@opengeni/core 4.0.3-canary.36079201993001 → 4.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "4.0.3-canary.36079201993001",
+  "version": "4.0.3",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,17 +50,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.4-canary.36079201993001",
-    "@opengeni/codex": "^0.2.26-canary.36079201993001",
-    "@opengeni/config": "^2.1.1-canary.36079201993001",
-    "@opengeni/contracts": "^5.1.1-canary.36079201993001",
-    "@opengeni/db": "^6.0.3-canary.36079201993001",
-    "@opengeni/documents": "^0.8.34-canary.36079201993001",
-    "@opengeni/events": "^0.4.32-canary.36079201993001",
-    "@opengeni/network": "^0.3.1-canary.36079201993001",
-    "@opengeni/observability": "^0.8.32-canary.36079201993001",
-    "@opengeni/runtime": "^4.0.3-canary.36079201993001",
-    "@opengeni/storage": "^0.2.133-canary.36079201993001",
+    "@opengeni/capabilities": "^0.3.4",
+    "@opengeni/codex": "^0.2.26",
+    "@opengeni/config": "^2.1.1",
+    "@opengeni/contracts": "^5.1.1",
+    "@opengeni/db": "^6.0.3",
+    "@opengeni/documents": "^0.8.34",
+    "@opengeni/events": "^0.4.32",
+    "@opengeni/network": "^0.3.1",
+    "@opengeni/observability": "^0.8.32",
+    "@opengeni/runtime": "^4.0.3",
+    "@opengeni/storage": "^0.2.133",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/application/session-mcp-credential-rotation.ts

@@ -27,11 +27,6 @@ import {
 import { requireVariableSetEncryption } from "../domain/environments";
 import { normalizedSessionMcpCredentialHeaders } from "../domain/sessions";
 import { externalContinuationCommitAuthorizer } from "./external-continuation";
-import {
-  listOwnConnectionAccountsForGrant,
-  personalConnectionDelegationSourceForGrant,
-} from "../domain/personal-connection-delegations";
-import { nativeSessionConnectionReplacement } from "../domain/session-native-connection-replacement";
 
