@opengeni/api-router 0.5.4 → 0.5.5

package/dist/{chunk-DO2G3JSB.js → chunk-HBEJMWD3.js}

@@ -4,7 +4,12 @@ import {
   configuredAllowedReasoningEfforts,
   configuredModels
 } from "@opengeni/config";
-import { ClientConfig, resolveWorkspaceMemoryEnabled } from "@opengeni/contracts";
+import {
+  ClientConfig,
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION,
+  resolveWorkspaceMemoryEnabled
+} from "@opengeni/contracts";
 import {
   createDocumentServices,
   indexDocumentNow
@@ -14,6 +19,7 @@ import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { HTTPException as HTTPException24 } from "hono/http-exception";
 import { hasPermission as hasPermission4, requireAccessGrant as requireAccessGrant17, requirePermission } from "@opengeni/core";
@@ -279,7 +285,6 @@ import {
   UpdateScheduledTaskRequest
 } from "@opengeni/contracts";
 import {
-  addSessionSystemUpdate,
   correctWorkspaceMemory,
   countVariableSets,
   beginRigChangeVerificationAttempt,
@@ -288,6 +293,7 @@ import {
   encryptVariableSetValue,
   getSession,
   getSessionGoal,
+  getSessionQueueSnapshot,
   getSessionTurn,
   getVariableSet,
   getVariableSetByName,
@@ -306,10 +312,8 @@ import {
   requireFile,
   requireScheduledTask,
   requireSession,
-  requestSessionControl,
   saveWorkspaceMemory,
   searchWorkspaceMemories,
-  setSessionChildNotificationsMode,
   setSessionGoalStatus,
   setVariableSetVariable,
   updateScheduledTask,
@@ -356,9 +360,12 @@ import {
 } from "@opengeni/core";
 import {
   acceptSessionUserMessage,
+  controlAgentSessionWorkstream,
+  controlHumanSessionWorkstream,
   createSessionForRequest,
-  updateSessionTitle,
-  workflowIdForSession
+  sendAgentSessionMessage,
+  steerAgentSession,
+  updateSessionTitle
 } from "@opengeni/core";
 import {
   buildFleetContextForSession,
@@ -545,24 +552,6 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
       }
     );
   }
-  if (sessionId !== null && !toolspaceMode && can("sessions:create")) {
-    server.registerTool(
-      "set_child_notifications_mode",
-      {
-        description: "Change how workers you spawn report back when they finish. This setting persists across turns and must not be re-applied as routine setup or recovery. 'digest' (default): completions arrive as a coalesced turn you process. 'passive': completions appear only as quiet cards and never queue a turn or model run. Call only when the desired mode differs from the mode already in effect.",
-        inputSchema: { mode: z4.enum(["digest", "passive"]) }
-      },
-      async ({ mode }) => {
-        const changed = await setSessionChildNotificationsMode(
-          deps.db,
-          grant.workspaceId,
-          sessionId,
-          mode
-        );
-        return json({ ok: true, changed, mode });
-      }
-    );
-  }
   if (sessionId !== null && can("goals:manage")) {
     registerGoalTools(server, deps, grant, sessionId, json);
   }
@@ -575,7 +564,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   if (!toolspaceMode) {
     registerRigTools(server, deps, grant, can, sessionId, json);
   }
-  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, json);
+  registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, toolspaceMode, json);
   registerVariableSetTools(server, deps, grant, can, json);
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
@@ -1445,7 +1434,23 @@ function registerRigTools(server, deps, grant, can, sessionId, json) {
     );
   }
 }
-function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSessionId, json) {
+function exactAgentCommandContext(grant, callerSessionId) {
+  const turnId = grant.metadata?.["turnId"];
+  const attemptId = grant.metadata?.["attemptId"];
+  const executionGeneration = grant.metadata?.["executionGeneration"];
+  if (typeof turnId !== "string" || typeof attemptId !== "string" || typeof executionGeneration !== "number" || !Number.isSafeInteger(executionGeneration) || executionGeneration < 1) {
+    throw new Error("caller_attempt_claims_missing");
+  }
+  return {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    callerSessionId,
+    callerTurnId: turnId,
+    callerAttemptId: attemptId,
+    callerExecutionGeneration: executionGeneration
+  };
+}
+function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSessionId, toolspaceMode, json) {
   if (can("sessions:read")) {
     server.registerTool(
       "sessions_list",
@@ -1466,7 +1471,11 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         if (!session) {
           throw new Error("session not found");
         }
-        return json(capSessionDetail(session));
+        const queue = await getSessionQueueSnapshot(deps.db, grant.workspaceId, sessionId);
+        return json({
+          ...capSessionDetail(session),
+          effectiveControl: queue?.effectiveControl ?? null
+        });
       }
     );
     server.registerTool(
@@ -1576,7 +1585,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
       async (args) => json(await createSessionForRequest(deps, grant, grant.workspaceId, args))
     );
   }
-  if (can("sessions:control")) {
+  if (can("sessions:control") && !toolspaceMode) {
     server.registerTool(
       "session_send_message",
       {
@@ -1584,50 +1593,30 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         inputSchema: {
           sessionId: z4.string().uuid(),
           text: z4.string().min(1),
+          idempotencyKey: z4.string().uuid(),
           // Header-value rotation only. URL/name/tool settings are immutable
           // after create; core enforces mcp_servers:attach on this field.
