@opengeni/api-router 2.10.0-canary.2 → 2.10.0-canary.4

package/dist/app.js

@@ -24,7 +24,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-BVX5ASFY.js";
+} from "./chunk-NWSVDE7O.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,
   allowedCorsOrigin,

package/dist/{chunk-BVX5ASFY.js → chunk-NWSVDE7O.js}

@@ -27892,7 +27892,7 @@ function registerCodexRoutes(app, deps) {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: sourceBeforeConnect.workspaceKind === "personal" ? "automatic" : "workspace",
+        mode: "workspace",
         effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);
@@ -56928,6 +56928,8 @@ function socialHttpException(error) {
 }
 
 // src/routes/workspaces.ts
+import { SessionControlConflictError as SessionControlConflictError2, WorkspacePauseTimerInputError } from "@opengeni/db";
+import { WorkspacePauseTimerRequest } from "@opengeni/contracts";
 import { createHash as createHash18 } from "crypto";
 import {
   AddWorkspaceMemberRequest,
@@ -57011,6 +57013,7 @@ import {
   hasPermission as hasPermission20,
   requireAccessContext as requireAccessContext3,
   requireAccessGrant as requireAccessGrant32,
+  requireWorkspaceSettingsGrant,
   requireFreshAccessGrant as requireFreshAccessGrant3,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings7
 } from "@opengeni/core";
@@ -57018,7 +57021,8 @@ import { requireLimit as requireLimit9 } from "@opengeni/core";
 import {
   assertWorkspaceMemberRemovable,
   assertWorkspaceMemberUpdateAllowed,
-  controlHumanWorkspace
+  controlHumanWorkspace,
+  controlHumanWorkspaceTimer
 } from "@opengeni/core";
 
 // src/workspace-deletion.ts
@@ -57358,7 +57362,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException60(400, {
@@ -57458,7 +57462,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceGatewayCustomModelRequest.safeParse(
       await c.req.json().catch(() => null)
     );
@@ -57530,7 +57534,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/gateway-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
       customModelId
@@ -57587,7 +57591,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceOpenRouterCustomModelRequest.safeParse(
       await c.req.json().catch(() => null)
     );
@@ -57659,7 +57663,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/openrouter-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
       customModelId
@@ -57763,7 +57767,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
     const catalog = await resolveWorkspaceCatalogSettings7(deps.db, deps.settings, {
       accountId: grant.accountId,
@@ -57777,9 +57781,39 @@ function registerWorkspaceRoutes(app, deps) {
     });
     return c.json(policy);
   });
+  app.post("/v1/workspaces/:workspaceId/pause-timer", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
+      throw new HTTPException60(400, { message: "workspace-control actor is too large" });
+    }
+    const parsed = WorkspacePauseTimerRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) throw new HTTPException60(400, { message: "Invalid pause timer" });
+    try {
+      await controlHumanWorkspaceTimer(
+        {
+          db: deps.db,
+          bus: deps.bus,
+          workflowClient: deps.workflowClient,
+          ...deps.schedulePromptPostCommit ? { schedulePromptPostCommit: deps.schedulePromptPostCommit } : {}
+        },
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        parsed.data
+      );
+    } catch (error) {
+      if (error instanceof SessionControlConflictError2)
+        throw new HTTPException60(409, {
+          message: "Workspace changed. Reopen the timer and try again."
+        });
+      if (error instanceof WorkspacePauseTimerInputError)
+        throw new HTTPException60(400, { message: error.message });
+      throw error;
+    }
+    return c.json({ ok: true });
+  });
   app.post("/v1/workspaces/:workspaceId/inference-control", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
       throw new HTTPException60(400, {
         message: "workspace-control actor is too large"
@@ -58422,7 +58456,8 @@ import {
 } from "@opengeni/contracts";
 import {
   publishGovernedLearningEventToSlack,
-  requireAccessGrant as requireAccessGrant34
+  requireAccessGrant as requireAccessGrant34,
+  requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant2
 } from "@opengeni/core";
 import {
   activateWorkspaceLearningPolicyRevision,
@@ -58515,7 +58550,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
   });
   app.post(`${base}/revisions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, CreateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58541,7 +58576,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     const revisionId2 = z18.string().uuid().safeParse(context.req.param("revisionId"));
     if (!revisionId2.success) throw new HTTPException62(422, { message: "Invalid revision id" });
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, ActivateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58565,7 +58600,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
   });
   app.post(`${base}/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, RollbackWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -58593,7 +58628,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
     if (!activationReceiptId.success) {
       throw new HTTPException62(422, { message: "Invalid activation receipt id" });
     }
-    const grant = await requireAccessGrant34(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant2(context, deps, workspaceId);
     const request = await parseBody2(context, UndoGovernedLearningActivationHttpRequest);
     try {
       const undo = await undoGovernedLearningActivation(deps.db, {
@@ -60188,7 +60223,9 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException67(503, { message: "Object storage is not configured" });
+      throw new HTTPException67(503, {
+        message: "Object storage is not configured"
+      });
     const ref = await getWorkspaceArtifactContentRef2(
       deps.db,
       workspaceId,
@@ -60199,13 +60236,17 @@ function registerWorkspaceArtifactRoutes(app, deps) {
   });
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
-      status: context.req.query("status")
+      status: context.req.query("status"),
+      sourceSessionId: context.req.query("sourceSessionId")
     });
     if (!query.success) throw new HTTPException67(422, { message: "Invalid artifact list query" });
+    if (query.data.sourceSessionId && !await canReadProvenanceSession(deps, grant, query.data.sourceSessionId)) {
+      throw new HTTPException67(404, { message: "Session not found" });
+    }
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
@@ -60213,7 +60254,8 @@ function registerWorkspaceArtifactRoutes(app, deps) {
             await listWorkspaceArtifacts2(deps.db, workspaceId, {
               limit: query.data.limit,
               ...query.data.cursor ? { cursor: query.data.cursor } : {},
-              ...query.data.status ? { status: query.data.status } : {}
+              ...query.data.status ? { status: query.data.status } : {},
+              ...query.data.sourceSessionId ? { sourceSessionId: query.data.sourceSessionId } : {}
             })
           )
         )
@@ -60285,7 +60327,9 @@ function registerWorkspaceArtifactRoutes(app, deps) {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant39(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException67(503, { message: "Object storage is not configured" });
+      throw new HTTPException67(503, {
+        message: "Object storage is not configured"
+      });
     const ref = await getWorkspaceArtifactContentRef2(
       deps.db,
       workspaceId,
@@ -61997,6 +62041,7 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant as requireAccessGrant44,
+  requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant3,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy
@@ -62033,7 +62078,7 @@ function registerVideoGenerationRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant44(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant3(c, deps, workspaceId);
     const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
     const [connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
@@ -71253,6 +71298,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/inference-control$/,
     label: "/v1/workspaces/:workspaceId/inference-control"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pause-timer$/,
+    label: "/v1/workspaces/:workspaceId/pause-timer"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/fs\/(list|list-batch|read|write|delete|move|mkdir)$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/fs/:operation"
@@ -71853,4 +71902,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-BVX5ASFY.js.map
+//# sourceMappingURL=chunk-NWSVDE7O.js.map