@opengeni/db 5.0.1 → 6.0.0

package/src/host-mcp-resolvers.ts

@@ -1,266 +0,0 @@
-import { createHmac, randomUUID } from "node:crypto";
-import { sql } from "drizzle-orm";
-import { stableJson } from "@opengeni/contracts";
-import {
-  HostMcpResolver,
-  HostMcpResolverSource,
-  PutHostMcpResolverRequest,
-  RevokeHostMcpResolverRequest,
-} from "@opengeni/contracts/host-mcp-resolvers";
-import { rawRows, setSubjectRlsContext, withRlsContext, type Database } from "./database";
-import { encryptEnvironmentValue, decryptEnvironmentValue } from "./environment-crypto";
-
-export class HostMcpResolverError extends Error {
-  constructor(
-    readonly status: 403 | 404 | 409,
-    message: string,
-  ) {
-    super(message);
-  }
-}
-type Actor = { accountId: string; subjectId: string };
-type Row = {
-  id: string;
-  account_id: string;
-  external_source: string;
-  url: string;
-  secret_encrypted: string;
-  timeout_ms: number;
-  generation: number | string;
-  status: string;
-  created_at: Date | string;
-  updated_at: Date | string;
-};
-const project = (row: Row): HostMcpResolver =>
-  HostMcpResolver.parse({
-    id: row.id,
-    organizationId: row.account_id,
-    externalSource: row.external_source,
-    url: row.url,
-    timeoutMs: row.timeout_ms,
-    generation: Number(row.generation),
-    status: row.status,
-    createdAt: new Date(row.created_at).toISOString(),
-    updatedAt: new Date(row.updated_at).toISOString(),
-  });
-
-/** Caller proves service-key provenance at the public authentication boundary.
- * Recheck the exact live key under lock, including receipt replay. */
-async function administered<T>(
-  db: Database,
-  actor: Actor,
-  use: (tx: Database) => Promise<T>,
-): Promise<T> {
-  return withRlsContext(db, { accountId: actor.accountId, workspaceId: null }, async (tx) => {
-    await setSubjectRlsContext(tx, actor.subjectId);
-    const [key] = await rawRows(
-      tx,
-      sql`select id from api_keys where account_id = ${actor.accountId}::uuid
-      and 'api_key:' || id::text = ${actor.subjectId} and workspace_id is null and credential_kind = 'organization'
-      and revoked_at is null and (expires_at is null or expires_at > clock_timestamp())
-      and permissions ? 'workspace:admin' for share`,
-    );
-    if (!key) throw new HostMcpResolverError(403, "organization service administration required");
-    await tx.execute(
-      sql`select pg_advisory_xact_lock(hashtextextended(${`host-mcp-resolvers:${actor.accountId}`}, 0))`,
-    );
-    return use(tx);
-  });
-}
-
-export async function getHostMcpResolver(
-  db: Database,
-  actor: Actor,
-  source: string,
-): Promise<HostMcpResolver> {
-  const externalSource = HostMcpResolverSource.parse(source);
-  return administered(db, actor, async (tx) => {
-    const [row] = await rawRows<Row>(
-      tx,
-      sql`select * from host_mcp_resolvers where account_id = ${actor.accountId}::uuid and external_source = ${externalSource}`,
-    );
-    if (!row) throw new HostMcpResolverError(404, "resolver unavailable");
-    return project(row);
-  });
-}
-
-export async function mutateHostMcpResolver(
-  db: Database,
-  actor: Actor,
-  input: {
-    externalSource: string;
-    encryptionKey: Uint8Array;
-    legacyConfigured: boolean;
-  } & (
-    | { kind: "put"; request: PutHostMcpResolverRequest }
-    | { kind: "revoke"; request: RevokeHostMcpResolverRequest }
-  ),
-): Promise<HostMcpResolver> {
-  const externalSource = HostMcpResolverSource.parse(input.externalSource);
-  const putRequest = input.kind === "put" ? PutHostMcpResolverRequest.parse(input.request) : null;
-  const operation = putRequest ?? RevokeHostMcpResolverRequest.parse(input.request);
-  const digest = createHmac("sha256", input.encryptionKey)
-    .update("opengeni:host-mcp-resolver-operation:v1\0")
-    .update(stableJson({ actor, externalSource, kind: input.kind, request: operation }))
-    .digest("hex");
-  return administered(db, actor, async (tx) => {
-    const [receipt] = await rawRows<{ request_digest: string; result: unknown }>(
-      tx,
-      sql`select request_digest, result from host_mcp_resolver_operations
-      where account_id = ${actor.accountId}::uuid and operation_id = ${operation.operationId}::uuid`,
-    );
-    if (receipt) {
-      if (receipt.request_digest !== digest)
-        throw new HostMcpResolverError(409, "resolver operation conflicts");
-      // Return historical metadata only; never restore old configuration or secrets.
