@opengeni/api-router 3.0.1 → 3.1.2

package/dist/routes/model-account-choice.d.ts

@@ -0,0 +1,13 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/**
+ * Explicit model-account choice for a session and a person's own
+ * preferences, for every provider on the shared subscription core
+ * (SUB-SEL-02, SUB-SEL-04, SUB-ELIG-05, SUB-OWN-05, D-24, D-27, D-28).
+ *
+ * The session routes sit behind the session authorization middleware
+ * (`session.read` to read, the account-choice operation to write), so a
+ * private session is reachable only by its owner. The database enforces
+ * which account a session may use; these routes translate its outcome.
+ */
+export declare function registerModelAccountChoiceRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/model-account-settings.d.ts

@@ -0,0 +1,19 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+import { ApiHttpError } from "../http/api-error.js";
+/**
+ * 409 `setting_locked` for any write the organization's settings lock refused:
+ * these routes and every older route whose write meets the 0724 guard (for
+ * example a Codex rotation, primary or source change). Mapped centrally in
+ * the app error handler.
+ */
+export declare function subscriptionSettingsLockedHttpError(error: unknown): ApiHttpError | null;
+/**
+ * Model-account settings (SUB-SET-01..05). Organization owners and admins
+ * read and change the organization's values and locks and read the overview
+ * of every shared workspace. Workspace members read their workspace's
+ * effective values; its administrators (and organization administrators)
+ * override what the organization has not locked. The database enforces
+ * every refusal; these routes only translate it.
+ */
+export declare function registerModelAccountSettingsRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/native-app-auth.d.ts

@@ -0,0 +1,12 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare const NATIVE_APP_CODE_TTL_MS: number;
+export declare const NATIVE_APP_PLATFORMS: readonly ["ios", "android", "macos", "windows", "linux"];
+type NativeAppPlatform = (typeof NATIVE_APP_PLATFORMS)[number];
+/** The device label shown in the person's signed-in sessions. */
+export declare function nativeAppSessionUserAgent(platform: NativeAppPlatform, deviceName: string | null): string;
+/** A registered native callback: exactly `<allowed scheme>://auth/callback`. */
+export declare function nativeAppRedirectAllowed(redirectUri: string, schemes: readonly string[]): boolean;
+export declare function pkceS256Challenge(verifier: string): string;
+export declare function registerNativeAppAuthRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/organization-integration-policy.d.ts

@@ -0,0 +1,8 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+/** The database rechecks current organization membership/key authority at commit. */
+export declare function authorizeOrganizationIntegrationAdministration(context: Context, deps: ApiRouteDeps, accountId: string, mutation: boolean): Promise<{
+    accountId: string;
+    subjectId: string;
+}>;
+export declare function registerOrganizationIntegrationPolicyRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-integrations.d.ts

@@ -0,0 +1,6 @@
+import { type AccessContext } from "@opengeni/contracts";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Account administrators or verified full-access organization keys; never workspace keys. */
+export declare function requireOrganizationIntegrationAdmin(context: AccessContext, organizationId: string, authorization?: AccessGrantAuthorization): string;
+export declare function registerOrganizationIntegrationRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-mcp-connections.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationMcpConnectionRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-model-defaults.d.ts

@@ -0,0 +1,9 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/**
+ * Organization model defaults: what every workspace follows until it saves
+ * its own default model, allowed models or compaction trigger. Owners and
+ * admins read and change them; workspaces read them through their own model
+ * routes, which report where each value comes from.
+ */
+export declare function registerOrganizationModelDefaultsRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/organization-service-accounts.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationServiceAccountRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/personal-api-keys.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerPersonalApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/session-admin-access.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerSessionAdminAccessRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/session-artifact-associations.d.ts

@@ -0,0 +1,4 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Exact authorized membership proof, not a paginated artifact discovery API. */
+export declare function registerSessionArtifactAssociationRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/session-history-imports.d.ts

