@opengeni/api-router 0.30.1 → 1.0.0

package/dist/routes/client-errors.d.ts

@@ -0,0 +1,146 @@
+import type { Settings } from "@opengeni/config";
+import { CLIENT_ERROR_KINDS, CLIENT_ERROR_REPORT_MAX_BYTES, CLIENT_ERRORS_PATH, type ClientErrorKind } from "@opengeni/contracts/client-error-report";
+import type { Observability } from "@opengeni/observability";
+import type { Hono } from "hono";
+import { z } from "zod";
+import { type KeyedAdmission } from "../http/keyed-admission.js";
+export { CLIENT_ERROR_KINDS, CLIENT_ERROR_REPORT_MAX_BYTES, CLIENT_ERRORS_PATH, type ClientErrorKind, };
+export declare const ClientErrorReport: z.ZodObject<{
+    kind: z.ZodEnum<{
+        chunk_load: "chunk_load";
+        route_error: "route_error";
+        unhandled_rejection: "unhandled_rejection";
+        window_error: "window_error";
+    }>;
+    route: z.ZodString;
+    revision: z.ZodString;
+}, z.core.$strict>;
+export type ClientErrorReport = z.infer<typeof ClientErrorReport>;
+export declare const ClientSignalReport: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    signal: z.ZodLiteral<"request_failure">;
+    action: z.ZodEnum<{
+        checkout_start: "checkout_start";
+        composer_submit: "composer_submit";
+        connect_integration: "connect_integration";
+        connect_model: "connect_model";
+        create_session: "create_session";
+        retry_turn: "retry_turn";
+        send_message: "send_message";
+        steer_message: "steer_message";
+    }>;
+    reason: z.ZodEnum<{
+        network: "network";
+        offline: "offline";
+        timeout: "timeout";
+    }>;
+    route: z.ZodString;
+    revision: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    signal: z.ZodLiteral<"stream">;
+    stream: z.ZodEnum<{
+        session: "session";
+        workspace: "workspace";
+    }>;
+    event: z.ZodEnum<{
+        long_disconnect: "long_disconnect";
+        reconnect: "reconnect";
+        reconnect_exhausted: "reconnect_exhausted";
+    }>;
+    route: z.ZodString;
+    revision: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    signal: z.ZodLiteral<"web_vital">;
+    metric: z.ZodEnum<{
+        cls: "cls";
+        inp: "inp";
+        lcp: "lcp";
+        ttfb: "ttfb";
+    }>;
+    page: z.ZodEnum<{
+        "account-auth": "account-auth";
+        agents: "agents";
+        artifacts: "artifacts";
+        capabilities: "capabilities";
+        "checkout-return": "checkout-return";
+        "connect-agent": "connect-agent";
+        device: "device";
+        documents: "documents";
+        environments: "environments";
+        files: "files";
+        home: "home";
+        "identity-link": "identity-link";
+        insights: "insights";
+        "integration-return": "integration-return";
+        machines: "machines";
+        memory: "memory";
+        organization: "organization";
+        other: "other";
+        "personal-security": "personal-security";
+        plugins: "plugins";
+        priority: "priority";