-      return HostMcpResolver.parse(receipt.result);
-    }
-    const [current] = await rawRows<Row>(
-      tx,
-      sql`select * from host_mcp_resolvers where account_id = ${actor.accountId}::uuid and external_source = ${externalSource} for update`,
-    );
-    if ((current ? Number(current.generation) : 0) !== operation.expectedGeneration)
-      throw new HostMcpResolverError(409, "resolver generation changed");
-    let row: Row | undefined;
-    if (putRequest) {
-      const request = putRequest;
-      const [existing] = await rawRows(
-        tx,
-        sql`select id from host_mcp_resolvers where account_id = ${actor.accountId}::uuid limit 1`,
-      );
-      if (!existing && input.legacyConfigured && !request.acknowledgeLegacyRoutingReplacement)
-        throw new HostMcpResolverError(
-          409,
-          "first registration requires explicit legacy routing replacement acknowledgement",
-        );
-      const id = current?.id ?? randomUUID();
-      const generation = request.expectedGeneration + 1;
-      const encrypted = encryptEnvironmentValue(
-        input.encryptionKey,
-        JSON.stringify({
-          version: 1,
-          id,
-          accountId: actor.accountId,
-          externalSource,
-          generation,
-          url: request.url,
-          bearerToken: request.bearerToken,
-        }),
-      );
-      [row] = current
-        ? await rawRows<Row>(
-            tx,
-            sql`update host_mcp_resolvers set url = ${request.url}, secret_encrypted = ${encrypted}, timeout_ms = ${request.timeoutMs}, generation = ${generation}, status = 'active', updated_at = clock_timestamp() where id = ${id}::uuid returning *`,
-          )
-        : await rawRows<Row>(
-            tx,
-            sql`insert into host_mcp_resolvers (id, account_id, external_source, url, secret_encrypted, timeout_ms, generation, status) values (${id}::uuid, ${actor.accountId}::uuid, ${externalSource}, ${request.url}, ${encrypted}, ${request.timeoutMs}, 1, 'active') returning *`,
-          );
-    } else {
-      if (!current) throw new HostMcpResolverError(404, "resolver unavailable");
-      [row] = await rawRows<Row>(
-        tx,
-        sql`update host_mcp_resolvers set status = 'revoked', generation = generation + 1, updated_at = clock_timestamp() where id = ${current.id}::uuid returning *`,
-      );
-    }
-    if (!row) throw new Error("resolver mutation unavailable");
-    const result = project(row);
-    await tx.execute(sql`insert into host_mcp_resolver_operations (account_id, operation_id, actor_subject_id, request_digest, result)
-      values (${actor.accountId}::uuid, ${operation.operationId}::uuid, ${actor.subjectId}, ${digest}, ${JSON.stringify(result)}::jsonb)`);
-    return result;
-  });
-}
-
-export type HostMcpResolverRoute =
-  | { mode: "legacy" }
-  | { mode: "denied" }
-  | {
-      mode: "namespace";
-      id: string;
-      generation: number;
-      accountId: string;
-      workspaceId: string;
-      externalSource: string;
-      url: string;
-      bearerToken: string;
-      timeoutMs: number;
-    };
-/** Runtime lookup, not tool authority. Failure must never be interpreted as legacy. */
-export async function resolveHostMcpResolverRoute(
-  db: Database,
-  input: { accountId: string; workspaceId: string },
-  encryptionKey: Uint8Array | null,
-): Promise<HostMcpResolverRoute> {
-  return withRlsContext(
-    db,
-    { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (tx) => {
-      const [workspace] = await rawRows<{ external_source: string | null }>(
-        tx,
-        sql`select external_source from workspaces where id = ${input.workspaceId}::uuid and account_id = ${input.accountId}::uuid`,
-      );
-      if (!workspace) return { mode: "denied" };
-      const [any] = await rawRows(
-        tx,
