@opengeni/api-router 3.0.1 → 4.0.0

package/src/sandbox/channel-a.ts

@@ -51,6 +51,7 @@ import {
   recordTenancyCompatibilityLaneUse,
   sandboxLeaseTelemetryKey,
   sandboxOperationMetricObserver,
+  sandboxCaptureWaitMetricObserver,
   type Observability,
 } from "@opengeni/observability";
 import { HTTPException } from "hono/http-exception";
@@ -531,6 +532,9 @@ async function withChannelAOperation<T>(
   const onSandboxOperation = services.observability
     ? sandboxOperationMetricObserver(services.observability)
     : undefined;
+  const onSandboxCaptureWait = services.observability
+    ? sandboxCaptureWaitMetricObserver(services.observability)
+    : undefined;
   const { accountId, workspaceId, session } = ctx;
 
   if (session.sandboxBackend === "none") {
@@ -753,6 +757,7 @@ async function withChannelAOperation<T>(
           settings,
           bus,
           ...(onSandboxOperation ? { onSandboxOperation } : {}),
+          ...(onSandboxCaptureWait ? { onSandboxCaptureWait } : {}),
           ...(ctx.waitSignal ? { waitSignal: ctx.waitSignal } : {}),
         },
         {
@@ -787,7 +792,7 @@ async function withChannelAOperation<T>(
 
   // One session has one logical runtime across turns and every API-direct
   // surface. Without this, Terminal/Files/Browser/Computer/viewers could rearm
-  // a stale deployment image after the worker had resolved a newer Pack/Rig or
+
   // deployment image for the same durable sandbox group.
   const sandboxRuntime = await resolveSessionSandboxRuntime(db, settings, session);
 
@@ -1060,6 +1065,7 @@ async function withChannelAOperation<T>(
           settings,
           bus,
           ...(onSandboxOperation ? { onSandboxOperation } : {}),
+          ...(onSandboxCaptureWait ? { onSandboxCaptureWait } : {}),
           ...(ctx.waitSignal ? { waitSignal: ctx.waitSignal } : {}),
         },
         {

package/src/sandbox/rematerialize.ts

@@ -162,7 +162,8 @@ export async function establishApiSandboxSpawner(input: {
   try {
     if (
       (input.acquiredLease.recovery.archive.status === "available" &&
-        input.acquiredLease.archiveComplete) ||
+        (input.acquiredLease.archiveComplete ||
+          input.acquiredLease.historicalRecoveryAuthorized === true)) ||
       (input.acquiredLease.recovery.archive.status === "none" && hasWorkspaceArchive(archiveSource))
     ) {
       const id = crypto.randomUUID();

package/src/scheduled-task-deletion.ts

@@ -1,6 +1,10 @@
 import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
-import type { ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
-import { deleteScheduledTaskLifecycle, type ApiRouteDeps } from "@opengeni/core";
+import type { AccessGrant, ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
+import {
+  assertScheduledTaskMutationOwner,
+  deleteScheduledTaskLifecycle,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 import * as z4 from "zod/v4";
@@ -100,13 +104,19 @@ export async function cleanupScheduledTaskConnectorAuthorization(
 /** Shared HTTP/MCP domain operation: authorize, tombstone, persist, then accelerate cleanup. */
 export async function deleteScheduledTaskWithDurableCleanup(
   deps: ApiRouteDeps,
-  input: { workspaceId: string; taskId: string; subjectId: string },
+  request: { grant: AccessGrant; taskId: string },
 ): Promise<{ task: ScheduledTaskValue; changed: boolean }> {
+  const input = {
+    workspaceId: request.grant.workspaceId,
+    subjectId: request.grant.subjectId,
+    taskId: request.taskId,
+  };
   const result = await deleteScheduledTaskLifecycle({
     db: deps.db,
     workspaceId: input.workspaceId,
     taskId: input.taskId,
     subjectId: input.subjectId,
+    beforeDeleteCommit: (tx) => assertScheduledTaskMutationOwner(tx, request.grant, request.taskId),
     preflightConnectorAuthorization: async (task) =>
       await preflightConnectorAuthorization(deps, task, input.subjectId),
     cleanupConnectorAuthorization: async (db, task) =>

