@opengeni/core 3.2.2 → 3.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "Opengeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,18 +50,18 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
+    "@opengeni/capabilities": "3.4.0",
+    "@opengeni/codex": "3.4.0",
+    "@opengeni/config": "3.4.0",
+    "@opengeni/contracts": "3.4.0",
+    "@opengeni/db": "3.4.0",
+    "@opengeni/documents": "3.4.0",
+    "@opengeni/events": "3.4.0",
+    "@opengeni/network": "3.4.0",
+    "@opengeni/observability": "3.4.0",
+    "@opengeni/runtime": "3.4.0",
+    "@opengeni/storage": "3.4.0",
+    "@opengeni/vaults": "3.4.0",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -37,6 +37,7 @@ import {
   listWorkspacesForSubject,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
+  subjectHasLiveWorkspaceAuthorityInScope,
   requireWorkspace,
   resolveNamedManagedPersonalWorkspaceGrant,
   type Database,
@@ -216,6 +217,7 @@ const delegatedHumanAuthorizationSchema = z.object({
 
 const delegatedHumanRequests = new WeakMap<Request, DelegatedHumanAuthorization>();
 const delegatedHumanContexts = new WeakMap<AccessContext, DelegatedHumanAuthorization>();
+const verifiedSiteViewerProofs = new WeakSet<DelegatedHumanAuthorization>();
 const delegatedHumanProfileSchema = z.object({
   id: z.string(),
   name: z.string().nullable(),
@@ -283,6 +285,48 @@ export function stampDelegatedHumanAuthorization(
   delegatedHumanRequests.set(request, Object.freeze(proof));
 }
 
+/**
+ * Verified published-Site dispatch only: the caller has verified the signed
+ * gateway, served host and opaque viewer cookie. This is exact-workspace
+ * ownership for session routes, not a console login or a generic Site bearer.
+ * Native people use the existing delegated-human resolver; external owning
+ * users reload their existing membership without provisioning a new identity.
+ */
+export function stampSiteViewerSessionAuthorization(
+  request: Request,
+  input: {
+    organizationId: string;
+    workspaceId: string;
+    subjectId: string;
+    permissions: Permission[];
+  },
+): void {
+  if (input.subjectId.startsWith("user:")) {
+    stampDelegatedHumanAuthorization(request, {
+      ...input,
+      workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] },
+    });
+    return;
+  }
+  if (delegatedHumanRequests.has(request) || accessResolvedRequests.has(request))
+    throw new HTTPException(403, { message: "request access authorization already resolved" });
+  const parsed = delegatedHumanAuthorizationSchema
+    .extend({
+      subjectId: z
+        .string()
+        .max(1024)
+        .regex(/^external_user:[^\s\u0000-\u001f\u007f]+$/),
+    })
+    .parse({ ...input, workspaceScope: { kind: "selected", workspaceIds: [input.workspaceId] } });
+  if (parsed.workspaceScope.kind !== "selected") throw new Error("Site workspace scope required");
+  Object.freeze(parsed.permissions);
+  Object.freeze(parsed.workspaceScope.workspaceIds);
+  Object.freeze(parsed.workspaceScope);
+  const proof = Object.freeze(parsed);
+  verifiedSiteViewerProofs.add(proof);
+  delegatedHumanRequests.set(request, proof);
+}
+
 /** Token prefix of personal API keys, which act as the person who made them. */
 export const PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
 
