@opengeni/api-router 0.30.3 → 1.0.0

package/src/routes/supergrok.ts

@@ -1,12 +1,23 @@
+import { registerSubscriptionAccountPoolRoutes } from "./subscription-account-pools";
+import {
+  requireSameOriginBrowserMutation,
+  requirePrivateSubscriptionHuman,
+  requireSubscriptionScopeMutation,
+} from "./subscription-pool-access";
+export { managedCookieHuman } from "./subscription-pool-access";
+import { requireOrganizationCodexHuman } from "./codex";
+import {
+  listOrganizationXaiSubscriptions,
+  upsertOrganizationXaiSubscription,
+  updateOrganizationXaiSubscription,
+  updateOrganizationXaiRotation,
+} from "@opengeni/db";
 import {
   configuredModels,
   environmentsEncryptionKeyBytes,
   withXaiSubscriptionCatalogProvider,
 } from "@opengeni/config";
-import {
-  WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
-  type XaiProviderAccountAuthoritySnapshotV1,
-} from "@opengeni/contracts";
+import type { XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 import {
   disconnectXaiSubscriptionCredentialAndRepick,
   ensureXaiRotationSettings,
@@ -23,19 +34,26 @@ import {
   updateXaiRotationSettings,
   upsertXaiSubscriptionCredential,
   wakeXaiCapacityWaiters,
+  encryptEnvironmentValue,
+  decryptEnvironmentValue,
   type XaiSubscriptionAccountMetadata,
 } from "@opengeni/db";
 import { createSignedState, readSignedState } from "@opengeni/github";
-import { getManagedSession, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  externalActorContinuationForAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   XAI_CLIENT_VERSION,
   XaiSubscriptionError,
   fetchXaiSubscriptionModels,
-  fetchXaiVerifiedIdentity,
   pollXaiDeviceCode,
   refreshXaiToken,
   requestXaiDeviceCode,
   xaiAccessTokenExpiry,
+  xaiIdentityFromDeviceTokens,
   type XaiFetch,
   type XaiProxyAuthContext,
 } from "@opengeni/xai-subscription";
@@ -43,11 +61,13 @@ import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import * as z from "zod/v4";
 import { projectClientModel } from "../model-catalog";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { requireConnectOwnerAuthority } from "../integrations/connect-authority";
 
 type XaiAuthoritySnapshot = XaiProviderAccountAuthoritySnapshotV1;
-type ManagedCookieHuman = { subjectId: string };
 
 type SuperGrokConnectState = {
+  externalContinuationEncrypted?: string;
   workspaceId: string;
   scope: "workspace" | "user";
   subjectId: string;
@@ -61,51 +81,6 @@ const connectStartBody = z.object({
   scope: z.enum(["workspace", "user"]).default("workspace"),
 });
 const connectPollBody = z.object({ state: z.string().min(1).max(16_384) });
-const allocatorBody = z.object({
-  enabled: z.boolean(),
-  expectedVersion: z.number().int().positive(),
-});
-const settingsBody = z.object({ rotationEnabled: z.boolean() });
-const renameBody = z.object({ label: z.string().trim().max(200).nullable() });
-
-async function managedCookieHuman(
-  c: Context,
-  deps: ApiRouteDeps,
-): Promise<ManagedCookieHuman | null> {
-  if (
-    deps.settings.productAccessMode !== "managed" ||
-    !deps.managedAuth ||
-    !c.req.header("cookie") ||
-    c.req.header("authorization")
-  ) {
-    return null;
-  }
-  const session = await getManagedSession(c, deps.managedAuth);
-  return session?.user?.id ? { subjectId: `user:${session.user.id}` } : null;
-}
-
-function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void {
-  const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-  if (contentType !== "application/json") {
-    throw new HTTPException(403, { message: "JSON browser request required" });
-  }
-  if (!deps.settings.publicBaseUrl) {
-    throw new HTTPException(503, {
-      message: "managed browser origin is not configured",
-    });
-  }
-  const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
-  if (c.req.header("origin") !== expectedOrigin) {
-    throw new HTTPException(403, {
-      message: "same-origin browser request required",
-    });
-  }
-  if (c.req.header("sec-fetch-site")?.toLowerCase() !== "same-origin") {
-    throw new HTTPException(403, {