@@ -0,0 +1,20 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+/** Exact server-only routes with their own bounded, streaming JSON ingress. */
+export declare function isSessionHistoryImportRequest(method: string, pathname: string): boolean;
+/** Count raw UTF-8 bytes before decoding or parsing, including chunked bodies. */
+export declare function readSessionHistoryImportJson(request: Request): Promise<unknown>;
+export declare const SESSION_ARCHIVED_MESSAGE = "This session is archived and read-only. Start a new session to continue the work.";
+export declare const SESSION_IMPORTED_MESSAGE = "Imported session history is read-only";
+export type ReadOnlySessionRefusal = {
+    code: "SESSION_ARCHIVED_READ_ONLY" | "SESSION_IMPORTED_READ_ONLY";
+    message: string;
+};
+/**
+ * Classifies a write refused because its session is read-only (archived or an
+ * imported history), for HTTP responses and agent tool results alike.
+ */
+export declare function readOnlySessionRefusal(error: unknown): ReadOnlySessionRefusal | null;
+/** Also used by the composed API for imported- and archived-session Send/Steer refusals. */
+export declare function archivedSessionImportErrorResponse(c: Context, error: unknown): Response | null;
+export declare function registerSessionHistoryImportRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/sessions.d.ts

@@ -1,11 +1,14 @@
-import { ClientSessionEvent, SteerSessionMessageRequest, type SessionStatus, type WorkClaimSubjectFilter, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
-import { type SessionDiscoveryCursor } from "@opengeni/db";
+import { type AgentCapabilities } from "@opengeni/contracts";
+import { ClientSessionEvent, SessionScopeSubjectId, SteerSessionMessageRequest, type SessionStatus, type WorkClaimSubjectFilter, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
+import { decodeSessionListCursor, type SessionDiscoveryCursor } from "@opengeni/db";
 import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { type ViewerServices } from "../sandbox/viewer.js";
 type SessionRouteDeps = ApiRouteDeps & Pick<ViewerServices, "establishSandboxSession">;
 export declare function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void;
 export declare function goalProposalMatchesExpectedRevision(revision: Pick<SessionGoalRevision, "baseObjectiveRevision">, expectedObjectiveRevision: number): boolean;
+export declare function sessionRealtimeHttpError(error: unknown): HTTPException;
 /**
  * Map every mounted session-addressed HTTP path to the host-neutral operation
  * the embedding port authorizes. Returning null is deliberately fail-closed in
@@ -13,6 +16,32 @@ export declare function goalProposalMatchesExpectedRevision(revision: Pick<Sessi
  */
 export declare function sessionAuthorizationOperationForHttp(method: string, pathname: string, sessionId: string): SessionAuthorizationOperation | null;
 export declare function sessionTenancyHttpError(error: unknown): Error;
+export declare function sessionListQuery(query: Record<string, string>, allowCursor?: boolean): {
+    originSiteId: string | undefined;
+    limit: string | undefined;
+    parentSessionId: string | null | undefined;
+    cursor: ReturnType<typeof decodeSessionListCursor> | undefined;
+    search: string | undefined;
+    pinsOnly: boolean;
+    includePinned: boolean;
+    includeTotals: boolean;
+    needsYouOnly: boolean;
+    contentArchivedOnly: boolean;
+    archivedOnly: boolean;
+    sortBy: "updatedAt" | "createdAt" | "name" | undefined;
+    archiveStatus: "active" | "archived" | "all" | undefined;
+    channelId: string | null | undefined;
+    createdBy: {
+        kind: "subject" | "service";
+        subjectId: string;
+    } | undefined;
+    updatedFrom: Date | undefined;
+    updatedBefore: Date | undefined;
+    createdFrom: Date | undefined;
+    createdBefore: Date | undefined;
+    scopeSubjectId: SessionScopeSubjectId | undefined;
+    hasPageFilters: boolean;
+};
 export type AgentTopologyCursorEnvelope = {
     cursor: SessionDiscoveryCursor;
     parentSessionId: string | null | "all";
@@ -37,6 +66,13 @@ export declare function agentTopologyQuery(query: Record<string, string>): {
     claimLimit: number | undefined;
     cursor: SessionDiscoveryCursor | undefined;
 };
+/**
+ * A Site page's session capabilities: the workspace default with workspace
+ * administration (sandboxes, Connected Machines, `run_on`) and browser and
+ * computer control off. Capabilities this server does not offer are left to
+ * the default, so the create never fails on them.
+ */
+export declare function siteFrameCapabilities(workspaceDefault: AgentCapabilities, unavailable: Readonly<Partial<Record<string, string>>>): Exclude<AgentCapabilities, string>;
 /** Stable, value-free JSON errors for only the create-session boundary. */
 export declare function sessionCreateErrorResponse(c: Context, error: unknown): Response;
 export declare function parseSessionEventAdmission(raw: unknown): ClientSessionEvent;

