,4BAA4B,IAAI,kBAAyC;AAC/E,IAAM,oCAAoC;AAGnC,SAAS,+BAA+B,MAAgC;AAC7E,QAAM,QAAQ,0BAA0B,SAAS;AACjD,MAAI,CAAC,MAAO;AACZ,aAAW,SAAS,MAAM;AACxB,QAAI,MAAM,OAAO,UAAU,kCAAmC;AAC9D,QAAI,SAAS,OAAO,UAAU,SAAU,OAAM,OAAO,KAAK,KAAK;AAAA,EACjE;AACF;AAEA,SAAS,gCAAgC,OAAyB;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAClB,SAAO,UAAU,WAAW,2BAA2B,UAAU,eAAe;AAClF;AAEA,eAAsB,6BAAgC,QAAsC;AAC1F,QAAM,QAAQ,EAAE,QAAQ,CAAC,EAAe;AACxC,MAAI;AACF,WAAO,MAAM,0BAA0B,IAAI,OAAO,MAAM;AAAA,EAC1D,SAAS,OAAO;AAGd,QACE,gCAAgC,KAAK,KACrC,MAAM,OAAO;AAAA,MACX,CAAC,WAAW,yBAAyB,MAAM,KAAK,oCAAoC,MAAM;AAAA,IAC5F,GACA;AACA,YAAM,IAAI,yBAAyB,0CAA0C;AAAA,QAC3E,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,IAAM,+BAA+B,KAAK;AAC1C,IAAM,kCAAkC,IAAI,KAAK;AACjD,IAAM,qCAAqC,KAAK,KAAK;AACrD,IAAM,iCAAiC;AAOvC,IAAM,sCAAiE;AAAA,EACrE,cAAc,MAAM,YAAY,IAAI;AAAA,EACpC,UAAU,CAAC,UAAU,YAAY,WAAW,WAAW,UAAU,OAAO,CAAC;AAAA,EACzE,QAAQ,CAAC,UAAU,aAAa,KAAK;AAAA,EACrC,WAAW,MAAM;AACf,YAAQ,OAAO,MAAM,4DAA4D;AACjF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AACA,IAAI,4BAA4B;AAgBhC,IAAM,8BAA8B,oBAAI,QAAqC;AAC7E,IAAM,6BAA6B,oBAAI,QAAyB;AAChE,IAAM,iCAAiC,oBAAI,QAAiD;AAS5F,IAAM,wBAAwB,oBAAI,QAAwC;AAGnE,SAAS,8BACd,MACA,QACM;AACN,MAAI,WAAW,OAAW,uBAAsB,OAAO,IAAI;AAAA,MACtD,uBAAsB,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC;AAClD;AAEA,eAAsB,qBAAqB,MAAgD;AACzF,QAAM,UAAU,MAAM,sBAAsB,GAAG,IAAI;AACnD,6BAA2B,KAAK,CAAC,GAAG,SAAS,IAAI;AACjD,SAAO;AACT;AAOO,IAAM,+BAA+B;AAS5C,eAAsB,2BACpB,MACA,YACA,IACA;AACA,MAAI,CAAC,WAAW,WAAW,4BAA4B,EAAG,QAAO;AACjE,QAAM,QAAQ,WAAW,MAAM,6BAA6B,MAAM;AAClE,MAAI,CAAC,yBAAyB,KAAK,KAAK,EAAG,QAAO;AAClD,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,SAAS;AAAA,IACb,GAAG,KAAK,IAAI,WAAW,UAAU,QAAQ,MAAM,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,QAAQ,CAAC;AAAA,EACzF;AACA,QAAM,UAAU,MAAM;AAAA,IAA6B,MACjD,KAAK,IAAI,WAAW;AAAA,MAClB,SAAS,IAAI,QAAQ,EAAE,QAAQ,GAAG,QAAQ,YAAY,aAAa,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA;AAAA,MAErF,OAAO,EAAE,oBAAoB,KAAK;AAAA,IACpC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,6BAA2B,MAAM,QAAQ,IAAI;AAC7C,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,IAAI;AAAA,IACpD;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,EAC3B,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAEO,SAAS,2BACd,MACA,MACM;AACN,QAAM,SAAS,sBAAsB,IAAI,IAAI;AAC7C,MACE,QACA,WAAW,WACV,CAAC,KAAK,iBAAiB,CAAC,wBAAwB,QAAQ,KAAK,KAAK;AAEnE,UAAM,IAAI,cAAc,KAAK,EAAE,SAAS,8CAA8C,CAAC;AAC3F;AAEA,eAAe,sBACb,GACA,MACA,SAMA;AACA,QAAM,iBAAiB,SAAS,kBAAkB;AAClD,MAAI,mBAAmB,YAAY,SAAS,MAAM,QAAQ,gBAAgB;AACxE,UAAM,YAAY,cAAc,EAAE,IAAI,KAAK,+BAA+B;AAC1E,QAAI,WAAW;AACb,UAAI;AAKF,cAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cAAM,qBACJ,sBAAsB,EAAE,IAAI,OAAO,+BAA+B,KAAK;AACzE,cAAM,gBACJ,mBAAmB,UAAU,uBAAuB,OAChD,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO,IACpE;AACN,cAAM,WAAW,MAAM,kCAAkC;AAAA,UACvD,IAAI,QAAQ;AAAA,UACZ,SAAS,QAAQ;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,UACN;AAAA,UACA,wBACE,OAAO,eAAe,SAAS,OAAO,WAAW,cAAc,QAAQ,KAAK;AAAA,UAC9E,eAAe,QAAQ,yBAAyB;AAAA,QAClD,CAAC;AACD,YAAI,UAAU;AAIZ,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,SAAS,WAAW,UAAU;AACxE,uCAA2B,IAAI,EAAE,IAAI,KAAK,SAAS,WAAW,UAAU;AAAA,UAC1E;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,kBAAkB,SAAS;AAAA,YAC1C,YAAY,SAAS,WAAW;AAAA,UAClC,CAAC;AAAA,QACH;AACA,YAAI,YAAY,CAAC,SAAS,QAAS,QAAO;AAC1C,YAAI,UAAU,SAAS;AACrB,cAAI,kBAAkB,SAAS;AAC/B,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR;AAAA,cACA,SAAS,WAAW;AAAA,YACtB;AACA,kBAAM,eAAe,MAAM;AAAA,cACzB,QAAQ;AAAA,cACR;AAAA,cACA;AAAA,cACA,QAAQ,yBAAyB;AAAA,YACnC;AACA,gBAAI,CAAC,aAAc,OAAM,IAAI,4BAA4B;AACzD,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,YAAY;AAClF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,aAAa,iBACtC,UAAU,KAAK,OAAO,aAAa,YACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,8BAAkB;AAAA,UACpB;AACA,iBAAO;AAAA,QACT;AAKA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAIhD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,QAAI,mBAAmB,SAAU,QAAO;AACxC,UAAM,UAAU,MAAM,QAAQ,eAAe,sBAAsB,EAAE,IAAI,IAAI,OAAO;AACpF,QAAI,SAAS,SAAS;AACpB,UAAI;AACF,cAAM,UAAU,MAAM,qCAAqC,QAAQ,IAAI,QAAQ,QAAQ,EAAE;AACzF,YAAI,SAAS;AACX,gBAAM,qBAAqB,2BAA2B,IAAI,EAAE,IAAI,GAAG,KAAK;AACxE,cACE,QAAQ,eAAe,OACtB,uBAAuB,QAAQ,QAAQ,eAAe,sBACvD,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,MACnD,QAAQ,SAAS,eAAe,QAAQ,KAAK,IAC7C;AACA,kBAAM,IAAI,4BAA4B;AAAA,UACxC;AACA,cAAI,uBAAuB,MAAM;AAC/B,cAAE,OAAO,iCAAiC,QAAQ,UAAU;AAC5D,uCAA2B,IAAI,EAAE,IAAI,KAAK,QAAQ,UAAU;AAAA,UAC9D;AACA,yCAA+B,IAAI,EAAE,IAAI,KAAK;AAAA,YAC5C,eAAe,QAAQ;AAAA,YACvB,YAAY,QAAQ;AAAA,UACtB,CAAC;AACD,cAAI,+BAA+B,EAAE,IAAI,MAAM,GAAG;AAChD,kBAAM;AAAA,cACJ,EAAE,IAAI;AAAA,cACN,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV;AACA,kBAAM,UAAU,MAAM;AAAA,cACpB,QAAQ;AAAA,cACR,QAAQ,QAAQ;AAAA,YAClB;AACA,gBACE,SAAS,kBAAkB,QAAQ,iBACnC,QAAQ,eAAe,QAAQ,cAC/B,CAAC,QAAQ,YACT,QAAQ,SAAS,kBAAkB,QAAQ,QAAQ,IACnD;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,kBAAM,YAAY,MAAM,QAAQ,eAAe,uBAAuB,QAAQ,QAAQ;AACtF,gBACE,CAAC,aACD,UAAU,QAAQ,OAAO,QAAQ,QAAQ,MACzC,UAAU,KAAK,OAAO,QAAQ,KAAK,IACnC;AACA,oBAAM,IAAI,4BAA4B;AAAA,YACxC;AACA,mBAAO;AAAA,UACT;AACA,iBAAO;AAAA,QACT;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,6BAA6B;AAChD,cAAI,CAAC,2BAA2B,IAAI,EAAE,IAAI,GAAG,GAAG;AAC9C,cAAE,OAAO,0BAA0B,SAAS;AAAA,UAC9C;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,MAAM,CAAC;AAAA,QACpE;AACA,cAAM;AAAA,MACR;AAAA,EACJ;AACA,QAAM,SAAS,MAAM;AAAA,IAA6B,MAChD,KAAK,IAAI,WAAW;AAAA,MAClB,SAAS,EAAE,IAAI,IAAI;AAAA,MACnB,eAAe;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,aAAW,UAAU,iBAAiB,OAAO,OAAO,GAAG;AACrD,MAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD;AAEA,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,GAAI,QAAO;AAC3C,QAAM,gBAAgB,QAAQ,SAAS;AACvC,MAAI,OAAO,kBAAkB,SAAU,QAAO;AAC9C,QAAM,QAAQ,MAAM,8BAA8B,QAAQ,IAAI;AAAA,IAC5D;AAAA,IACA,YAAY,QAAQ,KAAK;AAAA,IACzB,GAAI,QAAQ,0BAA0B,SAClC,CAAC,IACD,EAAE,eAAe,QAAQ,sBAAsB;AAAA,EACrD,CAAC;AACD,SAAO,QAAQ,UAAU;AAC3B;AAGO,SAAS,gCAAgC,SAAiC;AAC/E,SAAO,2BAA2B,IAAI,OAAO,KAAK;AACpD;AAEA,SAAS,yBACP,IACA,WACA,MACA,eACA;AACA,SAAO,iCAAiC,IAAI;AAAA,IAC1C,eAAe,kBAAkB,SAAS;AAAA,IAC1C;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA,UAAU;AAAA,EACZ,CAAC,EAAE,KAAK,CAAC,aAAa,UAAU,YAAY,IAAI;AAClD;AAGA,eAAsB,oCAAoC,SAAiC;AACzF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,8BAA4B,OAAO,OAAO;AAC1C,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,MAAI,MAAM,cAAe,OAAM,QAAQ,OAAO,MAAM,aAAa;AACjE,MAAI,MAAM,WAAY,OAAM,QAAQ,OAAO,MAAM,UAAU;AAC3D,QAAM,qCAAqC,MAAM,IAAI;AAAA,IACnD,eAAe,MAAM;AAAA,IACrB,WAAW,MAAM;AAAA,EACnB,CAAC;AACH;