-        sql`select id from host_mcp_resolvers where account_id = ${input.accountId}::uuid limit 1`,
-      );
-      if (!any) return { mode: "legacy" };
-      if (!workspace.external_source || !encryptionKey) return { mode: "denied" };
-      const [row] = await rawRows<Row>(
-        tx,
-        sql`select * from host_mcp_resolvers where account_id = ${input.accountId}::uuid and external_source = ${workspace.external_source} and status = 'active'`,
-      );
-      if (!row) return { mode: "denied" };
-      const bundle = JSON.parse(decryptEnvironmentValue(encryptionKey, row.secret_encrypted));
-      if (
-        bundle.version !== 1 ||
-        bundle.id !== row.id ||
-        bundle.accountId !== input.accountId ||
-        bundle.externalSource !== workspace.external_source ||
-        bundle.generation !== Number(row.generation) ||
-        bundle.url !== row.url ||
-        typeof bundle.bearerToken !== "string" ||
-        !bundle.bearerToken ||
-        /[\r\n]/u.test(bundle.bearerToken)
-      )
-        throw new Error("resolver secret binding invalid");
-      return {
-        mode: "namespace",
-        id: row.id,
-        generation: Number(row.generation),
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        externalSource: workspace.external_source,
-        url: row.url,
-        bearerToken: bundle.bearerToken,
-        timeoutMs: row.timeout_ms,
-      };
-    },
-  );
-}
-
-export async function hostMcpResolverRouteIsCurrent(
-  db: Database,
-  input: { accountId: string; workspaceId: string },
-  route: HostMcpResolverRoute,
-): Promise<boolean> {
-  if (route.mode === "denied") return false;
-  return withRlsContext(
-    db,
-    { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (tx) => {
-      const [row] =
-        route.mode === "legacy"
-          ? await rawRows(
-              tx,
-              sql`select w.id from workspaces w where w.id = ${input.workspaceId}::uuid and w.account_id = ${input.accountId}::uuid and not exists (select 1 from host_mcp_resolvers r where r.account_id = w.account_id)`,
-            )
-          : await rawRows(
-              tx,
-              sql`select r.id from host_mcp_resolvers r join workspaces w on w.account_id = r.account_id and w.external_source = r.external_source
-        where w.id = ${input.workspaceId}::uuid and r.account_id = ${input.accountId}::uuid and r.external_source = ${route.externalSource} and r.id = ${route.id}::uuid and r.generation = ${route.generation} and r.status = 'active'`,
-            );
-      return Boolean(row);
-    },
-  );
-}

package/src/host-mcp-task-authority.ts

@@ -1,384 +0,0 @@
-import { sql } from "drizzle-orm";
-import {
-  stableJson,
-  ScheduledTaskRunAcceptedExecution,
-  type ScheduledTask,
-} from "@opengeni/contracts";
-import {
-  HostMcpAcceptedAuthority,
-  HostMcpTaskAuthority,
-  HostMcpBindingDefinition,
-  HostMcpOwnerSubject,
-  hostMcpBindingMatchesSelection,
-  type HostMcpBindingSelection,
-} from "@opengeni/contracts/host-mcp-bindings";
-import { getScheduledTaskRevisionAuthority } from "./scheduled-task-revision-authority";
-import { getHostMcpLiveAttempt } from "./live-session-attempt";
-import { rawRows, withWorkspaceSubjectRls, type Database } from "./database";
-import {
-  getHostMcpBinding,
-  getHostMcpDelegation,
-  HostMcpDelegationAuthorityError,
-  authorizeDirectHostMcpUse,
-  type HostMcpBindingOwner,
-} from "./host-mcp-bindings";
-
-export type SelectedHostMcpTaskGrant = {
-  delegationId: string;
-  generation: number;
-  bindingId: string;
-  bindingGeneration: number;
-  definition: HostMcpBindingDefinition;
-};
-
-/** Internal capture only. The API/core authenticates the external owner and
- * rechecks that proof in this same task-write transaction before calling. */
-export async function captureHostMcpTaskAuthorities(
-  db: Database,