package/src/workspace-tool-gateway.ts

@@ -22,7 +22,6 @@ import {
   ToolGatewayApprovalResponse,
   ToolGatewayDeclarationsResponse,
   type AccessGrant,
-  type McpGatewayCredentialAuthority,
   type ToolGatewayCatalog,
   type ToolGatewayIdentity,
   type ToolRef,
@@ -43,7 +42,6 @@ import {
 import {
   buildCodexTokenResolver,
   buildConnectionTokenResolver,
-  buildHostGatewayConnectionTokenResolver,
   lockActiveExternalOrganizationKey,
   withAccountRls,
   requireWorkspace,
@@ -187,16 +185,7 @@ export async function prepareWorkspaceToolGateway(
     routeDeps,
     grant,
     undefined,
-    reauthorize
-      ? {
-          authority: {
-            kind: external ? "external_user" : "organization_service",
-            subjectId: scope.subjectId,
-            permissions,
-          },
-          reauthorize,
-        }
-      : undefined,
+    reauthorize,
   );
   try {
     await reauthorize?.();
@@ -226,11 +215,36 @@ export async function prepareWorkspaceToolGatewayForGrant(
   return await prepareWorkspaceToolGatewayForGrantInternal(routeDeps, grant, allowedIdentities);
 }
 
+/** Keep live caller authority independent of native connection acquisition and refresh. */
+export function withWorkspaceConnectionAuthorization(
+  resolve: ReturnType<typeof buildConnectionTokenResolver>,
+  reauthorize?: () => Promise<void>,
+): ReturnType<typeof buildConnectionTokenResolver> {
+  if (!reauthorize) return resolve;
+  return async (input) => {
+    await reauthorize();
+    const result = await resolve(input);
+    await reauthorize();
+    if (result.status !== "ok") return result;
+    return {
+      ...result,
+      authorizeProviderRequest: async () => {
+        try {
+          await reauthorize();
+          return result.authorizeProviderRequest ? await result.authorizeProviderRequest() : true;
+        } catch {
+          return false;
+        }
+      },
+    };
+  };
+}
+
 async function prepareWorkspaceToolGatewayForGrantInternal(
   routeDeps: ApiRouteDeps,
   grant: AccessGrant,
   allowedIdentities?: readonly { serverId: string; toolName: string }[],
-  hostContext?: { authority: McpGatewayCredentialAuthority; reauthorize: () => Promise<void> },
+  reauthorize?: () => Promise<void>,
 ): Promise<PreparedWorkspaceToolGateway> {
   const catalogSourceSettings = routeDeps.catalogSourceSettings ?? routeDeps.settings;
   const resolvedCatalog = await resolveWorkspaceCatalogSettings(
@@ -256,24 +270,10 @@ async function prepareWorkspaceToolGatewayForGrantInternal(
   const gatewaySettings = workspaceToolGatewaySettingsForGrant(settings, grant, allowedIdentities);
   const gatewayServerIds = new Set(gatewaySettings.mcpServers.map((server) => server.id));
   const deps = { ...routeDeps, catalogSourceSettings, settings: gatewaySettings };
-  const nativeResolveConnection = buildConnectionTokenResolver(routeDeps.db, gatewaySettings);
-  const hostPort = routeDeps.connectionCredentials?.mcpGatewayCredentials;
-  const hostResolveConnection =
-    hostContext && hostPort
-      ? buildHostGatewayConnectionTokenResolver(
-          hostPort,
-          {
-            accountId: grant.accountId,
-            workspaceId: grant.workspaceId,
-            authority: hostContext.authority,
-          },
-          hostContext.reauthorize,
-        )
-      : undefined;
-  const resolveConnection: typeof nativeResolveConnection = async (input) =>
-    input.connectionRef.authoritySource === "host" && hostResolveConnection
-      ? await hostResolveConnection(input)
-      : await nativeResolveConnection(input);
+  const resolveConnection = withWorkspaceConnectionAuthorization(
+    buildConnectionTokenResolver(routeDeps.db, gatewaySettings),
+    reauthorize,
+  );
   const resolveCredential = async (
     input: ResolveConnectionCredentialInput,
   ): Promise<ResolveConnectionCredentialResult> =>

