@opengeni/api-router 0.4.1 → 0.5.0

package/dist/{chunk-2JL5OXRE.js → chunk-DQ5TIRDZ.js}

@@ -12,8 +12,8 @@ import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { HTTPException as HTTPException18 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
+import { HTTPException as HTTPException20 } from "hono/http-exception";
+import { hasPermission as hasPermission4, requireAccessGrant as requireAccessGrant16, requirePermission } from "@opengeni/core";
 
 // src/auth/managed-auth.ts
 import { ensureManagedAccessForUser } from "@opengeni/db";
@@ -494,8 +494,9 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   });
   const json = (value) => ({ content: [{ type: "text", text: JSON.stringify(value, null, 2) }] });
   const can = (permission) => hasPermission(grant.permissions, permission);
+  const toolspaceMode = options.toolspace != null;
   const sessionId = typeof grant.metadata?.["sessionId"] === "string" ? grant.metadata["sessionId"] : null;
-  if (sessionId !== null) {
+  if (sessionId !== null && (!toolspaceMode || can("sessions:control"))) {
     server.registerTool("set_session_title", {
       description: "Set this session's display title to a concise 3-7 word summary. Call once early to name the session; calling again replaces it unless a human has manually set the title.",
       inputSchema: { title: z4.string().min(1).max(200) }
@@ -507,7 +508,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   if (sessionId !== null && can("goals:manage")) {
     registerGoalTools(server, deps, grant, sessionId, json);
   }
-  if (sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
+  if (!toolspaceMode && sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
     registerFleetTools(server, deps, grant, sessionId, json);
   }
   registerWorkspaceOrchestrationTools(server, deps, grant, can, json);
@@ -518,225 +519,253 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
       registerGitHubTokenTool(server, deps, grant, sessionId, json);
     }
   }
-  server.registerTool("files_get_download_url", {
-    description: "Create a short-lived download URL for a ready file asset.",
-    inputSchema: { fileId: z4.string().uuid() }
-  }, async ({ fileId }) => {
-    if (!deps.objectStorage) {
-      throw new Error("object storage is not configured");
-    }
-    const file = await requireFile(deps.db, grant.workspaceId, fileId);
-    if (file.status !== "ready") {
-      throw new Error(`file is ${file.status}`);
-    }
-    const signed = await deps.objectStorage.createGetUrl({ key: file.objectKey });
-    return json({
-      file: {
-        id: file.id,
-        filename: file.filename,
-        safeFilename: file.safeFilename,
-        contentType: file.contentType,
-        sizeBytes: file.sizeBytes,
-        sha256: file.sha256,
-        status: file.status,
-        createdAt: file.createdAt,
-        updatedAt: file.updatedAt
-      },
-      downloadUrl: {
-        url: signed.url,
-        expiresAt: signed.expiresAt.toISOString()
+  if (!toolspaceMode || can("files:read")) {
+    server.registerTool("files_get_download_url", {
+      description: "Create a short-lived download URL for a ready file asset.",
+      inputSchema: { fileId: z4.string().uuid() }
+    }, async ({ fileId }) => {
+      if (!deps.objectStorage) {
+        throw new Error("object storage is not configured");
       }
+      const file = await requireFile(deps.db, grant.workspaceId, fileId);
+      if (file.status !== "ready") {
+        throw new Error(`file is ${file.status}`);
+      }
+      const signed = await deps.objectStorage.createGetUrl({ key: file.objectKey });
+      return json({
+        file: {
+          id: file.id,
+          filename: file.filename,
+          safeFilename: file.safeFilename,
+          contentType: file.contentType,
+          sizeBytes: file.sizeBytes,
+          sha256: file.sha256,
+          status: file.status,
+          createdAt: file.createdAt,
+          updatedAt: file.updatedAt
+        },
+        downloadUrl: {
+          url: signed.url,
+          expiresAt: signed.expiresAt.toISOString()
+        }
+      });
     });
-  });
-  server.registerTool("github_repositories_list", {
-    description: "List GitHub App repositories available as scheduled task repository resources. Use the returned resource object in scheduled task agentConfig.resources.",
-    inputSchema: { limit: z4.number().int().positive().optional() }
-  }, async ({ limit }) => {
-    try {
-      const installationIds = await listGitHubInstallationIdsForWorkspace(deps.db, grant.workspaceId);
-      const repositories = await listGitHubAppRepositories(deps.settings, { installationIds });
-      const visible = typeof limit === "number" ? repositories.slice(0, limit) : repositories;
-      return json({ repositories: visible.map((repository) => repositoryWithScheduledTaskResource(repository)) });
-    } catch (error) {
-      if (error instanceof GitHubAppConfigurationError) {
-        throw new Error(`GitHub App is not configured: ${error.missing.join(", ")}`);
+  }
+  if (!toolspaceMode || can("github:use")) {
+    server.registerTool("github_repositories_list", {
+      description: "List GitHub App repositories available as scheduled task repository resources. Use the returned resource object in scheduled task agentConfig.resources.",
+      inputSchema: { limit: z4.number().int().positive().optional() }
+    }, async ({ limit }) => {
+      try {
+        const installationIds = await listGitHubInstallationIdsForWorkspace(deps.db, grant.workspaceId);
+        const repositories = await listGitHubAppRepositories(deps.settings, { installationIds });
+        const visible = typeof limit === "number" ? repositories.slice(0, limit) : repositories;
+        return json({ repositories: visible.map((repository) => repositoryWithScheduledTaskResource(repository)) });
+      } catch (error) {
+        if (error instanceof GitHubAppConfigurationError) {
+          throw new Error(`GitHub App is not configured: ${error.missing.join(", ")}`);
+        }
+        throw error;
       }
-      throw error;
-    }
-  });
-  server.registerTool("social_connections_list", {
-    description: "List connected social media accounts available to social media analysis packs.",
-    inputSchema: { limit: z4.number().int().positive().optional() }
-  }, async ({ limit }) => json({ connections: await listSocialConnections(deps.db, grant.workspaceId, boundedMcpLimit(limit)) }));
-  server.registerTool("social_posts_recent", {
-    description: "List recent social media posts imported or synced into OpenGeni.",
-    inputSchema: {
-      connectionIds: z4.array(z4.string().uuid()).optional(),
-      since: z4.string().optional(),
-      windowHours: z4.number().int().positive().optional(),
-      limit: z4.number().int().positive().optional()
-    }
-  }, async ({ connectionIds, since, windowHours, limit }) => {
-    const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
-    return json({
-      since: sinceDate.toISOString(),
-      posts: await listSocialPosts(deps.db, {
+    });
+  }
+  if (!toolspaceMode || can("connections:read")) {
+    server.registerTool("social_connections_list", {
+      description: "List connected social media accounts available to social media analysis packs.",
+      inputSchema: { limit: z4.number().int().positive().optional() }
+    }, async ({ limit }) => json({ connections: await listSocialConnections(deps.db, grant.workspaceId, boundedMcpLimit(limit)) }));
+    server.registerTool("social_posts_recent", {
+      description: "List recent social media posts imported or synced into OpenGeni.",
+      inputSchema: {
+        connectionIds: z4.array(z4.string().uuid()).optional(),
+        since: z4.string().optional(),
+        windowHours: z4.number().int().positive().optional(),
+        limit: z4.number().int().positive().optional()
+      }
+    }, async ({ connectionIds, since, windowHours, limit }) => {
+      const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
+      return json({
+        since: sinceDate.toISOString(),
+        posts: await listSocialPosts(deps.db, {
+          workspaceId: grant.workspaceId,
+          ...connectionIds?.length ? { connectionIds } : {},
+          since: sinceDate,
+          limit: boundedMcpLimit(limit)
+        })
+      });
+    });
+    server.registerTool("social_daily_analysis_context", {
+      description: "Collect social account and recent post context for a daily marketing analysis run.",
+      inputSchema: {
+        connectionIds: z4.array(z4.string().uuid()).optional(),
+        documentBaseIds: z4.array(z4.string().uuid()).optional(),
+        since: z4.string().optional(),
+        windowHours: z4.number().int().positive().optional(),
+        limit: z4.number().int().positive().optional()
+      }
+    }, async ({ connectionIds, documentBaseIds, since, windowHours, limit }) => {
+      const allConnections = await listSocialConnections(deps.db, grant.workspaceId, 500);
+      const selectedIds = connectionIds && connectionIds.length > 0 ? new Set(connectionIds) : null;
+      const connections = selectedIds ? allConnections.filter((connection) => selectedIds.has(connection.id)) : allConnections.filter((connection) => connection.status === "connected");
+      if (selectedIds) {
+        const foundIds = new Set(connections.map((connection) => connection.id));
+        const missing = [...selectedIds].filter((id) => !foundIds.has(id));
+        if (missing.length > 0) {
+          throw new Error(`Unknown social connection IDs: ${missing.join(", ")}`);
+        }
+      }
+      const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
+      const posts = connections.length > 0 ? await listSocialPosts(deps.db, {
         workspaceId: grant.workspaceId,
-        ...connectionIds?.length ? { connectionIds } : {},
+        connectionIds: connections.map((connection) => connection.id),
         since: sinceDate,
         limit: boundedMcpLimit(limit)
-      })
+      }) : [];
+      return json({
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        window: {
+          since: sinceDate.toISOString(),
+          until: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        documentBaseIds: documentBaseIds ?? [],
+        connections,
+        posts,
+        instructions: [
+          "Use docs MCP search tools for the supplied documentBaseIds when brand, campaign, or audience knowledge is needed.",
+          "Report data gaps explicitly when posts or metrics are missing.",
+          "Do not infer unpublished metrics or hidden platform data."
+        ]
+      });
     });
-  });
-  server.registerTool("social_daily_analysis_context", {
-    description: "Collect social account and recent post context for a daily marketing analysis run.",
-    inputSchema: {
-      connectionIds: z4.array(z4.string().uuid()).optional(),
-      documentBaseIds: z4.array(z4.string().uuid()).optional(),
-      since: z4.string().optional(),
-      windowHours: z4.number().int().positive().optional(),
-      limit: z4.number().int().positive().optional()
-    }
-  }, async ({ connectionIds, documentBaseIds, since, windowHours, limit }) => {
-    const allConnections = await listSocialConnections(deps.db, grant.workspaceId, 500);
-    const selectedIds = connectionIds && connectionIds.length > 0 ? new Set(connectionIds) : null;
-    const connections = selectedIds ? allConnections.filter((connection) => selectedIds.has(connection.id)) : allConnections.filter((connection) => connection.status === "connected");
-    if (selectedIds) {
-      const foundIds = new Set(connections.map((connection) => connection.id));
-      const missing = [...selectedIds].filter((id) => !foundIds.has(id));
-      if (missing.length > 0) {
-        throw new Error(`Unknown social connection IDs: ${missing.join(", ")}`);
+  }
+  if (!toolspaceMode || can("scheduled_tasks:manage") || can("scheduled_tasks:run")) {
+    server.registerTool("scheduled_tasks_list", {
+      description: "List scheduled tasks.",
+      inputSchema: { limit: z4.number().int().positive().optional() }
+    }, async ({ limit }) => json({ tasks: await listScheduledTasks(deps.db, grant.workspaceId, limit ?? 100) }));
+    server.registerTool("scheduled_tasks_get", {
+      description: "Get one scheduled task.",
+      inputSchema: { id: z4.string().uuid() }
+    }, async ({ id }) => json(await requireScheduledTask(deps.db, grant.workspaceId, id)));
+    server.registerTool("scheduled_tasks_create", {
+      description: "Create a scheduled task.",
+      inputSchema: {
+        name: z4.string(),
+        schedule: z4.unknown(),
+        runMode: z4.string().optional(),
+        overlapPolicy: z4.string().optional(),
+        agentConfig: z4.unknown(),
+        status: z4.string().optional(),
+        environmentId: z4.string().uuid().optional(),
+        metadata: z4.record(z4.string(), z4.unknown()).optional()
       }
-    }
-    const sinceDate = since ? parseMcpDate(since, "since") : new Date(Date.now() - (windowHours ?? 24) * 60 * 60 * 1e3);
-    const posts = connections.length > 0 ? await listSocialPosts(deps.db, {
-      workspaceId: grant.workspaceId,
-      connectionIds: connections.map((connection) => connection.id),
-      since: sinceDate,
-      limit: boundedMcpLimit(limit)
-    }) : [];
-    return json({
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      window: {
-        since: sinceDate.toISOString(),
-        until: (/* @__PURE__ */ new Date()).toISOString()
-      },
-      documentBaseIds: documentBaseIds ?? [],
-      connections,
-      posts,
-      instructions: [
-        "Use docs MCP search tools for the supplied documentBaseIds when brand, campaign, or audience knowledge is needed.",
-        "Report data gaps explicitly when posts or metrics are missing.",
-        "Do not infer unpublished metrics or hidden platform data."
