@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/video-generation.ts

@@ -6,6 +6,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getVideoGenerationOperationSummary,
+  withSessionRlsActorContext,
   getWorkspaceVercelAiGatewayConnectionMetadata,
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
@@ -14,6 +15,9 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant,
+  requireAccessGrantAuthorization,
+  fileOwnerContextForAccess,
+  requireWorkspaceSettingsGrant,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy,
@@ -21,6 +25,7 @@ import {
 } from "@opengeni/core";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
@@ -58,8 +63,8 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
 
   app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    const payload = await parseRequestJson(c, UpdateVideoGenerationPolicyRequest);
     const [connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
       workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
@@ -107,11 +112,10 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
 
   app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const summary = await getVideoGenerationOperationSummary(
-      deps.db,
-      workspaceId,
-      c.req.param("operationId"),
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const actor = await fileOwnerContextForAccess(deps, access, "workspace:read");
+    const summary = await withSessionRlsActorContext(actor, () =>
+      getVideoGenerationOperationSummary(deps.db, workspaceId, c.req.param("operationId")),
     );
     if (!summary)
       throw new HTTPException(404, {
@@ -133,12 +137,12 @@ function videoGenerationFundingOptions(input: {
   return [
     {
       source: "opengeni_credits" as const,
-      label: "OpenGeni",
-      description: "Uses OpenGeni credits through the managed Gateway route.",
+      label: "Opengeni",
+      description: "Uses Opengeni credits through the managed Gateway route.",
       available: input.managedConfigured,
       unavailableReason: input.managedConfigured
         ? null
-        : "OpenGeni-managed video generation is not configured.",
+        : "Opengeni-managed video generation is not configured.",
     },
     {
       source: "supergrok_subscription" as const,

package/src/routes/workspace-artifacts.ts

@@ -3,21 +3,32 @@ import {
   CreateWorkspaceArtifactRequest,
   PublishWorkspaceArtifactVersionRequest,
   RollbackWorkspaceArtifactRequest,
+  SetWorkspaceArtifactStatusRequest,
   WorkspaceArtifactContentResponse,
   WorkspaceArtifactDetailResponse,
   WorkspaceArtifactListQuery,
   WorkspaceArtifactListResponse,
   WorkspaceArtifactMutationResponse,
   normalizeWorkspaceArtifactSlug,
+  type AccessGrant,
 } from "@opengeni/contracts";
-import { requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   createWorkspaceArtifact,
   getWorkspaceArtifact,
   getWorkspaceArtifactContentRef,
   listWorkspaceArtifacts,
+  nestedPostgresSqlState,
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
+  setWorkspaceArtifactStatus,
   WorkspaceArtifactConflictError,
   WorkspaceArtifactNotFoundError,
   WorkspaceArtifactOperationError,
@@ -25,10 +36,22 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { readWorkspaceArtifactContent } from "../workspace-artifact-content";
+import { userContentDispositionHeaders } from "../http/user-content";
+import {
+  projectWorkspaceArtifactDetailProvenance,
+  projectWorkspaceArtifactMutationProvenance,
+  redactWorkspaceArtifactListProvenance,
+} from "../workspace-artifact-provenance";
+
+import {
+  prepareWorkspaceArtifactPublication,
+  prepareWorkspaceArtifactUpload,
+  workspaceArtifactDownloads,
+  readArtifactObject,
+} from "../site-uploads";
 
 const ArtifactId = z.string().uuid();
-const encoder = new TextEncoder();
-const decoder = new TextDecoder("utf-8", { fatal: true });
 
 async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
@@ -36,13 +59,20 @@ async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z
   return parsed.data;
 }
 
+function parseVersionId(value: string | undefined): string | undefined {
+  if (value !== undefined && !ArtifactId.safeParse(value).success) {
+    throw new HTTPException(422, { message: "Invalid artifact version id" });
+  }
+  return value;
+}
+
 function artifactId(context: Context): string {
   const parsed = ArtifactId.safeParse(context.req.param("artifactId"));
   if (!parsed.success) throw new HTTPException(422, { message: "Invalid artifact id" });
   return parsed.data;
 }
 
