@opengeni/api-router 2.6.4 → 2.10.0-canary.0

package/src/routes/github.ts

@@ -4,6 +4,11 @@ import {
   type GitHubInstallationBindingCandidate,
   type GitHubInstallationBindingProof,
 } from "@opengeni/contracts";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  VerifyPublicGitHubRepositoryRefRequest,
+} from "@opengeni/contracts/github-repository-contracts";
+import { parseCanonicalGitHubRepositoryUrl } from "@opengeni/contracts/github-repository";
 import {
   bindAuthorizedGitHubInstallationRepositories,
   deleteGitHubInstallationBinding,
@@ -19,12 +24,14 @@ import {
   GitHubAppApiError,
   GitHubAppConfigurationError,
   GitHubInstallationAuthorityError,
+  GitHubPublicRepositoryVerificationError,
   githubAppMissingSettings,
   githubOAuthAuthorizeUrl,
   organizationAppManifestUrl,
   personalAppManifestUrl,
   readSignedState,
   stateMaxAgeSeconds,
+  verifyPublicGitHubRepositoryRef,
   type GitHubSignedStatePayload,
   verifySignedState,
 } from "@opengeni/github";
@@ -42,7 +49,9 @@ import {
 } from "../github-browser-flow";
 import {
   githubBindingStatus,
+  GitHubRepositoryBranchAuthorityError,
   listWorkspaceGitHubInstallationBindings,
+  listWorkspaceGitHubRepositoryBranches,
   listWorkspaceGitHubRepositories,
 } from "../github-access";
 
@@ -177,6 +186,65 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     }
   });
 
+  app.post("/v1/workspaces/:workspaceId/github/public-repositories/verify", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId);
+    requirePublicGitHubRepositoryVerificationPermission(grant);
+    const request = VerifyPublicGitHubRepositoryRefRequest.parse(await c.req.json());
+    let repository: ReturnType<typeof parseCanonicalGitHubRepositoryUrl>;
+    try {
+      repository = parseCanonicalGitHubRepositoryUrl(request.url);
+    } catch (error) {
+      throw new HTTPException(422, {
+        message: error instanceof Error ? error.message : "GitHub repository URL is invalid.",
+      });
+    }
+    try {
+      return c.json(
+        await verifyPublicGitHubRepositoryRef(
+          { repository, ref: request.ref },
+          deps.githubAnonymousFetch ?? fetch,
+        ),
+      );
+    } catch (error) {
+      if (error instanceof GitHubPublicRepositoryVerificationError) {
+        throw new HTTPException(error.code === "provider_unavailable" ? 503 : 422, {
+          message: error.message,
+        });
+      }
+      throw new HTTPException(503, {
+        message: "GitHub public repository verification is temporarily unavailable.",
+      });
+    }
+  });
+
+  app.get(
+    "/v1/workspaces/:workspaceId/github/installations/:installationId/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "github:use");
+      const installationId = parsePositiveInteger(c.req.param("installationId"));
+      const repositoryId = parsePositiveInteger(c.req.param("repositoryId"));
+      if (installationId === null || repositoryId === null) {
+        throw new HTTPException(400, { message: "invalid GitHub repository identity" });
+      }
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      try {
+        return c.json(
+          await listWorkspaceGitHubRepositoryBranches(deps, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            installationId,
+            repositoryId,
+            query,
+          }),
+        );
+      } catch (error) {
+        throw githubRepositoryBranchesRouteError(error);
+      }
+    },
+  );
+
   app.delete("/v1/workspaces/:workspaceId/github/installations/:installationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "github:manage");
@@ -184,14 +252,11 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (installationId === null) {
       throw new HTTPException(400, { message: "invalid GitHub installation id" });
     }
-    const deleted = await deleteGitHubInstallationBinding(db, {
+    await deleteGitHubInstallationBinding(db, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       installationId,
     });
-    if (!deleted) {
-      throw new HTTPException(404, { message: "GitHub installation binding not found" });
-    }
     return c.body(null, 204);
   });
 
