@opengeni/api-router 2.13.0-canary.0 → 2.13.0-canary.2

package/src/routes/knowledge.ts

@@ -0,0 +1,386 @@
+import { retryWhileMissing } from "@opengeni/storage";
+import { allowedFirstPartyMcpToolsForSession } from "@opengeni/config";
+import {
+  type FirstPartyMcpToolName,
+  AgentLearningContext,
+  AgentLearningOverridePatch,
+  KnowledgeEntryListRequest,
+  KnowledgeReviewBatchListRequest,
+  KnowledgeEntryBatchReviewRequest,
+  AgentInstructionReviewRequest,
+  KnowledgeEntryReviewRequest,
+  KnowledgeEntryRestoreRequest,
+  KnowledgeEntrySaveRequest,
+  KnowledgeOriginalFileDownload,
+} from "@opengeni/contracts";
+import {
+  prepareKnowledgeFile,
+  searchKnowledgeEntries,
+  hasPermission,
+  knowledgeContextForAccess,
+  requireAccessGrantAuthorization,
+  requireSessionAuthorization,
+  requireWorkspaceSettingsGrant,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import {
+  getKnowledgeOriginalFile,
+  recordAuditEvent,
+  archiveKnowledgeEntry,
+  getAgentLearningSettings,
+  getKnowledgeEntry,
+  listAgentLearningOverrides,
+  listKnowledgeEntryHistory,
+  listKnowledgeReviewBatches,
+  nestedPostgresSqlState,
+  restoreKnowledgeEntry,
+  reviewKnowledgeEntry,
+  saveAgentLearningSettings,
+  saveKnowledgeEntry,
+  reviewKnowledgeEntries,
+  reviewAgentInstruction,
+  listAgentInstructionReviews,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
+
+const ReadSettings = z
+  .object({
+    scope: z.enum(["workspace", "personal", "context"]).default("workspace"),
+    source: AgentLearningContext.optional(),
+  })
+  .strict();
+const WriteSettings = ReadSettings.extend({
+  scope: z.enum(["workspace", "personal"]).default("workspace"),
+  operationId: z.uuid(),
+  expectedVersion: z.number().int().nonnegative(),
+  settings: AgentLearningOverridePatch,
+});
+const Id = z.uuid();
+function knowledgeHttpError(error: unknown): never {
+  if (error instanceof HTTPException) throw error;
+  if (error instanceof z.ZodError)
+    throw new HTTPException(422, {
+      message: error.issues[0]?.message ?? "Invalid Knowledge request",
+    });
+  const state = nestedPostgresSqlState(error);
+  if (state === "40001" || state === "23505")
+    throw new HTTPException(409, { message: "This item changed. Refresh it and try again." });
+  if (state === "42501")
+    throw new HTTPException(403, {
+      message: "This Knowledge operation is not available with your access or learning settings.",
+    });
+  if (state === "22023" || state === "23514")
+    throw new HTTPException(422, { message: "Invalid Knowledge operation or reference." });
+  throw error;
+}
+
+export function registerKnowledgeRoutes(app: Hono, deps: ApiRouteDeps) {
+  const base = "/v1/workspaces/:workspaceId/knowledge/entries";
+  async function run<T>(
+    c: Context,
+    write: boolean,
+    fn: (context: Awaited<ReturnType<typeof knowledgeContextForAccess>>) => Promise<T>,
+  ) {
+    try {
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        c.req.param("workspaceId")!,
+        write ? "documents:manage" : "documents:search",
+      );
+      return await withAccessGrantSessionRlsContext(deps, access.grant, async () => {
+        const context = await knowledgeContextForAccess(
+          deps,
+          access,
+          write ? "documents:manage" : "documents:search",
+        );
+        c.header("cache-control", "private, no-store");
+        return fn(context);
+      });
+    } catch (error) {
+      knowledgeHttpError(error);
+    }
+  }
+  app.post("/v1/workspaces/:workspaceId/knowledge/files/:fileId/prepare", (c) =>
+    run(c, false, async (context) => {
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        context.workspaceId,
+        "files:read",
+      );
+      const selected = access.grant.metadata?.firstPartyMcpTools as
+        | FirstPartyMcpToolName[]
+        | undefined;
+      if (
+        context.actor.kind !== "agent" ||
+        !selected ||
+        !allowedFirstPartyMcpToolsForSession(deps.settings, selected).includes(
+          "knowledge_retain_file",
+        )
+      )
+        throw new HTTPException(403, {
+          message: "Source preparation is unavailable for this task",
+        });
+      return c.json(await prepareKnowledgeFile(deps, context, Id.parse(c.req.param("fileId"))));
+    }),
+  );
+  app.post(`${base}/:entryId/file/download-url`, (c) =>
