@opengeni/api-router 1.0.2 → 1.1.0

package/dist/mcp/server.d.ts

@@ -43,7 +43,7 @@ export declare function slackBotFileContentResult(result: Awaited<ReturnType<Ope
         mimeType?: never;
         data?: never;
     } | {
-        readonly text?: never;
+        text?: never;
         type: "image";
         mimeType: "image/jpeg" | "image/png" | "image/webp";
         data: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,25 +43,25 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "1.0.2",
-    "@opengeni/artifact-tool": "1.0.2",
-    "@opengeni/capabilities": "1.0.2",
-    "@opengeni/codemode": "1.0.2",
-    "@opengeni/codex": "1.0.2",
-    "@opengeni/config": "1.0.2",
-    "@opengeni/contracts": "1.0.2",
-    "@opengeni/core": "1.0.2",
-    "@opengeni/db": "1.0.2",
-    "@opengeni/documents": "1.0.2",
-    "@opengeni/events": "1.0.2",
-    "@opengeni/github": "1.0.2",
-    "@opengeni/interaction": "1.0.2",
-    "@opengeni/network": "1.0.2",
-    "@opengeni/observability": "1.0.2",
-    "@opengeni/runtime": "1.0.2",
-    "@opengeni/storage": "1.0.2",
-    "@opengeni/tool-gateway": "1.0.2",
-    "@opengeni/xai-subscription": "1.0.2",
+    "@opengeni/agent-proto": "1.1.0",
+    "@opengeni/artifact-tool": "1.1.0",
+    "@opengeni/capabilities": "1.1.0",
+    "@opengeni/codemode": "1.1.0",
+    "@opengeni/codex": "1.1.0",
+    "@opengeni/config": "1.1.0",
+    "@opengeni/contracts": "1.1.0",
+    "@opengeni/core": "1.1.0",
+    "@opengeni/db": "1.1.0",
+    "@opengeni/documents": "1.1.0",
+    "@opengeni/events": "1.1.0",
+    "@opengeni/github": "1.1.0",
+    "@opengeni/interaction": "1.1.0",
+    "@opengeni/network": "1.1.0",
+    "@opengeni/observability": "1.1.0",
+    "@opengeni/runtime": "1.1.0",
+    "@opengeni/storage": "1.1.0",
+    "@opengeni/tool-gateway": "1.1.0",
+    "@opengeni/xai-subscription": "1.1.0",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -1418,7 +1418,13 @@ export function createAppComposition(deps: AppDependencies): {
       await next();
       return;
     }
-    const grant = await requireAccessGrant(c, routeDeps, workspaceId);
+    // Match Hono's decoded routing path before first-use membership and RLS.
+    const permission =
+      c.req.method === "PUT" &&
+      /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path)
+        ? "artifacts:publish"
+        : undefined;
+    const grant = await requireAccessGrant(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
 
@@ -2480,7 +2486,7 @@ const routeLabelPatterns: Array<{
   label: string | ((match: RegExpMatchArray) => string);
 }> = [
   {
-    pattern: /^\/\.well-known\/oauth-authorization-server$/,
+    pattern: /^\/\.well-known\/oauth-authorization-server(?:\/.*)?$/,
     label: "/.well-known/oauth-authorization-server",
   },
   {

package/src/artifact-catalog-cursor.ts

@@ -13,6 +13,7 @@ const Cursor = z
         key: z.string().max(4096),
         kind: ArtifactCatalogKind,
         id: z.string().min(1).max(128),
+        pinned: z.boolean().optional(),
       })
       .strict(),
   })

package/src/index.ts

@@ -342,8 +342,6 @@ export async function startApi(
     rlsStrategy: settings.rlsStrategy,
     expectedRole: settings.runtimeDatabaseRole,
     targetSchema: settings.dbSchema.trim() || "public",
-    organizationTenancyCanonicalActivationEnabled:
-      settings.organizationTenancyCanonicalActivationEnabled,
   } as const;
   // The PRIVILEGED control-plane NATS login (M-AUTH): when the server runs with
   // auth_callout, api/worker authenticate as a static account user permitted to

package/src/mcp/action-catalog.gen.ts

@@ -6106,6 +6106,17 @@ export const ACTION_CATALOG: readonly ActionCatalogEntry[] = [
       "PrReviewAppRegistration"
     ]
   },
+  {
+    "id": "updateArtifactPin",
+    "method": "PUT",
+    "path": "/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin",
+    "request": [
+      "ArtifactCatalogKind"
+    ],
+    "response": [
+      "ArtifactPinResponse"
+    ]
+  },
   {
     "id": "updateBrowserIdentity",
     "method": "PATCH",