package/dist/connection-authority-owner.d.ts

@@ -1,59 +0,0 @@
-import type { AccessGrantAuthorization } from "@opengeni/core";
-import type { UserResourceAuthoritySummary } from "@opengeni/db";
-import { type IssueConnectionUseGrantRequest as IssueConnectionUseGrantRequestValue } from "@opengeni/contracts/connection-authority";
-/**
- * Personal connection authority is available only to the exact authenticated
- * human. API keys, delegated bearers, services, and agent attempts cannot name
- * or substitute a personal owner.
- */
-export declare function requireConnectionAuthorityOwner(access: AccessGrantAuthorization): string;
-/** Removes generic resource kind and refuses non-connection grant actions. */
-export declare function projectSelfConnectionAuthorities(page: {
-    authorities: UserResourceAuthoritySummary[];
-    nextCursor: string | null;
-}): {
-    scope: "user";
-    authorities: {
-        authorityId: string;
-        resourceId: string;
-        originWorkspaceId: string | null;
-        generation: number;
-        status: "active" | "retained" | "revoked";
-        grants: {
-            grantId: string;
-            targetWorkspaceId: string;
-            targetSessionId: string | null;
-            mode: "always" | "once" | "session";
-            context: "user_private" | "workspace_shared";
-            authorityEpoch: number | null;
-            generation: number;
-            status: "active" | "consumed" | "expired" | "revoked";
-            expiresAt: string | null;
-            delegation: {
-                authorityId: string;
-                grantId: string;
-                organizationId: string;
-                workspaceId: string;
-                sessionId: string | null;
-                action: string;
-                mode: "always" | "once" | "session";
-                context: "user_private" | "workspace_shared";
-                authorityEpoch: number | null;
-                authorityGeneration: number;
-                grantGeneration: number;
-                resourceVersionId?: string | null | undefined;
-            };
-            action: "connection.use";
-        }[];
-    }[];
-    nextCursor: string | null;
-};
-/** The API owns the action; callers supply neither action nor owner identity. */
-export declare function connectionUseGrantLifecycleInput(input: unknown): {
-    action: "connection.use";
-    mode: IssueConnectionUseGrantRequestValue["mode"];
-    context: IssueConnectionUseGrantRequestValue["context"];
-    sessionId: string | null;
-    expectedAuthorityEpoch: number | null;
-    workspaceSharedAcknowledged: boolean;
-};

package/dist/routes/connection-authorities.d.ts

@@ -1,3 +0,0 @@
-import { type ApiRouteDeps } from "@opengeni/core";
-import type { Hono } from "hono";
-export declare function registerConnectionAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/host-mcp-bindings.d.ts

@@ -1,5 +0,0 @@
-import type { Hono } from "hono";
-import { type ApiRouteDeps } from "@opengeni/core";
-/** Registration is not an execution grant. The durable runtime must separately
- * validate the exact binding generation and accepted execution context. */
-export declare function registerHostMcpBindingRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/host-mcp-resolvers.d.ts