+    run(c, false, async (context) => {
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        context.workspaceId,
+        "files:read",
+      );
+      const { revisionId } = z
+        .object({ revisionId: z.uuid().optional() })
+        .strict()
+        .parse(await c.req.json());
+      const entryId = Id.parse(c.req.param("entryId"));
+      const file = await getKnowledgeOriginalFile(deps.db, context, entryId, revisionId);
+      if (!file) throw new HTTPException(404, { message: "Original file unavailable" });
+      if (!deps.objectStorage)
+        throw new HTTPException(503, { message: "File storage is unavailable" });
+      if (
+        !(await retryWhileMissing(async () =>
+          (await deps.objectStorage!.fileExists(file)) ? true : null,
+        ))
+      )
+        throw new HTTPException(410, { message: "Original file bytes are unavailable" });
+      const signed = await deps.objectStorage.createGetUrl({ key: file.objectKey });
+      await recordAuditEvent(deps.db, {
+        accountId: context.accountId,
+        workspaceId: context.workspaceId,
+        subjectId: access.grant.subjectId,
+        action: "file.signed_url.issued",
+        targetType: "knowledge_entry",
+        targetId: entryId,
+        metadata: { fileId: file.id, kind: "download", expiresAt: signed.expiresAt.toISOString() },
+      });
+      return c.json(
+        KnowledgeOriginalFileDownload.parse({
+          url: signed.url,
+          expiresAt: signed.expiresAt.toISOString(),
+          fileId: file.id,
+          filename: file.filename,
+          contentType: file.contentType,
+          sizeBytes: file.sizeBytes,
+        }),
+      );
+    }),
+  );
+  app.post(`${base}/search`, (c) =>
+    run(c, false, async (context) =>
+      c.json(
+        await searchKnowledgeEntries(
+          deps.db,
+          context,
+          KnowledgeEntryListRequest.parse(await c.req.json()),
+          () => deps.getDocumentServices().embedder,
+        ),
+      ),
+    ),
+  );
+  app.get("/v1/workspaces/:workspaceId/knowledge/review-groups", (c) =>
+    run(c, true, async (context) => {
+      const query = c.req.query();
+      return c.json(
+        await listKnowledgeReviewBatches(
+          deps.db,
+          context,
+          KnowledgeReviewBatchListRequest.parse({
+            ...query,
+            ...(query.limit ? { limit: Number(query.limit) } : {}),
+          }),
+        ),
+      );
+    }),
+  );
+  app.post(`${base}/review`, (c) =>
+    run(c, true, async (context) =>
+      c.json(
+        await reviewKnowledgeEntries(
+          deps.db,
+          context,
+          KnowledgeEntryBatchReviewRequest.parse(await c.req.json()),
+        ),
+      ),
+    ),
+  );
+  app.get(base, (c) =>
+    run(c, false, async (context) => {
+      const query = c.req.query();
+      return c.json(
+        await searchKnowledgeEntries(
+          deps.db,
+          context,
+          KnowledgeEntryListRequest.parse({
+            ...query,
+            ...(query.limit ? { limit: Number(query.limit) } : {}),
+          }),
+          () => deps.getDocumentServices().embedder,
+        ),
+      );
+    }),
+  );
+  app.post(base, (c) =>
+    run(c, true, async (context) => {
+      const result = await saveKnowledgeEntry(
+        deps.db,
+        context,
+        KnowledgeEntrySaveRequest.parse(await c.req.json()),
+      );
+      return c.json(result, result.replayed ? 200 : 201);
+    }),
+  );
+  app.get(`${base}/:entryId/history`, (c) =>
+    run(c, false, async (context) =>
+      c.json(
+        await listKnowledgeEntryHistory(
+          deps.db,
+          context,
+          Id.parse(c.req.param("entryId")),
+          c.req.query("beforeRevision")
+            ? z.coerce.number().int().positive().parse(c.req.query("beforeRevision"))
+            : undefined,
+        ),
+      ),
+    ),
+  );
+  app.get(`${base}/:entryId`, (c) =>
+    run(c, false, async (context) => {
+      const options = z
+        .object({
+          revisionId: Id.optional(),
+          view: z.enum(["published", "needs_review", "archived", "rejected"]).optional(),
+        })
+        .strict()
+        .parse(c.req.query());
+      const entry = await getKnowledgeEntry(
+        deps.db,
+        context,
+        Id.parse(c.req.param("entryId")),
+        options,
+      );
