@opengeni/api-router 0.30.1 → 1.0.0

package/dist/integration-endpoint-test.d.ts

@@ -0,0 +1,20 @@
+import { CredentialProviderResponse, type IntegrationEndpointTestResult } from "@opengeni/contracts";
+import { pinnedFetch, type OutboundNetworkSettings } from "@opengeni/network";
+export type IntegrationEndpointTestInput = {
+    kind: "webhook" | "credential-provider";
+    url: string;
+    secret: string;
+    /** The exact body to sign and send. */
+    body: string;
+    /** Extra identity headers (the webhook event id). */
+    headers?: Record<string, string>;
+    timeoutMs: number;
+    settings: OutboundNetworkSettings;
+    fetch?: typeof pinnedFetch;
+    now?: () => number;
+};
+/** What went wrong reaching the endpoint, in words an administrator can act on. */
+export declare function integrationTestNetworkError(error: unknown): string;
+/** The names of what a run would receive. Values are dropped here. */
+export declare function credentialProviderTestSummary(response: CredentialProviderResponse): NonNullable<IntegrationEndpointTestResult["credentials"]>;
+export declare function sendIntegrationEndpointTest(input: IntegrationEndpointTestInput): Promise<IntegrationEndpointTestResult>;

package/dist/integrations/api-integrations.d.ts

@@ -1,5 +1,5 @@
 import { type IntegrationCredentialResolver, type IntegrationInvocationAuthority, type IntegrationTransport } from "@opengeni/capabilities";
-import { ApiIntegrationPreview, type IntegrationSource } from "@opengeni/contracts";
+import { ApiIntegrationPreview, type IntegrationSourceInput } from "@opengeni/contracts";
 import type { StoredApiIntegrationRevision } from "@opengeni/db";
 export type ApiIntegrationConnectionDescriptor = {
     id: string;
@@ -16,7 +16,7 @@ export type ResolvedApiIntegrationPreview = {
     authScheme: Record<string, unknown>;
 };
 export declare function resolveApiIntegrationPreview(input: {
-    source: IntegrationSource;
+    source: IntegrationSourceInput;
     connection: ApiIntegrationConnectionDescriptor | null;
     transport: IntegrationTransport;
     credentialResolver?: IntegrationCredentialResolver;

package/dist/integrations/atlassian.d.ts

@@ -1,3 +1,8 @@
+type AtlassianRequestAuthority = {
+    connectionUseContext?: Omit<AcceptedConnectionUseContext, "physicalRequestId" | "usePhase">;
+};
+import type { AcceptedConnectionUseContext } from "@opengeni/db";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type { AccessGrant, ScheduledTask } from "@opengeni/contracts";
 import { AtlassianOAuthStartResponse, type AtlassianDisconnectRequest, type AtlassianLifecycleActionRequest, type AtlassianOAuthStartRequest } from "@opengeni/contracts/atlassian";
 import { type ApiRouteDeps } from "@opengeni/core";
@@ -9,6 +14,8 @@ export declare function startAtlassianOAuth(deps: ApiRouteDeps, input: {
     subjectId: string;
     requestUrl: string;
     payload: AtlassianOAuthStartRequest;
+    connectAttemptId?: string;
+    externalContinuation?: ExternalActorContinuation;
 }): Promise<AtlassianOAuthStartResponse>;
 export declare function completeAtlassianOAuthCallback(deps: ApiRouteDeps, input: {
     code?: string | undefined;
@@ -17,14 +24,17 @@ export declare function completeAtlassianOAuthCallback(deps: ApiRouteDeps, input
     requestUrl: string;
 }): Promise<{
     redirectTo: string;
+    exactReturn?: boolean;
 }>;
-export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
+export declare function browseAtlassianSources(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -58,7 +68,7 @@ export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
         webUrl: string;
     }[];
 }>;
-export declare function searchAtlassianLive(deps: ApiRouteDeps, input: {
+export declare function searchAtlassianLive(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;
@@ -86,7 +96,7 @@ export declare function searchAtlassianLive(deps: ApiRouteDeps, input: {
     updatedAt: string | null;
     url: string;
 })[]>;
-export declare function getAtlassianLiveItem(deps: ApiRouteDeps, input: {
+export declare function getAtlassianLiveItem(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;
@@ -167,10 +177,26 @@ export declare function disconnectAtlassian(deps: ApiRouteDeps, input: {
     connection: AtlassianConnectionRecord;
     payload: AtlassianDisconnectRequest;
 }): Promise<import("@opengeni/db").ConnectionMetadataWithVerification | null>;
+export declare function preflightAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
+    task: ScheduledTask;
+    subjectId: string;
+}): Promise<void>;
 export declare function revokeAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
     task: ScheduledTask;
     subjectId: string;
 }): Promise<void>;
+export declare function cleanupAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
+    taskId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    connectionVersion: number;
+    sourceId: string;
+    sourceLifecycleGeneration: number;
+    sourceConfigGeneration: number;
+    externalSourceId: string;
+    subjectId: string;
+}): Promise<void>;
 export declare function isSelectableConfluenceSpaceType(value: unknown): boolean;
 export declare function confluenceNextUrl(cloudId: string, next: string): URL;
 export {};

