@opengeni/api-router 3.0.1 → 3.1.2

package/dist/routes/codex-core.d.ts

@@ -0,0 +1,401 @@
+import type { Context } from "hono";
+import { requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import { type SubscriptionCoreCodexCredentialInput } from "@opengeni/db";
+import type { CodexUsagePayload } from "@opengeni/codex";
+import { codexModelsForPicker, requireCodexAppsHuman } from "./codex.js";
+import { SUBSCRIPTION_CORE_CUTOVER_DISABLED, typedHttpError } from "./subscription-core-http.js";
+export { SUBSCRIPTION_CORE_CUTOVER_DISABLED, typedHttpError };
+/**
+ * Only an enabled Codex cutover admits a request. Missing and disabled rows
+ * are maintenance: fail closed, never fall back to legacy state.
+ */
+export declare function codexRouteDisposition(deps: ApiRouteDeps, accountId: string): Promise<"core">;
+/**
+ * Persist a finished device-code sign-in on the core (M3 PR 3b): the legacy
+ * `connect/poll` response. `workspaceId` null is the organization route.
+ */
+export declare function coreCodexConnected(c: Context, deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string | null;
+    subjectId: string;
+    credential: SubscriptionCoreCodexCredentialInput;
+}): Promise<Response & import("hono").TypedResponse<{
+    status: string;
+    plan: string | null;
+    accountId: string;
+    isActive: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** Disconnect one account on the core: the legacy `{ disconnected, newActiveId }`. */
+export declare function coreCodexDisconnect(c: Context, deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string | null;
+    subjectId: string;
+    connectionId: string;
+}): Promise<Response & import("hono").TypedResponse<{
+    disconnected: boolean;
+    newActiveId: string | null;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** The legacy workspace "disconnect all" on the core: `{ disconnected }`. */
+export declare function coreCodexDisconnectAll(c: Context, deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<Response & import("hono").TypedResponse<{
+    disconnected: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexSource(c: Context, deps: ApiRouteDeps, accountId: string, workspaceId: string): Promise<Response & import("hono").TypedResponse<{
+    accountId: string;
+    workspaceId: string;
+    workspaceKind: "personal" | "shared";
+    mode: import("@opengeni/db").WorkspaceCodexSubscriptionMode;
+    effectiveSource: import("@opengeni/db").EffectiveCodexSubscriptionSource;
+    workspaceAvailable: boolean;
+    organizationAvailable: boolean;
+    workspaceSetAside?: boolean;
+    organizationCount?: number;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexSetSource(c: Context, deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    mode: "automatic" | "workspace" | "organization" | "disabled";
+}): Promise<Response & import("hono").TypedResponse<{
+    accountId: string;
+    workspaceId: string;
+    workspaceKind: "personal" | "shared";
+    mode: import("@opengeni/db").WorkspaceCodexSubscriptionMode;
+    effectiveSource: import("@opengeni/db").EffectiveCodexSubscriptionSource;
+    workspaceAvailable: boolean;
+    organizationAvailable: boolean;
+    workspaceSetAside?: boolean;
+    organizationCount?: number;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/**
+ * Readiness is computed from the core pool; there is no live provider model
+ * probe (that needs a connection-level credential read, which is PR 2c's usage
+ * seam), so `valid` reports whether a serviceable account exists and `models`
+ * is the configured Codex catalog.
+ */
+export declare function coreCodexStatus(c: Context, deps: ApiRouteDeps, accountId: string, workspaceId: string, catalogSettings: Parameters<typeof codexModelsForPicker>[0], viewerSubjectId: string): Promise<Response & import("hono").TypedResponse<{
+    connected: boolean;
+    plan: string | null;
+    valid: boolean;
+    activeAccountValid: boolean;
+    poolReady: boolean;
+    workerRoutable: boolean;
+    expiresAt: string | null;