+      if (!entry) throw new HTTPException(404, { message: "Knowledge entry not found" });
+      return c.json(entry);
+    }),
+  );
+  app.post(`${base}/:entryId/review`, (c) =>
+    run(c, true, async (context) => {
+      const request = KnowledgeEntryReviewRequest.parse({
+        ...(await c.req.json()),
+        entryId: c.req.param("entryId"),
+      });
+      return c.json(await reviewKnowledgeEntry(deps.db, context, request));
+    }),
+  );
+  app.post(`${base}/:entryId/restore`, (c) =>
+    run(c, true, async (context) => {
+      const request = KnowledgeEntryRestoreRequest.parse({
+        ...(await c.req.json()),
+        entryId: c.req.param("entryId"),
+      });
+      return c.json(await restoreKnowledgeEntry(deps.db, context, request));
+    }),
+  );
+  app.post(`${base}/:entryId/archive`, (c) =>
+    run(c, true, async (context) => {
+      const request = z
+        .object({ operationId: Id, expectedVersion: z.number().int().positive() })
+        .strict()
+        .parse(await c.req.json());
+      return c.json(
+        await archiveKnowledgeEntry(deps.db, context, {
+          ...request,
+          entryId: Id.parse(c.req.param("entryId")),
+        }),
+      );
+    }),
+  );
+
+  const learning = "/v1/workspaces/:workspaceId/agent-learning";
+  async function instructionReviewContext(
+    c: Context,
+    context: Awaited<ReturnType<typeof knowledgeContextForAccess>>,
+  ) {
+    if (context.actor.kind !== "human")
+      throw new HTTPException(403, {
+        message: "Instruction review requires an authenticated person",
+      });
+    await requireWorkspaceSettingsGrant(c, deps, context.workspaceId);
+    context.actor.settingsScopes = ["workspace"];
+    return context;
+  }
+  app.get(`${learning}/instructions/reviews`, (c) =>
+    run(c, false, async (context) =>
+      c.json(
+        await listAgentInstructionReviews(
+          deps.db,
+          await instructionReviewContext(c, context),
+          c.req.query("cursor"),
+        ),
+      ),
+    ),
+  );
+  app.post(`${learning}/instructions/review`, (c) =>
+    run(c, false, async (context) =>
+      c.json(
+        await reviewAgentInstruction(
+          deps.db,
+          await instructionReviewContext(c, context),
+          AgentInstructionReviewRequest.parse(await c.req.json()),
+        ),
+      ),
+    ),
+  );
+  app.post(`${learning}/read`, (c) =>
+    run(c, false, async (context) => {
+      const request = ReadSettings.parse(await c.req.json());
+      return c.json(
+        await getAgentLearningSettings(deps.db, context, request.scope, request.source),
+      );
+    }),
+  );
+  app.get(`${learning}/overrides`, (c) =>
+    run(c, false, async (context) => {
+      const scope = z
+        .enum(["workspace", "personal"])
+        .default("workspace")
+        .parse(c.req.query("scope"));
+      return c.json(await listAgentLearningOverrides(deps.db, context, scope));
+    }),
+  );
+  app.post(learning, (c) =>
+    run(c, false, async (context) => {
+      const request = WriteSettings.parse(await c.req.json());
+      if (context.actor.kind !== "human")
+        throw new HTTPException(403, { message: "Agents cannot change learning settings" });
+      const access = await requireAccessGrantAuthorization(c, deps, context.workspaceId);
+      if (request.source?.kind === "chat") {
+        if (!hasPermission(access.grant.permissions, "sessions:control"))
+          throw new HTTPException(403, { message: "Chat settings require session control" });
+        await requireSessionAuthorization(deps, access.grant, {
+          sessionId: request.source.id,
+          operation: "session.context.write",
+          surface: "http",
+        });
+        context.actor.settingsScopes = [request.scope];
+      } else if (request.source?.kind === "scheduled_task") {
+        if (!hasPermission(access.grant.permissions, "scheduled_tasks:manage"))
+          throw new HTTPException(403, {
+            message: "Scheduled task settings require task management",
+          });
+        context.actor.settingsScopes = [request.scope];
+      } else if (request.scope === "workspace") {
+        await requireWorkspaceSettingsGrant(c, deps, context.workspaceId);
+        context.actor.settingsScopes = ["workspace"];
+      }
+      return c.json(await saveAgentLearningSettings(deps.db, context, request));
+    }),
+  );
+}