@@ -428,14 +493,6 @@ export function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (candidates.length === 0) {
         return redirectToGitHubInstallation(c, deps, selectionState);
       }
-      if (candidates.length === 1) {
-        return redirectToExactGitHubAuthorization(
-          c,
-          deps,
-          selectionState,
-          candidates[0]!.installation.installationId,
-        );
-      }
       setGitHubStateCookie(c, deps, selectionState);
       return c.html(
         githubInstallationChooserHtml(
@@ -757,6 +814,50 @@ function githubAuthorityHttpError(error: unknown): HTTPException {
   return new HTTPException(502, { message: "GitHub authority verification failed" });
 }
 
+function githubRepositoryBranchesRouteError(error: unknown): Error {
+  if (error instanceof HTTPException) {
+    return error;
+  }
+  if (error instanceof GitHubRepositoryBranchAuthorityError) {
+    return error.code === "not_authorized"
+      ? new HTTPException(404, {
+          message: "GitHub repository is not authorized for this workspace",
+        })
+      : new HTTPException(409, {
+          message: "GitHub repository authorization changed; refresh and try again",
+        });
+  }
+  if (error instanceof GitHubAppConfigurationError) {
+    return new HTTPException(409, { message: "GitHub App is not configured" });
+  }
+  if (error instanceof GitHubAppApiError) {
+    if (error.status === 429) {
+      return new HTTPException(503, { message: "GitHub is temporarily rate limited" });
+    }
+    if (error.status === 401 || error.status === 403 || error.status === 404) {
+      return new HTTPException(409, {
+        message: "GitHub repository access changed; refresh and try again",
+      });
+    }
+    return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+  }
+  return new HTTPException(502, { message: "GitHub branch discovery is unavailable" });
+}
+
+export function requirePublicGitHubRepositoryVerificationPermission(
+  grant: Pick<AccessGrant, "permissions">,
+): void {
+  if (
+    hasPermission(grant.permissions, "sessions:create") ||
+    hasPermission(grant.permissions, "sessions:control")
+  ) {
+    return;
+  }
+  throw new HTTPException(403, {
+    message: "missing permission: sessions:create or sessions:control",
+  });
+}
+
 function isSecureRequest(c: Context, deps: ApiRouteDeps): boolean {
   return (
     deps.settings.publicBaseUrl?.startsWith("https://") ||
@@ -783,15 +884,15 @@ function githubInstallationChooserHtml(
 ): string {
   const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
   const options = candidates
-    .map(({ installation, authorityKind }) => {
+    .map(({ installation, authorityKind }, index) => {
       const account = escapeHtml(
         installation.accountLogin ?? `installation ${installation.installationId}`,
       );
       const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
-      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required><span><strong>${account}</strong><small>${label}</small></span></label>`;
+      return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span><strong>${account}</strong><small>${label}</small></span></label>`;
     })
     .join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>Only installations where GitHub proved you are the personal owner or an active organization owner are shown.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>These accounts already have the OpenGeni GitHub App installed and GitHub proved you are the personal owner or an active organization owner.</p><form method="get" action="${escapeHtml(action)}"><input type="hidden" name="state" value="${escapeHtml(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
 }
 
 function githubSetupPendingHtml(): string {

package/src/routes/organization-memberships.ts

@@ -1,5 +1,7 @@
 import {
   AcceptOrganizationInvitationRequest,
+  CreateAdditionalOrganizationRequest,
+  CreateAdditionalOrganizationResponse,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
   CreateOrganizationWorkspaceRequest,
@@ -40,6 +42,7 @@ import {
   acceptOrganizationInvitation,
   bindPendingOrganizationInvitationsForVerifiedEmail,
   claimOrganizationUserSetupDelivery,
+  createAdditionalManagedOrganization,
   createManagedOrganization,
   createOrganizationWorkspace,
   createOrganizationInvitation,
@@ -68,12 +71,11 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { deleteWorkspaceForRequest } from "../workspace-deletion";
 
 import {
   assertOrganizationUserSetupDeliveryConfigured,
-  deriveOrganizationUserSetupToken,
-  organizationUserSetupPayloadDigest,
-  renderOrganizationUserSetupEmail,
+  resolveOrganizationUserSetupDeliveryEmail,
 } from "../auth/organization-user-setup";
 
 const OrganizationId = z.string().uuid();
@@ -117,7 +119,9 @@ async function requireOrganizationAdministrator(
     );
     return { subjectId };
   }
-  throw new HTTPException(401, { message: "organization administrator session required" });
+  throw new HTTPException(401, {
+    message: "organization administrator session required",
+  });
 }
 
 async function parseBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
@@ -136,8 +140,14 @@ function parseId(schema: z.ZodString, value: string, label: string): string {
   return parsed.data;
 }
 
