@opengeni/api-router 0.30.0 → 0.30.3

package/dist/{chunk-2PQMSRCB.js → chunk-WCXHI3FF.js}

@@ -22,7 +22,7 @@ import {
 } from "@opengeni/contracts";
 import {
   createDocumentServices,
-  getDocument as getDocument2,
+  getDocumentForIndexing,
   indexDocumentNow
 } from "@opengeni/documents";
 import {
@@ -66,10 +66,10 @@ import {
   CodexCompactionV2ProviderLockedError,
   hasPermission as hasPermission21,
   requireAccessGrant as requireAccessGrant40,
-  requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization2,
+  requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization3,
   requirePermission as requirePermission3,
   requireSessionAuthorization as requireSessionAuthorization8,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError7,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError8,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError7
 } from "@opengeni/core";
 
@@ -3301,6 +3301,10 @@ import {
 import {
   GOOGLE_DRIVE_CREDENTIAL_LABEL,
   GOOGLE_DRIVE_CREDENTIAL_ROLE,
+  GOOGLE_DRIVE_FILE_SCOPE,
+  GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION,
+  GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+  GOOGLE_DRIVE_PUBLICATION_TOOL_NAME,
   GOOGLE_DRIVE_PROVIDER_DOMAIN,
   GOOGLE_DRIVE_READONLY_SCOPE,
   GoogleDriveKnowledgeSourceConfig,
@@ -3309,6 +3313,7 @@ import {
   GoogleDriveConnectionLifecycle,
   GoogleDriveConnectionMetadata,
   GoogleDriveOAuthStartResponse,
+  GoogleDriveOutputDestination,
   SaveGoogleDriveIntegrationSourceRequest,
   SaveGoogleDriveSourceRequest,
   googleDriveOAuthScopeDecision,
@@ -3344,6 +3349,7 @@ import {
   decryptEnvironmentValue as decryptEnvironmentValue3,
   disconnectConnectionIdempotently,
   encryptEnvironmentValue as encryptEnvironmentValue3,
+  ensureConnectorActionPolicyDefault,
   getConnectionMetadata as getConnectionMetadata2,
   getKnowledgeSourceByExternalIdentityForSyncAuthority,
   getKnowledgeSourceForSyncAuthority,
@@ -3387,6 +3393,11 @@ async function startGoogleDriveOAuth(deps, input) {
   if (input.payload.connectionId && !existing) {
     throw new HTTPException5(404, { message: "Google Drive connection not found" });
   }
+  if (input.payload.capability === "publish" && !existing) {
+    throw new HTTPException5(409, {
+      message: "Connect Google Drive for source access before enabling publishing"
+    });
+  }
   if (existing) {
     requireGoogleDriveConnection(existing, input.subjectId);
   }
@@ -3400,16 +3411,29 @@ async function startGoogleDriveOAuth(deps, input) {
     subjectId: input.subjectId,
     returnPath: GOOGLE_DRIVE_RETURN_PATH(input.workspaceId),
     encryptedPkceVerifier: encryptEnvironmentValue3(key, verifier),
+    capability: input.payload.capability,
     ...existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}
   });
   const authorizationUrl = new URL(GOOGLE_AUTHORIZATION_URL);
   authorizationUrl.searchParams.set("client_id", google.clientId);
   authorizationUrl.searchParams.set("redirect_uri", redirectUri);
   authorizationUrl.searchParams.set("response_type", "code");
-  authorizationUrl.searchParams.set("scope", GOOGLE_DRIVE_READONLY_SCOPE);
+  authorizationUrl.searchParams.set(
+    "scope",
+    input.payload.capability === "publish" ? GOOGLE_DRIVE_FILE_SCOPE : GOOGLE_DRIVE_READONLY_SCOPE
+  );
   authorizationUrl.searchParams.set("access_type", "offline");
   authorizationUrl.searchParams.set("include_granted_scopes", "true");
-  authorizationUrl.searchParams.set("prompt", "consent select_account");
+  authorizationUrl.searchParams.set(
+    "prompt",
+    input.payload.capability === "publish" ? "consent" : "consent select_account"
+  );
+  if (input.payload.capability === "publish") {
+    authorizationUrl.searchParams.set("trigger_onepick", "true");
+    authorizationUrl.searchParams.set("allow_folder_selection", "true");
+    authorizationUrl.searchParams.set("allow_multiple", "false");
+    authorizationUrl.searchParams.set("mimetypes", GOOGLE_DRIVE_FOLDER_MIME_TYPE);
+  }
   authorizationUrl.searchParams.set("state", state);