package/src/mcp/server.ts

@@ -9,6 +9,7 @@ import {
   setSessionChannel,
 } from "@opengeni/db";
 import { createHash, randomUUID } from "node:crypto";
+import { assertGoalResumeAllowed } from "@opengeni/core";
 import { mintEnrollToken } from "../sandbox/enrollment";
 import { capabilityAccountReadiness } from "./capability-account-readiness";
 import {
@@ -3076,6 +3077,8 @@ function registerGoalTools(
         sessionId,
         {
           status: "active",
+          beforeResume: (tx, session, causalTurn) =>
+            assertGoalResumeAllowed({ ...deps, db: tx }, session, causalTurn),
           event: { type: "goal.resumed", actor: "agent" },
         },
       );

package/src/mcp-oauth.ts

@@ -79,7 +79,10 @@ export type McpOAuthRouteAccess = {
 };
 
 export function registerMcpOAuthRoutes(app: Hono, deps: ApiRouteDeps): void {
-  app.get("/.well-known/oauth-authorization-server", (c) => {
+  // RFC 8414 path-aware discovery: MCP clients (Claude among them) ask for the
+  // metadata at /.well-known/oauth-authorization-server/<resource path> first
+  // and give up on anything but JSON. Serve the same document at both.
+  const authorizationServerMetadata = (c: Context) => {
     requireMcpOAuthEnabled(deps);
     const issuer = mcpOAuthIssuer(deps);
     c.header("cache-control", "public, max-age=300");
@@ -97,7 +100,9 @@ export function registerMcpOAuthRoutes(app: Hono, deps: ApiRouteDeps): void {
         authorization_response_iss_parameter_supported: true,
       }),
     );
-  });
+  };
+  app.get("/.well-known/oauth-authorization-server", authorizationServerMetadata);
+  app.get("/.well-known/oauth-authorization-server/*", authorizationServerMetadata);
 
   app.get("/.well-known/oauth-protected-resource/*", (c) => {
     requireMcpOAuthEnabled(deps);
@@ -563,6 +568,7 @@ export function mcpOAuthConsentToolIdentities(catalog: ToolGatewayCatalog): Tool
 export function isMcpOAuthPublicProtocolPath(pathname: string): boolean {
   return (
     pathname === "/.well-known/oauth-authorization-server" ||
+    pathname.startsWith("/.well-known/oauth-authorization-server/") ||
     pathname.startsWith("/.well-known/oauth-protected-resource/") ||
     pathname === "/oauth/register" ||
     pathname === "/oauth/authorize" ||

package/src/routes/artifact-catalog.ts

@@ -4,6 +4,8 @@ import {
   ArtifactCatalogKind,
   ArtifactCatalogListQuery,
   ArtifactCatalogListResponse,
+  ArtifactPinResponse,
+  UpdateArtifactPinRequest,
   retainedArtifactReferenceFromFile,
   retainedGeneratedImageReferenceFromFile,
   type AccessGrant,
@@ -26,6 +28,8 @@ import {
   getGeneratedImageArtifact,
   getSessionAuthorityProjection,
   listArtifactCatalogCandidates,
+  nestedPostgresSqlState,
+  updateArtifactPin,
   withSessionRlsActorContext,
   type ArtifactCatalogCandidate,
   type ArtifactCatalogPosition,
@@ -33,6 +37,7 @@ import {
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
 import { artifactCatalogCursorCodec } from "../artifact-catalog-cursor";
 import {
   editableArtifactActorForGrant,
@@ -51,9 +56,95 @@ const position = (row: ArtifactCatalogCandidate): ArtifactCatalogPosition => ({
   key: row.sort_key,
   kind: row.kind,
   id: row.id,
+  pinned: row.pinned ?? false,
 });
 
