@opengeni/api-router 0.5.3 → 0.5.4

package/src/auth/managed-auth.ts

@@ -27,12 +27,14 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
     trustedOrigins: betterAuthTrustedOrigins(settings),
     advanced: {
       useSecureCookies: settings.publicBaseUrl?.startsWith("https://") ?? false,
-      ...(settings.betterAuthCookieDomain ? {
-        crossSubDomainCookies: {
-          enabled: true,
-          domain: settings.betterAuthCookieDomain,
-        },
-      } : {}),
+      ...(settings.betterAuthCookieDomain
+        ? {
+            crossSubDomainCookies: {
+              enabled: true,
+              domain: settings.betterAuthCookieDomain,
+            },
+          }
+        : {}),
       database: {
         generateId: () => crypto.randomUUID(),
       },
@@ -149,7 +151,11 @@ export function createManagedAuth(settings: Settings, db: Database): ManagedAuth
   }) as ManagedAuth;
 }
 
-export async function managedSessionAccessContext(auth: ManagedAuth, db: Database, headers: Headers) {
+export async function managedSessionAccessContext(
+  auth: ManagedAuth,
+  db: Database,
+  headers: Headers,
+) {
   const session = await auth.api.getSession({ headers });
   if (!session?.user) {
     return null;
@@ -184,15 +190,20 @@ function betterAuthTrustedOrigins(settings: Settings): string[] {
   return [...origins];
 }
 
-async function sendEmail(settings: Settings, input: {
-  to: string;
-  subject: string;
-  text: string;
-  html: string;
-}): Promise<void> {
+async function sendEmail(
+  settings: Settings,
+  input: {
+    to: string;
+    subject: string;
+    text: string;
+    html: string;
+  },
+): Promise<void> {
   if (!settings.resendApiKey) {
     if (settings.environment === "local" || settings.environment === "test") {
-      console.warn(`[opengeni] Skipping email to ${input.to}: OPENGENI_RESEND_API_KEY is not configured`);
+      console.warn(
+        `[opengeni] Skipping email to ${input.to}: OPENGENI_RESEND_API_KEY is not configured`,
+      );
       return;
     }
     throw new Error("OPENGENI_RESEND_API_KEY is required to send managed auth email");
@@ -212,7 +223,9 @@ async function sendEmail(settings: Settings, input: {
 
 async function verificationUrl(settings: Settings, email: string): Promise<string> {
   if (!settings.betterAuthSecret) {
-    throw new Error("OPENGENI_BETTER_AUTH_SECRET is required to send managed auth verification email");
+    throw new Error(
+      "OPENGENI_BETTER_AUTH_SECRET is required to send managed auth verification email",
+    );
   }
   if (!settings.publicBaseUrl) {
     throw new Error("OPENGENI_PUBLIC_BASE_URL is required to send managed auth verification email");
@@ -225,7 +238,10 @@ async function verificationUrl(settings: Settings, email: string): Promise<strin
 }
 
 function splitCsv(raw: string): string[] {
-  return raw.split(",").map((value) => value.trim()).filter(Boolean);
+  return raw
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
 }
 
 function escapeHtml(value: string): string {

package/src/http/auth.ts

@@ -84,7 +84,14 @@ function isAuthorized(c: Context, expected: string | undefined): boolean {
     return false;
   }
   const explicit = c.req.header("x-opengeni-access-key");
-  return constantTimeEqual(explicit, expected);
+  if (constantTimeEqual(explicit, expected)) {
+    return true;
+  }
+  const authorization = c.req.header("authorization");
+  const bearer = authorization?.startsWith("Bearer ")
+    ? authorization.slice("Bearer ".length)
+    : undefined;
+  return constantTimeEqual(bearer, expected);
 }
 
 function constantTimeEqual(actual: string | undefined, expected: string): boolean {

package/src/http/common.ts

@@ -9,8 +9,12 @@ export function boundedLimit(raw: string | undefined): number {
   return Math.min(500, Math.max(1, Math.floor(limit)));
 }
 
-export async function assertSessionExists(db: Database, workspaceId: string, sessionId: string): Promise<void> {
-  if (!await getSession(db, workspaceId, sessionId)) {
+export async function assertSessionExists(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+): Promise<void> {
+  if (!(await getSession(db, workspaceId, sessionId))) {
     throw new HTTPException(404, { message: "session not found" });
   }
 }

package/src/http/sse.ts

@@ -2,7 +2,14 @@ import type { SessionEvent } from "@opengeni/contracts";
 import { listSessionEvents, type Database } from "@opengeni/db";
 import { formatSse, type EventBus } from "@opengeni/events";
 