   authorizationUrl.searchParams.set("code_challenge_method", "S256");
   authorizationUrl.searchParams.set(
@@ -3460,8 +3484,10 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       },
       fetchImpl
     );
-    const scopeDecision = googleDriveOAuthScopeDecision(token.scopes);
-    if (scopeDecision.accessMode !== "readonly" || !scopeDecision.capabilities.includes("recursive_source_sync")) {
+    const grantedScopes2 = [...new Set(token.scopes)].sort();
+    const scopeDecision = googleDriveOAuthScopeDecision(grantedScopes2);
+    const requiredCapability = state.capability === "publish" ? "publish_file" : "recursive_source_sync";
+    if (!scopeDecision.accessMode || !scopeDecision.capabilities.includes(requiredCapability) || state.capability === "publish" && !scopeDecision.capabilities.includes("recursive_source_sync")) {
       throw new GoogleDriveCallbackError("scope_not_granted");
     }
     const identity = await verifyGoogleDriveIdentity(token.accessToken, fetchImpl);
@@ -3481,6 +3507,24 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       }
     }
     const previousMetadata = existing ? GoogleDriveConnectionMetadata.parse(existing.metadata) : null;
+    const outputDestination = state.capability === "publish" ? await verifyPickedGoogleDriveOutputDestination(
+      token.accessToken,
+      input.pickedFileIds,
+      fetchImpl
+    ) : previousMetadata?.outputDestination;
+    if (state.capability === "publish") {
+      if (!existing) throw new GoogleDriveCallbackError("connection_conflict");
+      await ensureConnectorActionPolicyDefault(deps.db, {
+        accountId: state.accountId,
+        workspaceId: state.workspaceId,
+        subjectId: state.subjectId,
+        connectionId: existing.id,
+        serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+        toolName: GOOGLE_DRIVE_PUBLICATION_TOOL_NAME,
+        actionName: GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION,
+        policy: "ask"
+      });
+    }
     let refreshToken = token.refreshToken;
     if (!refreshToken && existing) {
       const previousCredential = await loadConnectionCredentialForBroker(deps.db, deps.settings, {
@@ -3503,7 +3547,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
         refresh_token: refreshToken,
         token_type: token.tokenType,
         ...token.expiresAt ? { expires_at: token.expiresAt.toISOString() } : {},
-        scope: token.scopes.join(" "),
+        scope: grantedScopes2.join(" "),
         token_endpoint: GOOGLE_TOKEN_URL,
         client_id: google.clientId,
         client_secret: google.clientSecret,
@@ -3519,6 +3563,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
       accessMode: scopeDecision.accessMode,
       lifecycle: googleDriveLifecycle("active"),
+      ...outputDestination ? { outputDestination } : {},
       ...previousMetadata?.documentDestination ? { documentDestination: previousMetadata.documentDestination } : {},
       ...previousMetadata?.selectedSources ? { selectedSources: previousMetadata.selectedSources } : previousMetadata?.selectedSource ? { selectedSources: [previousMetadata.selectedSource] } : {}
     });
@@ -3532,7 +3577,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       kind: "oauth2",
       status: "active",
       credentialEncrypted,
-      grantedScopes: token.scopes,
+      grantedScopes: grantedScopes2,
       expiresAt: token.expiresAt,
       metadata,
       updatedBySubjectId: state.subjectId
@@ -3543,7 +3588,7 @@ async function completeGoogleDriveOAuthCallback(deps, input) {
       providerDomain: GOOGLE_DRIVE_PROVIDER_DOMAIN,
       kind: "oauth2",
       credentialEncrypted,
-      grantedScopes: token.scopes,
+      grantedScopes: grantedScopes2,
       expiresAt: token.expiresAt,
       metadata,
       createdBySubjectId: state.subjectId
@@ -3953,6 +3998,42 @@ async function saveGoogleDriveSource(deps, input) {
   });
   return updated;
 }
+async function verifyPickedGoogleDriveOutputDestination(accessToken, rawPickedFileIds, fetchImpl) {
