@opengeni/api-router 0.30.3 → 2.1.0-canary.0

package/src/routes/environments.ts

@@ -5,8 +5,6 @@ import {
   VariableSetVariableName,
 } from "@opengeni/contracts";
 import {
-  countActiveSessionsUsingVariableSet,
-  countScheduledTasksUsingVariableSet,
   countVariableSets,
   createVariableSet,
   decryptVariableSetValue,
@@ -18,10 +16,16 @@ import {
   readVariableSetSecretAtomically,
   setVariableSetVariable,
   updateVariableSet,
+  VariableSetAttachedError,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant, requireLiteralPermission, requirePermission } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  requireLiteralPermission,
+  requirePermission,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   assertAllowedVariableSetVariableName,
@@ -45,15 +49,35 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const grant = await requireAccessGrant(c, deps, workspaceId);
       requirePermission(grant, "variable-sets:list");
       requirePermission(grant, "secrets:list");
-      return c.json(await listVariableSets(db, workspaceId));
+      return c.json(
+        await listVariableSets(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+        }),
+      );
     });
 
     app.post(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       const key = requireVariableSetEncryption(settings);
       const payload = CreateVariableSetRequest.parse(await c.req.json());
+      if (prefix.endsWith("/environments") && payload.scope !== "workspace") {
+        throw new HTTPException(422, {
+          message: "the legacy environments route only creates workspace-scoped variable sets",
+        });
+      }
+      if (
+        payload.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") !== true
+      ) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
       if (payload.variables.length > 0) {
         requirePermission(grant, "secrets:write");
       }
@@ -73,12 +97,17 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
         }
         variableNames.add(variable.name);
       }
-      if ((await countVariableSets(db, workspaceId)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
+      const access = {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+      };
+      if ((await countVariableSets(db, access, payload.scope)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
         throw new HTTPException(422, {
           message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE} variable sets`,
         });
       }
-      if (await getVariableSetByName(db, workspaceId, name)) {
+      if (await getVariableSetByName(db, access, name, payload.scope)) {
         throw new HTTPException(409, {
           message: `variable set name is already in use: ${name}`,
         });
@@ -88,6 +117,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const created = await createVariableSet(db, {
         accountId: grant.accountId,
         workspaceId,
+        scope: payload.scope,
+        subjectId: grant.subjectId,
+        allowOrganization: payload.scope === "organization",
         name,
         description: payload.description ?? null,
         variables: payload.variables.map((variable) => ({
@@ -108,7 +140,7 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const grant = await requireAccessGrant(c, deps, workspaceId);
       requirePermission(grant, "variable-sets:read");
       requirePermission(grant, "secrets:list");
-      return c.json(await requireVariableSetForApi(db, workspaceId, c.req.param("variableSetId")!));
+      return c.json(await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!));
     });
 
