@opengeni/api-router 1.0.2 → 1.1.0

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-6TZ5LG3O.js";
+} from "./chunk-A4J3LBH6.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/artifact-catalog-cursor.d.ts

@@ -14,6 +14,7 @@ declare const Cursor: z.ZodObject<{
             spreadsheet: "spreadsheet";
         }>;
         id: z.ZodString;
+        pinned: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type ArtifactCatalogCursor = z.infer<typeof Cursor>;

package/dist/{chunk-6TZ5LG3O.js → chunk-A4J3LBH6.js}

@@ -9756,6 +9756,7 @@ import {
   setSessionChannel
 } from "@opengeni/db";
 import { createHash as createHash15, randomUUID as randomUUID5 } from "crypto";
+import { assertGoalResumeAllowed } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
 import { createPublicKey, randomBytes as randomBytes3, verify } from "crypto";
@@ -14802,7 +14803,7 @@ var PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
 var WORKSPACE_MCP_PATH = /^\/v1\/workspaces\/([0-9a-f-]{36})\/mcp(?:\/(docs|files))?$/u;
 var ORGANIZATION_MCP_PATH = "/v1/mcp";
 function registerMcpOAuthRoutes(app, deps) {
-  app.get("/.well-known/oauth-authorization-server", (c) => {
+  const authorizationServerMetadata = (c) => {
     requireMcpOAuthEnabled(deps);
     const issuer = mcpOAuthIssuer(deps);
     c.header("cache-control", "public, max-age=300");
@@ -14820,7 +14821,9 @@ function registerMcpOAuthRoutes(app, deps) {
         authorization_response_iss_parameter_supported: true
       })
     );
-  });
+  };
+  app.get("/.well-known/oauth-authorization-server", authorizationServerMetadata);
+  app.get("/.well-known/oauth-authorization-server/*", authorizationServerMetadata);
   app.get("/.well-known/oauth-protected-resource/*", (c) => {
     requireMcpOAuthEnabled(deps);
     const pathname = new URL(c.req.url).pathname.replace(
@@ -15242,7 +15245,7 @@ function mcpOAuthConsentToolIdentities(catalog) {
   return catalog.entries.map((entry2) => entry2.identity);
 }
 function isMcpOAuthPublicProtocolPath(pathname) {
-  return pathname === "/.well-known/oauth-authorization-server" || pathname.startsWith("/.well-known/oauth-protected-resource/") || pathname === "/oauth/register" || pathname === "/oauth/authorize" || pathname === "/oauth/token";
+  return pathname === "/.well-known/oauth-authorization-server" || pathname.startsWith("/.well-known/oauth-authorization-server/") || pathname.startsWith("/.well-known/oauth-protected-resource/") || pathname === "/oauth/register" || pathname === "/oauth/authorize" || pathname === "/oauth/token";
 }
 function mcpOAuthAuthenticateHeader(deps, pathname) {
   return `Bearer resource_metadata="${mcpOAuthIssuer(deps)}/.well-known/oauth-protected-resource${pathname}", scope="${MCP_OAUTH_SCOPE}"`;
@@ -33429,6 +33432,7 @@ function registerGoalTools(server, deps, grant, sessionId, json2) {
         sessionId,
         {
           status: "active",
+          beforeResume: (tx, session, causalTurn) => assertGoalResumeAllowed({ ...deps, db: tx }, session, causalTurn),
           event: { type: "goal.resumed", actor: "agent" }
         }
       );
@@ -42907,6 +42911,17 @@ var ACTION_CATALOG = [
       "PrReviewAppRegistration"
     ]
   },
+  {
+    "id": "updateArtifactPin",
+    "method": "PUT",
+    "path": "/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin",
+    "request": [
+      "ArtifactCatalogKind"
+    ],
+    "response": [
+      "ArtifactPinResponse"
+    ]
+  },
   {
     "id": "updateBrowserIdentity",
     "method": "PATCH",
@@ -99677,6 +99692,7 @@ function registerScheduledTaskRoutes(app, deps) {
 