-      ]
+    }, async (args) => {
+      const payload = CreateScheduledTaskRequest.parse(args);
+      requireEnvironmentsUseForMcpAttachment(grant, payload.environmentId);
+      await requireLimit(deps, { accountId: grant.accountId, workspaceId: grant.workspaceId, action: "schedule:create", quantity: 1 });
+      const task = await createValidatedScheduledTask({ settings: deps.settings, db: deps.db, objectStorage: deps.objectStorage, grant, payload, toolsProvided: scheduledTaskToolsProvided(args) });
+      await syncCreatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, task });
+      return json(task);
     });
-  });
-  server.registerTool("scheduled_tasks_list", {
-    description: "List scheduled tasks.",
-    inputSchema: { limit: z4.number().int().positive().optional() }
-  }, async ({ limit }) => json({ tasks: await listScheduledTasks(deps.db, grant.workspaceId, limit ?? 100) }));
-  server.registerTool("scheduled_tasks_get", {
-    description: "Get one scheduled task.",
-    inputSchema: { id: z4.string().uuid() }
-  }, async ({ id }) => json(await requireScheduledTask(deps.db, grant.workspaceId, id)));
-  server.registerTool("scheduled_tasks_create", {
-    description: "Create a scheduled task.",
-    inputSchema: {
-      name: z4.string(),
-      schedule: z4.unknown(),
-      runMode: z4.string().optional(),
-      overlapPolicy: z4.string().optional(),
-      agentConfig: z4.unknown(),
-      status: z4.string().optional(),
-      environmentId: z4.string().uuid().optional(),
-      metadata: z4.record(z4.string(), z4.unknown()).optional()
-    }
-  }, async (args) => {
-    const payload = CreateScheduledTaskRequest.parse(args);
-    requireEnvironmentsUseForMcpAttachment(grant, payload.environmentId);
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId: grant.workspaceId, action: "schedule:create", quantity: 1 });
-    const task = await createValidatedScheduledTask({ settings: deps.settings, db: deps.db, objectStorage: deps.objectStorage, grant, payload, toolsProvided: scheduledTaskToolsProvided(args) });
-    await syncCreatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, task });
-    return json(task);
-  });
-  server.registerTool("scheduled_tasks_update", {
-    description: "Update a scheduled task.",
-    inputSchema: {
-      id: z4.string().uuid(),
-      name: z4.string().optional(),
-      schedule: z4.unknown().optional(),
-      runMode: z4.string().optional(),
-      overlapPolicy: z4.string().optional(),
-      agentConfig: z4.unknown().optional(),
-      status: z4.string().optional(),
-      environmentId: z4.string().uuid().nullable().optional(),
-      metadata: z4.record(z4.string(), z4.unknown()).optional()
-    }
-  }, async ({ id, ...raw }) => {
-    const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
-    const payload = UpdateScheduledTaskRequest.parse(raw);
-    requireEnvironmentsUseForMcpAttachment(grant, payload.environmentId);
-    const update = await validatedScheduledTaskUpdate({ settings: deps.settings, db: deps.db, objectStorage: deps.objectStorage, grant, existing, payload, toolsProvided: scheduledTaskToolsProvided(raw) });
-    const task = await updateScheduledTask(deps.db, grant.workspaceId, id, update);
-    await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
-    return json(task);
-  });
-  server.registerTool("scheduled_tasks_pause", {
-    description: "Pause a scheduled task.",
-    inputSchema: { id: z4.string().uuid() }
-  }, async ({ id }) => {
-    const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
-    const task = await updateScheduledTask(deps.db, grant.workspaceId, id, { status: "paused" });
-    await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
-    return json(task);
-  });
-  server.registerTool("scheduled_tasks_resume", {
-    description: "Resume a scheduled task.",
-    inputSchema: { id: z4.string().uuid() }
-  }, async ({ id }) => {
-    const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
-    const task = await updateScheduledTask(deps.db, grant.workspaceId, id, { status: "active" });
-    await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
-    return json(task);
-  });
-  server.registerTool("scheduled_tasks_trigger", {
-    description: "Trigger a scheduled task immediately. Pass a stable triggerId to make a retried trigger idempotent (one charge, one run).",
-    inputSchema: { id: z4.string().uuid(), triggerId: z4.string().min(1).max(128).optional() }
-  }, async ({ id, triggerId }) => {
-    const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId: grant.workspaceId, action: "agent_run:create", quantity: 1, model: task.agentConfig.model ?? deps.settings.openaiModel });
-    const triggerToken = scheduledTaskTriggerToken(triggerId);
-    const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(grant.workspaceId, task.id, triggerToken);
-    const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
-    await deps.workflowClient.triggerScheduledTask({ task, agentRunUsageIdempotencyKey, triggerWorkflowId });
-    await recordWorkspaceUsage(deps, {
-      accountId: grant.accountId,
-      workspaceId: grant.workspaceId,
-      subjectId: grant.subjectId,
-      eventType: "agent_run.created",
-      quantity: 1,
-      unit: "run",
-      sourceResourceType: "scheduled_task",
-      sourceResourceId: task.id,
-      idempotencyKey: agentRunUsageIdempotencyKey
+    server.registerTool("scheduled_tasks_update", {
+      description: "Update a scheduled task.",
+      inputSchema: {
+        id: z4.string().uuid(),
+        name: z4.string().optional(),
+        schedule: z4.unknown().optional(),
+        runMode: z4.string().optional(),
+        overlapPolicy: z4.string().optional(),
+        agentConfig: z4.unknown().optional(),
+        status: z4.string().optional(),
+        environmentId: z4.string().uuid().nullable().optional(),
+        metadata: z4.record(z4.string(), z4.unknown()).optional()
+      }
+    }, async ({ id, ...raw }) => {
+      const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+      const payload = UpdateScheduledTaskRequest.parse(raw);
+      requireEnvironmentsUseForMcpAttachment(grant, payload.environmentId);
+      const update = await validatedScheduledTaskUpdate({ settings: deps.settings, db: deps.db, objectStorage: deps.objectStorage, grant, existing, payload, toolsProvided: scheduledTaskToolsProvided(raw) });
+      const task = await updateScheduledTask(deps.db, grant.workspaceId, id, update);
+      await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
+      return json(task);
+    });
+    server.registerTool("scheduled_tasks_pause", {
+      description: "Pause a scheduled task.",
+      inputSchema: { id: z4.string().uuid() }
+    }, async ({ id }) => {
+      const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+      const task = await updateScheduledTask(deps.db, grant.workspaceId, id, { status: "paused" });
+      await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
+      return json(task);
+    });
+    server.registerTool("scheduled_tasks_resume", {
+      description: "Resume a scheduled task.",
+      inputSchema: { id: z4.string().uuid() }
+    }, async ({ id }) => {
+      const existing = await requireScheduledTask(deps.db, grant.workspaceId, id);
+      const task = await updateScheduledTask(deps.db, grant.workspaceId, id, { status: "active" });
+      await syncUpdatedScheduledTask({ db: deps.db, workflowClient: deps.workflowClient, previous: existing, task });
+      return json(task);
+    });
+    server.registerTool("scheduled_tasks_trigger", {
+      description: "Trigger a scheduled task immediately. Pass a stable triggerId to make a retried trigger idempotent (one charge, one run).",
+      inputSchema: { id: z4.string().uuid(), triggerId: z4.string().min(1).max(128).optional() }
+    }, async ({ id, triggerId }) => {
+      const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
+      await requireLimit(deps, { accountId: grant.accountId, workspaceId: grant.workspaceId, action: "agent_run:create", quantity: 1, model: task.agentConfig.model ?? deps.settings.openaiModel });
+      const triggerToken = scheduledTaskTriggerToken(triggerId);
+      const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey(grant.workspaceId, task.id, triggerToken);
+      const triggerWorkflowId = manualScheduledTaskTriggerWorkflowId(task.id, triggerToken);
+      await deps.workflowClient.triggerScheduledTask({ task, agentRunUsageIdempotencyKey, triggerWorkflowId });
+      await recordWorkspaceUsage(deps, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        subjectId: grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "scheduled_task",
+        sourceResourceId: task.id,
+        idempotencyKey: agentRunUsageIdempotencyKey
+      });
+      return json(task);
+    });
+    server.registerTool("scheduled_tasks_delete", {
+      description: "Delete a scheduled task.",
+      inputSchema: { id: z4.string().uuid() }
+    }, async ({ id }) => {
+      const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
+      await deps.workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId: task.temporalScheduleId });
+      await deleteScheduledTask(deps.db, grant.workspaceId, id);
+      return json({ ok: true });
     });
-    return json(task);
-  });
-  server.registerTool("scheduled_tasks_delete", {
-    description: "Delete a scheduled task.",
-    inputSchema: { id: z4.string().uuid() }
-  }, async ({ id }) => {
-    const task = await requireScheduledTask(deps.db, grant.workspaceId, id);
-    await deps.workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId: task.temporalScheduleId });
-    await deleteScheduledTask(deps.db, grant.workspaceId, id);
-    return json({ ok: true });
-  });
-  server.registerTool("scheduled_task_runs_list", {
-    description: "List runs for a scheduled task.",
-    inputSchema: { taskId: z4.string().uuid(), limit: z4.number().int().positive().optional() }
-  }, async ({ taskId, limit }) => json({ runs: await listScheduledTaskRuns(deps.db, grant.workspaceId, taskId, limit ?? 100) }));
+    server.registerTool("scheduled_task_runs_list", {
+      description: "List runs for a scheduled task.",
+      inputSchema: { taskId: z4.string().uuid(), limit: z4.number().int().positive().optional() }
+    }, async ({ taskId, limit }) => json({ runs: await listScheduledTaskRuns(deps.db, grant.workspaceId, taskId, limit ?? 100) }));
+  }
+  registerToolspaceProxyTools(server, options.toolspace ?? null);
   return server;
 }
+function registerToolspaceProxyTools(server, surface) {
+  if (!surface) {
+    return;
+  }
+  for (const tool of surface.tools) {
+    server.registerTool(tool.name, {
+      ...tool.description ? { description: tool.description } : {},
+      inputSchema: z4.object({}).passthrough(),
+      _meta: {
+        opengeni: {
+          origin: "toolspace",
+          subjectId: surface.subjectId,
+          sessionId: surface.sessionId,
+          ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {}
+        }
+      }
+    }, async (args) => await tool.call(args));
+  }
+}
 function registerGoalTools(server, deps, grant, sessionId, json) {
   server.registerTool("goal_set", {
     description: "Set or replace this session's goal. While a goal is active the session keeps working: idle moments synthesize continuation turns until goal_complete or goal_pause is called. Replacing a goal reactivates it and resets the continuation budget.",
@@ -1216,6 +1245,448 @@ function parseMcpDate(raw, label) {
   return date;
 }
 
+// src/mcp/toolspace.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { prefixedMcpToolName } from "@opengeni/contracts";
+import { hasPermission as hasPermission2, settingsWithEnabledCapabilityMcpServers } from "@opengeni/core";
+import {
+  buildConnectionTokenResolver,
+  listSessionMcpServerMetadata,
+  listSessionMcpServersForRun,
+  requireSession as requireSession2,
+  reserveToolspaceCallForTurn
+} from "@opengeni/db";
+import { appendAndPublishEvents as appendAndPublishEvents2 } from "@opengeni/events";
+var APPROVAL_REQUIRED_MESSAGE = "requires approval - invoke via the agent";
+var TOOLSPACE_AUTH_NEEDED_ERROR_CODE = -32001;
+var TOOLSPACE_AUTH_NEEDED_MESSAGE = "Authentication required - a connection link was posted to the session.";
+var TOOLSPACE_NO_ACTIVE_TURN_MESSAGE = "no active turn - toolspace calls require an in-flight turn";
+var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs"]);
+var TOOLSPACE_TOOL_LIST_TTL_MS = 3e4;
+var TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES = 2e3;
+var toolListCache = /* @__PURE__ */ new Map();
+function isToolspaceGrant(settings, grant) {
+  return settings.toolspaceEnabled && hasPermission2(grant.permissions, "toolspace:call") && typeof grant.metadata?.sessionId === "string";
+}
+async function prepareToolspaceMcpSurface(input) {
+  const { deps, grant } = input;
+  if (!isToolspaceGrant(deps.settings, grant)) {
+    return null;
+  }
+  const sessionId = grant.metadata.sessionId;
+  const session = await requireSession2(deps.db, grant.workspaceId, sessionId);
+  const selectedIds = selectedMcpServerIds(session.tools, session.mcpServers.map((server) => server.id));
+  const proxyableIds = [...selectedIds].filter((id) => toolspaceCanProxyServerId(id));
+  if (proxyableIds.length === 0) {
+    return emptyToolspaceSurface(sessionId, grant.subjectId);
+  }
+  let registryPromise = null;
+  const getRegistry = () => registryPromise ??= buildToolspaceRegistry(deps, grant.workspaceId, sessionId);
+  const listing = await resolveToolListing({
+    deps,
+    grant,
+    sessionId,
+    proxyableIds,
+    activeTurnId: session.activeTurnId ?? null,
+    getRegistry
+  });
+  const tools = listing.map((entry) => toolspaceToolFor({ deps, grant, sessionId, entry, getRegistry }));
+  return {
+    sessionId,
+    subjectId: grant.subjectId,
+    tools,
+    // Connections are opened lazily and closed inline (per listing pass, per
+    // call), so there is nothing persistent to tear down here.
+    close: async () => {
+    }
+  };
+}
+function emptyToolspaceSurface(sessionId, subjectId) {
+  return { sessionId, subjectId, tools: [], close: async () => {
+  } };
+}
+async function buildToolspaceRegistry(deps, workspaceId, sessionId) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(deps.db, workspaceId, deps.settings);
+  const withSessionServers = await settingsWithSessionMcpServersForToolspace(deps, workspaceId, sessionId, runtimeSettings);
+  return new Map(withSessionServers.mcpServers.map((server) => [server.id, server]));
+}
+async function resolveToolListing(input) {
+  const { deps, grant, sessionId, proxyableIds, activeTurnId, getRegistry } = input;
+  const cacheKey = await toolListCacheKey(deps, grant.workspaceId, sessionId, proxyableIds);
+  const cached = readToolListCache(cacheKey);
+  if (cached) {
+    return cached;
+  }
+  if (!activeTurnId) {
+    return [];
+  }
+  const registry = await getRegistry();
+  const entries = [];
+  for (const serverId of proxyableIds) {
+    const config = registry.get(serverId);
+    if (!config || !toolspaceCanProxyServer(config)) {
+      continue;
+    }
+    const connection = await connectToolspaceServer({ deps, grant, config, sessionId }).catch(() => null);
+    if (!connection) {
+      continue;
+    }
+    try {
+      const listed = await connection.client.listTools(void 0, toolspaceRequestOptions(config)).catch(() => ({ tools: [] }));
+      for (const tool of listed.tools) {
+        if (!tool?.name || !allowedByConfig(config, tool.name)) {
+          continue;
+        }
+        entries.push({ serverId, tool, requireApproval: config.requireApproval });
+      }
+    } finally {
+      await connection.close();
+    }
+  }
+  writeToolListCache(cacheKey, entries);
+  return entries;
+}
+async function toolListCacheKey(deps, workspaceId, sessionId, proxyableIds) {
+  const metadata = await listSessionMcpServerMetadata(deps.db, workspaceId, sessionId);
+  const versions = new Map(metadata.map((server) => [server.id, server.credentialVersion]));
+  const signature = proxyableIds.slice().sort().map((id) => `${id}@${versions.get(id) ?? 0}`).join(",");
+  return `${workspaceId}:${sessionId}:${signature}`;
+}
+function readToolListCache(key) {
+  const hit = toolListCache.get(key);
+  if (!hit) {
+    return null;
+  }
+  if (hit.expiresAt <= Date.now()) {
+    toolListCache.delete(key);
+    return null;
+  }
+  return hit.entries;
+}
+function writeToolListCache(key, entries) {
+  if (toolListCache.size >= TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES) {
+    const now = Date.now();
+    for (const [existingKey, value] of toolListCache) {
+      if (value.expiresAt <= now) {
+        toolListCache.delete(existingKey);
+      }
+    }
+    if (toolListCache.size >= TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES) {
+      toolListCache.clear();
+    }
+  }
+  toolListCache.set(key, { expiresAt: Date.now() + TOOLSPACE_TOOL_LIST_TTL_MS, entries });
+}
+async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sessionId, settings) {
+  const encryptionKey = environmentsEncryptionKeyBytes(settings);
+  if (!encryptionKey) {
+    const metadata = await listSessionMcpServerMetadata(deps.db, workspaceId, sessionId);
+    if (metadata.length === 0) {
+      return settings;
+    }
+    throw new Error("session MCP server credentials require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY");
+  }
+  const servers = await listSessionMcpServersForRun(deps.db, workspaceId, sessionId, encryptionKey);
+  if (servers.length === 0) {
+    return settings;
+  }
+  const sessionIds = new Set(servers.map((server) => server.id));
+  return {
+    ...settings,
+    mcpServers: [
+      ...settings.mcpServers.filter((server) => !sessionIds.has(server.id)),
+      ...servers.map((server) => ({
+        id: server.id,
+        ...server.name ? { name: server.name } : {},
+        url: server.url,
+        ...server.allowedTools ? { allowedTools: server.allowedTools } : {},
+        ...server.timeoutMs ? { timeoutMs: server.timeoutMs } : {},
+        cacheToolsList: server.cacheToolsList ?? false,