@@ -1521,6 +1565,62 @@ async function resolveDelegatedHumanAccessContext(
       message: "delegated humans require native organization access",
     });
   }
+  if (verifiedSiteViewerProofs.has(proof)) {
+    const workspaceId =
+      proof.workspaceScope.kind === "selected" && proof.workspaceScope.workspaceIds.length === 1
+        ? proof.workspaceScope.workspaceIds[0]
+        : null;
+    if (!workspaceId)
+      throw new HTTPException(403, { message: "Site viewer workspace unavailable" });
+    const grant = await withWorkspaceSubjectRls(
+      deps.db,
+      workspaceId,
+      proof.subjectId,
+      async (tx) => {
+        if (
+          !(await subjectHasLiveWorkspaceAuthorityInScope(tx, {
+            accountId: proof.organizationId,
+            workspaceId,
+            subjectId: proof.subjectId,
+          }))
+        )
+          return null;
+        return getWorkspaceGrant(tx, proof.subjectId, workspaceId, {
+          principalKind: "human_session",
+        });
+      },
+    );
+    if (!grant || grant.accountId !== proof.organizationId)
+      throw new HTTPException(403, { message: "Site viewer membership unavailable" });
+    const bounded = Object.freeze({
+      ...grant,
+      permissionMode: "explicit" as const,
+      permissions: Object.freeze(
+        explicitPermissions(
+          Permission.options.filter(
+            (permission) =>
+              hasPermission(grant.permissions, permission) &&
+              hasPermission(proof.permissions, permission, "explicit"),
+          ),
+        ),
+      ) as Permission[],
+    });
+    const accountGrant = Object.freeze({
+      accountId: proof.organizationId,
+      subjectId: proof.subjectId,
+      permissions: Object.freeze([] as Permission[]) as Permission[],
+    });
+    const context: AccessContext = Object.freeze({
+      mode: "managed",
+      subjectId: proof.subjectId,
+      accountGrants: Object.freeze([accountGrant]) as AccountGrant[],
+      workspaceGrants: Object.freeze([bounded]) as AccessGrant[],
+      defaultAccountId: proof.organizationId,
+      defaultWorkspaceId: workspaceId,
+    });
+    delegatedHumanContexts.set(context, proof);
+    return context;
+  }
   const userId = proof.subjectId.slice("user:".length);
   const profiles = await getManagedUserProfilesByIds(deps.db, [userId]);
   const parsedProfile = delegatedHumanProfileSchema.safeParse(

package/src/application/site-session-cancellation.ts

@@ -0,0 +1,47 @@
+import { cancelSiteRuntimeConversation, type Database } from "@opengeni/db";
+import {
+  publishDurableSessionEvents,
+  publishDurableWorkspaceControlEvent,
+  type EventBus,
+} from "@opengeni/events";
+import type { SessionWorkflowClient } from "../dependencies";
+
+/** Internal host lifecycle, not a session-read/control API or a viewer grant. */
+export async function cancelPublishedSiteSession(
+  deps: {
+    db: Database;
+    bus: EventBus;
+    workflowClient: Pick<SessionWorkflowClient, "requestSessionWorkflowWakeDispatch">;
+  },
+  input: Parameters<typeof cancelSiteRuntimeConversation>[1],
+) {
+  const result = await cancelSiteRuntimeConversation(deps.db, input);
+  if (!result) return null;
+  // Capture only this command's event envelopes under its transaction witness.
+  // Never re-open private transcript visibility to do post-commit fanout.
+  const bySession = new Map<string, typeof result.events>();
+  for (const event of result.events) {
+    const group = bySession.get(event.sessionId) ?? [];
+    group.push(event);
+    bySession.set(event.sessionId, group);
+  }
+  const effects = await Promise.allSettled([
+    ...[...bySession].map(([sessionId, events]) =>
+      publishDurableSessionEvents(deps.bus, input.workspaceId, sessionId, events),
+    ),
+    ...(result.workspaceEvent
+      ? [publishDurableWorkspaceControlEvent(deps.bus, input.workspaceId, result.workspaceEvent)]
+      : []),
+    ...(result.wakeCount > 0 ? [deps.workflowClient.requestSessionWorkflowWakeDispatch()] : []),
+  ]);
+  if (effects.some((effect) => effect.status === "rejected"))
+    console.warn(
+      "[site-lifecycle] post-commit fanout failed; durable events and wake outbox retained",
+    );
+  return {
+    receiptId: result.receiptId,
+    replay: result.replay,
+    cancelledSessionCount: result.cancelledSessionCount,
+    cancelledTurnCount: result.cancelledTurnCount,
+  };
+}

