@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/dist/integrations/atlassian.d.ts

@@ -25,6 +25,7 @@ export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -167,10 +168,26 @@ export declare function disconnectAtlassian(deps: ApiRouteDeps, input: {
     connection: AtlassianConnectionRecord;
     payload: AtlassianDisconnectRequest;
 }): Promise<import("@opengeni/db").ConnectionMetadataWithVerification | null>;
+export declare function preflightAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
+    task: ScheduledTask;
+    subjectId: string;
+}): Promise<void>;
 export declare function revokeAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
     task: ScheduledTask;
     subjectId: string;
 }): Promise<void>;
+export declare function cleanupAtlassianScheduleAuthorization(deps: ApiRouteDeps, input: {
+    taskId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    connectionVersion: number;
+    sourceId: string;
+    sourceLifecycleGeneration: number;
+    sourceConfigGeneration: number;
+    externalSourceId: string;
+    subjectId: string;
+}): Promise<void>;
 export declare function isSelectableConfluenceSpaceType(value: unknown): boolean;
 export declare function confluenceNextUrl(cloudId: string, next: string): URL;
 export {};

package/dist/integrations/fiken.d.ts

@@ -25,6 +25,7 @@ type FikenContext = {
     subjectId: string | null;
     sessionId: string | null;
 };
+type FikenProviderAuthorization = () => Promise<boolean | void>;
 /**
  * Validates a pasted Fiken personal API token before it enters encrypted
  * storage, and discovers the companies it can act on. The companies list is
@@ -57,8 +58,10 @@ export declare class FikenClient {
     private readonly metadata;
     private readonly context;
     private readonly fetchImpl;
+    private readonly authorizeProviderRequest?;
     private readonly resolveCredential;
-    constructor(db: Database, settings: Settings, connection: ConnectionMetadata, metadata: FikenConnectionMetadata, context: FikenContext, fetchImpl?: FetchLike);
+    private expectedConnectionVersion;
+    constructor(db: Database, settings: Settings, connection: ConnectionMetadata, metadata: FikenConnectionMetadata, context: FikenContext, fetchImpl?: FetchLike, authorizeProviderRequest?: FikenProviderAuthorization | undefined);
     listCompanies(input?: {
         page?: number;
         pageSize?: number;
@@ -202,7 +205,8 @@ export declare class FikenClient {
     private request;
     private readResponse;
     private markNeedsReauth;
-    private headersFor;
+    private currentAuthority;
+    private credentialFor;
     private receipt;
     private recordAudit;
 }
@@ -210,6 +214,7 @@ export declare function createFikenClient(deps: {
     db: Database;
     settings: Settings;
     fikenFetch?: typeof fetch;
+    authorizeProviderRequest?: FikenProviderAuthorization;
 }, resolved: Awaited<ReturnType<typeof resolveFikenConnectionForTool>>): FikenClient;
 export declare class FikenOAuthCallbackError extends Error {
     readonly reason: string;

package/dist/integrations/google-drive.d.ts

@@ -52,6 +52,7 @@ export declare function browseGoogleDrive(deps: ApiRouteDeps, input: {
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -107,6 +108,7 @@ export declare function browseGoogleDriveFacetSource(deps: ApiRouteDeps, input:
 }): Promise<{
     connection: {
         id: string;
+        authorityId?: string | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -174,8 +176,24 @@ export declare function saveGoogleDriveSource(deps: ApiRouteDeps, input: {
     canManageWorkspaceDestination: boolean;
     canManagePersonalDestination: boolean;
 }): Promise<import("@opengeni/db").ConnectionMetadataWithVerification>;
+export declare function preflightKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
+    task: ScheduledTask;
+    subjectId: string;
+}): Promise<void>;
 export declare function revokeKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
     task: ScheduledTask;
     subjectId: string;
 }): Promise<void>;
+export declare function cleanupKnowledgeSourceScheduleAuthorization(deps: ApiRouteDeps, input: {
+    taskId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    connectionVersion: number;
+    sourceId: string;
+    sourceLifecycleGeneration: number;
+    sourceConfigGeneration: number;
+    externalSourceId: string;
+    subjectId: string;
+}): Promise<void>;
 export {};

