@opengeni/core 3.2.2 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Opengeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,18 +50,18 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
+    "@opengeni/capabilities": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/db": "3.3.0",
+    "@opengeni/documents": "3.3.0",
+    "@opengeni/events": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/runtime": "3.3.0",
+    "@opengeni/storage": "3.3.0",
+    "@opengeni/vaults": "3.3.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -37,6 +37,7 @@ import {
   listWorkspacesForSubject,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
+  subjectHasLiveWorkspaceAuthorityInScope,
   requireWorkspace,
   resolveNamedManagedPersonalWorkspaceGrant,
   type Database,
@@ -216,6 +217,7 @@ const delegatedHumanAuthorizationSchema = z.object({
 
 const delegatedHumanRequests = new WeakMap<Request, DelegatedHumanAuthorization>();
 const delegatedHumanContexts = new WeakMap<AccessContext, DelegatedHumanAuthorization>();
+const verifiedSiteViewerProofs = new WeakSet<DelegatedHumanAuthorization>();
 const delegatedHumanProfileSchema = z.object({
   id: z.string(),
   name: z.string().nullable(),
@@ -283,6 +285,48 @@ export function stampDelegatedHumanAuthorization(
   delegatedHumanRequests.set(request, Object.freeze(proof));
 }
 
+/**
+ * Verified published-Site dispatch only: the caller has verified the signed
+ * gateway, served host and opaque viewer cookie. This is exact-workspace
+ * ownership for session routes, not a console login or a generic Site bearer.
+ * Native people use the existing delegated-human resolver; external owning
+ * users reload their existing membership without provisioning a new identity.
+ */
+export function stampSiteViewerSessionAuthorization(
+  request: Request,
+  input: {
+    organizationId: string;
+    workspaceId: string;
+    subjectId: string;
+    permissions: Permission[];
+  },
+): void {
+  if (input.subjectId.startsWith("user:")) {
+    stampDelegatedHumanAuthorization(request, {
+      ...input,
+      workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] },
+    });
+    return;
+  }
+  if (delegatedHumanRequests.has(request) || accessResolvedRequests.has(request))
+    throw new HTTPException(403, { message: "request access authorization already resolved" });
+  const parsed = delegatedHumanAuthorizationSchema
+    .extend({
+      subjectId: z
+        .string()
+        .max(1024)
+        .regex(/^external_user:[^\s\u0000-\u001f\u007f]+$/),
+    })
+    .parse({ ...input, workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] } });
+  if (parsed.workspaceScope.kind !== "selected") throw new Error("Site workspace scope required");
+  Object.freeze(parsed.permissions);
+  Object.freeze(parsed.workspaceScope.workspaceIds);
+  Object.freeze(parsed.workspaceScope);
+  const proof = Object.freeze(parsed);
+  verifiedSiteViewerProofs.add(proof);
+  delegatedHumanRequests.set(request, proof);
+}
+
 /** Token prefix of personal API keys, which act as the person who made them. */
 export const PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
 
@@ -1521,6 +1565,62 @@ async function resolveDelegatedHumanAccessContext(
       message: "delegated humans require native organization access",
     });
   }
+  if (verifiedSiteViewerProofs.has(proof)) {
+    const workspaceId =
+      proof.workspaceScope.kind === "selected" && proof.workspaceScope.workspaceIds.length === 1
+        ? proof.workspaceScope.workspaceIds[0]
+        : null;
+    if (!workspaceId)
+      throw new HTTPException(403, { message: "Site viewer workspace unavailable" });
+    const grant = await withWorkspaceSubjectRls(
+      deps.db,
+      workspaceId,
+      proof.subjectId,
+      async (tx) => {
+        if (
+          !(await subjectHasLiveWorkspaceAuthorityInScope(tx, {
+            accountId: proof.organizationId,
+            workspaceId,
+            subjectId: proof.subjectId,
+          }))
+        )
+          return null;
+        return getWorkspaceGrant(tx, proof.subjectId, workspaceId, {
+          principalKind: "human_session",
+        });
+      },
+    );
+    if (!grant || grant.accountId !== proof.organizationId)
+      throw new HTTPException(403, { message: "Site viewer membership unavailable" });
+    const bounded = Object.freeze({
+      ...grant,
+      permissionMode: "explicit" as const,
+      permissions: Object.freeze(
+        explicitPermissions(
+          Permission.options.filter(
+            (permission) =>
+              hasPermission(grant.permissions, permission) &&
+              hasPermission(proof.permissions, permission, "explicit"),
+          ),
+        ),
+      ) as Permission[],
+    });
+    const accountGrant = Object.freeze({
+      accountId: proof.organizationId,
+      subjectId: proof.subjectId,
+      permissions: Object.freeze([] as Permission[]) as Permission[],
+    });
+    const context: AccessContext = Object.freeze({
+      mode: "managed",
+      subjectId: proof.subjectId,
+      accountGrants: Object.freeze([accountGrant]) as AccountGrant[],
+      workspaceGrants: Object.freeze([bounded]) as AccessGrant[],
+      defaultAccountId: proof.organizationId,
+      defaultWorkspaceId: workspaceId,
+    });
+    delegatedHumanContexts.set(context, proof);
+    return context;
+  }
   const userId = proof.subjectId.slice("user:".length);
   const profiles = await getManagedUserProfilesByIds(deps.db, [userId]);
   const parsedProfile = delegatedHumanProfileSchema.safeParse(