package/src/routes/organization-memberships.ts

@@ -1,3 +1,7 @@
+import {
+  lookupExternalIdentityForRequest,
+  cancelExternalWorkspaceMemberGrantForRequest,
+} from "@opengeni/core";
 import {
   AcceptOrganizationInvitationRequest,
   CreateAdditionalOrganizationRequest,
@@ -165,6 +169,22 @@ function rethrowMembershipError(error: unknown, resourceLimitMessage?: string):
 }
 
 export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDeps): void {
+  // POST carries an opaque identity reference; this lookup never provisions.
+  app.post("/v1/organizations/:organizationId/external-identities/lookup", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    return context.json(
+      await lookupExternalIdentityForRequest(
+        context,
+        deps,
+        organizationId,
+        await context.req.json().catch(() => null),
+      ),
+    );
+  });
   app.patch("/v1/organizations/:organizationId/external-members/:membershipId", async (context) => {
     const organizationId = parseId(
       OrganizationId,
@@ -461,6 +481,19 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   app.post(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/members/:membershipId/revoke",
     async (context) => {
+      const input: unknown = await context.req.json().catch(() => null);
+      if (input && typeof input === "object" && "cancelGrantOperationId" in input) {
+        return context.json(
+          await cancelExternalWorkspaceMemberGrantForRequest(
+            context,
+            deps,
+            parseId(OrganizationId, context.req.param("organizationId"), "organization id"),
+            parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id"),
+            parseId(MembershipId, context.req.param("membershipId"), "membership id"),
+            input,
+          ),
+        );
+      }
       const { subjectId } = await requireManagedHuman(context, deps);
       const organizationId = parseId(
         OrganizationId,

package/src/routes/scheduled-tasks.ts

@@ -150,7 +150,15 @@ export function registerScheduledTaskRoutes(app: Hono, deps: ApiRouteDeps): void
       sessionAuthorization: deps.sessionAuthorization,
       authorizationSurface: "http",
     });
-    const task = await updateScheduledTaskForApi(db, workspaceId, taskId, update);
+    const task = await updateScheduledTaskForApi(
+      db,
+      workspaceId,
+      taskId,
+      update,
+      payload.agentLearning
+        ? { authorization, request: payload.agentLearning, restoreState: previous }
+        : undefined,
+    );
     await syncUpdatedScheduledTask({ db, workflowClient, previous, task });
     return c.json(scheduledTaskForGrant(task, grant));
   });

