@opengeni/api-router 0.5.2 → 0.5.4

package/src/routes/packs.ts

@@ -23,7 +23,7 @@ import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { validateEnvironmentAttachment } from "@opengeni/core";
+import { validateVariableSetAttachment } from "@opengeni/core";
 import {
   assertPackSandboxImageCompatible,
   buildMarketingDailyAnalysisAgentConfig,
@@ -32,10 +32,7 @@ import {
   MARKETING_SOCIAL_PACK_ID,
   resolveCapabilityPack,
 } from "@opengeni/core";
-import {
-  createValidatedScheduledTask,
-  syncCreatedScheduledTask,
-} from "@opengeni/core";
+import { createValidatedScheduledTask, syncCreatedScheduledTask } from "@opengeni/core";
 
 export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { settings, db, objectStorage, workflowClient } = deps;
@@ -56,7 +53,9 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
-      throw new HTTPException(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
+      throw new HTTPException(409, {
+        message: `pack id ${manifest.id} is a built-in pack and cannot be replaced`,
+      });
     }
     const { pack, created } = await registerWorkspacePack(db, {
       accountId: grant.accountId,
@@ -73,7 +72,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (isBuiltInCapabilityPack(packId)) {
       throw new HTTPException(409, { message: "built-in packs cannot be unregistered" });
     }
-    if (!await getWorkspacePack(db, workspaceId, packId)) {
+    if (!(await getWorkspacePack(db, workspaceId, packId))) {
       throw new HTTPException(404, { message: "pack not found" });
     }
     // Disable installations before deleting the registration so a crash in
@@ -84,7 +83,11 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (installation && installation.status === "active") {
       await updatePackInstallationStatus(db, workspaceId, packId, "disabled");
     }
-    const capabilityInstallation = await getCapabilityInstallation(db, workspaceId, `pack:${packId}`);
+    const capabilityInstallation = await getCapabilityInstallation(
+      db,
+      workspaceId,
+      `pack:${packId}`,
+    );
     if (capabilityInstallation && capabilityInstallation.status === "active") {
       await disableCapabilityInstallation(db, workspaceId, `pack:${packId}`);
     }
@@ -115,22 +118,41 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
     await assertPackSandboxImageCompatible(db, workspaceId, pack);
     const existing = await getPackInstallation(db, workspaceId, pack.id);
     const payload = EnablePackRequest.parse(await c.req.json());
-    // Re-enabling without environmentId keeps the stored attachment instead of
+    // Re-enabling without variableSetId keeps the stored attachment instead of
     // silently dropping it; the inherited attachment is re-validated below in
-    // case the environment was deleted or its variables changed since. The
-    // inherited attachment was authorized with environments:use when it was
+    // case the variableSet was deleted or its variables changed since. The
+    // inherited attachment was authorized with variableSets:use when it was
     // first attached, so only a fresh attachment re-checks that permission.
-    const storedEnvironmentId = typeof existing?.metadata.environmentId === "string" ? existing.metadata.environmentId : undefined;
-    const environmentId = payload.environmentId ?? storedEnvironmentId;
-    if (pack.environment?.required && !environmentId) {
-      throw new HTTPException(422, { message: "this pack requires an environment attachment; pass environmentId" });
+    // Back-compat: installations enabled before the Variable Set rename stored
+    // the attachment under `metadata.environmentId`; read it as a fallback so a
+    // re-enable without an explicit id still inherits the existing attachment.
+    const storedVariableSetId =
+      typeof existing?.metadata.variableSetId === "string"
+        ? existing.metadata.variableSetId
+        : typeof existing?.metadata.environmentId === "string"
+          ? existing.metadata.environmentId
+          : undefined;
+    const variableSetId = payload.variableSetId ?? storedVariableSetId;
+    if (pack.variableSet?.required && !variableSetId) {
+      throw new HTTPException(422, {
+        message: "this pack requires a variableSet attachment; pass variableSetId",
+      });
     }
-    if (environmentId) {
-      const environment = await validateEnvironmentAttachment({ settings, db }, grant, workspaceId, environmentId, { preauthorized: !payload.environmentId });
-      const missing = (pack.environment?.requiredVariables ?? [])
-        .filter((name) => !environment.variables.some((variable) => variable.name === name));
+    if (variableSetId) {
+      const variableSet = await validateVariableSetAttachment(
+        { settings, db },
+        grant,
+        workspaceId,
+        variableSetId,
+        { preauthorized: !payload.variableSetId },
+      );
+      const missing = (pack.variableSet?.requiredVariables ?? []).filter(
+        (name) => !variableSet.variables.some((variable) => variable.name === name),
+      );
       if (missing.length > 0) {
-        throw new HTTPException(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
+        throw new HTTPException(422, {
+          message: `variableSet is missing required variable(s): ${missing.join(", ")}`,
+        });
       }
     }
     const installation = await enablePackInstallation(db, {
@@ -140,69 +162,84 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
       metadata: {
         ...payload.metadata,
         packVersion: pack.version,
-        ...(environmentId ? { environmentId } : {}),
+        ...(variableSetId ? { variableSetId } : {}),
       },
     });
     return c.json(installation, existing ? 200 : 201);
   });
 
