@opengeni/api-router 2.10.0-canary.2 → 2.10.0-canary.4

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-BVX5ASFY.js";
+} from "./chunk-NWSVDE7O.js";
 
 // src/index.ts
 import {

package/dist/mcp/scheduled-task-view.d.ts

@@ -82,8 +82,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -205,8 +205,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -389,8 +389,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
-            readonly sourceId?: never;
             kind: "agent_turn";
+            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.10.0-canary.2",
+  "version": "2.10.0-canary.4",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.11",
-    "@opengeni/artifact-tool": "^0.3.19-canary.2",
-    "@opengeni/capabilities": "^0.3.2-canary.2",
-    "@opengeni/codemode": "^0.4.27-canary.2",
-    "@opengeni/codex": "^0.2.21-canary.2",
-    "@opengeni/config": "^1.0.0-canary.2",
-    "@opengeni/contracts": "^2.13.0-canary.2",
-    "@opengeni/core": "^2.7.5-canary.2",
-    "@opengeni/db": "^4.0.0-canary.2",
-    "@opengeni/documents": "^0.8.19-canary.2",
-    "@opengeni/events": "^0.4.17-canary.2",
-    "@opengeni/github": "^0.7.3-canary.2",
-    "@opengeni/network": "^0.3.0-canary.2",
-    "@opengeni/observability": "^0.8.19-canary.2",
-    "@opengeni/runtime": "^2.3.0-canary.2",
-    "@opengeni/storage": "^0.2.120-canary.2",
-    "@opengeni/tool-gateway": "^0.1.0-canary.2",
-    "@opengeni/xai-subscription": "^0.1.3-canary.2",
+    "@opengeni/agent-proto": "^0.5.1-canary.13",
+    "@opengeni/artifact-tool": "^0.3.19-canary.4",
+    "@opengeni/capabilities": "^0.3.2-canary.4",
+    "@opengeni/codemode": "^0.4.27-canary.4",
+    "@opengeni/codex": "^0.2.21-canary.4",
+    "@opengeni/config": "^1.0.0-canary.4",
+    "@opengeni/contracts": "^2.13.0-canary.4",
+    "@opengeni/core": "^2.7.5-canary.4",
+    "@opengeni/db": "^4.0.0-canary.4",
+    "@opengeni/documents": "^0.8.19-canary.4",
+    "@opengeni/events": "^0.4.17-canary.4",
+    "@opengeni/github": "^0.7.3-canary.4",
+    "@opengeni/network": "^0.3.0-canary.4",
+    "@opengeni/observability": "^0.8.19-canary.4",
+    "@opengeni/runtime": "^2.3.0-canary.4",
+    "@opengeni/storage": "^0.2.120-canary.4",
+    "@opengeni/tool-gateway": "^0.1.0-canary.4",
+    "@opengeni/xai-subscription": "^0.1.3-canary.4",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -1974,6 +1974,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/inference-control$/,
     label: "/v1/workspaces/:workspaceId/inference-control",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/pause-timer$/,
+    label: "/v1/workspaces/:workspaceId/pause-timer",
+  },
   {
     pattern:
       /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/fs\/(list|list-batch|read|write|delete|move|mkdir)$/,

package/src/routes/codex.ts

@@ -1214,7 +1214,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: sourceBeforeConnect.workspaceKind === "personal" ? "automatic" : "workspace",
+        mode: "workspace",
         effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource,
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);

package/src/routes/video-generation.ts

@@ -14,6 +14,7 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy,
@@ -58,7 +59,7 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
 
   app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
     const [connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),

package/src/routes/workspace-artifacts.ts

@@ -181,7 +181,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
     const ref = await getWorkspaceArtifactContentRef(
       deps.db,
       workspaceId,
@@ -193,13 +195,20 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
       status: context.req.query("status"),
+      sourceSessionId: context.req.query("sourceSessionId"),
     });
     if (!query.success) throw new HTTPException(422, { message: "Invalid artifact list query" });
+    if (
+      query.data.sourceSessionId &&
+      !(await canReadProvenanceSession(deps, grant, query.data.sourceSessionId))
+    ) {
+      throw new HTTPException(404, { message: "Session not found" });
+    }
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
@@ -208,6 +217,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
               limit: query.data.limit,
               ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
               ...(query.data.status ? { status: query.data.status } : {}),
+              ...(query.data.sourceSessionId
+                ? { sourceSessionId: query.data.sourceSessionId }
+                : {}),
             }),
           ),
         ),
@@ -281,7 +293,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
     const ref = await getWorkspaceArtifactContentRef(
       deps.db,
       workspaceId,