+  const pickedFileIds = uniqueStrings2((rawPickedFileIds ?? "").split(","));
+  if (pickedFileIds.length !== 1) {
+    throw new GoogleDriveCallbackError("output_folder_required");
+  }
+  const folderId = validDriveId(pickedFileIds[0], "picked_file_ids");
+  const url = new URL(`${GOOGLE_DRIVE_API_BASE}/files/${encodeURIComponent(folderId)}`);
+  url.searchParams.set("supportsAllDrives", "true");
+  url.searchParams.set("fields", "id,name,mimeType,driveId,trashed,capabilities(canAddChildren)");
+  const response = await providerFetch(fetchImpl, url, {
+    headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" }
+  });
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => void 0);
+    throw new GoogleDriveCallbackError("output_folder_unavailable");
+  }
+  const record5 = objectRecord(
+    await readResponseJsonBounded4(
+      response,
+      GOOGLE_RESPONSE_MAX_BYTES,
+      "Google Drive picked output folder"
+    )
+  );
+  const driveId = optionalString(record5.driveId);
+  const capabilities = objectRecord(record5.capabilities);
+  if (requiredString2(record5.id, "Google Drive folder id") !== folderId || requiredString2(record5.mimeType, "Google Drive folder MIME type") !== GOOGLE_DRIVE_FOLDER_MIME_TYPE || record5.trashed === true || capabilities.canAddChildren !== true) {
+    throw new GoogleDriveCallbackError("output_folder_unavailable");
+  }
+  return GoogleDriveOutputDestination.parse({
+    folderId,
+    folderName: requiredString2(record5.name, "Google Drive folder name"),
+    driveId: driveId ?? null,
+    location: driveId ? "shared_drive" : "my_drive",
+    selectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
 async function requireGoogleDriveIntegrationFacet(deps, input) {
   const instance = await listIntegrationInstanceFacets(
     deps.db,
@@ -4571,6 +4652,11 @@ function readGoogleDriveOAuthState(raw, settings) {
   }
   const connectionId = optionalString(payload.connectionId) ?? void 0;
   const connectionVersion = numberValue2(payload.connectionVersion);
+  const capabilityValue = optionalString(payload.capability);
+  const capability = capabilityValue ?? "source_read";
+  if (capability !== "source_read" && capability !== "publish") {
+    throw new HTTPException5(400, { message: "invalid Google Drive OAuth capability" });
+  }
   if (connectionVersion !== void 0 && !Number.isInteger(connectionVersion) || Boolean(connectionId) !== Boolean(connectionVersion)) {
     throw new HTTPException5(400, { message: "invalid Google Drive reconnect state" });
   }
@@ -4583,6 +4669,7 @@ function readGoogleDriveOAuthState(raw, settings) {
       payload.encryptedPkceVerifier,
       "state.encryptedPkceVerifier"
     ),
+    capability,
     ...connectionId ? { connectionId, connectionVersion } : {},
     nonce: requiredString2(payload.nonce, "state.nonce"),
     iat
@@ -4779,7 +4866,7 @@ async function googleDriveApiRequest(deps, input) {
     if (!resolved || resolved.version !== connectionVersion) {
       throw new HTTPException5(409, { message: "Google Drive connection changed; try again" });
     }
-    await requireGoogleDriveSourceConnection(deps, resolved, input.subjectId);
+    await requireGoogleDriveApiConnection(deps, resolved, input.subjectId);
   };
   let credential = await resolve(false);
   if (credential.status !== "ok") {
@@ -21594,6 +21681,7 @@ function registerConnectionRoutes(app, deps) {
       ...c.req.query("code") ? { code: c.req.query("code") } : {},
       ...c.req.query("state") ? { state: c.req.query("state") } : {},
       ...c.req.query("error") ? { error: c.req.query("error") } : {},
+      ...c.req.query("picked_file_ids") ? { pickedFileIds: c.req.query("picked_file_ids") } : {},
       requestUrl: c.req.url
     };
     const result = await completeGoogleDriveOAuthCallback(deps, input);
@@ -22621,17 +22709,22 @@ import {
   getFileUpload,
   getGeneratedImageArtifact,
   getGeneratedVideoArtifact,
+  getFilesForSubject,
   getRetainedFileArtifact,
   getRetainedScreenshotArtifact,
-  requireFile as requireFile2