-  app.post("/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
-    const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
-    const installation = await getPackInstallation(db, workspaceId, pack.id);
-    if (installation?.status !== "active") {
-      throw new HTTPException(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
-    }
-    const payload = MarketingDailyAnalysisTaskRequest.parse(await c.req.json());
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
-    const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
-    if (connections.length === 0) {
-      throw new HTTPException(422, { message: "at least one connected social account is required" });
-    }
-    await validateDocumentBaseIds(db, workspaceId, payload.documentBaseIds);
-    const agentConfig = buildMarketingDailyAnalysisAgentConfig({
-      connections,
-      documentBaseIds: payload.documentBaseIds,
-      ...(payload.promptInstructions ? { promptInstructions: payload.promptInstructions } : {}),
-    });
-    // Installation-inherited environment attachment: it was authorized with
-    // environments:use at pack-enable time, so the scheduled_tasks:manage
-    // caller here is not re-checked for that permission.
-    const installationEnvironmentId = typeof installation.metadata.environmentId === "string"
-      ? installation.metadata.environmentId
-      : undefined;
-    const task = await createValidatedScheduledTask({
-      settings,
-      db,
-      objectStorage,
-      grant,
-      environmentPreauthorized: true,
-      payload: {
-        name: payload.name ?? "Daily social media analysis",
-        status: payload.status,
-        schedule: {
-          type: "calendar",
-          timeZone: payload.timeZone,
-          hour: payload.hour,
-          minute: payload.minute,
-        },
-        runMode: payload.runMode,
-        overlapPolicy: payload.overlapPolicy,
-        agentConfig,
-        ...(installationEnvironmentId ? { environmentId: installationEnvironmentId } : {}),
-        metadata: {
-          packId: pack.id,
-          packVersion: pack.version,
-          packTemplateId: "daily-social-analysis",
-          socialConnectionIds: connections.map((connection) => connection.id),
-          documentBaseIds: payload.documentBaseIds,
+  app.post(
+    "/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
+      const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
+      const installation = await getPackInstallation(db, workspaceId, pack.id);
+      if (installation?.status !== "active") {
+        throw new HTTPException(409, {
+          message: "enable the marketing social pack before creating its scheduled tasks",
+        });
+      }
+      const payload = MarketingDailyAnalysisTaskRequest.parse(await c.req.json());
+      await requireLimit(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        action: "schedule:create",
+        quantity: 1,
+      });
+      const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
+      if (connections.length === 0) {
+        throw new HTTPException(422, {
+          message: "at least one connected social account is required",
+        });
+      }
+      await validateDocumentBaseIds(db, workspaceId, payload.documentBaseIds);
+      const agentConfig = buildMarketingDailyAnalysisAgentConfig({
+        connections,
+        documentBaseIds: payload.documentBaseIds,
+        ...(payload.promptInstructions ? { promptInstructions: payload.promptInstructions } : {}),
+      });
+      // Installation-inherited variableSet attachment: it was authorized with
+      // variableSets:use at pack-enable time, so the scheduled_tasks:manage
+      // caller here is not re-checked for that permission.
+      const installationVariableSetId =
+        typeof installation.metadata.variableSetId === "string"
+          ? installation.metadata.variableSetId
+          : typeof installation.metadata.environmentId === "string"
+            ? installation.metadata.environmentId
+            : undefined;
+      const task = await createValidatedScheduledTask({
+        settings,
+        db,
+        objectStorage,
+        grant,
+        variableSetPreauthorized: true,
+        payload: {
+          name: payload.name ?? "Daily social media analysis",
+          status: payload.status,
+          schedule: {
+            type: "calendar",
+            timeZone: payload.timeZone,
+            hour: payload.hour,
+            minute: payload.minute,
+          },
+          runMode: payload.runMode,
+          overlapPolicy: payload.overlapPolicy,
+          agentConfig,
+          ...(installationVariableSetId ? { variableSetId: installationVariableSetId } : {}),
+          metadata: {
+            packId: pack.id,
+            packVersion: pack.version,
+            packTemplateId: "daily-social-analysis",
+            socialConnectionIds: connections.map((connection) => connection.id),
+            documentBaseIds: payload.documentBaseIds,
+          },
         },
-      },
-    });
-    await syncCreatedScheduledTask({ db, workflowClient, task });
-    return c.json(task, 201);
-  });
+      });
+      await syncCreatedScheduledTask({ db, workflowClient, task });
+      return c.json(task, 201);
+    },
+  );
 }
 