 /** HMAC domains separate request identity from key availability. The key tag
  * carries no request material and neither fingerprint is returned publicly. */
@@ -85,20 +80,11 @@ export async function rotateSessionMcpCredentialsForRequest(
           id: update.id,
           expectedCredentialVersion: update.expectedCredentialVersion,
           expectedServerUrl: update.expectedServerUrl,
-          ...("nativeConnectionId" in update
-            ? {
-                nativeConnectionId: update.nativeConnectionId,
-                ...(update.replacementServerUrl
-                  ? { replacementServerUrl: update.replacementServerUrl }
-                  : {}),
-              }
-            : {
-                headers: Object.fromEntries(
-                  Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
-                    .map(([name, value]) => [name.toLowerCase(), value] as const)
-                    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
-                ),
-              }),
+          headers: Object.fromEntries(
+            Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
+              .map(([name, value]) => [name.toLowerCase(), value] as const)
+              .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+          ),
         }))
         .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
     };
@@ -116,45 +102,20 @@ export async function rotateSessionMcpCredentialsForRequest(
     actorType: grant.principalKind === "service" ? ("service" as const) : ("human" as const),
   };
   const externalAuthorize = externalContinuationCommitAuthorizer(authorization);
-  let authorizedGrant = grant;
   try {
     return await rotateSessionMcpCredentialsAtomically(deps.db, {
       ...scope,
       operationKey: request.operationKey,
       ...sessionMcpRotationFingerprint(encryptionKey, scope, request),
-      updates: request.updates.map((update) =>
-        "nativeConnectionId" in update
-          ? update
-          : {
-              id: update.id,
-              expectedCredentialVersion: update.expectedCredentialVersion,
-              expectedServerUrl: update.expectedServerUrl,
-              headersEncrypted: Object.fromEntries(
-                Object.entries(update.headers).map(([name, value]) => [
-                  name,
-                  encryptVariableSetValue(encryptionKey, value),
-                ]),
-              ),
-            },
-      ),
-      resolveNativeConnection: async (tx, server, nativeConnectionId, replacementServerUrl) => {
-        const connections = await listOwnConnectionAccountsForGrant(tx, authorizedGrant);
-        const source = personalConnectionDelegationSourceForGrant(authorizedGrant);
-        try {
-          return nativeSessionConnectionReplacement({
-            accountId: grant.accountId,
-            workspaceId: grant.workspaceId,
-            subjectId: source.kind === "subject" ? source.subjectId : null,
-            serverUrl: server.url,
-            ...(replacementServerUrl ? { replacementServerUrl } : {}),
-            currentRef: server.connectionRef,
-            nativeConnectionId,
-            connections,
-          });
-        } catch {
-          throw new SessionMcpCredentialRotationError("connection_unavailable");
-        }
-      },
+      updates: request.updates.map(({ headers, ...update }) => ({
+        ...update,
+        headersEncrypted: Object.fromEntries(
+          Object.entries(headers).map(([name, value]) => [
+            name,
+            encryptVariableSetValue(encryptionKey, value),
+          ]),
+        ),
+      })),
       authorize: async (tx) => {
         await externalAuthorize?.(tx);
         const fresh = await reauthorize(tx);
@@ -184,7 +145,6 @@ export async function rotateSessionMcpCredentialsForRequest(
           operation: "session.mcp.credentials.rotate",
           surface: "http",
         });
-        authorizedGrant = fresh;
       },
     });
   } catch (error) {
@@ -202,9 +162,7 @@ export async function rotateSessionMcpCredentialsForRequest(
             ? 403
             : error.code === "not_found"
               ? 404
-              : error.code === "invalid_request" ||
-                  error.code === "brokered_server" ||
-                  error.code === "connection_unavailable"
+              : error.code === "invalid_request" || error.code === "brokered_server"
                 ? 422
                 : 409;
       throw new HTTPException(status, { message: `credential_rotation_${error.code}` });

package/src/domain/capabilities.ts

@@ -4,7 +4,6 @@ import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { isDeepStrictEqual } from "node:util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
-import { pinnedFetch } from "@opengeni/network";
 import {
   CapabilityCatalogItem,
   capabilityCatalogItemIsTrustedForExposure,
@@ -345,12 +344,7 @@ export async function prepareCapabilityEnable(input: EnableCapabilityInput) {
       ...installationMetadata,
       ...(connectionRef && !headers
         ? authDeferredMcpConnectivity()
-        : await validateMcpCapabilityConnection(
-            item,
-            input.probeMcpServer,
-            headers ?? undefined,
-            input.settings,
-          )),
+        : await validateMcpCapabilityConnection(item, input.probeMcpServer, headers ?? undefined)),
     };
     if (connectionRef) {
       installationConfig.connectionRef = connectionRef;
@@ -675,7 +669,6 @@ export type McpCapabilityProbeInput = {
   url: string;
   timeoutMs: number;
   headers?: Record<string, string>;
-  settings?: Settings;
 };
 
 export type McpCapabilityProbeResult = {
@@ -690,7 +683,6 @@ export async function validateMcpCapabilityConnection(
   item: CapabilityCatalogItem,
   probe: McpCapabilityProbe = probeStreamableHttpMcpServer,
   headers?: Record<string, string>,
-  settings?: Settings,
 ): Promise<Record<string, unknown>> {
   if (item.kind !== "mcp") {
     return {};
@@ -707,7 +699,6 @@ export async function validateMcpCapabilityConnection(
       url: item.endpointUrl,
       timeoutMs: mcpCapabilityProbeTimeoutMs,
       ...(headers ? { headers } : {}),
-      ...(settings ? { settings } : {}),
     });
     return {
       mcpConnectivity: {
@@ -726,8 +717,6 @@ export async function validateMcpCapabilityConnection(
 async function probeStreamableHttpMcpServer(
   input: McpCapabilityProbeInput,
 ): Promise<McpCapabilityProbeResult> {
-  const settings = input.settings;
-  if (!settings) throw new Error("Network policy is unavailable for MCP validation");
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), input.timeoutMs);
   const client = new Client(
@@ -740,11 +729,6 @@ async function probeStreamableHttpMcpServer(
         signal: controller.signal,
         ...(input.headers ? { headers: input.headers } : {}),
       },
-      fetch: (url, init) =>
-        pinnedFetch(url, init, settings, {
-          label: "MCP capability probe",
-          requireHttpsOutsideLocalTest: true,
-        }),
     });
     await client.connect(transport as unknown as Transport, {
       timeout: input.timeoutMs,