+    lastError: string | null;
+    models: {
+        id: string;
+        label: string;
+        provider: string;
+        providerLabel: string;
+        api: "responses";
+    }[];
+    activeAccount: {
+        id: string;
+        label: string | null;
+        chatgptAccountId: string | null;
+    } | null;
+    accountCount: number;
+    source: {
+        accountId: string;
+        workspaceId: string;
+        workspaceKind: "personal" | "shared";
+        mode: import("@opengeni/db").WorkspaceCodexSubscriptionMode;
+        effectiveSource: import("@opengeni/db").EffectiveCodexSubscriptionSource;
+        workspaceAvailable: boolean;
+        organizationAvailable: boolean;
+        workspaceSetAside?: boolean;
+        organizationCount?: number;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexAccounts(c: Context, deps: ApiRouteDeps, grant: Awaited<ReturnType<typeof requireAccessGrant>>, workspaceId: string): Promise<Response & import("hono").TypedResponse<{
+    accounts: {
+        canEnableApps: boolean;
+        id: string;
+        source: "organization" | "workspace";
+        chatgptAccountId: string | null;
+        label: string | null;
+        email: string | null;
+        plan: string | null;
+        planCheckedAt: string | null;
+        planChangedFrom: string | null;
+        planChangedAt: string | null;
+        planExcludedModels: {
+            model: string;
+            label: string;
+            excludedAt: string;
+            retryAfter: string;
+        }[];
+        status: string;
+        active: boolean;
+        expiresAt: string | null;
+        lastRefreshAt: string | null;
+        lastError: string | null;
+        fiveHour: {
+            used: number;
+            limit: number;
+            remaining: number;
+            percent: number;
+            resetAt: string | null;
+            resetAfterSeconds: number | null;
+            limitWindowSeconds: number;
+        } | null;
+        weekly: {
+            used: number;
+            limit: number;
+            remaining: number;
+            percent: number;
+            resetAt: string | null;
+            resetAfterSeconds: number | null;
+            limitWindowSeconds: number;
+        } | null;
+        usageCheckedAt: string | null;
+        extraCreditsEnabled: boolean;
+        extraCreditsVersion: number;
+        extraCreditsUpdatedAt: string | null;
+        allocatorEnabled: boolean;
+        allocatorVersion: number;
+        allocatorUpdatedAt: string | null;
+        resetCreditAvailableCount: number | null;
+        resetCreditsCheckedAt: string | null;
+        exhaustedUntil: string | null;
+        ownInWorkspaceIds?: string[] | undefined;
+        appsDesignated: boolean;
+    }[];
+    activeAccountId: string | null;
+    source: {
+        accountId: string;
+        workspaceId: string;
+        workspaceKind: "personal" | "shared";
+        mode: import("@opengeni/db").WorkspaceCodexSubscriptionMode;
+        effectiveSource: import("@opengeni/db").EffectiveCodexSubscriptionSource;
+        workspaceAvailable: boolean;
+        organizationAvailable: boolean;
+        workspaceSetAside?: boolean;
+        organizationCount?: number;
+    };
+    apps: {
+        available: boolean;
+        credentialId: string | null;
+        version: number;
+        designatedAt: string | null;
+        canDisable: boolean;
+    };
+    settings: {
+        rotationEnabled: boolean;
+        rotationStrategy: string;
+        activeCredentialId: string | null;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+type AppsHuman = Awaited<ReturnType<typeof requireCodexAppsHuman>>;
+export declare function coreCodexDesignateApps(c: Context, deps: ApiRouteDeps, workspaceId: string, { human, accountId }: AppsHuman): Promise<Response & import("hono").TypedResponse<{
+    credentialId: string | null;
+    version: number;
+    designatedAt: string | null;
