@opengeni/api-router 2.6.4 → 2.8.1-canary.0

package/dist/integrations/personal-github-repositories.d.ts

@@ -1,9 +1,39 @@
 import { type PersonalGitHubRepository as PersonalGitHubRepositoryContract, type PersonalGitHubRepositorySelectionInput } from "@opengeni/contracts/personal-github";
+import { type GitHubRepositoryBranchesResponse as GitHubRepositoryBranchesResponseContract, type ListGitHubRepositoryBranchesQuery } from "@opengeni/contracts/github-repository-contracts";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { getConnectionMetadata } from "@opengeni/db";
+import { getConnectionMetadata, type PersonalGitHubRepositorySelectionState as DbPersonalGitHubRepositorySelectionState } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 export type PersonalGitHubRepositoryConnection = NonNullable<Awaited<ReturnType<typeof getConnectionMetadata>>>;
-export type PersonalGitHubRepositoryProviderErrorCode = "connection_changed" | "connection_inactive" | "invalid_provider_response" | "provider_denied" | "provider_rate_limited" | "provider_unavailable" | "repository_archived" | "repository_not_found" | "repository_read_denied" | "repository_write_denied";
+type PersonalGitHubRepositoryProviderOperation = "repositories_list" | "repository_branches_list" | "repository_verify";
+type ExpectedPersonalGitHubRepositoryAuthority = {
+    selectionGeneration: number;
+    repositoryId: string;
+    fullName: string;
+};
+type PersonalGitHubProviderJsonOptions = {
+    operation: PersonalGitHubRepositoryProviderOperation;
+    expectedRepositoryAuthority?: ExpectedPersonalGitHubRepositoryAuthority;
+    responseLabel?: string;
+    responseMaxBytes?: number;
+};
+export type PersonalGitHubRepositoryBranchServices = {
+    requireConnection: typeof requirePersonalGitHubRepositoryConnection;
+    getSelectionState: (deps: ApiRouteDeps, input: {
+        accountId: string;
+        originWorkspaceId: string;
+        subjectId: string;
+        connectionId: string;
+    }) => Promise<DbPersonalGitHubRepositorySelectionState | null>;
+    providerJson: (input: {
+        deps: ApiRouteDeps;
+        connection: PersonalGitHubRepositoryConnection;
+        subjectId: string;
+        url: URL;
+        expectedConnectionAuthorityGeneration: number;
+        options: PersonalGitHubProviderJsonOptions;
+    }) => Promise<unknown>;
+};
+export type PersonalGitHubRepositoryProviderErrorCode = "connection_changed" | "connection_inactive" | "invalid_provider_response" | "provider_denied" | "provider_rate_limited" | "provider_unavailable" | "repository_archived" | "repository_not_found" | "repository_not_selected" | "repository_read_denied" | "repository_selection_changed" | "repository_write_denied";
 export declare class PersonalGitHubRepositoryProviderError extends Error {
     readonly code: PersonalGitHubRepositoryProviderErrorCode;
     constructor(code: PersonalGitHubRepositoryProviderErrorCode);
@@ -26,6 +56,14 @@ export declare function listLivePersonalGitHubRepositories(deps: ApiRouteDeps, i
     repositories: PersonalGitHubRepositoryContract[];
     nextPage: number | null;
 }>;
+export declare function listLivePersonalGitHubRepositoryBranches(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    repositoryId: string;
+    query: ListGitHubRepositoryBranchesQuery;
+}, services?: PersonalGitHubRepositoryBranchServices): Promise<GitHubRepositoryBranchesResponseContract>;
 /** Serial by design: one bounded provider request and one authority check at a time. */
 export declare function verifyLivePersonalGitHubRepositories(deps: ApiRouteDeps, input: {
     workspaceId: string;
@@ -43,3 +81,4 @@ export declare function parsePersonalGitHubProviderJson(value: string): unknown;
 export declare function personalGitHubRepositoryCanRead(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
 export declare function personalGitHubRepositoryCanWrite(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
 export declare function parsePersonalGitHubRepository(value: unknown): PersonalGitHubRepositoryContract;
+export {};

package/dist/mcp/scheduled-task-view.d.ts

@@ -82,8 +82,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -205,8 +205,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -389,8 +389,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
+            readonly sourceId?: never;
             kind: "agent_turn";
-            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/model-catalog.d.ts

