@opengeni/core 3.2.2 → 3.3.0

package/dist/access/index.d.ts

@@ -56,6 +56,19 @@ export type VerifiedDelegatedHumanContext = Readonly<{
  * transplanted. This proof never becomes managed-cookie/person-present proof.
  */
 export declare function stampDelegatedHumanAuthorization(request: Request, input: DelegatedHumanAuthorization): void;
+/**
+ * Verified published-Site dispatch only: the caller has verified the signed
+ * gateway, served host and opaque viewer cookie. This is exact-workspace
+ * ownership for session routes, not a console login or a generic Site bearer.
+ * Native people use the existing delegated-human resolver; external owning
+ * users reload their existing membership without provisioning a new identity.
+ */
+export declare function stampSiteViewerSessionAuthorization(request: Request, input: {
+    organizationId: string;
+    workspaceId: string;
+    subjectId: string;
+    permissions: Permission[];
+}): void;
 /** Token prefix of personal API keys, which act as the person who made them. */
 export declare const PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
 /**

package/dist/application/site-session-cancellation.d.ts

@@ -0,0 +1,14 @@
+import { cancelSiteRuntimeConversation, type Database } from "@opengeni/db";
+import { type EventBus } from "@opengeni/events";
+import type { SessionWorkflowClient } from "../dependencies.js";
+/** Internal host lifecycle, not a session-read/control API or a viewer grant. */
+export declare function cancelPublishedSiteSession(deps: {
+    db: Database;
+    bus: EventBus;
+    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
+}, input: Parameters<typeof cancelSiteRuntimeConversation>[1]): Promise<{
+    receiptId: string;
+    replay: boolean;
+    cancelledSessionCount: number;
+    cancelledTurnCount: number;
+} | null>;

package/dist/domain/insights-usage.d.ts

@@ -1,5 +1,28 @@
-import type { InsightsCallsQuery, InsightsCallsResponse, InsightsUsageQuery, InsightsUsageRange, InsightsUsageResponse } from "@opengeni/contracts/insights-usage";
+import type { InsightsCallsQuery, InsightsCallsResponse, InsightsUsageQuery, InsightsUsageRange, InsightsUsageResponse, InsightsSiteUsageQuery } from "@opengeni/contracts/insights-usage";
 import { type Database } from "@opengeni/db";
+export declare function getInsightsSiteUsage(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    query: InsightsSiteUsageQuery;
+    viewerSubjectId: string | null;
+    now?: Date;
+}): Promise<{
+    workspaceId: string;
+    range: "30d" | "90d" | "month" | "today" | "week" | "ytd";
+    windowStart: string;
+    windowEnd: string;
+    rows: {
+        siteId: string | null;
+        title: string;
+        kind: "other" | "restricted" | "site";
+        calls: number;
+        pricedCalls: number;
+        chargedMicros: number;
+        apiEquivalentMicros: number;
+        subscriptionApiEquivalentMicros: number;
+        ownKeyApiEquivalentMicros: number;
+    }[];
+}>;
 export type InsightsQueryScope = {
     accountId: string;
     /** null means organization scope; it does not grant workspace/session access. */

package/dist/index.d.ts

@@ -85,6 +85,7 @@ export * from "./domain/organization-membership-lifecycle.js";
 export * from "./application/new-session-drafts.js";
 export * from "./application/composer-submit.js";
 export * from "./application/session-commands.js";
+export * from "./application/site-session-cancellation.js";
 export * from "./application/archived-session-imports.js";
 export * from "./application/session-tenancy.js";
 export * from "./application/organization-privacy.js";