package/dist/routes/site-data.d.ts

@@ -0,0 +1,18 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import { SiteDataError } from "@opengeni/db";
+import type { Hono } from "hono";
+import { ApiHttpError } from "../http/api-error.js";
+/** Typed Site Data errors in the public envelope; `details.code` is the Site Data code. */
+export declare function siteDataHttpError(error: SiteDataError): ApiHttpError;
+/**
+ * Site Data routes. Reads and record writes need Site access (the viewer's
+ * audience and `artifacts:read`); the collection's access mode decides the
+ * rest. Management (describe, define, reset, import, export) needs a manager.
+ */
+/**
+ * A Site Data file upload. It streams its body under its own per-file cap,
+ * read only after access, the rate window and the quota pass, so the generic
+ * request ceiling (which buffers bodies without a Content-Length) skips it.
+ */
+export declare function isSiteDataFileUploadRequest(method: string, pathname: string): boolean;
+export declare function registerSiteDataRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/site-publishing.d.ts

@@ -0,0 +1,5 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** A one-time sign-in code lives this long. */
+export declare const SITE_AUTH_CODE_TTL_SECONDS = 60;
+export declare function registerSitePublishingRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/site-runtime.d.ts

@@ -0,0 +1,31 @@
+import { type SiteEmbeddedAgent, type ToolRef } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+import { type SiteRuntimeViewer } from "../site-publishing/viewer.js";
+/** Request bodies site-runtime reads at most (the gateway enforces the same caps). */
+export declare const SITE_RUNTIME_JSON_BODY_LIMIT: number;
+export declare const SITE_RUNTIME_FILE_BODY_LIMIT: number;
+/** A version a publish or rollback replaced is still served this long (open pages keep loading). */
+export declare const SITE_VERSION_GRACE_SECONDS = 600;
+/** The document policy for a published version: scripts in an opaque origin, framed only by its own shell. */
+export declare const SITE_VERSION_CONTENT_SECURITY_POLICY = "sandbox allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads allow-modals; frame-ancestors 'self'";
+/**
+ * The Site-safe projection of a session: no account or workspace ids,
+ * instructions, tools or policies, metadata, creator, sandbox or diagnostics.
+ */
+export declare function siteSessionProjection(session: unknown): Record<string, unknown>;
+/**
+ * The workspace tools a Site conversation gets: the OVERLAP of what the Site
+ * declares (its admin-chosen MCP connections) and what the viewer may do in
+ * the workspace. Only workspace members who may attach MCP connections to
+ * their own sessions (`mcp_servers:attach`, or workspace admins) get them.
+ * People outside the workspace (invited people and public visitors, signed in
+ * or anonymous) never get workspace tools: only the Site's own data and the
+ * page. There is no setting that changes this; `guestTools` is ignored.
+ * Optional references: a connection the workspace does not have is skipped
+ * rather than failing the conversation.
+ */
+export declare function siteAgentToolRefs(agent: Pick<SiteEmbeddedAgent, "tools">, viewer: Pick<SiteRuntimeViewer, "kind">, memberPermissions?: readonly string[] | null): ToolRef[];
+/** Only workspace members who may use MCP connections get the Site's tools. */
+export declare function siteViewerGetsTools(viewer: Pick<SiteRuntimeViewer, "kind">, memberPermissions: readonly string[] | null): boolean;
+export declare function registerSiteRuntimeRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/site-sql.d.ts

@@ -0,0 +1,16 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+import { z } from "zod";
+import { ApiHttpError } from "../http/api-error.js";
+import { SiteSqlError } from "../site-sql/service.js";
+/** Typed Site SQL errors in the public envelope; `details.code` is the Site SQL code. */
+export declare function siteSqlHttpError(error: SiteSqlError): ApiHttpError;
+export declare function runSiteSqlRoute<T>(fn: () => Promise<T>): Promise<T>;
+export declare function siteSqlBody<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>>;
+/**
+ * Site SQL routes. Running a named query needs Site access (`artifacts:read`
+ * and the viewer's audience); the query's audience decides the rest. Everything
+ * else is management: a manager of the Site outside any Site frame, with
+ * `artifacts:read` to look and `artifacts:publish` to change.
+ */
+export declare function registerSiteSqlRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/slack-bot-access.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerSlackBotAccessRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/subscription-account-pools.d.ts