package/dist/integrations/oauth-client.d.ts

@@ -2,10 +2,9 @@ import { type Settings } from "@opengeni/config";
 import { OAuthStartResponse, type ConnectionOwnership, type OAuthStartRequest } from "@opengeni/contracts";
 import type { Observability } from "@opengeni/observability";
 import { type Database } from "@opengeni/db";
+import { type OAuthProviderProfile } from "./oauth-profiles.js";
 export declare const oauthStateTtlMs: number;
-export declare const OFFICIAL_SLACK_MCP_URL: "https://mcp.slack.com/mcp";
-export declare const OFFICIAL_GMAIL_MCP_URL = "https://gmailmcp.googleapis.com/mcp/v1";
-export declare const OFFICIAL_GMAIL_MCP_SCOPES: readonly ["https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.compose", "https://www.googleapis.com/auth/gmail.modify"];
+export { OFFICIAL_GMAIL_MCP_SCOPES, OFFICIAL_GMAIL_MCP_URL, OFFICIAL_SLACK_MCP_URL, } from "./oauth-profiles.js";
 export { OAUTH_MAX_RESPONSE_BYTES } from "@opengeni/network";
 type OAuthClientDeps = {
     db: Database;
@@ -18,6 +17,12 @@ export type OAuthStartContext = {
     accountId: string;
     workspaceId: string;
     subjectId: string;
+    /**
+     * False for every principal that cannot own a personal Connection (API keys,
+     * the configured key, services, agent attempts). Resolved by the route from
+     * the live authenticated principal, never inferred here.
+     */
+    personalOwnershipAllowed: boolean;
     requestUrl: string;
     payload: OAuthStartRequest;
 };
@@ -39,7 +44,16 @@ export declare const OAUTH_START_DEADLINE_MS = 15000;
 export declare const OAUTH_CALLBACK_DEADLINE_MS = 30000;
 export type OAuthStartStage = "connection_lookup" | "mcp_challenge" | "protected_resource_metadata" | "authorization_server_metadata" | "client_registration";
 export declare function startMcpOAuth(deps: OAuthClientDeps, context: OAuthStartContext): Promise<OAuthStartResponse>;
+/** Ownership fence for the official Gmail profile, keyed by exact MCP URL. */
 export declare function assertOfficialGmailPersonalOwnership(mcpUrl: string, ownership: ConnectionOwnership): void;
+/**
+ * Slack's hosted MCP issues user tokens only. Sharing one human's grant as
+ * workspace authority made every shared agent act as a named employee; the
+ * OpenGeni workspace bot owns shared Slack access instead (bot-token search
+ * covers public channels, files, and users).
+ */
+export declare function assertHostedSlackMcpPersonalOwnership(hostedSlackMcp: boolean, ownership: ConnectionOwnership): void;
+export declare function isHostedSlackMcpTarget(providerDomain: string, mcpUrl: string): boolean;
 export declare function completeMcpOAuthCallback(deps: OAuthClientDeps, input: {
     code?: string | undefined;
     state?: string | undefined;
@@ -47,8 +61,11 @@ export declare function completeMcpOAuthCallback(deps: OAuthClientDeps, input: {
 }): Promise<OAuthCallbackResult>;
 export declare function integrationBaseUrl(publicBaseUrl: string | undefined, requestUrl: string): string;
 export declare function requireIntegrationsStateSecret(settings: Settings): string;
+/** The hosted-Slack profile's origin pins, kept exported for its tests. */
 export declare function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void;
+/** The official-Gmail profile's origin pins, kept exported for its tests. */
 export declare function assertGoogleAuthorizationServer(as: AuthorizationServerMetadata): void;
+export declare function preferredOAuthSelfRegistration(as: Pick<AuthorizationServerMetadata, "clientIdMetadataDocumentSupported" | "registrationEndpoint">, clientSource: OAuthProviderProfile["clientSource"]): "cimd" | "dcr" | null;
 export declare function buildAuthorizationUrl(input: {
     endpoint: string;
     settings: Settings;
@@ -59,6 +76,8 @@ export declare function buildAuthorizationUrl(input: {
     verifier: string;
     scopes: string[];
     resourceParameterSupported: boolean;
+    /** Profile-declared extra authorize parameters, applied last. */
+    extraParams?: Readonly<Record<string, string>> | undefined;
 }): string;
 export type OAuthPublicErrorFields = {
     errorClass: "OAuthOperationError";