-      message: "same-origin fetch metadata required",
-    });
-  }
-}
 
 function requireEnabled(deps: ApiRouteDeps): void {
   if (!deps.settings.supergrokSubscriptionEnabled) {
@@ -115,44 +90,14 @@ function requireEnabled(deps: ApiRouteDeps): void {
   }
 }
 
-async function requirePrivateHuman(
-  c: Context,
-  deps: ApiRouteDeps,
-  workspaceId: string,
-): Promise<{ accountId: string; subjectId: string }> {
-  if (c.req.header("authorization")) {
-    throw new HTTPException(403, {
-      message: "authorization bearer is not allowed for private SuperGrok accounts",
-    });
-  }
-  const human = await managedCookieHuman(c, deps);
-  if (!human) {
-    throw new HTTPException(401, {
-      message: "managed browser session required",
-    });
-  }
-  const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
-  if (grant.subjectId !== human.subjectId) {
-    throw new HTTPException(403, {
-      message: "managed browser identity mismatch",
-    });
-  }
-  return { accountId: grant.accountId, subjectId: grant.subjectId };
-}
-
-async function requireScopeMutation(
+const requirePrivateHuman = (c: Context, deps: ApiRouteDeps, workspaceId: string) =>
+  requirePrivateSubscriptionHuman(c, deps, workspaceId, "SuperGrok");
+export const requireScopeMutation = (
   c: Context,
   deps: ApiRouteDeps,
   workspaceId: string,
-  scope: "workspace" | "user",
-): Promise<{ accountId: string; subjectId: string }> {
-  if (scope === "user") {
-    requireSameOriginBrowserMutation(c, deps);
-    return await requirePrivateHuman(c, deps, workspaceId);
-  }
-  const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-  return { accountId: grant.accountId, subjectId: grant.subjectId };
-}
+  scope: "workspace" | "user" | "organization",
+) => requireSubscriptionScopeMutation(c, deps, workspaceId, scope, "SuperGrok");
 
 async function resolveReadAuthority(
   c: Context,
@@ -168,7 +113,7 @@ async function resolveReadAuthority(
     workspaceId,
     subjectId: grant.subjectId,
   });
-  if (snapshot.scope === "workspace") {
+  if (snapshot.scope !== "user") {
     return { accountId: grant.accountId, subjectId: grant.subjectId, snapshot };
   }
   const human = await requirePrivateHuman(c, deps, workspaceId);
@@ -197,6 +142,7 @@ function accountJson(row: XaiSubscriptionAccountMetadata, activeCredentialId: st
     subject: row.providerAccountId ?? row.accountEmail ?? row.id,
     email: row.accountEmail,
     label: row.label,
+    plan: row.planType,
     status: row.status === "disabled" ? "error" : row.status,
     active: row.id === activeCredentialId,
     expiresAt: row.expiresAt?.toISOString() ?? null,
@@ -307,34 +253,135 @@ async function materializedAuthContext(
   };
 }
 
-async function authorityForAccountMutation(
-  c: Context,
-  deps: ApiRouteDeps,
-  workspaceId: string,
-  credentialId: string,
-): Promise<{
-  accountId: string;
-  subjectId: string;
-  snapshot: XaiAuthoritySnapshot;
-}> {
-  const readGrant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-  const snapshot = await getXaiSubscriptionAccountAuthoritySnapshot(deps.db, {
-    workspaceId,
-    subjectId: readGrant.subjectId,
-    credentialId,
+export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
+  registerSubscriptionAccountPoolRoutes(app, deps, {
+    provider: "xai",
+    route: "supergrok",
+    displayName: "SuperGrok",
+    enabled: () => deps.settings.supergrokSubscriptionEnabled,
+    accountJson,
+    repository: {
+      listOrganizationSubscriptions: listOrganizationXaiSubscriptions,
+      updateOrganizationSubscription: updateOrganizationXaiSubscription,
+      updateOrganizationSubscriptionRotation: updateOrganizationXaiRotation,
+      listSubscriptionAccountsMetadata: listXaiSubscriptionAccountsMetadata,
+      getSubscriptionRotationSettings: getXaiRotationSettings,
+      ensureSubscriptionRotationSettings: ensureXaiRotationSettings,
+      getSubscriptionAccountAuthoritySnapshot: getXaiSubscriptionAccountAuthoritySnapshot,
+      resolveSubscriptionProviderAccountAuthoritySnapshotForAcceptance:
+        resolveXaiProviderAccountAuthoritySnapshotForAcceptance,
+      setActiveSubscriptionCredential: setActiveXaiCredential,
+      updateSubscriptionRotationSettings: updateXaiRotationSettings,
+      updateSubscriptionAllocatorEligibility: updateXaiAllocatorEligibility,
+      renameSubscriptionAccount: renameXaiSubscriptionAccount,
+      disconnectSubscriptionCredentialAndRepick: disconnectXaiSubscriptionCredentialAndRepick,
+      wakeSubscriptionCapacityWaiters: wakeXaiCapacityWaiters,
+    },
   });
-  if (!snapshot) throw new HTTPException(404, { message: "SuperGrok account not found" });
-  const mutation = await requireScopeMutation(c, deps, workspaceId, snapshot.scope);
-  return { ...mutation, snapshot };
-}
+  const { db } = deps;
 
-export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const organizationPath = "/v1/organizations/:organizationId/supergrok";
+  const organizationActor = async (c: Context, mutation = false, providerConsent = false) => {
+    requireEnabled(deps);
+    if (mutation) requireSameOriginBrowserMutation(c, deps);
+    const organizationId = c.req.param("organizationId")!;
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId, { providerConsent });
+    return { organizationId, actorSubjectId: human.subjectId };
+  };
+  app.post(`${organizationPath}/connect/start`, async (c) => {
+    const actor = await organizationActor(c, true, true);
+    try {
+      const start = await requestXaiDeviceCode({ fetch: (deps.xaiFetch ?? fetch) as XaiFetch });
+      const expiresAt = Math.floor(Date.now() / 1000) + start.expiresInSeconds;
+      return c.json({
+        ...start,
+        scope: "organization",
+        state: createSignedState(deps.githubStateSecret, {
+          ...actor,
+          deviceCode: start.deviceCode,
+          intervalSeconds: start.intervalSeconds,
+          expiresAt,
+        }),
+        deviceCode: undefined,
+      });
+    } catch (error) {
+      throw xaiHttpError(error, "Failed to start SuperGrok device login");
+    }
+  });
+  app.post(`${organizationPath}/connect/poll`, async (c) => {
+    const actor = await organizationActor(c, true, true);
+    const parsed = connectPollBody.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) throw new HTTPException(400, { message: "SuperGrok state is required" });
+    const state = readSignedState(parsed.data.state, deps.githubStateSecret) as {
+      organizationId?: string;
+      actorSubjectId?: string;
+      deviceCode?: string;
+      intervalSeconds?: number;
+      expiresAt?: number;
+    } | null;
+    if (
+      !state ||
+      state.organizationId !== actor.organizationId ||
+      state.actorSubjectId !== actor.actorSubjectId ||
+      !state.deviceCode ||
+      !Number.isFinite(state.intervalSeconds) ||
+      !Number.isFinite(state.expiresAt)
+    ) {
+      throw new HTTPException(400, { message: "SuperGrok connect state is invalid or expired" });
+    }
+    if (Math.floor(Date.now() / 1000) >= state.expiresAt!) return c.json({ status: "expired" });
+    try {
+      const poll = await pollXaiDeviceCode(
+        { deviceCode: state.deviceCode, intervalSeconds: state.intervalSeconds! },
+        { fetch: (deps.xaiFetch ?? fetch) as XaiFetch },
+      );
+      if (poll.status !== "authorized") return c.json(poll);
+      const identity = xaiIdentityFromDeviceTokens(poll.tokens);
+      const encryptionKey = environmentsEncryptionKeyBytes(deps.settings);
+      if (!encryptionKey)
+        throw new HTTPException(500, { message: "Connection encryption is not configured" });
+      const connected = await upsertOrganizationXaiSubscription(db, {
+        ...actor,
+        encryptionKey,
+        secret: {
+          version: 1,
+          accessToken: poll.tokens.accessToken,
+          refreshToken: poll.tokens.refreshToken,
+        },
+        providerAccountId: identity.subject,
+        label: identity.name ?? identity.email ?? identity.subject,
+        accountEmail: identity.email,
+        expiresAt:
+          xaiAccessTokenExpiry(poll.tokens.accessToken) ??