+        "reset-password": "reset-password";
+        rigs: "rigs";
+        schedules: "schedules";
+        "session-link": "session-link";
+        sessions: "sessions";
+        settings: "settings";
+        "setup-account": "setup-account";
+        state: "state";
+        "variable-sets": "variable-sets";
+    }>;
+    value: z.ZodNumber;
+    revision: z.ZodString;
+}, z.core.$strict>], "signal">;
+export type ClientSignalReport = z.infer<typeof ClientSignalReport>;
+export type ClientBeaconReport = ClientErrorReport | ClientSignalReport;
+/**
+ * Bucket bounds cover the published good/poor thresholds of every metric:
+ * CLS 0.1/0.25, INP 0.2/0.5 s, TTFB 0.8/1.8 s, LCP 2.5/4 s.
+ */
+export declare const CLIENT_WEB_VITAL_BUCKETS: number[];
+export type ClientErrorAdmission = KeyedAdmission<ClientErrorKind>;
+/** Keyed by `<signal>:<closed dimension>`, a finite set of buckets. */
+export type ClientSignalAdmission = KeyedAdmission<string>;
+/** Same bounds as the error kinds: one bucket per closed signal key. */
+export declare function createClientSignalAdmission(options?: {
+    capacity?: number;
+    refillPerSecond?: number;
+    now?: () => number;
+}): ClientSignalAdmission;
+/**
+ * Web vitals arrive from every page load rather than only on failure, so they
+ * get a much larger dedicated bucket per metric (burst 1,200, then 20 a
+ * second per process). The browser samples vitals before sending.
+ */
+export declare function createClientWebVitalAdmission(options?: {
+    capacity?: number;
+    refillPerSecond?: number;
+    now?: () => number;
+}): ClientSignalAdmission;
+/**
+ * One token bucket per closed kind bounds counter inflation and log volume
+ * from any caller, including an anonymous one, without per-client state.
+ */
+export declare function createClientErrorAdmission(options?: {
+    capacity?: number;
+    refillPerSecond?: number;
+    now?: () => number;
+}): ClientErrorAdmission;
+export declare function parseClientErrorReport(body: string | null): ClientErrorReport | null;
+/** Parse any accepted beacon body: an error report or a closed signal report. */
+export declare function parseClientBeaconReport(body: string | null): ClientBeaconReport | null;
+export declare function isClientSignalReport(report: ClientBeaconReport): report is ClientSignalReport;
+/**
+ * The exact beacon request. The app-wide request-body limit skips it because
+ * the route enforces its own 512-byte limit on the streamed body; the generic
+ * ceiling would otherwise buffer a chunked body of many megabytes on an
+ * anonymous route before this one could refuse it.
+ */
+export declare function isClientErrorReportRequest(method: string, pathname: string): boolean;
+export declare function registerClientErrorRoutes(app: Hono, deps: {
+    observability: Observability;
+    settings: Pick<Settings, "corsAllowOriginRegex" | "publicBaseUrl" | "webBaseUrl">;
+    admission?: ClientErrorAdmission;
+    signalAdmission?: ClientSignalAdmission;
+    webVitalAdmission?: ClientSignalAdmission;
+}): void;