package/src/domain/capabilities.ts

@@ -43,6 +43,7 @@ import {
   getCapabilityCatalogItem,
   getCapabilityInstallation,
   getConnectionMetadata,
+  isTransactionHandle,
   readCodexCutoverDisposition,
   resolveSubscriptionCoreCodexAppsDesignation,
   rlsContextForWorkspace,
@@ -93,6 +94,28 @@ export async function buildCapabilityCatalog(input: {
   /** The workspace's organization, when the caller knows it (skips a lookup). */
   accountId?: string;
 }): Promise<CapabilityCatalogResponse> {
+  // Scoped readers use savepoints and transaction-local actor settings. They
+  // must not overlap on a caller's transaction: one reader can otherwise
+  // restore another reader's subject instead of the enclosing caller's.
+  // Independent pool reads keep their existing parallel execution.
+  const serial = isTransactionHandle(input.db);
+  const reads = [
+    () => listCapabilityCatalogItems(input.db, input.workspaceId),
+    () => listCapabilityInstallations(input.db, input.workspaceId),
+    () => listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),
+    () => listConnectionsMetadata(input.db, input.workspaceId, null),
+    () => discoverCuratedSkillLibraryItems(),
+    () => listInstalledSkills(input.db, input.workspaceId),
+    () =>
+      input.settings.codexConnectedAppsEnabled
+        ? resolveCodexAppsDesignationForRun(
+            input.db,
+            input.workspaceId,
+            input.accountId ? { accountId: input.accountId } : {},
+          )
+        : Promise.resolve(null),
+    () => listEnabledMcpCapabilityServers(input.db, input.workspaceId),
+  ] as const;
   const [
     persistedItems,
     capabilityInstallations,
@@ -102,22 +125,27 @@ export async function buildCapabilityCatalog(input: {
     installedSkills,
     codexAppsDesignation,
     runnableMcpServers,
-  ] = await Promise.all([
-    listCapabilityCatalogItems(input.db, input.workspaceId),
-    listCapabilityInstallations(input.db, input.workspaceId),
-    listSocialConnections(input.db, input.workspaceId, 500, input.subjectId),
-    listConnectionsMetadata(input.db, input.workspaceId, null),
-    discoverCuratedSkillLibraryItems(),
-    listInstalledSkills(input.db, input.workspaceId),
-    input.settings.codexConnectedAppsEnabled
-      ? resolveCodexAppsDesignationForRun(
-          input.db,
-          input.workspaceId,
-          input.accountId ? { accountId: input.accountId } : {},
-        )
-      : Promise.resolve(null),
-    listEnabledMcpCapabilityServers(input.db, input.workspaceId),
-  ]);
+  ] = serial
+    ? ([
+        await reads[0](),
+        await reads[1](),
+        await reads[2](),
+        await reads[3](),
+        await reads[4](),
+        await reads[5](),
+        await reads[6](),
+        await reads[7](),
+      ] as const)
+    : await Promise.all([
+        reads[0](),
+        reads[1](),
+        reads[2](),
+        reads[3](),
+        reads[4](),
+        reads[5](),
+        reads[6](),
+        reads[7](),
+      ]);
   const runnableCapabilityIds = new Set(runnableMcpServers.map((server) => server.capabilityId));
   const operatorOAuthClientConfigured = operatorOAuthClientResolver(input.settings);
   const catalogInstallations = capabilityInstallations.filter(

package/src/domain/file-owner.ts

@@ -62,6 +62,7 @@ export async function fileOwnerContextForAgent(
     },
     subjectId: grant.subjectId,
     initiatingHumanSubjectId: attempt.initiatingHumanSubjectId,
+    agentRootSessionId: attempt.callerRootSessionId,
     privateFileOwnerSubjectId: snapshot.defaultScope === "personal" ? snapshot.subjectId : null,
   };
 }

package/src/domain/insights-usage.ts

@@ -4,8 +4,27 @@ import type {
   InsightsUsageQuery,
   InsightsUsageRange,
   InsightsUsageResponse,
+  InsightsSiteUsageQuery,
 } from "@opengeni/contracts/insights-usage";
-import { readInsightsCalls, readInsightsUsage, type Database } from "@opengeni/db";
+import {
+  readInsightsCalls,
+  readInsightsUsage,
+  readInsightsSiteUsage,
+  type Database,
+} from "@opengeni/db";
+
+export async function getInsightsSiteUsage(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    query: InsightsSiteUsageQuery;
+    viewerSubjectId: string | null;
+    now?: Date;
+  },
+) {
+  return readInsightsSiteUsage(db, { ...input, now: input.now ?? new Date() });
+}
 
 export type InsightsQueryScope = {
   accountId: string;

package/src/domain/session-tool-policy.ts

@@ -589,6 +589,9 @@ export function sessionEffectiveToolProjectionInput(
     "request_human_input",
     "list_models",
     ...webSearchPlan.providerTools,
+    // Interaction entry tools stay visible even with progressive disclosure;
+    // the remaining authorized family tools are disclosed after opening.
+    ...firstPartyMcpTools.filter((name) => name === "browser_open" || name === "computer_open"),
     ...(toolRefs.some((ref) => ref.id === "opengeni" && ref.eager === true) ||
     !progressiveDisclosure
       ? firstPartyMcpTools.filter((name) => !interactionNames.has(name) || !progressiveDisclosure)