+          new Date(Date.now() + poll.tokens.expiresInSeconds * 1000),
+      });
+      return c.json({
+        status: "connected",
+        accountId: connected.account.id,
+        scope: "organization",
+        isActive: connected.isActive,
+        email: identity.email,
+      });
+    } catch (error) {
+      throw xaiHttpError(error, "SuperGrok device login failed");
+    }
+  });
   app.post("/v1/workspaces/:workspaceId/supergrok/connect/start", async (c) => {
     requireEnabled(deps);
     const workspaceId = c.req.param("workspaceId");
     const parsed = connectStartBody.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) throw new HTTPException(400, { message: "invalid SuperGrok scope" });
     const authority = await requireScopeMutation(c, deps, workspaceId, parsed.data.scope);
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      parsed.data.scope === "workspace" ? "workspace:admin" : "connections:write",
+    );
+    const continuation = externalActorContinuationForAuthorization(authorization);
+    const encryptionKey = environmentsEncryptionKeyBytes(deps.settings);
+    if (continuation && !encryptionKey)
+      throw new HTTPException(503, { message: "Credential encryption is unavailable" });
     try {
       const start = await requestXaiDeviceCode({
         fetch: (deps.xaiFetch ?? fetch) as XaiFetch,
@@ -354,6 +401,14 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
           deviceCode: start.deviceCode,
           intervalSeconds: start.intervalSeconds,
           expiresAt,
+          ...(continuation
+            ? {
+                externalContinuationEncrypted: encryptEnvironmentValue(
+                  encryptionKey!,
+                  JSON.stringify(continuation),
+                ),
+              }
+            : {}),
         }),
       });
     } catch (error) {
@@ -389,9 +444,34 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "SuperGrok connect identity changed",
       });
     }
+    const originKey = environmentsEncryptionKeyBytes(deps.settings);
+    const origin =
+      state.externalContinuationEncrypted && originKey
+        ? ExternalActorContinuation.parse(
+            JSON.parse(decryptEnvironmentValue(originKey, state.externalContinuationEncrypted)),
+          )
+        : null;
+    if (state.externalContinuationEncrypted && !origin)
+      throw new HTTPException(503, { message: "Connection origin unavailable" });
+    const requireOrigin = async () => {
+      if (origin)
+        await requireConnectOwnerAuthority(
+          deps.db,
+          {
+            accountId: authority.accountId,
+            workspaceId,
+            subjectId: authority.subjectId,
+            externalContinuation: origin,
+          },
+          state.scope === "workspace" ? "workspace:admin" : "connections:write",
+          origin,
+        );
+    };
+    await requireOrigin();
     if (Math.floor(Date.now() / 1_000) >= state.expiresAt) {
       return c.json({ status: "expired" as const });
     }
+    let phase = "device_token_exchange";
     try {
       const poll = await pollXaiDeviceCode(
         {
@@ -401,9 +481,16 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
         { fetch: (deps.xaiFetch ?? fetch) as XaiFetch },
       );
       if (poll.status !== "authorized") return c.json(poll);
-      const identity = await fetchXaiVerifiedIdentity(poll.tokens.accessToken, {
-        fetch: (deps.xaiFetch ?? fetch) as XaiFetch,
-      });
+      phase = "token_identity";
+      const identity = xaiIdentityFromDeviceTokens(poll.tokens);
+      phase = "credential_persist";
+      await requireOrigin();
+      const liveAuthority = await requireScopeMutation(c, deps, workspaceId, state.scope);
+      if (
+        liveAuthority.accountId !== authority.accountId ||
+        liveAuthority.subjectId !== authority.subjectId
+      )
+        throw new HTTPException(403, { message: "SuperGrok connection identity changed" });
       const encryptionKey = environmentsEncryptionKeyBytes(deps.settings);
       if (!encryptionKey) {
         throw new HTTPException(500, {
@@ -458,37 +545,28 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
         email: identity.email,
       });
     } catch (error) {