+        ...server.requireApproval !== void 0 ? { requireApproval: server.requireApproval } : {},
+        headers: server.headers
+      }))
+    ]
+  };
+}
+async function connectToolspaceServer(input) {
+  const baseFetch = input.config.connectionRef ? connectionBrokerFetch(globalThis.fetch, input) : globalThis.fetch;
+  const client = new Client({ name: `opengeni-toolspace-${input.config.id}`, version: "1.0.0" }, { capabilities: {} });
+  const transport = new StreamableHTTPClientTransport(new URL(input.config.url), {
+    ...baseFetch !== globalThis.fetch ? { fetch: baseFetch } : {},
+    requestInit: {
+      headers: toolspaceServerHeaders(input.config)
+    }
+  });
+  await client.connect(transport, toolspaceRequestOptions(input.config));
+  return {
+    config: input.config,
+    client,
+    close: async () => {
+      await client.close().catch(() => void 0);
+    }
+  };
+}
+function toolspaceToolFor(input) {
+  const { deps, grant, sessionId, entry, getRegistry } = input;
+  const { serverId, tool } = entry;
+  const name = prefixedMcpToolName(serverId, tool.name);
+  const approvalRequired = mcpToolRequiresApproval(entry.requireApproval, tool.name);
+  const description = approvalRequired ? `${tool.description ?? tool.name} (unavailable: ${APPROVAL_REQUIRED_MESSAGE})` : tool.description;
+  return {
+    name,
+    ...description ? { description } : {},
+    ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
+    call: async (args) => {
+      if (approvalRequired) {
+        return mcpError(APPROVAL_REQUIRED_MESSAGE);
+      }
+      const reservation = await reserveActiveTurnCall(deps, grant.workspaceId, sessionId);
+      if (reservation.status === "no_active_turn") {
+        return mcpError(TOOLSPACE_NO_ACTIVE_TURN_MESSAGE);
+      }
+      if (reservation.status === "budget_exhausted") {
+        return mcpError(`toolspace call budget exhausted (${deps.settings.toolspaceMaxCallsPerTurn}/turn)`);
+      }
+      const turnId = reservation.turnId;
+      const registry = await getRegistry();
+      const config = registry.get(serverId);
+      if (!config || !toolspaceCanProxyServer(config) || !allowedByConfig(config, tool.name)) {
+        return mcpError(`upstream tool failed: ${name}`);
+      }
+      if (mcpToolRequiresApproval(config.requireApproval, tool.name)) {
+        return mcpError(APPROVAL_REQUIRED_MESSAGE);
+      }
+      const connection = await connectToolspaceServer({ deps, grant, config, sessionId }).catch(() => null);
+      if (!connection) {
+        return mcpError(`upstream tool failed: ${name}`);
+      }
+      try {
+        const callId = crypto.randomUUID();
+        await appendAndPublishEvents2(deps.db, deps.bus, grant.workspaceId, sessionId, [{
+          type: "agent.toolCall.created",
+          turnId,
+          producerId: grant.subjectId,
+          payload: {
+            id: callId,
+            name,
+            arguments: args,
+            origin: "toolspace",
+            subjectId: grant.subjectId,
+            raw: {
+              type: "toolspace_call",
+              serverId,
+              toolName: tool.name
+            }
+          }
+        }]);
+        const output = await callRemoteTool(deps, connection, tool.name, args);
+        await appendAndPublishEvents2(deps.db, deps.bus, grant.workspaceId, sessionId, [{
+          type: "agent.toolCall.output",
+          turnId,
+          producerId: grant.subjectId,
+          payload: {
+            id: callId,
+            output,
+            origin: "toolspace",
+            subjectId: grant.subjectId
+          }
+        }]);
+        return output;
+      } finally {
+        await connection.close();
+      }
+    }
+  };
+}
+async function callRemoteTool(deps, server, toolName, args) {
+  try {
+    return await server.client.callTool({
+      name: toolName,
+      arguments: args
+    }, void 0, toolspaceRequestOptions(server.config));
+  } catch (error) {
+    if (isToolspaceAuthNeededError(error)) {
+      return mcpError(TOOLSPACE_AUTH_NEEDED_MESSAGE);
+    }
+    deps.observability?.warn("toolspace upstream tool call failed", {
+      serverId: server.config.id,
+      toolName,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return mcpError(`upstream tool failed: ${prefixedMcpToolName(server.config.id, toolName)}`);
+  }
+}
+async function reserveActiveTurnCall(deps, workspaceId, sessionId) {
+  const session = await requireSession2(deps.db, workspaceId, sessionId);
+  if (!session.activeTurnId) {
+    return { status: "no_active_turn" };
+  }
+  const reservation = await reserveToolspaceCallForTurn(
+    deps.db,
+    workspaceId,
+    sessionId,
+    session.activeTurnId,
+    deps.settings.toolspaceMaxCallsPerTurn
+  );
+  return reservation.reserved ? { status: "ok", turnId: session.activeTurnId } : { status: "budget_exhausted" };
+}
+function selectedMcpServerIds(tools, sessionServerIds) {
+  const out = new Set(sessionServerIds);
+  for (const tool of tools) {
+    if (tool.kind === "mcp") {
+      out.add(tool.id);
+    }
+  }
+  return out;
+}
+function toolspaceCanProxyServerId(serverId) {
+  return serverId !== "opengeni" && !FIRST_PARTY_PROXY_IDS.has(serverId);
+}
+function toolspaceCanProxyServer(config) {
+  return toolspaceCanProxyServerId(config.id);
+}
+function toolspaceServerHeaders(config) {
+  const headers = {};
+  for (const [name, value] of Object.entries(config.headers ?? {})) {
+    headers[name] = value;
+  }
+  return headers;
+}
+function allowedByConfig(config, toolName) {
+  return !config.allowedTools || config.allowedTools.includes(toolName);
+}
+function mcpToolRequiresApproval(policy, unprefixedName) {
+  if (policy === true) {
+    return true;
+  }
+  return Array.isArray(policy) && policy.includes(unprefixedName);
+}
+function mcpError(message) {
+  return {
+    isError: true,
+    content: [{ type: "text", text: message }]
+  };
+}
+function toolspaceRequestOptions(config) {
+  return config.timeoutMs ? { timeout: config.timeoutMs, maxTotalTimeout: config.timeoutMs } : {};
+}
+function connectionBrokerFetch(baseFetch, input) {
+  const connectionRef = input.config.connectionRef;
+  if (!connectionRef) {
+    return baseFetch;
+  }
+  const resolveCredential = buildConnectionTokenResolver(input.deps.db, input.deps.settings);
+  return async (requestInput, init) => {
+    const request = await mcpRequestInfo(requestInput, init);
+    const first = await resolveCredential({
+      workspaceId: input.grant.workspaceId,
+      serverId: input.config.id,
+      connectionRef,
+      forceRefresh: false,
+      ...request.toolName ? { toolId: request.toolName } : {},
+      subjectId: input.grant.subjectId
+    });
+    if (first.status === "auth_needed") {
+      return await authNeededFetchResponse(input, request, first);
+    }
+    const response = await baseFetch(fetchInputForAttempt(requestInput), withConnectionHeaders(requestInput, init, first.headers));
+    if (response.status === 401) {
+      const refreshed = await resolveCredential({
+        workspaceId: input.grant.workspaceId,
+        serverId: input.config.id,
+        connectionRef,
+        forceRefresh: true,
+        ...request.toolName ? { toolId: request.toolName } : {},
+        subjectId: input.grant.subjectId
+      });
+      if (refreshed.status === "auth_needed") {
+        return await authNeededFetchResponse(input, request, refreshed);
+      }
+      return await baseFetch(fetchInputForAttempt(requestInput), withConnectionHeaders(requestInput, init, refreshed.headers));
+    }
+    if (response.status === 403) {
+      return await authNeededFetchResponse(input, request, authNeededFromStatus(input.config, first, "insufficient_scope"));
+    }
+    return response;
+  };
+}
+function authNeededFromStatus(config, first, reason) {
+  const connectionRef = config.connectionRef;
+  return {
+    status: "auth_needed",
+    reason,
+    providerDomain: connectionRef.providerDomain,
+    connectionId: first.connectionId,
+    ...connectionRef.scopes ? { scopes: connectionRef.scopes } : {},
+    ...connectionRef.resource ? { resource: connectionRef.resource } : {}
+  };
+}
+async function authNeededFetchResponse(input, request, auth) {
+  await appendAndPublishEvents2(input.deps.db, input.deps.bus, input.grant.workspaceId, input.sessionId, [{
+    type: "tool.auth_needed",
+    producerId: input.grant.subjectId,
+    payload: {
+      serverId: input.config.id,
+      toolName: request.toolName ?? null,
+      providerDomain: auth.providerDomain,
+      reason: auth.reason,
+      ...auth.connectionId ? { connectionId: auth.connectionId } : {},
+      ...auth.scopes ? { scopes: auth.scopes } : {},
+      ...auth.resource ? { resource: auth.resource } : {},
+      ...auth.authorizationUrl ? { authorizationUrl: auth.authorizationUrl } : {},
+      subjectId: input.grant.subjectId
+    }
+  }]).catch(() => void 0);
+  if (request.method === "tools/call") {
+    return new Response(JSON.stringify({
+      jsonrpc: "2.0",
+      id: request.id ?? null,
+      error: {
+        code: TOOLSPACE_AUTH_NEEDED_ERROR_CODE,
+        message: TOOLSPACE_AUTH_NEEDED_MESSAGE
+      }
+    }), {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    });
+  }
+  return new Response("Authentication required for MCP server connection", { status: 401 });
+}
+async function mcpRequestInfo(_input, init) {
+  const body = typeof init?.body === "string" ? init.body : "";
+  if (!body) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(body);
+    const method = typeof parsed.method === "string" ? parsed.method : void 0;
+    const id = typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0;
+    const toolName = method === "tools/call" && typeof parsed.params?.name === "string" ? parsed.params.name : void 0;
+    return {
+      ...method ? { method } : {},
+      ...id !== void 0 ? { id } : {},
+      ...toolName ? { toolName } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function withConnectionHeaders(_input, init, authHeaders) {
+  const headers = new Headers(init?.headers);
+  for (const [name, value] of Object.entries(authHeaders)) {
+    headers.set(name, value);
+  }
+  return { ...init, headers };
+}
+function fetchInputForAttempt(input) {
+  return input;
+}
+function isToolspaceAuthNeededError(error) {
+  return error instanceof Error && (error.code === TOOLSPACE_AUTH_NEEDED_ERROR_CODE || error.message.includes(TOOLSPACE_AUTH_NEEDED_MESSAGE));
+}
+
 // src/routes/install.ts
 import { readFile, stat } from "fs/promises";
 import { HTTPException } from "hono/http-exception";
@@ -1362,6 +1833,9 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/github/setup" || path === "/v1/github/install/callback" || path === "/v1/github/oauth/callback" || path === "/v1/github/app-manifest/callback") {
     return true;
   }
+  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json") {
+    return true;
+  }
   if (githubConnectPathPattern.test(path)) {
     return true;
   }
@@ -1491,7 +1965,7 @@ function registerCapabilityRoutes(app, deps) {
 }
 
 // src/routes/codex.ts
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
 import {
   accessTokenExpiry,
   buildCodexUsageWindowFromCache,
@@ -1604,7 +2078,7 @@ function registerCodexRoutes(app, deps) {
       throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
     }
     const id = parseIdToken(tokens.idToken);
-    const key = environmentsEncryptionKeyBytes(settings);
+    const key = environmentsEncryptionKeyBytes2(settings);
     if (!key) {
       throw new HTTPException3(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
     }
@@ -1694,124 +2168,1013 @@ function registerCodexRoutes(app, deps) {
       }
     });
   });
-  app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const accountId = c.req.param("accountId");
+    const activated = await setActiveCodexCredential(db, workspaceId, accountId);
+    if (!activated) {
+      throw new HTTPException3(404, { message: "codex account not found" });
+    }
+    return c.json({ activated: true, accountId });
+  });
+  app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const body = await c.req.json().catch(() => ({}));
+    const patch = {};
+    if (typeof body.rotationEnabled === "boolean") {
+      patch.rotationEnabled = body.rotationEnabled;
+    }
+    if (typeof body.rotationStrategy === "string") {
+      if (!CODEX_ROTATION_STRATEGIES.includes(body.rotationStrategy)) {
+        throw new HTTPException3(400, { message: "invalid rotation strategy" });
+      }
+      patch.rotationStrategy = body.rotationStrategy;
+    }
+    if (patch.rotationEnabled === void 0 && patch.rotationStrategy === void 0) {
+      throw new HTTPException3(400, { message: "no settings to update" });
+    }
+    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
+    const updated = await updateCodexRotationSettings(db, workspaceId, patch);
+    if (!updated) {
+      throw new HTTPException3(404, { message: "codex rotation settings not found" });
+    }
+    return c.json({
+      rotationEnabled: updated.rotationEnabled,
+      rotationStrategy: updated.rotationStrategy,
+      activeCredentialId: updated.activeCredentialId
+    });
+  });
+  app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const accountId = c.req.param("accountId");
+    const body = await c.req.json();
+    const label = typeof body.label === "string" ? body.label : null;
+    const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
+    if (!renamed) {
+      throw new HTTPException3(404, { message: "codex account not found" });
+    }
+    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    const row = accounts.find((account) => account.id === accountId);
+    if (!row) {
+      throw new HTTPException3(404, { message: "codex account not found" });
+    }
+    return c.json(codexAccountJson(row));
+  });
+  app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const accountId = c.req.param("accountId");
+    const result = await disconnectCodexAccount(db, workspaceId, accountId);
+    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+  });
+  app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const removed = await disconnectAllCodexAccounts(db, workspaceId);
+    return c.json({ disconnected: removed > 0 });
+  });
+  app.get("/v1/workspaces/:workspaceId/codex/usage", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const status = await getCodexCredentialStatus(db, workspaceId);
+    if (!status?.credentialId) {
+      throw new HTTPException3(404, { message: "codex subscription is not connected" });
+    }
+    const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
+    return c.json(codexUsageJson(payload));
+  });
+  app.get("/v1/workspaces/:workspaceId/codex/accounts/:accountId/usage", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const accountId = c.req.param("accountId");
+    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    if (!accounts.some((account) => account.id === accountId)) {
+      throw new HTTPException3(404, { message: "codex account not found" });
+    }
+    const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
+    return c.json(codexUsageJson(payload));
+  });
+  app.post("/v1/workspaces/:workspaceId/codex/usage/refresh", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    const usage = {};
+    const queue = [...accounts];
+    const CONCURRENCY = 4;
+    const worker = async () => {
+      for (; ; ) {
+        const account = queue.shift();
+        if (!account) return;
+        const settled = await Promise.allSettled([fetchCodexUsageForAccount(db, settings, workspaceId, account.id)]);
+        const result = settled[0];
+        usage[account.id] = result.status === "fulfilled" ? codexUsageJson(result.value) : { status: "error", usage: { status: "error", planType: null, fiveHour: null, weekly: null, limitReached: false, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker()));
+    return c.json({ usage });
+  });
+}
+
+// src/routes/connections.ts
+import {
+  ConnectionResponse,
+  CreateConnectionRequest,
+  IntegrationClientMetadata,
+  ListConnectionsResponse,
+  OAuthStartRequest,
+  OAuthStartResponse as OAuthStartResponse2,
+  UpdateConnectionRequest
+} from "@opengeni/contracts";
+import { requireAccessGrant as requireAccessGrant3, requireEnvironmentEncryption as requireEnvironmentEncryption3 } from "@opengeni/core";
+import {
+  createConnection as createConnection2,
+  encryptEnvironmentValue as encryptEnvironmentValue4,
+  getConnectionMetadata as getConnectionMetadata2,
+  listConnectionsMetadata,
+  revokeConnection,
+  updateConnection as updateConnection2
+} from "@opengeni/db";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
+
+// src/integrations/oauth-client.ts
+import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { parseIntegrationsOauthClientsJson } from "@opengeni/config";
+import { OAuthStartResponse } from "@opengeni/contracts";
+import { requireEnvironmentEncryption as requireEnvironmentEncryption2 } from "@opengeni/core";
+import {
+  consumeIntegrationOAuthStateNonce,
+  createConnection,
+  decryptEnvironmentValue,
+  encryptEnvironmentValue as encryptEnvironmentValue3,
+  getConnectionMetadata,
+  isPrivateAddress,
+  loadIntegrationOAuthClient,
+  storeIntegrationOAuthClient,
+  updateConnection
+} from "@opengeni/db";
+import { createSignedState as createSignedState3, readSignedState as readSignedState2 } from "@opengeni/github";
+import { Buffer } from "buffer";
+import { createHash, randomBytes } from "crypto";
+import { lookup } from "dns/promises";
+import { isIP } from "net";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+var oauthStateTtlMs = 10 * 60 * 1e3;
+async function startMcpOAuth(deps, context) {
+  const { db, settings } = deps;
+  const resource = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
+  const providerDomain = canonicalProviderDomain(context.payload.providerDomain ?? new URL(resource).hostname);
+  const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
+  const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
+  const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