package/dist/integrations/connect-authority.d.ts

@@ -0,0 +1 @@
+export { requireConnectOwnerAuthority } from "@opengeni/core";

package/dist/integrations/connect-callback-return.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from "hono";
+import type { ApiRouteDeps } from "@opengeni/core";
+/** Navigation-only recovery. Recently expired signed state can identify the host's saved
+ * destination, but cannot authorize exchange, persistence, or credential use.
+ * Normal callbacks independently enforce current time and live authority. */
+export declare function registerConnectCallbackReturns(app: Hono, deps: ApiRouteDeps): void;

package/dist/integrations/fiken.d.ts

@@ -1,9 +1,15 @@
 import type { ApiRouteDeps } from "@opengeni/core";
 import type { Settings } from "@opengeni/config";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import { FikenOAuthStartResponse, type AccessGrant, type ConnectionMetadata, type FikenCompanySummary, type FikenConnectionMetadata, type FikenOAuthStartRequest } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import { type FetchLike } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
+/** Shared native/embedded token adapter. Provider verification happens before
+ * persistence; the caller reauthorizes inside its durable commit transaction.
+ * That caller must acquire the organization policy fence for `fiken` BEFORE
+ * owner/tenancy locks and invoke the returned writer with that exact tx. */
+export declare function prepareFikenTokenInstall(deps: ApiRouteDeps, grant: Pick<AccessGrant, "accountId" | "workspaceId" | "subjectId">, raw: unknown, expectedVersion?: number): Promise<(tx: Database) => Promise<ConnectionMetadata>>;
 export type FikenOperation = "companies.list" | "contacts.list" | "contact.create" | "products.list" | "invoices.list" | "invoice.get" | "invoice_draft.create" | "bank_accounts.list" | "purchases.list" | "sales.list";
 export declare class FikenProviderError extends Error {
     readonly code: string;
@@ -25,6 +31,7 @@ type FikenContext = {
     subjectId: string | null;
     sessionId: string | null;
 };
+type FikenProviderAuthorization = () => Promise<boolean | void>;
 /**
  * Validates a pasted Fiken personal API token before it enters encrypted
  * storage, and discovers the companies it can act on. The companies list is
@@ -57,8 +64,10 @@ export declare class FikenClient {
     private readonly metadata;
     private readonly context;
     private readonly fetchImpl;
+    private readonly authorizeProviderRequest?;
     private readonly resolveCredential;
-    constructor(db: Database, settings: Settings, connection: ConnectionMetadata, metadata: FikenConnectionMetadata, context: FikenContext, fetchImpl?: FetchLike);
+    private expectedConnectionVersion;
+    constructor(db: Database, settings: Settings, connection: ConnectionMetadata, metadata: FikenConnectionMetadata, context: FikenContext, fetchImpl?: FetchLike, authorizeProviderRequest?: FikenProviderAuthorization | undefined);
     listCompanies(input?: {
         page?: number;
         pageSize?: number;
@@ -202,7 +211,8 @@ export declare class FikenClient {
     private request;
     private readResponse;
     private markNeedsReauth;
-    private headersFor;
+    private currentAuthority;
+    private credentialFor;
     private receipt;
     private recordAudit;
 }
@@ -210,6 +220,7 @@ export declare function createFikenClient(deps: {
     db: Database;
     settings: Settings;
     fikenFetch?: typeof fetch;
+    authorizeProviderRequest?: FikenProviderAuthorization;
 }, resolved: Awaited<ReturnType<typeof resolveFikenConnectionForTool>>): FikenClient;
 export declare class FikenOAuthCallbackError extends Error {
     readonly reason: string;
@@ -221,6 +232,8 @@ export declare function startFikenOAuth(deps: ApiRouteDeps, input: {
     subjectId: string;
     requestUrl: string;
     payload: FikenOAuthStartRequest;
+    externalContinuation?: ExternalActorContinuation;
+    connectAttemptId?: string;
 }): Promise<FikenOAuthStartResponse>;
 export declare function completeFikenOAuthCallback(deps: ApiRouteDeps, input: {
     code?: string | undefined;
@@ -229,5 +242,6 @@ export declare function completeFikenOAuthCallback(deps: ApiRouteDeps, input: {
     requestUrl: string;
 }): Promise<{
     redirectTo: string;
+    exactReturn?: boolean;
 }>;
 export {};