-function rethrowMembershipError(error: unknown): never {
-  const status = organizationMembershipHttpStatus(nestedPostgresSqlState(error));
+function rethrowMembershipError(error: unknown, resourceLimitMessage?: string): never {
+  const sqlState = nestedPostgresSqlState(error);
+  if (sqlState === "54000" && resourceLimitMessage) {
+    throw new HTTPException(409, {
+      message: resourceLimitMessage,
+    });
+  }
+  const status = organizationMembershipHttpStatus(sqlState);
   if (status !== null) {
     throw new HTTPException(status, {
       message:
@@ -173,6 +183,25 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.post("/v1/organizations/additional", async (context) => {
+    const { session, subjectId } = await requireManagedHuman(context, deps);
+    const payload = await parseBody(context, CreateAdditionalOrganizationRequest);
+    try {
+      return context.json(
+        CreateAdditionalOrganizationResponse.parse(
+          await createAdditionalManagedOrganization(deps.db, {
+            subjectId,
+            subjectLabel: session.user.email || session.user.name,
+            ...payload,
+          }),
+        ),
+        201,
+      );
+    } catch (error) {
+      rethrowMembershipError(error, "additional organization limit reached");
+    }
+  });
+
   app.get("/v1/organization-memberships", async (context) => {
     const { session } = await requireManagedHuman(context, deps);
     try {
@@ -328,6 +357,22 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     }
   });
 
+  app.delete("/v1/organizations/:organizationId/workspaces/:workspaceId", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
+    const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
+    await deleteWorkspaceForRequest(deps, {
+      accountId: organizationId,
+      workspaceId,
+      organizationAdministratorSubjectId: subjectId,
+    });
+    return context.body(null, 204);
+  });
+
   app.patch(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/settings",
     async (context) => {
@@ -768,18 +813,18 @@ async function deliverOrganizationUserSetup(
 ) {
   const claim = await claimOrganizationUserSetupDelivery(deps.db, input);
   if (!claim.claimed) return claim.delivery;
-  const setup = await deriveOrganizationUserSetupToken(deps.settings, {
+  const prepared = await resolveOrganizationUserSetupDeliveryEmail(deps.settings, {
     invitationId: claim.invitationId,
     deliveryId: claim.delivery.id,
-  });
-  const message = renderOrganizationUserSetupEmail({
     senderEmail: deps.managedEmailTransport.sender,
     recipientEmail: claim.recipientEmail,
     recipientName: claim.recipientName,
     organizationName: claim.organizationName,
     organizationRole: claim.organizationRole,
     sharedWorkspaceAccess: claim.sharedWorkspaceAccess,
-    setupUrl: setup.url,
+    providerIdempotencyScope: deps.managedEmailTransport.idempotency.scope,
+    frozenTransport: claim.setupTokenTransport,
+    frozenPayloadDigest: claim.payloadDigest,
   });
   await prepareOrganizationUserSetupDelivery(deps.db, {
     organizationId: input.organizationId,
@@ -787,11 +832,9 @@ async function deliverOrganizationUserSetup(
     deliveryId: claim.delivery.id,
     attemptId: claim.attemptId,
     claimHolderId: claim.claimHolderId,
-    tokenDigest: setup.digest,
-    payloadDigest: await organizationUserSetupPayloadDigest({
-      ...message,
-      providerIdempotencyScope: deps.managedEmailTransport.idempotency.scope,
-    }),
+    tokenDigest: prepared.tokenDigest,
+    payloadDigest: prepared.payloadDigest,
+    setupTokenTransport: prepared.transport,
     providerIdempotencyScope: deps.managedEmailTransport.idempotency.scope,
     providerIdempotencyRetentionSeconds: deps.managedEmailTransport.idempotency.retentionSeconds,
   });
@@ -801,7 +844,7 @@ async function deliverOrganizationUserSetup(
   try {
     outcome = await deps.managedEmailTransport.send({
       kind: "organization_user_setup",
-      ...message,
+      ...prepared.message,
       idempotencyKey: claim.providerKey,
     });
   } catch {