+  const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
+  const existing = context.payload.connectionId ? await getConnectionMetadata(db, context.workspaceId, context.payload.connectionId, context.subjectId) : null;
+  if (context.payload.connectionId && !existing) {
+    throw new HTTPException4(404, { message: "connection not found" });
+  }
+  const discovery = await discoverMcpOAuth(resource, settings);
+  const client = await registerOAuthClient(db, settings, discovery.as, metadataUrl, redirectUri);
+  const verifier = randomPkceVerifier();
+  const authorizeScopes = chooseAuthorizeScopes(context.payload.requestedScopes, discovery.challenge.scope, discovery.prm.scopesSupported);
+  const key = requireEnvironmentEncryption2(settings);
+  const state = createSignedState3(requireIntegrationsStateSecret(settings), {
+    accountId: context.accountId,
+    workspaceId: context.workspaceId,
+    subjectId: context.subjectId,
+    providerDomain,
+    resource,
+    requestedScopes: uniqueStrings(context.payload.requestedScopes ?? []),
+    authorizeScopes,
+    encryptedPkceVerifier: encryptEnvironmentValue3(key, verifier),
+    clientId: client.clientId,
+    tokenEndpoint: discovery.as.tokenEndpoint,
+    authorizationServer: client.authorizationServer,
+    issuer: client.issuer,
+    clientRegistrationMethod: client.method,
+    tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
+    returnPath,
+    ...existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}
+  });
+  const authorizationUrl = buildAuthorizationUrl({
+    endpoint: discovery.as.authorizationEndpoint,
+    clientId: client.clientId,
+    redirectUri,
+    state,
+    resource,
+    verifier,
+    scopes: authorizeScopes
+  });
+  return OAuthStartResponse.parse({
+    state,
+    authorizationUrl,
+    expiresAt: new Date(Date.now() + oauthStateTtlMs).toISOString()
+  });
+}
+async function completeMcpOAuthCallback(deps, input) {
+  const { db, settings } = deps;
+  if (!input.state) {
+    throw new HTTPException4(400, { message: "missing OAuth state" });
+  }
+  const state = readOAuthState(input.state, settings);
+  if (!input.code) {
+    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" }) };
+  }
+  const consumed = await consumeIntegrationOAuthStateNonce(db, {
+    accountId: state.accountId,
+    workspaceId: state.workspaceId,
+    subjectId: state.subjectId,
+    nonce: state.nonce,
+    expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
+    now: /* @__PURE__ */ new Date()
+  });
+  if (!consumed) {
+    throw new HTTPException4(400, { message: "OAuth state has already been used" });
+  }
+  try {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, input.requestUrl);
+    const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
+    const key = requireEnvironmentEncryption2(settings);
+    const verifier = decryptEnvironmentValue(key, state.encryptedPkceVerifier);
+    const client = await clientForState(db, settings, state);
+    const token = await exchangeAuthorizationCode(settings, {
+      code: input.code,
+      verifier,
+      redirectUri,
+      resource: state.resource,
+      tokenEndpoint: state.tokenEndpoint,
+      client
+    });
+    const tools = await verifyMcpToolsList(settings, state.resource, token);
+    const scopes = grantedScopes(token.scopeText, state.authorizeScopes);
+    const credential = credentialBundle(token, state, client);
+    const metadata = {
+      resource: state.resource,
+      authorizationServer: state.authorizationServer,
+      authorizationServerIssuer: state.issuer,
+      tokenEndpoint: state.tokenEndpoint,
+      clientId: client.clientId,
+      clientRegistrationMethod: state.clientRegistrationMethod,
+      mcpTools: tools
+    };
+    const credentialEncrypted = encryptEnvironmentValue3(key, JSON.stringify(credential));
+    const connection = state.connectionId ? await updateConnection(db, {
+      workspaceId: state.workspaceId,
+      connectionId: state.connectionId,
+      visibleToSubjectId: state.subjectId,
+      expectedVersion: state.connectionVersion,
+      providerDomain: state.providerDomain,
+      kind: "oauth2",
+      status: "active",
+      credentialEncrypted,
+      grantedScopes: scopes,
+      expiresAt: token.expiresAt,
+      metadata,
+      updatedBySubjectId: state.subjectId
+    }) : await createConnection(db, {
+      accountId: state.accountId,
+      workspaceId: state.workspaceId,
+      subjectId: null,
+      providerDomain: state.providerDomain,
+      kind: "oauth2",
+      credentialEncrypted,
+      grantedScopes: scopes,
+      expiresAt: token.expiresAt,
+      metadata,
+      createdBySubjectId: state.subjectId
+    });
+    if (!connection) {
+      throw new HTTPException4(409, { message: "connection changed during OAuth reconnect; start again" });
+    }
+    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id }) };
+  } catch (error) {
+    if (error instanceof HTTPException4 && error.status >= 400 && error.status < 500) {
+      throw error;
+    }
+    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "oauth_callback_failed" }) };
+  }
+}
+function integrationBaseUrl(publicBaseUrl, requestUrl) {
+  return (publicBaseUrl ?? new URL(requestUrl).origin).replace(/\/+$/, "");
+}
+function requireIntegrationsStateSecret(settings) {
+  const secret = settings.integrationsStateSecret?.trim();
+  if (!secret) {
+    throw new HTTPException4(503, { message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET" });
+  }
+  return secret;
+}
+async function discoverMcpOAuth(resource, settings) {
+  const challenge = await probeMcpChallenge(resource, settings);
+  const prm = await discoverProtectedResourceMetadata(resource, settings, challenge.resourceMetadata);
+  const authorizationServer = prm.authorizationServers[0];
+  if (!authorizationServer) {
+    throw new HTTPException4(422, { message: "MCP protected resource metadata did not advertise an authorization server" });
+  }
+  const as = await discoverAuthorizationServerMetadata(authorizationServer, settings);
+  if (!as.codeChallengeMethodsSupported.includes("S256")) {
+    throw new HTTPException4(422, { message: "authorization server does not support required PKCE S256" });
+  }
+  return { challenge, prm, as };
+}
+async function probeMcpChallenge(resource, settings) {
+  const response = await fetchOAuth(resource, settings, {
+    method: "GET",
+    headers: { accept: "application/json" }
+  });
+  if (response.status !== 401) {
+    return {};
+  }
+  return parseWwwAuthenticate(response.headers.get("www-authenticate"));
+}
+async function discoverProtectedResourceMetadata(resource, settings, advertisedUrl) {
+  const candidates = uniqueStrings([
+    ...advertisedUrl ? [advertisedUrl] : [],
+    ...wellKnownCandidates(resource, "oauth-protected-resource")
+  ]);
+  for (const candidate of candidates) {
+    const payload = await fetchJsonObject(candidate, settings).catch((error) => {
+      if (error instanceof HTTPException4) {
+        throw error;
+      }
+      return null;
+    });
+    if (!payload) {
+      continue;
+    }
+    const authorizationServers = stringArray(payload.authorization_servers);
+    if (authorizationServers.length === 0) {
+      continue;
+    }
+    return {
+      authorizationServers,
+      scopesSupported: stringArray(payload.scopes_supported),
+      raw: payload,
+      ...stringValue(payload.resource) ? { resource: stringValue(payload.resource) } : {}
+    };
+  }
+  throw new HTTPException4(422, { message: "could not discover MCP protected resource metadata" });
+}
+async function discoverAuthorizationServerMetadata(authorizationServer, settings) {
+  const candidates = uniqueStrings([
+    authorizationServer,
+    ...wellKnownCandidates(authorizationServer, "oauth-authorization-server"),
+    ...wellKnownCandidates(authorizationServer, "openid-configuration")
+  ]);
+  for (const candidate of candidates) {
+    const payload = await fetchJsonObject(candidate, settings).catch((error) => {
+      if (error instanceof HTTPException4) {
+        throw error;
+      }
+      return null;
+    });
+    if (!payload) {
+      continue;
+    }
+    const authorizationEndpoint = stringValue(payload.authorization_endpoint);
+    const tokenEndpoint = stringValue(payload.token_endpoint);
+    if (!authorizationEndpoint || !tokenEndpoint) {
+      continue;
+    }
+    return {
+      issuer: stringValue(payload.issuer) ?? authorizationServer.replace(/\/+$/, ""),
+      authorizationServer: authorizationServer.replace(/\/+$/, ""),
+      authorizationEndpoint,
+      tokenEndpoint,
+      clientIdMetadataDocumentSupported: payload.client_id_metadata_document_supported === true,
+      codeChallengeMethodsSupported: stringArray(payload.code_challenge_methods_supported),
+      raw: payload,
+      ...stringValue(payload.registration_endpoint) ? { registrationEndpoint: stringValue(payload.registration_endpoint) } : {}
+    };
+  }
+  throw new HTTPException4(422, { message: "could not discover OAuth authorization server metadata" });
+}
+async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
+  const operator = operatorClientForAs(settings, as);
+  if (operator) {
+    return operator;
+  }
+  if (as.clientIdMetadataDocumentSupported) {
+    return {
+      method: "cimd",
+      issuer: as.issuer,
+      authorizationServer: as.authorizationServer,
+      clientId: metadataUrl,
+      tokenEndpointAuthMethod: "none"
+    };
+  }
+  const storedClient = await loadIntegrationOAuthClient(db, settings, as.issuer);
+  if (storedClient) {
+    return {
+      method: "dcr",
+      issuer: storedClient.issuer,
+      authorizationServer: storedClient.authorizationServer,
+      clientId: storedClient.clientId,
+      ...storedClient.clientSecret ? { clientSecret: storedClient.clientSecret } : {},
+      tokenEndpointAuthMethod: tokenAuthMethod(storedClient.tokenEndpointAuthMethod, Boolean(storedClient.clientSecret))
+    };
+  }
+  if (!as.registrationEndpoint) {
+    throw new HTTPException4(422, {
+      message: "manual OAuth client credentials are required for this authorization server"
+    });
+  }
+  const dcr = await dynamicClientRegistration(settings, as, redirectUri);
+  const key = dcr.clientSecret ? requireEnvironmentEncryption2(settings) : null;
+  const storedWinner = await storeIntegrationOAuthClient(db, {
+    issuer: as.issuer,
+    authorizationServer: as.authorizationServer,
+    clientId: dcr.clientId,
+    clientSecretEncrypted: dcr.clientSecret && key ? encryptEnvironmentValue3(key, dcr.clientSecret) : null,
+    tokenEndpointAuthMethod: dcr.tokenEndpointAuthMethod,
+    metadata: {
+      registrationEndpoint: as.registrationEndpoint,
+      registeredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+  if (storedWinner.clientId !== dcr.clientId) {
+    const winner = await loadIntegrationOAuthClient(db, settings, as.issuer);
+    if (!winner) {
+      throw new HTTPException4(422, { message: "OAuth client registration could not be loaded after a registration race" });
+    }
+    return dcrRegistrationFromStored(winner);
+  }
+  return dcr;
+}
+function dcrRegistrationFromStored(stored) {
+  return {
+    method: "dcr",
+    issuer: stored.issuer,
+    authorizationServer: stored.authorizationServer,
+    clientId: stored.clientId,
+    ...stored.clientSecret ? { clientSecret: stored.clientSecret } : {},
+    tokenEndpointAuthMethod: tokenAuthMethod(stored.tokenEndpointAuthMethod, Boolean(stored.clientSecret))
+  };
+}
+function operatorClientForAs(settings, as) {
+  const entry = operatorClientEntryFor(settings, [as.issuer, as.authorizationServer]);
+  if (!entry) {
+    return null;
+  }
+  return {
+    method: "operator",
+    issuer: as.issuer,
+    authorizationServer: as.authorizationServer,
+    clientId: entry.clientId,
+    ...entry.clientSecret ? { clientSecret: entry.clientSecret } : {},
+    tokenEndpointAuthMethod: tokenAuthMethod(entry.tokenEndpointAuthMethod, Boolean(entry.clientSecret))
+  };
+}
+function operatorClientEntryFor(settings, candidates) {
+  const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
+  const exactKeys = uniqueStrings(candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)]));
+  for (const key of exactKeys) {
+    const entry = configured[key];
+    if (entry) {
+      return entry;
+    }
+  }
+  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
+  for (const [key, entry] of Object.entries(configured)) {
+    if (normalizedCandidates.has(normalizedIssuerKey(key))) {
+      return entry;
+    }
+  }
+  return null;
+}
+function normalizedIssuerKey(value) {
+  return value.replace(/\/+$/, "");
+}
+async function dynamicClientRegistration(settings, as, redirectUri) {
+  if (!as.registrationEndpoint) {
+    throw new HTTPException4(422, { message: "authorization server does not support dynamic client registration" });
+  }
+  await assertOAuthFetchAllowed(as.registrationEndpoint, settings);
+  const response = await fetchOAuth(as.registrationEndpoint, settings, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "OpenGeni",
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"]
+    })
+  });
+  if (!response.ok) {
+    throw new HTTPException4(422, { message: `dynamic client registration failed with HTTP ${response.status}` });
+  }
+  const payload = await response.json();
+  const clientId = stringValue(payload.client_id);
+  if (!clientId) {
+    throw new HTTPException4(422, { message: "dynamic client registration response did not include client_id" });
+  }
+  const clientSecret = stringValue(payload.client_secret);
+  return {
+    method: "dcr",
+    issuer: as.issuer,
+    authorizationServer: as.authorizationServer,
+    clientId,
+    ...clientSecret ? { clientSecret } : {},
+    tokenEndpointAuthMethod: tokenAuthMethod(stringValue(payload.token_endpoint_auth_method), Boolean(clientSecret))
+  };
+}
+function buildAuthorizationUrl(input) {
+  const url = new URL(input.endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("resource", input.resource);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("code_challenge", pkceChallenge(input.verifier));
+  if (input.scopes.length > 0) {
+    url.searchParams.set("scope", input.scopes.join(" "));
+  }
+  return url.toString();
+}
+function readOAuthState(state, settings) {
+  const payload = readSignedState2(state, requireIntegrationsStateSecret(settings));
+  if (!payload) {
+    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const iat = numberValue(payload.iat);
+  if (iat === void 0 || nowSeconds - iat > oauthStateTtlMs / 1e3 || nowSeconds < iat) {
+    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+  }
+  const parsed = {
+    accountId: requiredString(payload.accountId, "state.accountId"),
+    workspaceId: requiredString(payload.workspaceId, "state.workspaceId"),
+    subjectId: requiredString(payload.subjectId, "state.subjectId"),
+    providerDomain: requiredString(payload.providerDomain, "state.providerDomain"),
+    resource: requiredString(payload.resource, "state.resource"),
+    requestedScopes: stringArray(payload.requestedScopes),
+    authorizeScopes: stringArray(payload.authorizeScopes),
+    encryptedPkceVerifier: requiredString(payload.encryptedPkceVerifier, "state.encryptedPkceVerifier"),
+    clientId: requiredString(payload.clientId, "state.clientId"),
+    tokenEndpoint: requiredString(payload.tokenEndpoint, "state.tokenEndpoint"),
+    authorizationServer: requiredString(payload.authorizationServer, "state.authorizationServer"),
+    issuer: requiredString(payload.issuer, "state.issuer"),
+    clientRegistrationMethod: registrationMethod(payload.clientRegistrationMethod),
+    tokenEndpointAuthMethod: tokenAuthMethod(stringValue(payload.tokenEndpointAuthMethod), false),
+    returnPath: safeReturnPath(stringValue(payload.returnPath) ?? "/integrations"),
+    nonce: requiredString(payload.nonce, "state.nonce"),
+    iat
+  };
+  const connectionId = stringValue(payload.connectionId);
+  const connectionVersion = numberValue(payload.connectionVersion);
+  return {
+    ...parsed,
+    ...connectionId ? { connectionId } : {},
+    ...connectionVersion !== void 0 ? { connectionVersion } : {}
+  };
+}
+async function clientForState(db, settings, state) {
+  if (state.clientRegistrationMethod === "cimd") {
+    return {
+      method: "cimd",
+      issuer: state.issuer,
+      authorizationServer: state.authorizationServer,
+      clientId: state.clientId,
+      tokenEndpointAuthMethod: "none"
+    };
+  }
+  if (state.clientRegistrationMethod === "dcr") {
+    const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
+    if (!stored || stored.clientId !== state.clientId) {
+      throw new HTTPException4(400, { message: "OAuth client registration is no longer available" });
+    }
+    return {
+      method: "dcr",
+      issuer: stored.issuer,
+      authorizationServer: stored.authorizationServer,
+      clientId: stored.clientId,
+      ...stored.clientSecret ? { clientSecret: stored.clientSecret } : {},
+      tokenEndpointAuthMethod: tokenAuthMethod(stored.tokenEndpointAuthMethod, Boolean(stored.clientSecret))
+    };
+  }
+  const entry = operatorClientEntryFor(settings, [state.issuer, state.authorizationServer]);
+  if (!entry || entry.clientId !== state.clientId) {
+    throw new HTTPException4(400, { message: "operator OAuth client credentials are no longer available" });
+  }
+  return {
+    method: "operator",
+    issuer: state.issuer,
+    authorizationServer: state.authorizationServer,
+    clientId: entry.clientId,
+    ...entry.clientSecret ? { clientSecret: entry.clientSecret } : {},
+    tokenEndpointAuthMethod: tokenAuthMethod(entry.tokenEndpointAuthMethod, Boolean(entry.clientSecret))
+  };
+}
+async function exchangeAuthorizationCode(settings, input) {
+  await assertOAuthFetchAllowed(input.tokenEndpoint, settings);
+  const body = new URLSearchParams();
+  body.set("grant_type", "authorization_code");
+  body.set("code", input.code);
+  body.set("redirect_uri", input.redirectUri);
+  body.set("code_verifier", input.verifier);
+  body.set("resource", input.resource);