AAGO,SAAS,sCAAsC,SAAsC;AAC1F,SAAO,4BAA4B,IAAI,OAAO,GAAG,gBAAgB,UAAU;AAC7E;AAoBA,eAAsB,qCAAqC,SAAiC;AAC1F,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,CAAC,MAAO;AACZ,MAAI,MAAM,uBAAwB;AAClC,MAAI,MAAM,aAAa,MAAM;AAC3B,UAAM,IAAI,yCAAyC;AAAA,MACjD,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,sCAAsC,MAAM,IAAI;AAAA,IAClE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,4BAA4B;AACpD;AAEO,IAAM,2CAAN,cAAuD,MAAM;AAAA,EACzD,OAAO;AAAA,EACP,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,gFAAgF,OAAO;AAAA,EAC/F;AACF;AAGO,SAAS,6CAA6C,SAAwB;AACnF,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,MAAI,MAAO,OAAM,yBAAyB;AAC5C;AAcO,SAAS,yCACd,SACuC;AACvC,SAAO,+BAA+B,IAAI,OAAO,KAAK;AACxD;AAGO,SAAS,qCACd,SAC2C;AAC3C,QAAM,QAAQ,4BAA4B,IAAI,OAAO;AACrD,SAAO,QACH;AAAA,IACE,eAAe,MAAM;AAAA,IACrB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,EACnB,IACA;AACN;AAEA,SAAS,+BAA+B,QAAyB;AAC/D,SAAO,WAAW,SAAS,WAAW,UAAU,WAAW;AAC7D;AAEA,eAAe,yBACb,SACA,IACA,WACA,YACe;AACf,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,QAAM,gCAAgC,SAAS,IAAI,eAAe,UAAU;AAC9E;AAEA,eAAe,gCACb,SACA,IACA,eACA,YACe;AACf,QAAM,WAAW,4BAA4B,IAAI,OAAO;AACxD,MAAI,UAAU;AACZ,QAAI,SAAS,kBAAkB,iBAAiB,SAAS,eAAe,YAAY;AAClF,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA;AAAA,EACF;AACA,QAAM,QAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,OAAO,WAAW;AAAA,IAC7B,cAAc;AAAA,IACd,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,WAAW,oBAAI,KAAK,CAAC;AAAA,IACrB,+BAA+B;AAAA,IAC/B,SAAS;AAAA,IACT,iBAAiB,IAAI,gBAAgB;AAAA,IACrC,UAAU;AAAA,IACV,wBAAwB;AAAA,EAC1B;AACA,QAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,MAAI;AACF,UAAM,YAAY,MAAM,qCAAqC,IAAI;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QACE,iBAAiB,gDACjB,iBAAiB,qCACjB;AACA,YAAM,IAAI,4BAA4B;AAAA,IACxC;AACA,UAAM;AAAA,EACR;AACA,QAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,8BAA4B,IAAI,SAAS,KAAK;AAC9C,oCAAkC,SAAS,KAAK;AAChD,QAAM,gBAAgB,MAAM,QAAQ,SAAS,MAAM;AACjD;AAAA,MACE;AAAA,MACA;AAAA,MACA,IAAI,MAAM,8DAA8D;AAAA,IAC1E;AAAA,EACF,GAAG,kCAAkC;AACvC;AAEA,SAAS,kCAAkC,SAAkB,OAAiC;AAC5F,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AACzC,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AACxD,UAAM,8BAA8B,MAAM,QAAQ,aAAa;AAC/D,SAAK,qCAAqC,MAAM,IAAI;AAAA,MAClD,eAAe,MAAM;AAAA,MACrB,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,cAAc;AAAA,IAChB,CAAC,EACE,KAAK,OAAO,cAAc;AACzB,UAAI,4BAA4B,IAAI,OAAO,MAAM,OAAO;AAItD,cAAM,qCAAqC,MAAM,IAAI;AAAA,UACnD,eAAe,MAAM;AAAA,UACrB,WAAW,MAAM;AAAA,QACnB,CAAC;AACD;AAAA,MACF;AACA,YAAM,YAAY;AAClB,YAAM,gCACJ,8BACA,+BAA+B,MAC/B;AACF,wCAAkC,SAAS,KAAK;AAAA,IAClD,CAAC,EACA,MAAM,CAAC,UAAU,yBAAyB,SAAS,OAAO,KAAK,CAAC;AAAA,EACrE,GAAG,+BAA+B;AAClC,QAAM,eAAe;AACvB;AAEA,SAAS,yBACP,SACA,OACA,OACM;AACN,MAAI,4BAA4B,IAAI,OAAO,MAAM,SAAS,MAAM,aAAa,KAAM;AACnF,QAAM,WAAW;AACjB,MAAI,MAAM,aAAc,OAAM,QAAQ,OAAO,MAAM,YAAY;AAC/D,QAAM,eAAe;AACrB,QAAM,gBAAgB,MAAM,KAAK;AACjC,QAAM,eAAe,KAAK;AAAA,IACxB;AAAA,IACA,MAAM,gCAAgC,MAAM,QAAQ,aAAa;AAAA,EACnE;AACA,QAAM,aAAa,MAAM,QAAQ,SAAS,MAAM;AAC9C,QAAI,4BAA4B,IAAI,OAAO,MAAM,MAAO;AAKxD,UAAM,QAAQ,UAAU;AAAA,EAC1B,GAAG,YAAY;AACjB;AAEA,SAAS,WAAoD,OAAa;AACxE,EAAC,MAAqC,QAAQ;AAC9C,SAAO;AACT;AAEA,SAAS,cAAc,SAAkB,MAA6B;AACpE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,YAAY,KAAK,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,MAAM,KAAM;AAC/D,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,CAAC,SAAS,MAAM,SAAS,IAAK,QAAO;AACzC,QAAI;AACF,aAAO,mBAAmB,KAAK;AAAA,IACjC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA4B;AACpD,QAAM,eACJ,QAGA;AACF,MAAI,cAAc;AAChB,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC;AAEA,QAAM,SAAS,QAAQ,IAAI,YAAY;AACvC,SAAO,SAAS,CAAC,MAAM,IAAI,CAAC;AAC9B;","names":[]}