-  owner: HostMcpBindingOwner,
-  task: ScheduledTask,
-  selections: SelectedHostMcpTaskGrant[],
-): Promise<void> {
-  if (task.accountId !== owner.accountId || task.workspaceId !== owner.workspaceId)
-    throw new HostMcpDelegationAuthorityError("Host task scope mismatch");
-  const proof = await getScheduledTaskRevisionAuthority(db, {
-    ...owner,
-    taskId: task.id,
-    taskAuthorityRevision: task.authorityRevision,
-  });
-  if (
-    !proof ||
-    proof.subjectId !== owner.subjectId ||
-    proof.membershipAuthorizationRevision !== owner.authorizationRevision
-  )
-    throw new HostMcpDelegationAuthorityError("Host task revision authority changed");
-  const target =
-    task.runMode === "existing_session" && task.targetSessionId
-      ? ((
-          await withWorkspaceSubjectRls(db, owner.workspaceId, owner.subjectId, (tx) =>
-            rawRows<{
-              id: string;
-              visibility: "user_private" | "workspace_shared";
-              authority_epoch: number;
-            }>(
-              tx,
-              sql`select id, visibility, authority_epoch from sessions where id = ${task.targetSessionId}::uuid
-            and workspace_id = ${owner.workspaceId}::uuid and account_id = ${owner.accountId}::uuid`,
-            ),
-          )
-        )[0] ?? null)
-      : null;
-  const context = target?.visibility ?? "workspace_shared";
-  await withWorkspaceSubjectRls(db, owner.workspaceId, owner.subjectId, async (tx) => {
-    for (const selection of selections) {
-      const delegation = await getHostMcpDelegation(tx, owner, selection.delegationId);
-      const binding = delegation ? await getHostMcpBinding(tx, owner, delegation.bindingId) : null;
-      const definition = HostMcpBindingDefinition.parse(selection.definition);
-      if (
-        !delegation ||
-        !binding ||
-        delegation.status !== "active" ||
-        binding.status !== "active" ||
-        delegation.generation !== selection.generation ||
-        binding.generation !== delegation.bindingGeneration ||
-        binding.id !== selection.bindingId ||
-        binding.generation !== selection.bindingGeneration ||
-        stableJson(binding.definition) !== stableJson(definition) ||
-        delegation.grant.context !== context ||
-        (delegation.grant.mode === "session" &&
-          (!target ||
-            delegation.grant.sessionId !== target.id ||
-            delegation.grant.expectedAuthorityEpoch !== target.authority_epoch))
-      )
-        throw new HostMcpDelegationAuthorityError("Host task delegation changed");
-      const authority = HostMcpTaskAuthority.parse({
-        version: 1,
-        accountId: owner.accountId,
-        workspaceId: owner.workspaceId,
-        taskId: task.id,
-        taskAuthorityRevision: task.authorityRevision,
-        taskExecutionDigest: task.executionDigest,
-        ownerSubjectId: owner.subjectId,
-        ownerOrganizationMembershipId: proof.organizationMembershipId,
-        ownerMembershipAuthorizationRevision: proof.membershipAuthorizationRevision,
-        bindingId: binding.id,
-        bindingGeneration: binding.generation,
-        delegationId: delegation.id,
-        delegationGeneration: delegation.generation,
-        definition,
-        context,
-      });
-      await tx.execute(sql`insert into host_mcp_task_authorities
-        (task_id, task_authority_revision, server_id, account_id, workspace_id, owner_subject_id, binding_id, delegation_id, canonical_snapshot)
-        values (${task.id}::uuid, ${task.authorityRevision}, ${definition.serverId}, ${owner.accountId}::uuid,
-          ${owner.workspaceId}::uuid, ${owner.subjectId}, ${binding.id}::uuid, ${delegation.id}::uuid,
-          ${JSON.stringify(authority)}::jsonb)`);
-    }
-  });
-}
-
-/** Backend-only read; native immutable task-revision proof chooses the owner.