+  body.set("client_id", input.client.clientId);
+  const headers = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+  if (input.client.clientSecret && input.client.tokenEndpointAuthMethod === "client_secret_post") {
+    body.set("client_secret", input.client.clientSecret);
+  } else if (input.client.clientSecret && input.client.tokenEndpointAuthMethod === "client_secret_basic") {
+    headers.authorization = `Basic ${Buffer.from(`${input.client.clientId}:${input.client.clientSecret}`).toString("base64")}`;
+  }
+  const response = await fetchOAuth(input.tokenEndpoint, settings, { method: "POST", headers, body });
+  if (!response.ok) {
+    throw new Error(`OAuth token endpoint returned HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  const accessToken = stringValue(payload.access_token);
+  if (!accessToken) {
+    throw new Error("OAuth token response did not include access_token");
+  }
+  return {
+    accessToken,
+    tokenType: stringValue(payload.token_type) ?? "Bearer",
+    expiresAt: expiresAtFromTokenResponse(payload),
+    raw: payload,
+    ...stringValue(payload.refresh_token) ? { refreshToken: stringValue(payload.refresh_token) } : {},
+    ...stringValue(payload.scope) ? { scopeText: stringValue(payload.scope) } : {}
+  };
+}
+async function verifyMcpToolsList(settings, resource, token) {
+  await assertOAuthFetchAllowed(resource, settings);
+  const client = new Client2({ name: "opengeni-integration-verify", version: "0.1.0" }, { capabilities: {} });
+  try {
+    const transport = new StreamableHTTPClientTransport2(new URL(resource), {
+      requestInit: {
+        headers: { authorization: `${token.tokenType} ${token.accessToken}` }
+      },
+      fetch: (url, init) => fetchOAuth(url.toString(), settings, init)
+    });
+    await client.connect(transport, { timeout: 1e4, maxTotalTimeout: 1e4 });
+    const listed = await client.listTools(void 0, { timeout: 1e4, maxTotalTimeout: 1e4 });
+    return listed.tools.map((tool) => ({
+      name: tool.name,
+      ...tool.description ? { description: tool.description } : {}
+    }));
+  } finally {
+    await client.close().catch(() => void 0);
+  }
+}
+function credentialBundle(token, state, client) {
+  return {
+    access_token: token.accessToken,
+    ...token.refreshToken ? { refresh_token: token.refreshToken } : {},
+    token_type: token.tokenType,
+    ...token.expiresAt ? { expires_at: token.expiresAt.toISOString() } : {},
+    resource: state.resource,
+    ...token.scopeText ? { scope: token.scopeText } : state.authorizeScopes.length ? { scope: state.authorizeScopes.join(" ") } : {},
+    token_endpoint: state.tokenEndpoint,
+    client_id: client.clientId,
+    ...client.clientSecret ? { client_secret: client.clientSecret, token_endpoint_auth_method: client.tokenEndpointAuthMethod } : {}
+  };
+}
+function callbackReturnPath(returnPath, status, params) {
+  const url = new URL(returnPath, "https://opengeni.local");
+  url.searchParams.set("integration_oauth", status);
+  for (const [key, value] of Object.entries(params)) {
+    url.searchParams.set(key, value);
+  }
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+function canonicalMcpResource(value) {
+  if (!value) {
+    throw new HTTPException4(400, { message: "mcpUrl is required" });
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new HTTPException4(422, { message: "MCP resource URL is invalid" });
+  }
+  url.hash = "";
+  return url.toString();
+}
+function canonicalProviderDomain(value) {
+  return value.trim().toLowerCase().replace(/^www\./, "");
+}
+function safeReturnPath(value) {
+  if (!value.startsWith("/") || value.startsWith("//")) {
+    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+  }
+  const parsed = new URL(value, "https://opengeni.local");
+  if (parsed.origin !== "https://opengeni.local") {
+    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+  }
+  return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+async function fetchJsonObject(url, settings) {
+  const response = await fetchOAuth(url, settings, { headers: { accept: "application/json" } });
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("metadata response was not a JSON object");
+  }
+  return payload;
+}
+async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
+  await assertOAuthFetchAllowed(rawUrl, settings);
+  const response = await fetch(rawUrl, { ...init, redirect: "manual" });
+  if (response.status < 300 || response.status >= 400) {
+    return response;
+  }
+  if (hop >= 3) {
+    throw new HTTPException4(422, { message: "OAuth fetch exceeded maximum redirect hops" });
+  }
+  const location = response.headers.get("location");
+  if (!location) {
+    throw new HTTPException4(422, { message: "OAuth fetch redirect was missing Location" });
+  }
+  let nextUrl;
+  try {
+    nextUrl = new URL(location, rawUrl).toString();
+  } catch {
+    throw new HTTPException4(422, { message: "OAuth fetch redirect Location was invalid" });
+  }
+  return await fetchOAuth(nextUrl, settings, init, hop + 1);
+}
+async function assertOAuthFetchAllowed(rawUrl, settings) {
+  const url = new URL(rawUrl);
+  if (!["https:", "http:"].includes(url.protocol)) {
+    throw new HTTPException4(422, { message: "OAuth discovery only supports http and https URLs" });
+  }
+  if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
+    return;
+  }
+  if (url.protocol !== "https:") {
+    throw new HTTPException4(422, { message: "OAuth discovery targets must use https outside local/test" });
+  }
+  const hostname = url.hostname.toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+    throw new HTTPException4(422, { message: "OAuth discovery may not target localhost" });
+  }
+  const literal2 = isIP(hostname);
+  const addresses = literal2 ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
+  if (addresses.some(isPrivateAddress)) {
+    throw new HTTPException4(422, { message: "OAuth discovery may not target private network addresses" });
+  }
+}
+function parseWwwAuthenticate(header) {
+  if (!header) {
+    return {};
+  }
+  const bearerIndex = header.toLowerCase().indexOf("bearer");
+  if (bearerIndex < 0) {
+    return {};
+  }
+  const paramsText = header.slice(bearerIndex + "bearer".length);
+  const params = {};
+  const re = /([a-zA-Z_][a-zA-Z0-9_-]*)\s*=\s*("(?:[^"\\]|\\.)*"|[^,\s]+)/g;
+  let match;
+  while ((match = re.exec(paramsText)) !== null) {
+    const raw = match[2];
+    params[match[1].toLowerCase()] = raw.startsWith('"') ? raw.slice(1, -1).replace(/\\"/g, '"') : raw;
+  }
+  return {
+    ...params.resource_metadata ? { resourceMetadata: params.resource_metadata } : {},
+    ...params.scope ? { scope: params.scope.split(/\s+/).filter(Boolean) } : {},
+    ...params.error ? { error: params.error } : {}
+  };
+}
+function wellKnownCandidates(rawUrl, name) {
+  const url = new URL(rawUrl);
+  const path = url.pathname.replace(/^\/+|\/+$/g, "");
+  return uniqueStrings([
+    `${url.origin}/.well-known/${name}${path ? `/${path}` : ""}`,
+    `${url.origin}${path ? `/${path}` : ""}/.well-known/${name}`,
+    `${url.origin}/.well-known/${name}`
+  ]);
+}
+function chooseAuthorizeScopes(requested, challenged, supported) {
+  if (requested?.length) {
+    return uniqueStrings(requested);
+  }
+  if (challenged?.length) {
+    return uniqueStrings(challenged);
+  }
+  return uniqueStrings(supported);
+}
+function grantedScopes(scopeText, fallback) {
+  if (scopeText) {
+    return uniqueStrings(scopeText.split(/\s+/).filter(Boolean));
+  }
+  return fallback;
+}
+function tokenAuthMethod(raw, hasSecret) {
+  if (raw === "client_secret_post" || raw === "client_secret_basic") {
+    return raw;
+  }
+  return hasSecret ? "client_secret_post" : "none";
+}
+function registrationMethod(value) {
+  if (value === "operator" || value === "cimd" || value === "dcr") {
+    return value;
+  }
+  throw new HTTPException4(400, { message: "invalid OAuth state" });
+}
+function expiresAtFromTokenResponse(payload) {
+  const expiresAt = stringValue(payload.expires_at);
+  if (expiresAt) {
+    const parsed = new Date(expiresAt);
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+  }
+  const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : Number(payload.expires_in);
+  if (Number.isFinite(expiresIn) && expiresIn > 0) {
+    return new Date(Date.now() + expiresIn * 1e3);
+  }
+  return null;
+}
+function pkceChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function randomPkceVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function uniqueStrings(values) {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function stringArray(value) {
+  return Array.isArray(value) ? uniqueStrings(value.filter((entry) => typeof entry === "string")) : [];
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function requiredString(value, field) {
+  const result = stringValue(value);
+  if (!result) {
+    throw new HTTPException4(400, { message: `invalid OAuth state: missing ${field}` });
+  }
+  return result;
+}
+
+// src/routes/connections.ts
+function registerConnectionRoutes(app, deps) {
+  const { db, settings } = deps;
+  function assertIntegrationsEnabled() {
+    if (!settings.integrationsEnabled) {
+      throw new HTTPException5(404, { message: "integrations are not enabled for this deployment" });
+    }
+  }
+  app.get("/v1/workspaces/:workspaceId/connections", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:read");
+    return c.json(ListConnectionsResponse.parse({
+      connections: await listConnectionsMetadata(db, workspaceId, grant.subjectId)
+    }));
+  });
+  app.post("/v1/workspaces/:workspaceId/connections", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+    const payload = CreateConnectionRequest.parse(await c.req.json());
+    const key = requireEnvironmentEncryption3(settings);
+    const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
+    const connection = await createConnection2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId,
+      providerDomain: payload.providerDomain,
+      kind: payload.kind,
+      credentialEncrypted: encryptCredentialBundle(key, payload.credential),
+      grantedScopes: payload.grantedScopes,
+      expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
+      metadata: payload.metadata,
+      createdBySubjectId: grant.subjectId
+    });
+    return c.json(ConnectionResponse.parse({ connection }), 201);
+  });
+  app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const accountId = c.req.param("accountId");
-    const activated = await setActiveCodexCredential(db, workspaceId, accountId);
-    if (!activated) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:read");
+    const connection = await getConnectionMetadata2(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
+    if (!connection) {
+      throw new HTTPException5(404, { message: "connection not found" });
     }
-    return c.json({ activated: true, accountId });
+    return c.json(ConnectionResponse.parse({ connection }));
   });
-  app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
+  app.patch("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const body = await c.req.json().catch(() => ({}));
-    const patch = {};
-    if (typeof body.rotationEnabled === "boolean") {
-      patch.rotationEnabled = body.rotationEnabled;
-    }
-    if (typeof body.rotationStrategy === "string") {
-      if (!CODEX_ROTATION_STRATEGIES.includes(body.rotationStrategy)) {
-        throw new HTTPException3(400, { message: "invalid rotation strategy" });
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+    const payload = UpdateConnectionRequest.parse(await c.req.json());
+    if (payload.status !== void 0) {
+      if (payload.status !== "active") {
+        throw new HTTPException5(400, { message: 'status can only be set to "active"; use DELETE to revoke' });
+      }
+      if (payload.credential === void 0) {
+        throw new HTTPException5(400, { message: "reactivating a connection requires a new credential" });
       }
-      patch.rotationStrategy = body.rotationStrategy;
-    }
-    if (patch.rotationEnabled === void 0 && patch.rotationStrategy === void 0) {
-      throw new HTTPException3(400, { message: "no settings to update" });
-    }
-    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
-    const updated = await updateCodexRotationSettings(db, workspaceId, patch);
-    if (!updated) {
-      throw new HTTPException3(404, { message: "codex rotation settings not found" });
     }
-    return c.json({
-      rotationEnabled: updated.rotationEnabled,
-      rotationStrategy: updated.rotationStrategy,
-      activeCredentialId: updated.activeCredentialId
+    const key = payload.credential === void 0 ? null : requireEnvironmentEncryption3(settings);
+    const subjectId = payload.subjectId === void 0 ? void 0 : writableSubjectId(payload.subjectId, grant.subjectId);
+    const connection = await updateConnection2(db, {
+      workspaceId,
+      connectionId: c.req.param("connectionId"),
+      visibleToSubjectId: grant.subjectId,
+      updatedBySubjectId: grant.subjectId,
+      ...payload.providerDomain !== void 0 ? { providerDomain: payload.providerDomain } : {},
+      ...subjectId !== void 0 ? { subjectId } : {},
+      ...payload.kind !== void 0 ? { kind: payload.kind } : {},
+      ...payload.status !== void 0 ? { status: payload.status } : {},
+      ...payload.credential !== void 0 && key ? { credentialEncrypted: encryptCredentialBundle(key, payload.credential) } : {},
+      ...payload.grantedScopes !== void 0 ? { grantedScopes: payload.grantedScopes } : {},
+      ...payload.expiresAt !== void 0 ? { expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null } : {},
+      ...payload.metadata !== void 0 ? { metadata: payload.metadata } : {}
     });
-  });
-  app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const accountId = c.req.param("accountId");
-    const body = await c.req.json();
-    const label = typeof body.label === "string" ? body.label : null;
-    const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
-    if (!renamed) {
-      throw new HTTPException3(404, { message: "codex account not found" });
-    }
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
-    const row = accounts.find((account) => account.id === accountId);
-    if (!row) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+    if (!connection) {
+      throw new HTTPException5(404, { message: "connection not found" });
     }
-    return c.json(codexAccountJson(row));
-  });
-  app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const accountId = c.req.param("accountId");
-    const result = await disconnectCodexAccount(db, workspaceId, accountId);
-    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
-  });
-  app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const removed = await disconnectAllCodexAccounts(db, workspaceId);
-    return c.json({ disconnected: removed > 0 });
+    return c.json(ConnectionResponse.parse({ connection }));
   });
-  app.get("/v1/workspaces/:workspaceId/codex/usage", async (c) => {
+  app.delete("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
-    const status = await getCodexCredentialStatus(db, workspaceId);
-    if (!status?.credentialId) {
-      throw new HTTPException3(404, { message: "codex subscription is not connected" });
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+    const connection = await revokeConnection(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
+    if (!connection) {
+      throw new HTTPException5(404, { message: "connection not found" });
     }
-    const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
-    return c.json(codexUsageJson(payload));
+    return c.json(ConnectionResponse.parse({ connection }));
   });
-  app.get("/v1/workspaces/:workspaceId/codex/accounts/:accountId/usage", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/connections/oauth/start", async (c) => {
+    assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
-    const accountId = c.req.param("accountId");
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
-    if (!accounts.some((account) => account.id === accountId)) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+    const parsed = OAuthStartRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException5(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
     }
-    const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
-    return c.json(codexUsageJson(payload));
-  });
-  app.post("/v1/workspaces/:workspaceId/codex/usage/refresh", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
-    const usage = {};
-    const queue = [...accounts];
-    const CONCURRENCY = 4;
-    const worker = async () => {
-      for (; ; ) {
-        const account = queue.shift();
-        if (!account) return;
-        const settled = await Promise.allSettled([fetchCodexUsageForAccount(db, settings, workspaceId, account.id)]);
-        const result = settled[0];
-        usage[account.id] = result.status === "fulfilled" ? codexUsageJson(result.value) : { status: "error", usage: { status: "error", planType: null, fiveHour: null, weekly: null, limitReached: false, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() } };
-      }
-    };
-    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker()));
-    return c.json({ usage });
+    const payload = parsed.data;
+    const result = await startMcpOAuth({ db, settings }, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      requestUrl: c.req.url,
+      payload
+    });
+    return c.json(OAuthStartResponse2.parse(result));
+  });
+  app.get("/v1/integrations/oauth/callback", async (c) => {
+    assertIntegrationsEnabled();
+    const result = await completeMcpOAuthCallback({ db, settings }, {
+      code: c.req.query("code"),
+      state: c.req.query("state"),
+      requestUrl: c.req.url
+    });
+    return c.redirect(result.redirectTo, 302);
+  });
+  app.get("/v1/integrations/oauth/client-metadata.json", (c) => {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
+    const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
+    return c.json(IntegrationClientMetadata.parse({