package/src/index.ts

@@ -149,6 +149,7 @@ export * from "./domain/organization-membership-lifecycle";
 export * from "./application/new-session-drafts";
 export * from "./application/composer-submit";
 export * from "./application/session-commands";
+export * from "./application/site-session-cancellation";
 export * from "./application/archived-session-imports";
 export * from "./application/session-tenancy";
 export * from "./application/organization-privacy";

package/src/sandbox/fleet.ts

@@ -985,6 +985,7 @@ function runOnOperationAdmission(
     operationResourcePolicySupported: enrollment.agentCapabilities.operationResourcePolicy === true,
     operationCpuQuotaSupported: enrollment.agentCapabilities.operationCpuQuota === true,
     transactionalFsWriteSupported: enrollment.agentCapabilities.transactionalFsWrite === true,
+    browserControlHttpSupported: enrollment.agentCapabilities.browserControlHttp === true,
   };
 }
 

package/src/session-authorization.ts

@@ -14,13 +14,12 @@ import {
 import { AsyncLocalStorage } from "node:async_hooks";
 import {
   currentSessionRlsActorIdentityKey,
-  getSessionAuthorityProjection,
-  getSessionAuthorizationTargetProjection,
+  currentSiteViewerRlsContext,
   getSession,
-  getSessionTurnForAttempt,
-  getSlackInteractionSessionAccessForSession,
+  getSessionAuthorizationFacts,
   withSessionRlsActorContext,
   type Database,
+  type SessionAuthorizationFacts,
   type SessionRlsActorContext,
 } from "@opengeni/db";
 import type { AppDependencies } from "./dependencies";
@@ -199,10 +198,6 @@ export function agentAccessListScopeForViewer(
   };
 }
 
-type ResolvedSessionAuthorizationTarget = {
-  target: SessionAuthorizationTarget;
-};
-
 /**
  * Whether a grant acts with live agent-attempt authority: an explicit
  * `agent_attempt` principal kind, or (for legacy tokens without one) any
@@ -237,6 +232,7 @@ export function sessionRlsActorForAuthorization(
     ? {
         subjectId: authorization.actor.subjectId,
         initiatingHumanSubjectId: authorization.actor.initiatingHumanSubjectId,
+        agentRootSessionId: authorization.actor.callerRootSessionId,
       }
     : { subjectId: authorization.actor.subjectId };
 }
@@ -259,7 +255,11 @@ export async function requireLiveAgentAttemptAuthorization(
   callerSessionId: string,
 ): Promise<Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>> {
   const reads = claimSessionAuthorizationReads();
-  const { actor } = await resolveSessionAuthorizationActor(db, grant, reads);
+  const claims = agentAttemptClaims(grant);
+  const facts = claims
+    ? await readSessionAuthorizationFacts(db, grant, claims.callerSessionId, claims, reads)
+    : null;
+  const { actor } = resolveSessionAuthorizationActor(grant, claims, facts);
   if (actor.kind !== "agent_attempt" || actor.callerSessionId !== callerSessionId) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
@@ -289,18 +289,13 @@ export async function requireSessionAuthorization(
   const reads = claimSessionAuthorizationReads();
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
-  // Callers can supply a transaction handle. Both reads open nested RLS
-  // savepoints, which must not race on the same PostgreSQL connection.
-  const slackAccess = await getSlackInteractionSessionAccessForSession(deps.db, {
-    accountId: grant.accountId,
-    workspaceId: grant.workspaceId,
-    sessionId: input.sessionId,
-  });
-  const authority = await getSessionAuthorityProjection(
-    deps.db,
-    grant.workspaceId,
-    input.sessionId,
-  );
+  const claims = agentAttemptClaims(grant);
+  // One scoped read returns the target's authority, its Slack ownership and,
+  // for an agent attempt, the caller session and its live turn. Every check
+  // below decides from these facts; none of them reads again.
+  const facts = await readSessionAuthorizationFacts(deps.db, grant, input.sessionId, claims, reads);
+  const authority = facts.target;
+  const slackAccess = authority?.slackAccess ?? null;
 