- * No caller-supplied subject and no ambient workspace account enumeration. */
-export async function getHostMcpTaskAuthorities(
-  db: Database,
-  input: {
-    accountId: string;
-    workspaceId: string;
-    taskId: string;
-    taskAuthorityRevision: number;
-  },
-): Promise<HostMcpTaskAuthority[]> {
-  const proof = await getScheduledTaskRevisionAuthority(db, input);
-  if (!proof || !HostMcpOwnerSubject.safeParse(proof.subjectId).success) return [];
-  return withWorkspaceSubjectRls(db, input.workspaceId, proof.subjectId, async (tx) => {
-    const rows = await rawRows<{ canonical_snapshot: unknown }>(
-      tx,
-      sql`
-      select canonical_snapshot from host_mcp_task_authorities where task_id = ${input.taskId}::uuid
-        and task_authority_revision = ${input.taskAuthorityRevision} and account_id = ${input.accountId}::uuid
-        and workspace_id = ${input.workspaceId}::uuid and owner_subject_id = ${proof.subjectId}
-      order by server_id`,
-    );
-    return rows.map((row) => HostMcpTaskAuthority.parse(row.canonical_snapshot));
-  });
-}
-
-/** Native task revisions are the authority/version boundary, including ordinary
- * lifecycle edits. Never silently drop or reassign retained host selections. */
-export async function cloneHostMcpTaskAuthorities(
-  db: Database,
-  task: ScheduledTask,
-  sourceRevision: number,
-): Promise<void> {
-  if (sourceRevision === task.authorityRevision) return;
-  const previous = await getHostMcpTaskAuthorities(db, {
-    accountId: task.accountId,
-    workspaceId: task.workspaceId,
-    taskId: task.id,
-    taskAuthorityRevision: sourceRevision,
-  });
-  if (!previous.length) return;
-  const existing = await getHostMcpTaskAuthorities(db, {
-    accountId: task.accountId,
-    workspaceId: task.workspaceId,
-    taskId: task.id,
-    taskAuthorityRevision: task.authorityRevision,
-  });
-  if (existing.length) {
-    const selection = (a: HostMcpTaskAuthority) => ({
-      definition: a.definition,
-      bindingId: a.bindingId,
-      bindingGeneration: a.bindingGeneration,
-      delegationId: a.delegationId,
-      delegationGeneration: a.delegationGeneration,
-      ownerSubjectId: a.ownerSubjectId,
-      ownerMembershipAuthorizationRevision: a.ownerMembershipAuthorizationRevision,
-    });
-    if (stableJson(existing.map(selection)) !== stableJson(previous.map(selection)))
-      throw new HostMcpDelegationAuthorityError("Host task materialization selection changed");
-    return;
-  }
-  const owner = previous[0]!;
-  await captureHostMcpTaskAuthorities(
-    db,
-    {
-      accountId: owner.accountId,
-      workspaceId: owner.workspaceId,
-      subjectId: owner.ownerSubjectId,
-      authorizationRevision: owner.ownerMembershipAuthorizationRevision,
-    },
-    task,
-    previous.map((a) => ({
-      delegationId: a.delegationId,
-      generation: a.delegationGeneration,
-      bindingId: a.bindingId,
-      bindingGeneration: a.bindingGeneration,
-      definition: a.definition,
-    })),
-  );
-}
-
-/** Claim-time attachment to the exact accepted run. No host callback or key is
- * used here; credentials are requested only when the accepted attempt uses MCP. */
-export async function captureScheduledHostMcpTurnAuthorities(
-  db: Database,
-  input: {
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    turnId: string;
-    runId: string;
-  },
-): Promise<void> {
-  const [run] = await rawRows<{
-    accepted_execution_snapshot: unknown;
-    task_id: string;
-    task_authority_revision: string | number;
-    task_execution_digest: string;
-  }>(
-    db,
-    sql`
-    select accepted_execution_snapshot, task_id, task_authority_revision, task_execution_digest from scheduled_task_runs where id = ${input.runId}::uuid
-      and account_id = ${input.accountId}::uuid and workspace_id = ${input.workspaceId}::uuid
-      and session_id = ${input.sessionId}::uuid and status = 'dispatched'`,
-  );
-  if (!run) throw new HostMcpDelegationAuthorityError("Host scheduled run unavailable");