+      client_id: metadataUrl,
+      client_name: "OpenGeni",
+      redirect_uris: [`${baseUrl}/v1/integrations/oauth/callback`],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"]
+    }));
   });
 }
+function writableSubjectId(requested, grantSubjectId) {
+  if (requested == null) {
+    return null;
+  }
+  if (requested !== grantSubjectId) {
+    throw new HTTPException5(403, { message: "cannot write a connection for another subject" });
+  }
+  return requested;
+}
+function encryptCredentialBundle(key, credential) {
+  return encryptEnvironmentValue4(key, JSON.stringify(credential));
+}
 
 // src/routes/documents.ts
 import {
   AddDocumentRequest,
+  CreateKnowledgeMemoryRequest,
   CreateDocumentBaseRequest,
   Document,
   DocumentBase,
-  DocumentSearchRequest
+  DocumentSearchRequest,
+  KnowledgeMemory,
+  KnowledgeMemorySearchRequest,
+  UpdateKnowledgeMemoryRequest
 } from "@opengeni/contracts";
+import {
+  createKnowledgeMemory as createKnowledgeMemory2,
+  getKnowledgeMemory,
+  listKnowledgeMemories as listKnowledgeMemories2,
+  updateKnowledgeMemory
+} from "@opengeni/db";
 import {
   addDocumentToBase,
   createDocumentBase,
@@ -1824,8 +3187,8 @@ import {
   searchDocuments as searchDocuments2
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { HTTPException as HTTPException4 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant3 } from "@opengeni/core";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
 
 // src/mcp/documents.ts
@@ -1834,9 +3197,29 @@ import {
   listDocumentBases,
   searchDocuments
 } from "@opengeni/documents";
+import {
+  createKnowledgeMemory,
+  listKnowledgeMemories
+} from "@opengeni/db";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import * as z from "zod/v4";
-function buildDocumentsMcpServer(db, workspaceId, documentServices) {
+var SearchInputSchema = {
+  query: z.string().min(1),
+  baseIds: z.array(z.string().uuid()).optional(),
+  limit: z.number().int().positive().max(50).optional(),
+  mode: z.enum(["hybrid", "vector", "keyword"]).optional(),
+  sourceKinds: z.array(z.enum(["manual_upload", "meeting_transcript", "repository", "email", "chat", "document", "web", "other"])).optional(),
+  aclTags: z.array(z.string().min(1)).optional()
+};
+var MemoryKindSchema = z.enum(["semantic", "episodic", "procedural", "decision", "preference"]);
+var SourceRefSchema = z.object({
+  kind: z.enum(["document_chunk", "document", "session_event", "memory", "external"]),
+  id: z.string().min(1),
+  uri: z.string().min(1).optional(),
+  title: z.string().min(1).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, options = {}) {
   const server = new McpServer2({
     name: "opengeni-documents",
     version: "1.0.0"
@@ -1848,27 +3231,29 @@ function buildDocumentsMcpServer(db, workspaceId, documentServices) {
     content: [{ type: "text", text: JSON.stringify(await listDocumentBases(db, workspaceId)) }]
   }));
   server.registerTool("search_documents", {
-    description: "Search indexed documents.",
-    inputSchema: {
-      query: z.string(),
-      baseIds: z.array(z.string()).optional(),
-      limit: z.number().optional()
-    }
-  }, async ({ query, baseIds, limit }) => ({
-    content: [{
-      type: "text",
-      text: JSON.stringify(await searchDocuments(db, {
-        workspaceId,
-        query,
-        ...baseIds ? { baseIds } : {},
-        ...limit ? { limit } : {}
-      }, documentServices))
-    }]
-  }));
+    description: "Search indexed documents with hybrid, vector, or keyword retrieval.",
+    inputSchema: SearchInputSchema
+  }, async (input) => searchContent(db, workspaceId, documentServices, input));
+  server.registerTool("knowledge_search", {
+    description: "Search company knowledge sources with optional base, source-kind, ACL, and retrieval-mode filters.",
+    inputSchema: SearchInputSchema
+  }, async (input) => searchContent(db, workspaceId, documentServices, input));
   server.registerTool("fetch_document_chunk", {
     description: "Fetch one indexed document chunk by id.",
     inputSchema: {
-      chunkId: z.string()
+      chunkId: z.string().uuid()
+    }
+  }, async ({ chunkId }) => {
+    const found = await getDocumentChunk(db, workspaceId, chunkId);
+    return {
+      content: [{ type: "text", text: found ? JSON.stringify(found) : `chunk not found: ${chunkId}` }],
+      isError: !found
+    };
+  });
+  server.registerTool("knowledge_fetch", {
+    description: "Fetch one knowledge source chunk by id.",
+    inputSchema: {
+      chunkId: z.string().uuid()
     }
   }, async ({ chunkId }) => {
     const found = await getDocumentChunk(db, workspaceId, chunkId);
@@ -1877,42 +3262,99 @@ function buildDocumentsMcpServer(db, workspaceId, documentServices) {
       isError: !found
     };
   });
+  server.registerTool("memory_search", {
+    description: "Search approved company memory records.",
+    inputSchema: {
+      query: z.string().min(1).optional(),
+      kind: MemoryKindSchema.optional(),
+      scope: z.string().min(1).optional(),
+      limit: z.number().int().positive().max(100).optional()
+    }
+  }, async ({ query, kind, scope, limit }) => ({
+    content: [{ type: "text", text: JSON.stringify(await listKnowledgeMemories(db, workspaceId, {
+      ...query ? { query } : {},
+      status: "approved",
+      ...kind ? { kind } : {},
+      ...scope ? { scope } : {},
+      ...limit ? { limit } : {}
+    })) }]
+  }));
+  server.registerTool("memory_propose", {
+    description: "Propose a company memory record for human review.",
+    inputSchema: {
+      text: z.string().min(1),
+      kind: MemoryKindSchema.optional(),
+      scope: z.string().min(1).optional(),
+      sourceRefs: z.array(SourceRefSchema).optional(),
+      confidence: z.number().min(0).max(1).optional(),
+      metadata: z.record(z.string(), z.unknown()).optional()
+    }
+  }, async ({ text, kind, scope, sourceRefs, confidence, metadata }) => ({
+    content: [{ type: "text", text: JSON.stringify(await createKnowledgeMemory(db, {
+      accountId,
+      workspaceId,
+      status: "proposed",
+      kind: kind ?? "semantic",
+      scope: scope ?? "workspace",
+      text,
+      sourceRefs: sourceRefs?.map((sourceRef) => ({ ...sourceRef, metadata: sourceRef.metadata ?? {} })) ?? [],
+      confidence: confidence ?? 0.5,
+      metadata: metadata ?? {},
+      createdBySessionId: options.createdBySessionId
+    })) }]
+  }));
   return server;
 }
+async function searchContent(db, workspaceId, documentServices, input) {
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify(await searchDocuments(db, {
+        workspaceId,
+        query: input.query,
+        ...input.baseIds ? { baseIds: input.baseIds } : {},
+        ...input.limit ? { limit: input.limit } : {},
+        ...input.mode ? { mode: input.mode } : {},
+        ...input.sourceKinds ? { sourceKinds: input.sourceKinds } : {},
+        ...input.aclTags ? { aclTags: input.aclTags } : {}
+      }, documentServices))
+    }]
+  };
+}
 
 // src/routes/documents.ts
 function registerDocumentRoutes(app, deps) {
   const { db, objectStorage, documentIndexer, getDocumentServices } = deps;
   app.post("/v1/workspaces/:workspaceId/document-bases", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "documents:manage");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     const payload = CreateDocumentBaseRequest.parse(await c.req.json());
     return c.json(DocumentBase.parse(await createDocumentBase(db, { ...payload, accountId: grant.accountId, workspaceId })), 201);
   });
   app.get("/v1/workspaces/:workspaceId/document-bases", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant3(c, deps, workspaceId, "documents:search");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     return c.json((await listDocumentBases2(db, workspaceId)).map((base) => DocumentBase.parse(base)));
   });
   app.get("/v1/workspaces/:workspaceId/document-bases/:baseId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant3(c, deps, workspaceId, "documents:search");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException4(404, { message: "document base not found" });
+      throw new HTTPException6(404, { message: "document base not found" });
     }
     return c.json(DocumentBase.parse(base));
   });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "documents:manage");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException4(503, { message: "object storage is not configured" });
+      throw new HTTPException6(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     const payload = AddDocumentRequest.parse(await c.req.json());
     try {
-      const document = await addDocumentToBase(db, { accountId: grant.accountId, workspaceId, baseId: c.req.param("baseId"), fileId: payload.fileId });
+      const document = await addDocumentToBase(db, { ...payload, accountId: grant.accountId, workspaceId, baseId: c.req.param("baseId") });
       const wasCreated = document.status === "queued" && document.chunkCount === 0 && document.error === null;
       const indexed = document.status === "ready" ? document : await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? document;
       if (indexed.status === "ready") {
@@ -1935,12 +3377,12 @@ function registerDocumentRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant3(c, deps, workspaceId, "documents:search");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     return c.json((await listDocuments(db, workspaceId, c.req.param("baseId"))).map((document) => Document.parse(document)));
   });
   app.delete("/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "documents:manage");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     try {
       await deleteDocumentFromBase(db, {
         accountId: grant.accountId,
@@ -1955,21 +3397,21 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId/reindex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "documents:manage");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException4(503, { message: "object storage is not configured" });
+      throw new HTTPException6(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     try {
       const document = await getDocument(db, workspaceId, c.req.param("documentId"));
       if (!document) {
-        throw new HTTPException4(404, { message: "document not found" });
+        throw new HTTPException6(404, { message: "document not found" });
       }
       if (document.status !== "failed") {
-        throw new HTTPException4(422, { message: "only failed documents can be retried" });
+        throw new HTTPException6(422, { message: "only failed documents can be retried" });
       }
       if (document.baseId !== c.req.param("baseId")) {
-        throw new HTTPException4(404, { message: "document not found" });
+        throw new HTTPException6(404, { message: "document not found" });
       }
       const queued = await queueDocumentForReindex(db, workspaceId, document.id);
       const indexed = await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? queued;
@@ -1988,7 +3430,7 @@ function registerDocumentRoutes(app, deps) {
       }
       return c.json(Document.parse(indexed));
     } catch (error) {
-      if (error instanceof HTTPException4) {
+      if (error instanceof HTTPException6) {
         throw error;
       }
       throw documentHttpException(error);
@@ -1996,26 +3438,94 @@ function registerDocumentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/search", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant3(c, deps, workspaceId, "documents:search");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const payload = DocumentSearchRequest.parse(await c.req.json());
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException4(404, { message: "document base not found" });
+      throw new HTTPException6(404, { message: "document base not found" });
     }
     return c.json({
       results: await searchDocuments2(db, {
         workspaceId,
         baseIds: [base.id],
         query: payload.query,
-        limit: payload.limit
+        limit: payload.limit,
+        mode: payload.mode,
+        sourceKinds: payload.sourceKinds,
+        aclTags: payload.aclTags
+      }, getDocumentServices())
+    });
+  });
+  app.post("/v1/workspaces/:workspaceId/knowledge/search", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
+    const payload = DocumentSearchRequest.parse(await c.req.json());
+    return c.json({
+      results: await searchDocuments2(db, {
+        workspaceId,
+        query: payload.query,
+        baseIds: payload.baseIds,
+        limit: payload.limit,
+        mode: payload.mode,
+        sourceKinds: payload.sourceKinds,
+        aclTags: payload.aclTags
       }, getDocumentServices())
     });
   });
+  app.get("/v1/workspaces/:workspaceId/knowledge/memories", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
+    const parsed = KnowledgeMemorySearchRequest.safeParse({
+      query: c.req.query("query") || void 0,
+      status: c.req.query("status") || void 0,
+      kind: c.req.query("kind") || void 0,
+      scope: c.req.query("scope") || void 0,
+      limit: c.req.query("limit") ? Number(c.req.query("limit")) : void 0
+    });
+    if (!parsed.success) {
+      throw new HTTPException6(400, { message: "invalid knowledge memory query parameters" });
+    }
+    return c.json((await listKnowledgeMemories2(db, workspaceId, parsed.data)).map((memory) => KnowledgeMemory.parse(memory)));
+  });
+  app.get("/v1/workspaces/:workspaceId/knowledge/memories/:memoryId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant4(c, deps, workspaceId, "documents:search");
+    const memory = await getKnowledgeMemory(db, workspaceId, c.req.param("memoryId"));
+    if (!memory) {
+      throw new HTTPException6(404, { message: "knowledge memory not found" });
+    }
+    return c.json(KnowledgeMemory.parse(memory));
+  });
+  app.post("/v1/workspaces/:workspaceId/knowledge/memories", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
+    const payload = CreateKnowledgeMemoryRequest.parse(await c.req.json());
+    return c.json(KnowledgeMemory.parse(await createKnowledgeMemory2(db, {
+      ...payload,
+      accountId: grant.accountId,
+      workspaceId
+    })), 201);
+  });
+  app.patch("/v1/workspaces/:workspaceId/knowledge/memories/:memoryId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
+    const payload = UpdateKnowledgeMemoryRequest.parse(await c.req.json());
+    const reviewedBy = payload.reviewedBy ?? (payload.status === "approved" || payload.status === "rejected" ? grant.subjectLabel ?? grant.subjectId : void 0);
+    try {
+      return c.json(KnowledgeMemory.parse(await updateKnowledgeMemory(db, workspaceId, c.req.param("memoryId"), {
+        ...payload,
+        ...reviewedBy ? { reviewedBy } : {}
+      })));
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
   app.all("/v1/workspaces/:workspaceId/mcp/docs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant3(c, deps, workspaceId, "documents:search");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:search");
+    const sessionId = typeof grant.metadata?.sessionId === "string" ? grant.metadata.sessionId : void 0;
     const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
-    const server = buildDocumentsMcpServer(db, workspaceId, getDocumentServices());
+    const server = buildDocumentsMcpServer(db, grant.accountId, workspaceId, getDocumentServices(), { createdBySessionId: sessionId });
     await server.connect(transport);
     return await transport.handleRequest(c.req.raw);
   });
@@ -2023,12 +3533,12 @@ function registerDocumentRoutes(app, deps) {
 function documentHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException4(404, { message });
+    return new HTTPException6(404, { message });
   }
   if (message.includes("pending") || message.includes("failed") || message.includes("deleted")) {
-    return new HTTPException4(422, { message });
+    return new HTTPException6(422, { message });
   }
-  return new HTTPException4(500, { message });
+  return new HTTPException6(500, { message });
 }
 
 // src/routes/enrollments.ts
@@ -2054,11 +3564,11 @@ import {
   listEnrollments,
   revokeEnrollment
 } from "@opengeni/db";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import {
   resolveEnrollmentSigningSecret,
   resolveRelayTokenSecret
@@ -2088,11 +3598,11 @@ var ENROLLMENT_BEARER_TTL_SECONDS = 30 * 24 * 3600;
 var RELAY_TOKEN_TTL_SECONDS = 30 * 24 * 3600;
 var ENROLL_TOKEN_TTL_SECONDS = 3600;
 function mintDeviceCode() {
-  return randomBytes(32).toString("base64url");
+  return randomBytes2(32).toString("base64url");
 }
 var USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 function mintUserCode() {
-  const bytes = randomBytes(8);
+  const bytes = randomBytes2(8);
   let out = "";
   for (let i = 0; i < 8; i += 1) {
     out += USER_CODE_ALPHABET[bytes[i] % USER_CODE_ALPHABET.length];
@@ -2170,18 +3680,18 @@ async function lookupDeviceEnrollment(services, input) {
   const { db } = services;
   return await getPendingDeviceEnrollmentRequestByUserCodeGlobal(db, input.userCode);
 }
-function toLookupResponse(record2) {
+function toLookupResponse(record3) {
   return {
-    workspaceId: record2.workspaceId,
-    userCode: record2.userCode,
+    workspaceId: record3.workspaceId,
+    userCode: record3.userCode,
     machine: {
-      machineName: record2.machineName,
-      os: record2.os,
-      arch: record2.arch,
-      canOfferDisplay: record2.canOfferDisplay,
-      requestsScreenControl: record2.requestsScreenControl
+      machineName: record3.machineName,
+      os: record3.os,
+      arch: record3.arch,
+      canOfferDisplay: record3.canOfferDisplay,
+      requestsScreenControl: record3.requestsScreenControl
     },
-    expiresAt: record2.expiresAt
+    expiresAt: record3.expiresAt
   };
 }
 async function denyDeviceEnrollment(services, input) {
@@ -2338,7 +3848,7 @@ function registerEnrollmentRoutes(app, deps) {
   const { settings, db } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException5(404, { message: "selfhosted enrollment is not enabled for this deployment" });
