@opengeni/api-router 4.2.1-canary.39642758903001 → 4.3.1

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-3WOFRCYO.js";
+} from "./chunk-CFZCR2OW.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/{chunk-3WOFRCYO.js → chunk-CFZCR2OW.js}

@@ -20813,10 +20813,10 @@ import {
   selectCanonicalPersonalSlackConnection
 } from "@opengeni/contracts";
 import {
-  connectMcpStreamableHttpClient,
   integrationKeyForConnectProvider,
   legacyMcpClientError,
-  requireEnvironmentEncryption as requireEnvironmentEncryption4
+  requireEnvironmentEncryption as requireEnvironmentEncryption4,
+  withMcpStreamableHttpClient
 } from "@opengeni/core";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import {
@@ -23150,9 +23150,8 @@ async function oauthErrorFromResponse(response, signal) {
   return error;
 }
 async function verifyMcpToolsList(settings, resource, token, signal) {
-  let client;
-  try {
-    client = await connectMcpStreamableHttpClient({
+  const listed2 = await withMcpStreamableHttpClient(
+    {
       url: resource,
       clientName: "opengeni-integration-verify",
       clientVersion: "0.1.0",
@@ -23166,20 +23165,18 @@ async function verifyMcpToolsList(settings, resource, token, signal) {
         ...init,
         signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal
       })
-    });
-    const listed2 = await client.listTools(void 0, {
+    },
+    (client) => client.listTools(void 0, {
       timeout: 1e4,
       maxTotalTimeout: 1e4
     }).catch((error) => {
       throw legacyMcpClientError(error);
-    });
-    return listed2.tools.map((tool) => ({
-      name: tool.name,
-      ...tool.description ? { description: tool.description } : {}
-    }));
-  } finally {
-    await client?.close().catch(() => void 0);
-  }
+    })
+  );
+  return listed2.tools.map((tool) => ({
+    name: tool.name,
+    ...tool.description ? { description: tool.description } : {}
+  }));
 }
 async function verifyMcpToolsListNonFatal(observability, settings, state, token, deadline) {
   let grantRejected = false;
@@ -65898,7 +65895,9 @@ import {
   withXaiSubscriptionCatalogProvider,
   withOrganizationGatewayCatalogProvider,
   withOrganizationOpenRouterCatalogProvider,
-  withOrganizationOpperCatalogProvider
+  withOrganizationOpperCatalogProvider,
+  withOrganizationDirectCatalogProvider,
+  organizationDirectModelIdPrefix
 } from "@opengeni/config";
 import { ModelConnectionAccessPolicy as ModelConnectionAccessPolicy2, ModelConnectionAccessResponse } from "@opengeni/contracts";
 import {
@@ -65921,6 +65920,7 @@ import {
   updateSubscriptionCoreProviderModelConnectionAccess,
   getOrganizationAdministrationOverview,
   listOrganizationModelProviderCustomModels,
+  getOrganizationModelProviderConnection,
   getWorkspaceProviderApiKeyConnectionMetadata as getWorkspaceProviderApiKeyConnectionMetadata2
 } from "@opengeni/db";
 import { HTTPException as HTTPException56 } from "hono/http-exception";
@@ -65932,9 +65932,13 @@ var Kind2 = z33.enum([
   "openrouter",
   "anthropic",
   "claude_subscription",
-  "opper"
+  "opper",
+  "openai",
+  "azure_openai"
 ]);
 function modelPrefix(target) {
+  if (target.kind === "openai" || target.kind === "azure_openai")
+    return organizationDirectModelIdPrefix(target.kind);
   if (target.kind === "anthropic" || target.kind === "claude_subscription")
     return claudeProviderId2(target.kind, target.workspaceId === null ? "organization" : "workspace") + "/";
   if (target.kind === "codex" || target.kind === "supergrok") return `${target.kind}/`;
@@ -65973,6 +65977,8 @@ function registerModelConnectionAccessRoutes(app, deps) {
           core: await coreAccessDisposition(deps, kind, scopeId) === "core"
         };
       }
+      if (kind === "openai" || kind === "azure_openai")
+        throw new HTTPException56(404, { message: "Connection not found" });
       const grant = await requireAccessGrant20(c, deps, scopeId, "workspace:read");
       const sharedCore = (kind === "supergrok" || kind === "claude_subscription") && await coreAccessDisposition(deps, kind, grant.accountId) === "core";
       if (mutate2) {
@@ -66038,6 +66044,22 @@ function registerModelConnectionAccessRoutes(app, deps) {