+      deps.observability?.warn("SuperGrok connection operation failed", {
+        provider: "xai",
+        providerApi: "oauth",
+        op: phase,
+        outcome: "failed",
+        reason:
+          error instanceof XaiSubscriptionError
+            ? error.kind
+            : error instanceof HTTPException
+              ? "http_exception"
+              : "unexpected",
+        status:
+          error instanceof XaiSubscriptionError
+            ? error.status
+            : error instanceof HTTPException
+              ? error.status
+              : undefined,
+      });
       throw xaiHttpError(error, "SuperGrok device login failed");
     }
   });
 
-  app.get("/v1/workspaces/:workspaceId/supergrok/accounts", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const authority = await resolveReadAuthority(c, deps, workspaceId);
-    const [accounts, settings] = await Promise.all([
-      listXaiSubscriptionAccountsMetadata(deps.db, {
-        workspaceId,
-        subjectId: authority.subjectId,
-      }),
-      getXaiRotationSettings(deps.db, {
-        workspaceId,
-        subjectId: authority.subjectId,
-        authoritySnapshot: authority.snapshot,
-      }),
-    ]);
-    const activeCredentialId = settings?.activeCredentialId ?? null;
-    return c.json({
-      accounts: accounts.map((account) => accountJson(account, activeCredentialId)),
-      activeAccountId: activeCredentialId,
-      settings: {
-        rotationEnabled: settings?.rotationEnabled ?? true,
-        rotationStrategy: "sharded" as const,
-        activeCredentialId,
-      },
-    });
-  });
-
   app.get("/v1/workspaces/:workspaceId/supergrok/status", async (c) => {
     requireEnabled(deps);
     const workspaceId = c.req.param("workspaceId");
@@ -529,8 +607,9 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
     } catch {
       valid = false;
     }
-    const catalog = valid
-      ? configuredModels(withXaiSubscriptionCatalogProvider(deps.settings))
+    const catalogSettings = valid ? (await deps.resolveCatalogSettings()).settings : null;
+    const catalog = catalogSettings
+      ? configuredModels(withXaiSubscriptionCatalogProvider(catalogSettings))
           .filter(
             (model) =>
               model.credentialSource.kind === "connected_subscription" &&
@@ -551,167 +630,4 @@ export function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void {
       },
     });
   });
-
-  app.post("/v1/workspaces/:workspaceId/supergrok/accounts/:accountId/activate", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const credentialId = c.req.param("accountId");
-    const authority = await authorityForAccountMutation(c, deps, workspaceId, credentialId);
-    const activated = await setActiveXaiCredential(deps.db, {
-      accountId: authority.accountId,
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: authority.snapshot,
-      credentialId,
-    });
-    if (!activated)
-      throw new HTTPException(409, {
-        message: "SuperGrok account requires relogin",
-      });
-    await wakeXaiCapacityWaiters(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: authority.snapshot,
-      reason: "xai_active_credential_changed",
-    });
-    return c.json({ activated: true, accountId: credentialId });
-  });
-
-  app.patch("/v1/workspaces/:workspaceId/supergrok/settings", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const parsed = settingsBody.safeParse(await c.req.json().catch(() => null));
-    if (!parsed.success) throw new HTTPException(400, { message: "rotationEnabled is required" });
-    const readAuthority = await resolveReadAuthority(c, deps, workspaceId);
-    const authority = await requireScopeMutation(
-      c,
-      deps,
-      workspaceId,
-      readAuthority.snapshot.scope,
-    );
-    const current = await ensureXaiRotationSettings(deps.db, {
-      accountId: authority.accountId,
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: readAuthority.snapshot,
-    });
-    const updated = await updateXaiRotationSettings(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: readAuthority.snapshot,
-      expectedVersion: current.version,
-      rotationEnabled: parsed.data.rotationEnabled,
-    }).catch(() => null);