     if (prefix.endsWith("/variable-sets")) {
@@ -139,27 +171,47 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.patch(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
       const payload = UpdateVariableSetRequest.parse(await c.req.json());
       const name = payload.name !== undefined ? trimmedVariableSetName(payload.name) : undefined;
       if (name !== undefined && name !== variableSet.name) {
-        const existing = await getVariableSetByName(db, workspaceId, name);
+        const existing = await getVariableSetByName(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          name,
+          variableSet.scope,
+        );
         if (existing && existing.id !== variableSet.id) {
           throw new HTTPException(409, {
             message: `variable set name is already in use: ${name}`,
           });
         }
       }
-      const updated = await updateVariableSet(db, workspaceId, variableSet.id, {
-        ...(name !== undefined ? { name } : {}),
-        ...(payload.description !== undefined ? { description: payload.description } : {}),
-      });
+      const updated = await updateVariableSet(
+        db,
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        variableSet.id,
+        {
+          ...(name !== undefined ? { name } : {}),
+          ...(payload.description !== undefined ? { description: payload.description } : {}),
+          allowOrganization,
+        },
+      );
       await recordVariableSetAuditEvent(db, {
         grant,
         action: "variable_set.updated",
@@ -170,35 +222,36 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const attachedTasks = await countScheduledTasksUsingVariableSet(
-        db,
-        workspaceId,
-        variableSet.id,
-      );
-      if (attachedTasks > 0) {
-        throw new HTTPException(409, {
-          message: `variable set is attached to ${attachedTasks} scheduled task(s); detach first`,
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
         });
       }
-      const activeSessions = await countActiveSessionsUsingVariableSet(
-        db,
-        workspaceId,
-        variableSet.id,
-      );
-      if (activeSessions > 0) {
-        throw new HTTPException(409, {
-          message: `variable set is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first`,
-        });
+      try {
+        await deleteVariableSet(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+          },
+          variableSet.id,
+          { allowOrganization },
+        );
+      } catch (error) {
+        if (error instanceof VariableSetAttachedError) {
+          throw new HTTPException(409, { message: error.message });
+        }
+        throw error;
       }
-      await deleteVariableSet(db, workspaceId, variableSet.id);
       await recordVariableSetAuditEvent(db, {
         grant,
         action: "variable_set.deleted",
@@ -209,16 +262,21 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
       const key = requireVariableSetEncryption(settings);
       const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(
-        db,
-        workspaceId,
-        c.req.param("variableSetId")!,
-      );
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
       const payload = SetVariableSetVariableRequest.parse(await c.req.json());
       const exists = variableSet.variables.some((variable) => variable.name === name);
       if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT) {
@@ -229,9 +287,11 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       const metadata = await setVariableSetVariable(db, {
         accountId: grant.accountId,
         workspaceId,
+        subjectId: grant.subjectId,
         variableSetId: variableSet.id,
         name,
         valueEncrypted: encryptVariableSetValue(key, payload.value),
+        allowOrganization,
       });
       await recordVariableSetAuditEvent(db, {
         grant,
@@ -244,16 +304,28 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
+      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+      const grant = authorization.grant;
       requirePermission(grant, "variable-sets:write");
       requirePermission(grant, "secrets:write");
       const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(
-        db,
+      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
+      const allowOrganization =
+        variableSet.scope === "organization" &&
+        authorization.accountGrant?.permissions.includes("account:admin") === true;
+      if (variableSet.scope === "organization" && !allowOrganization) {
+        throw new HTTPException(403, {
+          message: "missing permission: account:admin",
+        });
+      }
+      const deleted = await deleteVariableSetVariable(db, {
+        accountId: grant.accountId,
         workspaceId,
-        c.req.param("variableSetId")!,
-      );
-      const deleted = await deleteVariableSetVariable(db, workspaceId, variableSet.id, name);
+        subjectId: grant.subjectId,
+        variableSetId: variableSet.id,
+        name,
+        allowOrganization,
+      });
       if (!deleted) {
         throw new HTTPException(404, {
           message: "variable set variable not found",

package/src/routes/files.ts

@@ -23,6 +23,7 @@ import {
   createFileUpload,
   getFileUpload,
   getGeneratedImageArtifact,
+  recordAuditEvent,
   getGeneratedVideoArtifact,
   getFilesForSubject,
   getRetainedFileArtifact,
@@ -42,6 +43,7 @@ import {
 } from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { retryWhileMissing } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { buildFilesMcpServer } from "../mcp/files";
 