 async function requirePack(db: ApiRouteDeps["db"], workspaceId: string, packId: string) {
@@ -213,25 +250,40 @@ async function requirePack(db: ApiRouteDeps["db"], workspaceId: string, packId:
   return pack;
 }
 
-async function resolveSocialConnections(db: ApiRouteDeps["db"], workspaceId: string, connectionIds: string[]): Promise<SocialConnection[]> {
+async function resolveSocialConnections(
+  db: ApiRouteDeps["db"],
+  workspaceId: string,
+  connectionIds: string[],
+): Promise<SocialConnection[]> {
   const ids = [...new Set(connectionIds)];
-  const connections = ids.length > 0
-    ? await Promise.all(ids.map(async (id) => {
-        const connection = await getSocialConnection(db, workspaceId, id);
-        if (!connection) {
-          throw new HTTPException(422, { message: `unknown social connection: ${id}` });
-        }
-        return connection;
-      }))
-    : (await listSocialConnections(db, workspaceId, 500)).filter((connection) => connection.status === "connected");
+  const connections =
+    ids.length > 0
+      ? await Promise.all(
+          ids.map(async (id) => {
+            const connection = await getSocialConnection(db, workspaceId, id);
+            if (!connection) {
+              throw new HTTPException(422, { message: `unknown social connection: ${id}` });
+            }
+            return connection;
+          }),
+        )
+      : (await listSocialConnections(db, workspaceId, 500)).filter(
+          (connection) => connection.status === "connected",
+        );
   const inactive = connections.find((connection) => connection.status !== "connected");
   if (inactive) {
-    throw new HTTPException(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
+    throw new HTTPException(422, {
+      message: `social connection ${inactive.id} is ${inactive.status}`,
+    });
   }
   return connections;
 }
 
-async function validateDocumentBaseIds(db: ApiRouteDeps["db"], workspaceId: string, documentBaseIds: string[]): Promise<void> {
+async function validateDocumentBaseIds(
+  db: ApiRouteDeps["db"],
+  workspaceId: string,
+  documentBaseIds: string[],
+): Promise<void> {
   for (const baseId of [...new Set(documentBaseIds)]) {
     const base = await getDocumentBase(db, workspaceId, baseId);
     if (!base) {