package/src/routes/workspace-learning.ts

@@ -12,6 +12,7 @@ import {
 import {
   publishGovernedLearningEventToSlack,
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -122,7 +123,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.post(`${base}/revisions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, CreateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -149,7 +150,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     const revisionId = z.string().uuid().safeParse(context.req.param("revisionId"));
     if (!revisionId.success) throw new HTTPException(422, { message: "Invalid revision id" });
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, ActivateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -174,7 +175,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.post(`${base}/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, RollbackWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -206,7 +207,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
     if (!activationReceiptId.success) {
       throw new HTTPException(422, { message: "Invalid activation receipt id" });
     }
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, UndoGovernedLearningActivationHttpRequest);
     try {
       const undo = await undoGovernedLearningActivation(deps.db, {

package/src/routes/workspaces.ts

@@ -1,3 +1,5 @@
+import { SessionControlConflictError, WorkspacePauseTimerInputError } from "@opengeni/db";
+import { WorkspacePauseTimerRequest } from "@opengeni/contracts";
 import { createHash } from "node:crypto";
 import {
   AddWorkspaceMemberRequest,
@@ -86,6 +88,7 @@ import {
   hasPermission,
   requireAccessContext,
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   requireFreshAccessGrant,
   resolveWorkspaceCatalogSettings,
 } from "@opengeni/core";
@@ -95,6 +98,7 @@ import {
   assertWorkspaceMemberRemovable,
   assertWorkspaceMemberUpdateAllowed,
   controlHumanWorkspace,
+  controlHumanWorkspaceTimer,
 } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
 import { ApiHttpError } from "../http/api-error";
@@ -367,7 +371,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   // deep-merges (top-level) a settings patch, preserving unknown/future keys.
   app.patch("/v1/workspaces/:workspaceId/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, {
@@ -476,7 +480,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceGatewayCustomModelRequest.safeParse(
       await c.req.json().catch(() => null),
     );
@@ -552,7 +556,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/gateway-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (
       !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
@@ -613,7 +617,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceOpenRouterCustomModelRequest.safeParse(
       await c.req.json().catch(() => null),
     );
@@ -691,7 +695,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/openrouter-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (
       !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
@@ -804,12 +808,12 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 
   // Full replace (PUT, not merge): null/omitted = unrestricted for that
-  // dimension; an empty array is a valid explicit total block. Admin access —
-  // this decides whether turns can reach paid providers, so it is the same
-  // trust level as billing-affecting workspace settings.
+  // dimension; an empty array is a valid explicit total block. Settings access
+  // admits workspace administrators and the verified Personal owner, without
+  // widening membership or API-key delegation authority.
   app.put("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
     const catalog = await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: grant.accountId,
@@ -824,9 +828,42 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(policy);
   });
 
+  app.post("/v1/workspaces/:workspaceId/pause-timer", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    if (workspaceControlUtf8Bytes(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES) {
+      throw new HTTPException(400, { message: "workspace-control actor is too large" });
+    }
+    const parsed = WorkspacePauseTimerRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) throw new HTTPException(400, { message: "Invalid pause timer" });
+    try {
+      await controlHumanWorkspaceTimer(
+        {
+          db: deps.db,
+          bus: deps.bus,
+          workflowClient: deps.workflowClient,
+          ...(deps.schedulePromptPostCommit
+            ? { schedulePromptPostCommit: deps.schedulePromptPostCommit }
+            : {}),
+        },
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        parsed.data,
+      );
+    } catch (error) {
+      if (error instanceof SessionControlConflictError)
+        throw new HTTPException(409, {
+          message: "Workspace changed. Reopen the timer and try again.",
+        });
+      if (error instanceof WorkspacePauseTimerInputError)
+        throw new HTTPException(400, { message: error.message });
+      throw error;
+    }
+    return c.json({ ok: true });
+  });
+
   app.post("/v1/workspaces/:workspaceId/inference-control", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES) {
       throw new HTTPException(400, {
         message: "workspace-control actor is too large",