-function errorResponse(context: Context, error: unknown): Response {
+export function workspaceArtifactErrorResponse(context: Context, error: unknown): Response {
   if (error instanceof WorkspaceArtifactNotFoundError) {
     return context.json({ code: "WORKSPACE_ARTIFACT_NOT_FOUND", message: error.message }, 404);
   }
@@ -62,41 +92,28 @@ function errorResponse(context: Context, error: unknown): Response {
       422,
     );
   }
-  if (typeof error === "object" && error !== null && "code" in error && error.code === "23505") {
+  if (nestedPostgresSqlState(error) === "23505") {
     return context.json(
-      { code: "WORKSPACE_ARTIFACT_CONFLICT", message: "Artifact slug or operation already exists" },
+      {
+        code: "WORKSPACE_ARTIFACT_CONFLICT",
+        message: "Artifact slug or operation already exists",
+      },
       409,
     );
   }
   throw error;
 }
 
-function contentMetadata(workspaceId: string, html: string) {
-  const bytes = encoder.encode(html);
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  return {
-    bytes,
-    contentSha256: sha256,
-    sizeBytes: bytes.byteLength,
-    contentKey: `workspaces/${workspaceId}/workspace-artifacts/blobs/${sha256}.html`,
-  };
-}
-
-function prepareHtml(deps: ApiRouteDeps, workspaceId: string, html: string) {
+function prepareContent(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  input: Parameters<typeof prepareWorkspaceArtifactPublication>[2],
+) {
   if (!deps.objectStorage)
-    throw new HTTPException(503, { message: "Object storage is not configured" });
-  const content = contentMetadata(workspaceId, html);
-  return {
-    ...content,
-    persistContent: async () => {
-      await deps.objectStorage!.putObject({
-        key: content.contentKey,
-        contentType: "text/html; charset=utf-8",
-        body: content.bytes,
-        sha256: content.contentSha256,
-      });
-    },
-  };
+    throw new HTTPException(503, {
+      message: "Object storage is not configured",
+    });
+  return prepareWorkspaceArtifactPublication(deps, grant, input);
 }
 
 function provenance(subjectId: string, idempotencyKey: string) {
@@ -111,49 +128,138 @@ function provenance(subjectId: string, idempotencyKey: string) {
   };
 }
 
+async function canReadProvenanceSession(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  sessionId: string,
+): Promise<boolean> {
+  try {
+    await requireSessionAuthorization(deps, grant, {
+      sessionId,
+      operation: "session.read",
+      surface: "http",
+    });
+    return true;
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) return false;
+    if (error instanceof SessionAuthorizationUnavailableError) {
+      throw new HTTPException(503, {
+        message: "Session authorization is unavailable",
+      });
+    }
+    throw error;
+  }
+}
+
+async function mutationResponse(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  response: WorkspaceArtifactMutationResponse,
+): Promise<WorkspaceArtifactMutationResponse> {
+  return WorkspaceArtifactMutationResponse.parse(
+    await projectWorkspaceArtifactMutationProvenance(response, (sessionId) =>
+      canReadProvenanceSession(deps, grant, sessionId),
+    ),
+  );
+}
+
 export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps): void {
   // `published-artifacts` deliberately avoids the existing `/artifacts/:id`
   // retained-output API. The product route remains simply `/artifacts`.
   const base = "/v1/workspaces/:workspaceId/published-artifacts";
 
