@opengeni/core 5.0.0 → 5.0.1-canary.36927100590001

package/dist/access/index.d.ts

@@ -1,10 +1,23 @@
 import { type Settings } from "@opengeni/config";
 import { ExternalActorAttribution, type ExternalActorContinuation } from "@opengeni/contracts/external-identities";
-import { type AccountGrant, type AccessContext, type AccessGrant, Permission, type Workspace } from "@opengeni/contracts";
+import { type AccountGrant, type AccessContext, type AccessGrant, type OrganizationApiKeyAccess, Permission, type Workspace } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";
 import type { ManagedAuth } from "../managed-auth-type.js";
 import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets.js";
+import type { UserPresenceRecorder } from "../user-presence.js";
+/** Only canonical authentication can prove setup-key provenance. */
+export declare function isDeveloperSetupApiKeyContext(context: AccessContext): boolean;
+/** Provenance from canonical raw-key or verified restricted-token authentication. */
+export declare function isDeveloperSetupAuthorization(authorization: AccessGrantAuthorization | undefined): boolean;
+/** Exact grant objects resolved under authenticated setup-only provenance. */
+export declare function isDeveloperSetupGrant(grant: AccessGrant): boolean;
+/** Setup-derived credentials cannot carry literal organization or key authority. */
+export declare function isDeveloperSetupDelegatedPermissionAllowed(permission: Permission): boolean;
+/** Canonical authentication provenance, including the backing key of asUser. */
+export declare function requireApiKeyManagementContext(context: AccessContext): void;
+/** Membership is not an escape hatch for minting durable credentials. */
+export declare function requireApiKeyDelegationContext(context: AccessContext, permissions: Permission[]): void;
 /** Creation audit only, never an authentication or delegation token. Metadata
  * claiming to be external is insufficient; the exact resolver proof is needed. */
 export declare function externalAttributionForAuthorization(authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): ExternalActorAttribution | null;
@@ -24,6 +37,8 @@ export type AccountScopedApiKeyWorkspaceAuthority = Readonly<{
  * shape alone is deliberately insufficient.
  */
 export declare function accountScopedApiKeyWorkspaceAuthority(context: AccessContext): AccountScopedApiKeyWorkspaceAuthority | null;
+/** Classify stored scopes without changing the legacy full/read permission sets. */
+export declare function organizationApiKeyAccess(permissions: Permission[]): OrganizationApiKeyAccess;
 /**
  * Opaque, request-local proof that the canonical access resolver authorized the
  * exact account administrator named by the stamp. The random id is audit and
@@ -41,6 +56,8 @@ export type AccessDeps = {
     settings: Settings;
     managedAuth?: ManagedAuth | null;
     managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
+    /** Analytics only: notes canonical managed-cookie activity, never authority. */
+    userPresence?: UserPresenceRecorder | null;
 };
 /** null means this is not an authenticated external lane; [] means that lane
  * has no readable inventory. Callers must not fall back from [] to service or

package/dist/application/archived-session-imports.d.ts

@@ -0,0 +1,6 @@
+import { AppendArchivedSessionEventsResponse, ImportArchivedSessionResponse } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+import type { ApiRouteDeps } from "../dependencies.js";
+export { ArchivedSessionImportError } from "@opengeni/db";
+export declare function importArchivedSessionForRequest(deps: ApiRouteDeps, authorization: AccessGrantAuthorization, workspaceId: string, rawPayload: unknown): Promise<ImportArchivedSessionResponse>;
+export declare function appendArchivedSessionEventsForRequest(deps: ApiRouteDeps, authorization: AccessGrantAuthorization, workspaceId: string, importId: string, rawPayload: unknown): Promise<AppendArchivedSessionEventsResponse>;

package/dist/application/external-workspace-members.d.ts

@@ -26,7 +26,7 @@ export declare function cancelExternalWorkspaceMemberGrantForRequest(c: Context,
 export declare function updateExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, organizationId: string, workspaceId: string, membershipId: string, input: unknown): Promise<{
     subjectId: string;
     organizationMembershipId: string;
-    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
     narrowed: boolean;
     replay: boolean;
 }>;

package/dist/application/session-commands.d.ts

@@ -1,4 +1,5 @@
 import type { ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SessionAuthorizationPort, SessionAuthorizationSurface, SessionControlRequest, SessionControlResponse, SessionQueueMutationResponse, SteerSessionQueueItemRequest, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse } from "@opengeni/contracts";
+import type { Settings } from "@opengeni/config";
 import { type Database, type SessionCommandReceiptRow } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import type { SessionWorkflowClient } from "../dependencies.js";
@@ -37,6 +38,7 @@ type SessionCommandPostCommitDeps = {
 };
 export declare function sendAgentSessionMessage(deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;
@@ -47,6 +49,7 @@ export declare function sendAgentSessionMessage(deps: {
 }): Promise<import("@opengeni/db").AgentInternalUpdateCommandResult>;
 export declare function steerAgentSession(deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;

package/dist/billing/limits.d.ts

@@ -9,6 +9,8 @@ export declare function documentEmbeddingCostMicros(settings: Settings, inputByt
 export type LimitCheckInput = {
     accountId: string;
     workspaceId?: string;
+    /** Frozen causal human, never the API key or service admitting the work. */
+    initiatingHumanSubjectId?: string | null;
     action: LimitAction;
     quantity?: number;
     model?: string | null;

package/dist/{chunk-2JXLQTMR.js → chunk-2MKMRGSY.js}

@@ -25,7 +25,7 @@ import {
   editableArtifactSnapshotId,
   editableArtifactStateHash,
   validateEditableArtifactActor
-} from "./chunk-VCZFFEPB.js";
+} from "./chunk-LCQXNR62.js";
 
 // src/domain/editable-artifacts/durable-export.ts
 import { createHash } from "crypto";
@@ -1288,6 +1288,9 @@ var InMemoryEditableArtifactStore = class {
     });
   }
   async readTransactionBasis(scope, artifactId, request) {
+    if (request.authorizeCommit) {
+      throw new TypeError("Transactional artifact authority requires a PostgreSQL store");
+    }
     const normalizedScope = editableArtifactScope(scope);
     const normalizedArtifactId = editableArtifactId(artifactId);
     const key = aggregateKey(normalizedScope, normalizedArtifactId);
@@ -1337,6 +1340,9 @@ var InMemoryEditableArtifactStore = class {
     });
   }
   async tryCommitAppliedTransaction(request) {
+    if (request.authorizeCommit) {
+      throw new TypeError("Transactional artifact authority requires a PostgreSQL store");
+    }
     const scope = editableArtifactScope(request.scope);
     const artifactId = editableArtifactId(request.artifactId);
     const key = aggregateKey(scope, artifactId);
@@ -2455,4 +2461,4 @@ export {
   EditableArtifactGenesisPipeline,
   editableArtifactMaterializationKey
 };
-//# sourceMappingURL=chunk-2JXLQTMR.js.map
+//# sourceMappingURL=chunk-2MKMRGSY.js.map