@opengeni/api-router 2.6.4-canary.0 → 2.8.1-canary.0

package/src/routes/organization-model-providers.ts

@@ -0,0 +1,231 @@
+import {
+  CreateOrganizationProviderCustomModelRequest,
+  DeleteOrganizationProviderCustomModelRequest,
+  OrganizationModelProviderConnectionResponse,
+  OrganizationModelProviderKind,
+  OrganizationProviderCustomModel,
+  OrganizationProviderCustomModelsResponse,
+  RevokeOrganizationModelProviderConnectionRequest,
+  UpsertOrganizationModelProviderConnectionRequest,
+} from "@opengeni/contracts";
+import { requireEnvironmentEncryption, type ApiRouteDeps } from "@opengeni/core";
+import {
+  createOrganizationModelProviderCustomModel,
+  encryptEnvironmentValue,
+  getOrganizationModelProviderConnection,
+  listOrganizationModelProviderCustomModels,
+  organizationModelProviderCredentialDigest,
+  OrganizationModelProviderConflictError,
+  OrganizationModelProviderLimitError,
+  retireOrganizationModelProviderCustomModel,
+  revokeOrganizationModelProviderConnection,
+  upsertOrganizationModelProviderConnection,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
+
+const OrganizationId = z.string().uuid();
+
+function parseOrganizationId(value: string): string {
+  const parsed = OrganizationId.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "organization not found" });
+  return parsed.data;
+}
+
+async function jsonBody<T>(c: Context, schema: z.ZodType<T>, message: string): Promise<T> {
+  const parsed = schema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message });
+  return parsed.data;
+}
+
+function providerKind(value: string) {
+  const parsed = OrganizationModelProviderKind.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "model provider not found" });
+  return parsed.data;
+}
+
+function connectionJson(connection: {
+  providerKind: "vercel_gateway" | "openrouter";
+  status: "active" | "revoked";
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationModelProviderConnectionResponse.parse({
+    ...connection,
+    createdAt: connection.createdAt.toISOString(),
+    updatedAt: connection.updatedAt.toISOString(),
+  });
+}
+
+function modelJson(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationProviderCustomModel.parse({
+    ...model,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function conflict(error: unknown): never {
+  if (error instanceof OrganizationModelProviderConflictError) {
+    throw new HTTPException(409, { message: "organization model provider version conflict" });
+  }
+  if (error instanceof OrganizationModelProviderLimitError) {
+    throw new HTTPException(409, { message: "organization custom model limit reached" });
+  }
+  throw error;
+}
+
+export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const connection = await getOrganizationModelProviderConnection(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      providerKind: providerKind(c.req.param("providerKind")),
+    });
+    return connection ? c.json(connectionJson(connection)) : c.json(null);
+  });
+
+  app.put("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      UpsertOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider connection",
+    );
+    try {
+      const connection = await upsertOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        credentialEncrypted: encryptEnvironmentValue(
+          requireEnvironmentEncryption(deps.settings),
+          payload.apiKey,
+        ),
+        credentialDigest: organizationModelProviderCredentialDigest(payload.apiKey),
+        operationId: payload.operationId,
+        ...(payload.expectedVersion === undefined
+          ? {}
+          : { expectedVersion: payload.expectedVersion }),
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.delete("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      RevokeOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider disconnect",
+    );
+    try {
+      const connection = await revokeOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        ...payload,
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.get(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const models = await listOrganizationModelProviderCustomModels(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+      });
+      return c.json(
+        OrganizationProviderCustomModelsResponse.parse({ models: models.map(modelJson) }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        CreateOrganizationProviderCustomModelRequest,
+        "invalid organization custom model",
+      );
+      try {
+        const model = await createOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          operationId: payload.operationId,
+          upstreamModelId: payload.upstreamModelId,
+          ...(payload.label === undefined ? {} : { label: payload.label }),
+        });
+        return c.json(modelJson(model), 201);
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+
+  app.delete(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models/:customModelId",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        DeleteOrganizationProviderCustomModelRequest,
+        "invalid organization custom model deletion",
+      );
+      const customModelId = z.string().uuid().safeParse(c.req.param("customModelId"));
+      if (!customModelId.success) {
+        throw new HTTPException(422, { message: "invalid organization custom model id" });
+      }
+      try {
+        const model = await retireOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          customModelId: customModelId.data,
+          ...payload,
+        });
+        return c.json(modelJson(model));
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+}