package/dist/routes/codex.d.ts

@@ -1,4 +1,60 @@
-export declare function codexModelsForPicker(liveSlugs: readonly string[]): Array<{
+import { type Settings } from "@opengeni/config";
+import { type CodexAccountStatus } from "@opengeni/db";
+export declare function codexAccountJson(row: CodexAccountStatus, options?: {
+    appsCredentialId?: string | null;
+    canManageApps?: boolean;
+    humanSubjectId?: string | null;
+}): {
+    id: string;
+    source: "organization" | "workspace";
+    chatgptAccountId: string | null;
+    label: string | null;
+    email: string | null;
+    plan: string | null;
+    planCheckedAt: Date | null;
+    planChangedFrom: string | null;
+    planChangedAt: Date | null;
+    planExcludedModels: {
+        model: string;
+        label: string;
+        excludedAt: Date;
+        retryAfter: Date;
+    }[];
+    status: string;
+    active: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastError: string | null;
+    fiveHour: import("@opengeni/codex").CodexUsageWindow | null;
+    weekly: import("@opengeni/codex").CodexUsageWindow | null;
+    usageCheckedAt: Date | null;
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: Date | null;
+    resetCreditAvailableCount: number | null;
+    resetCreditsCheckedAt: Date | null;
+    exhaustedUntil: Date | null;
+    appsDesignated: boolean;
+    canEnableApps: boolean;
+};
+/**
+ * Derive the two distinct cached worker-readiness meanings exposed by the
+ * status route. `poolReady` means at least one effective-pool account passes
+ * the worker's cached admission predicate. `workerRoutable` additionally
+ * honors rotation-off's active-pointer-only rule; it says nothing about a
+ * session-specific manual pin.
+ */
+export declare function codexWorkerReadiness(input: {
+    effectiveSource: "workspace" | "organization" | "disabled";
+    rotationEnabled: boolean;
+    activeCredentialId: string | null;
+    accounts: ReadonlyArray<Pick<CodexAccountStatus, "id" | "status" | "allocatorEnabled" | "primaryUsedPercent" | "primaryResetAt" | "secondaryUsedPercent" | "secondaryResetAt" | "exhaustedUntil">>;
+    now: Date;
+}): {
+    poolReady: boolean;
+    workerRoutable: boolean;
+};
+export declare function codexModelsForPicker(settings?: Settings, supportedSlugs?: readonly string[]): Array<{
     id: string;
     label: string;
     provider: string;
@@ -6,5 +62,23 @@ export declare function codexModelsForPicker(liveSlugs: readonly string[]): Arra
     api: "responses";
 }>;
 import { type ApiRouteDeps } from "@opengeni/core";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
+type ManagedCookieHuman = {
+    subjectId: string;
+    browserSessionHash: string;
+};
+export declare function managedCookieHuman(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
+/**
+ * The person in this browser, or an agent acting as them. Only for routes that
+ * then require the same person's workspace grant; provider sign-in steps keep
+ * managedCookieHuman. An agent has no browser session, so its hash never
+ * matches a sign-in started in one.
+ */
+export declare function managedHumanOrAgent(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
+export declare function requireOrganizationCodexHuman(c: Context, deps: ApiRouteDeps, organizationId: string, options?: {
+    /** A provider sign-in step: the person does it in the browser, never an agent. */
+    providerConsent?: boolean;
+}): Promise<ManagedCookieHuman>;
+export declare function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void;
 export declare function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/company-brain.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerCompanyBrainRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/company-profile.d.ts

@@ -1,3 +1,4 @@
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
 import type { Hono } from "hono";
+export declare function requireDirectAccountAdmin(access: AccessGrantAuthorization): void;
 export declare function registerCompanyProfileRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/computer-sessions.d.ts

@@ -1,6 +1,20 @@
 import { type ApiRouteDeps } from "@opengeni/core";
+import { type ComputerControlFrame, type ExpectedComputerFrameEvidence } from "@opengeni/runtime/sandbox";
 import type { Hono } from "hono";
+type ComputerFrameCaptureClient = {
+    capture(targetId: string, options: {
+        format?: "jpeg" | "png";
+        quality?: number;
+        maxWidth?: number;
+        maxHeight?: number;
+    }): Promise<ComputerControlFrame>;
+};
+export declare function validateComputerFrameForApi(frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">, expected: ExpectedComputerFrameEvidence): ComputerControlFrame;
+export declare function captureModelComputerFrame(sessionClient: ComputerFrameCaptureClient, expected: ExpectedComputerFrameEvidence): Promise<ComputerControlFrame>;
+/** One validated screen frame, served as sandboxed, non-embeddable user content. */
+export declare function computerScreenshotResponse(frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">): Response;
 /** Public ComputerSession resource surface. Physical app/window authority stays
  * in the same placement controller used by BrowserSession; this route owns only
  * durable authorization, placement fencing, lifecycle receipts, and routing. */
 export declare function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/connect.d.ts

@@ -0,0 +1,5 @@
+import type { Hono } from "hono";
+import { type ApiRouteDeps } from "@opengeni/core";
+/** Shared durable setup entry. Provider completion is distinct from
+ * subsequent preview/install; never report an OAuth token as a ready integration. */
+export declare function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/editable-artifacts.d.ts