@@ -0,0 +1,21 @@
+import type { XaiSubscriptionAccountMetadata } from "@opengeni/db";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+import { type SubscriptionPoolCore } from "./subscription-pool-core.js";
+/** The legacy pool repository; only Claude still has one (until its own cutover). */
+/** The legacy pool account shape SuperGrok and Claude share (SuperGrok's metadata defines it). */
+export type SubscriptionPoolAccount = XaiSubscriptionAccountMetadata;
+/**
+ * The repository of a provider whose legacy runtime was deleted after its
+ * cutover: its routes serve only the core (`requireSubscriptionCoreRoute`
+ * refuses any other route first), so no legacy handler can reach these.
+ */
+/** Account CRUD uses one authority, allocator and wake contract for every pool. */
+export declare function registerSubscriptionAccountPoolRoutes(app: Hono, deps: ApiRouteDeps, options: {
+    provider: "xai" | "claude";
+    route: "supergrok" | "claude";
+    displayName: "SuperGrok" | "Claude";
+    enabled: () => boolean;
+    accountJson: (account: XaiSubscriptionAccountMetadata, activeId: string | null) => Record<string, unknown>;
+    core: SubscriptionPoolCore;
+}): void;

package/dist/routes/subscription-core-http.d.ts

@@ -0,0 +1,5 @@
+import { ApiHttpError } from "../http/api-error.js";
+/** `details.reason` of the 503 a provider's route answers while its cutover row is missing or disabled. */
+export declare const SUBSCRIPTION_CORE_CUTOVER_DISABLED = "subscription_core_cutover_disabled";
+/** The public error envelope with the core reason in `details.reason`. */
+export declare function typedHttpError(status: 409 | 503, reason: string, message: string): ApiHttpError;

package/dist/routes/subscription-pool-access.d.ts

@@ -0,0 +1,37 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Context } from "hono";
+type ManagedCookieHuman = {
+    subjectId: string;
+};
+/**
+ * Where a private (scope `user`) subscription is managed. The legacy pools
+ * keep a person's private accounts in an ordinary workspace they are a member
+ * of; the shared subscription core keeps a personal connection only in its
+ * owner's own Personal workspace (D-03), so on the core the private routes
+ * answer there and nowhere else.
+ */
+export type PrivateSubscriptionPlace = "ordinary_workspace" | "personal_workspace";
+export declare function managedCookieHuman(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
+export declare function requireSameOriginBrowserMutation(c: Context, deps: ApiRouteDeps): void;
+export declare function requirePrivateSubscriptionHuman(c: Context, deps: ApiRouteDeps, workspaceId: string, displayName: string, place?: PrivateSubscriptionPlace): Promise<{
+    accountId: string;
+    subjectId: string;
+}>;
+export declare function requireSubscriptionScopeMutation(c: Context, deps: ApiRouteDeps, workspaceId: string, scope: "workspace" | "user" | "organization", displayName: string, place?: PrivateSubscriptionPlace): Promise<{
+    accountId: string;
+    subjectId: string;
+}>;
+/**
+ * The mutation gate of a pool whose legacy repository is deleted (Claude,
+ * C4). The account's scope can no longer be read, so every caller gets the
+ * workspace-scope gate of `requireSubscriptionScopeMutation` (a browser
+ * request must be same-origin, and the caller needs `workspace:admin`)
+ * before the route fails closed; nothing is read or written either way.
+ * For a former private (user-scope) account this changes two outcomes: an
+ * ordinary bearer with `workspace:admin` now reaches the 503 where it got
+ * 403 (no verified owning user), and the owner without `workspace:admin` now
+ * gets 403 where it passed. C2b restores the per-scope check, including the
+ * owner's path, when the core serves these routes.
+ */
+export declare function requireDeletedSubscriptionPoolMutation(c: Context, deps: ApiRouteDeps, workspaceId: string): Promise<void>;
+export {};