+    changed: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexClearApps(c: Context, deps: ApiRouteDeps, workspaceId: string, { human, accountId }: AppsHuman): Promise<Response & import("hono").TypedResponse<{
+    credentialId: string | null;
+    version: number;
+    designatedAt: string | null;
+    changed: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+type Admin = {
+    accountId: string;
+    workspaceId: string | null;
+    subjectId: string;
+};
+export declare function coreCodexActivate(c: Context, deps: ApiRouteDeps, admin: Admin, connectionId: string): Promise<Response & import("hono").TypedResponse<{
+    activated: true;
+    accountId: string;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexSetRotation(c: Context, deps: ApiRouteDeps, admin: Admin, rotationEnabled: boolean): Promise<Response & import("hono").TypedResponse<{
+    rotationEnabled: boolean;
+    rotationStrategy: string;
+    activeCredentialId: string | null;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexRename(c: Context, deps: ApiRouteDeps, admin: Admin, connectionId: string, label: string | null): Promise<Response & import("hono").TypedResponse<{
+    id: string;
+    source: "organization" | "workspace";
+    chatgptAccountId: string | null;
+    label: string | null;
+    email: string | null;
+    plan: string | null;
+    planCheckedAt: string | null;
+    planChangedFrom: string | null;
+    planChangedAt: string | null;
+    planExcludedModels: {
+        model: string;
+        label: string;
+        excludedAt: string;
+        retryAfter: string;
+    }[];
+    status: string;
+    active: boolean;
+    expiresAt: string | null;
+    lastRefreshAt: string | null;
+    lastError: string | null;
+    fiveHour: {
+        used: number;
+        limit: number;
+        remaining: number;
+        percent: number;
+        resetAt: string | null;
+        resetAfterSeconds: number | null;
+        limitWindowSeconds: number;
+    } | null;
+    weekly: {
+        used: number;
+        limit: number;
+        remaining: number;
+        percent: number;
+        resetAt: string | null;
+        resetAfterSeconds: number | null;
+        limitWindowSeconds: number;
+    } | null;
+    usageCheckedAt: string | null;
+    extraCreditsEnabled: boolean;
+    extraCreditsVersion: number;
+    extraCreditsUpdatedAt: string | null;
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: string | null;
+    resetCreditAvailableCount: number | null;
+    resetCreditsCheckedAt: string | null;
+    exhaustedUntil: string | null;
+    ownInWorkspaceIds?: string[] | undefined;
+    appsDesignated: boolean;
+    canEnableApps: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexAllocator(c: Context, deps: ApiRouteDeps, admin: Admin, connectionId: string, body: {
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<Response & import("hono").TypedResponse<{
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: string | null;
+    changed: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreCodexExtraCredits(c: Context, deps: ApiRouteDeps, admin: Admin, connectionId: string, body: {
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<Response & import("hono").TypedResponse<{
+    extraCreditsEnabled: boolean;
+    extraCreditsVersion: number;
+    extraCreditsUpdatedAt: string | null;
+    changed: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreOrganizationCodexAccounts(c: Context, deps: ApiRouteDeps, organizationId: string, subjectId: string): Promise<Response & import("hono").TypedResponse<{
+    accounts: {
+        id: string;
+        source: "organization" | "workspace";
+        chatgptAccountId: string | null;
+        label: string | null;
+        email: string | null;
+        plan: string | null;
+        planCheckedAt: string | null;
+        planChangedFrom: string | null;
+        planChangedAt: string | null;
+        planExcludedModels: {
+            model: string;
+            label: string;
+            excludedAt: string;
+            retryAfter: string;
+        }[];
+        status: string;
+        active: boolean;