+  requireFileForSubject as requireFileForSubject2
 } from "@opengeni/db";
 import { HTTPException as HTTPException19 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
+import {
+  requireAccessGrant as requireAccessGrant6,
+  requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization2,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError3
+} from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 // src/mcp/files.ts
-import { requireFile } from "@opengeni/db";
+import { requireFileForSubject } from "@opengeni/db";
 import { hasPermission as hasPermission13 } from "@opengeni/core";
 import { McpServer as McpServer3 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as z8 from "zod/v4";
@@ -22663,7 +22756,12 @@ function buildFilesMcpServer(deps, grant) {
       if (!deps.objectStorage) {
         throw new Error("object storage is not configured");
       }
-      const file = await requireFile(deps.db, grant.workspaceId, fileId);
+      const file = await requireFileForSubject(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        subjectId: grant.subjectId,
+        fileId
+      });
       if (file.status !== "ready") {
         throw new Error(`file is ${file.status}`);
       }
@@ -22901,8 +22999,13 @@ function registerFileRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "files:read");
-    const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const grant = await requireAccessGrant6(c, deps, workspaceId, "files:read");
+    const file = await requireFileForSubject2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      fileId: c.req.param("fileId")
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException19(404, { message: "file not found" });
     }
@@ -22910,9 +23013,14 @@ function registerFileRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant6(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, workspaceId, artifactId2);
+    const artifact = await getWorkspaceArtifact2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId: artifactId2
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId2, "deleted"), 404);
     }
@@ -22920,9 +23028,14 @@ function registerFileRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId/content", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant6(c, deps, workspaceId, "files:read");
     const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact2(db, workspaceId, artifactId2);
+    const artifact = await getWorkspaceArtifact2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId: artifactId2
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId2, "deleted"), 404);
     }
@@ -23007,13 +23120,18 @@ function registerFileRoutes(app, deps) {
   );
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant6(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
       throw new HTTPException19(503, {
         message: "object storage is not configured"
       });
     }
-    const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const file = await requireFileForSubject2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      fileId: c.req.param("fileId")
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException19(404, { message: "file not found" });
     }
@@ -23134,12 +23252,12 @@ function retainedArtifactMetadata(artifact) {
   }
   return retainedArtifactUnavailable(file.id, "unsupported");
 }
-async function getWorkspaceArtifact2(db, workspaceId, artifactId2) {
-  const generated = await getGeneratedImageArtifact(db, workspaceId, artifactId2);
+async function getWorkspaceArtifact2(db, input) {
+  const generated = await getGeneratedImageArtifact(db, input.workspaceId, input.artifactId);
   if (generated) {
     return { file: generated.file, metadata: retainedGeneratedImageMetadata(generated) };
   }
-  const generatedVideo = await getGeneratedVideoArtifact(db, workspaceId, artifactId2);
+  const generatedVideo = await getGeneratedVideoArtifact(db, input.workspaceId, input.artifactId);
   if (generatedVideo && !generatedVideo.artifact.deletedAt) {