package/dist/integrations/github-app-connect.d.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import type { ConnectAdvance, ConnectAttempt } from "@opengeni/contracts/connect";
+import { type ConnectActorScope } from "@opengeni/db";
+import type { ApiRouteDeps, PreparedConnectOperation } from "@opengeni/core";
+declare const stateSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"github_app_connect">;
+    accountId: z.ZodString;
+    workspaceId: z.ZodString;
+    subjectId: z.ZodString;
+    personalOwnerVerified: z.ZodBoolean;
+    connectAttemptId: z.ZodString;
+    phase: z.ZodEnum<{
+        bind: "bind";
+        discover: "discover";
+        install: "install";
+    }>;
+    installationId: z.ZodOptional<z.ZodNumber>;
+    providerId: z.ZodDefault<z.ZodEnum<{
+        "github-app": "github-app";
+        "github-lens": "github-lens";
+    }>>;
+    nonce: z.ZodString;
+    iat: z.ZodNumber;
+}, z.core.$strip>;
+type State = z.infer<typeof stateSchema>;
+export declare function isGitHubAppConnectState(deps: ApiRouteDeps, raw: string | undefined): boolean;
+type GitHubConnectScope = ConnectActorScope & {
+    personalOwnerVerified?: boolean;
+    providerId?: "github-app" | "github-lens";
+};
+export declare function githubAppConnectNavigation(deps: ApiRouteDeps, scope: GitHubConnectScope, attemptId: string, requestUrl: string, phase?: State["phase"], installationId?: number, providerId?: State["providerId"]): {
+    authorizationUrl: string;
+    expiresAt: string;
+};
+export declare function prepareGitHubAppConnectAction(deps: ApiRouteDeps, scope: GitHubConnectScope, requestUrl: string, attempt: ConnectAttempt, action: ConnectAdvance): PreparedConnectOperation;
+/** No browser login/cookie required: signed attempt + current stored origin,
+ * then fresh GitHub owner proof, are the two separate authority boundaries. */
+export declare function completeGitHubAppConnect(deps: ApiRouteDeps, input: {
+    state?: string | undefined;
+    code?: string | undefined;
+    installationId?: string | undefined;
+    setupAction?: string | undefined;
+    error?: string | undefined;
+    requestUrl: string;
+    expectedProvider?: "github-app" | "github-lens";
+}): Promise<Response>;
+export {};