   // The projection is read under the caller's own RLS context, so a missing
   // session and one the caller may not see (another member's private session)
@@ -312,6 +307,24 @@ export async function requireSessionAuthorization(
     throw new SessionAuthorizationDeniedError("not_found");
   }
 
+  // Also enforce the durable Site audience for hosts using scoped (owner-role)
+  // databases. The request-local viewer proof is never taken from Site JSON.
+  if (authority?.siteAccessRootId) {
+    const viewer = currentSiteViewerRlsContext();
+    const actor = resolveSessionAuthorizationActor(grant, claims, facts).actor;
+    const allowed =
+      actor.kind === "agent_attempt"
+        ? (authority.siteOwnerSubjectId !== null &&
+            authority.siteOwnerSubjectId === actor.initiatingHumanSubjectId) ||
+          (actor.callerRootSessionId === authority.rootSessionId &&
+            authority.siteAccessRootId === authority.rootSessionId)
+        : authority.siteOwnerSubjectId === actor.subjectId ||
+          (actor.subjectId === `site:${authority.siteId}` &&
+            viewer?.siteId === authority.siteId &&
+            viewer.principal === authority.siteViewerPrincipal);
+    if (!allowed) throw new SessionAuthorizationDeniedError("not_found");
+  }
+
   // A request from a Site page (an HTTP frame request, or a tool the page
   // called) may act on a session only when that same Site, or for a frame
   // without a published Site the same mounted frame, started it. Anything
@@ -335,15 +348,15 @@ export async function requireSessionAuthorization(
   }
   if (!authority) throw new SessionAuthorizationDeniedError("not_found");
 
-  const resolvedActor = await resolveSessionAuthorizationActor(deps.db, grant, reads);
-  const resolvedTarget = await resolveSessionAuthorizationTarget(
-    deps.db,
-    grant,
-    input.sessionId,
-    reads,
-  );
+  const resolvedActor = resolveSessionAuthorizationActor(grant, claims, facts);
+  if (authority.accountId !== grant.accountId) {
+    throw new SessionAuthorizationDeniedError("not_found");
+  }
   const actor = resolvedActor.actor;
-  const target = resolvedTarget.target;
+  const target: SessionAuthorizationTarget = {
+    sessionId: authority.sessionId,
+    rootSessionId: authority.rootSessionId,
+  };
   const agentRelatedSessionAccess =
     actor.kind === "agent_attempt"
       ? relatedSessionAccessForAgentAttempt(actor, target.sessionId)
@@ -462,7 +475,11 @@ export async function requireSessionAuthorizationListScope(
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
   if (!port && !isAgentAttempt) return null;
-  const { actor, callerAccess } = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+  const claims = agentAttemptClaims(grant);
+  const facts = claims
+    ? await readSessionAuthorizationFacts(deps.db, grant, claims.callerSessionId, claims, reads)
+    : null;
+  const { actor, callerAccess } = resolveSessionAuthorizationActor(grant, claims, facts);
   // Standalone agents retain compact workspace discovery only while the signed
   // caller attempt is still the exact live attempt, and only within their own
   // declared agent-access reach (migration 0427). The viewer is derived from
@@ -504,36 +521,72 @@ export async function requireSessionAuthorizationListScope(
   return viewer ? agentAccessListScopeForViewer(viewer, hostScope) : hostScope;
 }
 