-export async function sseSessionStream(db: Database, bus: EventBus, workspaceId: string, sessionId: string, after: number, signal: AbortSignal): Promise<Response> {
+export async function sseSessionStream(
+  db: Database,
+  bus: EventBus,
+  workspaceId: string,
+  sessionId: string,
+  after: number,
+  signal: AbortSignal,
+): Promise<Response> {
   const encoder = new TextEncoder();
   let controller: ReadableStreamDefaultController<Uint8Array>;
   let lastSent = after;
@@ -18,7 +25,13 @@ export async function sseSessionStream(db: Database, bus: EventBus, workspaceId:
           return;
         }
         if (event.sequence > lastSent + 1) {
-          const missing = await listSessionEvents(db, workspaceId, sessionId, lastSent, event.sequence - lastSent - 1);
+          const missing = await listSessionEvents(
+            db,
+            workspaceId,
+            sessionId,
+            lastSent,
+            event.sequence - lastSent - 1,
+          );
           for (const missed of missing) {
             if (missed.sequence > lastSent) {
               controller.enqueue(encoder.encode(formatSse(missed)));
@@ -40,7 +53,11 @@ export async function sseSessionStream(db: Database, bus: EventBus, workspaceId:
         }
       });
 
-      await replaySessionEvents((cursor, limit) => listSessionEvents(db, workspaceId, sessionId, cursor, limit), send, after);
+      await replaySessionEvents(
+        (cursor, limit) => listSessionEvents(db, workspaceId, sessionId, cursor, limit),
+        send,
+        after,
+      );
       replaying = false;
       for (const event of buffered.sort((a, b) => a.sequence - b.sequence)) {
         await send(event);
@@ -53,9 +70,13 @@ export async function sseSessionStream(db: Database, bus: EventBus, workspaceId:
     },
   });
 
-  signal.addEventListener("abort", () => {
-    unsubscribe?.();
-  }, { once: true });
+  signal.addEventListener(
+    "abort",
+    () => {
+      unsubscribe?.();
+    },
+    { once: true },
+  );
 
   return new Response(stream, {
     headers: {

package/src/index.ts

@@ -1,9 +1,26 @@
-import { dbSearchPath, getSettings, resolveNatsCalloutConfig, resolveNatsControlPlaneAuth, retryStartupDependency, startupRetryOptions } from "@opengeni/config";
-import type { ScheduledTask, ScheduledTaskOverlapPolicy, ScheduledTaskScheduleSpec } from "@opengeni/contracts";
-import { createDb } from "@opengeni/db";
+import {
+  dbSearchPath,
+  getSettings,
+  resolveNatsCalloutConfig,
+  resolveNatsControlPlaneAuth,
+  retryStartupDependency,
+  startupRetryOptions,
+} from "@opengeni/config";
+import type {
+  ScheduledTask,
+  ScheduledTaskOverlapPolicy,
+  ScheduledTaskScheduleSpec,
+} from "@opengeni/contracts";
+import { createDb, markSessionWorkflowWakeDelivered, type Database } from "@opengeni/db";
 import { createNatsEventBus, type ResponderConnection } from "@opengeni/events";
 import { createObservability, logStartupDependencyRetry } from "@opengeni/observability";
-import { Connection, Client as TemporalClient, ScheduleNotFoundError, ScheduleOverlapPolicy, WorkflowExecutionAlreadyStartedError } from "@temporalio/client";
+import {
+  Connection,
+  Client as TemporalClient,
+  ScheduleNotFoundError,
+  ScheduleOverlapPolicy,
+  WorkflowExecutionAlreadyStartedError,
+} from "@temporalio/client";
 import type { ScheduleOptions, ScheduleSpec, ScheduleUpdateOptions } from "@temporalio/client";
 import { createApp, type DocumentIndexClient, type SessionWorkflowClient } from "./app";
 import { observabilityEventLogger } from "./observability";
@@ -35,7 +52,10 @@ const TEMPORAL_MONTHS = [
   "DECEMBER",
 ] as const;
 