           });
           settings = connection.kind === "vercel_gateway" ? withOrganizationGatewayCatalogProvider(settings, models) : connection.kind === "opper" ? withOrganizationOpperCatalogProvider(settings, models) : withOrganizationOpenRouterCatalogProvider(settings, models);
         }
+        if (connection.kind === "openai" || connection.kind === "azure_openai") {
+          const [models, direct] = await Promise.all([
+            listOrganizationModelProviderCustomModels(deps.db, {
+              ...actor,
+              providerKind: connection.kind
+            }),
+            getOrganizationModelProviderConnection(deps.db, {
+              ...actor,
+              providerKind: connection.kind
+            })
+          ]);
+          settings = withOrganizationDirectCatalogProvider(settings, connection.kind, {
+            endpoint: direct?.endpoint ?? null,
+            models
+          });
+        }
       }
       const people = organizationCore && coreAccess?.peopleSupported ? await listOrganizationAdministrationMembers(deps.db, {
         organizationId: connection.accountId,
@@ -97457,6 +97479,7 @@ function ifNoneMatchSatisfied(header2, etag) {
 import { claudeProviderId as claudeProviderId3, opperCredentialProblem } from "@opengeni/config";
 import {
   CreateOrganizationProviderCustomModelRequest as CreateOrganizationProviderCustomModelRequest2,
+  DirectModelName,
   DeleteOrganizationProviderCustomModelRequest as DeleteOrganizationProviderCustomModelRequest2,
   OrganizationModelProviderConnectionResponse,
   OrganizationModelProviderKind as OrganizationModelProviderKind2,
@@ -97465,12 +97488,16 @@ import {
   RevokeOrganizationModelProviderConnectionRequest as RevokeOrganizationModelProviderConnectionRequest2,
   UpsertOrganizationModelProviderConnectionRequest as UpsertOrganizationModelProviderConnectionRequest2
 } from "@opengeni/contracts";
-import { requireEnvironmentEncryption as requireEnvironmentEncryption10 } from "@opengeni/core";
+import {
+  requireEnvironmentEncryption as requireEnvironmentEncryption10,
+  verifyOrganizationDirectModel
+} from "@opengeni/core";
 import {
   createOrganizationModelProviderCustomModel,
   encryptEnvironmentValue as encryptEnvironmentValue12,
-  getOrganizationModelProviderConnection,
+  getOrganizationModelProviderConnection as getOrganizationModelProviderConnection2,
   listOrganizationModelProviderCustomModels as listOrganizationModelProviderCustomModels2,
+  loadOrganizationModelProviderCredentialForAdministrator,
   organizationModelProviderCredentialDigest,
   OrganizationModelProviderConflictError,
   OrganizationModelProviderLimitError,
@@ -97502,8 +97529,10 @@ function modelProviderKind(value) {
   return kind;
 }
 function connectionJson(connection) {
+  const { endpoint, ...rest } = connection;
   return OrganizationModelProviderConnectionResponse.parse({
-    ...connection,
+    ...rest,
+    ...endpoint ? { endpoint } : {},
     createdAt: connection.createdAt.toISOString(),
     updatedAt: connection.updatedAt.toISOString()
   });
@@ -97541,7 +97570,7 @@ function registerOrganizationModelProviderRoutes(app, deps) {
     const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
     if (c.req.param("providerKind") === "claude_subscription")
       throw new HTTPException58(410, { message: "Claude subscriptions use individual accounts." });
-    const connection = await getOrganizationModelProviderConnection(deps.db, {
+    const connection = await getOrganizationModelProviderConnection2(deps.db, {
       organizationId: organizationId2,
       actorSubjectId: human.subjectId,
       providerKind: providerKind(c.req.param("providerKind"))
@@ -97590,6 +97619,14 @@ function registerOrganizationModelProviderRoutes(app, deps) {
       });
     const opperProblem = kind === "opper" ? opperCredentialProblem(payload.apiKey) : null;
     if (opperProblem) throw new HTTPException58(422, { message: opperProblem });
+    if (kind === "azure_openai" && !payload.endpoint)
+      throw new HTTPException58(422, {
+        message: "Enter your Azure OpenAI resource endpoint (https://RESOURCE.openai.azure.com)."