+      throw new HTTPException7(404, { message: "selfhosted enrollment is not enabled for this deployment" });
     }
   }
   const startLimiter = new TokenBucket({ capacity: 10, refillPerSecond: 0.5 });
@@ -2348,7 +3858,7 @@ function registerEnrollmentRoutes(app, deps) {
   function rateLimit(c, limiter) {
     const ip = clientIp(c);
     if (!limiter.take(ip)) {
-      throw new HTTPException5(429, { message: "too many requests; slow down" });
+      throw new HTTPException7(429, { message: "too many requests; slow down" });
     }
   }
   app.post("/v1/enrollments/device/start", async (c) => {
@@ -2356,12 +3866,12 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, startLimiter);
     const parsed = DeviceEnrollmentStartRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid device-start request" });
+      throw new HTTPException7(400, { message: "invalid device-start request" });
     }
     const body = parsed.data;
     const workspace = await getWorkspace(db, body.workspaceId);
     if (!workspace) {
-      throw new HTTPException5(404, { message: "workspace not found" });
+      throw new HTTPException7(404, { message: "workspace not found" });
     }
     const result = await startDeviceEnrollment({ db, settings }, {
       accountId: workspace.accountId,
@@ -2382,7 +3892,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, pollLimiter);
     const parsed = DeviceEnrollmentPollRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid device-poll request" });
+      throw new HTTPException7(400, { message: "invalid device-poll request" });
     }
     const result = await pollDeviceEnrollment({ db, settings }, { deviceCode: parsed.data.deviceCode });
     return c.json(result, 200);
@@ -2392,25 +3902,25 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, lookupLimiter);
     const parsed = DeviceEnrollmentLookupRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid device-lookup request" });
+      throw new HTTPException7(400, { message: "invalid device-lookup request" });
     }
-    const record2 = await lookupDeviceEnrollment({ db, settings }, { userCode: parsed.data.userCode });
-    if (!record2) {
-      throw new HTTPException5(404, { message: "no pending enrollment for that code" });
+    const record3 = await lookupDeviceEnrollment({ db, settings }, { userCode: parsed.data.userCode });
+    if (!record3) {
+      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
     }
     try {
-      await requireAccessGrant4(c, deps, record2.workspaceId, "enrollments:read");
+      await requireAccessGrant5(c, deps, record3.workspaceId, "enrollments:read");
     } catch {
-      throw new HTTPException5(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
     }
-    return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record2)), 200);
+    return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record3)), 200);
   });
   app.post("/v1/enrollments/token/exchange", async (c) => {
     assertSelfhostedEnabled();
     rateLimit(c, exchangeLimiter);
     const parsed = EnrollTokenExchangeRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid enroll-token-exchange request" });
+      throw new HTTPException7(400, { message: "invalid enroll-token-exchange request" });
     }
     const body = parsed.data;
     const result = await exchangeEnrollToken({ db, settings }, {
@@ -2423,19 +3933,19 @@ function registerEnrollmentRoutes(app, deps) {
     });
     if (!result.ok) {
       if (result.reason === "disabled") {
-        throw new HTTPException5(503, { message: "enrollment credential plane is not configured" });
+        throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
       }
-      throw new HTTPException5(401, { message: "invalid or expired enroll token" });
+      throw new HTTPException7(401, { message: "invalid or expired enroll token" });
     }
     return c.json(EnrollTokenExchangeResponse.parse({ credentials: result.credentials }), 201);
   });
   app.post("/v1/workspaces/:workspaceId/enrollments/device/approve", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "enrollments:manage");
+    const grant = await requireAccessGrant5(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentApproveRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid device-approve request" });
+      throw new HTTPException7(400, { message: "invalid device-approve request" });
     }
     const body = parsed.data;
     const approved = await approveDeviceEnrollment({ db, settings }, {
@@ -2448,7 +3958,7 @@ function registerEnrollmentRoutes(app, deps) {
       approvedBySubjectLabel: grant.subjectLabel ?? null
     });
     if (!approved) {
-      throw new HTTPException5(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentApproveResponse.parse({
       approved: true,
@@ -2459,11 +3969,11 @@ function registerEnrollmentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/enrollments/device/deny", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "enrollments:manage");
+    const grant = await requireAccessGrant5(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentDenyRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid device-deny request" });
+      throw new HTTPException7(400, { message: "invalid device-deny request" });
     }
     const result = await denyDeviceEnrollment({ db, settings }, {
       accountId: grant.accountId,
@@ -2474,11 +3984,11 @@ function registerEnrollmentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/enrollments/token", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "enrollments:manage");
+    const grant = await requireAccessGrant5(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
     const parsed = MintEnrollTokenRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: "invalid mint-enroll-token request" });
+      throw new HTTPException7(400, { message: "invalid mint-enroll-token request" });
     }
     const minted = await mintEnrollToken({ db, settings }, {
       accountId: grant.accountId,
@@ -2486,13 +3996,13 @@ function registerEnrollmentRoutes(app, deps) {
       allowScreenControl: parsed.data.allowScreenControl
     });
     if (!minted) {
-      throw new HTTPException5(503, { message: "enrollment credential plane is not configured" });
+      throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
     }
     return c.json(MintEnrollTokenResponse.parse(minted), 201);
   });
   app.get("/v1/workspaces/:workspaceId/enrollments", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant4(c, deps, workspaceId, "enrollments:read");
+    await requireAccessGrant5(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const statusFilter = c.req.query("status");
     const rows = await listEnrollments(db, workspaceId, statusFilter === "active" ? { status: "active" } : {});
@@ -2502,6 +4012,7 @@ function registerEnrollmentRoutes(app, deps) {
         pubkey: row.pubkey,
         exposure: row.exposure,
         hasDisplay: row.hasDisplay,
+        desktopUnavailableReason: row.desktopUnavailableReason,
         allowScreenControl: row.allowScreenControl,
         status: row.status,
         os: row.os,
@@ -2514,7 +4025,7 @@ function registerEnrollmentRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/enrollments/:enrollmentId/revoke", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "enrollments:manage");
+    const grant = await requireAccessGrant5(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
     const result = await revokeEnrollment(db, {
       accountId: grant.accountId,
@@ -2569,8 +4080,8 @@ import {
   getEnrollment as getEnrollment2,
   readMachineMetricsSeries
 } from "@opengeni/db";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
 import { buildFleetContextForSession as buildFleetContextForSession2, swapActiveSandbox as swapActiveSandbox2 } from "@opengeni/core";
 
 // src/sandbox/machines.ts
@@ -2685,6 +4196,7 @@ async function listMachines(services, input) {
       os: "linux",
       arch: "x86_64",
       hasDisplay: false,
+      desktopUnavailableReason: null,
       allowScreenControl: false,
       sharedSessionCount: 1,
       lastSeenAt: null,
@@ -2721,6 +4233,7 @@ async function listMachines(services, input) {
       os: enrollment.os,
       arch: enrollment.arch,
       hasDisplay: enrollment.hasDisplay,
+      desktopUnavailableReason: enrollment.desktopUnavailableReason,
       allowScreenControl: enrollment.allowScreenControl,
       sharedSessionCount,
       lastSeenAt: enrollment.lastSeenAt,
@@ -2742,12 +4255,12 @@ function registerMachineRoutes(app, deps) {
   const { settings, db, bus } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException6(404, { message: "selfhosted machines are not enabled for this deployment" });
+      throw new HTTPException8(404, { message: "selfhosted machines are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/machines", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant5(c, deps, workspaceId, "enrollments:read");
+    await requireAccessGrant6(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const sessionId = c.req.query("sessionId") ?? null;
     const response = await listMachines({ db, settings, bus }, { workspaceId, sessionId });
@@ -2755,12 +4268,12 @@ function registerMachineRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/machines/:enrollmentId/metrics/series", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant5(c, deps, workspaceId, "enrollments:read");
+    await requireAccessGrant6(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const enrollmentId = c.req.param("enrollmentId");
     const enrollment = await getEnrollment2(db, workspaceId, enrollmentId);
     if (!enrollment) {
-      throw new HTTPException6(404, { message: "machine not found in this workspace" });
+      throw new HTTPException8(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;
     const since = new Date(Date.now() - windowMs);
@@ -2771,7 +4284,7 @@ function registerMachineRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/active-sandbox", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant5(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant6(c, deps, workspaceId, "sessions:control");
     assertSelfhostedEnabled();
     const sessionId = c.req.param("sessionId");
     const body = SwapActiveSandboxRequest.parse(await c.req.json());
@@ -2799,51 +4312,51 @@ import {
   createWorkspaceEnvironment as createWorkspaceEnvironment2,
   deleteWorkspaceEnvironment,
   deleteWorkspaceEnvironmentVariable,
-  encryptEnvironmentValue as encryptEnvironmentValue3,
+  encryptEnvironmentValue as encryptEnvironmentValue5,
   getWorkspaceEnvironmentByName as getWorkspaceEnvironmentByName2,
   listWorkspaceEnvironments as listWorkspaceEnvironments2,
   setWorkspaceEnvironmentVariable as setWorkspaceEnvironmentVariable2,
   updateWorkspaceEnvironment
 } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant7 } from "@opengeni/core";
 import {
   assertAllowedEnvironmentVariableName as assertAllowedEnvironmentVariableName2,
   MAX_ENVIRONMENTS_PER_WORKSPACE as MAX_ENVIRONMENTS_PER_WORKSPACE2,
   MAX_VARIABLES_PER_ENVIRONMENT as MAX_VARIABLES_PER_ENVIRONMENT2,
   recordEnvironmentAuditEvent as recordEnvironmentAuditEvent2,
-  requireEnvironmentEncryption as requireEnvironmentEncryption2,
+  requireEnvironmentEncryption as requireEnvironmentEncryption4,
   requireEnvironmentForApi
 } from "@opengeni/core";
 function registerEnvironmentRoutes(app, deps) {
   const { settings, db } = deps;
   app.get("/v1/workspaces/:workspaceId/environments", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "environments:use");
+    await requireAccessGrant7(c, deps, workspaceId, "environments:use");
     return c.json(await listWorkspaceEnvironments2(db, workspaceId));
   });
   app.post("/v1/workspaces/:workspaceId/environments", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant6(c, deps, workspaceId, "environments:manage");
-    const key = requireEnvironmentEncryption2(settings);
+    const grant = await requireAccessGrant7(c, deps, workspaceId, "environments:manage");
+    const key = requireEnvironmentEncryption4(settings);
     const payload = CreateWorkspaceEnvironmentRequest.parse(await c.req.json());
     const name = trimmedEnvironmentName(payload.name);
     if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException7(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const variableNames = /* @__PURE__ */ new Set();
     for (const variable of payload.variables) {
       assertAllowedEnvironmentVariableName2(variable.name);
       if (variableNames.has(variable.name)) {
-        throw new HTTPException7(422, { message: `duplicate environment variable name: ${variable.name}` });
+        throw new HTTPException9(422, { message: `duplicate environment variable name: ${variable.name}` });
       }
       variableNames.add(variable.name);
     }
     if (await countWorkspaceEnvironments2(db, workspaceId) >= MAX_ENVIRONMENTS_PER_WORKSPACE2) {
-      throw new HTTPException7(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
+      throw new HTTPException9(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
     }
     if (await getWorkspaceEnvironmentByName2(db, workspaceId, name)) {
-      throw new HTTPException7(409, { message: `environment name is already in use: ${name}` });
+      throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
     }
     const created = await createWorkspaceEnvironment2(db, {
       accountId: grant.accountId,
@@ -2852,7 +4365,7 @@ function registerEnvironmentRoutes(app, deps) {
       description: payload.description ?? null,
       variables: payload.variables.map((variable) => ({
         name: variable.name,
-        valueEncrypted: encryptEnvironmentValue3(key, variable.value)
+        valueEncrypted: encryptEnvironmentValue5(key, variable.value)
       }))
     });
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.created", environmentId: created.id });
@@ -2860,19 +4373,19 @@ function registerEnvironmentRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/environments/:environmentId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant6(c, deps, workspaceId, "environments:use");
+    await requireAccessGrant7(c, deps, workspaceId, "environments:use");
     return c.json(await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId")));
   });
   app.patch("/v1/workspaces/:workspaceId/environments/:environmentId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant6(c, deps, workspaceId, "environments:manage");
+    const grant = await requireAccessGrant7(c, deps, workspaceId, "environments:manage");
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const payload = UpdateWorkspaceEnvironmentRequest.parse(await c.req.json());
     const name = payload.name !== void 0 ? trimmedEnvironmentName(payload.name) : void 0;
     if (name !== void 0 && name !== environment.name) {
       const existing = await getWorkspaceEnvironmentByName2(db, workspaceId, name);
       if (existing && existing.id !== environment.id) {
-        throw new HTTPException7(409, { message: `environment name is already in use: ${name}` });
+        throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
       }
     }
     const updated = await updateWorkspaceEnvironment(db, workspaceId, environment.id, {
@@ -2884,15 +4397,15 @@ function registerEnvironmentRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/environments/:environmentId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant6(c, deps, workspaceId, "environments:manage");
+    const grant = await requireAccessGrant7(c, deps, workspaceId, "environments:manage");
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const attachedTasks = await countScheduledTasksUsingEnvironment(db, workspaceId, environment.id);
     if (attachedTasks > 0) {
-      throw new HTTPException7(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
+      throw new HTTPException9(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
     }
     const activeSessions = await countActiveSessionsUsingEnvironment(db, workspaceId, environment.id);
     if (activeSessions > 0) {
-      throw new HTTPException7(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
+      throw new HTTPException9(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
     }
     await deleteWorkspaceEnvironment(db, workspaceId, environment.id);
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.deleted", environmentId: environment.id });
@@ -2900,33 +4413,33 @@ function registerEnvironmentRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/environments/:environmentId/variables/:name", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant6(c, deps, workspaceId, "environments:manage");
-    const key = requireEnvironmentEncryption2(settings);
+    const grant = await requireAccessGrant7(c, deps, workspaceId, "environments:manage");
+    const key = requireEnvironmentEncryption4(settings);
     const name = parseVariableName(c.req.param("name"));
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const payload = SetWorkspaceEnvironmentVariableRequest.parse(await c.req.json());
     const exists = environment.variables.some((variable) => variable.name === name);
     if (!exists && environment.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException7(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const metadata = await setWorkspaceEnvironmentVariable2(db, {
       accountId: grant.accountId,
       workspaceId,
       environmentId: environment.id,
       name,
-      valueEncrypted: encryptEnvironmentValue3(key, payload.value)
+      valueEncrypted: encryptEnvironmentValue5(key, payload.value)
     });
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.variable.set", environmentId: environment.id, variableName: name });
     return c.json(metadata);
   });
   app.delete("/v1/workspaces/:workspaceId/environments/:environmentId/variables/:name", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant6(c, deps, workspaceId, "environments:manage");
+    const grant = await requireAccessGrant7(c, deps, workspaceId, "environments:manage");
     const name = parseVariableName(c.req.param("name"));