package/src/routes/packs.ts

@@ -277,6 +277,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
           sourcePath: inline.sourcePath,
           name: inline.name,
           description: inline.description,
+          activationMode: inline.activationMode,
           contentSha256: inline.contentSha256,
           totalBytes: inline.totalBytes,
           files: inline.files,

package/src/routes/personal-github.ts

@@ -3,10 +3,15 @@ import {
   ListPersonalGitHubRepositoriesResponse,
   PersonalGitHubConnectionStatusResponse,
   PersonalGitHubOAuthStartRequest,
+  PersonalGitHubRepositoryId,
   PersonalGitHubRepositorySelectionState,
   ReplacePersonalGitHubRepositorySelectionsRequest,
   VerifyPersonalGitHubRepositorySelectionsRequest,
 } from "@opengeni/contracts/personal-github";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  GitHubRepositoryBranchesResponse,
+} from "@opengeni/contracts/github-repository-contracts";
 import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -31,6 +36,7 @@ import {
   startPersonalGitHubOAuth,
 } from "../integrations/personal-github";
 import {
+  listLivePersonalGitHubRepositoryBranches,
   listLivePersonalGitHubRepositories,
   personalGitHubRepositoryProviderHttpError,
   PersonalGitHubRepositoryProviderError,
@@ -187,6 +193,39 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const connectionId = c.req.param("connectionId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:read",
+      );
+      assertPersonalConnectionOwnerPrincipal(access, "My GitHub repositories");
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      const repositoryId = PersonalGitHubRepositoryId.parse(c.req.param("repositoryId"));
+      try {
+        return c.json(
+          GitHubRepositoryBranchesResponse.parse(
+            await listLivePersonalGitHubRepositoryBranches(deps, {
+              accountId: access.grant.accountId,
+              workspaceId,
+              subjectId: access.grant.subjectId,
+              connectionId,
+              repositoryId,
+              query,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw personalGitHubRepositoryRouteError(error);
+      }
+    },
+  );
+
   app.post(
     "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
     async (c) => {

package/src/routes/pr-review.ts

@@ -14,6 +14,7 @@ import {
   defaultPrReviewProviderBaseUrl,
   getCapabilityPack,
   workspaceCustomModelReference,
+  lockActiveCustomModelForAdmission,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
   prReviewPackConnectorId,
@@ -34,8 +35,6 @@ import {
   getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
-  lockActiveWorkspaceGatewayCustomModelForAdmission,
-  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   nestedPostgresSqlState,
   recordAuditEvent,
   updatePrReviewAppRegistration,
@@ -557,18 +556,11 @@ function prReviewCustomModelCommitGuard(input: {
   const reference = workspaceCustomModelReference(input.settings, input.modelId);
   if (!reference) return undefined;
   return async (tx): Promise<void> => {
-    const active =
-      reference.providerKind === "openrouter"
-        ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            upstreamModelId: reference.upstreamModelId,
-          })
-        : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            upstreamModelId: reference.upstreamModelId,
-          });
+    const active = await lockActiveCustomModelForAdmission(tx, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      reference,
+    });
     if (!active) {
       throw new HTTPException(422, {
         message: `model is not available: ${input.modelId}`,