package/dist/index.js

@@ -156,6 +156,7 @@ import {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import {
   currentSessionRlsActorIdentityKey,
+  currentSiteViewerRlsContext,
   getSessionAuthorityProjection,
   getSessionAuthorizationTargetProjection,
   getSession as getSession2,
@@ -395,7 +396,8 @@ function relatedSessionAccessForAgentAttempt(actor, targetSessionId) {
 function sessionRlsActorForAuthorization(authorization) {
   return authorization.actor.kind === "agent_attempt" ? {
     subjectId: authorization.actor.subjectId,
-    initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId
+    initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,
+    agentRootSessionId: authorization.actor.callerRootSessionId
   } : { subjectId: authorization.actor.subjectId };
 }
 async function withResolvedSessionAuthorization(authorization, fn) {
@@ -426,6 +428,13 @@ async function requireSessionAuthorization(deps, grant, input) {
   if (!authority && input.surface !== "core") {
     throw new SessionAuthorizationDeniedError("not_found");
   }
+  if (authority?.siteAccessRootId) {
+    const viewer = currentSiteViewerRlsContext();
+    const resolved = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+    const actor2 = resolved.actor;
+    const allowed = actor2.kind === "agent_attempt" ? authority.siteOwnerSubjectId !== null && authority.siteOwnerSubjectId === actor2.initiatingHumanSubjectId || actor2.callerRootSessionId === authority.rootSessionId && authority.siteAccessRootId === authority.rootSessionId : authority.siteOwnerSubjectId === actor2.subjectId || actor2.subjectId === `site:${authority.siteId}` && viewer?.siteId === authority.siteId && viewer.principal === authority.siteViewerPrincipal;
+    if (!allowed) throw new SessionAuthorizationDeniedError("not_found");
+  }
   const siteOrigin = currentSiteSessionOrigin();
   if (siteOrigin && authority && !input.operation.endsWith(".read")) {
     const session = await getSession2(deps.db, grant.workspaceId, input.sessionId);
@@ -4430,6 +4439,7 @@ import {
   listWorkspacesForSubject,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
+  subjectHasLiveWorkspaceAuthorityInScope,
   requireWorkspace,
   resolveNamedManagedPersonalWorkspaceGrant
 } from "@opengeni/db";
@@ -4552,6 +4562,7 @@ var delegatedHumanAuthorizationSchema = z2.object({
 });
 var delegatedHumanRequests = /* @__PURE__ */ new WeakMap();
 var delegatedHumanContexts = /* @__PURE__ */ new WeakMap();
+var verifiedSiteViewerProofs = /* @__PURE__ */ new WeakSet();
 var delegatedHumanProfileSchema = z2.object({
   id: z2.string(),
   name: z2.string().nullable(),
@@ -4581,6 +4592,27 @@ function stampDelegatedHumanAuthorization(request, input) {
   Object.freeze(proof.permissions);
   delegatedHumanRequests.set(request, Object.freeze(proof));
 }
+function stampSiteViewerSessionAuthorization(request, input) {
+  if (input.subjectId.startsWith("user:")) {
+    stampDelegatedHumanAuthorization(request, {
+      ...input,
+      workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] }
+    });
+    return;
+  }
+  if (delegatedHumanRequests.has(request) || accessResolvedRequests.has(request))
+    throw new HTTPException8(403, { message: "request access authorization already resolved" });
+  const parsed = delegatedHumanAuthorizationSchema.extend({
+    subjectId: z2.string().max(1024).regex(/^external_user:[^\s\u0000-\u001f\u007f]+$/)
+  }).parse({ ...input, workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] } });
+  if (parsed.workspaceScope.kind !== "selected") throw new Error("Site workspace scope required");
+  Object.freeze(parsed.permissions);
+  Object.freeze(parsed.workspaceScope.workspaceIds);
+  Object.freeze(parsed.workspaceScope);
+  const proof = Object.freeze(parsed);
+  verifiedSiteViewerProofs.add(proof);
+  delegatedHumanRequests.set(request, proof);
+}
 var PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
 async function stampPersonalApiKeyRequest(request, deps) {