     const file = generatedVideoFileAsset(generatedVideo.file);
     return {
@@ -23150,8 +23268,36 @@ async function getWorkspaceArtifact2(db, workspaceId, artifactId2) {
       })
     };
   }
-  const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId2);
-  return artifact ? { file: artifact.file, metadata: retainedArtifactMetadata(artifact) } : null;
+  const artifact = await getRetainedFileArtifact(db, input.workspaceId, input.artifactId);
+  if (!artifact) return null;
+  const [authorizedFile] = await getFilesForSubject(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId,
+    fileIds: [artifact.file.id]
+  });
+  if (!authorizedFile) return null;
+  const authorizedArtifact = { ...artifact, file: authorizedFile };
+  return {
+    file: authorizedFile,
+    metadata: retainedArtifactMetadata(authorizedArtifact)
+  };
+}
+async function fileAuthoritySubjectIdForGrant(deps, grant) {
+  if (grant.principalKind !== "agent_attempt") return grant.subjectId;
+  const sessionId = grant.metadata?.["sessionId"];
+  if (typeof sessionId !== "string") {
+    throw new HTTPException19(404, { message: "file not found" });
+  }
+  try {
+    const actor = await requireLiveAgentAttemptAuthorization2(deps.db, grant, sessionId);
+    return actor.initiatingHumanSubjectId;
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError3) {
+      throw new HTTPException19(404, { message: "file not found", cause: error });
+    }
+    throw error;
+  }
 }
 function generatedVideoFileAsset(file) {
   return FileAsset.parse({
@@ -25985,7 +26131,7 @@ import {
   getBrowserRevisionArtifactAuthority,
   getEnrollment as getEnrollment4,
   getExternalAuthInteractiveContext,
-  getFiles,
+  getFilesForSubject as getFilesForSubject2,
   getFileUpload as getFileUpload2,
   getAuthRun,
   getExternalAuthPreparation,
@@ -26023,7 +26169,7 @@ import {
   recordWorkspaceUsage as recordWorkspaceUsage4,
   requireLimit as requireLimit5,
   relayConfigFromSettings as relayConfigFromSettings4,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError3,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError4,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError3
 } from "@opengeni/core";
 import {
@@ -27316,7 +27462,7 @@ function registerBrowserSessionRoutes(app, deps) {
         browserSessionId,
         "session.control",
         "browser.action",
-        async ({ sessionClient, binding, record: record5 }) => {
+        async ({ sessionClient, binding, record: record5, sourceAuthorization }) => {
           const command = BrowserActionCommand.parse({
             protocolVersion: BROWSER_CONTROL_PROTOCOL_VERSION,
             operationId: request.operationId,
@@ -27346,15 +27492,13 @@ function registerBrowserSessionRoutes(app, deps) {
                   message: "object storage is not configured"
                 });
               }
-              const files = await getFiles(deps.db, workspaceId, workspaceFileIds);
-              const byId = new Map(files.map((file) => [file.id, file]));
-              const ordered = workspaceFileIds.map((fileId) => byId.get(fileId));
-              if (ordered.some((file) => !file)) {
-                throw new HTTPException28(404, { message: "workspace file not found" });
-              }
-              if (ordered.some((file) => file.status !== "ready")) {
-                throw new HTTPException28(409, { message: "workspace file is not ready" });
-              }
+              const files = await getFilesForSubject2(deps.db, {
+                accountId: grant.accountId,
+                workspaceId,
+                subjectId: browserFileAuthoritySubjectId(grant, sourceAuthorization),
+                fileIds: workspaceFileIds
+              });
+              const ordered = requireAuthorizedBrowserUploadFiles(workspaceFileIds, files);
               const authorities = await Promise.all(
                 ordered.map(async (file) => {
                   const signed = await deps.objectStorage.createGetUrl({
@@ -29113,7 +29257,12 @@ function registerBrowserSessionRoutes(app, deps) {