@@ -42,3 +42,5 @@ export declare class EditableArtifactApplicationError extends Error {
 }
 export declare function registerEditableArtifactRoutes(app: Hono, deps: EditableArtifactRouteDependencies): void;
 export declare function editableArtifactActorForGrant(grant: AccessGrant, rawReplicaId: string): EditableArtifactRouteActor;
+export declare function isInvisibleListCandidate(error: unknown): boolean;
+export declare function editableArtifactHttpError(error: unknown): unknown;

package/dist/routes/external-identity-links.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import { type ApiRouteDeps } from "@opengeni/core";
+/** Both products address the link through a workspace they already own. The
+ * link itself is organization-local; the host's Personal workspace need not be
+ * exposed to the native human, and neither side names the other's subject. */
+export declare function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/feedback.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerFeedbackRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/files.d.ts

@@ -2,3 +2,7 @@ import type { Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
 export declare function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void;
 export declare function sanitizeFilename(filename: string): string;
+/** Human and stable service grants already carry their immutable subject.
+ * Agent tokens carry only a technical worker subject, so resolve the exact
+ * live attempt and use the initiating human frozen on its durable turn. */
+export declare function fileAuthoritySubjectIdForGrant(deps: Pick<ApiRouteDeps, "db">, grant: import("@opengeni/contracts").AccessGrant): Promise<string | null>;

package/dist/routes/github-browser-pages.d.ts

@@ -0,0 +1,12 @@
+import type { GitHubInstallationBindingCandidate } from "@opengeni/contracts";
+export declare function githubInstallationChooserHtml(candidates: GitHubInstallationBindingCandidate[], state: string, workspaceId: string, baseUrl: string): string;
+export declare function githubSetupSuccessHtml(account: string, returnUrl: string): string;
+export declare function githubSetupPendingHtml(): string;
+/**
+ * Why a GitHub browser step could not continue. Browser navigation (a stale
+ * page-load link, GitHub's Cancel button, a non-owner) must land on a readable
+ * page with a way back, never on a raw JSON error body.
+ */
+export type GitHubConnectFailure = "expired" | "cancelled" | "not_owner" | "forbidden" | "policy_denied" | "signed_out" | "failed";
+export declare function githubConnectFailureHtml(failure: GitHubConnectFailure, returnUrl: string, detail?: string | null): string;
+export declare function githubSuccessHtml(envLines: string[]): string;

package/dist/routes/github.d.ts

@@ -1,3 +1,5 @@
+import { type AccessGrant } from "@opengeni/contracts";
 import type { Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
 export declare function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function requirePublicGitHubRepositoryVerificationPermission(grant: Pick<AccessGrant, "permissions">): void;

package/dist/routes/insights-response-cache.d.ts

@@ -0,0 +1,10 @@
+export declare const INSIGHTS_RESPONSE_TTL_MS = 60000;
+/** Ephemeral keyed digest: raw credentials never become retained map keys or logs. */
+export declare function createInsightsCredentialPartition(): (authorization: string | undefined, cookie: string | undefined) => string;
+export declare function createInsightsResponseCache(clock?: () => number): {
+    get<T>(key: string, fence: string): T | null;
+    put(key: string, fence: string, value: unknown): void;
+    readonly size: number;
+};
+/** Match existing bounded cause-chain PostgreSQL timeout handling; never expose SQL. */
+export declare function insightsWithFriendlyTimeout<T>(read: () => Promise<T>): Promise<T>;

package/dist/routes/insights-usage.d.ts

@@ -0,0 +1,12 @@
+import type { AccessContext } from "@opengeni/contracts";
+import { type ApiRouteDeps, type InsightsQueryScope } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Keep repeated filters, but reject repeated scalar options in the strict schema. */
+export declare function insightsQueryParameters(query: Record<string, string[]>): Record<string, string | string[]>;
+/** Frozen interim capabilities: a newer additive contract must not silently widen a raw query. */
+export declare function insightsRawQuerySupported(query: Record<string, unknown>, organization: boolean, calls: boolean): boolean;
+/** The actor and its canonical detail authority are part of every sharing key. */
+export declare function insightsUsageCoalesceKey(scope: InsightsQueryScope, query: unknown, actor: string | null): string;
+/** Reuse canonical read grants, never infer session access from billing authority. */
+export declare function organizationInsightsScope(context: AccessContext, accountId: string): InsightsQueryScope;
+export declare function registerInsightsUsageRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/insights.d.ts