@@ -1,23 +1,7 @@
-import { type ConfiguredModel, type Settings } from "@opengeni/config";
-import { ClientModel, type WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponseType, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
-export type ModelAvailabilityObservation = {
-    status: "available" | "degraded" | "unavailable";
-    reason: "not_entitled" | "provider_unhealthy" | null;
-    checkedAt: string;
-};
-export type ModelCredentialReadinessObservation = {
-    status: "ready";
-    checkedAt: string;
-} | {
-    status: "not_ready";
-    reason: "prerequisites_missing" | "needs_reauth";
-    checkedAt: string;
-} | {
-    status: "error";
-    reason: "resolver_error";
-    checkedAt: string;
-};
-export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
+import { type ConfiguredModel } from "@opengeni/config";
+import { ClientModel, type WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponseType } from "@opengeni/contracts";
+import { type WorkspaceModelSelectionInput } from "@opengeni/core";
+export { MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS, type ModelAvailabilityObservation, type ModelCredentialReadinessObservation, } from "@opengeni/core";
 /** Static, client-safe definition projection. No provider secret is reachable. */
 export declare function projectClientModel(model: ConfiguredModel): ClientModel;
 /**
@@ -28,14 +12,4 @@ export declare function projectClientModel(model: ConfiguredModel): ClientModel;
  * successful typed resolver observation; credential health and provider health
  * are separate inputs and neither is fabricated.
  */
-export declare function buildWorkspaceModelCatalog(input: {
-    settings: Settings;
-    policy: WorkspaceModelPolicyContract | null;
-    codexSubscriptionActive: boolean;
-    xaiSubscriptionActive?: boolean;
-    workspaceGatewayConnectionActive?: boolean;
-    credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
-    observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
-    now?: Date | undefined;
-    credentialReadinessMaxAgeMs?: number | undefined;
-}): WorkspaceModelCatalogResponseType;
+export declare function buildWorkspaceModelCatalog(input: WorkspaceModelSelectionInput): WorkspaceModelCatalogResponseType;

package/dist/routes/codex.d.ts

@@ -6,5 +6,12 @@ export declare function codexModelsForPicker(liveSlugs: readonly string[]): Arra
     api: "responses";
 }>;
 import { type ApiRouteDeps } from "@opengeni/core";
-import type { Hono } from "hono";
+import type { Context, Hono } from "hono";
+type ManagedCookieHuman = {
+    subjectId: string;
+    browserSessionHash: string;
+};
+export declare function requireOrganizationCodexHuman(c: Context, deps: ApiRouteDeps, organizationId: string): Promise<ManagedCookieHuman>;
+export declare function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void;
 export declare function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/github.d.ts

@@ -1,3 +1,5 @@
+import { type AccessGrant } from "@opengeni/contracts";
 import type { Hono } from "hono";
 import type { ApiRouteDeps } from "@opengeni/core";
 export declare function registerGitHubRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function requirePublicGitHubRepositoryVerificationPermission(grant: Pick<AccessGrant, "permissions">): void;

package/dist/routes/organization-model-providers.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/workspace-deletion.d.ts