package/dist/routes/subscription-pool-core.d.ts

@@ -0,0 +1,153 @@
+import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { type Database, type SubscriptionCoreConnectRefusal, type SubscriptionCoreProvider, type SubscriptionCoreWake } from "@opengeni/db";
+import type { SubscriptionPoolAccount } from "./subscription-account-pools.js";
+import { typedHttpError } from "./subscription-core-http.js";
+/** The legacy pool account shape every pool route shares. */
+type PoolAccount = SubscriptionPoolAccount;
+export type SubscriptionCorePoolProjection = {
+    source: "workspace" | "user" | "organization";
+    accounts: PoolAccount[];
+    activeCredentialId: string | null;
+    rotationEnabled: boolean;
+};
+/** What a provider supplies to serve its pool routes from the core. */
+export type SubscriptionPoolCore = {
+    binding: SubscriptionCoreProvider;
+    workspaceProjection(db: Database, input: {
+        accountId: string;
+        workspaceId: string;
+        viewerSubjectId: string;
+    }): Promise<SubscriptionCorePoolProjection>;
+    organizationProjection(db: Database, input: {
+        organizationId: string;
+        subjectId: string;
+    }): Promise<SubscriptionCorePoolProjection>;
+    /**
+     * The JSON of one core account in the listings, when it differs from the
+     * legacy `accountJson` (fields the legacy listing adds beside it, such as
+     * a usage reading). Defaults to the legacy `accountJson`; every other
+     * route answers the legacy `accountJson`.
+     */
+    listedAccountJson?: (account: PoolAccount, activeId: string | null) => Record<string, unknown>;
+};
+type PoolContext = {
+    deps: ApiRouteDeps;
+    core: SubscriptionPoolCore;
+    displayName: string;
+    accountJson: (account: PoolAccount, activeId: string | null) => Record<string, unknown>;
+    /** The listings' account JSON (`SubscriptionPoolCore.listedAccountJson`). */
+    listedAccountJson: (account: PoolAccount, activeId: string | null) => Record<string, unknown>;
+};
+/**
+ * The runtime serving this provider for the organization: `legacy` without
+ * the provider's cutover receipt (one read; `accountId` is not called),
+ * `core` with an enabled switch row; maintenance fails closed and never
+ * falls back to legacy state.
+ */
+export declare function subscriptionCoreRoute(deps: ApiRouteDeps, provider: string, displayName: string, accountId: () => Promise<string>): Promise<"legacy" | "core">;
+/**
+ * The runtime for a provider whose legacy runtime was deleted after its
+ * cutover: only `core` serves. Any other route (maintenance, or no receipt,
+ * which the deployed binary's readiness check refuses) fails closed exactly
+ * as maintenance does.
+ */
+export declare function requireSubscriptionCoreRoute(deps: ApiRouteDeps, provider: string, displayName: string, accountId: () => Promise<string>): Promise<"core">;
+/** The typed refusal of a core-only provider that is not on `core`. */
+export declare function subscriptionCoreMaintenanceError(displayName: string): import("../http/api-error.js").ApiHttpError;
+/** Deliver a committed change's wake; never fails the request (waiters recheck). */
+export declare function deliverPoolCoreWake(deps: ApiRouteDeps, core: Pick<SubscriptionPoolCore, "binding">, wake: SubscriptionCoreWake | null): Promise<void>;
+/** The legacy texts for a refused core connect. */
+export declare function coreConnectRefused(reason: SubscriptionCoreConnectRefusal, displayName: string, personal: boolean): HTTPException | ReturnType<typeof typedHttpError>;
+/**
+ * A route's account id as the canonical core connection id: a legacy id the
+ * drained cutover kept as an alias resolves to its connection as the caller
+ * may see it (`resolveSubscriptionCoreRouteConnectionId`). Anything else is
+ * returned as given; the caller's projection or writer decides whether it
+ * exists and is theirs.
+ */