-    if (!updated) throw new HTTPException(409, { message: "SuperGrok settings changed" });
-    await wakeXaiCapacityWaiters(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: readAuthority.snapshot,
-      reason: "xai_rotation_settings_changed",
-    });
-    return c.json({
-      rotationEnabled: updated.rotationEnabled,
-      rotationStrategy: "sharded" as const,
-      activeCredentialId: updated.activeCredentialId,
-    });
-  });
-
-  app.patch("/v1/workspaces/:workspaceId/supergrok/accounts/:accountId/allocator", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const credentialId = c.req.param("accountId");
-    const authority = await authorityForAccountMutation(c, deps, workspaceId, credentialId);
-    const parsed = allocatorBody.safeParse(await c.req.json().catch(() => null));
-    if (!parsed.success) {
-      throw new HTTPException(400, {
-        message: "enabled and expectedVersion are required",
-      });
-    }
-    const result = await updateXaiAllocatorEligibility(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      credentialId,
-      enabled: parsed.data.enabled,
-      expectedVersion: parsed.data.expectedVersion,
-    });
-    if (result.kind === "not_found") {
-      throw new HTTPException(404, {
-        message: "SuperGrok account not found",
-      });
-    }
-    const response = {
-      allocatorEnabled: result.allocatorEnabled,
-      allocatorVersion: result.allocatorVersion,
-      allocatorUpdatedAt: result.allocatorUpdatedAt?.toISOString() ?? null,
-      changed: result.kind === "updated",
-    };
-    if (result.kind === "updated") {
-      await wakeXaiCapacityWaiters(deps.db, {
-        workspaceId,
-        subjectId: authority.subjectId,
-        authoritySnapshot: authority.snapshot,
-        reason: "xai_allocator_eligibility_changed",
-      });
-    }
-    return result.kind === "conflict" ? c.json(response, 409) : c.json(response);
-  });
-
-  app.patch("/v1/workspaces/:workspaceId/supergrok/accounts/:accountId", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const credentialId = c.req.param("accountId");
-    const authority = await authorityForAccountMutation(c, deps, workspaceId, credentialId);
-    const parsed = renameBody.safeParse(await c.req.json().catch(() => null));
-    if (!parsed.success) throw new HTTPException(400, { message: "label is invalid" });
-    const account = await renameXaiSubscriptionAccount(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      credentialId,
-      label: parsed.data.label || null,
-    });
-    if (!account)
-      throw new HTTPException(404, {
-        message: "SuperGrok account not found",
-      });
-    const settings = await getXaiRotationSettings(deps.db, {
-      workspaceId,
-      subjectId: authority.subjectId,
-      authoritySnapshot: authority.snapshot,
-    });
-    return c.json(accountJson(account, settings?.activeCredentialId ?? null));
-  });
-
-  app.delete("/v1/workspaces/:workspaceId/supergrok/accounts/:accountId", async (c) => {
-    requireEnabled(deps);
-    const workspaceId = c.req.param("workspaceId");
-    const credentialId = c.req.param("accountId");
-    const authority = await authorityForAccountMutation(c, deps, workspaceId, credentialId);
-    if (authority.snapshot.scope === "user") {
-      await wakeXaiCapacityWaiters(deps.db, {
-        workspaceId,
-        subjectId: authority.subjectId,
-        authoritySnapshot: authority.snapshot,
-        reason: "xai_credential_disconnecting",
-      });
-    }
-    const result = await disconnectXaiSubscriptionCredentialAndRepick(deps.db, {
-      accountId: authority.accountId,
-      workspaceId,
-      subjectId: authority.subjectId,
-      credentialId,
-      authoritySnapshot: authority.snapshot,
-    });
-    if (result.disconnected && authority.snapshot.scope === "workspace") {
-      await wakeXaiCapacityWaiters(deps.db, {
-        workspaceId,
-        subjectId: authority.subjectId,
-        authoritySnapshot: WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
-        reason: "xai_credential_disconnected",
-      });
-    }
-    return c.json({
-      disconnected: result.disconnected,
-      newActiveId: result.newActiveCredentialId,
-    });
-  });
 }