           mcpCredentialUpdates: z4.array(z4.unknown()).optional()
         }
       },
-      async ({ sessionId: targetSessionId, text, mcpCredentialUpdates }) => {
+      async ({ sessionId: targetSessionId, text, idempotencyKey, mcpCredentialUpdates }) => {
         if (callerSessionId !== null) {
           if ((mcpCredentialUpdates?.length ?? 0) > 0) {
             throw new Error("internal session updates cannot change MCP credentials");
           }
-          const result = await addSessionSystemUpdate(deps.db, {
-            accountId: grant.accountId,
-            workspaceId: grant.workspaceId,
-            sessionId: targetSessionId,
-            kind: "runtime_notice",
-            classification: "info",
-            sourceId: callerSessionId,
-            dedupeKey: `session-message:${callerSessionId}:${crypto.randomUUID()}`,
-            summary: text,
-            payload: { text },
-            lineage: { sourceSessionId: callerSessionId, targetSessionId }
-          });
-          if (result.reason === "session_cancelled") {
-            return json({ delivered: false, reason: result.reason });
-          }
-          if (result.added && result.events.length > 0) {
-            await deps.bus.publish(grant.workspaceId, targetSessionId, result.events);
-          }
-          if (result.shouldWake) {
-            if (result.workflowWakeRevision === null) {
-              throw new Error("Internal update has no workflow wake revision");
-            }
-            await deps.workflowClient.wakeSessionWorkflow({
-              accountId: grant.accountId,
-              workspaceId: grant.workspaceId,
-              sessionId: targetSessionId,
-              workflowId: result.temporalWorkflowId ?? workflowIdForSession(targetSessionId),
-              wakeRevision: result.workflowWakeRevision
-            });
-          }
+          const result = await sendAgentSessionMessage(
+            deps,
+            exactAgentCommandContext(grant, callerSessionId),
+            { targetSessionId, text, idempotencyKey }
+          );
           return json({
             delivered: true,
-            updateId: result.update.id,
-            delivery: "coalesced_internal_update"
+            updateId: result.updateId,
+            delivery: "coalesced_internal_update",
+            effectiveState: result.effectiveState,
+            wakeRequested: result.wakeRevision !== null,
+            resumeRequired: result.effectiveState === "paused",
+            replay: result.replay
           });
         }
         const { accepted, turn } = await acceptSessionUserMessage(
@@ -1638,8 +1627,9 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           {
             text,
             toolsProvided: false,
-            delivery: "queue",
+            delivery: "send",
             origin: "operator",
+            clientEventId: idempotencyKey,
             mcpCredentialUpdates: (mcpCredentialUpdates ?? []).map(
               (update) => SessionMcpCredentialUpdateInput.parse(update)
             )
@@ -1653,39 +1643,122 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
       {
         description: "Pause this session. Waiting prompts stay saved and inert until Resume.",
         inputSchema: {
-          sessionId: z4.string().uuid()
+          sessionId: z4.string().uuid(),
+          idempotencyKey: z4.string().uuid(),
+          reason: z4.string().min(1).max(500).optional()
         }
       },
-      async ({ sessionId }) => {
-        const controlled = await requestSessionControl(deps.db, {
-          accountId: grant.accountId,
-          workspaceId: grant.workspaceId,
-          sessionId,
-          actor: grant.subjectId,
-          mode: "pause",
-          reason: "mcp_pause"
-        });
-        await deps.bus.publish(grant.workspaceId, sessionId, controlled.events);
-        if (controlled.shouldSignalControl) {
-          if (controlled.workflowWakeRevision === null) {
-            throw new Error("Session control has no workflow wake revision");
-          }
-          await deps.workflowClient.signalSessionControl({
-            accountId: grant.accountId,
-            workspaceId: grant.workspaceId,
-            sessionId,
-            eventId: controlled.event.id,
-            workflowId: workflowIdForSession(sessionId),
-            workflowWakeRevision: controlled.workflowWakeRevision
+      async ({ sessionId, idempotencyKey, reason }) => {
+        if (callerSessionId !== null) {
+          const controlled = await controlAgentSessionWorkstream(
+            deps,
+            exactAgentCommandContext(grant, callerSessionId),
+            {
+              targetSessionId: sessionId,
+              action: "pause",
+              idempotencyKey,
+              reason: reason ?? "agent_mcp_pause"
+            }
+          );
+          return json({
+            receiptId: controlled.receipt.id,
+            effectiveControl: controlled.control,
+            interruptionCount: controlled.interruptionCount,
+            replay: controlled.replay
           });
         }
-        return json({
-          event: controlled.event,
-          controlState: controlled.controlState,
-          controlGeneration: controlled.controlGeneration
-        });
+        return json(
+          await controlHumanSessionWorkstream(
+            deps,
+            {
+              accountId: grant.accountId,
+              workspaceId: grant.workspaceId,
+              sessionId,
+              subjectId: grant.subjectId
+            },
+            {
+              action: "pause",
+              clientEventId: idempotencyKey,
+              ...reason ? { reason } : {}
+            }
+          )
+        );
+      }
+    );
+    server.registerTool(
+      "session_resume",
+      {
