@opengeni/api-router 2.10.0-canary.3 → 2.10.0-canary.4

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-CZGPIPDA.js";
+} from "./chunk-NWSVDE7O.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.10.0-canary.3",
+  "version": "2.10.0-canary.4",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.12",
-    "@opengeni/artifact-tool": "^0.3.19-canary.3",
-    "@opengeni/capabilities": "^0.3.2-canary.3",
-    "@opengeni/codemode": "^0.4.27-canary.3",
-    "@opengeni/codex": "^0.2.21-canary.3",
-    "@opengeni/config": "^1.0.0-canary.3",
-    "@opengeni/contracts": "^2.13.0-canary.3",
-    "@opengeni/core": "^2.7.5-canary.3",
-    "@opengeni/db": "^4.0.0-canary.3",
-    "@opengeni/documents": "^0.8.19-canary.3",
-    "@opengeni/events": "^0.4.17-canary.3",
-    "@opengeni/github": "^0.7.3-canary.3",
-    "@opengeni/network": "^0.3.0-canary.3",
-    "@opengeni/observability": "^0.8.19-canary.3",
-    "@opengeni/runtime": "^2.3.0-canary.3",
-    "@opengeni/storage": "^0.2.120-canary.3",
-    "@opengeni/tool-gateway": "^0.1.0-canary.3",
-    "@opengeni/xai-subscription": "^0.1.3-canary.3",
+    "@opengeni/agent-proto": "^0.5.1-canary.13",
+    "@opengeni/artifact-tool": "^0.3.19-canary.4",
+    "@opengeni/capabilities": "^0.3.2-canary.4",
+    "@opengeni/codemode": "^0.4.27-canary.4",
+    "@opengeni/codex": "^0.2.21-canary.4",
+    "@opengeni/config": "^1.0.0-canary.4",
+    "@opengeni/contracts": "^2.13.0-canary.4",
+    "@opengeni/core": "^2.7.5-canary.4",
+    "@opengeni/db": "^4.0.0-canary.4",
+    "@opengeni/documents": "^0.8.19-canary.4",
+    "@opengeni/events": "^0.4.17-canary.4",
+    "@opengeni/github": "^0.7.3-canary.4",
+    "@opengeni/network": "^0.3.0-canary.4",
+    "@opengeni/observability": "^0.8.19-canary.4",
+    "@opengeni/runtime": "^2.3.0-canary.4",
+    "@opengeni/storage": "^0.2.120-canary.4",
+    "@opengeni/tool-gateway": "^0.1.0-canary.4",
+    "@opengeni/xai-subscription": "^0.1.3-canary.4",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/routes/codex.ts

@@ -1214,7 +1214,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: sourceBeforeConnect.workspaceKind === "personal" ? "automatic" : "workspace",
+        mode: "workspace",
         effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource,
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);

package/src/routes/video-generation.ts

@@ -14,6 +14,7 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy,
@@ -58,7 +59,7 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
 
   app.put("/v1/workspaces/:workspaceId/video-generation/policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
     const [connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),

package/src/routes/workspace-artifacts.ts

@@ -181,7 +181,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
     const ref = await getWorkspaceArtifactContentRef(
       deps.db,
       workspaceId,
@@ -193,13 +195,20 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     const query = WorkspaceArtifactListQuery.safeParse({
       limit: context.req.query("limit"),
       cursor: context.req.query("cursor"),
       status: context.req.query("status"),
+      sourceSessionId: context.req.query("sourceSessionId"),
     });
     if (!query.success) throw new HTTPException(422, { message: "Invalid artifact list query" });
+    if (
+      query.data.sourceSessionId &&
+      !(await canReadProvenanceSession(deps, grant, query.data.sourceSessionId))
+    ) {
+      throw new HTTPException(404, { message: "Session not found" });
+    }
     try {
       return context.json(
         WorkspaceArtifactListResponse.parse(
@@ -208,6 +217,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
               limit: query.data.limit,
               ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
               ...(query.data.status ? { status: query.data.status } : {}),
+              ...(query.data.sourceSessionId
+                ? { sourceSessionId: query.data.sourceSessionId }
+                : {}),
             }),
           ),
         ),
@@ -281,7 +293,9 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
-      throw new HTTPException(503, { message: "Object storage is not configured" });
+      throw new HTTPException(503, {
+        message: "Object storage is not configured",
+      });
     const ref = await getWorkspaceArtifactContentRef(
       deps.db,
       workspaceId,

package/src/routes/workspace-learning.ts

@@ -12,6 +12,7 @@ import {
 import {
   publishGovernedLearningEventToSlack,
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -122,7 +123,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.post(`${base}/revisions`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, CreateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -149,7 +150,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     const revisionId = z.string().uuid().safeParse(context.req.param("revisionId"));
     if (!revisionId.success) throw new HTTPException(422, { message: "Invalid revision id" });
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, ActivateWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -174,7 +175,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.post(`${base}/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, RollbackWorkspaceLearningPolicyRevisionRequest);
     try {
       return context.json(
@@ -206,7 +207,7 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
     if (!activationReceiptId.success) {
       throw new HTTPException(422, { message: "Invalid activation receipt id" });
     }
-    const grant = await requireAccessGrant(context, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
     const request = await parseBody(context, UndoGovernedLearningActivationHttpRequest);
     try {
       const undo = await undoGovernedLearningActivation(deps.db, {

package/src/routes/workspaces.ts

@@ -88,6 +88,7 @@ import {
   hasPermission,
   requireAccessContext,
   requireAccessGrant,
+  requireWorkspaceSettingsGrant,
   requireFreshAccessGrant,
   resolveWorkspaceCatalogSettings,
 } from "@opengeni/core";
@@ -370,7 +371,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   // deep-merges (top-level) a settings patch, preserving unknown/future keys.
   app.patch("/v1/workspaces/:workspaceId/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException(400, {
@@ -479,7 +480,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceGatewayCustomModelRequest.safeParse(
       await c.req.json().catch(() => null),
     );
@@ -555,7 +556,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/gateway-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (
       !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
@@ -616,7 +617,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/openrouter-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const parsed = CreateWorkspaceOpenRouterCustomModelRequest.safeParse(
       await c.req.json().catch(() => null),
     );
@@ -694,7 +695,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/openrouter-custom-models/:customModelId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const customModelId = c.req.param("customModelId");
     if (
       !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
@@ -807,12 +808,12 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 
   // Full replace (PUT, not merge): null/omitted = unrestricted for that
-  // dimension; an empty array is a valid explicit total block. Admin access —
-  // this decides whether turns can reach paid providers, so it is the same
-  // trust level as billing-affecting workspace settings.
+  // dimension; an empty array is a valid explicit total block. Settings access
+  // admits workspace administrators and the verified Personal owner, without
+  // widening membership or API-key delegation authority.
   app.put("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
     const catalog = await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: grant.accountId,
@@ -829,7 +830,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/pause-timer", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES) {
       throw new HTTPException(400, { message: "workspace-control actor is too large" });
     }
@@ -862,7 +863,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/inference-control", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
     if (workspaceControlUtf8Bytes(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES) {
       throw new HTTPException(400, {
         message: "workspace-control actor is too large",