+        expiresAt: string | null;
+        lastRefreshAt: string | null;
+        lastError: string | null;
+        fiveHour: {
+            used: number;
+            limit: number;
+            remaining: number;
+            percent: number;
+            resetAt: string | null;
+            resetAfterSeconds: number | null;
+            limitWindowSeconds: number;
+        } | null;
+        weekly: {
+            used: number;
+            limit: number;
+            remaining: number;
+            percent: number;
+            resetAt: string | null;
+            resetAfterSeconds: number | null;
+            limitWindowSeconds: number;
+        } | null;
+        usageCheckedAt: string | null;
+        extraCreditsEnabled: boolean;
+        extraCreditsVersion: number;
+        extraCreditsUpdatedAt: string | null;
+        allocatorEnabled: boolean;
+        allocatorVersion: number;
+        allocatorUpdatedAt: string | null;
+        resetCreditAvailableCount: number | null;
+        resetCreditsCheckedAt: string | null;
+        exhaustedUntil: string | null;
+        ownInWorkspaceIds?: string[] | undefined;
+        appsDesignated: boolean;
+        canEnableApps: boolean;
+    }[];
+    activeAccountId: string | null;
+    settings: {
+        rotationEnabled: boolean;
+        rotationStrategy: string;
+        activeCredentialId: string | null;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+type Grant = Awaited<ReturnType<typeof requireAccessGrant>>;
+/**
+ * Live usage on the core (EP-N21): the workspace's effective primary
+ * connection (the legacy active account), or one connection of the
+ * workspace's pool by id or legacy alias. The 404 copy matches legacy.
+ */
+export declare function coreCodexUsage(c: Context, deps: ApiRouteDeps, grant: Grant, workspaceId: string, requestedId: string | null): Promise<Response & import("hono").TypedResponse<{
+    status: CodexUsagePayload["status"];
+    usage: {
+        status: import("@opengeni/codex").CodexUsageStatus;
+        planType: string | null;
+        fiveHour: import("@opengeni/codex").CodexUsageWindow | null;
+        weekly: import("@opengeni/codex").CodexUsageWindow | null;
+        limitReached: boolean;
+        fetchedAt: string;
+        rateLimitResetCredits: import("@opengeni/codex").CodexRateLimitResetCreditsSummary | null;
+        reason?: "needs_relogin" | undefined;
+        additionalLimits?: import("@opengeni/codex").CodexAdditionalLimit[] | undefined;
+        credits?: {
+            hasCredits: boolean;
+            unlimited: boolean;
+            overageLimitReached: boolean;
+            balance: string | null;
+        } | undefined;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** Batched live refresh over the workspace's core pool, four provider calls at a time. */
+export declare function coreCodexUsageRefresh(c: Context, deps: ApiRouteDeps, grant: Grant, workspaceId: string): Promise<Response & import("hono").TypedResponse<{
+    usage: {
+        [x: string]: {
+            status: CodexUsagePayload["status"];
+            usage: {
+                status: import("@opengeni/codex").CodexUsageStatus;
+                planType: string | null;
+                fiveHour: import("@opengeni/codex").CodexUsageWindow | null;
+                weekly: import("@opengeni/codex").CodexUsageWindow | null;
+                limitReached: boolean;
+                fetchedAt: string;
+                rateLimitResetCredits: import("@opengeni/codex").CodexRateLimitResetCreditsSummary | null;
+                reason?: "needs_relogin" | undefined;
+                additionalLimits?: import("@opengeni/codex").CodexAdditionalLimit[] | undefined;
+                credits?: {
+                    hasCredits: boolean;
+                    unlimited: boolean;
+                    overageLimitReached: boolean;
+                    balance: string | null;
+                } | undefined;
+            };
+        };
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;