         workspaceId,
         browserSessionId
       });
-      await authorizeSourceSession2(deps, grant, record5.sourceSessionId, authorizationOperation);
+      const sourceAuthorization = await authorizeSourceSession2(
+        deps,
+        grant,
+        record5.sourceSessionId,
+        authorizationOperation
+      );
       if (record5.session.lifecycle !== "active" || !record5.session.controller) {
         throw new BrowserSessionStateError2("BrowserSession is not active");
       }
@@ -29150,7 +29299,8 @@ function registerBrowserSessionRoutes(app, deps) {
           }),
           record: record5,
           binding,
-          placement
+          placement,
+          sourceAuthorization
         };
         let result;
         try {
@@ -29776,13 +29926,13 @@ async function requireSourceSession(deps, workspaceId, sessionId) {
 }
 async function authorizeSourceSession2(deps, grant, sessionId, operation) {
   try {
-    await requireSessionAuthorization4(deps, grant, {
+    return await requireSessionAuthorization4(deps, grant, {
       sessionId,
       operation,
       surface: "http"
     });
   } catch (error) {
-    if (error instanceof SessionAuthorizationDeniedError3) {
+    if (error instanceof SessionAuthorizationDeniedError4) {
       throw new HTTPException28(404, {
         message: "session not found",
         cause: error
@@ -30145,6 +30295,21 @@ function browserUploadFileIds(action) {
     ...new Set(actions.flatMap((entry) => entry.type === "upload" ? entry.workspaceFileIds : []))
   ];
 }
+function browserFileAuthoritySubjectId(grant, authorization) {
+  if (!authorization) return grant.principalKind === "agent_attempt" ? null : grant.subjectId;
+  return authorization.actor.kind === "agent_attempt" ? authorization.actor.initiatingHumanSubjectId : authorization.actor.subjectId;
+}
+function requireAuthorizedBrowserUploadFiles(workspaceFileIds, authorizedFiles) {
+  const byId = new Map(authorizedFiles.map((file) => [file.id, file]));
+  return workspaceFileIds.map((fileId) => {
+    const file = byId.get(fileId);
+    if (!file) throw new HTTPException28(404, { message: "workspace file not found" });
+    if (file.status !== "ready") {
+      throw new HTTPException28(409, { message: "workspace file is not ready" });
+    }
+    return file;
+  });
+}
 function browserUploadFilename(value) {
   const normalized = value.trim().replace(/[/\\]/gu, "_").replace(/[^A-Za-z0-9._ -]+/gu, "_").replace(/\s+/gu, " ").trim().slice(0, 240);
   return normalized && normalized !== "." && normalized !== ".." ? normalized : "file";
@@ -30327,7 +30492,7 @@ import {
   requireAccessGrant as requireAccessGrant15,
   requireSessionAuthorization as requireSessionAuthorization5,
   relayConfigFromSettings as relayConfigFromSettings5,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError4,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError5,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError4
 } from "@opengeni/core";
 import {
@@ -31432,7 +31597,7 @@ async function authorizeSourceSession3(deps, grant, sessionId, operation) {
       surface: "http"
     });
   } catch (error) {
-    if (error instanceof SessionAuthorizationDeniedError4) {
+    if (error instanceof SessionAuthorizationDeniedError5) {
       throw new HTTPException29(404, { message: "session not found", cause: error });
     }
     if (error instanceof SessionAuthorizationUnavailableError4) {
@@ -33150,7 +33315,7 @@ import {
   updateSiteAuthConnection
 } from "@opengeni/db";
 import {
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError5,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError6,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError5,
   requireAccessGrant as requireAccessGrant19,
   requireSessionAuthorization as requireSessionAuthorization6,
@@ -34285,7 +34450,7 @@ async function authorizeSession(deps, grant, sessionId, operation) {
       surface: "http"
     });
   } catch (error) {
-    if (error instanceof SessionAuthorizationDeniedError5) {