+        description: "Resume the selected session workstream through older parent/workspace pauses. This creates no message.",
+        inputSchema: {
+          sessionId: z4.string().uuid(),
+          idempotencyKey: z4.string().uuid(),
+          reason: z4.string().min(1).max(500).optional()
+        }
+      },
+      async ({ sessionId, idempotencyKey, reason }) => {
+        if (callerSessionId !== null) {
+          const controlled = await controlAgentSessionWorkstream(
+            deps,
+            exactAgentCommandContext(grant, callerSessionId),
+            {
+              targetSessionId: sessionId,
+              action: "resume",
+              idempotencyKey,
+              reason: reason ?? "agent_mcp_resume"
+            }
+          );
+          return json({
+            receiptId: controlled.receipt.id,
+            effectiveControl: controlled.control,
+            interruptionCount: controlled.interruptionCount,
+            replay: controlled.replay
+          });
+        }
+        return json(
+          await controlHumanSessionWorkstream(
+            deps,
+            {
+              accountId: grant.accountId,
+              workspaceId: grant.workspaceId,
+              sessionId,
+              subjectId: grant.subjectId
+            },
+            {
+              action: "resume",
+              clientEventId: idempotencyKey,
+              ...reason ? { reason } : {}
+            }
+          )
+        );
       }
     );
+    if (callerSessionId !== null) {
+      server.registerTool(
+        "session_steer",
+        {
+          description: "Atomically replace another session's current direction and resume it. The instruction is an internal update, never a human queue row.",
+          inputSchema: {
+            sessionId: z4.string().uuid(),
+            instruction: z4.string().min(1),
+            idempotencyKey: z4.string().uuid()
+          }
+        },
+        async ({ sessionId, instruction, idempotencyKey }) => {
+          const result = await steerAgentSession(
+            deps,
+            exactAgentCommandContext(grant, callerSessionId),
+            { targetSessionId: sessionId, instruction, idempotencyKey }
+          );
+          return json({
+            updateId: result.updateId,
+            interruptionCount: result.interruptionCount,
+            stoppingPreviousAttempt: result.interruptionCount > 0,
+            effectiveState: result.effectiveState,
+            replay: result.replay
+          });
+        }
+      );
+    }
     server.registerTool(
       "set_other_session_title",
       {
@@ -7831,9 +7904,10 @@ import {
   AcknowledgeStreamRequest,
   AttachViewerRequest,
   ClearSessionContextRequest,
-  CancelSessionQueueItemRequest,
   ClientSessionEvent,
   CompactSessionContextRequest,
+  DeleteSessionQueueItemRequest,
+  EditSessionQueueItemRequest,
   FsDeleteRequest,
   FsListRequest,
   FsMkdirRequest,
@@ -7844,11 +7918,14 @@ import {
   GitLogRequest,
   GitShowRequest,
   GitStatusRequest,
+  MoveSessionQueueItemRequest,
   PtyCloseRequest,
   PtyOpenRequest,
   PtyResizeRequest,
   PtyWriteRequest,
   SessionControlRequest,
+  SaveComposerDraftRequest,
+  SteerSessionQueueItemRequest,
   SteerSessionMessageRequest,
   TerminalExecRequest,
   UpdateSessionPinRequest,
@@ -7858,7 +7935,6 @@ import {
 } from "@opengeni/contracts";
 import { streamTokenDegraded } from "@opengeni/config";
 import {
-  cancelQueuedSessionTurnWithVersion,
   acceptSessionApprovalDecision,
   clearSessionGoal,
   clearSessionContext,
@@ -7868,7 +7944,7 @@ import {
   getSession as getSession4,
   getSessionForSubject,
   getSessionGoal as getSessionGoal2,
-  getSessionQueueSnapshot,
+  getSessionQueueSnapshot as getSessionQueueSnapshot2,
   getStreamAcknowledgment,
   insertPtySession,
   listSessionEvents as listSessionEvents3,
@@ -7888,8 +7964,9 @@ import {
   revokeViewer,
   setSessionGoalStatus as setSessionGoalStatus2,
   updatePtySessionActivity,
-  requestSessionControl as requestSessionControl2,
-  SessionQueueConflictError,
+  QueueCommandConflictError,
+  SessionCommandIdempotencyError,
+  SessionControlConflictError,
   SessionContextBusyError,
   latestWorkspaceCapture,
   workspaceCaptureAtRevision
@@ -8681,14 +8758,21 @@ function viewerIdAsUuid(rawViewerId) {
 // src/routes/sessions.ts
 import {
   acceptSessionUserMessage as acceptSessionUserMessage2,
+  controlHumanSessionWorkstream as controlHumanSessionWorkstream2,
   createSessionForRequest as createSessionForRequest2,
+  deleteHumanQueuePrompt,
+  editHumanQueuePrompt,
+  getHumanComposerDraft,
+  moveHumanQueuePrompt,
   readSessionLineage,
+  saveHumanComposerDraft,
+  steerHumanQueuePrompt,
   updateSessionTitle as updateSessionTitle2,
-  workflowIdForSession as workflowIdForSession2
+  workflowIdForSession
 } from "@opengeni/core";
 
 // src/http/sse.ts
-import { listSessionEvents as listSessionEvents2 } from "@opengeni/db";
+import { listSessionEvents as listSessionEvents2, listWorkspaceControlEvents } from "@opengeni/db";
 import { formatSse } from "@opengeni/events";
 async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal) {
   const encoder = new TextEncoder();
@@ -8778,6 +8862,53 @@ async function replaySessionEvents(loadPage, send, after, pageSize = 1e3) {
     }
   }
 }
+async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal) {
+  const encoder = new TextEncoder();
+  let lastSent = after;
+  let replaying = true;
+  const buffered = [];
+  let unsubscribe = null;
+  const stream = new ReadableStream({
+    start: async (controller) => {
+      const send = (event) => {
+        if (event.sequence <= lastSent) return;
+        controller.enqueue(encoder.encode(formatSse(event)));
+        lastSent = event.sequence;
+      };
+      unsubscribe = await bus.subscribeWorkspaceControl(workspaceId, async (event) => {