@@ -0,0 +1,6 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare function deleteWorkspaceForRequest(deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    organizationAdministratorSubjectId?: string;
+}): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.6.4",
+  "version": "2.8.1-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,23 +43,23 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1",
-    "@opengeni/artifact-tool": "^0.3.14",
-    "@opengeni/capabilities": "^0.3.1",
-    "@opengeni/codemode": "^0.4.22",
-    "@opengeni/codex": "^0.2.20",
-    "@opengeni/config": "^0.22.5",
-    "@opengeni/contracts": "^2.9.2",
-    "@opengeni/core": "^2.6.4",
-    "@opengeni/db": "^3.7.4",
-    "@opengeni/documents": "^0.8.14",
-    "@opengeni/events": "^0.4.12",
-    "@opengeni/github": "^0.6.7",
-    "@opengeni/network": "^0.2.3",
-    "@opengeni/observability": "^0.8.14",
-    "@opengeni/runtime": "^2.0.1",
-    "@opengeni/storage": "^0.2.115",
-    "@opengeni/xai-subscription": "^0.1.2",
+    "@opengeni/agent-proto": "^0.5.1-canary.8",
+    "@opengeni/artifact-tool": "^0.3.17-canary.0",
+    "@opengeni/capabilities": "^0.3.1-canary.7",
+    "@opengeni/codemode": "^0.4.25-canary.0",
+    "@opengeni/codex": "^0.2.20-canary.2",
+    "@opengeni/config": "^0.23.2-canary.0",
+    "@opengeni/contracts": "^2.11.1-canary.0",
+    "@opengeni/core": "^2.7.2-canary.0",
+    "@opengeni/db": "^3.8.2-canary.0",
+    "@opengeni/documents": "^0.8.17-canary.0",
+    "@opengeni/events": "^0.4.15-canary.0",
+    "@opengeni/github": "^0.7.1-canary.0",
+    "@opengeni/network": "^0.2.3-canary.7",
+    "@opengeni/observability": "^0.8.17-canary.0",
+    "@opengeni/runtime": "^2.1.2-canary.0",
+    "@opengeni/storage": "^0.2.118-canary.0",
+    "@opengeni/xai-subscription": "^0.1.2-canary.7",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -66,6 +66,8 @@ import {
   requireLiveAgentAttemptAuthorization,
   requirePermission,
   releaseManagedAuthRequestActorLease,
+  resolveCatalogSettings,
+  resolveWorkspaceCatalogSettings,
   validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
@@ -116,6 +118,7 @@ import { allowedCorsOrigin } from "./http/cors";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
+import { registerOrganizationModelProviderRoutes } from "./routes/organization-model-providers";
 import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
 import { registerDocumentRoutes } from "./routes/documents";
@@ -222,6 +225,22 @@ export function createApp(deps: AppDependencies): Hono {
   return createAppComposition(deps).app;
 }
 
+export async function resolveWorkspaceMcpRouteDeps(
+  routeDeps: ApiRouteDeps,
+  grant: AccessGrant,
+): Promise<ApiRouteDeps> {
+  const catalogSourceSettings = routeDeps.catalogSourceSettings ?? routeDeps.settings;
+  const resolvedCatalog = await resolveWorkspaceCatalogSettings(
+    routeDeps.db,
+    catalogSourceSettings,
+    {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+    },
+  );
+  return { ...routeDeps, catalogSourceSettings, settings: resolvedCatalog.settings };
+}
+
 export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
@@ -358,6 +377,7 @@ export function createAppComposition(deps: AppDependencies): {
       : deps.transcriptionSegmenter;
   const routeDeps: ApiRouteDeps = {
     ...deps,
+    resolveCatalogSettings: () => resolveCatalogSettings(deps.db, deps.settings),
     observability,
     githubStateSecret:
       deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
@@ -403,6 +423,21 @@ export function createAppComposition(deps: AppDependencies): {
       "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Actor-State",
       "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Covered-First",
+      "X-OpenGeni-Covered-Last",
+      "X-OpenGeni-Event-Direction",
+      "X-OpenGeni-Event-Mode",
+      "X-OpenGeni-Event-Result",
+      "X-OpenGeni-Event-Result-Mode",
+      "X-OpenGeni-Forensic-Exact",
+      "X-OpenGeni-Has-More",
+      "X-OpenGeni-Next-After",
+      "X-OpenGeni-Next-Before",
+      "X-OpenGeni-Page-Bytes",
+      "X-OpenGeni-Page-Max-Bytes",
+      "X-OpenGeni-Page-Truncated",
+      "X-OpenGeni-Payload-Mode",
+      "X-OpenGeni-Truncated-By",
     ],
   };
   const publicApiCors = cors({
@@ -766,10 +801,12 @@ export function createAppComposition(deps: AppDependencies): {
 
