@opengeni/api-router 0.12.7 → 0.14.3

package/dist/app.d.ts

@@ -1,43 +1,23 @@
-import { SessionEvent, ErrorCode } from '@opengeni/contracts';
-import { Hono } from 'hono';
-import { AppDependencies } from '@opengeni/core';
-export { ApiRouteDeps, AppDependencies, DocumentIndexClient, ObjectStorageDependency, SessionWorkflowClient, mergeResourceRefs, mergeToolRefs, normalizeResources, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateToolRefs, withDefaultEnabledCapabilityMcpTools, workflowIdForSession } from '@opengeni/core';
-import { Database } from '@opengeni/db';
-import { EventBus } from '@opengeni/events';
-import { Observability } from '@opengeni/observability';
-
-type SseDeliveryBoundObservation = {
-    reason: "desired_size_non_positive" | "stall_timeout" | "frame_too_large";
-    desiredSize: number | null;
-    queuedFrames: number;
-    queuedBytes: number;
-};
-declare function sseSessionStream(db: Database, bus: EventBus, workspaceId: string, sessionId: string, after: number, signal: AbortSignal, options?: SessionSseDeliveryOptions): Promise<Response>;
-declare function replaySessionEvents(loadPage: (after: number, limit: number) => Promise<SessionEvent[]>, send: (event: SessionEvent) => Promise<void>, after: number, pageSize?: number): Promise<void>;
-declare function sseWorkspaceControlStream(db: Database, bus: EventBus, workspaceId: string, after: number, signal: AbortSignal, options?: SseDeliveryOptions): Promise<Response>;
-type SseDeliveryOptions = {
-    maxQueuedBytes?: number;
-    stallTimeoutMs?: number;
-    observability?: Observability | undefined;
-    onObservation?: ((observation: SseDeliveryBoundObservation) => void) | undefined;
-};
-type SessionSseDeliveryOptions = SseDeliveryOptions & {
-    /** Host ACL re-check, run even while the event stream is otherwise idle. */
-    reauthorize?: (() => Promise<void>) | undefined;
-    reauthorizeAfterMs?: number | undefined;
-};
-
-declare const API_MAX_REQUEST_BODY_BYTES: number;
-declare function createApp(deps: AppDependencies): Hono;
-declare function allowedCorsOrigin(pattern: string, origin: string): boolean;
-declare function httpStatusForError(error: unknown): number;
-declare function errorCodeForStatus(status: number): ErrorCode;
-declare function routeLabel(pathname: string): string;
+import { type ErrorCode } from "@opengeni/contracts";
+import { Hono } from "hono";
+import type { AppDependencies } from "@opengeni/core";
+export type { ApiRouteDeps, AppDependencies, DocumentIndexClient, ObjectStorageDependency, SessionWorkflowClient, } from "@opengeni/core";
+export { mergeResourceRefs, mergeToolRefs, normalizeResources, validateFileResources, validateGitHubRepositorySelection, validateGitHubRepositorySelectionShape, validateGitHubRepositorySelectionShapes, validateToolRefs, withDefaultEnabledCapabilityMcpTools, } from "@opengeni/core";
+export { workflowIdForSession } from "@opengeni/core";
+export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
+export declare const API_MAX_REQUEST_BODY_BYTES: number;
+/** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
+export declare function apiRequestBodyLimitBytes(settings: {
+    voiceInputMaxSizeBytes: number;
+}): number;
+export declare function createApp(deps: AppDependencies): Hono;
+export declare function allowedCorsOrigin(pattern: string, origin: string): boolean;
+export declare function httpStatusForError(error: unknown): number;
+export declare function errorCodeForStatus(status: number): ErrorCode;
+export declare function routeLabel(pathname: string): string;
 /**
  * State-changing OpenGeni HTTP calls must never cross an incompatible rollout
  * boundary. Standard third-party protocols and externally initiated callbacks
  * are intentionally outside this product API contract.
  */
-declare function isApiContractProtectedMutation(method: string, pathname: string): boolean;
-
-export { API_MAX_REQUEST_BODY_BYTES, allowedCorsOrigin, createApp, errorCodeForStatus, httpStatusForError, isApiContractProtectedMutation, replaySessionEvents, routeLabel, sseSessionStream, sseWorkspaceControlStream };
+export declare function isApiContractProtectedMutation(method: string, pathname: string): boolean;

package/dist/app.js

@@ -1,6 +1,7 @@
 import {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,
+  apiRequestBodyLimitBytes,
   createApp,
   errorCodeForStatus,
   httpStatusForError,
@@ -19,10 +20,11 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-SD5GJTZ4.js";
+} from "./chunk-36PW33ND.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,
+  apiRequestBodyLimitBytes,
   createApp,
   errorCodeForStatus,
   httpStatusForError,

package/dist/auth/managed-auth.d.ts

@@ -0,0 +1,35 @@
+import type { Settings } from "@opengeni/config";
+import { type ManagedAuth } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+export type { ManagedAuth };
+export declare function createManagedAuth(settings: Settings, db: Database): ManagedAuth | null;
+export declare function managedSessionAccessContext(auth: ManagedAuth, db: Database, headers: Headers): Promise<{
+    mode: "configured" | "local" | "managed";
+    subjectId: string;
+    subjectLabel?: string | undefined;
+    accountGrants: {
+        accountId: string;
+        subjectId: string;
+        subjectLabel?: string | undefined;
+        role?: "admin" | "member" | "owner" | undefined;
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "billing:manage" | "billing:read" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "toolspace:call" | "variable-sets:manage" | "variable-sets:use" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        metadata?: Record<string, unknown> | undefined;
+    }[];
+    workspaceGrants: {
+        workspaceId: string;
+        accountId: string;
+        subjectId: string;
+        subjectLabel?: string | undefined;
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "billing:manage" | "billing:read" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "toolspace:call" | "variable-sets:manage" | "variable-sets:use" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        principalKind?: "agent_attempt" | "api_key" | "configured_key" | "human_session" | "service" | undefined;
+        metadata?: Record<string, unknown> | undefined;
+        serviceInitiator?: {
+            kind: "service";
+            subjectId: string;
+            label?: string | undefined;
+        } | undefined;
+        serviceInitiatorContext?: Record<string, unknown> | undefined;
+    }[];
+    defaultAccountId: string | null;
+    defaultWorkspaceId: string | null;
+} | null>;