 // src/routes/sessions.ts
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
 import { UnsupportedLatencyModeError } from "@opengeni/config";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
 import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
@@ -103151,6 +103167,14 @@ function registerSessionRoutes(app, deps) {
       sessionId,
       {
         status: "active",
+        beforeResume: (tx, session, causalTurn) => assertGoalResumeAllowed2({ ...deps, db: tx }, session, causalTurn).catch(
+          (error) => {
+            if (error instanceof GoalResumeBlockedError) {
+              throw new HTTPException88(422, { message: error.message, cause: error });
+            }
+            throw error;
+          }
+        ),
         event: { type: "goal.resumed", actor: "api" }
       }
     );
@@ -105149,7 +105173,7 @@ function sessionTenancyHttpError(error) {
   if (error instanceof SessionTenancyNotActivatedError) {
     return new ApiHttpError(409, {
       code: "conflict",
-      message: "Session tenancy is not activated for this organization.",
+      message: "Only-me chats are not enabled for this organization.",
       retryable: false,
       details: { reason: "not_activated" }
     });
@@ -110062,6 +110086,8 @@ import {
   ArtifactCatalogKind as ArtifactCatalogKind2,
   ArtifactCatalogListQuery,
   ArtifactCatalogListResponse,
+  ArtifactPinResponse,
+  UpdateArtifactPinRequest,
   retainedArtifactReferenceFromFile as retainedArtifactReferenceFromFile3,
   retainedGeneratedImageReferenceFromFile as retainedGeneratedImageReferenceFromFile2
 } from "@opengeni/contracts";
@@ -110082,9 +110108,12 @@ import {
   getGeneratedImageArtifact as getGeneratedImageArtifact2,
   getSessionAuthorityProjection as getSessionAuthorityProjection3,
   listArtifactCatalogCandidates,
+  nestedPostgresSqlState as nestedPostgresSqlState14,
+  updateArtifactPin,
   withSessionRlsActorContext as withSessionRlsActorContext9
 } from "@opengeni/db";
 import { HTTPException as HTTPException102 } from "hono/http-exception";
+import { z as z53 } from "zod";
 
