@opengeni/api-router 0.12.7 → 0.14.3

package/dist/transcription/providers/openai.d.ts

@@ -0,0 +1,9 @@
+import { type TranscriptionProvider, TranscriptionServiceError } from "@opengeni/core";
+export declare function createOpenAiTranscriptionProvider(input: {
+    apiKey: string;
+    baseUrl: string;
+    model: string;
+    fetch?: typeof fetch;
+}): TranscriptionProvider;
+export declare function responseError(status: number): TranscriptionServiceError;
+export declare function fetchError(error: unknown): TranscriptionServiceError;

package/dist/transcription/service.d.ts

@@ -0,0 +1,10 @@
+import { type Settings } from "@opengeni/config";
+import { type TranscriptionAvailabilityContext, type TranscriptionService } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+export declare function createTranscriptionService(input: {
+    settings: Settings;
+    db: Database;
+    fetch?: typeof fetch;
+    codexFetch?: typeof fetch;
+    probeCodex?: (context?: TranscriptionAvailabilityContext) => boolean | Promise<boolean>;
+}): TranscriptionService;

package/dist/workspace-state-projection.d.ts

@@ -0,0 +1,16 @@
+import { type WorkspaceInstructionPolicyListResponse, type WorkspaceStateResponse as WorkspaceStateResponseType } from "@opengeni/contracts";
+import type { WorkspaceStateMemoryRecord } from "@opengeni/db";
+import type { DocumentInventory } from "@opengeni/documents";
+type KnowledgeProjectionInput = {
+    documents: DocumentInventory;
+    memories: WorkspaceStateMemoryRecord[];
+};
+export type WorkspaceStateProjectionInput = {
+    workspaceId: string;
+    generatedAt: string;
+    workspaceAgentInstructions: string | null;
+    policies: WorkspaceInstructionPolicyListResponse;
+    knowledge: KnowledgeProjectionInput | null;
+};
+export declare function projectWorkspaceState(input: WorkspaceStateProjectionInput): WorkspaceStateResponseType;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.12.7",
+  "version": "0.14.3",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -33,8 +33,8 @@
   "scripts": {
     "dev": "bun --watch src/index.ts",
     "start": "bun src/index.ts",
-    "typecheck": "tsgo --noEmit",
-    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "build": "bun ../../scripts/build-typescript-package.ts",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
@@ -43,18 +43,18 @@
     "@hono/zod-validator": "^0.7.6",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
-    "@opengeni/codex": "^0.2.7",
-    "@opengeni/config": "^0.7.11",
-    "@opengeni/contracts": "^0.22.0",
-    "@opengeni/core": "^0.12.7",
-    "@opengeni/db": "^0.14.0",
-    "@opengeni/documents": "^0.2.42",
-    "@opengeni/events": "^0.3.33",
-    "@opengeni/github": "^0.3.23",
+    "@opengeni/codex": "^0.2.9",
+    "@opengeni/config": "^0.7.22",
+    "@opengeni/contracts": "^0.26.1",
+    "@opengeni/core": "^0.14.3",
+    "@opengeni/db": "^0.16.2",
+    "@opengeni/documents": "^0.2.59",
+    "@opengeni/events": "^0.3.50",
+    "@opengeni/github": "^0.4.9",
     "@opengeni/network": "^0.1.1",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.14.1",
-    "@opengeni/storage": "^0.2.35",
+    "@opengeni/runtime": "^0.14.15",
+    "@opengeni/storage": "^0.2.46",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -12,6 +12,7 @@ import {
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
   resolveWorkspaceMemoryEnabled,
+  VOICE_INPUT_ACCEPTED_MIME_TYPES,
   type AccessGrant,
   type ErrorCode,
 } from "@opengeni/contracts";
@@ -31,6 +32,7 @@ import { HTTPException } from "hono/http-exception";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
+  CodexCompactionV2ProviderLockedError,
   hasPermission,
   requireAccessGrant,
   requirePermission,
@@ -65,7 +67,12 @@ import { registerSessionRoutes } from "./routes/sessions";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
+import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
+import { registerPreferenceRegistryRoutes } from "./routes/preference-registry";
+import { registerInsightsRoutes } from "./routes/insights";
+import { registerTranscriptionRoutes } from "./routes/transcriptions";
 import { projectClientModel } from "./model-catalog";
+import { createTranscriptionService } from "./transcription/service";
 
 export type {
   ApiRouteDeps,
@@ -89,6 +96,11 @@ export { workflowIdForSession } from "@opengeni/core";
 export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
 
 export const API_MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
+
+/** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
+export function apiRequestBodyLimitBytes(settings: { voiceInputMaxSizeBytes: number }): number {
+  return Math.max(API_MAX_REQUEST_BODY_BYTES, settings.voiceInputMaxSizeBytes + 64 * 1024);
+}
 const API_PUBLIC_ERROR_MESSAGE_MAX_BYTES = 512;
 
 export function createApp(deps: AppDependencies): Hono {
@@ -142,6 +154,14 @@ export function createApp(deps: AppDependencies): Hono {
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
   const observability =
     deps.observability ?? createObservability(deps.settings, { component: "api" });
+  const transcription =
+    deps.transcription === undefined
+      ? createTranscriptionService({
+          settings: deps.settings,
+          db: deps.db,
+          ...(deps.codexFetch ? { codexFetch: deps.codexFetch } : {}),
+        })
+      : deps.transcription;
   const routeDeps: ApiRouteDeps = {
     ...deps,
     observability,
@@ -151,6 +171,7 @@ export function createApp(deps: AppDependencies): Hono {
     objectStorage,
     documentIndexer,
     getDocumentServices,
+    transcription,
     ...(sandboxClient ? { sandboxClient } : {}),
     resumeBoxById,
   };
@@ -191,7 +212,7 @@ export function createApp(deps: AppDependencies): Hono {
   app.use(
     "*",
     bodyLimit({
-      maxSize: API_MAX_REQUEST_BODY_BYTES,
+      maxSize: apiRequestBodyLimitBytes(deps.settings),
       onError: (c) =>
         c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413),
     }),
@@ -321,7 +342,7 @@ export function createApp(deps: AppDependencies): Hono {
     }),
   );
 