package/dist/integrations/github-installation-proof.d.ts

@@ -0,0 +1,3 @@
+import type { GitHubInstallationBindingCandidate, GitHubInstallationBindingProof } from "@opengeni/contracts";
+export declare function isConsistentGitHubBindingCandidates(candidates: GitHubInstallationBindingCandidate[]): boolean;
+export declare function isConsistentGitHubBindingProof(proof: GitHubInstallationBindingProof, installationId: number): boolean;

package/dist/integrations/github-lens-connect.d.ts

@@ -0,0 +1,116 @@
+import { type GitHubInstallationBindingProof } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import { type Database } from "@opengeni/db";
+export declare function requireGitHubLensConnect(deps: ApiRouteDeps): Promise<{
+    template: {
+        adapterId: "source-control.pull-request.v1";
+        eventTypes: string[];
+        configuration: {};
+        sessionTemplate: {
+            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-schedules" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
+            prompt: string;
+            instructions: string | null;
+            resources: ({
+                kind: "repository";
+                uri: string;
+                ref: string;
+                expectedCommitSha?: string | undefined;
+                mountPath?: string | undefined;
+                subpath?: string | undefined;
+                provider?: "azure_devops" | "github" | "gitlab" | undefined;
+                connectionType?: "github_personal" | undefined;
+                credentialBindingId?: string | undefined;
+                access?: "read" | "write" | undefined;
+                repositoryId?: string | number | undefined;
+                installationId?: string | number | undefined;
+                projectId?: string | number | undefined;
+                connectionId?: string | undefined;
+                githubInstallationId?: number | undefined;
+                githubRepositoryId?: number | undefined;
+                optional?: boolean | undefined;
+            } | {
+                kind: "file";
+                fileId: string;
+                mountPath?: string | undefined;
+            })[];
+            skills: {
+                name: string;
+                description: string;
+                files: {
+                    path: string;
+                    content: string;
+                }[];
+            }[];
+            tools: {
+                kind: "mcp";
+                id: string;
+                eager?: boolean | undefined;
+                optional?: boolean | undefined;
+            }[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+            model: string | null;
+            reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
+            sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
+            policyRole: string | null;
+            metadata: Record<string, unknown>;
+            agent?: {
+                capabilities?: "all" | "none" | {
+                    webSearch?: boolean | undefined;
+                    humanInput?: boolean | undefined;
+                    skills?: "manage" | "read" | false | undefined;
+                    goals?: boolean | undefined;
+                    subagents?: boolean | undefined;
+                    knowledge?: boolean | undefined;
+                    schedules?: boolean | undefined;
+                    artifacts?: boolean | undefined;
+                    browser?: boolean | undefined;
+                    media?: boolean | undefined;
+                    workspaceFiles?: boolean | undefined;
+                    workspaceConnectors?: boolean | undefined;
+                    workspaceAdmin?: boolean | undefined;
+                    from: "all" | "none";
+                } | undefined;
+                identity?: string | null | undefined;
+                instructions?: string | undefined;
+                renderer?: "markdown" | "opengeni" | undefined;
+            } | undefined;
+            credentialRestriction?: "developer_setup" | undefined;
+        };
+    };
+}>;
+/** Separate Lens registration/source/automation domain, not a repository-access
+ * binding. Invoked inside the Connect receipt's authorized transaction. */
+export declare function commitGitHubLensConnect(deps: ApiRouteDeps, tx: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    installationId: number;
+    proof: GitHubInstallationBindingProof;
+    checkedAt: Date;
+    expiresAt: Date;
+    nonce: string;
+}): Promise<{
+    id: string;
+    sourceId: string;
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    provider: "azure_devops" | "github" | "gitlab";
+    providerBaseUrl: string;
+    appId: string | null;
+    installationId: string | null;
+    providerAccountLogin: string | null;
+    providerAccountType: "Organization" | "User" | null;
+    credentialKind: "github_app" | "managed_github_app" | "provider_token";
+    hasCredential: boolean;
+    accessTokenExpiresAt: string | null;
+    webhookAuthKind: "basic" | "hmac_sha256" | "shared_token";
+    hasWebhookSecret: boolean;
+    webhookUsername: string | null;
+    webhookPath: string;
+    status: "active" | "disabled";
+    createdBySubjectId: string;
+    createdAt: string;
+    updatedAt: string;
+}>;