-  app.get(base, async (context) => {
+  app.post(`${base}/uploads`, async (context) => {
+    const grant = await requireAccessGrant(
+      context,
+      deps,
+      context.req.param("workspaceId"),
+      "artifacts:publish",
+    );
+    return context.json(await prepareWorkspaceArtifactUpload(deps, grant));
+  });
+
+  app.get(`${base}/:artifactId/downloads`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    if (!deps.objectStorage)
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
+    const ref = await getWorkspaceArtifactContentRef(
+      deps.db,
+      workspaceId,
+      artifactId(context),
+      parseVersionId(context.req.query("versionId")),
+    );
+    return context.json(await workspaceArtifactDownloads(deps.objectStorage, ref, "public"));
+  });
+
+  app.get(base, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
+      status: context.req.query("status"),
+      sourceSessionId: context.req.query("sourceSessionId"),
     });
     if (!query.success) throw new HTTPException(422, { message: "Invalid artifact list query" });
+    if (
+      query.data.sourceSessionId &&
+      !(await canReadProvenanceSession(deps, grant, query.data.sourceSessionId))
+    ) {
+      throw new HTTPException(404, { message: "Session not found" });
+    }
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
-          await listWorkspaceArtifacts(deps.db, workspaceId, {
-            limit: query.data.limit,
-            ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
-          }),
+          redactWorkspaceArtifactListProvenance(
+            await listWorkspaceArtifacts(deps.db, workspaceId, {
+              limit: query.data.limit,
+              ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
+              ...(query.data.status ? { status: query.data.status } : {}),
+              ...(query.data.sourceSessionId
+                ? { sourceSessionId: query.data.sourceSessionId }
+                : {}),
+            }),
+          ),
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, CreateWorkspaceArtifactRequest);
     const id = crypto.randomUUID();
     const slugBase = request.slug ?? (normalizeWorkspaceArtifactSlug(request.title) || "artifact");
     const slug = request.slug ?? `${slugBase.slice(0, 87)}-${id.slice(0, 8)}`;
-    const content = prepareHtml(deps, workspaceId, request.html);
     try {
+      const content = await prepareContent(deps, grant, {
+        ...(request.html !== undefined ? { html: request.html } : {}),
+        ...(request.uploadId ? { uploadId: request.uploadId } : {}),
+        ...(request.source ? { source: request.source } : {}),
+        ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+      });
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await createWorkspaceArtifact(deps.db, {
             accountId: grant.accountId,
             workspaceId,
             artifactId: id,
             slug,
+            requestedSlug: request.slug ?? null,
             title: request.title,
             description: request.description ?? null,
             ...content,
@@ -163,33 +269,82 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         201,
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.get(`${base}/:artifactId`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     try {
+      const detail = await getWorkspaceArtifact(deps.db, workspaceId, artifactId(context));
       return context.json(
         WorkspaceArtifactDetailResponse.parse(
-          await getWorkspaceArtifact(deps.db, workspaceId, artifactId(context)),
+          await projectWorkspaceArtifactDetailProvenance(detail, (sessionId) =>
+            canReadProvenanceSession(deps, grant, sessionId),
+          ),
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
+  app.get(`${base}/:artifactId/html`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    if (!deps.objectStorage)
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
+    const ref = await getWorkspaceArtifactContentRef(
+      deps.db,
+      workspaceId,
+      artifactId(context),
+      parseVersionId(context.req.query("versionId")),
+    );
+    const iterator = readArtifactObject(deps.objectStorage, ref.contentKey);
+    return new Response(
+      new ReadableStream({
+        async pull(controller) {
+          try {
+            const item = await iterator.next();
+            if (item.done) controller.close();
+            else controller.enqueue(item.value);
+          } catch (error) {
+            controller.error(error);
+          }
+        },
+        async cancel() {
+          await iterator.return();
+        },
+      }),
+      {
+        headers: {
+          "Content-Type": "text/html; charset=utf-8",
+          "Cache-Control": "private, no-store",
+          // A Site runs its own scripts, but only inside an opaque origin: no
+          // same-origin access to the console, and no cross-site embedding.
+          "Content-Security-Policy": "sandbox allow-scripts",
+          "Cross-Origin-Resource-Policy": "same-origin",
+          "X-Content-Type-Options": "nosniff",
+          // Clients read this HTML with fetch and render it in their own frame
+          // (the console uses srcdoc). Opening the raw URL downloads it rather
+          // than running a publisher-authored page at an app-origin URL.
+          ...userContentDispositionHeaders("text/html", "site.html"),
+        },
+      },
+    );
+  });
+
   app.get(`${base}/:artifactId/content`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
-    const parsedVersion = context.req.query("versionId");
-    if (parsedVersion && !ArtifactId.safeParse(parsedVersion).success) {
-      throw new HTTPException(422, { message: "Invalid artifact version id" });
-    }
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
+    const parsedVersion = parseVersionId(context.req.query("versionId"));
     try {
       const ref = await getWorkspaceArtifactContentRef(
         deps.db,
@@ -197,17 +352,14 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         artifactId(context),
         parsedVersion,
       );
-      const object = await deps.objectStorage.getObjectBytes(ref.contentKey);
-      if (!object) throw new HTTPException(503, { message: "Artifact content is unavailable" });
-      const actualHash = createHash("sha256").update(object.bytes).digest("hex");
-      if (actualHash !== ref.version.contentSha256) {
-        throw new HTTPException(503, { message: "Artifact content failed integrity verification" });
-      }
-      let html: string;
+      let content: Awaited<ReturnType<typeof readWorkspaceArtifactContent>>;
       try {
-        html = decoder.decode(object.bytes);
-      } catch {
-        throw new HTTPException(503, { message: "Artifact content is not valid UTF-8" });
+        content = await readWorkspaceArtifactContent(deps.objectStorage, ref);
+      } catch (error) {
+        throw new HTTPException(503, {
+          message: error instanceof Error ? error.message : "Artifact content is unavailable",
+          cause: error,
+        });
       }
       return context.json(
         WorkspaceArtifactContentResponse.parse({
@@ -215,23 +367,36 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
           versionId: ref.version.id,
           contentType: "text/html",
           contentSha256: ref.version.contentSha256,
-          html,
+          ...content,
         }),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(`${base}/:artifactId/versions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, PublishWorkspaceArtifactVersionRequest);
     const id = artifactId(context);
-    const content = prepareHtml(deps, workspaceId, request.html);
     try {
+      const content = await prepareContent(deps, grant, {
+        ...(request.html !== undefined ? { html: request.html } : {}),
+        ...(request.uploadId ? { uploadId: request.uploadId } : {}),
+        ...(request.source ? { source: request.source } : {}),
+        ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+      });
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await publishWorkspaceArtifactVersion(deps.db, {
             accountId: grant.accountId,
             workspaceId,
@@ -245,21 +410,30 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 
   app.post(`${base}/:artifactId/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
     const request = await body(context, RollbackWorkspaceArtifactRequest);
+    const id = artifactId(context);
     try {
       return context.json(
-        WorkspaceArtifactMutationResponse.parse(
+        await mutationResponse(
+          deps,
+          grant,
           await rollbackWorkspaceArtifact(deps.db, {
             accountId: grant.accountId,
             workspaceId,
-            artifactId: artifactId(context),
+            artifactId: id,
             versionId: request.versionId,
             expectedCurrentVersionId: request.expectedCurrentVersionId,
             reason: request.reason,
@@ -268,7 +442,39 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         ),
       );
     } catch (error) {
-      return errorResponse(context, error);
+      return workspaceArtifactErrorResponse(context, error);
+    }
+  });
+
+  app.patch(`${base}/:artifactId/status`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
+    const request = await body(context, SetWorkspaceArtifactStatusRequest);
+    const id = artifactId(context);
+    try {
+      return context.json(
+        await mutationResponse(
+          deps,
+          grant,
+          await setWorkspaceArtifactStatus(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            artifactId: id,
+            status: request.status,
+            expectedCurrentVersionId: request.expectedCurrentVersionId,
+            reason: request.reason,
+            ...provenance(grant.subjectId, request.idempotencyKey),
+          }),
+        ),
+      );
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
     }
   });
 }

