@opengeni/api-router 0.11.1 → 0.11.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "./chunk-7PQKPKW5.js";
+} from "./chunk-BFWSDESE.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,17 +44,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.0",
+    "@opengeni/config": "^0.7.1",
     "@opengeni/contracts": "^0.19.0",
-    "@opengeni/core": "^0.11.1",
-    "@opengeni/db": "^0.12.0",
-    "@opengeni/documents": "^0.2.30",
-    "@opengeni/events": "^0.3.21",
-    "@opengeni/github": "^0.3.12",
+    "@opengeni/core": "^0.11.2",
+    "@opengeni/db": "^0.12.1",
+    "@opengeni/documents": "^0.2.31",
+    "@opengeni/events": "^0.3.22",
+    "@opengeni/github": "^0.3.13",
     "@opengeni/network": "^0.1.1",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.13.3",
-    "@opengeni/storage": "^0.2.24",
+    "@opengeni/runtime": "^0.13.4",
+    "@opengeni/storage": "^0.2.25",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/routes/install.ts

@@ -144,6 +144,7 @@ const VERSION_SEG = /^v[A-Za-z0-9][A-Za-z0-9._-]*$/;
 
 export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
   const releasesBase = deps.settings.agentReleasesBaseUrl.replace(/\/+$/, "");
+  const stableAgentTag = `agent-v${deps.settings.agentStableVersion}`;
 
   for (const [path, { file, contentType }] of Object.entries(TEXT_ASSETS)) {
     app.get(path, async (c) => {
@@ -185,20 +186,18 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
     return new Response(null, { status: 302, headers: { location: redirectUrl } });
   }
 
-  // `latest` → the BAKED binary if present, else the dedicated moving
-  // `agent-latest` GitHub Release. We deliberately do NOT use GitHub's
-  // repo-global `releases/latest` alias here: in this monorepo that alias is
-  // perpetually shadowed by the frequent changesets package releases (e.g.
-  // `@opengeni/contracts@x.y.z`), which carry no agent binaries → 404. The
-  // `agent-latest` release is maintained by .github/workflows/agent-release.yml
-  // as a moving tag that always points at the newest signed mac/windows
-  // binaries (+ checksums, install scripts, minisign pubkey).
+  // `latest` → the BAKED binary if present, else the operator-selected immutable
+  // `agent-v<version>` release. We deliberately do NOT use GitHub's repo-global
+  // `releases/latest` alias here: in this monorepo that alias is shadowed by
+  // frequent changesets package releases, which carry no agent binaries. The
+  // explicit stable-version setting also makes promotion and rollback auditable
+  // without moving or deleting a provider tag.
   app.get("/agent/latest/:asset", async (c) => {
     const asset = c.req.param("asset");
     if (!ASSET_NAME.test(asset)) {
       throw new HTTPException(400, { message: "invalid asset name" });
     }
-    return serveAsset(asset, `${releasesBase}/download/agent-latest/${asset}`);
+    return serveAsset(asset, `${releasesBase}/download/${stableAgentTag}/${asset}`);
   });
 
   // The version segment is the literal `v<ver>` (e.g. `v1.2.3`) — Hono cannot bind