package/src/routes/rigs.ts

@@ -0,0 +1,189 @@
+import {
+  CreateRigRequest,
+  ProposeRigChangeRequest,
+  RigDefinitionEditPayload,
+  UpdateRigRequest,
+} from "@opengeni/contracts";
+import {
+  beginRigChangeVerificationAttempt,
+  listRigs,
+  RigChangeAlreadyVerifyingError,
+  RigChangeTransitionError,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { requireAccessGrant } from "@opengeni/core";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  activateRigVersionForApi,
+  createRigForApi,
+  createRigVersionForApi,
+  deleteRigForApi,
+  listRigChangesForApi,
+  listRigVersionsForApi,
+  promoteVerifiedDefinitionEditChangeForApi,
+  proposeRigChangeForApi,
+  requireRigChangeForApi,
+  requireRigForApi,
+  updateRigForApi,
+} from "@opengeni/core";
+import { boundedLimit } from "../http/common";
+
+export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const { db, workflowClient } = deps;
+
+  async function startChangeVerification(workspaceId: string, changeId: string): Promise<unknown> {
+    const startedAt = new Date().toISOString();
+    let change;
+    try {
+      change = await beginRigChangeVerificationAttempt(db, workspaceId, changeId, { startedAt });
+    } catch (error) {
+      if (
+        error instanceof RigChangeAlreadyVerifyingError ||
+        error instanceof RigChangeTransitionError
+      ) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      throw error;
+    }
+    const attempt =
+      typeof change.verification?.attempt === "number" ? change.verification.attempt : Date.now();
+    await workflowClient.startRigVerification({
+      workspaceId,
+      changeId,
+      workflowId: `rig-verification-change-${changeId}-attempt-${attempt}`,
+    });
+    return change;
+  }
+
+  async function startVersionVerification(workspaceId: string, versionId: string): Promise<void> {
+    await workflowClient.startRigVerification({
+      workspaceId,
+      versionId,
+      workflowId: `rig-verification-version-${versionId}-${crypto.randomUUID()}`,
+    });
+  }
+
+  app.get("/v1/workspaces/:workspaceId/rigs", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    return c.json(await listRigs(db, workspaceId));
+  });
+
+  app.post("/v1/workspaces/:workspaceId/rigs", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const payload = CreateRigRequest.parse(await c.req.json());
+    const rig = await createRigForApi({ db }, grant, payload);
+    return c.json(rig, 201);
+  });
+
+  app.get("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    return c.json(await requireRigForApi(db, workspaceId, c.req.param("rigId")));
+  });
+
+  app.patch("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const payload = UpdateRigRequest.parse(await c.req.json());
+    return c.json(await updateRigForApi({ db }, grant, rig, payload));
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    await deleteRigForApi({ db }, grant, rig);
+    return c.json({ ok: true });
+  });
+
+  app.get("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    return c.json(await listRigVersionsForApi({ db }, workspaceId, rig.id));
+  });
+
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const payload = RigDefinitionEditPayload.parse(await c.req.json());
+    return c.json(await createRigVersionForApi({ db }, grant, rig, payload), 201);
+  });
+
+  // Rollback / promote-activate: flips which existing version is active.
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions/:versionId/activate", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const version = await activateRigVersionForApi({ db }, grant, rig, c.req.param("versionId"));
+    return c.json(version);
+  });
+
+  app.get("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    return c.json(
+      await listRigChangesForApi({ db }, workspaceId, rig.id, boundedLimit(c.req.query("limit"))),
+    );
+  });
+
+  // Propose a change (rigs:use — the additive, agent-trusted path). The change
+  // is recorded `proposed`; verification + auto-merge (setup_append) and the
+  // promote gate (definition_edit) land in M4.
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const request = ProposeRigChangeRequest.parse(await c.req.json());
+    const change = await proposeRigChangeForApi({ db }, grant, rig, request);
+    const verifying = await startChangeVerification(workspaceId, change.id);
+    return c.json(verifying, 201);
+  });
+
+  app.get("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    return c.json(
+      await requireRigChangeForApi(db, workspaceId, c.req.param("rigId"), c.req.param("changeId")),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId/verify", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const change = await requireRigChangeForApi(
+      db,
+      workspaceId,
+      c.req.param("rigId"),
+      c.req.param("changeId"),
+    );
+    const verifying = await startChangeVerification(workspaceId, change.id);
+    return c.json(verifying, 202);
+  });
+
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes/:changeId/promote", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    const change = await requireRigChangeForApi(db, workspaceId, rig.id, c.req.param("changeId"));
+    const promoted = await promoteVerifiedDefinitionEditChangeForApi({ db }, grant, rig, change);
+    return c.json(promoted.version, 201);
+  });
+
+  app.post("/v1/workspaces/:workspaceId/rigs/:rigId/verify", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "rigs:use");
+    const rig = await requireRigForApi(db, workspaceId, c.req.param("rigId"));
+    if (!rig.activeVersion) {
+      return c.json({ error: "rig has no active version" }, 422);
+    }
+    await startVersionVerification(workspaceId, rig.activeVersion.id);
+    return c.json({ ok: true, versionId: rig.activeVersion.id }, 202);
+  });
+}