+export declare function canonicalConnectionId(deps: ApiRouteDeps, binding: SubscriptionCoreProvider, input: {
+    accountId: string;
+    workspaceId: string | null;
+    subjectId: string;
+    routeId: string;
+}): Promise<string>;
+export declare function coreWorkspaceAccounts(c: Context, ctx: PoolContext, workspaceId: string): Promise<Response & import("hono").TypedResponse<{
+    source: "organization" | "user" | "workspace";
+    organizationId: string;
+    accounts: {
+        [x: string]: import("hono/utils/types").JSONValue;
+    }[];
+    activeAccountId: string | null;
+    settings: {
+        rotationEnabled: boolean;
+        rotationStrategy: "sharded";
+        activeCredentialId: string | null;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** Legacy "activate": the provider's effective primary at the scope the caller administers. */
+export declare function coreWorkspaceActivate(c: Context, ctx: PoolContext, workspaceId: string, routeId: string): Promise<Response & import("hono").TypedResponse<{
+    activated: true;
+    accountId: string;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** Legacy rotation toggle: on is `spread`, off is `primary_first`. */
+export declare function coreWorkspaceSettings(c: Context, ctx: PoolContext, workspaceId: string, rotationEnabled: boolean): Promise<Response & import("hono").TypedResponse<{
+    rotationEnabled: boolean;
+    rotationStrategy: "sharded";
+    activeCredentialId: string | null;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreWorkspaceAllocator(c: Context, ctx: PoolContext, workspaceId: string, routeId: string, body: {
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<Response & import("hono").TypedResponse<{
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: string | null;
+    changed: boolean;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreWorkspaceRename(c: Context, ctx: PoolContext, workspaceId: string, routeId: string, label: string | null): Promise<Response & import("hono").TypedResponse<{
+    [x: string]: import("hono/utils/types").JSONValue;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreWorkspaceDisconnect(c: Context, ctx: PoolContext, workspaceId: string, routeId: string): Promise<Response & import("hono").TypedResponse<{
+    disconnected: true;
+    newActiveId: string | null;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+type OrganizationActor = {
+    organizationId: string;
+    actorSubjectId: string;
+};
+export declare function coreOrganizationAccounts(c: Context, ctx: PoolContext, actor: OrganizationActor): Promise<Response & import("hono").TypedResponse<{
+    accounts: {
+        [x: string]: import("hono/utils/types").JSONValue;
+    }[];
+    activeAccountId: string | null;
+    source: string;
+    organizationId: string;
+    settings: {
+        rotationEnabled: boolean;
+        rotationStrategy: "sharded";
+        activeCredentialId: string | null;
+    };
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+export declare function coreOrganizationSettings(c: Context, ctx: PoolContext, actor: OrganizationActor, rotationEnabled: boolean): Promise<Response & import("hono").TypedResponse<{
+    rotationEnabled: boolean;
+    rotationStrategy: "sharded";
+    activeCredentialId: string | null;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">>;
+/** The legacy organization account mutations: one change per request. */
+export declare function coreOrganizationAccount(c: Context, ctx: PoolContext, actor: OrganizationActor, routeId: string, change: {
+    activate: true;
+} | {
+    disconnect: true;
+} | {
+    label: string | null;
+} | {
+    allocatorEnabled: boolean;
+    expectedAllocatorVersion: number;
+}): Promise<(Response & import("hono").TypedResponse<{
+    disconnected: true;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">) | (Response & import("hono").TypedResponse<{
+    updated: true;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">)>;
+export {};