package/dist/routes/codex.d.ts

@@ -1,4 +1,47 @@
+import { type Settings } from "@opengeni/config";
+import { type CodexUsagePayload } from "@opengeni/codex";
 import { type CodexAccountStatus } from "@opengeni/db";
+export declare function codexAccountJson(row: CodexAccountStatus, options?: {
+    appsCredentialId?: string | null;
+    canManageApps?: boolean;
+    humanSubjectId?: string | null;
+}): {
+    id: string;
+    source: "organization" | "workspace";
+    chatgptAccountId: string | null;
+    label: string | null;
+    email: string | null;
+    plan: string | null;
+    planCheckedAt: Date | null;
+    planChangedFrom: string | null;
+    planChangedAt: Date | null;
+    planExcludedModels: {
+        model: string;
+        label: string;
+        excludedAt: Date;
+        retryAfter: Date;
+    }[];
+    status: string;
+    active: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastError: string | null;
+    fiveHour: import("@opengeni/codex").CodexUsageWindow | null;
+    weekly: import("@opengeni/codex").CodexUsageWindow | null;
+    usageCheckedAt: Date | null;
+    extraCreditsEnabled: boolean;
+    extraCreditsVersion: number;
+    extraCreditsUpdatedAt: Date | null;
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: Date | null;
+    resetCreditAvailableCount: number | null;
+    resetCreditsCheckedAt: Date | null;
+    exhaustedUntil: Date | null;
+    ownInWorkspaceIds?: string[];
+    appsDesignated: boolean;
+    canEnableApps: boolean;
+};
 /**
  * Derive the two distinct cached worker-readiness meanings exposed by the
  * status route. `poolReady` means at least one effective-pool account passes
@@ -16,7 +59,11 @@ export declare function codexWorkerReadiness(input: {
     poolReady: boolean;
     workerRoutable: boolean;
 };
-export declare function codexModelsForPicker(): Array<{
+export declare function codexUsageJson(payload: CodexUsagePayload): {
+    status: CodexUsagePayload["status"];
+    usage: CodexUsagePayload;
+};
+export declare function codexModelsForPicker(settings?: Settings, supportedSlugs?: readonly string[]): Array<{
     id: string;
     label: string;
     provider: string;
@@ -29,7 +76,22 @@ type ManagedCookieHuman = {
     subjectId: string;
     browserSessionHash: string;
 };
-export declare function requireOrganizationCodexHuman(c: Context, deps: ApiRouteDeps, organizationId: string): Promise<ManagedCookieHuman>;
+export declare function managedCookieHuman(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
+/**
+ * The person in this browser, or an agent acting as them. Only for routes that
+ * then require the same person's workspace grant; provider sign-in steps keep
+ * managedCookieHuman. An agent has no browser session, so its hash never
+ * matches a sign-in started in one.
+ */
+export declare function managedHumanOrAgent(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
+export declare function requireOrganizationCodexHuman(c: Context, deps: ApiRouteDeps, organizationId: string, options?: {
+    /** A provider sign-in step: the person does it in the browser, never an agent. */
+    providerConsent?: boolean;
+}): Promise<ManagedCookieHuman>;
 export declare function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void;
+export declare function requireCodexAppsHuman(c: Context, deps: ApiRouteDeps, workspaceId: string): Promise<{
+    human: ManagedCookieHuman;
+    accountId: string;
+}>;
 export declare function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void;
 export {};

package/dist/routes/computer-sessions.d.ts

@@ -1,6 +1,7 @@
 import { type ApiRouteDeps } from "@opengeni/core";
 import { type ComputerControlFrame, type ExpectedComputerFrameEvidence } from "@opengeni/runtime/sandbox";
 import type { Hono } from "hono";
+import { type InteractionSecretsPort } from "../interaction-secrets.js";
 type ComputerFrameCaptureClient = {
     capture(targetId: string, options: {
         format?: "jpeg" | "png";
@@ -11,8 +12,12 @@ type ComputerFrameCaptureClient = {
 };
 export declare function validateComputerFrameForApi(frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">, expected: ExpectedComputerFrameEvidence): ComputerControlFrame;
 export declare function captureModelComputerFrame(sessionClient: ComputerFrameCaptureClient, expected: ExpectedComputerFrameEvidence): Promise<ComputerControlFrame>;
+/** One validated screen frame, served as sandboxed, non-embeddable user content. */
+export declare function computerScreenshotResponse(frame: Pick<ComputerControlFrame, "data" | "mediaType" | "metadataHeader">): Response;
 /** Public ComputerSession resource surface. Physical app/window authority stays
  * in the same placement controller used by BrowserSession; this route owns only
  * durable authorization, placement fencing, lifecycle receipts, and routing. */
-export declare function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps): void;
+export declare function registerComputerSessionRoutes(app: Hono, deps: ApiRouteDeps, options?: {
+    interactionSecrets?: InteractionSecretsPort | null;
+}): void;
 export {};