package/dist/integrations/oauth-profiles.d.ts

@@ -0,0 +1,195 @@
+import { type ConnectionOwnership } from "@opengeni/contracts";
+import type { Settings } from "@opengeni/config";
+import { z } from "zod";
+/**
+ * Provider OAuth quirks as data.
+ *
+ * Some providers do not support DCR or CIMD and need a pre-registered client
+ * with pinned metadata; some issue personal tokens only; some reject RFC 8707's
+ * `resource` parameter. Each used to be a hand-written branch set inside
+ * `oauth-client.ts`; every quirk is now a field on an `OAuthProviderProfile`.
+ * The flow reads exactly one resolved profile and contains no provider-name
+ * conditional.
+ *
+ * Profiles come from two layers:
+ *
+ * 1. Built-in profiles below, for the providers whose fences are security
+ *    invariants (hosted Slack MCP and official Gmail are personal-only, their
+ *    authorization servers are origin-pinned). These live in code as data so
+ *    the fences never depend on catalog import state.
+ * 2. A validated `oauthProfile` object on a global catalog row (curated
+ *    overlay -> importer -> `capability_catalog_items.metadata`). A catalog
+ *    profile applies only when no built-in matches, and it can only narrow the
+ *    default behavior, never loosen a built-in fence.
+ */
+export declare const OFFICIAL_SLACK_MCP_URL: "https://mcp.slack.com/mcp";
+export declare const OFFICIAL_GMAIL_MCP_URL = "https://gmailmcp.googleapis.com/mcp/v1";
+export declare const OFFICIAL_GMAIL_MCP_SCOPES: readonly ["https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.compose", "https://www.googleapis.com/auth/gmail.modify"];
+/** The slice of discovered authorization-server metadata the pins constrain. */
+export type PinnableAuthorizationServer = {
+    issuer: string;
+    authorizationServer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+};
+export type AuthorizationServerPins = {
+    /** Origins `issuer` and `authorizationServer` must both belong to. */
+    issuerOrigins: readonly string[];
+    /** Origins the authorization endpoint must belong to. */
+    authorizationEndpointOrigins: readonly string[];
+    /** Origins the token endpoint must belong to. */
+    tokenEndpointOrigins: readonly string[];
+    /** Exact 422 message when a pin fails. */
+    message: string;
+    /** Skip enforcement in a local test environment (loopback fixtures). */
+    skipInLocalTest: boolean;
+};
+export type OAuthProviderProfile = {
+    /** Stable identity for guards, logs, and tests. */
+    key: string;
+    /** Built-in matching; catalog profiles match their own row's exact mcpUrl. */
+    match: {
+        mcpUrls?: readonly string[];
+        providerDomains?: readonly string[];
+    };
+    /**
+     * Canonical provider identity forced when the profile matches by URL, so a
+     * caller cannot relabel a pinned resource under another domain.
+     */
+    canonicalProviderDomain?: string;
+    /** Reject a caller-supplied manual OAuth client (deployment-managed only). */
+    rejectCallerOAuthClient?: {
+        message: string;
+    };
+    /** The payload's explicit providerDomain must canonicalize to this domain. */
+    requireProviderDomain?: {
+        domain: string;
+        message: string;
+    };
+    /** Outside a local test environment, the start URL must be exactly this. */
+    requireExactMcpUrl?: {
+        url: string;
+        message: string;
+    };
+    /** Deployment-managed client credentials must be configured (503 otherwise). */
+    requireDeploymentClient?: {
+        key: DeploymentManagedClientKey;
+        message: string;
+    };
+    /** Ownerships a connection may take; a singleton also sets the default. */
+    allowedOwnership: readonly ConnectionOwnership[];
+    /** Exact 422 message when an explicit disallowed ownership is requested. */
+    ownershipMessage?: string;
+    /** Bind reconnect/dedupe to the exact mcpUrl, not just the provider domain. */
+    exactMcpBinding: boolean;
+    /** How an existing connection is chosen for reconnect coalescing. */
+    connectionSelection: "canonical_personal" | "first_active";
+    /** Post-discovery authorization-server origin pins. */
+    authorizationServer?: AuthorizationServerPins;
+    /**
+     * Post-discovery identity check: the resolved providerDomain must equal this
+     * domain (the reserved-authorization-server guard shares its message).
+     */
+    postDiscoveryProviderDomain?: {
+        domain: string;
+        message: string;
+    };
+    /**
+     * Client registration preference. `dcr` or `cimd` forces that advertised
+     * self-registration mechanism after operator/deployment clients. Without an
+     * explicit preference, DCR wins when both mechanisms are advertised.
+     */
+    clientSource?: "deployment_managed" | "cimd" | "dcr";
+    /** Send RFC 8707 `resource` on authorize and token requests. */
+    sendResourceParameter: boolean;