+        if (replaying) {
+          buffered.push(event);
+        } else {
+          send(event);
+        }
+      });
+      let cursor = after;
+      while (true) {
+        const page = await listWorkspaceControlEvents(db, workspaceId, cursor, 1e3);
+        for (const event of page) {
+          send(event);
+          cursor = Math.max(cursor, event.sequence);
+        }
+        if (page.length < 1e3) break;
+      }
+      replaying = false;
+      for (const event of buffered.sort((left, right) => left.sequence - right.sequence)) {
+        send(event);
+      }
+      buffered.length = 0;
+      controller.enqueue(encoder.encode(": connected\n\n"));
+    },
+    cancel: () => unsubscribe?.()
+  });
+  signal.addEventListener("abort", () => unsubscribe?.(), { once: true });
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive"
+    }
+  });
+}
 
 // src/routes/workspace-capture.ts
 import {
@@ -9170,7 +9301,7 @@ function registerSessionRoutes(app, deps) {
           accountId: grant.accountId,
           workspaceId,
           sessionId,
-          workflowId: workflowIdForSession2(sessionId),
+          workflowId: workflowIdForSession(sessionId),
           wakeRevision: workflowWakeRevision
         });
       }
@@ -9288,111 +9419,133 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
-    const snapshot = await getSessionQueueSnapshot(db, workspaceId, sessionId);
+    const snapshot = await getSessionQueueSnapshot2(db, workspaceId, sessionId);
     if (!snapshot) throw new HTTPException21(404, { message: "session not found" });
     return c.json(snapshot);
   });
-  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/cancel", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/move", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
-    const payload = CancelSessionQueueItemRequest.parse(await c.req.json());
+    const payload = MoveSessionQueueItemRequest.parse(await c.req.json());
     try {
-      const result = await cancelQueuedSessionTurnWithVersion(
-        db,
-        workspaceId,
-        sessionId,
-        c.req.param("turnId"),
-        payload.expectedQueueVersion,
-        payload.expectedItemVersion,
-        grant.subjectId,
-        payload.reason ?? null
+      return c.json(
+        await moveHumanQueuePrompt(
+          { db, bus },
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          c.req.param("turnId"),
+          payload
+        )
       );
-      await bus.publish(workspaceId, sessionId, result.events);
-      if (result.shouldWake) {
-        if (result.workflowWakeRevision === null) {
-          throw new Error("Queue continuation has no workflow wake revision");
-        }
-        await workflowClient.wakeSessionWorkflow({
-          accountId: grant.accountId,
-          workspaceId,
-          sessionId,
-          workflowId: workflowIdForSession2(sessionId),
-          wakeRevision: result.workflowWakeRevision
-        });
-      }
-      return c.json(result);
     } catch (error) {
-      throwQueueConflict(error);
+      return commandConflictResponse(c, error);
     }
   });
-  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/control", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/edit", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
-    const payload = SessionControlRequest.parse(await c.req.json());
-    let result;
+    await assertSessionExists(db, workspaceId, sessionId);
+    const payload = EditSessionQueueItemRequest.parse(await c.req.json());
     try {
-      result = await requestSessionControl2(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        sessionId,
-        actor: grant.subjectId,
-        mode: payload.mode,
-        reason: payload.reason ?? null,
-        clientEventId: payload.clientEventId ?? null,
-        ...payload.expectedControlState !== void 0 ? { expectedControlState: payload.expectedControlState } : {},
-        ...payload.expectedControlGeneration !== void 0 ? { expectedControlGeneration: payload.expectedControlGeneration } : {},
-        ...payload.expectedWorkspaceInferenceGeneration !== void 0 ? {
-          expectedWorkspaceInferenceGeneration: payload.expectedWorkspaceInferenceGeneration
-        } : {}
-      });
+      return c.json(
+        await editHumanQueuePrompt(
+          { db, bus },
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          c.req.param("turnId"),
+          payload
+        )
+      );
     } catch (error) {
-      throwQueueConflict(error);
+      return commandConflictResponse(c, error);
     }
-    await bus.publish(workspaceId, sessionId, result.events);
-    const workflowId = workflowIdForSession2(sessionId);
-    if (result.shouldSignalControl) {
-      if (result.workflowWakeRevision === null) {
-        throw new Error("Session control has no workflow wake revision");
-      }
-      await workflowClient.signalSessionControl({
-        accountId: grant.accountId,
-        workspaceId,
-        sessionId,
-        eventId: result.event.id,
-        workflowId,
-        workflowWakeRevision: result.workflowWakeRevision
-      });
-    } else if (result.shouldWake) {
-      if (result.workflowWakeRevision === null) {
-        throw new Error("Session resume has no workflow wake revision");
-      }
-      await workflowClient.wakeSessionWorkflow({
+  });
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/steer", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+    const sessionId = c.req.param("sessionId");
+    await assertSessionExists(db, workspaceId, sessionId);
+    const payload = SteerSessionQueueItemRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        await steerHumanQueuePrompt(
+          { db, bus },
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          c.req.param("turnId"),
+          payload