-export async function createTemporalWorkflowClient(settings: ReturnType<typeof getSettings>): Promise<{
+export async function createTemporalWorkflowClient(
+  settings: ReturnType<typeof getSettings>,
+  db: Database,
+): Promise<{
   client: SessionWorkflowClient;
   documentIndexer: DocumentIndexClient;
   close: () => Promise<void>;
@@ -49,7 +69,13 @@ export async function createTemporalWorkflowClient(settings: ReturnType<typeof g
     signalUserMessage: async ({ eventId, workflowId }) => {
       await temporal.workflow.getHandle(workflowId).signal("userMessage", eventId);
     },
-    wakeSessionWorkflow: async ({ accountId, workspaceId, sessionId, workflowId }) => {
+    wakeSessionWorkflow: async ({
+      accountId,
+      workspaceId,
+      sessionId,
+      workflowId,
+      wakeRevision,
+    }) => {
       await temporal.workflow.signalWithStart("sessionWorkflow", {
         taskQueue: settings.temporalTaskQueue,
         workflowId,
@@ -57,26 +83,87 @@ export async function createTemporalWorkflowClient(settings: ReturnType<typeof g
         args: [{ accountId, workspaceId, sessionId }],
         signal: "queueChanged",
       });
+      await markSessionWorkflowWakeDelivered(db, {
+        accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: workflowId,
+        wakeRevision,
+      });
+    },
+    signalCodexCapacity: async ({
+      accountId,
+      workspaceId,
+      sessionId,
+      workflowId,
+      wakeRevision,
+      workflowWakeRevision,
+    }) => {
+      await temporal.workflow.signalWithStart("sessionWorkflow", {
+        taskQueue: settings.temporalTaskQueue,
+        workflowId,
+        workflowIdReusePolicy: "ALLOW_DUPLICATE",
+        args: [{ accountId, workspaceId, sessionId }],
+        signal: "codexCapacityChanged",
+        signalArgs: [wakeRevision],
+      });
+      await markSessionWorkflowWakeDelivered(db, {
+        accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: workflowId,
+        wakeRevision: workflowWakeRevision,
+      });
     },
-    signalApprovalDecision: async ({ eventId, workflowId }) => {
-      await temporal.workflow.getHandle(workflowId).signal("approvalDecision", eventId);
+    signalApprovalDecision: async ({
+      accountId,
+      workspaceId,
+      sessionId,
+      eventId,
+      workflowId,
+      workflowWakeRevision,
+    }) => {
+      await temporal.workflow.signalWithStart("sessionWorkflow", {
+        taskQueue: settings.temporalTaskQueue,
+        workflowId,
+        workflowIdReusePolicy: "ALLOW_DUPLICATE",
+        args: [{ accountId, workspaceId, sessionId }],
+        signal: "approvalDecision",
+        signalArgs: [eventId],
+      });
+      await markSessionWorkflowWakeDelivered(db, {
+        accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: workflowId,
+        wakeRevision: workflowWakeRevision,
+      });
     },
-    signalInterrupt: async ({ accountId, workspaceId, sessionId, eventId, workflowId }) => {
-      // Start-or-signal: an interrupt POSTed while the session is idle has no
-      // running workflow execution to signal, and getHandle().signal() would
-      // throw WorkflowNotFoundError -> a 500 (the operator-can't-stop bug). Like
-      // wakeSessionWorkflow, signalWithStart delivers the signal to a live run
-      // when one exists and otherwise starts a fresh sessionWorkflow that picks
-      // the buffered `interrupt` up immediately. ALLOW_DUPLICATE matches the
-      // wake path so a running execution is reused rather than rejected.
+    signalSessionControl: async ({
+      accountId,
+      workspaceId,
+      sessionId,
+      eventId,
+      workflowId,
+      workflowWakeRevision,
+    }) => {
+      // Start-or-signal: a control sent after the prior workflow returned idle
+      // starts a fresh run with the durable control already buffered.
       await temporal.workflow.signalWithStart("sessionWorkflow", {
         taskQueue: settings.temporalTaskQueue,
         workflowId,
         workflowIdReusePolicy: "ALLOW_DUPLICATE",
         args: [{ accountId, workspaceId, sessionId }],
-        signal: "interrupt",
+        signal: "sessionControl",
         signalArgs: [eventId],