@@ -100,6 +102,23 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       objectKey,
       expiresAt: signed.expiresAt,
     });
+    // Every principal-facing signed URL issuance is a
+    // metadata-only audit fact. Awaited before the URL leaves the platform:
+    // no recorded fact, no bearer capability. Never the URL or object key.
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_upload.issued",
+      targetType: "workspace_file",
+      targetId: fileId,
+      metadata: {
+        fileId,
+        contentType: payload.contentType,
+        sizeBytes: payload.sizeBytes,
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       CreateFileUploadResponse.parse({
         fileId: upload.file.id,
@@ -231,11 +250,13 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       const file = await rejectAndCleanObject(409, "file upload has expired", "expired");
       return c.json(CompleteFileUploadResponse.parse({ file }));
     }
-    const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException(409, {
-        message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}`,
-      });
+    const head = await retryWhileMissing(async () => {
+      if (!(await objectStorage.fileExists(upload.file))) return null;
+      return await objectStorage.headFile(upload.file);
     });
+    if (!head) {
+      throw new HTTPException(409, { message: "uploaded object is not available" });
+    }
     if (Number(head.ContentLength ?? -1) !== upload.file.sizeBytes) {
       const file = await rejectAndCleanObject(
         422,
@@ -324,7 +345,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/artifacts/:artifactId/playback-source", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
       throw new HTTPException(503, { message: "object storage is not configured" });
     }
@@ -337,10 +358,26 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(409, { message: `generated video is ${retained.file.status}` });
     }
     const file = generatedVideoFileAsset(retained.file);
-    if (!(await objectStorage.fileExists(file))) {
+    const videoPresent = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!videoPresent) {
       throw new HTTPException(410, { message: "generated video bytes are unavailable" });
     }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_url.issued",
+      targetType: "retained_artifact",
+      targetId: artifactId,
+      metadata: {
+        artifactId,
+        kind: "video_playback",
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       VideoArtifactPlaybackSource.parse({
         schemaVersion: 1,
@@ -416,7 +453,26 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (file.status !== "ready") {
       throw new HTTPException(409, { message: `file is ${file.status}` });
     }
+    const present = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!present) {
+      throw new HTTPException(410, { message: "file bytes are unavailable" });
+    }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_url.issued",
+      targetType: "workspace_file",
+      targetId: file.id,
+      metadata: {
+        fileId: file.id,
+        kind: "download",
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       FileDownloadUrlResponse.parse({
         url: signed.url,
@@ -480,16 +536,21 @@ async function serveRetainedArtifactContent(
     ...(range.contentRange ? { "Content-Range": range.contentRange } : {}),
   };
   if (range.kind === "empty") {
-    if (!(await objectStorage.fileExists(file))) {
+    const present = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!present) {
       return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
     }
     return c.body(null, 200, headers);
   }
 
-  const bytes = await objectStorage.getFileRange(file, {
-    start: range.start,
-    end: range.end,
-  });
+  const bytes = await retryWhileMissing(async () =>
+    objectStorage.getFileRange(file, {
+      start: range.start,
+      end: range.end,
+    }),
+  );
   if (!bytes) {
     return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
   }

package/src/routes/install.ts

@@ -44,15 +44,34 @@ const BAKED_DIR = new URL("baked/", INSTALL_DIR);
 // The static text artifacts served verbatim, with their content types. Each is
 // read once at first request and memoized (committed files; immutable per deploy).
 const TEXT_ASSETS: Record<string, { file: string; contentType: string }> = {
-  "/install.sh": { file: "install.sh", contentType: "text/x-shellscript; charset=utf-8" },
-  "/install.ps1": { file: "install.ps1", contentType: "text/plain; charset=utf-8" },
-  "/uninstall.sh": { file: "uninstall.sh", contentType: "text/x-shellscript; charset=utf-8" },
+  "/install.sh": {
+    file: "install.sh",
+    contentType: "text/x-shellscript; charset=utf-8",
+  },
+  "/install.ps1": {
+    file: "install.ps1",
+    contentType: "text/plain; charset=utf-8",
+  },
+  "/uninstall.sh": {
+    file: "uninstall.sh",
+    contentType: "text/x-shellscript; charset=utf-8",
+  },
   "/opengeni-agent-minisign.pub": {
     file: "opengeni-agent-minisign.pub",
     contentType: "text/plain; charset=utf-8",
   },
 };
 
+// Non-executable resources needed to assemble a complete platform bundle. These
+// stay committed beside the installer rather than depending on a release/CDN so
+// an exact-SHA local or private deployment remains self-contained.
+const COMMITTED_BINARY_ASSETS: Record<string, { file: string; contentType: string }> = {
+  "OpenGeni-Agent.icns": {
+    file: "OpenGeni-Agent.icns",
+    contentType: "image/icns",
+  },
+};
+
 const assetCache = new Map<string, string>();
 