package/dist/routes/desktop-distribution.d.ts

@@ -0,0 +1,32 @@
+import type { Hono } from "hono";
+import type { ApiRouteDeps } from "@opengeni/core";
+export declare const DESKTOP_INSTALLER_PATH = "/desktop/install.sh";
+export declare const DESKTOP_RELEASE_PAGE_PATH = "/desktop/latest";
+export declare const DESKTOP_DOWNLOAD_PREFIX = "/desktop/latest/";
+/** The versioned release file for a version-less name, or null if it isn't one. */
+export declare function desktopReleaseFile(asset: string, version: string): string | null;
+/** The highest stable version among desktop-v<version> tags. */
+export declare function newestDesktopVersion(tags: readonly string[]): string | null;
+/** owner/name for a https://github.com/<owner>/<name>/releases base, else null. */
+export declare function githubRepositoryOf(releasesBase: string): string | null;
+export interface DesktopVersionResolverOptions {
+    /** An operator pin. When set, it is the only version ever served. */
+    pinnedVersion?: string | undefined;
+    releasesBase: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    /** How long a looked-up version is reused. */
+    freshForMs?: number;
+    /** How long to wait before looking again after a failed lookup. */
+    retryAfterMs?: number;
+}
+/**
+ * The version /desktop/latest serves: the pin, or the newest desktop-v tag on
+ * the release repository. A lookup is shared by concurrent requests and reused
+ * for ten minutes, well within GitHub's unauthenticated rate limit. When GitHub
+ * is unreachable the last known version keeps serving.
+ */
+export declare function createDesktopVersionResolver(options: DesktopVersionResolverOptions): () => Promise<string>;
+export declare function desktopInstallerFor(body: string, publicBaseUrl: string | undefined): string;
+export declare function registerDesktopDistributionRoutes(app: Hono, deps: ApiRouteDeps, resolveVersion?: () => Promise<string>): void;
+export declare function isDesktopDistributionPath(path: string): boolean;

package/dist/routes/github-browser-fonts.gen.d.ts

@@ -0,0 +1,2 @@
+/** `@font-face` rules for the fonts above, embedded as data: URIs. */
+export declare const GITHUB_PAGE_FONT_FACES: string;

package/dist/routes/github-browser-pages.d.ts

@@ -0,0 +1,27 @@
+import type { GitHubInstallationBindingCandidate } from "@opengeni/contracts";
+export declare function githubInstallationChooserHtml(candidates: GitHubInstallationBindingCandidate[], state: string, workspaceId: string, baseUrl: string): string;
+export declare function githubSetupSuccessHtml(account: string, returnUrl: string): string;
+/**
+ * GitHub sends a non-owner here after they ask their organization owners to
+ * approve the app (`setup_action=request`). Nothing is connected yet: an owner
+ * approves on GitHub, then an owner connects the organization in Opengeni.
+ */
+export declare function githubSetupPendingHtml(returnUrl?: string | null): string;
+/**
+ * Where GitHub sends an organization owner after they approve a member's
+ * request (or install the app straight from GitHub). The redirect carries no
+ * Opengeni state, so it cannot name a workspace and must not connect one: an
+ * owner chooses the workspace explicitly from inside Opengeni.
+ */
+export declare function githubOwnerApprovedHtml(homeUrl: string): string;
+/**
+ * Why a GitHub browser step could not continue. Browser navigation (a stale
+ * page-load link, GitHub's Cancel button, a non-owner) must land on a readable
+ * page with a way back, never on a raw JSON error body.
+ */
+export type GitHubConnectFailure = "expired" | "cancelled" | "not_owner" | "forbidden" | "policy_denied" | "signed_out" | "failed";
+export declare function githubConnectFailureHtml(failure: GitHubConnectFailure, returnUrl: string, detail?: string | null): string;
+export declare function prReviewInstallationChooserHtml(candidates: GitHubInstallationBindingCandidate[], state: string, action: string): string;
+export declare function prReviewSetupSuccessHtml(account: string, returnUrl: string): string;
+export declare function prReviewSetupPendingHtml(): string;
+export declare function githubSuccessHtml(envLines: string[]): string;

package/dist/routes/inbox.d.ts

@@ -0,0 +1,13 @@
+import { type InboxItem } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { type InboxItemRow } from "@opengeni/db";
+import type { Hono } from "hono";
+/**
+ * The items another member's agent sent from a session the person cannot
+ * open (such as that member's private session). Those show no session: no
+ * title and no link. The person's own items are never checked here.
+ */
+export declare function itemsWithUnavailableSession(rows: readonly InboxItemRow[], canRead: (row: InboxItemRow) => Promise<boolean>): Promise<Set<string>>;
+/** An inbox row as the person sees it. */
+export declare function presentInboxItem(row: InboxItemRow, sessionTitle: string | null, sessionAvailable: boolean): InboxItem;
+export declare function registerInboxRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/insights-response-cache.d.ts