 export function registerArtifactCatalogRoutes(app: Hono, deps: Dependencies): void {
+  app.put("/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin", async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish",
+    );
+    const grant = authorization.grant;
+    if (!hasPermission(grant.permissions, "artifacts:publish"))
+      throw new HTTPException(403, { message: "Artifact publish access required" });
+    const kind = ArtifactCatalogKind.safeParse(context.req.param("kind"));
+    const body = UpdateArtifactPinRequest.safeParse(await context.req.json().catch(() => null));
+    const requestedId = context.req.param("artifactId");
+    if (
+      !kind.success ||
+      !body.success ||
+      !(editableKinds.has(kind.data)
+        ? /^[0-9a-f]{32}$/.test(requestedId)
+        : z.string().uuid().safeParse(requestedId).success)
+    )
+      throw new HTTPException(422, { message: "Invalid artifact pin request" });
+    const artifactId = editableKinds.has(kind.data) ? requestedId : requestedId.toLowerCase();
+    const fileKind = kind.data === "file" || kind.data === "image";
+    if (!hasPermission(grant.permissions, fileKind ? "files:read" : "artifacts:read"))
+      throw new HTTPException(403, { message: "Artifact read access required" });
+    const actor = fileKind
+      ? await fileOwnerContextForAccess(deps, authorization, "files:read")
+      : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+    context.header("cache-control", "private, no-store");
+    return withSessionRlsActorContext(actor, async () => {
+      if (editableKinds.has(kind.data)) {
+        if (!deps.editableArtifacts)
+          throw new HTTPException(503, { message: "Editable artifacts are unavailable" });
+        try {
+          const scope = editableArtifactScope({ accountId: grant.accountId, workspaceId });
+          const artifact = await deps.editableArtifacts.readArtifact({
+            scope,
+            actor: editableArtifactActorForGrant(grant, "0000000000000001"),
+            artifactId: editableArtifactId(artifactId),
+          });
+          if (
+            artifact.scope.accountId !== scope.accountId ||
+            artifact.scope.workspaceId !== scope.workspaceId ||
+            artifact.id !== artifactId ||
+            artifact.modality !== kind.data
+          )
+            throw new HTTPException(404, { message: "Artifact not found" });
+        } catch (error) {
+          if (isInvisibleListCandidate(error))
+            throw new HTTPException(404, { message: "Artifact not found" });
+          throw editableArtifactHttpError(error);
+        }
+      }
+      if (fileKind) {
+        const subjectId = await fileAuthoritySubjectIdForGrant(deps, grant);
+        const [file] = await getFilesForSubject(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId,
+          fileIds: [artifactId],
+        });
+        if (!file || file.status !== "ready")
+          throw new HTTPException(404, { message: "Artifact not found" });
+      }
+      try {
+        await updateArtifactPin(
+          deps.db,
+          { accountId: grant.accountId, workspaceId },
+          {
+            kind: kind.data,
+            artifactId,
+            pinned: body.data.pinned,
+          },
+        );
+      } catch (error) {
+        if (nestedPostgresSqlState(error) === "42501")
+          throw new HTTPException(404, { message: "Artifact not found" });
+        throw error;
+      }
+      return context.json(
+        ArtifactPinResponse.parse({ kind: kind.data, artifactId, pinned: body.data.pinned }),
+      );
+    });
+  });
   app.get("/v1/workspaces/:workspaceId/artifact-catalog", async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization(context, deps, workspaceId);
@@ -210,6 +301,7 @@ async function projectCandidate(
     status: row.status,
     createdAt: iso(row.created_at),
     updatedAt: iso(row.updated_at),
+    ...(row.pinned !== undefined ? { pinned: row.pinned } : {}),
   };
   if (row.version_id) item.versionId = row.version_id;
   if (editableKinds.has(row.kind)) {

package/src/routes/organization-memberships.ts

@@ -691,11 +691,6 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
         ),
       );
     } catch (error) {
-      if (nestedPostgresSqlState(error) === "55000") {
-        throw new HTTPException(409, {
-          message: "private-session readiness is not activated for this organization",
-        });
-      }
       rethrowMembershipError(error);
     }
   });

package/src/routes/sessions.ts

@@ -1,4 +1,5 @@
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { assertGoalResumeAllowed, GoalResumeBlockedError } from "@opengeni/core";
 import { UnsupportedLatencyModeError } from "@opengeni/config";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
 import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
@@ -2748,6 +2749,15 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       sessionId,
       {
         status: "active",
+        beforeResume: (tx, session, causalTurn) =>
+          assertGoalResumeAllowed({ ...deps, db: tx }, session, causalTurn).catch(
+            (error: unknown) => {
+              if (error instanceof GoalResumeBlockedError) {
+                throw new HTTPException(422, { message: error.message, cause: error });
+              }
+              throw error;
+            },
+          ),
         event: { type: "goal.resumed", actor: "api" },
       },
     );
@@ -5152,7 +5162,7 @@ export function sessionTenancyHttpError(error: unknown): Error {
   if (error instanceof SessionTenancyNotActivatedError) {
     return new ApiHttpError(409, {
       code: "conflict",
-      message: "Session tenancy is not activated for this organization.",
+      message: "Only-me chats are not enabled for this organization.",
       retryable: false,
       details: { reason: "not_activated" },
     });