 async function loadAsset(file: string): Promise<string> {
@@ -73,26 +92,40 @@ async function loadAsset(file: string): Promise<string> {
 // `curl https://<this-host>/install.sh | sh` installs the exact agent that
 // matches the API it enrolls against, with NO dependency on a public CDN (which a
 // private/air-gapped deploy may not even resolve). When a public base URL is
-// configured we therefore rewrite each script's default-base-URL marker line to
-// that origin before serving. The user's OPENGENI_INSTALL_BASE_URL env override
-// still wins at run time (the scripts use `:-default`); only the built-in DEFAULT
-// changes. The marker lines are kept shape-stable in agent/install/install.{sh,ps1}.
-const DEFAULT_BASE_REWRITES: Record<string, (base: string) => { from: string; to: string }> = {
-  "install.sh": (base) => ({
-    from: 'OPENGENI_INSTALL_DEFAULT_BASE_URL="https://get.opengeni.ai"',
-    to: `OPENGENI_INSTALL_DEFAULT_BASE_URL="${base}"`,
-  }),
-  "install.ps1": (base) => ({
-    from: "$OpengeniInstallDefaultBaseUrl = 'https://get.opengeni.ai'",
-    to: `$OpengeniInstallDefaultBaseUrl = '${base}'`,
-  }),
+// configured we therefore rewrite each script's release-asset AND connection-API
+// default markers to that origin before serving. The user's
+// OPENGENI_INSTALL_BASE_URL / OPENGENI_API_URL overrides still win at run time;
+// only the built-in defaults change. The marker lines are kept shape-stable in
+// agent/install/install.{sh,ps1}.
+type DefaultRewrite = { from: string; to: string };
+
+const DEFAULT_BASE_REWRITES: Record<string, (base: string) => DefaultRewrite[]> = {
+  "install.sh": (base) => [
+    {
+      from: 'OPENGENI_INSTALL_DEFAULT_BASE_URL="https://get.opengeni.ai"',
+      to: `OPENGENI_INSTALL_DEFAULT_BASE_URL="${base}"`,
+    },
+    {
+      from: 'OPENGENI_API_DEFAULT_URL="https://app.opengeni.ai"',
+      to: `OPENGENI_API_DEFAULT_URL="${base}"`,
+    },
+  ],
+  "install.ps1": (base) => [
+    {
+      from: "$OpengeniInstallDefaultBaseUrl = 'https://get.opengeni.ai'",
+      to: `$OpengeniInstallDefaultBaseUrl = '${base}'`,
+    },
+    {
+      from: "$OpengeniApiDefaultUrl = 'https://app.opengeni.ai'",
+      to: `$OpengeniApiDefaultUrl = '${base}'`,
+    },
+  ],
 };
 
-// Rewrite a served script's default release-asset base URL to this deployment's
-// own public origin. A no-op when no public base URL is configured (the public
-// archive default stands), when the URL is not absolute http(s) (never serve a
-// script with a broken base), or when the file has no marker (script drift — fail
-// safe to serving it verbatim rather than crashing the install surface).
+// Rewrite a served script's default release-asset and connection-API URLs to this
+// deployment's own public origin. A no-op when no public base URL is configured,
+// when the URL is not absolute http(s), or when either marker is absent (script
+// drift — fail safe to serving it verbatim rather than splitting the two origins).
 function rewriteDefaultBaseUrl(
   file: string,
   body: string,
@@ -102,11 +135,11 @@ function rewriteDefaultBaseUrl(
     return body;
   }
   const base = publicBaseUrl.replace(/\/+$/, "");
-  const rule = DEFAULT_BASE_REWRITES[file]?.(base);
-  if (!rule || !body.includes(rule.from)) {
+  const rules = DEFAULT_BASE_REWRITES[file]?.(base);
+  if (!rules || rules.some((rule) => !body.includes(rule.from))) {
     return body;
   }
-  return body.replace(rule.from, rule.to);
+  return rules.reduce((rewritten, rule) => rewritten.replace(rule.from, rule.to), body);
 }
 