package/dist/codex-model-availability.d.ts

@@ -0,0 +1,55 @@
+import { fetchCodexModels } from "@opengeni/codex";
+import { type Settings } from "@opengeni/config";
+import { listSubscriptionCoreCodexServingConnections, readCodexCutoverDisposition, recordSubscriptionCoreCodexModelCatalog, type CodexCredentialTokenSnapshot, type Database } from "@opengeni/db";
+import type { ModelAvailabilityObservation } from "./model-catalog.js";
+/** The workspace, organization and acting subject of a Codex catalog read. */
+export type WorkspaceCodexCatalogContext = {
+    accountId: string;
+    workspaceId: string;
+    /**
+     * The person whose new work the catalog describes: the authenticated
+     * caller, or a scheduled task's execution owner. Their own personal
+     * connection counts only in their own Personal workspace; null or a
+     * non-human subject sees shared capacity only.
+     */
+    subjectId: string | null;
+};
+export type WorkspaceCodexCatalogReadiness = {
+    /** Codex models are ready in this workspace (the catalog's connection readiness). */
+    active: boolean;
+    /** Live per-model availability, keyed by model definition version. */
+    observations: Record<string, ModelAvailabilityObservation>;
+};
+type CatalogDependencies = {
+    recordModels: typeof recordSubscriptionCoreCodexModelCatalog;
+    disposition: typeof readCodexCutoverDisposition;
+    listServing: typeof listSubscriptionCoreCodexServingConnections;
+    fetchModels: typeof fetchCodexModels;
+    getCoreToken: (db: Database, settings: Settings, context: WorkspaceCodexCatalogContext, connectionId: string) => Promise<CodexCredentialTokenSnapshot>;
+};
+/**
+ * Placement consumes the same per-account catalog facts as the picker, never
+ * the union of another account's entitlements. Failed reads remain unknown.
+ * Personal credentials require an accepted-turn lease and are not probed by
+ * this workspace reader; their proven refusals remain model cooldowns.
+ */
+export declare function refreshCoreCodexModelEntitlements(db: Database, settings: Settings, context: WorkspaceCodexCatalogContext, deps?: CatalogDependencies): Promise<void>;
+/**
+ * Codex readiness and live model availability for a workspace catalog,
+ * default-model or picker read, by the organization's Codex cutover row:
+ *
+ * - a missing or disabled row (maintenance): Codex is not ready and no legacy Codex
+ *   table is read;
+ * - an enabled row (`core`): the core connections that can serve new work of
+ *   `context.subjectId` here. A shared connection's live model list is read
+ *   through the connection-level core seam. A personal connection's list
+ *   cannot be read outside an exact accepted turn, so a model it permits and
+ *   has not been refused for (no live model cooldown) is reported without an
+ *   observation (selectable, status unknown); placement still decides.