-async function resolveSessionAuthorizationTarget(
+type AgentAttemptClaims = {
+  callerSessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+};
+
+/**
+ * The signed attempt claims of an agent-attempt grant, or null for any other
+ * principal and for malformed claims (which the actor check then refuses).
+ */
+function agentAttemptClaims(grant: AccessGrant): AgentAttemptClaims | null {
+  if (!grantHasAgentAttemptAuthority(grant)) return null;
+  const callerSessionId = grant.metadata?.["sessionId"];
+  const turnId = grant.metadata?.["turnId"];
+  const attemptId = grant.metadata?.["attemptId"];
+  const executionGeneration = grant.metadata?.["executionGeneration"];
+  if (
+    typeof callerSessionId !== "string" ||
+    typeof turnId !== "string" ||
+    typeof attemptId !== "string" ||
+    typeof executionGeneration !== "number" ||
+    !Number.isSafeInteger(executionGeneration) ||
+    executionGeneration < 1
+  ) {
+    return null;
+  }
+  return { callerSessionId, turnId, attemptId, executionGeneration };
+}
+
+async function readSessionAuthorizationFacts(
   db: Database,
   grant: AccessGrant,
   sessionId: string,
+  claims: AgentAttemptClaims | null,
   reads: SessionAuthorizationReads | null,
-): Promise<ResolvedSessionAuthorizationTarget> {
-  const session = await reusableAuthorizationRead(
+): Promise<SessionAuthorizationFacts> {
+  return await reusableAuthorizationRead(
     reads,
     db,
-    ["target-identity", grant.workspaceId, sessionId],
-    () => getSessionAuthorizationTargetProjection(db, grant.workspaceId, sessionId),
+    [
+      "authorization-facts",
+      grant.accountId,
+      grant.workspaceId,
+      sessionId,
+      claims?.callerSessionId ?? "",
+      claims?.attemptId ?? "",
+    ],
+    () =>
+      getSessionAuthorizationFacts(db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        sessionId,
+        caller: claims
+          ? { sessionId: claims.callerSessionId, attemptId: claims.attemptId }
+          : undefined,
+      }),
   );
-  if (!session || session.accountId !== grant.accountId) {
-    throw new SessionAuthorizationDeniedError("not_found");
-  }
-  return {
-    target: { sessionId: session.id, rootSessionId: session.rootSessionId },
-  };
 }
-async function resolveSessionAuthorizationActor(
-  db: Database,
+
+function resolveSessionAuthorizationActor(
   grant: AccessGrant,
-  reads: SessionAuthorizationReads | null,
-): Promise<ResolvedSessionAuthorizationActor> {
-  const callerSessionId = grant.metadata?.["sessionId"];
-  const turnId = grant.metadata?.["turnId"];
-  const attemptId = grant.metadata?.["attemptId"];
-  const executionGeneration = grant.metadata?.["executionGeneration"];
-  const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
-  if (!isAgentAttempt) {
+  claims: AgentAttemptClaims | null,
+  facts: SessionAuthorizationFacts | null,
+): ResolvedSessionAuthorizationActor {
+  if (!grantHasAgentAttemptAuthority(grant)) {
     return {
       actor: SessionAuthorizationActor.parse({
         kind: "subject",
@@ -544,36 +597,15 @@ async function resolveSessionAuthorizationActor(
       callerAccess: null,
     };
   }
+  const callerSession = facts?.caller?.session ?? null;
+  const turn = facts?.caller?.turn ?? null;
   if (
-    typeof callerSessionId !== "string" ||
-    typeof turnId !== "string" ||
-    typeof attemptId !== "string" ||
-    typeof executionGeneration !== "number" ||
-    !Number.isSafeInteger(executionGeneration) ||
-    executionGeneration < 1
-  ) {
-    throw new SessionAuthorizationDeniedError("caller_stale");
-  }
-  // These scoped reads can also open nested savepoints on a transaction handle.
-  const callerSession = await reusableAuthorizationRead(
-    reads,
-    db,
-    ["session", grant.workspaceId, callerSessionId],
-    () => getSession(db, grant.workspaceId, callerSessionId),
-  );
-  const turn = await reusableAuthorizationRead(
-    reads,
-    db,
-    ["turn", grant.workspaceId, callerSessionId, attemptId],
-    () => getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),
-  );
-  if (
+    !claims ||
     !callerSession ||
     callerSession.accountId !== grant.accountId ||
     !turn ||
-    turn.id !== turnId ||
-    turn.executionGeneration !== executionGeneration ||
-    callerSession.activeTurnId !== turn.id
+    turn.id !== claims.turnId ||
+    turn.executionGeneration !== claims.executionGeneration
   ) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
@@ -581,11 +613,11 @@ async function resolveSessionAuthorizationActor(
     actor: SessionAuthorizationActor.parse({
       kind: "agent_attempt",
       subjectId: grant.subjectId,
-      callerSessionId,
+      callerSessionId: claims.callerSessionId,
       callerRootSessionId: callerSession.rootSessionId,
-      turnId,
-      attemptId,
-      executionGeneration,
+      turnId: claims.turnId,
+      attemptId: claims.attemptId,
+      executionGeneration: claims.executionGeneration,
       initiator: turn.initiator,
       initiatorContext: turn.initiatorContext,
       initiatingHumanSubjectId: