@opengeni/api-router 0.22.2 → 0.23.1

package/src/mcp/toolspace.ts

@@ -51,7 +51,6 @@ import {
   type McpRequestReplayInfo,
 } from "@opengeni/runtime/mcp-network";
 import { Buffer } from "node:buffer";
-import { createHash } from "node:crypto";
 
 export type ToolspaceCallResult = CallToolResult;
 
@@ -399,10 +398,10 @@ async function resolveToolListing(input: {
       turn: activeTurn,
       personalConnectionDelegations,
     }).catch((error) => {
-      deps.observability?.warn("toolspace upstream connection failed", {
-        serverId,
-        ...toolspaceErrorAttributes(error),
-      });
+      deps.observability?.warn(
+        "toolspace upstream connection failed",
+        toolspacePublicErrorFields(error),
+      );
       return null;
     });
     if (!connection) {
@@ -413,20 +412,20 @@ async function resolveToolListing(input: {
       const listed = await connection.client
         .listTools(undefined, toolspaceRequestOptions(config))
         .catch((error) => {
-          deps.observability?.warn("toolspace upstream tool list failed", {
-            serverId,
-            ...toolspaceErrorAttributes(error),
-          });
+          deps.observability?.warn(
+            "toolspace upstream tool list failed",
+            toolspacePublicErrorFields(error),
+          );
           return { tools: [] };
         });
       let boundedTools: readonly McpTool[];
       try {
         boundedTools = assertMcpToolListWithinBounds(listed.tools as McpTool[]) as McpTool[];
       } catch (error) {
-        deps.observability?.warn("toolspace upstream tool list exceeded safety limit", {
-          serverId,
-          errorClass: error instanceof Error ? error.name : typeof error,
-        });
+        deps.observability?.warn(
+          "toolspace upstream tool list exceeded safety limit",
+          toolspacePublicErrorFields(error, "tool_list_too_large"),
+        );
         aggregateBudget.replace(serverId, []);
         return;
       }
@@ -629,17 +628,19 @@ function toolspaceToolFor(input: {
       if (mcpToolRequiresApproval(config.requireApproval, tool.name)) {
         return mcpError(APPROVAL_REQUIRED_MESSAGE);
       }
-      const connection = await connectToolspaceServer({
-        deps,
-        grant,
-        config,
-        sessionId,
-        rootSessionId,
-        turn: reservation.turn,
-        personalConnectionDelegations,
-      }).catch(() => null);
-      if (!connection) {
-        return mcpError(`upstream tool failed: ${name}`);
+      let connection: ConnectedToolspaceServer;
+      try {
+        connection = await connectToolspaceServer({
+          deps,
+          grant,
+          config,
+          sessionId,
+          rootSessionId,
+          turn: reservation.turn,
+          personalConnectionDelegations,
+        });
+      } catch (error) {
+        return mcpError(exactErrorMessage(error));
       }
       try {
         const callId = crypto.randomUUID();
@@ -659,7 +660,7 @@ function toolspaceToolFor(input: {
             type: "toolspace_call",
             id: callId,
             name,
-            arguments: toolspaceAuditSummary(args),
+            arguments: args,
             serverId,
             toolName: tool.name,
           },
@@ -718,7 +719,7 @@ function toolspaceToolFor(input: {
               producerId: grant.subjectId,
               payload: {
                 id: callId,
-                output: toolspaceAuditSummary(output),
+                output,
                 origin: "toolspace",
                 subjectId: grant.subjectId,
               },
@@ -755,11 +756,10 @@ async function callRemoteTool(
     return output;
   } catch (error) {
     if (error instanceof McpPayloadTooLargeError) {
-      deps.observability?.warn("toolspace upstream tool result exceeded safety limit", {
-        serverId: server.config.id,
-        toolName,
-        errorClass: error.name,
-      });
+      deps.observability?.warn(
+        "toolspace upstream tool result exceeded safety limit",
+        toolspacePublicErrorFields(error, "tool_result_too_large"),
+      );
       return mcpError("upstream tool result exceeded the safety limit");
     }
     if (isToolspaceAuthNeededError(error)) {
@@ -768,52 +768,56 @@ async function callRemoteTool(
     if (isToolspaceOutcomeUncertainError(error)) {
       return mcpError(TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message);
     }
-    // The raw upstream error can carry provider-specific detail; log it
-    // server-side and return only a generic result to the sandbox so no header
-    // or credential material can ride the message back out.
-    deps.observability?.warn("toolspace upstream tool call failed", {
-      serverId: server.config.id,
-      toolName,
-      error: error instanceof Error ? error.message : String(error),
-    });
-    return mcpError(`upstream tool failed: ${prefixedMcpToolName(server.config.id, toolName)}`);
+    const message = exactErrorMessage(error);
+    // The exact provider diagnostic remains the internal/model-facing tool
+    // result. Public observability receives only allowlisted metadata.
+    deps.observability?.warn(
+      "toolspace upstream tool call failed",
+      toolspacePublicErrorFields(error),
+    );
+    return mcpError(message);
   }
 }
 
-function toolspaceAuditSummary(value: unknown): {
-  redacted: true;
-  sizeBytes: number;
-  sha256: string;
-} {
-  let serialized: string;
-  try {
-    serialized = JSON.stringify(value) ?? "null";
-  } catch {
-    serialized = "[unserializable]";
-  }
-  return {
-    redacted: true,
-    sizeBytes: Buffer.byteLength(serialized),
-    sha256: createHash("sha256").update(serialized).digest("hex"),
-  };
+function exactErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
 }
 
-function toolspaceErrorAttributes(error: unknown): {
-  errorClass: string;
-  errorCode?: string;
-  errorMessage?: string;
-} {
-  if (!(error instanceof Error)) {
-    return { errorClass: typeof error };
-  }
-  const code = (error as Error & { code?: unknown }).code;
-  return {
-    errorClass: error.name,
-    ...(typeof code === "string" ? { errorCode: code } : {}),
-    ...(error.message
-      ? { errorMessage: error.message.replaceAll(/[\r\n]+/gu, " ").slice(0, 512) }
-      : {}),
+export type ToolspacePublicErrorFields = {
+  errorClass: "ToolspaceOperationError";
+  errorCode: ToolspacePublicFailureCode;
+  status?: number;
+  origin: "toolspace";
+};
+
+type ToolspacePublicFailureCode =
+  | "toolspace_operation_failed"
+  | "tool_list_too_large"
+  | "tool_result_too_large";
+
+/** Allowlisted projection for public telemetry; product data stays exact. */
+export function toolspacePublicErrorFields(
+  error: unknown,
+  errorCode: ToolspacePublicFailureCode = "toolspace_operation_failed",
+): ToolspacePublicErrorFields {
+  const fields: ToolspacePublicErrorFields = {
+    errorClass: "ToolspaceOperationError",
+    errorCode,
+    origin: "toolspace",
   };
+  try {
+    const rawStatus =
+      error && typeof error === "object"
+        ? ((error as { status?: unknown; statusCode?: unknown }).status ??
+          (error as { statusCode?: unknown }).statusCode)
+        : undefined;
+    const status = Number(rawStatus);
+    if (Number.isInteger(status) && status >= 100 && status <= 599) fields.status = status;
+  } catch {
+    // Public telemetry is best-effort. A hostile getter/proxy must never
+    // replace the exact Toolspace failure with a projection failure.
+  }
+  return fields;
 }
 
 type ToolspaceReservation =

package/src/observability.ts

@@ -12,11 +12,11 @@ function eventAttributes(attributes: Record<string, unknown> | undefined): Attri
   if (!attributes) {
     return undefined;
   }
-  const sanitized: Attributes = {};
+  const projected: Attributes = {};
   for (const [key, value] of Object.entries(attributes)) {
-    sanitized[key] = eventAttributeValue(value);
+    projected[key] = eventAttributeValue(value);
   }
-  return sanitized;
+  return projected;
 }
 
 function eventAttributeValue(value: unknown): AttributeValue {

package/src/routes/api-keys.ts

@@ -54,7 +54,13 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
 
 function ensureDelegablePermissions(grantPermissions: Permission[], requested: Permission[]): void {
   if (grantPermissions.includes("workspace:admin")) {
-    return;
+    const highTrustMissing = requested.filter(
+      (permission) => permission === "secrets:read" && !grantPermissions.includes("secrets:read"),
+    );
+    if (highTrustMissing.length === 0) return;
+    throw new HTTPException(403, {
+      message: `cannot delegate missing literal permissions: ${highTrustMissing.join(", ")}`,
+    });
   }
   const missing = requested.filter((permission) => !grantPermissions.includes(permission));
   if (missing.length > 0) {

package/src/routes/codex.ts

@@ -150,7 +150,12 @@ export function codexModelsForPicker(liveSlugs: readonly string[]): Array<{
   }));
 }
 import { createSignedState, readSignedState } from "@opengeni/github";
-import { hasPermission, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  getManagedSession,
+  hasPermission,
+  requireAccessGrant,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import * as z from "zod/v4";
@@ -190,9 +195,7 @@ async function managedCookieHuman(
   ) {
     return null;
   }
-  const session = await deps.managedAuth.api.getSession({
-    headers: c.req.raw.headers,
-  });
+  const session = await getManagedSession(c, deps.managedAuth);
   if (!session?.user?.id || !session.session?.id) return null;
   return {
     subjectId: `user:${session.user.id}`,

package/src/routes/connections.ts

@@ -10,6 +10,10 @@ import {
   OAuthStartResponse,
   UpdateConnectionRequest,
 } from "@opengeni/contracts";
+import {
+  bindConnectorDocumentDestination,
+  ConnectorDocumentDestinationSelection,
+} from "@opengeni/contracts/connector-destinations";
 import {
   GOOGLE_DRIVE_PROVIDER_DOMAIN,
   GoogleDriveConnectionMetadata,
@@ -41,6 +45,7 @@ import {
   SlackBotLifecycleSuccessAuditError,
   updateConnection,
   updateConnectionWithSlackBotSuccessAudit,
+  updateSlackBotDocumentDestination,
   type SlackBotInstallCallbackFailureReason,
   type SlackBotInstallCallbackFailureStage,
 } from "@opengeni/db";
@@ -380,7 +385,13 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.patch("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "connections:write",
+    );
+    const { grant } = authorization;
     const payload = UpdateConnectionRequest.parse(await c.req.json());
     assertNotReservedSlackBotMetadata(payload.metadata);
     const existing = await getConnectionMetadata(
@@ -390,9 +401,69 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       grant.subjectId,
     );
     if (existing && isOpenGeniSlackBotConnection(existing)) {
-      throw new HTTPException(422, {
-        message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
+      const destination = ConnectorDocumentDestinationSelection.safeParse(
+        payload.metadata?.documentDestination,
+      );
+      const destinationOnlyUpdate =
+        payload.metadata !== undefined &&
+        Object.keys(payload.metadata).length === 1 &&
+        payload.providerDomain === undefined &&
+        payload.subjectId === undefined &&
+        payload.kind === undefined &&
+        payload.status === undefined &&
+        payload.credential === undefined &&
+        payload.grantedScopes === undefined &&
+        payload.expiresAt === undefined;
+      if (!destination.success || !destinationOnlyUpdate) {
+        throw new HTTPException(422, {
+          message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
+        });
+      }
+      const destinationSelection = destination.data;
+      if (
+        destinationSelection.authorityKind === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") !== true
+      ) {
+        throw new HTTPException(403, { message: "missing permission: account:admin" });
+      }
+      if (
+        destinationSelection.authorityKind === "workspace" &&
+        !hasPermission(grant.permissions, "workspace:admin")
+      ) {
+        throw new HTTPException(403, { message: "missing permission: workspace:admin" });
+      }
+      if (
+        destinationSelection.authorityKind === "personal" &&
+        (!authorization.contextIntegrity ||
+          authorization.authenticatedSubjectId !== grant.subjectId)
+      ) {
+        throw new HTTPException(403, {
+          message: "personal destination requires the exact actor",
+        });
+      }
+      const metadata = {
+        ...existing.metadata,
+        documentDestination: bindConnectorDocumentDestination(destinationSelection, {
+          accountId: grant.accountId,
+          workspaceId,
+          initiatingSubjectId: grant.subjectId,
+        }),
+      };
+      const connection = await updateSlackBotDocumentDestination(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId: existing.id,
+        visibleToSubjectId: grant.subjectId,
+        expectedVersion: existing.version,
+        metadata,
+        updatedBySubjectId: grant.subjectId,
       });
+      if (!connection) {
+        throw new HTTPException(409, {
+          message: "Slack bot connection changed; reload before saving its destination",
+        });
+      }
+      return c.json(ConnectionResponse.parse({ connection }));
     }
     if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
       throw new HTTPException(422, {

package/src/routes/enrollments.ts

@@ -20,6 +20,7 @@
 // workspace can approve it (the approve's user_code lookup is workspace-scoped) — a
 // start can never grant access to a workspace no authorized user later approves in.
 
+import { randomUUID } from "node:crypto";
 import {
   DeviceEnrollmentApproveRequest,
   DeviceEnrollmentApproveResponse,
@@ -35,11 +36,18 @@ import {
   ListEnrollmentsResponse,
   MintEnrollTokenRequest,
   MintEnrollTokenResponse,
+  RemoveEnrollmentRequest,
   RevokeEnrollmentResponse,
   type EnrollmentArch,
   type EnrollmentOs,
 } from "@opengeni/contracts";
-import { getWorkspace, listEnrollments, revokeEnrollment } from "@opengeni/db";
+import {
+  getWorkspace,
+  listEnrollments,
+  MachineRemovalIdempotencyError,
+  MachineRemovalRevisionConflictError,
+  removeEnrollment,
+} from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
@@ -301,11 +309,12 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const statusFilter = c.req.query("status");
-    const rows = await listEnrollments(
-      db,
-      workspaceId,
-      statusFilter === "active" ? { status: "active" } : {},
-    );
+    if (statusFilter !== undefined && statusFilter !== "active" && statusFilter !== "revoked") {
+      throw new HTTPException(400, { message: "status must be active or revoked" });
+    }
+    const rows = await listEnrollments(db, workspaceId, {
+      status: statusFilter === "revoked" ? "revoked" : "active",
+    });
     return c.json(
       ListEnrollmentsResponse.parse({
         enrollments: rows.map((row) =>
@@ -333,12 +342,45 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
-    const result = await revokeEnrollment(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      enrollmentId: c.req.param("enrollmentId"),
-    });
-    return c.json(RevokeEnrollmentResponse.parse(result));
+    const parsed = RemoveEnrollmentRequest.safeParse(await c.req.json().catch(() => ({})));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid machine removal request" });
+    }
+    const idempotencyKey =
+      parsed.data.idempotencyKey?.trim() || c.req.header("idempotency-key")?.trim() || randomUUID();
+    try {
+      const result = await removeEnrollment(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        enrollmentId: c.req.param("enrollmentId"),
+        operationKey: idempotencyKey,
+        ...(parsed.data.expectedUpdatedAt
+          ? { expectedUpdatedAt: parsed.data.expectedUpdatedAt }
+          : {}),
+        subjectId: grant.subjectId,
+      });
+      if (!result) {
+        throw new HTTPException(404, { message: "machine enrollment not found" });
+      }
+      return c.json(
+        RevokeEnrollmentResponse.parse({
+          revoked: result.removed,
+          ...result,
+        }),
+        200,
+      );
+    } catch (error) {
+      if (error instanceof MachineRemovalIdempotencyError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      if (error instanceof MachineRemovalRevisionConflictError) {
+        throw new HTTPException(409, {
+          message: error.message,
+          cause: { code: "stale_revision", currentUpdatedAt: error.currentUpdatedAt },
+        });
+      }
+      throw error;
+    }
   });
 }
 

package/src/routes/environments.ts

@@ -9,17 +9,19 @@ import {
   countScheduledTasksUsingVariableSet,
   countVariableSets,
   createVariableSet,
+  decryptVariableSetValue,
   deleteVariableSet,
   deleteVariableSetVariable,
   encryptVariableSetValue,
   getVariableSetByName,
   listVariableSets,
+  readVariableSetSecretAtomically,
   setVariableSetVariable,
   updateVariableSet,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import { requireAccessGrant, requireLiteralPermission, requirePermission } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   assertAllowedVariableSetVariableName,
@@ -40,15 +42,21 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
   for (const prefix of prefixes) {
     app.get(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      await requireAccessGrant(c, deps, workspaceId, "variable-sets:use");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:list");
+      requirePermission(grant, "secrets:list");
       return c.json(await listVariableSets(db, workspaceId));
     });
 
     app.post(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
       const key = requireVariableSetEncryption(settings);
       const payload = CreateVariableSetRequest.parse(await c.req.json());
+      if (payload.variables.length > 0) {
+        requirePermission(grant, "secrets:write");
+      }
       const name = trimmedVariableSetName(payload.name);
       if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT) {
         throw new HTTPException(422, {
@@ -71,7 +79,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
         });
       }
       if (await getVariableSetByName(db, workspaceId, name)) {
-        throw new HTTPException(409, { message: `variable set name is already in use: ${name}` });
+        throw new HTTPException(409, {
+          message: `variable set name is already in use: ${name}`,
+        });
       }
       // Values are encrypted up front and the variableSet plus all initial
       // variables are written in one transaction: a failure leaves nothing.
@@ -95,13 +105,42 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.get(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      await requireAccessGrant(c, deps, workspaceId, "variable-sets:use");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:read");
+      requirePermission(grant, "secrets:list");
       return c.json(await requireVariableSetForApi(db, workspaceId, c.req.param("variableSetId")!));
     });
 
+    if (prefix.endsWith("/variable-sets")) {
+      app.get(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+        const workspaceId = c.req.param("workspaceId")!;
+        const grant = await requireAccessGrant(c, deps, workspaceId);
+        requirePermission(grant, "variable-sets:read");
+        requireLiteralPermission(grant, "secrets:read");
+        const key = requireVariableSetEncryption(settings);
+        const name = parseVariableName(c.req.param("name")!);
+        const secret = await readVariableSetSecretAtomically(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          variableSetId: c.req.param("variableSetId")!,
+          name,
+          actor: { kind: "subject" },
+          decrypt: (valueEncrypted) => decryptVariableSetValue(key, valueEncrypted),
+        });
+        if (!secret) {
+          throw new HTTPException(404, {
+            message: "variable set variable not found",
+          });
+        }
+        return c.json(secret);
+      });
+    }
+
     app.patch(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
       const variableSet = await requireVariableSetForApi(
         db,
         workspaceId,
@@ -112,7 +151,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (name !== undefined && name !== variableSet.name) {
         const existing = await getVariableSetByName(db, workspaceId, name);
         if (existing && existing.id !== variableSet.id) {
-          throw new HTTPException(409, { message: `variable set name is already in use: ${name}` });
+          throw new HTTPException(409, {
+            message: `variable set name is already in use: ${name}`,
+          });
         }
       }
       const updated = await updateVariableSet(db, workspaceId, variableSet.id, {
@@ -129,7 +170,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const variableSet = await requireVariableSetForApi(
         db,
         workspaceId,
@@ -166,7 +209,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const key = requireVariableSetEncryption(settings);
       const name = parseVariableName(c.req.param("name")!);
       const variableSet = await requireVariableSetForApi(
@@ -199,7 +244,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const name = parseVariableName(c.req.param("name")!);
       const variableSet = await requireVariableSetForApi(
         db,
@@ -208,7 +255,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       );
       const deleted = await deleteVariableSetVariable(db, workspaceId, variableSet.id, name);
       if (!deleted) {
-        throw new HTTPException(404, { message: "variable set variable not found" });
+        throw new HTTPException(404, {
+          message: "variable set variable not found",
+        });
       }
       await recordVariableSetAuditEvent(db, {
         grant,