@@ -0,0 +1,10 @@
+export declare const INSIGHTS_RESPONSE_TTL_MS = 60000;
+/** Ephemeral keyed digest: raw credentials never become retained map keys or logs. */
+export declare function createInsightsCredentialPartition(): (authorization: string | undefined, cookie: string | undefined) => string;
+export declare function createInsightsResponseCache(clock?: () => number): {
+    get<T>(key: string, fence: string): T | null;
+    put(key: string, fence: string, value: unknown): void;
+    readonly size: number;
+};
+/** Match existing bounded cause-chain PostgreSQL timeout handling; never expose SQL. */
+export declare function insightsWithFriendlyTimeout<T>(read: () => Promise<T>): Promise<T>;

package/dist/routes/insights-usage.d.ts

@@ -0,0 +1,12 @@
+import type { AccessContext } from "@opengeni/contracts";
+import { type ApiRouteDeps, type InsightsQueryScope } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Keep repeated filters, but reject repeated scalar options in the strict schema. */
+export declare function insightsQueryParameters(query: Record<string, string[]>): Record<string, string | string[]>;
+/** Frozen interim capabilities: a newer additive contract must not silently widen a raw query. */
+export declare function insightsRawQuerySupported(query: Record<string, unknown>, organization: boolean, calls: boolean): boolean;
+/** The actor and its canonical detail authority are part of every sharing key. */
+export declare function insightsUsageCoalesceKey(scope: InsightsQueryScope, query: unknown, actor: string | null): string;
+/** Reuse canonical read grants, never infer session access from billing authority. */
+export declare function organizationInsightsScope(context: AccessContext, accountId: string): InsightsQueryScope;
+export declare function registerInsightsUsageRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/insights.d.ts

@@ -1,4 +1,32 @@
 import { type ApiRouteDeps, type WorkspaceInsightsFilterField } from "@opengeni/core";
 import type { Hono } from "hono";
 export declare function normalizeWorkspaceInsightsQueryFilter(value: string | null | undefined, field: WorkspaceInsightsFilterField): string | null;
+/**
+ * Share one in-flight computation between identical concurrent callers.
+ *
+ * A reload, a second tab, or a retried fetch joins the rollup already running
+ * instead of starting another multi-second aggregate on the database.
+ * Authorization and filter validation still run per request before a caller
+ * may join; the map only ever holds running work. The caller supplies the
+ * complete sharing key, which must identify everything the result depends on.
+ */
+export declare function createInFlightCoalescer<T>(): {
+    run: (key: string, work: () => Promise<T>) => Promise<T>;
+    readonly size: number;
+};
+/**
+ * Insights rows are filtered by the database RLS actor (private sessions are
+ * visible only to their owner), so two administrators of one workspace can
+ * legitimately receive different responses. The actor identity is part of
+ * the key; requests share work only when every visibility input is equal.
+ */
+export declare function workspaceInsightsCoalesceKey(input: {
+    workspaceId: string;
+    range: string;
+    provider: string | null;
+    model: string | null;
+    rootSessionId?: string | null;
+    sessionId?: string | null;
+    rlsActor: string | null;
+}): string;
 export declare function registerInsightsRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/interaction-placement-message.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The 422 a session gets when it asks for a computer or browser on a Connected
+ * Machine it is not currently placed on. Name the exact way to get there so an
+ * agent switches itself over instead of delegating or giving up, and keep it
+ * conditional because not every session is allowed to swap.
+ */
+export declare function wrongInteractionPlacementMessage(targetSandboxId: string): string;

package/dist/routes/managed-sign-in-methods.d.ts

@@ -0,0 +1,6 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+export declare function admitManagedSignInMutation(context: Context, deps: ApiRouteDeps): Promise<void>;
+export declare function registerManagedSignInMethodRoutes(app: Hono, deps: ApiRouteDeps): void;
+/** Intercept only database-backed, product-issued explicit connect states. */
+export declare function handleManagedSignInConnectCallback(context: Context, deps: ApiRouteDeps, provider: "google" | "github"): Promise<Response | null>;