+      });
+    if (kind !== "azure_openai" && payload.endpoint !== void 0)
+      throw new HTTPException58(422, {
+        message: "An endpoint is only valid for an Azure OpenAI connection."
+      });
     if (payload.claudeIdentity)
       throw new HTTPException58(422, {
         message: "Claude identity is only valid for subscription connections."
@@ -97605,6 +97642,7 @@ function registerOrganizationModelProviderRoutes(app, deps) {
           credential
         ),
         credentialDigest: organizationModelProviderCredentialDigest(credential),
+        ...kind === "azure_openai" ? { endpoint: payload.endpoint ?? null } : {},
         operationId: payload.operationId,
         ...payload.expectedVersion === void 0 ? {} : { expectedVersion: payload.expectedVersion }
       });
@@ -97674,6 +97712,31 @@ function registerOrganizationModelProviderRoutes(app, deps) {
       const kind = modelProviderKind(c.req.param("providerKind"));
       if ((kind === "anthropic" || kind === "claude_subscription") && `${claudeProviderId3(kind)}/${payload.upstreamModelId}`.length > 256)
         throw new HTTPException58(422, { message: "Claude model ID is too long" });
+      if (kind === "openai" || kind === "azure_openai") {
+        const title = kind === "openai" ? "OpenAI" : "Azure OpenAI";
+        if (!DirectModelName.safeParse(payload.upstreamModelId).success)
+          throw new HTTPException58(422, {
+            message: kind === "openai" ? "Enter the exact OpenAI model ID." : "Enter the exact Azure OpenAI deployment name."
+          });
+        const credential = await loadOrganizationModelProviderCredentialForAdministrator(
+          deps.db,
+          deps.settings,
+          { organizationId: organizationId2, actorSubjectId: human.subjectId, providerKind: kind }
+        );
+        if (!credential || kind === "azure_openai" && !credential.endpoint)
+          throw new HTTPException58(409, {
+            message: `Connect ${title} for the organization before adding ${kind === "openai" ? "models" : "deployments"}.`
+          });
+        await verifyOrganizationDirectModel(
+          kind === "openai" ? { provider: "openai", model: payload.upstreamModelId } : {
+            provider: "azure_openai",
+            model: payload.upstreamModelId,
+            endpoint: credential.endpoint
+          },
+          credential.apiKey,
+          deps.directModelFetch
+        );
+      }
       try {
         const model = await createOrganizationModelProviderCustomModel(deps.db, {
           organizationId: organizationId2,
@@ -128879,7 +128942,8 @@ function registerWorkspaceRoutes(app, deps) {
       getOrganizationModelProviderCatalogForWorkspace(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        providerKinds
+        // Organization Azure OpenAI has no workspace custom-model rail.
+        providerKinds: [...providerKinds, "openai", "azure_openai"]
       }),
       getWorkspace7(deps.db, workspaceId),
       getOrganizationModelDefaults3(deps.db, grant.accountId),
@@ -128926,7 +128990,18 @@ function registerWorkspaceRoutes(app, deps) {
       workspaceOpperConnectionActive: workspaceConnectionActive("opper"),
       workspaceOpperCustomModels: workspaceCustomModels.opper,
       organizationOpperConnectionActive: organizationProviders.opper.active,
-      organizationOpperCustomModels: organizationProviders.opper.models
+      organizationOpperCustomModels: organizationProviders.opper.models,
+      organizationDirect: {
+        openai: {
+          active: organizationProviders.openai?.active === true,
+          models: organizationProviders.openai?.models ?? []
+        },
+        azure_openai: {
+          active: organizationProviders.azure_openai?.active === true,
+          endpoint: organizationProviders.azure_openai?.endpoint ?? null,
+          models: organizationProviders.azure_openai?.models ?? []
+        }
+      }
     });
     const workspaceSettings = workspace?.settings ?? {};
     const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
@@ -151955,4 +152030,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-3WOFRCYO.js.map
+//# sourceMappingURL=chunk-CFZCR2OW.js.map