-  const accepted = ScheduledTaskRunAcceptedExecution.parse(run.accepted_execution_snapshot);
-  const authorities = await getHostMcpTaskAuthorities(db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    taskId: run.task_id,
-    taskAuthorityRevision: Number(run.task_authority_revision),
-  });
-  if (!authorities.length) return;
-  const subjectId = authorities[0]!.ownerSubjectId;
-  if (accepted.causalHumanSubjectId !== subjectId)
-    throw new HostMcpDelegationAuthorityError("Host scheduled causal human mismatch");
-  await withWorkspaceSubjectRls(db, input.workspaceId, subjectId, async (tx) => {
-    const [session] = await rawRows<{ visibility: string; authority_epoch: number }>(
-      tx,
-      sql`
-      select visibility, authority_epoch from sessions where id = ${input.sessionId}::uuid
-        and account_id = ${input.accountId}::uuid and workspace_id = ${input.workspaceId}::uuid`,
-    );
-    if (!session) throw new HostMcpDelegationAuthorityError("Host scheduled session unavailable");
-    for (const stored of authorities) {
-      const owner = {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        subjectId,
-        authorizationRevision: stored.ownerMembershipAuthorizationRevision,
-      };
-      const grant = await getHostMcpDelegation(tx, owner, stored.delegationId);
-      const binding = await getHostMcpBinding(tx, owner, stored.bindingId);
-      if (
-        !grant ||
-        !binding ||
-        grant.status !== "active" ||
-        binding.status !== "active" ||
-        grant.generation !== stored.delegationGeneration ||
-        binding.generation !== stored.bindingGeneration
-      )
-        continue;
-      const { taskId, taskAuthorityRevision, taskExecutionDigest, context, ...base } = stored;
-      if (taskExecutionDigest !== run.task_execution_digest || context !== session.visibility)
-        throw new HostMcpDelegationAuthorityError("Host scheduled execution changed");
-      const scheduledOrigin = { taskId, taskAuthorityRevision, runId: input.runId };
-      const authority = HostMcpAcceptedAuthority.parse({
-        ...base,
-        targetSessionId: input.sessionId,
-        targetSessionVisibility: session.visibility,
-        targetSessionAuthorityEpoch: session.authority_epoch,
-        acceptedWork: { kind: "scheduled_task", ...scheduledOrigin },
-        scheduledOrigin,
-        source: { kind: "scheduled_task" },
-      });
-      await tx.execute(sql`insert into host_mcp_turn_authorities
-        (turn_id, server_id, account_id, workspace_id, session_id, owner_subject_id, binding_id, delegation_id, canonical_snapshot)
-        values (${input.turnId}::uuid, ${stored.definition.serverId}, ${input.accountId}::uuid,
-          ${input.workspaceId}::uuid, ${input.sessionId}::uuid, ${subjectId}, ${stored.bindingId}::uuid,
-          ${stored.delegationId}::uuid, ${JSON.stringify(authority)}::jsonb)`);
-    }
-  });
-}
-
-/** Agent-created task: derive selections exclusively from its live accepted
- * attempt, then re-admit only native successor-eligible grants. No user lookup
- * or connection inventory is a fallback for a turn with no captured authority. */
-export async function inheritHostMcpTaskAuthoritiesFromAttempt(
-  db: Database,
-  task: ScheduledTask,
-  source: { sessionId: string; turnId: string; attemptId: string; executionGeneration: number },
-  configured: HostMcpBindingSelection[],
-): Promise<void> {
-  const proof = await getScheduledTaskRevisionAuthority(db, {
-    accountId: task.accountId,
-    workspaceId: task.workspaceId,
-    taskId: task.id,
-    taskAuthorityRevision: task.authorityRevision,
-  });
-  if (!proof || !HostMcpOwnerSubject.safeParse(proof.subjectId).success) return;
-  const current = await getHostMcpLiveAttempt(
-    db,
-    task.workspaceId,
-    source.sessionId,
-    source.attemptId,
-  );
-  if (
-    !current ||
-    current.id !== source.turnId ||
-    current.executionGeneration !== source.executionGeneration
-  )
-    throw new HostMcpDelegationAuthorityError("Host task source attempt changed");
-  const owner = {