package/dist/domain/session-native-connection-replacement.d.ts

@@ -1,14 +0,0 @@
-import type { ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
-/** Selection is restricted to the caller's already-authorized inventory. This
- * projection grants no execution authority: subsequent admission and physical
- * credential use still validate the exact native account normally. */
-export declare function nativeSessionConnectionReplacement(input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string | null;
-    serverUrl: string;
-    replacementServerUrl?: string;
-    currentRef: McpServerConnectionRef | null;
-    nativeConnectionId: string;
-    connections: ConnectionMetadata[];
-}): McpServerConnectionRef;

package/src/domain/session-native-connection-replacement.ts

@@ -1,64 +0,0 @@
-import type { ConnectionMetadata, McpServerConnectionRef } from "@opengeni/contracts";
-import { connectionMetadataMatchesBinding } from "@opengeni/db/session-mcp-credential-rotation";
-
-/** Selection is restricted to the caller's already-authorized inventory. This
- * projection grants no execution authority: subsequent admission and physical
- * credential use still validate the exact native account normally. */
-export function nativeSessionConnectionReplacement(input: {
-  accountId: string;
-  workspaceId: string;
-  subjectId: string | null;
-  serverUrl: string;
-  replacementServerUrl?: string;
-  currentRef: McpServerConnectionRef | null;
-  nativeConnectionId: string;
-  connections: ConnectionMetadata[];
-}): McpServerConnectionRef {
-  const connection = input.connections.find(
-    (candidate) => candidate.id === input.nativeConnectionId,
-  );
-  if (
-    !connection ||
-    connection.accountId !== input.accountId ||
-    connection.status !== "active" ||
-    (connection.subjectId === null
-      ? connection.workspaceId !== input.workspaceId
-      : !input.subjectId || connection.subjectId !== input.subjectId || !connection.authorityId)
-  ) {
-    throw new Error("native connection unavailable");
-  }
-  const {
-    authoritySource: _authoritySource,
-    hostBinding: _hostBinding,
-    accountSelection: _accountSelection,
-    ...retained
-  } = input.currentRef ?? {};
-  // Preserve provider, resource, scope and selected-resource restrictions.
-  // Retired host identity is never interpreted as a native connection ID.
-  if (
-    input.currentRef &&
-    input.currentRef.providerDomain.toLowerCase() !== connection.providerDomain.toLowerCase()
-  )
-    throw new Error("native connection provider mismatch");
-  const ref: McpServerConnectionRef = {
-    ...retained,
-    ...(!input.currentRef?.resource && typeof connection.metadata.resource === "string"
-      ? { resource: connection.metadata.resource }
-      : {}),
-    connectionId: connection.id,
-    providerDomain: connection.providerDomain,
-    kind: connection.kind,
-    subjectScope: connection.subjectId === null ? "workspace" : "subject",
-  };
-  const destination = input.replacementServerUrl ?? input.serverUrl;
-  // A redirect must be explicitly requested and bound in the account metadata;
-  // the broker's legacy provider-host fallback is insufficient for rebinding.
-  if (
-    input.replacementServerUrl &&
-    (typeof connection.metadata.mcpUrl !== "string" || !connection.metadata.mcpUrl.trim())
-  )
-    throw new Error("native connection destination unavailable");
-  if (!connectionMetadataMatchesBinding(connection, ref, destination))
-    throw new Error("native connection binding mismatch");
-  return ref;
-}