 // src/artifact-catalog-cursor.ts
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash29, randomBytes as randomBytes12 } from "crypto";
@@ -110098,7 +110127,8 @@ var Cursor = z52.object({
   after: z52.object({
     key: z52.string().max(4096),
     kind: ArtifactCatalogKind,
-    id: z52.string().min(1).max(128)
+    id: z52.string().min(1).max(128),
+    pinned: z52.boolean().optional()
   }).strict()
 }).strict();
 function artifactCatalogCursorCodec(secret, binding) {
@@ -110146,9 +110176,82 @@ var iso2 = (value) => new Date(value).toISOString();
 var position = (row) => ({
   key: row.sort_key,
   kind: row.kind,
-  id: row.id
+  id: row.id,
+  pinned: row.pinned ?? false
 });
 function registerArtifactCatalogRoutes(app, deps) {
+  app.put("/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin", async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization36(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish"
+    );
+    const grant = authorization.grant;
+    if (!hasPermission27(grant.permissions, "artifacts:publish"))
+      throw new HTTPException102(403, { message: "Artifact publish access required" });
+    const kind = ArtifactCatalogKind2.safeParse(context.req.param("kind"));
+    const body3 = UpdateArtifactPinRequest.safeParse(await context.req.json().catch(() => null));
+    const requestedId = context.req.param("artifactId");
+    if (!kind.success || !body3.success || !(editableKinds.has(kind.data) ? /^[0-9a-f]{32}$/.test(requestedId) : z53.string().uuid().safeParse(requestedId).success))
+      throw new HTTPException102(422, { message: "Invalid artifact pin request" });
+    const artifactId2 = editableKinds.has(kind.data) ? requestedId : requestedId.toLowerCase();
+    const fileKind = kind.data === "file" || kind.data === "image";
+    if (!hasPermission27(grant.permissions, fileKind ? "files:read" : "artifacts:read"))
+      throw new HTTPException102(403, { message: "Artifact read access required" });
+    const actor = fileKind ? await fileOwnerContextForAccess5(deps, authorization, "files:read") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+    context.header("cache-control", "private, no-store");
+    return withSessionRlsActorContext9(actor, async () => {
+      if (editableKinds.has(kind.data)) {
+        if (!deps.editableArtifacts)
+          throw new HTTPException102(503, { message: "Editable artifacts are unavailable" });
+        try {
+          const scope = editableArtifactScope2({ accountId: grant.accountId, workspaceId });
+          const artifact = await deps.editableArtifacts.readArtifact({
+            scope,
+            actor: editableArtifactActorForGrant(grant, "0000000000000001"),
+            artifactId: editableArtifactId3(artifactId2)
+          });
+          if (artifact.scope.accountId !== scope.accountId || artifact.scope.workspaceId !== scope.workspaceId || artifact.id !== artifactId2 || artifact.modality !== kind.data)
+            throw new HTTPException102(404, { message: "Artifact not found" });
+        } catch (error) {
+          if (isInvisibleListCandidate(error))
+            throw new HTTPException102(404, { message: "Artifact not found" });
+          throw editableArtifactHttpError(error);
+        }
+      }
+      if (fileKind) {
+        const subjectId = await fileAuthoritySubjectIdForGrant(deps, grant);
+        const [file] = await getFilesForSubject3(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId,
+          fileIds: [artifactId2]
+        });
+        if (!file || file.status !== "ready")
+          throw new HTTPException102(404, { message: "Artifact not found" });
+      }
+      try {
+        await updateArtifactPin(
+          deps.db,
+          { accountId: grant.accountId, workspaceId },
+          {
+            kind: kind.data,
+            artifactId: artifactId2,
+            pinned: body3.data.pinned
+          }
+        );
+      } catch (error) {
+        if (nestedPostgresSqlState14(error) === "42501")
+          throw new HTTPException102(404, { message: "Artifact not found" });
+        throw error;
+      }
+      return context.json(
+        ArtifactPinResponse.parse({ kind: kind.data, artifactId: artifactId2, pinned: body3.data.pinned })
+      );
+    });
+  });
   app.get("/v1/workspaces/:workspaceId/artifact-catalog", async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization36(context, deps, workspaceId);
@@ -110282,7 +110385,8 @@ async function projectCandidate(deps, grant, row, fileSubject) {
     title: row.title,
     status: row.status,
     createdAt: iso2(row.created_at),
-    updatedAt: iso2(row.updated_at)
+    updatedAt: iso2(row.updated_at),
+    ...row.pinned !== void 0 ? { pinned: row.pinned } : {}
   };
   if (row.version_id) item.versionId = row.version_id;
   if (editableKinds.has(row.kind)) {
@@ -111873,9 +111977,9 @@ import {
   withRlsContext as withRlsContext2
 } from "@opengeni/db";
 import { HTTPException as HTTPException106 } from "hono/http-exception";
-import { z as z53 } from "zod";
-var SessionId2 = z53.string().uuid();
-var EditableArtifactId = z53.string().regex(/^(?!0{32}$)[0-9a-f]{32}$/u);
+import { z as z54 } from "zod";
+var SessionId2 = z54.string().uuid();
+var EditableArtifactId = z54.string().regex(/^(?!0{32}$)[0-9a-f]{32}$/u);
 function registerSessionArtifactAssociationRoutes(app, deps) {
   app.get(
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
@@ -112099,7 +112203,7 @@ import {
   getCanonicalHumanIdentityProjection as getCanonicalHumanIdentityProjection3
 } from "@opengeni/db/canonical-human-identities";
 import { HTTPException as HTTPException110 } from "hono/http-exception";
-import { z as z56 } from "zod";
+import { z as z57 } from "zod";
 
 // src/routes/managed-sign-in-methods.ts
 import {
@@ -112123,7 +112227,7 @@ import { getManagedAuthSessionSetSnapshot as getManagedAuthSessionSetSnapshot2 }
 import { getCanonicalHumanIdentityProjection as getCanonicalHumanIdentityProjection2 } from "@opengeni/db/canonical-human-identities";
 import { getCookie as getCookie2 } from "hono/cookie";
 import { HTTPException as HTTPException109 } from "hono/http-exception";
-import { z as z55 } from "zod";
+import { z as z56 } from "zod";
 
 // src/routes/managed-auth-session-sets.ts
 import { assertManagedUserAdmission as assertManagedUserAdmission2, getManagedSession as getManagedSession3 } from "@opengeni/core";
@@ -112189,12 +112293,12 @@ import {
 import { ensureManagedAccessForUser as ensureManagedAccessForUser2, getSession as getSession10 } from "@opengeni/db";
 import { deleteCookie as deleteCookie3, getCookie, setCookie as setCookie3 } from "hono/cookie";
 import { HTTPException as HTTPException108 } from "hono/http-exception";
-import { z as z54 } from "zod";
-var ManagedAuthSocialStartReceipt = z54.object({
-  version: z54.literal(1),
-  requestDigest: z54.string().regex(/^[0-9a-f]{64}$/u),
-  url: z54.string().url().max(4096),
-  stateCookie: z54.string().min(1).max(4096)
+import { z as z55 } from "zod";
+var ManagedAuthSocialStartReceipt = z55.object({
+  version: z55.literal(1),
+  requestDigest: z55.string().regex(/^[0-9a-f]{64}$/u),
+  url: z55.string().url().max(4096),
+  stateCookie: z55.string().min(1).max(4096)
 }).strict();
 function registerManagedAuthSessionSetRoutes(app, deps) {
   const noStore = async (context, next) => {
@@ -113130,23 +113234,23 @@ function setCookieHeaders(headers) {
 }
 