package/src/routes/sessions.ts

@@ -197,7 +197,7 @@ import {
 import {
   appendAndPublishEvents,
   boundSessionEventHttpPage,
-  coalesceSessionEventDeltas,
+  coalesceSessionEventDeltasWithCoverage,
   publishDurableSessionEvents,
 } from "@opengeni/events";
 import {
@@ -2621,10 +2621,16 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       c.header("X-OpenGeni-Covered-Last", String(result.coveredSequence.last));
       return c.json(result);
     }
-    const projected = compact ? coalesceSessionEventDeltas(events) : events;
+    const compactProjection = compact ? coalesceSessionEventDeltasWithCoverage(events) : null;
+    const projected = compactProjection?.events ?? events;
+    const forensicExact =
+      !compact && mode === "forensic" && payloadMode === "full" && dbPage.fullPayloadsExact;
     const page = boundSessionEventHttpPage(projected, {
       direction,
-      eventProjection: mode === "forensic" && payloadMode === "full" ? "exact" : "bounded",
+      eventProjection: forensicExact ? "exact" : "bounded",
+      ...(compactProjection
+        ? { coveredThroughBySequence: compactProjection.coveredThroughBySequence }
+        : {}),
     });
     const hasMore = dbPage.hasMore || page.truncated;
     c.header("X-OpenGeni-Page-Bytes", String(page.bytes));
@@ -2634,9 +2640,14 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     c.header("X-OpenGeni-Event-Mode", mode);
     c.header("X-OpenGeni-Event-Direction", direction);
     c.header("X-OpenGeni-Payload-Mode", payloadMode);
-    c.header("X-OpenGeni-Forensic-Exact", String(mode === "forensic" && payloadMode === "full"));
+    c.header("X-OpenGeni-Forensic-Exact", String(forensicExact));
     const coveredFirst = page.events[0]?.sequence;
-    const coveredLast = page.events.at(-1)?.sequence;
+    const coveredLastEvent = page.events.at(-1);
+    const coveredLast =
+      coveredLastEvent === undefined
+        ? undefined
+        : (compactProjection?.coveredThroughBySequence.get(coveredLastEvent.sequence) ??
+          coveredLastEvent.sequence);
     if (coveredFirst !== undefined) c.header("X-OpenGeni-Covered-First", String(coveredFirst));
     if (coveredLast !== undefined) c.header("X-OpenGeni-Covered-Last", String(coveredLast));
     const truncatedBy = page.truncated ? "http_bytes" : dbPage.truncatedBy;

package/src/routes/workspaces.ts

@@ -35,7 +35,6 @@ import {
 import {
   allWorkspacePermissions,
   createWorkspace,
-  deleteWorkspaceIfQuiescent,
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity,
   getManagedUserProfilesByIds,
@@ -69,6 +68,8 @@ import {
   workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
   workspaceOpenRouterConnectionActive,
+  organizationModelProviderConnectionActiveForWorkspace,
+  listOrganizationModelProviderCustomModelsForWorkspace,
   WorkspaceGatewayCustomModelHistoryLimitError,
   WorkspaceOpenRouterCustomModelHistoryLimitError,
   WorkspaceExternalIdentityConflictError,
@@ -99,8 +100,7 @@ import { boundedLimit } from "../http/common";
 import { ApiHttpError } from "../http/api-error";
 import { browserSseDeliveryOptions, sseWorkspaceControlStream } from "../http/sse";
 import { buildWorkspaceModelCatalog } from "../model-catalog";
-import { processTemporalScheduleCleanupClaims } from "../temporal-schedule-cleanup";
-import { workspaceDeleteObserver } from "../workspace-delete-observability";
+import { deleteWorkspaceForRequest } from "../workspace-deletion";
 import {
   AI_GATEWAY_REALTIME_MODELS,
   CODEX_REALTIME_MODEL_ID,
@@ -398,6 +398,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
       workspaceGatewayCustomModels,
       openRouterConnectionActive,
       workspaceOpenRouterCustomModels,
+      organizationGatewayConnectionActive,
+      organizationOpenRouterConnectionActive,
+      organizationGatewayCustomModels,
+      organizationOpenRouterCustomModels,
     ] = await Promise.all([
       deps.resolveCatalogSettings(),
       getWorkspaceModelPolicy(deps.db, workspaceId),
@@ -413,6 +417,26 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
       }),
+      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "vercel_gateway",
+      }),
+      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "openrouter",
+      }),
+      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "vercel_gateway",
+      }),
+      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "openrouter",
+      }),
     ]);
     c.header("cache-control", "private, no-store");
     return c.json(
@@ -426,6 +450,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
           workspaceGatewayCustomModels,
           workspaceOpenRouterConnectionActive: openRouterConnectionActive,
           workspaceOpenRouterCustomModels,
+          organizationGatewayConnectionActive,
+          organizationOpenRouterConnectionActive,
+          organizationGatewayCustomModels,
+          organizationOpenRouterCustomModels,
         }),
       ),
     );
@@ -883,65 +911,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.delete("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    // The DB transaction locks the account/workspace and every existing
-    // session/lease before checking runtime quiescence, then returns the exact
-    // external schedules removed by the cascade. A racing cold->warm transition
-    // can therefore never erase the only provider/capture ownership receipt.
-    const deleteObserver = workspaceDeleteObserver(deps.observability, {
+    await deleteWorkspaceForRequest(deps, {
       accountId: grant.accountId,
       workspaceId,
     });
-    const deleted = await deleteWorkspaceIfQuiescent(deps.db, {
-      accountId: grant.accountId,
-      workspaceId,
-      ...(deleteObserver ? { observer: deleteObserver } : {}),
-    });
-    if (deleted.status === "not_found") {
-      throw new HTTPException(404, { message: "workspace not found" });
-    }
-    if (deleted.status === "only_workspace") {
-      throw new HTTPException(409, {
-        message: "cannot delete the account's only workspace",
-      });
-    }
-    if (deleted.status === "active_sessions") {
-      throw new HTTPException(409, {
-        message: "stop the workspace's running sessions before deleting it",
-      });
-    }
-    if (deleted.status === "active_video_generations") {
-      throw new HTTPException(409, {
-        message: "wait for the workspace's active video generations to finish before deleting it",
-      });
-    }
-    if (deleted.status === "active_background_commands") {
-      throw new HTTPException(409, {
-        message: "pause or cancel the workspace's background commands before deleting it",
-      });
-    }
-    if (deleted.status === "live_sandboxes") {
-      throw new HTTPException(409, {
-        message: "wait for the workspace's active sandboxes to finish draining before deleting it",
-      });
-    }
-    if (deleted.status !== "deleted") {
-      throw new Error(`Unhandled workspace deletion outcome: ${deleted.status}`);
-    }
-    // The cleanup claims were inserted in the same transaction as the cascade.
-    // Try them immediately; failures are released to the replica-safe outbox
-    // pump, so a process crash or Temporal outage cannot orphan the schedules.
-    await processTemporalScheduleCleanupClaims(
-      {
-        db: deps.db,
-        deleteSchedule: async (temporalScheduleId) => {
-          await deps.workflowClient.deleteScheduledTaskSchedule({
-            temporalScheduleId,
-          });
-        },
-        ...(deps.observability ? { observability: deps.observability } : {}),
-      },
-      deleted.temporalScheduleCleanups,
-    );
     return c.body(null, 204);
   });
 