package/dist/integrations/github-skill-source.d.ts

@@ -1,5 +1 @@
-import type { Settings } from "@opengeni/config";
-import type { GitHubSkillSourceClient } from "@opengeni/core";
-type GitHubJsonRequest = (path: string, maxBytes: number, label: string) => Promise<unknown>;
-export declare function createGitHubSkillSourceClient(settings: Settings, requestJson?: GitHubJsonRequest): GitHubSkillSourceClient;
-export {};
+export { createGitHubSkillSourceClient } from "@opengeni/core";

package/dist/integrations/google-drive.d.ts

@@ -1,3 +1,4 @@
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type { AccessGrant, ScheduledTask } from "@opengeni/contracts";
 import { GoogleDriveOAuthStartResponse, type GoogleDriveDisconnectRequest, type GoogleDriveLifecycleActionRequest, type GoogleDriveOAuthStartRequest } from "@opengeni/contracts/google-drive";
 import { IntegrationFacetMutationResult } from "@opengeni/contracts";
@@ -21,14 +22,18 @@ export declare function startGoogleDriveOAuth(deps: ApiRouteDeps, input: {
     subjectId: string;
     requestUrl: string;
     payload: GoogleDriveOAuthStartRequest;
+    connectAttemptId?: string;
+    externalContinuation?: ExternalActorContinuation;
 }): Promise<GoogleDriveOAuthStartResponse>;
 export declare function completeGoogleDriveOAuthCallback(deps: ApiRouteDeps, input: {
     code?: string | undefined;
     state?: string | undefined;
     error?: string | undefined;
+    pickedFileIds?: string | undefined;
     requestUrl: string;
 }): Promise<{
     redirectTo: string;
+    exactReturn?: boolean;
 }>;
 export declare function transitionGoogleDriveLifecycle(deps: ApiRouteDeps, input: {
     workspaceId: string;
@@ -51,6 +56,8 @@ export declare function browseGoogleDrive(deps: ApiRouteDeps, input: {
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -106,6 +113,8 @@ export declare function browseGoogleDriveFacetSource(deps: ApiRouteDeps, input:
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -173,8 +182,24 @@ export declare function saveGoogleDriveSource(deps: ApiRouteDeps, input: {
     canManageWorkspaceDestination: boolean;
     canManagePersonalDestination: boolean;
 }): Promise<import("@opengeni/db").ConnectionMetadataWithVerification>;
+export declare function preflightKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
+    task: ScheduledTask;
+    subjectId: string;
+}): Promise<void>;
 export declare function revokeKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
     task: ScheduledTask;
     subjectId: string;
 }): Promise<void>;
+export declare function cleanupKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
+    taskId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    connectionVersion: number;
+    sourceId: string;
+    sourceLifecycleGeneration: number;
+    sourceConfigGeneration: number;
+    externalSourceId: string;
+    subjectId: string;
+}): Promise<void>;
 export {};

package/dist/integrations/integration-commit-authority.d.ts

@@ -0,0 +1,13 @@
+import { type AccessGrant, type Permission } from "@opengeni/contracts";
+import { type Settings } from "@opengeni/config";
+import { type AccessGrantAuthorization } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+export type IntegrationCommitGrant = AccessGrant & {
+    authorizeCommit: (tx: Database) => Promise<void>;
+};
+/** Keep server-verified provenance alongside the grant across provider work.
+ * Call only inside the policy transaction, before persistence locks. */
+export declare function integrationCommitGrant(authorization: AccessGrantAuthorization, permissions: readonly Permission[], request: {
+    settings: Settings;
+    authorizationHeader?: string | undefined;
+}): Promise<IntegrationCommitGrant>;