   const authorization = request.headers.get("authorization");
@@ -5262,6 +5294,55 @@ async function resolveDelegatedHumanAccessContext(deps, proof) {
       message: "delegated humans require native organization access"
     });
   }
+  if (verifiedSiteViewerProofs.has(proof)) {
+    const workspaceId = proof.workspaceScope.kind === "selected" && proof.workspaceScope.workspaceIds.length === 1 ? proof.workspaceScope.workspaceIds[0] : null;
+    if (!workspaceId)
+      throw new HTTPException8(403, { message: "Site viewer workspace unavailable" });
+    const grant = await withWorkspaceSubjectRls(
+      deps.db,
+      workspaceId,
+      proof.subjectId,
+      async (tx) => {
+        if (!await subjectHasLiveWorkspaceAuthorityInScope(tx, {
+          accountId: proof.organizationId,
+          workspaceId,
+          subjectId: proof.subjectId
+        }))
+          return null;
+        return getWorkspaceGrant(tx, proof.subjectId, workspaceId, {
+          principalKind: "human_session"
+        });
+      }
+    );
+    if (!grant || grant.accountId !== proof.organizationId)
+      throw new HTTPException8(403, { message: "Site viewer membership unavailable" });
+    const bounded = Object.freeze({
+      ...grant,
+      permissionMode: "explicit",
+      permissions: Object.freeze(
+        explicitPermissions(
+          Permission.options.filter(
+            (permission) => hasPermission(grant.permissions, permission) && hasPermission(proof.permissions, permission, "explicit")
+          )
+        )
+      )
+    });
+    const accountGrant2 = Object.freeze({
+      accountId: proof.organizationId,
+      subjectId: proof.subjectId,
+      permissions: Object.freeze([])
+    });
+    const context2 = Object.freeze({
+      mode: "managed",
+      subjectId: proof.subjectId,
+      accountGrants: Object.freeze([accountGrant2]),
+      workspaceGrants: Object.freeze([bounded]),
+      defaultAccountId: proof.organizationId,
+      defaultWorkspaceId: workspaceId
+    });
+    delegatedHumanContexts.set(context2, proof);
+    return context2;
+  }
   const userId = proof.subjectId.slice("user:".length);
   const profiles = await getManagedUserProfilesByIds(deps.db, [userId]);
   const parsedProfile = delegatedHumanProfileSchema.safeParse(
@@ -5796,6 +5877,7 @@ async function fileOwnerContextForAgent(deps, grant, permission) {
     },
     subjectId: grant.subjectId,
     initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,
+    agentRootSessionId: attempt.callerRootSessionId,
     privateFileOwnerSubjectId: snapshot.defaultScope === "personal" ? snapshot.subjectId : null
   };
 }
@@ -8989,7 +9071,8 @@ function runOnOperationAdmission(services, enrollment) {
     operationResourcePolicy: enrollment.operationPolicy,
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
-    transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true
+    transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true
   };
 }
 function hasSecretFileReference(carry) {
@@ -17588,7 +17671,7 @@ import { RotateSessionMcpCredentialsRequest } from "@opengeni/contracts";
 import {
   encryptVariableSetValue as encryptVariableSetValue3,
   getWorkspaceGrant as getWorkspaceGrant3,
-  subjectHasLiveWorkspaceAuthorityInScope
+  subjectHasLiveWorkspaceAuthorityInScope as subjectHasLiveWorkspaceAuthorityInScope2
 } from "@opengeni/db";
 import {
   rotateSessionMcpCredentialsAtomically,
@@ -17733,7 +17816,7 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
           } else if (!hasVerifiedOwningUserAuthorization(authorization)) {
             throw new HTTPException24(403, { message: "credential rotation authority changed" });
           }
-          if (!await subjectHasLiveWorkspaceAuthorityInScope(tx, scope)) {
+          if (!await subjectHasLiveWorkspaceAuthorityInScope2(tx, scope)) {
             throw new HTTPException24(403, { message: "credential rotation authority changed" });
           }
         }
@@ -25359,7 +25442,14 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
 }
 