       });
+      await markSessionWorkflowWakeDelivered(db, {
+        accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: workflowId,
+        wakeRevision: workflowWakeRevision,
+      });
     },
     syncScheduledTask: async ({ task }) => {
       const schedule = temporal.schedule.getHandle(task.temporalScheduleId);
@@ -91,36 +178,60 @@ export async function createTemporalWorkflowClient(settings: ReturnType<typeof g
       }
     },
     deleteScheduledTaskSchedule: async ({ temporalScheduleId }) => {
-      await temporal.schedule.getHandle(temporalScheduleId).delete().catch(() => undefined);
+      await temporal.schedule
+        .getHandle(temporalScheduleId)
+        .delete()
+        .catch(() => undefined);
     },
     triggerScheduledTask: async ({ task, agentRunUsageIdempotencyKey, triggerWorkflowId }) => {
-	      // Deterministic workflowId (derived from the trigger token by the
-	      // caller) + REJECT_DUPLICATE makes a retried manual trigger idempotent:
-	      // the second start collides on the id and is rejected instead of
-	      // spawning a second run. The shared idempotency key dedupes the charge.
-	      const workflowId = triggerWorkflowId ?? `scheduled-task-${task.id}-manual-${crypto.randomUUID()}`;
-	      try {
-	        await temporal.workflow.start("scheduledTaskFireWorkflow", {
-	          taskQueue: settings.temporalTaskQueue,
-	          workflowId,
-	          workflowIdReusePolicy: "REJECT_DUPLICATE",
-	          args: [{
-	            accountId: task.accountId,
-	            workspaceId: task.workspaceId,
-	            taskId: task.id,
-	            triggerType: "manual",
-	            agentRunUsageIdempotencyKey,
-	          }],
-	        });
-	      } catch (error) {
-	        // A duplicate trigger token started this run already; treat the retry
-	        // as a no-op so the (idempotent) usage charge stays the only effect.
-	        if (isWorkflowAlreadyStarted(error)) {
-	          return;
-	        }
+      // Deterministic workflowId (derived from the trigger token by the
+      // caller) + REJECT_DUPLICATE makes a retried manual trigger idempotent:
+      // the second start collides on the id and is rejected instead of
+      // spawning a second run. The shared idempotency key dedupes the charge.
+      const workflowId =
+        triggerWorkflowId ?? `scheduled-task-${task.id}-manual-${crypto.randomUUID()}`;
+      try {
+        await temporal.workflow.start("scheduledTaskFireWorkflow", {
+          taskQueue: settings.temporalTaskQueue,
+          workflowId,
+          workflowIdReusePolicy: "REJECT_DUPLICATE",
+          args: [
+            {
+              accountId: task.accountId,
+              workspaceId: task.workspaceId,
+              taskId: task.id,
+              triggerType: "manual",
+              agentRunUsageIdempotencyKey,
+            },
+          ],
+        });
+      } catch (error) {
+        // A duplicate trigger token started this run already; treat the retry
+        // as a no-op so the (idempotent) usage charge stays the only effect.
+        if (isWorkflowAlreadyStarted(error)) {
+          return;
+        }
         throw error;
       }
     },
+    startRigVerification: async ({ workspaceId, changeId, versionId, workflowId }) => {
+      const targetId = changeId ?? versionId;
+      if (!targetId) {
+        throw new Error("rig verification requires changeId or versionId");
+      }
+      await temporal.workflow.start("rigVerificationWorkflow", {
+        taskQueue: settings.temporalTaskQueue,
+        workflowId: workflowId ?? `rig-verification-${targetId}-${crypto.randomUUID()}`,
+        workflowIdReusePolicy: "ALLOW_DUPLICATE",
+        args: [
+          {
+            workspaceId,
+            ...(changeId ? { changeId } : {}),
+            ...(versionId ? { versionId } : {}),
+          },
+        ],
+      });
+    },
     check: async () => {
       await connection.workflowService.getSystemInfo({});
     },
@@ -158,7 +269,8 @@ export async function startApi() {
   let bus: Awaited<ReturnType<typeof createNatsEventBus>> | undefined;
   let workflowClient: Awaited<ReturnType<typeof createTemporalWorkflowClient>> | undefined;