+    if (error instanceof SessionAuthorizationDeniedError6) {
       throw new HTTPException33(404, { message: "session not found", cause: error });
     }
     if (error instanceof SessionAuthorizationUnavailableError5) {
@@ -37347,7 +37512,7 @@ import {
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope2,
   withResolvedSessionAuthorization,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError6,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError7,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError6
 } from "@opengeni/core";
 import {
@@ -39431,7 +39596,7 @@ function registerSessionRoutes(app, deps) {
     const result = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
       text: payload.text,
       annotations: payload.annotations,
-      turnInstructions: payload.turnInstructions ?? null,
+      modelContext: payload.modelContext ?? null,
       resources: payload.resources,
       model: payload.model ?? null,
       reasoningEffort: payload.reasoningEffort ?? null,
@@ -39466,7 +39631,7 @@ function registerSessionRoutes(app, deps) {
       const { accepted } = await acceptSessionUserMessage(deps, grant, workspaceId, sessionId, {
         text: event.payload.text,
         annotations: event.payload.annotations,
-        turnInstructions: event.payload.turnInstructions ?? null,
+        modelContext: event.payload.modelContext ?? null,
         resources: event.payload.resources ?? [],
         model: event.payload.model ?? null,
         reasoningEffort: event.payload.reasoningEffort ?? null,
@@ -40512,7 +40677,7 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
   return null;
 }
 function sessionAuthorizationHttpError(error) {
-  if (error instanceof SessionAuthorizationDeniedError6) {
+  if (error instanceof SessionAuthorizationDeniedError7) {
     return new HTTPException41(404, { message: "session not found" });
   }
   if (error instanceof SessionAuthorizationUnavailableError6) {
@@ -45454,8 +45619,8 @@ var SLACK_INTERACTION_BOT_SUBJECT_ID = "service:slack-interaction";
 var SLACK_ACTION_TTL_MS = 7 * 24 * 60 * 6e4;
 var MAX_SLACK_APPROVALS_PER_CARD = 8;
 var MAX_SLACK_ACTIONS_PER_CARD = 20;
-var SLACK_TASK_INSTRUCTIONS = [
-  "This turn originated from Slack. Slack message and thread context is task-local only.",
+var SLACK_SESSION_INSTRUCTIONS = [
+  "This session is an OpenGeni Slack task surface. Treat Slack message and thread context as task-local unless a separate explicit authorized user action says otherwise.",
   "Execute direct, safe, sufficiently specified requests immediately.",
   "Ask one concise clarifying question only when materially required information is missing or the requested action is risky, irreversible, or authorization-sensitive.",
   "Do not write Slack context to Documents, Knowledge, Memory, preferences, Workspace Charter, instructions, or policy unless a separate explicit authorized user action requests it.",
@@ -46264,7 +46429,7 @@ async function processSlackInboxEntry(deps, entry) {
     session = await createSessionForRequest2(deps, grant, entry.workspaceId, {
       requestedSessionId: interaction.sessionReservationId,
       initialMessage: slackInvocationPreparedEntry(preparedEntry, preparedAttachments).text,
-      turnInstructions: SLACK_TASK_INSTRUCTIONS,
+      instructions: SLACK_SESSION_INSTRUCTIONS,
       firstPartyMcpTools: slackTaskFirstPartyMcpTools(deps.settings),
       resources: preparedAttachments.resources,
       ...preferredModel ? { model: preferredModel } : {},
@@ -46657,7 +46822,7 @@ async function processSlackReactionInboxEntry(deps, entry) {
     session = await createSessionForRequest2(deps, grant, entry.workspaceId, {
       requestedSessionId: interaction.sessionReservationId,
       initialMessage: preparedEntry.text,
-      turnInstructions: SLACK_TASK_INSTRUCTIONS,
+      instructions: SLACK_SESSION_INSTRUCTIONS,
       // The exact reacted message and bounded containing thread are already in
       // the prompt; do not expose general Slack history tools for this trigger.