package/src/workspace-deletion.ts

@@ -0,0 +1,64 @@
+import { deleteWorkspaceIfQuiescent, nestedPostgresSqlState } from "@opengeni/db";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { HTTPException } from "hono/http-exception";
+
+import { processTemporalScheduleCleanupClaims } from "./temporal-schedule-cleanup";
+import { workspaceDeleteObserver } from "./workspace-delete-observability";
+
+export async function deleteWorkspaceForRequest(
+  deps: ApiRouteDeps,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    organizationAdministratorSubjectId?: string;
+  },
+): Promise<void> {
+  const observer = workspaceDeleteObserver(deps.observability, input);
+  let deleted;
+  try {
+    deleted = await deleteWorkspaceIfQuiescent(deps.db, {
+      ...input,
+      ...(observer ? { observer } : {}),
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "42501") {
+      throw new HTTPException(403, { message: "organization administration is not authorized" });
+    }
+    if (state === "P0002") {
+      throw new HTTPException(404, { message: "workspace not found" });
+    }
+    throw error;
+  }
+
+  if (deleted.status === "not_found") {
+    throw new HTTPException(404, { message: "workspace not found" });
+  }
+  const conflicts = {
+    only_workspace: "cannot delete the account's only workspace",
+    active_sessions: "stop the workspace's running sessions before deleting it",
+    active_video_generations:
+      "wait for the workspace's active video generations to finish before deleting it",
+    active_background_commands:
+      "pause or cancel the workspace's background commands before deleting it",
+    live_sandboxes:
+      "wait for the workspace's active sandboxes to finish draining before deleting it",
+  } as const;
+  if (deleted.status in conflicts) {
+    throw new HTTPException(409, { message: conflicts[deleted.status as keyof typeof conflicts] });
+  }
+  if (deleted.status !== "deleted") {
+    throw new Error(`Unhandled workspace deletion outcome: ${deleted.status}`);
+  }
+
+  await processTemporalScheduleCleanupClaims(
+    {
+      db: deps.db,
+      deleteSchedule: async (temporalScheduleId) => {
+        await deps.workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId });
+      },
+      ...(deps.observability ? { observability: deps.observability } : {}),
+    },
+    deleted.temporalScheduleCleanups,
+  );
+}