package/src/routes/scheduled-tasks.ts

@@ -1,4 +1,8 @@
-import { CreateScheduledTaskRequest, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest } from "@opengeni/contracts";
+import {
+  CreateScheduledTaskRequest,
+  TriggerScheduledTaskRequest,
+  UpdateScheduledTaskRequest,
+} from "@opengeni/contracts";
 import {
   deleteScheduledTask,
   listScheduledTaskRuns,
@@ -30,8 +34,20 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const grant = await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const rawPayload = await c.req.json();
     const payload = CreateScheduledTaskRequest.parse(rawPayload);
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
-    const task = await createValidatedScheduledTask({ settings, db, objectStorage, grant, payload, toolsProvided: scheduledTaskToolsProvided(rawPayload) });
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "schedule:create",
+      quantity: 1,
+    });
+    const task = await createValidatedScheduledTask({
+      settings,
+      db,
+      objectStorage,
+      grant,
+      payload,
+      toolsProvided: scheduledTaskToolsProvided(rawPayload),
+    });
     await syncCreatedScheduledTask({ db, workflowClient, task });
     return c.json(task, 201);
   });
@@ -55,7 +71,15 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const existing = await requireScheduledTaskForApi(db, workspaceId, taskId);
     const rawPayload = await c.req.json();
     const payload = UpdateScheduledTaskRequest.parse(rawPayload);
-    const update = await validatedScheduledTaskUpdate({ settings, db, objectStorage, grant, existing, payload, toolsProvided: scheduledTaskToolsProvided(rawPayload) });
+    const update = await validatedScheduledTaskUpdate({
+      settings,
+      db,
+      objectStorage,
+      grant,
+      existing,
+      payload,
+      toolsProvided: scheduledTaskToolsProvided(rawPayload),
+    });
     const task = await updateScheduledTask(db, workspaceId, taskId, update);
     await syncUpdatedScheduledTask({ db, workflowClient, previous: existing, task });
     return c.json(task);
@@ -85,15 +109,29 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     // Load the task before the gate so a codex-model scheduled task can be
     // recognised as codex-billed and skip the credit/cost gates at the edge.
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId, action: "agent_run:create", quantity: 1, model: task.agentConfig.model ?? deps.settings.openaiModel });
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "agent_run:create",
+      quantity: 1,
+      model: task.agentConfig.model ?? deps.settings.openaiModel,
+    });
     // Body is optional (a bare POST is still a valid trigger); only a present,
     // non-empty body must parse against the contract.
     const body = await c.req.json().catch(() => ({}));
     const { triggerId } = TriggerScheduledTaskRequest.parse(body ?? {});
     const triggerToken = scheduledTaskTriggerToken(triggerId);
-    const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(workspaceId, task.id, triggerToken);
+    const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(
+      workspaceId,
+      task.id,
+      triggerToken,
+    );
     const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
-    await workflowClient.triggerScheduledTask({ task, agentRunUsageIdempotencyKey, triggerWorkflowId });
+    await workflowClient.triggerScheduledTask({
+      task,
+      agentRunUsageIdempotencyKey,
+      triggerWorkflowId,
+    });
     await recordWorkspaceUsage(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -112,7 +150,9 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:manage");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    await workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId: task.temporalScheduleId });
+    await workflowClient.deleteScheduledTaskSchedule({
+      temporalScheduleId: task.temporalScheduleId,
+    });
     await deleteScheduledTask(db, workspaceId, task.id);
     return c.json({ ok: true });
   });
@@ -121,6 +161,8 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "scheduled_tasks:run");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
-    return c.json(await listScheduledTaskRuns(db, workspaceId, task.id, boundedLimit(c.req.query("limit"))));
+    return c.json(
+      await listScheduledTaskRuns(db, workspaceId, task.id, boundedLimit(c.req.query("limit"))),
+    );
   });
 }