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
-    const codexCatalogSettings = deps.settings.codexSubscriptionEnabled
-      ? withCodexCatalogProvider(deps.settings)
-      : deps.settings;
-    const catalogSettings = deps.settings.supergrokSubscriptionEnabled
+    const resolvedCatalog = await resolveCatalogSettings(deps.db, deps.settings);
+    const baseCatalogSettings = resolvedCatalog.settings;
+    const codexCatalogSettings = baseCatalogSettings.codexSubscriptionEnabled
+      ? withCodexCatalogProvider(baseCatalogSettings)
+      : baseCatalogSettings;
+    const catalogSettings = baseCatalogSettings.supergrokSubscriptionEnabled
       ? withXaiSubscriptionCatalogProvider(codexCatalogSettings)
       : codexCatalogSettings;
     return c.json(
@@ -889,7 +926,8 @@ export function createAppComposition(deps: AppDependencies): {
       const transport = new WebStandardStreamableHTTPServerTransport({
         enableJsonResponse: true,
       });
-      const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
+      const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
+      const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
         requestOrigin: new URL(c.req.url).origin,
         workspaceMemoryEnabled,
         workspaceMemoryPromptMode,
@@ -996,6 +1034,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerSessionRoutes(app, routeDeps);
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
+  registerOrganizationModelProviderRoutes(app, routeDeps);
   registerSuperGrokRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
   registerEditableArtifactRoutes(app, routeDeps);
@@ -1093,6 +1132,10 @@ const publicWorkspaceBrowserRoutePatterns = [
 ] as const;
 
 export function workspaceActorContextExempt(method: string, pathname: string): boolean {
+  // The account-scoped provisioning route shares the workspace collection prefix.
+  // Hono's trailing wildcard also matches it, but "external" is not a workspace UUID;
+  // the route performs its own organization API-key authorization.
+  if (method === "PUT" && pathname === "/v1/workspaces/external") return true;
   if (/^\/v1\/workspaces\/[^/]+\/mcp$/.test(pathname)) return true;
   if (
     method === "GET" &&
@@ -1379,11 +1422,14 @@ type ReadinessCheckResult = { ok: boolean; error?: string };
 function readinessChecks(deps: AppDependencies): ReadinessChecks {
   const configuredNatsCheck = deps.readinessChecks?.nats;
   return {
-    db:
-      deps.readinessChecks?.db ??
-      (async () => {
+    db: async () => {
+      if (deps.readinessChecks?.db) {
+        await deps.readinessChecks.db();
+      } else {
         await deps.db.execute(dbSql`select 1`);
-      }),
+      }
+      await resolveCatalogSettings(deps.db, deps.settings);
+    },
     nats: async () => {
       requireSessionEventDurableFanoutCapability(deps.bus);
       if (configuredNatsCheck) {

package/src/auth/organization-user-setup.ts

@@ -107,9 +107,9 @@ export function renderOrganizationUserSetupEmail(input: OrganizationUserSetupEma
   return {
     from: input.senderEmail,
     to: input.recipientEmail,
-    subject: `Join ${input.organizationName} on OpenGeni`,
-    text: `${greeting}\n\nYou have been invited to ${input.organizationName} as ${role}.\n\n${workspaceSummary}\n\nThis invitation grants only the organization role and shared workspace access listed above. It never shares anyone's Personal workspace.\n\nSet up your account: ${input.setupUrl}\n\nIf you already have an OpenGeni account, sign in and accept the invitation instead.`,
-    html: `<p>${escapeHtml(greeting)}</p><p>You have been invited to <strong>${escapeHtml(input.organizationName)}</strong> as ${escapeHtml(role)}.</p>${workspaceHtml}<p>This invitation grants only the organization role and shared workspace access listed above. It never shares anyone's Personal workspace.</p><p><a href="${escapeHtml(input.setupUrl)}">Set up your account</a></p><p>If you already have an OpenGeni account, sign in and accept the invitation instead.</p>`,
+    subject: `You're invited to join ${input.organizationName} on OpenGeni`,
+    text: `${greeting}\n\nYou've been invited to join ${input.organizationName} on OpenGeni as ${role}.\n\n${workspaceSummary}\n\nThis invitation grants only the organization role and shared workspace access listed above. It never shares anyone's Personal workspace.\n\nAccept invitation to ${input.organizationName}: ${input.setupUrl}\n\nYou'll sign in or create an account before joining. Already use OpenGeni? Open this invitation and choose Sign in as ${input.recipientEmail}. OpenGeni will show the invitation immediately after you sign in.`,
+    html: `<p>${escapeHtml(greeting)}</p><p>You've been invited to join <strong>${escapeHtml(input.organizationName)}</strong> on OpenGeni as ${escapeHtml(role)}.</p>${workspaceHtml}<p>This invitation grants only the organization role and shared workspace access listed above. It never shares anyone's Personal workspace.</p><p><a href="${escapeHtml(input.setupUrl)}">Accept invitation to ${escapeHtml(input.organizationName)}</a></p><p>You'll sign in or create an account before joining. Already use OpenGeni? Open this invitation and choose <strong>Sign in as ${escapeHtml(input.recipientEmail)}</strong>. OpenGeni will show the invitation immediately after you sign in.</p>`,
   };
 }
 