   const retryOptions = startupRetryOptions(settings);
-  const onRetry = (event: Parameters<typeof logStartupDependencyRetry>[1]) => logStartupDependencyRetry(observability, event);
+  const onRetry = (event: Parameters<typeof logStartupDependencyRetry>[1]) =>
+    logStartupDependencyRetry(observability, event);
   // The PRIVILEGED control-plane NATS login (M-AUTH): when the server runs with
   // auth_callout, api/worker authenticate as a static account user permitted to
   // request `agent.*.rpc`. Null in local dev (anonymous connect — the bus default).
@@ -169,7 +281,9 @@ export async function startApi() {
       () =>
         createNatsEventBus(
           settings.natsUrl,
-          controlPlaneAuth ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password } : undefined,
+          controlPlaneAuth
+            ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password }
+            : undefined,
           { logger: observabilityEventLogger(observability) },
         ),
       {
@@ -177,16 +291,16 @@ export async function startApi() {
         onRetry,
       },
     );
-    workflowClient = await retryStartupDependency("Temporal", () => createTemporalWorkflowClient(settings), {
-      ...retryOptions,
-      onRetry,
-    });
+    workflowClient = await retryStartupDependency(
+      "Temporal",
+      () => createTemporalWorkflowClient(settings, dbClient.db),
+      {
+        ...retryOptions,
+        onRetry,
+      },
+    );
   } catch (error) {
-    await Promise.allSettled([
-      bus?.close(),
-      workflowClient?.close(),
-      dbClient.close(),
-    ]);
+    await Promise.allSettled([bus?.close(), workflowClient?.close(), dbClient.close()]);
     throw error;
   }
   if (!bus || !workflowClient) {
@@ -295,25 +409,29 @@ export function temporalScheduleSpec(schedule: ScheduledTaskScheduleSpec): Sched
   }
   if (schedule.type === "calendar") {
     return {
-      calendars: [{
-        hour: schedule.hour,
-        minute: schedule.minute,
-        second: 0,
-        ...(schedule.daysOfWeek ? { dayOfWeek: schedule.daysOfWeek } : {}),
-      }],
+      calendars: [
+        {
+          hour: schedule.hour,
+          minute: schedule.minute,
+          second: 0,
+          ...(schedule.daysOfWeek ? { dayOfWeek: schedule.daysOfWeek } : {}),
+        },
+      ],
       timezone: schedule.timeZone,
     };
   }
   const runAt = new Date(schedule.runAt);
   return {
-    calendars: [{
-      year: runAt.getUTCFullYear(),
-      month: temporalMonth(runAt.getUTCMonth()),
-      dayOfMonth: runAt.getUTCDate(),
-      hour: runAt.getUTCHours(),
-      minute: runAt.getUTCMinutes(),
-      second: runAt.getUTCSeconds(),
-    }],
+    calendars: [
+      {
+        year: runAt.getUTCFullYear(),
+        month: temporalMonth(runAt.getUTCMonth()),
+        dayOfMonth: runAt.getUTCDate(),
+        hour: runAt.getUTCHours(),
+        minute: runAt.getUTCMinutes(),
+        second: runAt.getUTCSeconds(),
+      },
+    ],
     timezone: "UTC",
   };
 }
@@ -330,12 +448,14 @@ function temporalScheduleOptions(task: ScheduledTask, taskQueue: string): Schedu
       type: "startWorkflow",
       workflowType: "scheduledTaskFireWorkflow",
       taskQueue,
-      args: [{
-        accountId: task.accountId,
-        workspaceId: task.workspaceId,
-        taskId: task.id,
-        triggerType: "scheduled",
-      }],
+      args: [
+        {
+          accountId: task.accountId,
+          workspaceId: task.workspaceId,
+          taskId: task.id,
+          triggerType: "scheduled",
+        },
+      ],
     },
     policies: {
       overlap: temporalOverlapPolicy(task.overlapPolicy),
@@ -362,6 +482,8 @@ function temporalScheduleUpdateOptions(options: ScheduleOptions): ScheduleUpdate
     ...(options.policies ? { policies: options.policies } : {}),
     state: options.state ?? {},
     ...(options.searchAttributes ? { searchAttributes: options.searchAttributes } : {}),
-    ...(options.typedSearchAttributes ? { typedSearchAttributes: options.typedSearchAttributes } : {}),
+    ...(options.typedSearchAttributes
+      ? { typedSearchAttributes: options.typedSearchAttributes }
+      : {}),
   };
 }