package/src/routes/workspace-capture.ts

@@ -215,10 +215,20 @@ async function loadManifest(
  * manifest blob has been GC'd (all graceful cold-fallback states — never errors).
  * Inline manifest for ≤2MB, signed URL above.
  */
+/** Awaited before a signed capture URL is returned to the caller: the route
+ *  records the metadata-only issuance audit fact. A throwing recorder fails
+ *  the serve closed - no recorded fact, no bearer capability. */
+export type CaptureSignedUrlIssuanceRecorder = (fact: {
+  kind: "capture_manifest" | "capture_file";
+  revision: number;
+  expiresAt: string;
+}) => Promise<void>;
+
 export async function serveWorkspaceCapture(
   row: WorkspaceCaptureRow | null,
   storage: CaptureStoragePort,
   cache?: WorkspaceCaptureManifestCache,
+  onSignedUrlIssued?: CaptureSignedUrlIssuanceRecorder,
 ): Promise<GetWorkspaceCaptureResponse> {
   if (!row) {
     return { available: false };
@@ -274,6 +284,11 @@ export async function serveWorkspaceCapture(
     key: row.manifestKey,
     expiresInSeconds: CAPTURE_SIGNED_URL_TTL_SECONDS,
   });
+  await onSignedUrlIssued?.({
+    kind: "capture_manifest",
+    revision: row.revision,
+    expiresAt: signed.expiresAt.toISOString(),
+  });
   return GetWorkspaceCaptureResponse.parse({
     ...meta,
     manifest: null,
@@ -293,6 +308,7 @@ export async function serveWorkspaceCaptureFile(
   row: WorkspaceCaptureRow | null,
   path: string,
   storage: CaptureStoragePort,
+  onSignedUrlIssued?: CaptureSignedUrlIssuanceRecorder,
 ): Promise<GetWorkspaceCaptureFileResponse> {
   const loaded = row ? await loadManifest(row, storage) : null;
   if (!loaded) {
@@ -347,6 +363,11 @@ export async function serveWorkspaceCaptureFile(
     key: file.contentRef,
     expiresInSeconds: CAPTURE_SIGNED_URL_TTL_SECONDS,
   });
+  await onSignedUrlIssued?.({
+    kind: "capture_file",
+    revision: row!.revision,
+    expiresAt: signed.expiresAt.toISOString(),
+  });
   return GetWorkspaceCaptureFileResponse.parse({
     ...base,
     encoding: null,