package/src/routes/organization-model-providers.ts

@@ -0,0 +1,231 @@
+import {
+  CreateOrganizationProviderCustomModelRequest,
+  DeleteOrganizationProviderCustomModelRequest,
+  OrganizationModelProviderConnectionResponse,
+  OrganizationModelProviderKind,
+  OrganizationProviderCustomModel,
+  OrganizationProviderCustomModelsResponse,
+  RevokeOrganizationModelProviderConnectionRequest,
+  UpsertOrganizationModelProviderConnectionRequest,
+} from "@opengeni/contracts";
+import { requireEnvironmentEncryption, type ApiRouteDeps } from "@opengeni/core";
+import {
+  createOrganizationModelProviderCustomModel,
+  encryptEnvironmentValue,
+  getOrganizationModelProviderConnection,
+  listOrganizationModelProviderCustomModels,
+  organizationModelProviderCredentialDigest,
+  OrganizationModelProviderConflictError,
+  OrganizationModelProviderLimitError,
+  retireOrganizationModelProviderCustomModel,
+  revokeOrganizationModelProviderConnection,
+  upsertOrganizationModelProviderConnection,
+} from "@opengeni/db";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
+
+const OrganizationId = z.string().uuid();
+
+function parseOrganizationId(value: string): string {
+  const parsed = OrganizationId.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "organization not found" });
+  return parsed.data;
+}
+
+async function jsonBody<T>(c: Context, schema: z.ZodType<T>, message: string): Promise<T> {
+  const parsed = schema.safeParse(await c.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException(422, { message });
+  return parsed.data;
+}
+
+function providerKind(value: string) {
+  const parsed = OrganizationModelProviderKind.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "model provider not found" });
+  return parsed.data;
+}
+
+function connectionJson(connection: {
+  providerKind: "vercel_gateway" | "openrouter";
+  status: "active" | "revoked";
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationModelProviderConnectionResponse.parse({
+    ...connection,
+    createdAt: connection.createdAt.toISOString(),
+    updatedAt: connection.updatedAt.toISOString(),
+  });
+}
+
+function modelJson(model: {
+  id: string;
+  upstreamModelId: string;
+  label: string | null;
+  version: number;
+  createdAt: Date;
+  updatedAt: Date;
+}) {
+  return OrganizationProviderCustomModel.parse({
+    ...model,
+    createdAt: model.createdAt.toISOString(),
+    updatedAt: model.updatedAt.toISOString(),
+  });
+}
+
+function conflict(error: unknown): never {
+  if (error instanceof OrganizationModelProviderConflictError) {
+    throw new HTTPException(409, { message: "organization model provider version conflict" });
+  }
+  if (error instanceof OrganizationModelProviderLimitError) {
+    throw new HTTPException(409, { message: "organization custom model limit reached" });
+  }
+  throw error;
+}
+
+export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.get("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const connection = await getOrganizationModelProviderConnection(deps.db, {
+      organizationId,
+      actorSubjectId: human.subjectId,
+      providerKind: providerKind(c.req.param("providerKind")),
+    });
+    return connection ? c.json(connectionJson(connection)) : c.json(null);
+  });
+
+  app.put("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      UpsertOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider connection",
+    );
+    try {
+      const connection = await upsertOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        credentialEncrypted: encryptEnvironmentValue(
+          requireEnvironmentEncryption(deps.settings),
+          payload.apiKey,
+        ),
+        credentialDigest: organizationModelProviderCredentialDigest(payload.apiKey),
+        operationId: payload.operationId,
+        ...(payload.expectedVersion === undefined
+          ? {}
+          : { expectedVersion: payload.expectedVersion }),
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.delete("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
+    c.header("cache-control", "private, no-store");
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const payload = await jsonBody(
+      c,
+      RevokeOrganizationModelProviderConnectionRequest,
+      "invalid organization model provider disconnect",
+    );
+    try {
+      const connection = await revokeOrganizationModelProviderConnection(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+        ...payload,
+      });
+      return c.json(connectionJson(connection));
+    } catch (error) {
+      conflict(error);
+    }
+  });
+
+  app.get(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const models = await listOrganizationModelProviderCustomModels(deps.db, {
+        organizationId,
+        actorSubjectId: human.subjectId,
+        providerKind: providerKind(c.req.param("providerKind")),
+      });
+      return c.json(
+        OrganizationProviderCustomModelsResponse.parse({ models: models.map(modelJson) }),
+      );
+    },
+  );
+
+  app.post(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        CreateOrganizationProviderCustomModelRequest,
+        "invalid organization custom model",
+      );
+      try {
+        const model = await createOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          operationId: payload.operationId,
+          upstreamModelId: payload.upstreamModelId,
+          ...(payload.label === undefined ? {} : { label: payload.label }),
+        });
+        return c.json(modelJson(model), 201);
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+
+  app.delete(
+    "/v1/organizations/:organizationId/model-providers/:providerKind/custom-models/:customModelId",
+    async (c) => {
+      c.header("cache-control", "private, no-store");
+      requireSameOriginBrowserMutation(c, deps);
+      const organizationId = parseOrganizationId(c.req.param("organizationId"));
+      const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+      const payload = await jsonBody(
+        c,
+        DeleteOrganizationProviderCustomModelRequest,
+        "invalid organization custom model deletion",
+      );
+      const customModelId = z.string().uuid().safeParse(c.req.param("customModelId"));
+      if (!customModelId.success) {
+        throw new HTTPException(422, { message: "invalid organization custom model id" });
+      }
+      try {
+        const model = await retireOrganizationModelProviderCustomModel(deps.db, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: providerKind(c.req.param("providerKind")),
+          customModelId: customModelId.data,
+          ...payload,
+        });
+        return c.json(modelJson(model));
+      } catch (error) {
+        conflict(error);
+      }
+    },
+  );
+}