+        )
+      );
+    } catch (error) {
+      return commandConflictResponse(c, error);
+    }
+  });
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/delete", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+    const sessionId = c.req.param("sessionId");
+    await assertSessionExists(db, workspaceId, sessionId);
+    const payload = DeleteSessionQueueItemRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        await deleteHumanQueuePrompt(
+          { db, bus },
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          c.req.param("turnId"),
+          payload
+        )
+      );
+    } catch (error) {
+      return commandConflictResponse(c, error);
+    }
+  });
+  app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/composer-draft", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
+    const sessionId = c.req.param("sessionId");
+    return c.json(
+      await getHumanComposerDraft(db, {
         accountId: grant.accountId,
         workspaceId,
         sessionId,
-        workflowId,
-        wakeRevision: result.workflowWakeRevision
-      });
-    }
-    return c.json(
-      {
-        operationId: result.operationId,
-        event: result.event,
-        controlState: result.controlState,
-        controlGeneration: result.controlGeneration,
-        expectedActiveTurnId: result.expectedActiveTurnId,
-        expectedExecutionGeneration: result.expectedExecutionGeneration,
-        expectedAttemptId: result.expectedAttemptId,
-        deliveryEventId: result.deliveryEventId,
-        shouldSignalControl: result.shouldSignalControl,
-        shouldWake: result.shouldWake
-      },
-      202
+        subjectId: grant.subjectId
+      })
     );
   });
+  app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/composer-draft", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+    const sessionId = c.req.param("sessionId");
+    const payload = SaveComposerDraftRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        await saveHumanComposerDraft(
+          db,
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          payload
+        )
+      );
+    } catch (error) {
+      return commandConflictResponse(c, error);
+    }
+  });
+  app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/control", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+    const sessionId = c.req.param("sessionId");
+    const payload = SessionControlRequest.parse(await c.req.json());
+    try {
+      return c.json(
+        await controlHumanSessionWorkstream2(
+          { db, bus, workflowClient },
+          { accountId: grant.accountId, workspaceId, sessionId, subjectId: grant.subjectId },
+          payload
+        )
+      );
+    } catch (error) {
+      return commandConflictResponse(c, error);
+    }
+  });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/steer", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
@@ -9410,10 +9563,8 @@ function registerSessionRoutes(app, deps) {
       mcpCredentialUpdates: payload.mcpCredentialUpdates ?? [],
       delivery: "steer",
       origin: "human",
-      ...payload.expectedControlGeneration !== void 0 ? { expectedControlGeneration: payload.expectedControlGeneration } : {},
-      ...payload.expectedWorkspaceInferenceGeneration !== void 0 ? {
-        expectedWorkspaceInferenceGeneration: payload.expectedWorkspaceInferenceGeneration
-      } : {},
+      ...payload.controlEtag !== void 0 ? { controlEtag: payload.controlEtag } : {},
+      ...payload.expectedDraftRevision !== void 0 ? { expectedDraftRevision: payload.expectedDraftRevision } : {},
       ...payload.clientEventId ? { clientEventId: payload.clientEventId } : {}
     });
     return c.json(result, 202);
@@ -9433,6 +9584,8 @@ function registerSessionRoutes(app, deps) {
         model: event.payload.model ?? null,
         reasoningEffort: event.payload.reasoningEffort ?? null,
         mcpCredentialUpdates: event.payload.mcpCredentialUpdates ?? [],
+        ...event.payload.controlEtag !== void 0 ? { controlEtag: event.payload.controlEtag } : {},
+        ...event.payload.expectedDraftRevision !== void 0 ? { expectedDraftRevision: event.payload.expectedDraftRevision } : {},
         ...event.clientEventId ? { clientEventId: event.clientEventId } : {}
       });
       return c.json(accepted, 202);
@@ -9451,7 +9604,7 @@ function registerSessionRoutes(app, deps) {
         });
       }
       await publishDurableSessionEvents(bus, workspaceId, sessionId, accepted.events);
-      const workflowId = workflowIdForSession2(sessionId);
+      const workflowId = workflowIdForSession(sessionId);
       await workflowClient.signalApprovalDecision({
         accountId: grant.accountId,
         workspaceId,
@@ -10172,15 +10325,15 @@ function userMessagePayloadHasOwnProperty(value, key) {
   const payload = value.payload;
   return hasOwnProperty(payload, key);
 }
-function throwQueueConflict(error) {
-  if (error instanceof SessionQueueConflictError) {
-    throw new HTTPException21(409, {
-      message: JSON.stringify({
-        message: error.message,
-        currentQueueVersion: error.currentQueueVersion,
-        ...error.currentItemVersion !== void 0 ? { currentItemVersion: error.currentItemVersion } : {}
-      })
-    });
+function commandConflictResponse(c, error) {
+  if (error instanceof QueueCommandConflictError) {
+    return c.json({ code: error.code, message: error.message, current: error.current }, 409);
+  }
+  if (error instanceof SessionControlConflictError) {
+    return c.json({ code: error.code, message: error.message }, 409);
+  }
+  if (error instanceof SessionCommandIdempotencyError) {
+    return c.json({ code: error.code, message: error.message }, 409);
   }
   throw error;
 }
@@ -10329,6 +10482,7 @@ import {
   grantWorkspaceAccess,