       firstPartyMcpTools: resolveFirstPartyMcpToolPolicy(deps.settings).default,
@@ -46944,7 +47109,6 @@ async function acceptSlackReactionTask(deps, grant, sessionId, entry, resources)
   }
   await acceptSessionUserMessage2(deps, grant, entry.workspaceId, sessionId, {
     text: entry.text,
-    turnInstructions: SLACK_TASK_INSTRUCTIONS,
     resources,
     clientEventId
   });
@@ -47018,7 +47182,6 @@ async function continueSlackSession(deps, grant, interaction, entry, resources =
   }
   await acceptSessionUserMessage2(deps, grant, entry.workspaceId, interaction.sessionId, {
     text: entry.text,
-    turnInstructions: SLACK_TASK_INSTRUCTIONS,
     resources,
     clientEventId: `slack:${entry.providerEventId}`
   });
@@ -48301,9 +48464,7 @@ function createAppComposition(deps) {
       if (context.accountId !== accountId) {
         throw new Error("document account/workspace authority mismatch");
       }
-      const claimedDocument = await getDocument2(deps.db, workspaceId, documentId, {
-        viewerSubjectId: authoritySubjectId
-      });
+      const claimedDocument = await getDocumentForIndexing(deps.db, workspaceId, documentId);
       if (!claimedDocument || claimedDocument.authorityKind !== authorityKind || claimedDocument.authorityWorkspaceId !== authorityWorkspaceId || claimedDocument.authoritySubjectId !== authoritySubjectId) {
         throw new Error("document authority changed before indexing");
       }
@@ -48619,7 +48780,7 @@ function createAppComposition(deps) {
             surface: "first_party_mcp"
           });
         } catch (error) {
-          if (error instanceof SessionAuthorizationDeniedError7) {
+          if (error instanceof SessionAuthorizationDeniedError8) {
             throw new HTTPException55(404, { message: "session not found" });
           }
           if (error instanceof SessionAuthorizationUnavailableError7) {
@@ -48823,7 +48984,7 @@ async function withAccessGrantSessionRlsContext(deps, grant, fn) {
     throw new HTTPException55(403, { message: "agent attempt authority is invalid" });
   }
   try {
-    const actor = await requireLiveAgentAttemptAuthorization2(deps.db, grant, callerSessionId);
+    const actor = await requireLiveAgentAttemptAuthorization3(deps.db, grant, callerSessionId);
     return await withSessionRlsActorContext(
       {
         subjectId: actor.subjectId,
@@ -48832,7 +48993,7 @@ async function withAccessGrantSessionRlsContext(deps, grant, fn) {
       fn
     );
   } catch (error) {
-    if (error instanceof SessionAuthorizationDeniedError7) {
+    if (error instanceof SessionAuthorizationDeniedError8) {
       throw new HTTPException55(403, {
         message: "agent attempt authority is invalid",
         cause: error
@@ -48875,7 +49036,7 @@ function clientAuthConfig(settings) {
   return { mode: "none" };
 }
 function codemodeHttpError(error) {
-  if (error instanceof SessionAuthorizationDeniedError7) {
+  if (error instanceof SessionAuthorizationDeniedError8) {
     return new HTTPException55(404, {
       message: "session not found",
       cause: error
@@ -49756,4 +49917,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-2PQMSRCB.js.map
+//# sourceMappingURL=chunk-WCXHI3FF.js.map