@@ -1,3 +0,0 @@
-import type { Hono } from "hono";
-import { type ApiRouteDeps } from "@opengeni/core";
-export declare function registerHostMcpResolverRoutes(app: Hono, deps: ApiRouteDeps): void;

package/dist/routes/packs.d.ts

@@ -1,3 +0,0 @@
-import type { Hono } from "hono";
-import type { ApiRouteDeps } from "@opengeni/core";
-export declare function registerPackRoutes(app: Hono, deps: ApiRouteDeps): void;

package/src/connection-authority-owner.ts

@@ -1,61 +0,0 @@
-import type { AccessGrantAuthorization } from "@opengeni/core";
-import type { UserResourceAuthoritySummary } from "@opengeni/db";
-import {
-  IssueConnectionUseGrantRequest,
-  ListConnectionAuthoritiesResponse,
-  type IssueConnectionUseGrantRequest as IssueConnectionUseGrantRequestValue,
-} from "@opengeni/contracts/connection-authority";
-import { HTTPException } from "hono/http-exception";
-
-/**
- * Personal connection authority is available only to the exact authenticated
- * human. API keys, delegated bearers, services, and agent attempts cannot name
- * or substitute a personal owner.
- */
-export function requireConnectionAuthorityOwner(access: AccessGrantAuthorization): string {
-  if (
-    !access.contextIntegrity ||
-    access.authenticatedSubjectId !== access.grant.subjectId ||
-    access.grant.principalKind !== "human_session" ||
-    access.grant.serviceInitiator ||
-    access.grant.serviceInitiatorContext ||
-    access.grant.subjectId.startsWith("api_key:")
-  ) {
-    throw new HTTPException(403, { message: "authenticated connection owner required" });
-  }
-  return access.grant.subjectId;
-}
-
-/** Removes generic resource kind and refuses non-connection grant actions. */
-export function projectSelfConnectionAuthorities(page: {
-  authorities: UserResourceAuthoritySummary[];
-  nextCursor: string | null;
-}) {
-  return ListConnectionAuthoritiesResponse.parse({
-    scope: "user",
-    authorities: page.authorities
-      .filter((authority) => authority.resourceKind === "connection")
-      .map(({ resourceKind: _resourceKind, ...authority }) => authority),
-    nextCursor: page.nextCursor,
-  });
-}
-
-/** The API owns the action; callers supply neither action nor owner identity. */
-export function connectionUseGrantLifecycleInput(input: unknown): {
-  action: "connection.use";
-  mode: IssueConnectionUseGrantRequestValue["mode"];
-  context: IssueConnectionUseGrantRequestValue["context"];
-  sessionId: string | null;
-  expectedAuthorityEpoch: number | null;
-  workspaceSharedAcknowledged: boolean;
-} {
-  const request = IssueConnectionUseGrantRequest.parse(input);
-  return {
-    action: "connection.use",
-    mode: request.mode,
-    context: request.context,
-    sessionId: request.sessionId ?? null,
-    expectedAuthorityEpoch: request.expectedAuthorityEpoch ?? null,
-    workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
-  };
-}

package/src/routes/connection-authorities.ts

@@ -1,139 +0,0 @@
-import {
-  ConnectionUseGrantMutationResponse,
-  ConnectionUseGrantRevocationResponse,
-  IssueConnectionUseGrantRequest,
-  ListConnectionAuthoritiesQuery,
-  RevokeConnectionUseGrantQuery,
-} from "@opengeni/contracts/connection-authority";
-import {
-  issueManagedHumanUserResourceGrant,
-  listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization,
-  revokeManagedHumanUserResourceGrant,
-  SessionAuthorizationDeniedError,
-  SessionAuthorizationUnavailableError,
-  SessionTenancyManagedHumanRequiredError,
-  type ApiRouteDeps,
-} from "@opengeni/core";
-import { nestedPostgresSqlState, SessionTenancyNotActivatedError } from "@opengeni/db";
-import type { Context, Hono } from "hono";
-import { HTTPException } from "hono/http-exception";
-import { z } from "zod";
-import {
-  connectionUseGrantLifecycleInput,
-  projectSelfConnectionAuthorities,
-} from "../connection-authority-owner";
-
-async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
-  const parsed = schema.safeParse(await context.req.json().catch(() => null));
-  if (!parsed.success) throw new HTTPException(422, { message: "invalid connection authority" });
-  return parsed.data;
-}
-
-function lifecycleError(error: unknown): never {
-  if (
-    error instanceof SessionAuthorizationDeniedError ||
-    error instanceof SessionTenancyManagedHumanRequiredError ||
-    error instanceof SessionTenancyNotActivatedError
-  ) {
-    throw new HTTPException(403, { message: "connection authority denied" });
-  }
-  if (error instanceof SessionAuthorizationUnavailableError) {
-    throw new HTTPException(503, { message: "session authorization unavailable" });
-  }
-  if (nestedPostgresSqlState(error) === "42501") {
-    throw new HTTPException(403, { message: "connection authority denied" });
-  }
-  if (nestedPostgresSqlState(error) === "22023") {
-    throw new HTTPException(422, { message: "invalid connection authority" });
-  }
-  throw error;
-}
-
-export function registerConnectionAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const base = "/v1/workspaces/:workspaceId/connection-authorities";
-
-  app.get(base, async (context) => {
-    const query = ListConnectionAuthoritiesQuery.safeParse({
-      scope: context.req.query("scope"),
-      cursor: context.req.query("cursor"),
-      limit: context.req.query("limit"),
-    });
-    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "connections:read",
-    );
-    try {
-      return context.json(
-        projectSelfConnectionAuthorities(
-          await listManagedHumanUserResourceAuthorities(deps, access, workspaceId, {
-            resourceKind: "connection",
-            cursor: query.data.cursor,
-            limit: query.data.limit,
-          }),
-        ),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-
-  app.post(`${base}/:authorityId/grants`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const authorityId = z.string().uuid().safeParse(context.req.param("authorityId"));
-    if (!authorityId.success) throw new HTTPException(422, { message: "invalid authority id" });
-    const request = await body(context, IssueConnectionUseGrantRequest);
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "connections:read",
-    );
-    try {
-      const normalized = connectionUseGrantLifecycleInput(request);
-      return context.json(
-        ConnectionUseGrantMutationResponse.parse({
-          scope: "user",
-          grant: await issueManagedHumanUserResourceGrant(
-            deps,
-            access,
-            workspaceId,
-            authorityId.data,
-            { scope: "user", resourceKind: "connection", ...normalized },
-            "http",
-          ),
-        }),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-
-  app.delete(`${base}/grants/:grantId`, async (context) => {
-    const query = RevokeConnectionUseGrantQuery.safeParse({ scope: context.req.query("scope") });
-    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
-    const grantId = z.string().uuid().safeParse(context.req.param("grantId"));
-    if (!grantId.success) throw new HTTPException(422, { message: "invalid grant id" });
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "workspace:read",
-    );
-    try {
-      return context.json(
-        ConnectionUseGrantRevocationResponse.parse({
-          scope: "user",
-          grant: await revokeManagedHumanUserResourceGrant(deps, access, workspaceId, grantId.data),
-        }),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-}