 // The content type for a baked release asset. The binary is an
@@ -173,6 +206,18 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
   // un-baked asset). The baked path makes the agent the API enrolls against
   // identical to the API that serves it — no version skew, no extra hop.
   async function serveAsset(asset: string, redirectUrl: string): Promise<Response> {
+    const committed = COMMITTED_BINARY_ASSETS[asset];
+    if (committed) {
+      const buf = await readFile(new URL(committed.file, INSTALL_DIR));
+      return new Response(buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength), {
+        status: 200,
+        headers: {
+          "content-type": committed.contentType,
+          "cache-control": "public, max-age=3600",
+          "x-opengeni-agent-source": "committed",
+        },
+      });
+    }
     const baked = await readBaked(asset);
     if (baked !== null) {
       return new Response(baked, {
@@ -189,7 +234,10 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
     // Not baked here → the GitHub Release is the source of truth (the public
     // archive + the documented install.sh fallback). 302 so the client refetches.
-    return new Response(null, { status: 302, headers: { location: redirectUrl } });
+    return new Response(null, {
+      status: 302,
+      headers: { location: redirectUrl },
+    });
   }
 
   // `latest` → the BAKED binary if present, else the operator-selected immutable
@@ -217,10 +265,14 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
     app.get(`/agent/${channel}/:manifestAsset`, (c) => {
       const manifestAsset = c.req.param("manifestAsset");
       if (manifestAsset !== "manifest.json" && manifestAsset !== "manifest.json.minisig") {
-        throw new HTTPException(404, { message: "update manifest asset not found" });
+        throw new HTTPException(404, {
+          message: "update manifest asset not found",
+        });
       }
       if (!version) {
-        throw new HTTPException(404, { message: `${channel} agent channel is not configured` });
+        throw new HTTPException(404, {
+          message: `${channel} agent channel is not configured`,
+        });
       }
       return new Response(null, {
         status: 302,
@@ -240,7 +292,9 @@ export function registerInstallRoutes(app: Hono, deps: ApiRouteDeps): void {
     // `/agent/latest/<asset>` is handled by the more specific route above; any
     // other version segment must be the `v<ver>` shape.
     if (!VERSION_SEG.test(versionSeg) || !ASSET_NAME.test(asset)) {
-      throw new HTTPException(400, { message: "invalid version or asset name" });
+      throw new HTTPException(400, {
+        message: "invalid version or asset name",
+      });
     }
     return serveAsset(asset, `${releasesBase}/download/agent-${versionSeg}/${asset}`);
   });

package/src/routes/integration-facets.ts

@@ -13,6 +13,7 @@ import {
 } from "@opengeni/core";
 import {
   configureIntegrationFacet,
+  integrationFacetConfigureRequestDigest,
   IntegrationFacetBindingOwnershipConflictError,
   IntegrationFacetBindingVersionConflictError,
   IntegrationFacetBindingVersionRequiredError,
@@ -22,6 +23,7 @@ import {
   IntegrationFacetOperationIdempotencyError,
   listIntegrationInstanceFacets,
   removeIntegrationFacet,
+  replayCompletedIntegrationFacetOperation,
   setIntegrationFacetLifecycle,
 } from "@opengeni/db";
 import type { Hono } from "hono";
@@ -126,6 +128,33 @@ export function registerIntegrationFacetRoutes(app: Hono, deps: ApiRouteDeps): v
       const instanceKey = decoded(c.req.param("instanceKey"));
       const facetKey = decoded(c.req.param("facetKey"));
       try {
+        const replayed =
+          await replayCompletedIntegrationFacetOperation<IntegrationFacetMutationResult>(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+            capabilityId,
+            instanceKey,
+            facetKey,
+            idempotencyKey: payload.idempotencyKey,
+            kind: "configure",
+            expectedRequestDigest: integrationFacetConfigureRequestDigest({
+              capabilityId,
+              instanceKey,
+              facetKey,
+              displayName: payload.displayName,
+              config: payload.config,
+              ...(payload.expectedVersion !== undefined
+                ? { expectedVersion: payload.expectedVersion }
+                : {}),
+            }),
+          });
+        if (replayed) {
+          return c.json(
+            IntegrationFacetMutationResult.parse(replayed),
+            payload.expectedVersion === undefined ? 201 : 200,
+          );
+        }
         const instance = await listIntegrationInstanceFacets(
           deps.db,
           workspaceId,