   listScheduledTasks as listScheduledTasks3,
   listWorkspaceMembers,
+  listWorkspaceControlEvents as listWorkspaceControlEvents2,
   listWorkspacesForSubject,
   removeWorkspaceMember,
   requireWorkspace,
@@ -10336,8 +10490,7 @@ import {
   setWorkspaceDefaultRig,
   updateWorkspace,
   updateWorkspaceSettings,
-  upsertWorkspaceModelPolicy,
-  setWorkspaceInferenceControl
+  upsertWorkspaceModelPolicy
 } from "@opengeni/db";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
 import { hasPermission as hasPermission3, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
@@ -10345,6 +10498,7 @@ import { requireLimit as requireLimit7 } from "@opengeni/core";
 import {
   assertWorkspaceDeletable,
   assertWorkspaceMemberRemovable,
+  controlHumanWorkspace,
   resolveMemberSubjectId
 } from "@opengeni/core";
 function registerWorkspaceRoutes(app, deps) {
@@ -10448,51 +10602,33 @@ function registerWorkspaceRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant16(c, deps, workspaceId, "workspace:admin");
     const payload = WorkspaceInferenceControlRequest.parse(await c.req.json());
-    const result = await setWorkspaceInferenceControl(deps.db, {
-      accountId: grant.accountId,
-      workspaceId,
-      actor: grant.subjectId,
-      state: payload.state,
-      reason: payload.reason,
-      clientEventId: payload.clientEventId,
-      expectedState: payload.expectedState,
-      expectedGeneration: payload.expectedGeneration,
-      exceptSessionIds: payload.exceptSessionIds
-    });
-    for (const broadcast of result.broadcasts) {
-      await deps.bus.publish(workspaceId, broadcast.sessionId, broadcast.events);
-    }
-    for (const control of result.controls) {
-      await deps.workflowClient.signalSessionControl({
-        accountId: control.accountId,
-        workspaceId,
-        sessionId: control.sessionId,
-        eventId: control.eventId,
-        workflowId: control.workflowId,
-        workflowWakeRevision: control.workflowWakeRevision
-      });
-    }
-    for (const wake of result.wakeSessions) {
-      await deps.workflowClient.wakeSessionWorkflow({
-        accountId: wake.accountId,
-        workspaceId,
-        sessionId: wake.sessionId,
-        workflowId: wake.workflowId,
-        wakeRevision: wake.workflowWakeRevision
-      });
-    }
     return c.json(
-      {
-        operationId: result.operationId,
-        state: result.state,
-        generation: result.generation,
-        affectedSessionIds: result.affectedSessionIds,
-        controlSessionIds: result.controls.map((entry) => entry.sessionId),
-        exceptionSessionIds: result.exceptionSessionIds
-      },
-      202
+      await controlHumanWorkspace(
+        { db: deps.db, bus: deps.bus, workflowClient: deps.workflowClient },
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        payload
+      )
+    );
+  });
+  app.get("/v1/workspaces/:workspaceId/control-events", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant16(c, deps, workspaceId, "workspace:read");
+    const after = Math.max(0, Number.parseInt(c.req.query("after") ?? "0", 10) || 0);
+    return c.json(
+      await listWorkspaceControlEvents2(
+        deps.db,
+        workspaceId,
+        after,
+        boundedLimit(c.req.query("limit"))
+      )
     );
   });
+  app.get("/v1/workspaces/:workspaceId/control-events/stream", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant16(c, deps, workspaceId, "workspace:read");
+    const after = Math.max(0, Number.parseInt(c.req.query("after") ?? "0", 10) || 0);
+    return await sseWorkspaceControlStream(deps.db, deps.bus, workspaceId, after, c.req.raw.signal);
+  });
   app.put("/v1/workspaces/:workspaceId/default-rig", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant16(c, deps, workspaceId, "rigs:manage");
@@ -10610,7 +10746,8 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools
 } from "@opengeni/core";
-import { workflowIdForSession as workflowIdForSession3 } from "@opengeni/core";
+import { workflowIdForSession as workflowIdForSession2 } from "@opengeni/core";
+var API_MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
 function createApp(deps) {
   const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
   const objectStorage = deps.objectStorage === void 0 ? createObjectStorage(deps.settings) : deps.objectStorage;
@@ -10626,7 +10763,9 @@ function createApp(deps) {
       documentId
     }) => {
       if (!objectStorage) {
-        throw new HTTPException24(503, { message: "object storage is not configured" });
+        throw new HTTPException24(503, {
+          message: "object storage is not configured"
+        });
       }
       return await indexDocumentNow(
         deps.db,
@@ -10665,6 +10804,15 @@ function createApp(deps) {
     "*",
     cors({
       credentials: true,
+      allowHeaders: [
+        "Accept",
+        "Authorization",
+        "Content-Type",
+        "X-OpenGeni-Access-Key",
+        "X-OpenGeni-Api-Contract",
+        "X-OpenGeni-Subject"
+      ],
+      exposeHeaders: ["X-OpenGeni-Api-Contract"],
       origin: (origin) => {
         if (!origin) {
           return null;
@@ -10673,6 +10821,13 @@ function createApp(deps) {
       }
     })
   );
+  app.use(
+    "*",
+    bodyLimit({
+      maxSize: API_MAX_REQUEST_BODY_BYTES,
+      onError: (c) => c.json({ code: "PAYLOAD_TOO_LARGE", message: "Request body is too large." }, 413)
+    })
+  );
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
     const route = routeLabel(url.pathname);
@@ -10686,7 +10841,12 @@ function createApp(deps) {
       await next();
       const status = c.res.status || 200;
       const durationSeconds = (performance.now() - start) / 1e3;
-      observability.recordHttpRequest({ method: c.req.method, route, status, durationSeconds });
+      observability.recordHttpRequest({