+    /** Extra authorize-URL query parameters (e.g. offline-consent opts). */
+    extraAuthorizeParams?: Readonly<Record<string, string>>;
+    /** Exact scope override; the caller can never widen past it. */
+    requestedScopes?: readonly string[];
+};
+export declare const DEFAULT_OAUTH_PROFILE: OAuthProviderProfile;
+/** Exact built-in profile by its stable key; throws on an unknown key. */
+export declare function builtInOAuthProfileByKey(key: string): OAuthProviderProfile;
+export type DeploymentManagedClientKey = "slack";
+/**
+ * Pre-registered deployment clients resolved from dedicated settings, keyed by
+ * the authorization-server origins they serve. Consulted before the operator
+ * clients JSON so a deployment-managed provider can never be shadowed.
+ */
+export declare const DEPLOYMENT_MANAGED_CLIENTS: readonly {
+    key: DeploymentManagedClientKey;
+    issuerOrigins: readonly string[];
+    resolve: (settings: Settings) => {
+        clientId: string;
+        clientSecret: string;
+        tokenEndpointAuthMethod: "client_secret_post";
+    } | null;
+}[];
+export declare function deploymentManagedClientFor(settings: Settings, key: DeploymentManagedClientKey): ReturnType<(typeof DEPLOYMENT_MANAGED_CLIENTS)[number]["resolve"]>;
+/** Built-in profile for a start target, or null when only the default applies. */
+export declare function builtInOAuthProfileFor(input: {
+    mcpUrl: string;
+    providerDomain?: string | undefined;
+}): OAuthProviderProfile | null;
+/** Ownership an omitted request defaults to under a profile. */
+export declare function defaultOwnershipFor(profile: OAuthProviderProfile): ConnectionOwnership;
+/** Rejects an ownership outside the profile's allowed set with its exact message. */
+export declare function assertOwnershipAllowed(profile: OAuthProviderProfile, ownership: ConnectionOwnership): void;
+/** Enforces a profile's authorization-server origin pins with its exact message. */
+export declare function assertAuthorizationServerPins(as: PinnableAuthorizationServer, pins: Pick<AuthorizationServerPins, "issuerOrigins" | "authorizationEndpointOrigins" | "tokenEndpointOrigins" | "message">): void;
+/**
+ * Reserved-authorization-server guard: a discovered identity claimed by one
+ * profile is rejected on every other flow with that guard's exact message.
+ */
+export declare function assertAuthorizationServerNotReserved(as: PinnableAuthorizationServer, profile: OAuthProviderProfile): void;
+/**
+ * Catalog-row profile: the declarative subset a curated row may carry. It can
+ * only narrow the default flow; the fields that grant authority (deployment
+ * client settings, reserved-server membership) are built-in-only by
+ * construction because the schema cannot express them.
+ */
+/**
+ * Authorize-URL parameters owned by the OAuth client itself. A profile's
+ * `extraAuthorizeParams` may never name one: overriding `scope` or `resource`
+ * would widen the grant past the recorded contract, and the rest carry the
+ * PKCE/state security machinery. Enforced in this schema, in the curation
+ * parser, and defensively again in `buildAuthorizationUrl`.
+ */
+export declare const RESERVED_AUTHORIZE_PARAMS: ReadonlySet<string>;
+export declare const catalogOAuthProfileSchema: z.ZodObject<{
+    clientSource: z.ZodOptional<z.ZodEnum<{
+        cimd: "cimd";
+        dcr: "dcr";
+        deployment_managed: "deployment_managed";
+    }>>;
+    exactMcpUrl: z.ZodOptional<z.ZodString>;
+    pinnedIssuerOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pinnedEndpointOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sendResourceParameter: z.ZodOptional<z.ZodBoolean>;
+    allowedOwnership: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        personal: "personal";
+        workspace: "workspace";
+    }>>>;
+    requestedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strict>;
+export type CatalogOAuthProfile = z.infer<typeof catalogOAuthProfileSchema>;
+/**
+ * Canonical catalog lookup key for an MCP URL, mirroring the importer's
+ * `canonicalMcpUrl` (`scripts/catalog-curation.ts`): no fragment, lowercase
+ * host, default ports stripped, trailing slashes collapsed. Without this, a
+ * trailing-slash or uppercase-host variant of a profiled URL would miss the
+ * row and silently fall back to the default profile.
+ */
+export declare function catalogMcpUrlKey(value: string): string;
+/**
+ * Applies a validated catalog profile over the default profile for a row with
+ * no built-in. `deployment_managed` from catalog data resolves through the
+ * operator clients JSON (issuer-keyed) only; named settings-backed clients
+ * remain built-in-only.
+ *
+ * A present-but-invalid profile fails closed with a 422: the row's operator
+ * declared constraints, and silently degrading to the default profile would
+ * drop an ownership fence or origin pin on a JSON typo.
+ */
+export declare function oauthProfileFromCatalog(mcpUrl: string, raw: unknown): OAuthProviderProfile;