-    accountId: task.accountId,
-    workspaceId: task.workspaceId,
-    subjectId: proof.subjectId,
-    authorizationRevision: proof.membershipAuthorizationRevision,
-  };
-  const selections = await withWorkspaceSubjectRls(
-    db,
-    task.workspaceId,
-    proof.subjectId,
-    async (tx) => {
-      const rows = await rawRows<{ canonical_snapshot: unknown }>(
-        tx,
-        sql`
-      select canonical_snapshot from host_mcp_turn_authorities where account_id = ${task.accountId}::uuid
-        and workspace_id = ${task.workspaceId}::uuid and session_id = ${source.sessionId}::uuid
-        and turn_id = ${source.turnId}::uuid and owner_subject_id = ${proof.subjectId}`,
-      );
-      const selected: SelectedHostMcpTaskGrant[] = [];
-      for (const row of rows) {
-        const a = HostMcpAcceptedAuthority.parse(row.canonical_snapshot);
-        const server = configured.find((c) => c.serverId === a.definition.serverId);
-        if (!server) continue;
-        if (
-          !hostMcpBindingMatchesSelection(
-            { id: a.bindingId, generation: a.bindingGeneration, definition: a.definition },
-            server,
-          )
-        )
-          throw new HostMcpDelegationAuthorityError("Host task source destination changed");
-        const delegation = await getHostMcpDelegation(tx, owner, a.delegationId);
-        if (
-          !delegation ||
-          (delegation.grant.mode === "session" &&
-            (task.runMode !== "existing_session" ||
-              task.targetSessionId !== delegation.grant.sessionId))
-        )
-          continue;
-        const authorized = await authorizeDirectHostMcpUse(tx, {
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          sessionId: source.sessionId,
-          rootSessionId: source.sessionId,
-          turnId: source.turnId,
-          attemptId: source.attemptId,
-          executionGeneration: source.executionGeneration,
-          initiator: current.initiator,
-          initiatorContext: current.initiatorContext,
-          surface: "model",
-          serverId: a.definition.serverId,
-          destinationUrl: a.definition.destinationUrl,
-          credentialTarget: "mcp",
-          forceRefresh: false,
-          connectionRef: {
-            ...a.definition.connectionRef,
-            hostBinding: { bindingId: a.bindingId, generation: a.bindingGeneration },
-          },
-        });
-        if (!authorized) continue;
-        selected.push({
-          delegationId: a.delegationId,
-          generation: a.delegationGeneration,
-          bindingId: a.bindingId,
-          bindingGeneration: a.bindingGeneration,
-          definition: a.definition,
-        });
-      }
-      return selected;
-    },
-  );
-  if (selections.length) await captureHostMcpTaskAuthorities(db, owner, task, selections);
-}

package/src/host-selection-identity.ts

@@ -1,29 +0,0 @@
-import {
-  HostMcpCreateSelections as selections,
-  type HostMcpCreateSelection,
-} from "@opengeni/contracts/host-mcp-bindings";
-export type { HostMcpCreateSelection } from "@opengeni/contracts/host-mcp-bindings";
-const key = "_opengeni_session_create_host_delegations_v1";
-
-/** Replay identity only: neither grant admission nor credential authority. */
-export function normalizeHostCreateSelection(value: unknown): HostMcpCreateSelection[] {
-  return selections
-    .parse(value ?? [])
-    .sort((a, b) => (a.serverId < b.serverId ? -1 : a.serverId > b.serverId ? 1 : 0));
-}
-export function metadataWithHostCreateSelection(
-  metadata: Record<string, unknown>,
-  value: unknown,
-): Record<string, unknown> {
-  const next = { ...metadata };
-  delete next[key];
-  const canonical = normalizeHostCreateSelection(value);
-  if (canonical.length) next[key] = canonical;
-  return next;
-}
-export function hostCreateSelectionFromMetadata(
-  metadata: Record<string, unknown>,
-): HostMcpCreateSelection[] {
-  // A malformed stored identity fails closed; it must not become an empty grant.
-  return normalizeHostCreateSelection(metadata[key]);
-}