package/dist/routes/supergrok.d.ts

@@ -1,12 +1,12 @@
+export { managedCookieHuman } from "./subscription-pool-access.js";
 import { type ApiRouteDeps } from "@opengeni/core";
 import type { Context, Hono } from "hono";
-type ManagedCookieHuman = {
-    subjectId: string;
-};
-export declare function managedCookieHuman(c: Context, deps: ApiRouteDeps): Promise<ManagedCookieHuman | null>;
-export declare function requireScopeMutation(c: Context, deps: ApiRouteDeps, workspaceId: string, scope: "workspace" | "user" | "organization"): Promise<{
+/**
+ * The legacy scope check; on the shared core a private (`user`) account is
+ * managed only from its owner's Personal workspace.
+ */
+export declare const requireScopeMutation: (c: Context, deps: ApiRouteDeps, workspaceId: string, scope: "workspace" | "user" | "organization", runtime?: "legacy" | "core") => Promise<{
     accountId: string;
     subjectId: string;
 }>;
 export declare function registerSuperGrokRoutes(app: Hono, deps: ApiRouteDeps): void;
-export {};

package/dist/routes/usage-allowances.d.ts

@@ -0,0 +1,12 @@
+import type { Hono } from "hono";
+import { type AccessContext } from "@opengeni/contracts";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
+type Authority = {
+    authorization: AccessGrantAuthorization;
+    context: AccessContext;
+};
+type Operation = "read" | "budget-read" | "workspace-write" | "member-write" | "own";
+/** No workspace wildcard, service initiator, or actor label can confer budget authority. */
+export declare function requireAllowanceAuthority({ authorization, context }: Authority, operation: Operation): void;
+export declare function registerUsageAllowanceRoutes(app: Hono, deps: ApiRouteDeps): void;
+export {};

package/dist/routes/variable-sets-removed.d.ts

@@ -0,0 +1,2 @@
+import type { Hono } from "hono";
+export declare function registerVariableSetsRemovedRoutes(app: Hono): void;

package/dist/routes/vault-providers.d.ts

@@ -0,0 +1,34 @@
+import type { Hono } from "hono";
+import { type ApiRouteDeps, type OnePasswordConnectionMetadata, type OnePasswordVaultProviderFactory } from "@opengeni/core";
+import { type VaultDbContext } from "@opengeni/db";
+import { type VaultProvider, type VaultProviderRegistry } from "@opengeni/vaults";
+export declare function onePasswordFactoryFor(deps: ApiRouteDeps): OnePasswordVaultProviderFactory;
+/**
+ * The 1Password provider for a stored connection the caller can see, plus its
+ * metadata. Throws 404 for other connections.
+ */
+export declare function onePasswordProviderForConnection(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    connectionId: string;
+    subjectId: string | null;
+}): Promise<{
+    provider: VaultProvider;
+    metadata: OnePasswordConnectionMetadata;
+}>;
+/**
+ * The provider registry for one request: 1Password vaults load their
+ * connection token for the acting subject in this workspace; host vaults use
+ * the embedder's `connectionCredentials.vaultProvider`.
+ */
+export declare function vaultProviderRegistryFor(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    subjectId: string | null;
+}): VaultProviderRegistry;
+export type LinkedVaultLookup = (input: {
+    workspaceId: string;
+    connectionId: string;
+    context: VaultDbContext;
+}) => Promise<ReadonlyMap<string, string>>;
+export declare function registerVaultProviderRoutes(app: Hono, deps: ApiRouteDeps, options?: {
+    linkedVaults?: LinkedVaultLookup;
+}): void;

package/dist/routes/vaults.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerVaultRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/workspace-integrations.d.ts

@@ -0,0 +1,35 @@
+import { WorkspaceWebhookDelivery, type AccessGrant } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { type WorkspaceCredentialProviderRow, type WorkspaceWebhookDeliveryRow, type WorkspaceWebhookRow } from "@opengeni/db";
+import { type pinnedFetch } from "@opengeni/network";
+import type { Context, Hono } from "hono";
+import { z } from "zod";
+export declare function newIntegrationSecret(prefix: string): string;
+export declare function integrationWebhookFields(row: Omit<WorkspaceWebhookRow, "workspaceId">): {
+    id: string;
+    url: string;
+    eventTypes: string[];
+    enabled: boolean;
+    description: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export declare function integrationDeliveryProjection(row: WorkspaceWebhookDeliveryRow): WorkspaceWebhookDelivery;
+export declare function integrationProviderFields(row: Omit<WorkspaceCredentialProviderRow, "workspaceId">): {
+    url: string;
+    enabled: boolean;
+    timeoutMs: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export declare function integrationBody<T extends z.ZodTypeAny>(c: Context, schema: T, invalidStatus?: 400 | 422): Promise<z.output<T>>;
+export declare function integrationRouteConfiguration(deps: ApiRouteDeps, scope: "workspace" | "organization"): {
+    requireKey(): Uint8Array;
+    requireDeployableUrl(url: string): void;
+};
+export declare function isIntegrationAgent(grant: Pick<AccessGrant, "principalKind" | "metadata">): boolean;
+export type WorkspaceIntegrationRouteOptions = {
+    /** Tests inject a fetch; production uses the pinned outbound client. */
+    fetch?: typeof pinnedFetch;
+};
+export declare function registerWorkspaceIntegrationRoutes(app: Hono, deps: ApiRouteDeps, options?: WorkspaceIntegrationRouteOptions): void;

package/dist/routes/workspace-model-providers.d.ts

@@ -0,0 +1,4 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+/** Workspace-owned Claude models use the same immutable-generation protocol as gateway models. */
+export declare function registerWorkspaceModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void;