package/src/routes/sessions.ts

@@ -599,13 +599,24 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/new-session-draft", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "sessions:read",
+    );
+    const grant = authorization.grant;
     const catalog = await resolveWorkspaceCatalogSettings(db, settings, {
       accountId: grant.accountId,
       workspaceId,
     });
     return c.json(
-      await getActorNewSessionDraft({ settings: catalog.settings, db }, grant, workspaceId),
+      await getActorNewSessionDraft(
+        { settings: catalog.settings, db },
+        grant,
+        workspaceId,
+        authorization,
+      ),
     );
   });
 
@@ -3999,12 +4010,18 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/publish", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:upload");
+    const authorization = await requireAccessGrantAuthorization(
+      c,
+      deps,
+      workspaceId,
+      "files:upload",
+    );
     const ctx = await channelAPreamble(c, "files:read", "artifact.publish");
     const request = await parseChannelABody(c, PublishSandboxFileArtifactRequest);
     return c.json(
       await publishSandboxFileArtifact(deps, {
         grant: ctx.grant,
+        authorization,
         session: ctx.session,
         path: request.path,
         signal: ctx.waitSignal,

package/src/routes/skill-content.ts

@@ -4,6 +4,7 @@ import { HTTPException } from "hono/http-exception";
 import { SkillFile, type SkillWriteReceipt } from "@opengeni/contracts";
 import {
   approveSkill,
+  rejectSkill,
   listSkills,
   readSkill,
   requireAccessGrant,
@@ -168,7 +169,7 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
     );
     return c.json(receipt);
   });
-  for (const operation of ["approve", "restore"] as const) {
+  for (const operation of ["approve", "reject", "restore"] as const) {
     app.post(`${base}/:skillId/${operation}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
@@ -181,7 +182,12 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
       );
       if (!current) throw new HTTPException(404, { message: "Skill not found" });
       authorizePreferenceRegistryScopeMutation(access, current.scope);
-      const apply = operation === "approve" ? approveSkill : restoreSkill;
+      const apply =
+        operation === "approve"
+          ? approveSkill
+          : operation === "reject"
+            ? rejectSkill
+            : restoreSkill;
       return c.json(
         await skillMutation(() =>
           apply(deps.db, {

package/src/routes/video-generation.ts

@@ -6,6 +6,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getVideoGenerationOperationSummary,
+  withSessionRlsActorContext,
   getWorkspaceVercelAiGatewayConnectionMetadata,
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
@@ -14,6 +15,8 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant,
+  requireAccessGrantAuthorization,
+  fileOwnerContextForAccess,
   requireWorkspaceSettingsGrant,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
@@ -108,11 +111,10 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
 
   app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const summary = await getVideoGenerationOperationSummary(
-      deps.db,
-      workspaceId,
-      c.req.param("operationId"),
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const actor = await fileOwnerContextForAccess(deps, access, "workspace:read");
+    const summary = await withSessionRlsActorContext(actor, () =>
+      getVideoGenerationOperationSummary(deps.db, workspaceId, c.req.param("operationId")),
     );
     if (!summary)
       throw new HTTPException(404, {