+        method: c.req.method,
+        route,
+        status,
+        durationSeconds
+      });
       span.end({
         attributes: {
           "http.response.status_code": status,
@@ -10704,7 +10864,12 @@ function createApp(deps) {
     } catch (error) {
       const status = httpStatusForError(error);
       const durationSeconds = (performance.now() - start) / 1e3;
-      observability.recordHttpRequest({ method: c.req.method, route, status, durationSeconds });
+      observability.recordHttpRequest({
+        method: c.req.method,
+        route,
+        status,
+        durationSeconds
+      });
       span.end({
         attributes: {
           "http.response.status_code": status,
@@ -10725,6 +10890,20 @@ function createApp(deps) {
     }
   });
   app.use("*", requireAccessKey(deps.settings));
+  app.use("/v1/*", async (c, next) => {
+    c.header(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
+    if (deps.settings.environment !== "test" && isApiContractProtectedMutation(c.req.method, new URL(c.req.url).pathname) && c.req.header(OPENGENI_API_CONTRACT_HEADER) !== OPENGENI_API_CONTRACT_REVISION) {
+      return c.json(
+        {
+          code: "API_CONTRACT_CHANGED",
+          message: "OpenGeni updated. Reload this client before changing state.",
+          apiContractRevision: OPENGENI_API_CONTRACT_REVISION
+        },
+        409
+      );
+    }
+    await next();
+  });
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", (c) => managedAuth.handler(c.req.raw));
   }
@@ -10748,11 +10927,12 @@ function createApp(deps) {
       "content-type": "text/plain; version=0.0.4; charset=utf-8"
     })
   );
-  app.get(
-    "/v1/config/client",
-    (c) => c.json(
+  app.get("/v1/config/client", (c) => {
+    c.header("cache-control", "no-store");
+    return c.json(
       ClientConfig.parse({
         deploymentRevision: deps.settings.deploymentRevision,
+        apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         ...deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {},
         defaultModel: deps.settings.openaiModel,
         allowedModels: configuredAllowedModels(deps.settings),
@@ -10785,15 +10965,17 @@ function createApp(deps) {
         // Per-session availability is still negotiated on /stream-capabilities.
         structuredServices: structuredServicesHint(deps.settings.sandboxBackend)
       })
-    )
-  );
+    );
+  });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
     const toolspace = isToolspaceGrant(routeDeps.settings, grant) ? await prepareToolspaceMcpSurface({ deps: routeDeps, grant }) : null;
     const workspace = await getWorkspace2(routeDeps.db, workspaceId);
     const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-    const transport = new WebStandardStreamableHTTPServerTransport2({ enableJsonResponse: true });
+    const transport = new WebStandardStreamableHTTPServerTransport2({
+      enableJsonResponse: true
+    });
     const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
       requestOrigin: new URL(c.req.url).origin,
       toolspace,
@@ -10850,7 +11032,10 @@ function clientAuthConfig(settings) {
     };
   }
   if (settings.authRequired) {
-    return { mode: "deploymentKey", headerName: "x-opengeni-access-key" };
+    return {
+      mode: "deploymentKey",
+      headerName: "x-opengeni-access-key"
+    };
   }
   return { mode: "none" };
 }
@@ -10892,7 +11077,10 @@ async function runReadinessChecks(checks, timeoutMs) {
         } catch (error) {
           return [
             name,
-            { ok: false, error: error instanceof Error ? error.message : String(error) }
+            {
+              ok: false,
+              error: error instanceof Error ? error.message : String(error)
+            }
           ];
         }
       }
@@ -10941,15 +11129,24 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/usage$/,
     label: "/v1/workspaces/:workspaceId/codex/usage"
   },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/codex$/, label: "/v1/workspaces/:workspaceId/codex" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/codex$/,
+    label: "/v1/workspaces/:workspaceId/codex"
+  },
   { pattern: /^\/metrics$/, label: "/metrics" },
   { pattern: /^\/v1\/config\/client$/, label: "/v1/config/client" },
   { pattern: /^\/v1\/billing$/, label: "/v1/billing" },
   { pattern: /^\/v1\/billing\/checkout$/, label: "/v1/billing/checkout" },
   { pattern: /^\/v1\/billing\/usage$/, label: "/v1/billing/usage" },
-  { pattern: /^\/v1\/billing\/entitlements$/, label: "/v1/billing/entitlements" },
+  {
+    pattern: /^\/v1\/billing\/entitlements$/,
+    label: "/v1/billing/entitlements"
+  },
   { pattern: /^\/v1\/webhooks\/stripe$/, label: "/v1/webhooks/stripe" },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/mcp$/, label: "/v1/workspaces/:workspaceId/mcp" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/mcp$/,
+    label: "/v1/workspaces/:workspaceId/mcp"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/mcp\/docs$/,
     label: "/v1/workspaces/:workspaceId/mcp/docs"
@@ -10958,7 +11155,22 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/default-rig$/,
     label: "/v1/workspaces/:workspaceId/default-rig"
   },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/sessions$/, label: "/v1/workspaces/:workspaceId/sessions" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions$/,
+    label: "/v1/workspaces/:workspaceId/sessions"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/control-events\/stream$/,
+    label: "/v1/workspaces/:workspaceId/control-events/stream"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/control-events$/,
+    label: "/v1/workspaces/:workspaceId/control-events"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/inference-control$/,