package/dist/integrations/personal-github-repositories.d.ts

@@ -0,0 +1,45 @@
+import { type PersonalGitHubRepository as PersonalGitHubRepositoryContract, type PersonalGitHubRepositorySelectionInput } from "@opengeni/contracts/personal-github";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { getConnectionMetadata } from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+export type PersonalGitHubRepositoryConnection = NonNullable<Awaited<ReturnType<typeof getConnectionMetadata>>>;
+export type PersonalGitHubRepositoryProviderErrorCode = "connection_changed" | "connection_inactive" | "invalid_provider_response" | "provider_denied" | "provider_rate_limited" | "provider_unavailable" | "repository_archived" | "repository_not_found" | "repository_read_denied" | "repository_write_denied";
+export declare class PersonalGitHubRepositoryProviderError extends Error {
+    readonly code: PersonalGitHubRepositoryProviderErrorCode;
+    constructor(code: PersonalGitHubRepositoryProviderErrorCode);
+}
+export declare function requirePersonalGitHubRepositoryConnection(deps: ApiRouteDeps, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+}): Promise<PersonalGitHubRepositoryConnection>;
+export declare function listLivePersonalGitHubRepositories(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    expectedConnectionAuthorityGeneration: number;
+    page: number;
+    limit: number;
+}): Promise<{
+    repositories: PersonalGitHubRepositoryContract[];
+    nextPage: number | null;
+}>;
+/** Serial by design: one bounded provider request and one authority check at a time. */
+export declare function verifyLivePersonalGitHubRepositories(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    accountId: string;
+    subjectId: string;
+    connectionId: string;
+    expectedConnectionAuthorityGeneration: number;
+    repositories: PersonalGitHubRepositorySelectionInput[];
+}): Promise<Array<PersonalGitHubRepositoryContract & {
+    selectedAccess: "read" | "write";
+}>>;
+export declare function personalGitHubRepositoryProviderHttpError(error: PersonalGitHubRepositoryProviderError): HTTPException;
+/** Keep provider integer lexemes exact before repository IDs become bigint-backed strings. */
+export declare function parsePersonalGitHubProviderJson(value: string): unknown;
+export declare function personalGitHubRepositoryCanRead(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
+export declare function personalGitHubRepositoryCanWrite(permissions: PersonalGitHubRepositoryContract["permissions"]): boolean;
+export declare function parsePersonalGitHubRepository(value: unknown): PersonalGitHubRepositoryContract;