 // src/domain/insights-usage.ts
-import { readInsightsCalls, readInsightsUsage } from "@opengeni/db";
+import {
+  readInsightsCalls,
+  readInsightsUsage,
+  readInsightsSiteUsage
+} from "@opengeni/db";
+async function getInsightsSiteUsage(db, input) {
+  return readInsightsSiteUsage(db, { ...input, now: input.now ?? /* @__PURE__ */ new Date() });
+}
 async function getInsightsUsage(db, input) {
   return await readInsightsUsage(db, { ...input, now: input.now ?? /* @__PURE__ */ new Date() });
 }
@@ -28282,6 +28372,40 @@ async function controlHumanWorkspaceTimer(deps, context, input) {
   ]);
 }
 
+// src/application/site-session-cancellation.ts
+import { cancelSiteRuntimeConversation } from "@opengeni/db";
+import {
+  publishDurableSessionEvents as publishDurableSessionEvents4,
+  publishDurableWorkspaceControlEvent as publishDurableWorkspaceControlEvent3
+} from "@opengeni/events";
+async function cancelPublishedSiteSession(deps, input) {
+  const result = await cancelSiteRuntimeConversation(deps.db, input);
+  if (!result) return null;
+  const bySession = /* @__PURE__ */ new Map();
+  for (const event of result.events) {
+    const group = bySession.get(event.sessionId) ?? [];
+    group.push(event);
+    bySession.set(event.sessionId, group);
+  }
+  const effects = await Promise.allSettled([
+    ...[...bySession].map(
+      ([sessionId, events]) => publishDurableSessionEvents4(deps.bus, input.workspaceId, sessionId, events)
+    ),
+    ...result.workspaceEvent ? [publishDurableWorkspaceControlEvent3(deps.bus, input.workspaceId, result.workspaceEvent)] : [],
+    ...result.wakeCount > 0 ? [deps.workflowClient.requestSessionWorkflowWakeDispatch()] : []
+  ]);
+  if (effects.some((effect) => effect.status === "rejected"))
+    console.warn(
+      "[site-lifecycle] post-commit fanout failed; durable events and wake outbox retained"
+    );
+  return {
+    receiptId: result.receiptId,
+    replay: result.replay,
+    cancelledSessionCount: result.cancelledSessionCount,
+    cancelledTurnCount: result.cancelledTurnCount
+  };
+}
+
 // src/application/archived-session-imports.ts
 import {
   AppendArchivedSessionEventsRequest,
@@ -28296,7 +28420,7 @@ import {
   importArchivedSession,
   withSessionRlsActorContext as withSessionRlsActorContext7
 } from "@opengeni/db";
-import { publishDurableSessionEvents as publishDurableSessionEvents4 } from "@opengeni/events";
+import { publishDurableSessionEvents as publishDurableSessionEvents5 } from "@opengeni/events";
 import { HTTPException as HTTPException38 } from "hono/http-exception";
 import { ArchivedSessionImportError as ArchivedSessionImportError2 } from "@opengeni/db";
 function requireImportAuthorization(authorization, workspaceId, permission) {
@@ -28327,7 +28451,7 @@ function importerScope(authorization, workspaceId, permission, fileOwnerSubjectI
 async function publishImportedEvents(deps, workspaceId, sessionId, events) {
   if (!events.length) return;
   try {
-    await publishDurableSessionEvents4(deps.bus, workspaceId, sessionId, events);
+    await publishDurableSessionEvents5(deps.bus, workspaceId, sessionId, events);
   } catch {
     console.warn("[session-import] committed timeline fanout deferred to replay", { sessionId });
   }
@@ -29502,6 +29626,7 @@ export {
   buildFleetContextForSession,
   buildMissingSecretAskCard2 as buildMissingSecretAskCard,
   cancelExternalWorkspaceMemberGrantForRequest,
+  cancelPublishedSiteSession,
   canonicalConfiguredModel,
   canonicalConversationDeliveryCommandJson,
   canonicalConversationDeliveryOutcomeJson,
@@ -29644,6 +29769,7 @@ export {
   getAutomationAdapter,
   getConnectorToolPermissions,
   getHumanComposerDraft,
+  getInsightsSiteUsage,
   getInsightsUsage,
   getManagedAuthRequestActorAbortSignal,
   getManagedAuthRequestActorAdmissionStamp,
@@ -30024,6 +30150,7 @@ export {
   stableJson,
   stampDelegatedHumanAuthorization,
   stampPersonalApiKeyRequest,
+  stampSiteViewerSessionAuthorization,
   statusForVoiceInputError,
   steerAgentSession,
   steerHumanQueuePrompt,