+ */
+export declare function loadWorkspaceCodexCatalogReadiness(db: Database, settings: Settings, context: WorkspaceCodexCatalogContext, options?: {
+    observeAvailability?: boolean;
+    /** Deployment-level readiness settings, when different from the model catalog. */
+    activeSettings?: Pick<Settings, "codexSubscriptionEnabled">;
+}, deps?: CatalogDependencies): Promise<WorkspaceCodexCatalogReadiness>;
+export {};

package/dist/default-session-model.d.ts

@@ -0,0 +1,192 @@
+import { type ConfiguredModel, type Settings } from "@opengeni/config";
+import { type DefaultModelSelection, type ReasoningEffort, type ScheduledTask, type WorkspaceSessionDefaults, type ClaudeProviderAccountAuthoritySnapshotV1, type BillingBalance, type OrganizationModelDefaults } from "@opengeni/contracts";
+import { type SubscriptionCoreClaudeCatalogReadiness, type ConnectionModelRestrictions, type Database } from "@opengeni/db";
+import { type WorkspaceModelSelection, type WorkspaceModelSelectionInput } from "./model-catalog.js";
+/** The model's own default effort, matching the web picker's choice. */
+export declare function defaultReasoningEffortForConfiguredModel(model: ConfiguredModel, fallback: ReasoningEffort): ReasoningEffort;
+/** The highest supported effort at or below `preferred`. */
+export declare function clampReasoningEffortForConfiguredModel(model: ConfiguredModel, preferred: ReasoningEffort, fallback: ReasoningEffort): ReasoningEffort;
+export type DefaultSessionModelInput = {
+    /** Catalog-resolved settings: `openaiModel` is the deployment default. */
+    settings: Settings;
+    /** This workspace's selection, in operator catalog order. */
+    selections: readonly WorkspaceModelSelection[];
+    workspaceDefaults: WorkspaceSessionDefaults | null;
+    /** The organization's default every workspace follows until it saves its own. */
+    organizationDefaults?: WorkspaceSessionDefaults | null | undefined;
+    /**
+     * True while the organization holds a positive Opengeni credit balance from
+     * any source, the verified-signup trial grant included (see
+     * `organizationHoldsCredits`).
+     */
+    creditsAvailable: boolean;
+    creditBalance?: BillingBalance;
+};
+/**
+ * Default model policy for a new chat or scheduled task that names no model.
+ *
+ * Precedence, first match wins:
+ *
+ * 1. `workspace`: the saved workspace default (`settings.sessionDefaults`)
+ *    while it is selectable in this workspace, its saved effort clamped to
+ *    what the model supports today.
+ * 1b. `organization`: the organization's default, the same way, for a
+ *    workspace that saved none (or whose own default can't run here).
+ * 2. `subscription`: the first selectable connected-subscription model
+ *    (ChatGPT/Codex, then SuperGrok) in operator catalog order. The
+ *    deployment default wins inside this step when it is itself a selectable
+ *    subscription model.
+ * 3. `credits`: while the organization holds a positive Opengeni credit
+ *    balance (a purchase, a grant, or the verified-signup trial grant), the
+ *    configured credits default (`OPENGENI_CREDITS_DEFAULT_MODEL`, effort
+ *    clamped to what the model supports), or the first selectable
+ *    credits-billed model when that one is not selectable. When the
+ *    deployment default is already a funded, selectable credits-billed model it
+ *    keeps the deployment effort, except that it takes the
+ *    credits default effort when it is the credits default model itself.
+ * 4. `deployment`: the deployment default with the deployment reasoning effort
+ *    when stably admissible; otherwise the first stably admissible catalog
+ *    model with its own default effort. With no admitted models, retain the
+ *    deployment hint and let fresh creation refuse it.
+ *
+ * An explicit model on the request, the scheduled task, or the person's
+ * new-chat draft is never passed through this function.
+ */
+export declare function selectDefaultSessionModel(input: DefaultSessionModelInput): DefaultModelSelection;
+/**
+ * The default this workspace would use while its organization holds a
+ * positive Opengeni credit balance. Null when the deployment does not bill
+ * credits.
+ */
+export declare function creditsDefaultSessionModel(input: {
+    settings: Settings;
+    selections: readonly WorkspaceModelSelection[];
+    workspaceSettings: unknown;
+    organizationDefaults?: Pick<OrganizationModelDefaults, "sessionDefaults"> | null;
+    creditBalance?: BillingBalance;
+}): DefaultModelSelection | null;
+/**
+ * Resolve the default for an already-loaded workspace selection. The credit
+ * ledger is read only when it can change the answer.
+ */
+export declare function resolveDefaultSessionModelForSelections(db: Database, input: {
+    settings: Settings;
+    accountId: string;
+    workspaceSettings: unknown;
+    selections: readonly WorkspaceModelSelection[];
+    /** Already-read organization defaults; read here when omitted. */
+    organizationDefaults?: Pick<OrganizationModelDefaults, "sessionDefaults"> | null;
+}): Promise<DefaultModelSelection>;
+export type WorkspaceModelSelectionContext = {
+    accountId: string;
+    workspaceId: string;
+    /**
+     * The subject whose connected-subscription authority applies: the
+     * authenticated caller for direct creates, or a scheduled task's immutable
+     * execution owner. Never another member.