package/dist/integrations/personal-github.d.ts

@@ -0,0 +1,40 @@
+import { type Settings } from "@opengeni/config";
+import { type PersonalGitHubDisconnectRequest } from "@opengeni/contracts/personal-github";
+import { type AccessGrantAuthorization, type ApiRouteDeps } from "@opengeni/core";
+export declare function personalGitHubClientMarker(clientId: string): string;
+export declare function requirePersonalGitHubOAuthSettings(settings: Settings): {
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+    oauthEnvironment: string;
+    oauthClientMarker: string;
+};
+export declare function listPersonalGitHubConnections(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    subjectId: string;
+}): Promise<import("@opengeni/db").ConnectionMetadataWithVerification[]>;
+export declare function disconnectPersonalGitHub(deps: ApiRouteDeps, input: {
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    payload: PersonalGitHubDisconnectRequest;
+}): Promise<import("@opengeni/db").ConnectionMetadataWithVerification | null>;
+export declare function startPersonalGitHubOAuth(deps: ApiRouteDeps, input: {
+    access: AccessGrantAuthorization;
+    workspaceId: string;
+    connectionId?: string;
+    returnPath?: string;
+}): Promise<{
+    authorizationUrl: string;
+    expiresAt: string;
+}>;
+export declare function completePersonalGitHubOAuthCallback(deps: ApiRouteDeps, input: {
+    code?: string;
+    state?: string;
+    error?: string;
+    requestUrl: string;
+}): Promise<{
+    redirectTo: string;
+}>;
+export declare function personalGitHubReviewUrl(settings: Settings): string | null;
+export declare const PERSONAL_GITHUB_CONNECTION_PRINCIPAL_MESSAGE: string;

package/dist/integrations/pr-review-provider.d.ts

@@ -0,0 +1,22 @@
+import type { PrReviewProvider } from "@opengeni/contracts";
+import { type FetchLike, type OutboundNetworkSettings } from "@opengeni/network";
+export declare class PrReviewProviderRepositoryError extends Error {
+    readonly reason: "denied" | "identity_mismatch" | "unavailable";
+    constructor(reason: "denied" | "identity_mismatch" | "unavailable", message: string);
+}
+export type VerifiedPrReviewProviderRepository = {
+    repositoryUri: string;
+    repositoryFullName: string;
+    providerRepositoryId: string;
+    projectId: string;
+};
+export declare function verifyPrReviewProviderRepository(input: {
+    provider: Exclude<PrReviewProvider, "github">;
+    providerBaseUrl: string;
+    providerRepositoryId: string;
+    projectId?: string;
+    token: string;
+    username: string | null;
+    settings: OutboundNetworkSettings;
+    fetchImpl?: FetchLike;
+}): Promise<VerifiedPrReviewProviderRepository>;

package/dist/integrations/provider-oauth.d.ts

@@ -1,9 +1,16 @@
+import { type Settings } from "@opengeni/config";
 import { OAuthStartResponse, type ApiIntegrationOAuthStartRequest } from "@opengeni/contracts";
 import { type ApiRouteDeps } from "@opengeni/core";
 export declare function startApiIntegrationProviderOAuth(deps: ApiRouteDeps, input: {
     accountId: string;
     workspaceId: string;
     subjectId: string;
+    /**
+     * False for every principal that cannot own a personal Connection (API
+     * keys, the configured key, services, agent attempts). Resolved by the
+     * route from the live authenticated principal, never inferred here.
+     */
+    personalOwnershipAllowed: boolean;
     requestUrl: string;
     payload: ApiIntegrationOAuthStartRequest;
 }): Promise<OAuthStartResponse>;
@@ -15,3 +22,4 @@ export declare function completeApiIntegrationProviderOAuth(deps: ApiRouteDeps,
 }): Promise<{
     redirectTo: string;
 }>;
+export declare function isApiIntegrationProviderOAuthState(value: string | undefined, settings: Settings): boolean;

package/dist/integrations/slack-app-home.d.ts

@@ -0,0 +1,24 @@
+import type { Session } from "@opengeni/contracts";
+import type { SlackHomeBlock } from "./slack-bot.js";
+export type SlackAppHomeOpenedEvent = {
+    eventId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    viewHash: string | null;
+};
+export declare function slackAppHomeOpenedEvent(payload: unknown): SlackAppHomeOpenedEvent | null;
+/** URL-only App Home buttons are acknowledged but never become Slack commands. */
+export declare function isSlackAppHomeLinkAction(payload: unknown): boolean;
+export declare function buildSlackAppHomeBlocks(input: {
+    sessions: readonly Session[];
+    workspaceUrl: string | null;
+    sessionUrl: (sessionId: string) => string | null;
+    nowMs?: number;
+}): SlackHomeBlock[];
+export declare function buildSlackAppHomeAccessBlocks(input: {
+    title: string;
+    message: string;
+    actionLabel?: string;
+    actionUrl?: string | null;
+}): SlackHomeBlock[];
+export declare function escapeSlackMrkdwn(value: string): string;