package/src/github-access.ts

@@ -1,15 +1,61 @@
 import type {
+  GitHubAppRepositoryBranchPage,
   GitHubBindingStatus,
   GitHubInstallationBinding,
   GitHubRepository,
 } from "@opengeni/contracts";
 import {
+  GitHubRepositoryBranchesResponse as GitHubRepositoryBranchesResponseSchema,
+  type GitHubRepositoryBranchesResponse,
+  type ListGitHubRepositoryBranchesQuery,
+} from "@opengeni/contracts/github-repository-contracts";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
   hasAuditableGitHubInstallationAuthority,
   listGitHubInstallationAccessForWorkspace,
 } from "@opengeni/db";
-import { listGitHubAppInstallationSummaries, listGitHubAppRepositories } from "@opengeni/github";
+import {
+  GitHubAppApiError,
+  listGitHubAppInstallationSummaries,
+  listGitHubAppRepositories,
+  listGitHubAppRepositoryBranches,
+} from "@opengeni/github";
 import type { ApiRouteDeps } from "@opengeni/core";
 
+export type GitHubRepositoryBranchAuthorityErrorCode = "changed" | "not_authorized";
+
+export class GitHubRepositoryBranchAuthorityError extends Error {
+  constructor(readonly code: GitHubRepositoryBranchAuthorityErrorCode) {
+    super(code);
+    this.name = "GitHubRepositoryBranchAuthorityError";
+  }
+}
+
+export type WorkspaceGitHubRepositoryBranchServices = {
+  listInstallationAccess: typeof listGitHubInstallationAccessForWorkspace;
+  areRepositoriesAllowed: typeof areGitHubRepositoriesAllowedForWorkspace;
+  listProviderBranches: (
+    deps: ApiRouteDeps,
+    input: {
+      installationId: number;
+      repositoryId: number;
+      page: number;
+      limit: number;
+    },
+  ) => Promise<GitHubAppRepositoryBranchPage | null>;
+};
+
+const workspaceGitHubRepositoryBranchServices: WorkspaceGitHubRepositoryBranchServices = {
+  listInstallationAccess: listGitHubInstallationAccessForWorkspace,
+  areRepositoriesAllowed: areGitHubRepositoriesAllowedForWorkspace,
+  listProviderBranches: async (deps, input) =>
+    deps.githubAppApi?.listRepositoryBranches
+      ? await deps.githubAppApi.listRepositoryBranches(input)
+      : deps.githubAppApi
+        ? null
+        : await listGitHubAppRepositoryBranches(deps.settings, input),
+};
+
 export async function listWorkspaceGitHubInstallationBindings(
   deps: ApiRouteDeps,
   workspaceId: string,
@@ -153,3 +199,73 @@ export async function listWorkspaceGitHubRepositories(
     return installation.repositoryIds.includes(repository.id);
   });
 }
+
+export async function listWorkspaceGitHubRepositoryBranches(
+  deps: ApiRouteDeps,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    repositoryId: number;
+    query: ListGitHubRepositoryBranchesQuery;
+  },
+  services: WorkspaceGitHubRepositoryBranchServices = workspaceGitHubRepositoryBranchServices,
+): Promise<GitHubRepositoryBranchesResponse> {
+  const installations = await services.listInstallationAccess(deps.db, input.workspaceId);
+  const installation = installations.find(
+    (candidate) => candidate.installationId === input.installationId,
+  );
+  if (
+    !installation ||
+    installation.accountId !== input.accountId ||
+    !hasAuditableGitHubInstallationAuthority(installation) ||
+    !installation.repositoryIds.includes(input.repositoryId)
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("not_authorized");
+  }
+  if (
+    !(await services.areRepositoriesAllowed(deps.db, input.workspaceId, input.installationId, [
+      input.repositoryId,
+    ]))
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("changed");
+  }
+  const page = await services.listProviderBranches(deps, {
+    installationId: input.installationId,
+    repositoryId: input.repositoryId,
+    page: input.query.cursor,
+    limit: input.query.limit,
+  });
+  if (!page) {
+    throw new GitHubAppApiError(
+      "The configured GitHub provider cannot list exact repository branches",
+    );
+  }
+  if (
+    page.installationId !== input.installationId ||
+    page.repositoryId !== input.repositoryId ||
+    page.branches.length > input.query.limit ||
+    (page.nextPage !== null && page.nextPage !== input.query.cursor + 1) ||
+    (page.branches.length < input.query.limit && page.nextPage !== null)
+  ) {
+    throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
+  }
+  const response = GitHubRepositoryBranchesResponseSchema.safeParse({
+    branches: page.branches.map((name) => ({
+      name,
+      isDefault: name === page.defaultBranch,
+    })),
+    nextCursor: page.nextPage,
+  });
+  if (!response.success) {
+    throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
+  }
+  if (
+    !(await services.areRepositoriesAllowed(deps.db, input.workspaceId, input.installationId, [
+      input.repositoryId,
+    ]))
+  ) {
+    throw new GitHubRepositoryBranchAuthorityError("changed");
+  }
+  return response.data;
+}