package/src/routes/host-mcp-bindings.ts

@@ -1,122 +0,0 @@
-import type { Hono } from "hono";
-import { HTTPException } from "hono/http-exception";
-import { z } from "zod";
-import {
-  CreateHostMcpBindingRequest,
-  IssueHostMcpDelegationRequest,
-} from "@opengeni/contracts/host-mcp-bindings";
-import {
-  createHostMcpBinding,
-  getHostMcpBinding,
-  revokeHostMcpBinding,
-  issueHostMcpDelegation,
-  getHostMcpDelegation,
-  revokeHostMcpDelegation,
-  HostMcpDelegationAuthorityError,
-  HostMcpBindingConflictError,
-  withWorkspaceSubjectRls,
-} from "@opengeni/db";
-import {
-  requireAccessGrantAuthorization,
-  prepareHostMcpOwnerAuthorization,
-  type ApiRouteDeps,
-} from "@opengeni/core";
-
-/** Registration is not an execution grant. The durable runtime must separately
- * validate the exact binding generation and accepted execution context. */
-export function registerHostMcpBindingRoutes(app: Hono, deps: ApiRouteDeps): void {
-  for (const entity of ["bindings", "delegations"] as const) {
-    app.on(
-      ["GET", "POST"],
-      [
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}`,
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId`,
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId/revoke`,
-      ],
-      async (c) => {
-        const workspaceId = c.req.param("workspaceId")!;
-        const bindingId = c.req.param("bindingId");
-        const method = c.req.method;
-        const revoke = c.req.path.endsWith("/revoke");
-        if (
-          !(
-            (method === "POST" && !bindingId) ||
-            (method === "GET" && bindingId && !revoke) ||
-            (method === "POST" && bindingId && revoke)
-          )
-        )
-          throw new HTTPException(404, { message: "not found" });
-        const permission = method === "GET" ? "connections:read" : "connections:write";
-        const authorization = await requireAccessGrantAuthorization(
-          c,
-          deps,
-          workspaceId,
-          permission,
-        );
-        const authorizeCommit = prepareHostMcpOwnerAuthorization(
-          authorization,
-          workspaceId,
-          permission,
-        );
-        if (bindingId) z.string().uuid().parse(bindingId);
-        const createInput =
-          method === "POST" && !bindingId
-            ? (entity === "bindings"
-                ? CreateHostMcpBindingRequest
-                : IssueHostMcpDelegationRequest
-              ).parse(await c.req.json())
-            : null;
-        const revokeInput = revoke
-          ? z
-              .object({ expectedGeneration: z.number().int().positive().safe() })
-              .strict()
-              .parse(await c.req.json())
-          : null;
-        const owner = {
-          accountId: authorization.grant.accountId,
-          workspaceId,
-          subjectId: authorization.grant.subjectId,
-        };
-        try {
-          const result = await withWorkspaceSubjectRls(
-            deps.db,
-            workspaceId,
-            owner.subjectId,
-            async (tx) => {
-              const effectiveOwner = await authorizeCommit(tx);
-              if (createInput)
-                return entity === "bindings"
-                  ? createHostMcpBinding(tx, effectiveOwner, createInput)
-                  : issueHostMcpDelegation(tx, effectiveOwner, createInput);
-              const existing = await (
-                entity === "bindings" ? getHostMcpBinding : getHostMcpDelegation
-              )(tx, effectiveOwner, bindingId!);
-              if (!existing)
-                throw new HTTPException(404, {
-                  message:
-                    entity === "bindings" ? "Host binding not found" : "Host delegation not found",
-                });
-              return revokeInput
-                ? (entity === "bindings" ? revokeHostMcpBinding : revokeHostMcpDelegation)(
-                    tx,
-                    effectiveOwner,
-                    bindingId!,
-                    revokeInput.expectedGeneration,
-                  )
-                : existing;
-            },
-          );
-          return c.json(result, createInput ? 201 : 200);
-        } catch (error) {
-          if (error instanceof HostMcpDelegationAuthorityError)
-            throw new HTTPException(403, { message: "Host delegation authority unavailable" });
-          if (error instanceof HostMcpBindingConflictError)
-            throw new HTTPException(409, {
-              message: "Host binding changed; reload before retrying",
-            });
-          throw error;
-        }
-      },
-    );
-  }
-}

package/src/routes/host-mcp-resolvers.ts

@@ -1,41 +0,0 @@
-import type { Hono } from "hono";
-import { hostMcpResolverForRequest, type ApiRouteDeps } from "@opengeni/core";
-
-export function registerHostMcpResolverRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const path = "/v1/organizations/:organizationId/mcp-credential-resolvers/:externalSource";
-  app.get(path, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "get",
-      ),
-    ),
-  );
-  app.put(path, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "put",
-        await context.req.json().catch(() => null),
-      ),
-    ),
-  );
-  app.post(`${path}/revoke`, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "revoke",
-        await context.req.json().catch(() => null),
-      ),
-    ),
-  );
-}