 // src/routes/managed-sign-in-methods.ts
-var ConnectState = z55.object({
-  opengeniSignInMethod: z55.object({
-    intentId: z55.string().uuid(),
-    provider: z55.enum(["google", "github"])
+var ConnectState = z56.object({
+  opengeniSignInMethod: z56.object({
+    intentId: z56.string().uuid(),
+    provider: z56.enum(["google", "github"])
   }),
-  link: z55.object({ userId: z55.string().min(1), email: z55.string().email() }),
-  callbackURL: z55.string().url(),
-  errorURL: z55.string().url()
+  link: z56.object({ userId: z56.string().min(1), email: z56.string().email() }),
+  callbackURL: z56.string().url(),
+  errorURL: z56.string().url()
 });
-var ConnectIntent = z55.object({
-  authUserId: z55.string().min(1),
-  authSessionId: z55.string().min(1),
-  expectedIdentityId: z55.string().uuid(),
-  actorFence: z55.object({
-    authorityHash: z55.string().regex(/^[0-9a-f]{64}$/),
-    actorEpoch: z55.string().regex(/^[1-9][0-9]*$/),
-    requestId: z55.string().uuid()
+var ConnectIntent = z56.object({
+  authUserId: z56.string().min(1),
+  authSessionId: z56.string().min(1),
+  expectedIdentityId: z56.string().uuid(),
+  actorFence: z56.object({
+    authorityHash: z56.string().regex(/^[0-9a-f]{64}$/),
+    actorEpoch: z56.string().regex(/^[1-9][0-9]*$/),
+    requestId: z56.string().uuid()
   }).optional()
 });
 async function rows(deps, query) {
@@ -113466,7 +113570,7 @@ async function handleManagedSignInConnectCallback(context, deps, provider) {
 