-  app.get("/v1/config/client", (c) => {
+  app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
     const catalogSettings = deps.settings.codexSubscriptionEnabled
       ? withCodexCatalogProvider(deps.settings)
@@ -348,6 +369,12 @@ export function createApp(deps: AppDependencies): Hono {
           enabled: objectStorage !== null,
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5_000_000_000,
         },
+        voiceInput: {
+          available: (await transcription?.available()) ?? false,
+          maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
+          maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
+          acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES],
+        },
         productAccessMode: deps.settings.productAccessMode,
         auth: clientAuthConfig(deps.settings),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
@@ -428,7 +455,10 @@ export function createApp(deps: AppDependencies): Hono {
   registerGitHubRoutes(app, routeDeps);
   registerInstallRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
+  registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
+  registerWorkspaceStateRoutes(app, routeDeps);
+  registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
@@ -441,6 +471,7 @@ export function createApp(deps: AppDependencies): Hono {
   registerSessionRoutes(app, routeDeps);
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
+  registerTranscriptionRoutes(app, routeDeps);
 
   app.notFound((c) => {
     if (!new URL(c.req.url).pathname.startsWith("/v1/")) return c.text("Not Found", 404);
@@ -460,8 +491,9 @@ export function createApp(deps: AppDependencies): Hono {
   });
 
   app.onError((error, c) => {
-    const status = httpStatusForError(error);
-    const code = errorCodeForStatus(status);
+    const compactionLock = codexCompactionV2ProviderLockedError(error);
+    const status = compactionLock ? 422 : httpStatusForError(error);
+    const code: ErrorCode = compactionLock ? compactionLock.code : errorCodeForStatus(status);
     const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
     c.header(OPENGENI_CORRELATION_HEADER, requestId);
     if (new URL(c.req.url).pathname.startsWith("/v1/")) {
@@ -471,7 +503,9 @@ export function createApp(deps: AppDependencies): Hono {
       error: {
         status,
         code,
-        message: publicErrorMessage(error, status),
+        message: compactionLock
+          ? (boundedPublicMessage(compactionLock.message) ?? "Request failed.")
+          : publicErrorMessage(error, status),
         retryable: retryableHttpStatus(status),
         requestId,
       },
@@ -494,6 +528,13 @@ async function requireMcpAccessGrant(
   if (isToolspaceGrant(deps.settings, grant)) {
     return grant;
   }
+  // A worker-signed session-bound grant is allowed to reach the transport
+  // without inheriting broad workspace read access. The exact session
+  // authorization seam runs immediately after this gate, and tool registration
+  // still exposes only capabilities permitted by the delegated grant.
+  if (grant.metadata?.delegated === true && typeof grant.metadata.sessionId === "string") {
+    return grant;
+  }
   requirePermission(grant, "workspace:read");
   return grant;
 }
@@ -531,7 +572,23 @@ export function allowedCorsOrigin(pattern: string, origin: string): boolean {
   return new RegExp(`^(?:${pattern})$`).test(origin);
 }
 
+function codexCompactionV2ProviderLockedError(
+  error: unknown,
+): CodexCompactionV2ProviderLockedError | null {
+  if (error instanceof CodexCompactionV2ProviderLockedError) return error;
+  if (
+    error instanceof HTTPException &&
+    error.cause instanceof CodexCompactionV2ProviderLockedError
+  ) {
+    return error.cause;
+  }
+  return null;
+}
+
 export function httpStatusForError(error: unknown): number {
+  if (codexCompactionV2ProviderLockedError(error)) {
+    return 422;
+  }
   if (error instanceof HTTPException) {
     return error.status;
   }
@@ -543,6 +600,7 @@ export function httpStatusForError(error: unknown): number {
 
 export function errorCodeForStatus(status: number): ErrorCode {
   if (status === 401) return "unauthenticated";
+  if (status === 402) return "payment_required";
   if (status === 403) return "forbidden";
   if (status === 404) return "not_found";
   if (status === 409) return "conflict";
@@ -691,6 +749,10 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
   { pattern: /^\/v1\/billing$/, label: "/v1/billing" },
   { pattern: /^\/v1\/billing\/checkout$/, label: "/v1/billing/checkout" },
   { pattern: /^\/v1\/billing\/usage$/, label: "/v1/billing/usage" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/insights$/,
+    label: "/v1/workspaces/:workspaceId/insights",
+  },
   {
     pattern: /^\/v1\/billing\/entitlements$/,
     label: "/v1/billing/entitlements",
@@ -888,6 +950,14 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/connect$/,
     label: "/v1/workspaces/:workspaceId/github/connect",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations\/select$/,
+    label: "/v1/workspaces/:workspaceId/github/installations/select",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations\/[^/]+\/configure$/,
+    label: "/v1/workspaces/:workspaceId/github/installations/:installationId/configure",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/github\/installations$/,
     label: "/v1/workspaces/:workspaceId/github/installations",

package/src/github-access.ts

@@ -64,6 +64,7 @@ export async function listWorkspaceGitHubInstallationBindings(
     ),
     repositoryScope: installation.repositoryScope,
     repositoryCount: installation.repositoryIds.length,
+    configureUrl: null,
     createdAt: installation.createdAt,
     updatedAt: installation.updatedAt,
   }));