@opengeni/api-router 2.13.0-canary.0 → 2.13.0-canary.1

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-BJWHVMOL.js";
+} from "./chunk-V4IDX7VJ.js";
 
 // src/index.ts
 import {

package/dist/integrations/github-lens-connect.d.ts

@@ -65,7 +65,7 @@ export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId
         adapterId: string;
         eventTypes: string[];
         sessionTemplate: {
-            bundledSkillIds?: ("builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation")[] | undefined;
+            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
             prompt: string;
             instructions: string | null;
             resources: ({

package/dist/workspace-tool-gateway.d.ts

@@ -3,7 +3,7 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import type { Settings } from "@opengeni/config";
 import { ToolGatewayDeclarationsResponse, type AccessGrant, type ToolGatewayCatalog, type ToolGatewayIdentity } from "@opengeni/contracts";
 import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
-import { consumeToolGatewayApproval, issueToolGatewayApproval } from "@opengeni/db";
+import { consumeToolGatewayApproval, getWorkspaceArtifactContentRef, issueToolGatewayApproval } from "@opengeni/db";
 import { type PreparedWorkspaceToolGatewayTools } from "@opengeni/runtime/workspace-tool-gateway";
 import { type ToolGatewayDefinition } from "@opengeni/tool-gateway";
 import type { Observability } from "@opengeni/observability";
@@ -115,6 +115,7 @@ export declare function approveWorkspaceToolGatewayCall(prepared: PreparedWorksp
     approvalToken: string;
     expiresAt: string;
 }>;
+export declare function requireWorkspaceSiteToolAuthorization(db: ApiRouteDeps["db"], grant: AccessGrant, context: WorkspaceSiteToolContext, resolveVersion?: typeof getWorkspaceArtifactContentRef): Promise<void>;
 export declare function toolGatewayCatalogResponse(catalog: ToolGatewayCatalog): ToolGatewayCatalog;
 export declare function workspaceToolGatewayDeclarations(prepared: PreparedWorkspaceToolGateway): ToolGatewayDeclarationsResponse;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.13.0-canary.0",
+  "version": "2.13.0-canary.1",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.6.0-canary.0",
-    "@opengeni/artifact-tool": "^0.3.27-canary.0",
-    "@opengeni/capabilities": "^0.3.3-canary.12",
-    "@opengeni/codemode": "^0.5.7-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.12",
-    "@opengeni/config": "^1.2.0-canary.0",
-    "@opengeni/contracts": "^3.1.0-canary.0",
-    "@opengeni/core": "^2.10.0-canary.0",
-    "@opengeni/db": "^4.4.0-canary.0",
-    "@opengeni/documents": "^0.8.28-canary.0",
-    "@opengeni/events": "^0.4.26-canary.0",
-    "@opengeni/github": "^0.7.11-canary.0",
-    "@opengeni/network": "^0.3.1-canary.12",
-    "@opengeni/observability": "^0.8.27-canary.0",
-    "@opengeni/runtime": "^2.6.0-canary.0",
-    "@opengeni/storage": "^0.2.128-canary.0",
-    "@opengeni/tool-gateway": "^0.1.8-canary.0",
-    "@opengeni/xai-subscription": "^0.1.4-canary.12",
+    "@opengeni/agent-proto": "^0.6.0-canary.1",
+    "@opengeni/artifact-tool": "^0.3.27-canary.1",
+    "@opengeni/capabilities": "^0.3.3-canary.13",
+    "@opengeni/codemode": "^0.5.7-canary.1",
+    "@opengeni/codex": "^0.2.22-canary.13",
+    "@opengeni/config": "^1.2.0-canary.1",
+    "@opengeni/contracts": "^3.1.0-canary.1",
+    "@opengeni/core": "^2.10.0-canary.1",
+    "@opengeni/db": "^4.4.0-canary.1",
+    "@opengeni/documents": "^0.8.28-canary.1",
+    "@opengeni/events": "^0.4.26-canary.1",
+    "@opengeni/github": "^0.7.11-canary.1",
+    "@opengeni/network": "^0.3.1-canary.13",
+    "@opengeni/observability": "^0.8.27-canary.1",
+    "@opengeni/runtime": "^2.6.0-canary.1",
+    "@opengeni/storage": "^0.2.128-canary.1",
+    "@opengeni/tool-gateway": "^0.1.8-canary.1",
+    "@opengeni/xai-subscription": "^0.1.4-canary.13",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/codemode.ts

@@ -1,3 +1,4 @@
+import { siteRequestHeaders } from "@opengeni/contracts/site-session-http";
 import {
   codemodeDispatchSubject,
   decodeCodemodeDispatchAck,
@@ -93,14 +94,9 @@ export async function codemodeSessionRequest(
   const target = new URL(request.url);
   const rewritten = siteSessionPath(path, authority.workspaceId, request.method);
   const url = new URL(rewritten, target.origin);
-  const headers = new Headers({
-    authorization: `Bearer ${token}`,
-    [OPENGENI_API_CONTRACT_HEADER]: OPENGENI_API_CONTRACT_REVISION,
-  });
-  for (const name of ["content-type", "accept", "last-event-id"]) {
-    const value = request.headers.get(name);
-    if (value) headers.set(name, value);
-  }
+  const headers = siteRequestHeaders(request.headers);
+  headers.set("authorization", `Bearer ${token}`);
+  headers.set(OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION);
   return new Request(url, {
     method: request.method,
     headers,

package/src/workspace-tool-gateway.ts

@@ -48,7 +48,7 @@ import {
   requireWorkspace,
   withCodexAppsRequestAuthorization,
   consumeToolGatewayApproval,
-  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
   issueToolGatewayApproval,
   ToolGatewayApprovalOperationStartedError,
   ToolGatewayApprovalRateLimitError,
@@ -719,24 +719,25 @@ function throwWorkspaceToolGatewayHttpError(error: unknown): never {
   throw error;
 }
 
-async function requireWorkspaceSiteToolAuthorization(
+export async function requireWorkspaceSiteToolAuthorization(
   db: ApiRouteDeps["db"],
   grant: AccessGrant,
   context: WorkspaceSiteToolContext,
+  resolveVersion = getWorkspaceArtifactContentRef,
 ): Promise<void> {
   try {
-    const detail = await getWorkspaceArtifact(db, grant.workspaceId, context.siteArtifactId);
-    const currentVersion = detail.artifact.currentVersion;
-    const requested = currentVersion?.requestedTools.some(
+    const { status, version } = await resolveVersion(
+      db,
+      grant.workspaceId,
+      context.siteArtifactId,
+      context.siteVersionId,
+    );
+    const requested = version.requestedTools.some(
       (identity) =>
         identity.serverId === context.identity.serverId &&
         identity.toolName === context.identity.toolName,
     );
-    if (
-      detail.artifact.status !== "active" ||
-      currentVersion?.id !== context.siteVersionId ||
-      !requested
-    ) {
+    if (status !== "active" || version.id !== context.siteVersionId || !requested) {
       throw new HTTPException(403, { message: "site_tool_not_authorized" });
     }
   } catch (error) {