@@ -1,3 +1,32 @@
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type ApiRouteDeps, type WorkspaceInsightsFilterField } from "@opengeni/core";
 import type { Hono } from "hono";
+export declare function normalizeWorkspaceInsightsQueryFilter(value: string | null | undefined, field: WorkspaceInsightsFilterField): string | null;
+/**
+ * Share one in-flight computation between identical concurrent callers.
+ *
+ * A reload, a second tab, or a retried fetch joins the rollup already running
+ * instead of starting another multi-second aggregate on the database.
+ * Authorization and filter validation still run per request before a caller
+ * may join; the map only ever holds running work. The caller supplies the
+ * complete sharing key, which must identify everything the result depends on.
+ */
+export declare function createInFlightCoalescer<T>(): {
+    run: (key: string, work: () => Promise<T>) => Promise<T>;
+    readonly size: number;
+};
+/**
+ * Insights rows are filtered by the database RLS actor (private sessions are
+ * visible only to their owner), so two administrators of one workspace can
+ * legitimately receive different responses. The actor identity is part of
+ * the key; requests share work only when every visibility input is equal.
+ */
+export declare function workspaceInsightsCoalesceKey(input: {
+    workspaceId: string;
+    range: string;
+    provider: string | null;
+    model: string | null;
+    rootSessionId?: string | null;
+    sessionId?: string | null;
+    rlsActor: string | null;
+}): string;
 export declare function registerInsightsRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/knowledge.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerKnowledgeRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/managed-auth-session-sets.d.ts

@@ -0,0 +1,26 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function validatedManagedAuthSocialAuthorizationUrl(input: {
+    provider: "google" | "github";
+    rawUrl: unknown;
+    expectedClientId: string;
+    expectedCallbackUrl: string;
+}): string;
+/**
+ * Better Auth 1.6.26 provider lifecycle routes retained while session-set mode
+ * owns all selected-session reads, enumeration, revocation, and user mutation.
+ * The list is intentionally exact so a dependency upgrade cannot silently add
+ * a selected-session capability under the wildcard.
+ */
+export declare function requireManagedAuthProviderRouteAllowed(method: string, pathname: string): void;
+/** Remove provider bearer/session material and enforce browser-auth cache/cookie policy. */
+export declare function scrubManagedAuthProviderResponse(response: Response, options?: {
+    replacementCookies?: readonly string[] | undefined;
+    preserveCookieNames?: readonly string[] | undefined;
+}): Promise<Response>;
+export declare function parseSupportedDeepLink(path: string): {
+    workspaceId: string | null;
+    sessionId: string | null;
+    permission: "workspace:read" | "sessions:read";
+} | null;

package/dist/routes/managed-onboarding.d.ts

@@ -0,0 +1,29 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export type ManagedOnboardingRouteOptions = {
+    accountSetupLimiter?: {
+        take(key: string): boolean;
+    };
+    hashPassword?: (password: string) => Promise<string>;
+};
+export declare function registerManagedOnboardingRoutes(app: Hono, deps: ApiRouteDeps, options?: ManagedOnboardingRouteOptions): void;
+/**
+ * Bounded application-tier protection for the public setup bearer endpoint.
+ * The global bucket prevents spoofed/high-cardinality client keys from
+ * multiplying password-hash work, while the per-client bucket limits bursts.
+ * A full key map rejects new clients until an idle bucket can be pruned.
+ */
+export declare class PublicSetupRateLimiter {
+    private readonly options;
+    private readonly buckets;
+    private global;
+    constructor(options?: {
+        globalCapacity?: number;
+        globalRefillPerSecond?: number;
+        clientCapacity?: number;
+        clientRefillPerSecond?: number;
+        maxClientKeys?: number;
+        now?: () => number;
+    });
+    take(key: string): boolean;
+}