package/src/routes/packs.ts

@@ -277,6 +277,7 @@ export function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void {
           sourcePath: inline.sourcePath,
           name: inline.name,
           description: inline.description,
+          activationMode: inline.activationMode,
           contentSha256: inline.contentSha256,
           totalBytes: inline.totalBytes,
           files: inline.files,

package/src/routes/personal-github.ts

@@ -3,10 +3,15 @@ import {
   ListPersonalGitHubRepositoriesResponse,
   PersonalGitHubConnectionStatusResponse,
   PersonalGitHubOAuthStartRequest,
+  PersonalGitHubRepositoryId,
   PersonalGitHubRepositorySelectionState,
   ReplacePersonalGitHubRepositorySelectionsRequest,
   VerifyPersonalGitHubRepositorySelectionsRequest,
 } from "@opengeni/contracts/personal-github";
+import {
+  ListGitHubRepositoryBranchesQuery,
+  GitHubRepositoryBranchesResponse,
+} from "@opengeni/contracts/github-repository-contracts";
 import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
@@ -31,6 +36,7 @@ import {
   startPersonalGitHubOAuth,
 } from "../integrations/personal-github";
 import {
+  listLivePersonalGitHubRepositoryBranches,
   listLivePersonalGitHubRepositories,
   personalGitHubRepositoryProviderHttpError,
   PersonalGitHubRepositoryProviderError,
@@ -187,6 +193,39 @@ export function registerPersonalGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     },
   );
 
+  app.get(
+    "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/:repositoryId/branches",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const connectionId = c.req.param("connectionId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "connections:read",
+      );
+      assertPersonalConnectionOwnerPrincipal(access, "My GitHub repositories");
+      const query = ListGitHubRepositoryBranchesQuery.parse(c.req.query());
+      const repositoryId = PersonalGitHubRepositoryId.parse(c.req.param("repositoryId"));
+      try {
+        return c.json(
+          GitHubRepositoryBranchesResponse.parse(
+            await listLivePersonalGitHubRepositoryBranches(deps, {
+              accountId: access.grant.accountId,
+              workspaceId,
+              subjectId: access.grant.subjectId,
+              connectionId,
+              repositoryId,
+              query,
+            }),
+          ),
+        );
+      } catch (error) {
+        throw personalGitHubRepositoryRouteError(error);
+      }
+    },
+  );
+
   app.post(
     "/v1/workspaces/:workspaceId/connections/:connectionId/github/repositories/verify",
     async (c) => {