+     */
+    subjectId: string;
+    /** Already accepted Claude pool; never replace it with current selection. */
+    claudeAuthoritySnapshot?: ClaudeProviderAccountAuthoritySnapshotV1 | undefined;
+};
+/**
+ * SuperGrok readiness and its `supergrok/` model restriction on the shared
+ * core once its provider route is `core` (design 5.3, SuperGrok track X1a,
+ * EP-T18/EP-S25/EP-N26): the core eligibility projection for the subject
+ * (shared pools; their own personal connection only in their own Personal
+ * workspace). Null when the route is not `core` (maintenance, or no receipt,
+ * which this binary's readiness check refuses) and when the deployment
+ * disables SuperGrok (no read): the caller then treats SuperGrok as not ready
+ * with no selectable model.
+ */
+export declare function loadCoreRoutedXaiCatalogReadiness(db: Database, settings: Pick<Settings, "supergrokSubscriptionEnabled">, context: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+}): Promise<{
+    ready: boolean;
+    allowedModelIds: string[] | null;
+} | null>;
+/** The connection restrictions with SuperGrok's replaced by the core's answer. */
+export declare function withCoreRoutedXaiRestriction(restrictions: ConnectionModelRestrictions, core: {
+    allowedModelIds: string[] | null;
+}): ConnectionModelRestrictions;
+/**
+ * Claude readiness and its two model restrictions on the shared core once
+ * Claude's provider route is `core` (design 5.3, Claude track C2a,
+ * EP-T18/EP-S25/EP-N26): the core eligibility projection for the subject
+ * split by the legacy prefixes (`organization-claude-subscription/` from the
+ * organization inference pool; `workspace-claude-subscription/` from the
+ * workspace pool or the subject's own personal connection in their own
+ * Personal workspace). Not ready under maintenance. Null on the legacy route
+ * (one receipt read) and when the deployment disables Claude subscriptions
+ * (no read), so the caller keeps its legacy answer. Frozen v1 Claude
+ * snapshots are not read on the core route.
+ */
+export declare function loadCoreRoutedClaudeCatalogReadiness(db: Database, settings: Pick<Settings, "claudeSubscriptionEnabled">, context: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+}): Promise<SubscriptionCoreClaudeCatalogReadiness | null>;
+/**
+ * Readiness for the subject's current or already accepted Claude pool observes
+ * metadata only; quota is handled by the runtime allocator. This is not an
+ * authorization: callers must supply their authenticated or frozen subject.
+ */
+export declare function loadWorkspaceClaudeSubscriptionReadiness(db: Database, settings: Settings, context: WorkspaceModelSelectionContext, 
+/**
+ * Claude's core readiness when the caller already read it for this
+ * request (`loadCoreRoutedClaudeCatalogReadiness`; null on the legacy
+ * route), so the route is read once per request. Read here when absent.
+ */
+claudeCoreReadiness?: SubscriptionCoreClaudeCatalogReadiness | null): Promise<{
+    workspace: boolean;
+    organization: boolean;
+}>;
+/** Load the same inputs the workspace model catalog route evaluates. */
+export declare function loadWorkspaceModelSelectionInput(db: Database, settings: Settings, context: WorkspaceModelSelectionContext, options?: {
+    observeAvailability?: boolean;
+}): Promise<WorkspaceModelSelectionInput>;
+/**
+ * Caller-scoped stable fresh admission; never re-admit already accepted work.
+ * Live discovery is opt-in: its token refresh can mutate connection readiness,
+ * so a health hint must not change the billing rail of an explicit create.
+ */
+export declare function resolveCallerWorkspaceModelSelections(db: Database, settings: Settings, context: WorkspaceModelSelectionContext, options?: {
+    observeAvailability?: boolean;
+}): Promise<WorkspaceModelSelection[]>;
+/**
+ * Catalog membership only: true while the workspace still lists the model,
+ * selectable or not. Retired and removed models are not listed.
+ */
+export declare function workspaceCatalogListsModel(selections: readonly WorkspaceModelSelection[], modelId: string): boolean;
+/** Transient selectability for existing consumers; not fresh-create admission. */
+export declare function selectableWorkspaceModel(selections: readonly WorkspaceModelSelection[], modelId: string): WorkspaceModelSelection | undefined;
+/** Same stable decision used by client config and direct fresh session creation. */
+export declare function admissibleWorkspaceModel(selections: readonly WorkspaceModelSelection[], modelId: string): WorkspaceModelSelection | undefined;
+/**
+ * Server-side default for new work that names no model: API and Slack session
+ * creates, new-chat drafts that follow the default, and scheduled-task
+ * occurrences. The result is resolved once and then frozen by the accepted
+ * session or occurrence like any other model choice.