package/dist/routes/managed-sign-in-methods.d.ts

@@ -0,0 +1,6 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+export declare function admitManagedSignInMutation(context: Context, deps: ApiRouteDeps): Promise<void>;
+export declare function registerManagedSignInMethodRoutes(app: Hono, deps: ApiRouteDeps): void;
+/** Intercept only database-backed, product-issued explicit connect states. */
+export declare function handleManagedSignInConnectCallback(context: Context, deps: ApiRouteDeps, provider: "google" | "github"): Promise<Response | null>;

package/dist/routes/model-connection-access.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerModelConnectionAccessRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-integration-policy.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationIntegrationPolicyRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-integrations.d.ts

@@ -0,0 +1,6 @@
+import { type AccessContext } from "@opengeni/contracts";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Account administrators or verified full-access organization keys; never workspace keys. */
+export declare function requireOrganizationIntegrationAdmin(context: AccessContext, organizationId: string, authorization?: AccessGrantAuthorization): string;
+export declare function registerOrganizationIntegrationRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-mcp-connections.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationMcpConnectionRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-model-providers.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-recovery.d.ts

@@ -0,0 +1,19 @@
+import { getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorLeaseStamp, requireCanonicalHumanRequestIdentity } from "@opengeni/core/canonical-human-identities";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { acceptOrganizationRecoveryCustody, approveOrganizationRecoveryOperation, cancelOrganizationRecoveryOperation, configureOrganizationRecoveryPolicy, disableOrganizationRecoveryPolicy, executeOrganizationRecoveryOperation, getOrganizationRecoveryOverview, startOrganizationRecoveryOperation } from "@opengeni/db";
+import type { Hono } from "hono";
+export type OrganizationRecoveryRouteServices = {
+    requireCanonicalHumanRequestIdentity: typeof requireCanonicalHumanRequestIdentity;
+    getManagedAuthRequestActorAdmissionStamp: typeof getManagedAuthRequestActorAdmissionStamp;
+    getManagedAuthRequestActorLeaseStamp: typeof getManagedAuthRequestActorLeaseStamp;
+    getOrganizationRecoveryOverview: typeof getOrganizationRecoveryOverview;
+    configureOrganizationRecoveryPolicy: typeof configureOrganizationRecoveryPolicy;
+    acceptOrganizationRecoveryCustody: typeof acceptOrganizationRecoveryCustody;
+    disableOrganizationRecoveryPolicy: typeof disableOrganizationRecoveryPolicy;
+    startOrganizationRecoveryOperation: typeof startOrganizationRecoveryOperation;
+    approveOrganizationRecoveryOperation: typeof approveOrganizationRecoveryOperation;
+    cancelOrganizationRecoveryOperation: typeof cancelOrganizationRecoveryOperation;
+    executeOrganizationRecoveryOperation: typeof executeOrganizationRecoveryOperation;
+};
+export declare function organizationRecoveryHttpError(error: unknown): Error;
+export declare function registerOrganizationRecoveryRoutes(app: Hono, deps: ApiRouteDeps, services?: OrganizationRecoveryRouteServices): void;

package/dist/routes/organization-service-accounts.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationServiceAccountRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-sessions.d.ts