package/src/routes/workspace-learning.ts

@@ -1,13 +1,8 @@
 import { randomUUID } from "node:crypto";
 import {
-  ActivateWorkspaceLearningPolicyRevisionRequest,
-  CreateWorkspaceLearningPolicyRevisionRequest,
-  RollbackWorkspaceLearningPolicyRevisionRequest,
   UndoGovernedLearningActivationHttpRequest,
   WorkspaceLearningHistoryResponse,
   WorkspaceLearningPolicyHistoryQuery,
-  WorkspaceLearningPolicyMutationResponse,
-  WorkspaceLearningPolicyRevision,
 } from "@opengeni/contracts";
 import {
   publishGovernedLearningEventToSlack,
@@ -16,8 +11,6 @@ import {
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
-  activateWorkspaceLearningPolicyRevision,
-  createWorkspaceLearningPolicyRevision,
   GovernedLearningActivationAuthorityError,
   GovernedLearningActivationConflictError,
   GovernedLearningActivationInvalidOperationError,
@@ -25,7 +18,6 @@ import {
   listGovernedLearningActivationHistory,
   listGovernedLearningDecisionReceipts,
   listWorkspaceLearningPolicyHistory,
-  rollbackWorkspaceLearningPolicyRevision,
   undoGovernedLearningActivation,
   WorkspaceLearningPolicyAuthorityError,
   WorkspaceLearningPolicyConflictError,
@@ -121,82 +113,20 @@ export function registerWorkspaceLearningRoutes(app: Hono, deps: ApiRouteDeps):
     }
   });
 
-  app.post(`${base}/revisions`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
-    const request = await parseBody(context, CreateWorkspaceLearningPolicyRevisionRequest);
-    try {
-      return context.json(
-        WorkspaceLearningPolicyRevision.parse(
-          await createWorkspaceLearningPolicyRevision(deps.db, {
-            operationId: request.operationId ?? randomUUID(),
-            accountId: grant.accountId,
-            workspaceId,
-            workspaceMode: request.workspaceMode,
-            sourceOverrides: request.sourceOverrides,
-            supersedesRevisionId: request.supersedesRevisionId,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-          }),
-        ),
-        201,
-      );
-    } catch (error) {
-      learningError(error);
-    }
-  });
-
-  app.post(`${base}/revisions/:revisionId/activate`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const revisionId = z.string().uuid().safeParse(context.req.param("revisionId"));
-    if (!revisionId.success) throw new HTTPException(422, { message: "Invalid revision id" });
-    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
-    const request = await parseBody(context, ActivateWorkspaceLearningPolicyRevisionRequest);
-    try {
-      return context.json(
-        WorkspaceLearningPolicyMutationResponse.parse(
-          await activateWorkspaceLearningPolicyRevision(deps.db, {
-            operationId: request.operationId ?? randomUUID(),
-            accountId: grant.accountId,
-            workspaceId,
-            revisionId: revisionId.data,
-            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
-            expectedActivationVersion: request.expectedActivationVersion,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-            reason: request.reason,
-          }),
-        ),
-      );
-    } catch (error) {
-      learningError(error);
-    }
-  });
-
-  app.post(`${base}/rollback`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const grant = await requireWorkspaceSettingsGrant(context, deps, workspaceId);
-    const request = await parseBody(context, RollbackWorkspaceLearningPolicyRevisionRequest);
-    try {
+  for (const path of ["/revisions", "/revisions/:revisionId/activate", "/rollback"]) {
+    app.post(`${base}${path}`, async (context) => {
+      await requireWorkspaceSettingsGrant(context, deps, context.req.param("workspaceId")!);
       return context.json(
-        WorkspaceLearningPolicyMutationResponse.parse(
-          await rollbackWorkspaceLearningPolicyRevision(deps.db, {
-            operationId: request.operationId ?? randomUUID(),
-            accountId: grant.accountId,
-            workspaceId,
-            targetRevisionId: request.targetRevisionId,
-            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
-            expectedActivationVersion: request.expectedActivationVersion,
-            actorSubjectId: grant.subjectId,
-            principalKind: grant.principalKind,
-            reason: request.reason,
-          }),
-        ),
+        {
+          error: {
+            code: "learning_settings_replaced",
+            message: "Configure Knowledge, instructions and Skills in Agent learning settings.",
+          },
+        },
+        410,
       );
-    } catch (error) {
-      learningError(error);
-    }
-  });
+    });
+  }
 
   app.post(`${base}/activations/:activationReceiptId/undo`, async (context) => {
     const workspaceId = context.req.param("workspaceId");