+    label: "/v1/workspaces/:workspaceId/inference-control"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events\/stream$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events/stream"
@@ -10972,16 +11184,20 @@ var routeLabelPatterns = [
     label: "/v1/workspaces/:workspaceId/sessions/:id/events"
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns\/reorder$/,
-    label: "/v1/workspaces/:workspaceId/sessions/:id/turns/reorder"
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue\/[^/]+\/(move|edit|steer|delete)$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/queue/:turnId/:action"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/queue"
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns\/[^/]+$/,
-    label: "/v1/workspaces/:workspaceId/sessions/:id/turns/:turnId"
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/composer-draft$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/composer-draft"
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns$/,
-    label: "/v1/workspaces/:workspaceId/sessions/:id/turns"
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/(control|steer)$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/:controlAction"
   },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/stream-capabilities$/,
@@ -11023,7 +11239,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/files\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/files/:id"
   },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/api-keys$/, label: "/v1/workspaces/:workspaceId/api-keys" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/api-keys$/,
+    label: "/v1/workspaces/:workspaceId/api-keys"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/api-keys/:id"
@@ -11132,7 +11351,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/environments\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/environments/:id"
   },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/packs$/, label: "/v1/workspaces/:workspaceId/packs" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/packs$/,
+    label: "/v1/workspaces/:workspaceId/packs"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/packs\/installations$/,
     label: "/v1/workspaces/:workspaceId/packs/installations"
@@ -11170,13 +11392,22 @@ var routeLabelPatterns = [
     label: "/v1/workspaces/:workspaceId/connections/:connectionId"
   },
   { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
-  { pattern: /^\/v1\/integrations\/oauth\/callback$/, label: "/v1/integrations/oauth/callback" },
+  {
+    pattern: /^\/v1\/integrations\/oauth\/callback$/,
+    label: "/v1/integrations/oauth/callback"
+  },
   {
     pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/,
     label: "/v1/integrations/oauth/client-metadata.json"
   },
-  { pattern: /^\/v1\/enrollments\/device\/start$/, label: "/v1/enrollments/device/start" },
-  { pattern: /^\/v1\/enrollments\/device\/poll$/, label: "/v1/enrollments/device/poll" },
+  {
+    pattern: /^\/v1\/enrollments\/device\/start$/,
+    label: "/v1/enrollments/device/start"
+  },
+  {
+    pattern: /^\/v1\/enrollments\/device\/poll$/,
+    label: "/v1/enrollments/device/poll"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/enrollments\/device\/approve$/,
     label: "/v1/workspaces/:workspaceId/enrollments/device/approve"
@@ -11193,11 +11424,23 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/machines\/[^/]+\/metrics\/series$/,
     label: "/v1/workspaces/:workspaceId/machines/:enrollmentId/metrics/series"
   },
-  { pattern: /^\/v1\/workspaces\/[^/]+\/machines$/, label: "/v1/workspaces/:workspaceId/machines" },
-  { pattern: /^\/v1\/github\/app-manifest\/callback$/, label: "/v1/github/app-manifest/callback" },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/machines$/,
+    label: "/v1/workspaces/:workspaceId/machines"
+  },
+  {
+    pattern: /^\/v1\/github\/app-manifest\/callback$/,
+    label: "/v1/github/app-manifest/callback"
+  },
   { pattern: /^\/v1\/github\/setup$/, label: "/v1/github/setup" },
-  { pattern: /^\/v1\/github\/install\/callback$/, label: "/v1/github/install/callback" },
-  { pattern: /^\/v1\/github\/oauth\/callback$/, label: "/v1/github/oauth/callback" }
+  {
+    pattern: /^\/v1\/github\/install\/callback$/,
+    label: "/v1/github/install/callback"
+  },
+  {
+    pattern: /^\/v1\/github\/oauth\/callback$/,
+    label: "/v1/github/oauth/callback"
+  }
 ];
 function routeLabel(pathname) {
   const match = routeLabelPatterns.find(({ pattern }) => pattern.test(pathname));
@@ -11206,14 +11449,29 @@ function routeLabel(pathname) {
   }
   return pathname.startsWith("/v1/") ? "/v1/unknown" : "/unknown";
 }
+function isApiContractProtectedMutation(method, pathname) {
+  if (!(/* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"])).has(method.toUpperCase())) {
+    return false;
+  }
+  if (!pathname.startsWith("/v1/")) {
+    return false;
+  }
+  if (pathname.startsWith("/v1/auth/") || pathname.startsWith("/v1/webhooks/") || pathname.startsWith("/v1/integrations/oauth/") || pathname.startsWith("/v1/github/") || pathname === "/v1/enrollments/device/start" || pathname === "/v1/enrollments/device/poll" || pathname === "/v1/enrollments/token/exchange") {
+    return false;
+  }
+  return !pathname.split("/").includes("mcp");
+}
 
 export {
   sseSessionStream,
   replaySessionEvents,
+  sseWorkspaceControlStream,
+  API_MAX_REQUEST_BODY_BYTES,
   createApp,
   allowedCorsOrigin,
   httpStatusForError,
   routeLabel,
+  isApiContractProtectedMutation,
   mergeResourceRefs,
   mergeToolRefs,
   normalizeResources,
@@ -11222,6 +11480,6 @@ export {
   validateGitHubRepositorySelectionShape,
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
-  workflowIdForSession3 as workflowIdForSession
+  workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-DO2G3JSB.js.map
+//# sourceMappingURL=chunk-HBEJMWD3.js.map