+ */
+export declare function resolveDefaultSessionModel(db: Database, settings: Settings, context: WorkspaceModelSelectionContext & {
+    workspaceSettings?: unknown;
+}): Promise<DefaultModelSelection>;
+/**
+ * The default a scheduled occurrence uses when its task names no model and the
+ * occurrence creates its own session: resolved under the task's immutable
+ * execution owner (or its creator for a workspace/service task) and the task's
+ * frozen Claude authority, never another member's. The worker stamps the
+ * result onto the accepted execution, so retries and recovery replay it; the
+ * API's manual-trigger limit check uses the same resolution so it gates the
+ * model that will run.
+ */
+export declare function resolveScheduledTaskDefaultModel(db: Database, settings: Settings, task: Pick<ScheduledTask, "id" | "accountId" | "workspaceId" | "ownerSubjectId" | "createdBy">): Promise<DefaultModelSelection>;
+/**
+ * The model a manual trigger's limit pre-check evaluates, matching what the
+ * occurrence will run: the task's explicit model, else the target or reusable
+ * session's model when that session exists, else the resolved scheduled
+ * default. The worker still resolves authoritatively at dispatch.
+ */
+export declare function resolveScheduledTaskPreflightModel(db: Database, settings: Settings, task: Pick<ScheduledTask, "id" | "accountId" | "workspaceId" | "ownerSubjectId" | "createdBy" | "agentConfig" | "runMode" | "targetSessionId" | "reusableSessionId">): Promise<string>;

package/dist/dependencies.d.ts

@@ -1,14 +1,18 @@
 import type { Settings } from "@opengeni/config";
-import type { ConnectionCredentialsPort, Document, DocumentAuthorityKind, GitHubAppApiPort, ScheduledTask, ScheduledTaskTriggerType, SessionAuthorizationPort, TurnInitiator } from "@opengeni/contracts";
+import type { Document, DocumentAuthorityKind, EntitlementsPort, GitHubAppApiPort, ScheduledTask, ScheduledTaskTriggerType, SessionAuthorizationPort, TurnInitiator } from "@opengeni/contracts";
 import type { Database, SessionWorkflowWakeDeliveryResult } from "@opengeni/db";
+import type { VaultConnectionCredentialsPort } from "@opengeni/vaults";
+import type { OnePasswordVaultProviderFactory } from "./domain/vaults/provider-registry.js";
 import type { DocumentServices } from "@opengeni/documents";
 import type { EventBus } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
+import type { UserPresenceRecorder } from "./user-presence.js";
 import type { createObjectStorage } from "@opengeni/storage";
 import type { ManagedAuth } from "./managed-auth-type.js";
 import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets.js";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types.js";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription.js";
+import type { ModelCallService } from "./model-call.js";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live.js";
 import type { ResolvedCatalogSettings } from "./model-catalog.js";
 import type { EditableArtifactAgentApplication, EditableArtifactDurableExportService, EditableArtifactOfficeImportPort } from "./editable-artifacts.js";
@@ -52,7 +56,13 @@ export type SessionWorkflowClient = {
         workflowWakeRevision: number;
     }) => Promise<void>;
     syncScheduledTask: (input: {
-        task: ScheduledTask;
+        task: Pick<ScheduledTask, "id" | "workspaceId" | "temporalScheduleId">;
+        /**
+         * Compensate under the same per-schedule writer lock. Return the error to
+         * throw only after this transaction commits; lock/commit failures bypass
+         * that receipt. A failing compensation must roll back its own savepoint.
+         */
+        onFailure?: (tx: Database, error: unknown) => Promise<Error>;
     }) => Promise<void>;
     deleteScheduledTaskSchedule: (input: {
         temporalScheduleId: string;
@@ -62,6 +72,8 @@ export type SessionWorkflowClient = {
         agentRunUsageIdempotencyKey: string;
         triggerWorkflowId: string;
         initiator: TurnInitiator;
+        /** Server-frozen caller ceiling for this run, independent of task ownership. */
+        credentialRestriction?: "developer_setup";
         triggerType?: Extract<ScheduledTaskTriggerType, "manual" | "initial" | "provider_event" | "retry" | "repair">;
     }) => Promise<void>;
     startRigVerification: (input: {
@@ -83,7 +95,7 @@ export type DocumentIndexClient = {
     }) => Promise<Document | void>;
 };
 export type ManagedEmailMessage = {
-    kind: "email_verification" | "password_reset" | "organization_user_setup";
+    kind: "email_verification" | "password_reset" | "organization_user_setup" | "sign_in_method_changed" | "site_abuse_notice";
     from: string;
     to: string;
     subject: string;
@@ -125,6 +137,8 @@ export type AppDependencies = {
      */
     catalogSourceSettings?: Settings;
     db: Database;
+    /** Read-only host funding admission; unset uses the standalone billing ledger. */
+    entitlements?: EntitlementsPort | null;
     /**
      * Host-composed editable artifact engine. Standalone startup binds the same
      * native kernel/DB/object-store implementation; embedded hosts may inject an
@@ -150,6 +164,11 @@ export type AppDependencies = {
     documentIndexer?: DocumentIndexClient;
     documentServices?: DocumentServices;
     observability?: Observability;
+    /**
+     * Throttled server-side presence for canonical managed browser sessions
+     * (`createUserPresenceRecorder`). Analytics only; never an authorization input.