 // src/routes/canonical-human-identities.ts
 import { managedAuthSecretRequestDigest as managedAuthSecretRequestDigest3 } from "@opengeni/core/managed-auth-session-sets";
-var BindingId = z56.string().uuid();
+var BindingId = z57.string().uuid();
 async function requestIdentity(context, deps) {
   return await requireCanonicalHumanRequestIdentity2(context, {
     db: deps.db,
@@ -113702,7 +113806,7 @@ import {
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState14,
+  nestedPostgresSqlState as nestedPostgresSqlState15,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -113716,11 +113820,11 @@ import {
   updateOrganizationRetentionPolicy
 } from "@opengeni/db";
 import { HTTPException as HTTPException111 } from "hono/http-exception";
-import { z as z57 } from "zod";
-var OrganizationId2 = z57.string().uuid();
-var WorkspaceId = z57.string().uuid();
-var MembershipId = z57.string().uuid();
-var InvitationId = z57.string().uuid();
+import { z as z58 } from "zod";
+var OrganizationId2 = z58.string().uuid();
+var WorkspaceId = z58.string().uuid();
+var MembershipId = z58.string().uuid();
+var InvitationId = z58.string().uuid();
 async function requirePrivateSessionAdministrator(context, deps, organizationId2) {
   const agent = agentActingAsPerson(
     context,
@@ -113819,7 +113923,7 @@ function parseId(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
-  const sqlState = nestedPostgresSqlState14(error);
+  const sqlState = nestedPostgresSqlState15(error);
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException111(409, {
       message: resourceLimitMessage
@@ -113924,7 +114028,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState14(error) === "42501") {
+      if (nestedPostgresSqlState15(error) === "42501") {
         throw new HTTPException111(403, {
           message: "organization membership is not active"
         });
@@ -114232,11 +114336,6 @@ function registerOrganizationMembershipRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState14(error) === "55000") {
-        throw new HTTPException111(409, {
-          message: "private-session readiness is not activated for this organization"
-        });
-      }
       rethrowMembershipError(error);
     }
   });
@@ -114584,13 +114683,13 @@ import {
   SessionListCursorExpiredError as SessionListCursorExpiredError2
 } from "@opengeni/db";
 import { HTTPException as HTTPException112 } from "hono/http-exception";
-import { z as z58 } from "zod";
+import { z as z59 } from "zod";
 var ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS = 25;
-var OrganizationId3 = z58.string().uuid();
-var OrganizationSessionListCursorEnvelope = z58.object({
-  workspaceId: z58.string().uuid(),
-  cursor: z58.string().min(1).nullable(),
-  pinnedOffset: z58.number().int().nonnegative().max(1e4).optional()
+var OrganizationId3 = z59.string().uuid();
+var OrganizationSessionListCursorEnvelope = z59.object({
+  workspaceId: z59.string().uuid(),
+  cursor: z59.string().min(1).nullable(),
+  pinnedOffset: z59.number().int().nonnegative().max(1e4).optional()
 }).strict();
 function encodeOrganizationSessionListCursor(cursor) {
   return Buffer.from(JSON.stringify(cursor)).toString("base64url");
@@ -114818,9 +114917,9 @@ import {
   startOrganizationRecoveryOperation
 } from "@opengeni/db";
 import { HTTPException as HTTPException113 } from "hono/http-exception";
-import { z as z59 } from "zod";
-var OrganizationId4 = z59.string().uuid();
-var RecoveryOperationId = z59.string().uuid();
+import { z as z60 } from "zod";
+var OrganizationId4 = z60.string().uuid();
+var RecoveryOperationId = z60.string().uuid();
 var productionServices = {
   requireCanonicalHumanRequestIdentity: requireCanonicalHumanRequestIdentity3,
   getManagedAuthRequestActorAdmissionStamp,
@@ -115071,7 +115170,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState15,
+  nestedPostgresSqlState as nestedPostgresSqlState16,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup,
   recordOrganizationSignupUseCase
@@ -115128,14 +115227,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           useCase: parsed.data.useCase
         }).catch((error) => {
           console.warn("[api] could not record the signup use case", {
-            sqlState: nestedPostgresSqlState15(error) ?? null
+            sqlState: nestedPostgresSqlState16(error) ?? null
           });
         });
       }
       return context.json(completed);
     } catch (error) {
       recordOrganizationSetupOutcome(deps.observability, "failed");
-      const sqlState = nestedPostgresSqlState15(error);
+      const sqlState = nestedPostgresSqlState16(error);
       if (sqlState === "22023") {
         throw new HTTPException114(422, {
           message: "invalid organization setup request"
@@ -115215,7 +115314,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState15(error);
+      const sqlState = nestedPostgresSqlState16(error);
       if (sqlState === "22023") {
         throw new HTTPException114(422, {
           message: "invalid account setup request"
@@ -115336,9 +115435,9 @@ import {
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState16, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState17, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException115 } from "hono/http-exception";
-import { z as z60 } from "zod";
+import { z as z61 } from "zod";
 async function body2(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) throw new HTTPException115(422, { message: "invalid user-resource request" });
@@ -115351,10 +115450,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError15) {
     throw new HTTPException115(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState16(error) === "42501") {
+  if (nestedPostgresSqlState17(error) === "42501") {
     throw new HTTPException115(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState16(error) === "22023") {
+  if (nestedPostgresSqlState17(error) === "22023") {
     throw new HTTPException115(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -115395,7 +115494,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z60.string().uuid().safeParse(context.req.param("authorityId"));
+    const authorityId = z61.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException115(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
     const access = await requireAccessGrantAuthorization39(
@@ -115425,7 +115524,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeUserResourceGrantQuery.safeParse({ scope: context.req.query("scope") });
     if (!query.success) throw new HTTPException115(422, { message: "explicit scope=user required" });
-    const grantId = z60.string().uuid().safeParse(context.req.param("grantId"));
+    const grantId = z61.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException115(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization39(
@@ -122068,7 +122167,8 @@ function createAppComposition(deps) {
       await next();
       return;
     }
-    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
+    const permission = c.req.method === "PUT" && /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path) ? "artifacts:publish" : void 0;
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
@@ -122938,7 +123038,7 @@ async function withTimeout(promise, timeoutMs) {
 }
 var routeLabelPatterns = [
   {
-    pattern: /^\/\.well-known\/oauth-authorization-server$/,
+    pattern: /^\/\.well-known\/oauth-authorization-server(?:\/.*)?$/,
     label: "/.well-known/oauth-authorization-server"
   },
   {
@@ -123945,4 +124045,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-6TZ5LG3O.js.map
+//# sourceMappingURL=chunk-A4J3LBH6.js.map