package/src/application/site-session-cancellation.ts

@@ -0,0 +1,47 @@
+import { cancelSiteRuntimeConversation, type Database } from "@opengeni/db";
+import {
+  publishDurableSessionEvents,
+  publishDurableWorkspaceControlEvent,
+  type EventBus,
+} from "@opengeni/events";
+import type { SessionWorkflowClient } from "../dependencies";
+
+/** Internal host lifecycle, not a session-read/control API or a viewer grant. */
+export async function cancelPublishedSiteSession(
+  deps: {
+    db: Database;
+    bus: EventBus;
+    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
+  },
+  input: Parameters<typeof cancelSiteRuntimeConversation>[1],
+) {
+  const result = await cancelSiteRuntimeConversation(deps.db, input);
+  if (!result) return null;
+  // Capture only this command's event envelopes under its transaction witness.
+  // Never re-open private transcript visibility to do post-commit fanout.
+  const bySession = new Map<string, typeof result.events>();
+  for (const event of result.events) {
+    const group = bySession.get(event.sessionId) ?? [];
+    group.push(event);
+    bySession.set(event.sessionId, group);
+  }
+  const effects = await Promise.allSettled([
+    ...[...bySession].map(([sessionId, events]) =>
+      publishDurableSessionEvents(deps.bus, input.workspaceId, sessionId, events),
+    ),
+    ...(result.workspaceEvent
+      ? [publishDurableWorkspaceControlEvent(deps.bus, input.workspaceId, result.workspaceEvent)]
+      : []),
+    ...(result.wakeCount > 0 ? [deps.workflowClient.requestSessionWorkflowWakeDispatch()] : []),
+  ]);
+  if (effects.some((effect) => effect.status === "rejected"))
+    console.warn(
+      "[site-lifecycle] post-commit fanout failed; durable events and wake outbox retained",
+    );
+  return {
+    receiptId: result.receiptId,
+    replay: result.replay,
+    cancelledSessionCount: result.cancelledSessionCount,
+    cancelledTurnCount: result.cancelledTurnCount,
+  };
+}

package/src/domain/file-owner.ts

@@ -62,6 +62,7 @@ export async function fileOwnerContextForAgent(
     },
     subjectId: grant.subjectId,
     initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,
+    agentRootSessionId: attempt.callerRootSessionId,
     privateFileOwnerSubjectId: snapshot.defaultScope === "personal" ? snapshot.subjectId : null,
   };
 }

package/src/domain/insights-usage.ts

@@ -4,8 +4,27 @@ import type {
   InsightsUsageQuery,
   InsightsUsageRange,
   InsightsUsageResponse,
+  InsightsSiteUsageQuery,
 } from "@opengeni/contracts/insights-usage";
-import { readInsightsCalls, readInsightsUsage, type Database } from "@opengeni/db";
+import {
+  readInsightsCalls,
+  readInsightsUsage,
+  readInsightsSiteUsage,
+  type Database,
+} from "@opengeni/db";
+
+export async function getInsightsSiteUsage(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    query: InsightsSiteUsageQuery;
+    viewerSubjectId: string | null;
+    now?: Date;
+  },
+) {
+  return readInsightsSiteUsage(db, { ...input, now: input.now ?? new Date() });
+}
 
 export type InsightsQueryScope = {
   accountId: string;

package/src/index.ts

@@ -149,6 +149,7 @@ export * from "./domain/organization-membership-lifecycle";
 export * from "./application/new-session-drafts";
 export * from "./application/composer-submit";
 export * from "./application/session-commands";
+export * from "./application/site-session-cancellation";
 export * from "./application/archived-session-imports";
 export * from "./application/session-tenancy";
 export * from "./application/organization-privacy";

package/src/sandbox/fleet.ts

@@ -985,6 +985,7 @@ function runOnOperationAdmission(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 

package/src/session-authorization.ts

@@ -14,6 +14,7 @@ import {
 import { AsyncLocalStorage } from "node:async_hooks";
 import {
   currentSessionRlsActorIdentityKey,
+  currentSiteViewerRlsContext,
   getSessionAuthorityProjection,
   getSessionAuthorizationTargetProjection,
   getSession,
@@ -237,6 +238,7 @@ export function sessionRlsActorForAuthorization(
     ? {
         subjectId: authorization.actor.subjectId,
         initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,
+        agentRootSessionId: authorization.actor.callerRootSessionId,
       }
     : { subjectId: authorization.actor.subjectId };
 }
@@ -312,6 +314,25 @@ export async function requireSessionAuthorization(
     throw new SessionAuthorizationDeniedError("not_found");
   }
 
+  // Also enforce the durable Site audience for hosts using scoped (owner-role)
+  // databases. The request-local viewer proof is never taken from Site JSON.
+  if (authority?.siteAccessRootId) {
+    const viewer = currentSiteViewerRlsContext();
+    const resolved = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+    const actor = resolved.actor;
+    const allowed =
+      actor.kind === "agent_attempt"
+        ? (authority.siteOwnerSubjectId !== null &&
+            authority.siteOwnerSubjectId === actor.initiatingHumanSubjectId) ||
+          (actor.callerRootSessionId === authority.rootSessionId &&
+            authority.siteAccessRootId === authority.rootSessionId)
+        : authority.siteOwnerSubjectId === actor.subjectId ||
+          (actor.subjectId === `site:${authority.siteId}` &&
+            viewer?.siteId === authority.siteId &&
+            viewer.principal === authority.siteViewerPrincipal);
+    if (!allowed) throw new SessionAuthorizationDeniedError("not_found");
+  }
+
   // A request from a Site page (an HTTP frame request, or a tool the page
   // called) may act on a session only when that same Site, or for a frame
   // without a published Site the same mounted frame, started it. Anything