+     */
+    userPresence?: UserPresenceRecorder | null;
     readinessChecks?: Partial<Record<"db" | "nats" | "temporal", () => Promise<void> | void>>;
     githubStateSecret?: string;
     /**
@@ -158,14 +177,21 @@ export type AppDependencies = {
      * App credentials; standalone deployments fall back to @opengeni/github.
      */
     githubAppApi?: GitHubAppApiPort;
-    /** Optional provider seam for the separately registered OpenGeni Lens App. */
+    /** Optional provider seam for the separately registered Opengeni Lens App. */
     prReviewGithubAppApi?: GitHubAppApiPort;
     /**
      * Optional host-owned connection credential seam. API-side consumers use
      * the MCP leg for Codemode/Code Mode; worker consumers bind the same port
-     * for model MCP, Git, and sandbox-secret resolution.
+     * for model MCP, Git, and run credentials. `vaultProvider` is the host's
+     * password manager, linked as vaults with `source: "host"` (OP-6).
+     */
+    connectionCredentials?: VaultConnectionCredentialsPort | null;
+    /**
+     * Builds 1Password providers for linked vaults. apps/api and apps/worker
+     * bind it to a dynamic `import("@opengeni/vaults-onepassword")`; unset means
+     * 1Password vaults report `provider_unavailable`.
      */
-    connectionCredentials?: ConnectionCredentialsPort | null;
+    onePasswordVaultProvider?: OnePasswordVaultProviderFactory | null;
     /**
      * Optional embedding-host session ACL. Unset preserves standalone workspace
      * authorization; once bound, every session-addressed surface fails closed on
@@ -179,12 +205,16 @@ export type AppDependencies = {
     managedEmailTransport?: ManagedEmailTransport;
     /** Injectable Codex HTTP transport for deterministic API/provider tests. */
     codexFetch?: typeof fetch;
+    /** Injectable transport for customer OpenAI/Azure connection checks. */
+    directModelFetch?: typeof fetch;
     /** Injectable GitHub transport for deterministic personal-OAuth tests. */
     githubPersonalFetch?: typeof fetch;
     /** Injectable credential-free GitHub transport for public repository verification tests. */
     githubAnonymousFetch?: typeof fetch;
     /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
     xaiFetch?: typeof fetch;
+    /** Injectable Claude usage transport on the shared core, for deterministic API tests. */
+    claudeFetch?: typeof fetch;
     /** Injectable Slack Web API transport for deterministic bot-connection tests. */
     slackFetch?: typeof fetch;
     /** Injectable Google OAuth/Drive transport for deterministic connector tests. */
@@ -195,6 +225,8 @@ export type AppDependencies = {
     apiIntegrationOAuthFetch?: typeof fetch;
     /** Injectable specification/introspection transport, still network-policy checked. */
     apiIntegrationSourceFetch?: typeof fetch;
+    /** Injectable bounded MCP initialization/tools-list probe for Connect tests. */
+    mcpCapabilityProbe?: import("./domain/capabilities.js").McpCapabilityProbe;
     atlassianFetch?: typeof fetch;
     /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */
     oauthStartDeadlineMs?: number;
@@ -204,6 +236,8 @@ export type AppDependencies = {
     transcription?: TranscriptionService | null;
     /** Optional host-owned long-form audio normalization/segmentation service. */
     transcriptionSegmenter?: TranscriptionSegmenter | null;
+    /** Stateless single model calls (chat completions); built from settings when omitted. */
+    modelCalls?: ModelCallService | null;
     sandboxClient?: ApiSandboxClient;
     /**
      * Resume a box by id from a serialized resume_state envelope (the lease's
@@ -231,7 +265,7 @@ export type ApiRouteDeps = AppDependencies & {
  * the canonical admission path without constructing unrelated HTTP, document,
  * or sandbox services. The public API still passes its `ApiRouteDeps` superset.
  */
-export type AcceptSessionUserMessageDependencies = Pick<AppDependencies, "settings" | "catalogSourceSettings" | "db" | "bus" | "sessionAuthorization" | "schedulePromptPostCommit"> & {
+export type AcceptSessionUserMessageDependencies = Pick<AppDependencies, "settings" | "catalogSourceSettings" | "db" | "bus" | "sessionAuthorization" | "schedulePromptPostCommit" | "observability"> & {
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     objectStorage: ObjectStorageDependency;
 };

package/dist/developer-setup-credential-ceiling.d.ts

@@ -0,0 +1,10 @@
+import { type AccessGrant, type Permission, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "./access/index.js";
+/** The policy must be server-frozen, never supplied as request metadata. */
+export declare function requireDeveloperSetupDelegatedPermissions(policy: TurnExecutionPolicyV1, permissions: readonly Permission[] | undefined): void;
+/** Only pass server-owned persisted session/turn metadata, never request JSON. */
+export declare function withDeveloperSetupCredentialRestriction(policy: TurnExecutionPolicyV1, source: {
+    grant?: AccessGrant;
+    authorization?: AccessGrantAuthorization | undefined;
+    trustedMetadata?: readonly unknown[];
+}): TurnExecutionPolicyV1;