@@ -0,0 +1,26 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/**
+ * Upper bound on the workspace page reads one request performs. The
+ * organization list fans out over every shared workspace in stable id order,
+ * one RLS-scoped transaction per workspace, so an organization with many empty
+ * tenant workspaces would otherwise turn a single request into an unbounded
+ * scan. When the budget runs out the page is returned short with `nextCursor`
+ * pointing at the next unread position.
+ */
+export declare const ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS = 25;
+/**
+ * Base64url JSON `{ workspaceId, cursor, pinnedOffset? }`; `cursor` is the
+ * workspace list cursor or null. A subject's pinned sessions precede the
+ * ordinary keyset page of a workspace; when a page boundary falls inside that
+ * pinned prefix, `pinnedOffset` records how many pinned rows were already
+ * returned so the next page resumes after them instead of repeating them.
+ */
+export type OrganizationSessionListCursor = {
+    workspaceId: string;
+    cursor: string | null;
+    pinnedOffset?: number | undefined;
+};
+export declare function encodeOrganizationSessionListCursor(cursor: OrganizationSessionListCursor): string;
+export declare function decodeOrganizationSessionListCursor(value: string): OrganizationSessionListCursor | null;
+export declare function registerOrganizationSessionRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/personal-github-git-broker.d.ts

@@ -0,0 +1,29 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import { type PersonalGitHubGitBrokerClaims, type PersonalGitHubGitBrokerRepositoryClaim } from "@opengeni/github";
+import type { Hono } from "hono";
+export declare const PERSONAL_GITHUB_GIT_BROKER_PATH_PREFIX = "/v1/git/personal/";
+type BrokerOperation = "info_refs" | "upload_pack" | "receive_pack";
+type BrokerRepository = Omit<PersonalGitHubGitBrokerRepositoryClaim, "routeId">;
+type BrokerAuthority = {
+    claims: PersonalGitHubGitBrokerClaims;
+    repository: BrokerRepository;
+    providerPrincipalId: string;
+};
+export type PersonalGitHubGitBrokerServices = {
+    openClaims: (token: string) => PersonalGitHubGitBrokerClaims | null;
+    resolveAuthority: (claims: PersonalGitHubGitBrokerClaims, routeId: string) => Promise<BrokerAuthority>;
+    authorizeProviderRequest: (authority: BrokerAuthority, destinationUrl: string, operation: "identity_verify" | "repository_verify" | BrokerOperation) => Promise<string>;
+    fetch: typeof fetch;
+    idleTimeoutMs?: number;
+};
+/**
+ * Register the three closed Git smart-HTTP operations. These routes are not a
+ * product-auth bypass: their only credential is the short-lived encrypted,
+ * exact-attempt broker bearer and every physical provider request is fenced
+ * again against current database authority.
+ */
+export declare function registerPersonalGitHubGitBrokerRoutes(app: Hono, deps: ApiRouteDeps, services?: PersonalGitHubGitBrokerServices): void;
+export declare function isPersonalGitHubGitBrokerPath(pathname: string): boolean;
+export declare function isPersonalGitHubGitBrokerRequest(method: string, pathname: string): boolean;
+export declare function handlePersonalGitHubGitBrokerRequest(request: Request, routeId: string, operation: BrokerOperation, services: PersonalGitHubGitBrokerServices): Promise<Response>;
+export {};

package/dist/routes/personal-github.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/pr-review-github.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/pr-review.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/session-artifact-associations.d.ts

@@ -0,0 +1,4 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Exact authorized membership proof, not a paginated artifact discovery API. */
+export declare function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/session-history-imports.d.ts

@@ -0,0 +1,9 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+/** Exact server-only routes with their own bounded, streaming JSON ingress. */
+export declare function isSessionHistoryImportRequest(method: string, pathname: string): boolean;
+/** Count raw UTF-8 bytes before decoding or parsing, including chunked bodies. */
+export declare function readSessionHistoryImportJson(request: Request): Promise<unknown>;
+/** Also used by the composed API for imported-session Send/Steer refusals. */
+export declare function archivedSessionImportErrorResponse(c: Context, error: unknown): Response | null;
+export declare function registerSessionHistoryImportRoutes(app: Hono, deps: ApiRouteDeps): void;