package/src/http/sse.ts

@@ -10,12 +10,11 @@ import {
   type Database,
 } from "@opengeni/db";
 import {
-  coalesceSessionEventDeltas,
+  coalesceSessionEventDeltasWithCoverage,
   formatSessionEventSse,
   formatWorkspaceControlEventSse,
   requireSessionEventDurableFanoutCapability,
   SESSION_EVENT_SSE_FRAME_MAX_BYTES,
-  sessionEventResumeSequence,
   type EventBus,
 } from "@opengeni/events";
 import type { Observability } from "@opengeni/observability";
@@ -295,8 +294,14 @@ export async function sseSessionStream(
       limit: SESSION_REPLAY_PAGE_SIZE,
     });
     await options.reauthorize?.();
+    const compactProjection = coalesceSessionEventDeltasWithCoverage(events);
     return finiteSseBatchResponse(
-      coalesceSessionEventDeltas(events).map(formatSessionEventSse),
+      compactProjection.events.map((event) =>
+        formatSessionEventSse(
+          event,
+          compactProjection.coveredThroughBySequence.get(event.sequence) ?? event.sequence,
+        ),
+      ),
       options,
     );
   }
@@ -378,9 +383,12 @@ export async function sseSessionStream(
       // adjacent text deltas into bounded frames carrying `coalescedUntil`, so
       // a long answer cannot create thousands of React renders and starve
       // command acknowledgements behind its own token stream.
-      for (const projected of coalesceSessionEventDeltas(eligible)) {
-        await writeFrame(formatSessionEventSse(projected));
-        lastSent = sessionEventResumeSequence(projected);
+      const compactProjection = coalesceSessionEventDeltasWithCoverage(eligible);
+      for (const projected of compactProjection.events) {
+        const coveredThrough =
+          compactProjection.coveredThroughBySequence.get(projected.sequence) ?? projected.sequence;
+        await writeFrame(formatSessionEventSse(projected, coveredThrough));
+        lastSent = coveredThrough;
       }
       if (lastSent <= previousLastSent) {
         throw new Error(`Session event replay made no progress after sequence ${lastSent}`);
@@ -432,7 +440,7 @@ export async function sseSessionStream(
     drainReconnectReconciliation();
   };
   const send = async (event: SessionEvent) => {
-    const targetSequence = sessionEventResumeSequence(event);
+    const targetSequence = event.sequence;
     if (targetSequence <= lastSent) return;
     await reconcileDurableThrough(targetSequence);
   };

package/src/index.ts

@@ -28,7 +28,10 @@ import {
 } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { isArtifactRuntimeConfigured } from "@opengeni/artifact-tool/runtime/development";
-import { SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID } from "@opengeni/core";
+import {
+  resolveCatalogSettings,
+  SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID,
+} from "@opengeni/core";
 import {
   Connection,
   Client as TemporalClient,
@@ -357,6 +360,15 @@ export async function startApi(
       () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),
       { ...retryOptions, onRetry },
     );
+    const resolvedCatalog = await retryStartupDependency(
+      "model catalog",
+      () => resolveCatalogSettings(dbClient.db, settings),
+      { ...retryOptions, onRetry },
+    );
+    observability.info("OpenGeni model catalog resolved", {
+      catalogSource: resolvedCatalog.source,
+      catalogVersion: resolvedCatalog.version,
+    });
     bus = await retryStartupDependency(
       "NATS",
       () =>