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const deleted = await deleteWorkspaceEnvironmentVariable(db, workspaceId, environment.id, name);
     if (!deleted) {
-      throw new HTTPException7(404, { message: "environment variable not found" });
+      throw new HTTPException9(404, { message: "environment variable not found" });
     }
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.variable.deleted", environmentId: environment.id, variableName: name });
     return c.json({ ok: true });
@@ -2935,7 +4448,7 @@ function registerEnvironmentRoutes(app, deps) {
 function parseVariableName(raw) {
   const parsed = WorkspaceEnvironmentVariableName2.safeParse(raw);
   if (!parsed.success) {
-    throw new HTTPException7(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
+    throw new HTTPException9(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
   }
   assertAllowedEnvironmentVariableName2(parsed.data);
   return parsed.data;
@@ -2943,7 +4456,7 @@ function parseVariableName(raw) {
 function trimmedEnvironmentName(name) {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException7(422, { message: "environment name is required" });
+    throw new HTTPException9(422, { message: "environment name is required" });
   }
   return trimmed;
 }
@@ -2963,21 +4476,21 @@ import {
   markFileUploadFailed,
   requireFile as requireFile2
 } from "@opengeni/db";
-import { HTTPException as HTTPException8 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant7 } from "@opengeni/core";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant8 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 function registerFileRoutes(app, deps) {
   const { db, objectStorage } = deps;
   app.post("/v1/workspaces/:workspaceId/files/uploads", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant7(c, deps, workspaceId, "files:upload");
+    const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException8(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const payload = CreateFileUploadRequest.parse(await c.req.json());
     await requireLimit3(deps, { accountId: grant.accountId, workspaceId, action: "file:upload", quantity: payload.sizeBytes });
     if (payload.sizeBytes > objectStorage.maxSinglePutSizeBytes) {
-      throw new HTTPException8(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
+      throw new HTTPException10(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
     }
     const fileId = crypto.randomUUID();
     const safeFilename = sanitizeFilename(payload.filename);
@@ -3011,35 +4524,35 @@ function registerFileRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/files/uploads/:uploadId/complete", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant7(c, deps, workspaceId, "files:upload");
+    const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException8(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const upload = await getFileUpload(db, workspaceId, c.req.param("uploadId"));
     if (!upload) {
-      throw new HTTPException8(404, { message: "file upload not found" });
+      throw new HTTPException10(404, { message: "file upload not found" });
     }
     if (upload.status !== "pending") {
-      throw new HTTPException8(409, { message: `file upload is ${upload.status}` });
+      throw new HTTPException10(409, { message: `file upload is ${upload.status}` });
     }
     if (upload.expiresAt.getTime() < Date.now()) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException8(409, { message: "file upload has expired" });
+      throw new HTTPException10(409, { message: "file upload has expired" });
     }
     const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException8(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
+      throw new HTTPException10(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
     });
     if (Number(head.ContentLength ?? -1) !== upload.file.sizeBytes) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException8(422, { message: "uploaded object size does not match file metadata" });
+      throw new HTTPException10(422, { message: "uploaded object size does not match file metadata" });
     }
     if (upload.file.contentType && head.ContentType && head.ContentType !== upload.file.contentType) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException8(422, { message: "uploaded object content type does not match file metadata" });
+      throw new HTTPException10(422, { message: "uploaded object content type does not match file metadata" });
     }
     if (upload.file.sha256 && head.Metadata?.sha256 !== upload.file.sha256) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException8(422, { message: "uploaded object checksum metadata does not match file metadata" });
+      throw new HTTPException10(422, { message: "uploaded object checksum metadata does not match file metadata" });
     }
     const file = await completeFileUpload(db, workspaceId, upload.id);
     await recordWorkspaceUsage3(deps, {
@@ -3057,25 +4570,25 @@ function registerFileRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant7(c, deps, workspaceId, "files:read");
+    await requireAccessGrant8(c, deps, workspaceId, "files:read");
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException8(404, { message: "file not found" });
+      throw new HTTPException10(404, { message: "file not found" });
     }
     return c.json(FileAsset.parse(file));
   });
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant7(c, deps, workspaceId, "files:read");
+    await requireAccessGrant8(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
-      throw new HTTPException8(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException8(404, { message: "file not found" });
+      throw new HTTPException10(404, { message: "file not found" });
     }
     if (file.status !== "ready") {
-      throw new HTTPException8(409, { message: `file is ${file.status}` });
+      throw new HTTPException10(409, { message: `file is ${file.status}` });
     }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
     return c.json(FileDownloadUrlResponse.parse({
@@ -3094,18 +4607,18 @@ function sanitizeFilename(filename) {
 import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
 import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
 import { zValidator } from "@hono/zod-validator";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant8 } from "@opengeni/core";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant9 } from "@opengeni/core";
 import { requireLimit as requireLimit4 } from "@opengeni/core";
 function registerApiKeyRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/api-keys", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant8(c, deps, workspaceId, "api_keys:manage");
+    await requireAccessGrant9(c, deps, workspaceId, "api_keys:manage");
     return c.json({ apiKeys: await listApiKeys(deps.db, workspaceId) });
   });
   app.post("/v1/workspaces/:workspaceId/api-keys", zValidator("json", CreateApiKeyRequest.omit({ workspaceId: true })), async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant8(c, deps, workspaceId, "api_keys:manage");
+    const grant = await requireAccessGrant9(c, deps, workspaceId, "api_keys:manage");
     const body = c.req.valid("json");
     const permissions = body.permissions.length > 0 ? body.permissions : ["workspace:read"];
     ensureDelegablePermissions(grant.permissions, permissions);
@@ -3125,7 +4638,7 @@ function registerApiKeyRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/api-keys/:apiKeyId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant8(c, deps, workspaceId, "api_keys:manage");
+    await requireAccessGrant9(c, deps, workspaceId, "api_keys:manage");
     return c.json(await revokeApiKey(deps.db, workspaceId, c.req.param("apiKeyId")));
   });
 }
@@ -3135,7 +4648,7 @@ function ensureDelegablePermissions(grantPermissions, requested) {
   }
   const missing = requested.filter((permission) => !grantPermissions.includes(permission));
   if (missing.length > 0) {
-    throw new HTTPException9(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
+    throw new HTTPException11(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
   }
 }
 function generateApiKeyToken() {
@@ -3167,7 +4680,7 @@ import {
   recordStripeWebhookEvent,
   upsertBillingCustomer
 } from "@opengeni/db";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 function registerBillingRoutes(app, deps) {
@@ -3181,7 +4694,7 @@ function registerBillingRoutes(app, deps) {
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     const workspaceId = c.req.query("workspaceId");
     if (workspaceId && !context.workspaceGrants.some((grant) => grant.accountId === accountId && grant.workspaceId === workspaceId)) {
-      throw new HTTPException10(403, { message: "missing workspace access for usage query" });
+      throw new HTTPException12(403, { message: "missing workspace access for usage query" });
     }
     return c.json({
       balance: await getBillingBalance(deps.db, accountId),
@@ -3199,12 +4712,12 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/billing/checkout", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException10(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
     }
     const context = await requireAccessContext(c, deps);
     const parsed = CreateCheckoutRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException10(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
+      throw new HTTPException12(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
     }
     const body = parsed.data;
     const accountId = requireSelectedAccount(context, body.accountId, "billing:manage");
@@ -3225,7 +4738,7 @@ function registerBillingRoutes(app, deps) {
       idempotencyKey
     }), { idempotencyKey });
     if (!session.url) {
-      throw new HTTPException10(502, { message: "Stripe did not return a checkout URL" });
+      throw new HTTPException12(502, { message: "Stripe did not return a checkout URL" });
     }
     return c.json(CreateCheckoutResponse.parse({
       checkoutSessionId: session.id,
@@ -3234,18 +4747,18 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/webhooks/stripe", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException10(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
     }
     const signature = c.req.header("stripe-signature");
     if (!signature) {
-      throw new HTTPException10(400, { message: "missing stripe-signature" });
+      throw new HTTPException12(400, { message: "missing stripe-signature" });
     }
     const payload = await c.req.text();
     let event;
     try {
       event = await stripeClient(deps).webhooks.constructEventAsync(payload, signature, deps.settings.stripeWebhookSecret);
     } catch (error) {
-      throw new HTTPException10(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
+      throw new HTTPException12(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
     }
     const firstSeen = await recordStripeWebhookEvent(deps.db, {
       id: event.id,
@@ -3263,7 +4776,7 @@ function registerBillingRoutes(app, deps) {
       await markStripeWebhookProcessed(deps.db, event.id);
       return c.json({ received: true });
     } catch (error) {
-      throw new HTTPException10(500, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException12(500, { message: error instanceof Error ? error.message : String(error) });
     }
   });
 }
@@ -3315,7 +4828,7 @@ function stripeCheckoutSessionCreateParams(input) {
 }
 function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   if (!publicBaseUrl) {
-    throw new HTTPException10(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
+    throw new HTTPException12(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
   }
   const base = new URL(publicBaseUrl);
   const fallback = new URL(fallbackPath, base).toString();
@@ -3324,7 +4837,7 @@ function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   }
   const parsed = new URL(candidate);
   if (parsed.origin !== base.origin) {
-    throw new HTTPException10(400, { message: `${field} must use the OpenGeni public origin` });
+    throw new HTTPException12(400, { message: `${field} must use the OpenGeni public origin` });
   }
   return parsed.toString();
 }
@@ -3556,7 +5069,7 @@ async function getOrCreateStripeCustomer(deps, stripe, context, accountId) {
   }
   const account = await getManagedAccount(deps.db, accountId);
   if (!account) {
-    throw new HTTPException10(404, { message: "account not found" });
+    throw new HTTPException12(404, { message: "account not found" });
   }
   const customer = await stripe.customers.create({
     name: account.name,
@@ -3582,17 +5095,17 @@ function stripeCustomerProvider(input) {
 function requireSelectedAccount(context, requested, permission) {
   const accountId = requested ?? context.defaultAccountId ?? void 0;
   if (!accountId) {
-    throw new HTTPException10(409, { message: "account selection is required" });
+    throw new HTTPException12(409, { message: "account selection is required" });
   }
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException10(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException12(403, { message: `missing permission: ${permission}` });
   }
   return accountId;
 }
 function stripeClient(deps) {
   if (!deps.settings.stripeSecretKey) {
-    throw new HTTPException10(500, { message: "Stripe secret key is not configured" });
+    throw new HTTPException12(500, { message: "Stripe secret key is not configured" });
   }
   return new Stripe(deps.settings.stripeSecretKey);
 }
@@ -3621,7 +5134,7 @@ import {
 import {
   buildGitHubAppManifest,
   convertGitHubAppManifest,
-  createSignedState as createSignedState3,
+  createSignedState as createSignedState4,
   envLinesFromGitHubManifestConversion,
   GitHubAppApiError,
   GitHubAppConfigurationError as GitHubAppConfigurationError2,
@@ -3630,23 +5143,23 @@ import {
   listGitHubAppRepositories as listGitHubAppRepositories2,
   organizationAppManifestUrl,
   personalAppManifestUrl,
-  readSignedState as readSignedState2,
+  readSignedState as readSignedState3,
   stateMaxAgeSeconds as stateMaxAgeSeconds2,
   verifyGitHubInstallationAccessForUser,
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { HTTPException as HTTPException11 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant9 } from "@opengeni/core";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 function registerGitHubRoutes(app, deps) {
   const { db, settings, githubStateSecret } = deps;
   app.get("/v1/workspaces/:workspaceId/github/app", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant9(c, deps, workspaceId, "github:use");
+    const grant = await requireAccessGrant10(c, deps, workspaceId, "github:use");
     const missing = githubAppMissingSettings2(settings);
     const slug = settings.githubAppSlug?.trim() || null;
-    const state = createSignedState3(githubStateSecret, {
+    const state = createSignedState4(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId
     });
@@ -3664,49 +5177,49 @@ function registerGitHubRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const state = c.req.query("state");
     if (!state) {
-      throw new HTTPException11(400, { message: "missing GitHub installation state" });
+      throw new HTTPException13(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState2(state, githubStateSecret);
+    const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.workspaceId !== workspaceId) {
-      throw new HTTPException11(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
     }
     const slug = settings.githubAppSlug?.trim();
     if (!slug) {
-      throw new HTTPException11(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
+      throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
     }
     setGitHubStateCookie(c, deps, state);
     return c.redirect(`https://github.com/apps/${slug}/installations/new?state=${encodeURIComponent(state)}`);
   });
   app.get("/v1/workspaces/:workspaceId/github/repositories", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant9(c, deps, workspaceId, "github:use");
+    await requireAccessGrant10(c, deps, workspaceId, "github:use");
     try {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException11(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException11(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/repositories/sync", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant9(c, deps, workspaceId, "github:use");
+    await requireAccessGrant10(c, deps, workspaceId, "github:use");
     try {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException11(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException11(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/app-manifest", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant9(c, deps, workspaceId, "github:manage");
+    const grant = await requireAccessGrant10(c, deps, workspaceId, "github:manage");
     const payload = GitHubAppManifestCreate.parse(await c.req.json());
     const baseUrl = (settings.githubAppManifestBaseUrl ?? new URL(c.req.url).origin).replace(/\/+$/, "");
-    const state = createSignedState3(githubStateSecret, {
+    const state = createSignedState4(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId
     });
@@ -3730,10 +5243,10 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException11(400, { message: "missing GitHub manifest code" });
+      throw new HTTPException13(400, { message: "missing GitHub manifest code" });
     }
     if (!state || !verifySignedState(state, githubStateSecret)) {
-      throw new HTTPException11(400, { message: "invalid or expired GitHub manifest state" });
+      throw new HTTPException13(400, { message: "invalid or expired GitHub manifest state" });
     }
     try {
       const conversion = await convertGitHubAppManifest(code);
@@ -3744,7 +5257,7 @@ function registerGitHubRoutes(app, deps) {
       return c.html(githubSuccessHtml(envLines, installUrl));
     } catch (error) {
       const message = error instanceof GitHubAppApiError ? error.message : String(error);
-      throw new HTTPException11(502, { message });
+      throw new HTTPException13(502, { message });
     }
   });
   const handleGitHubInstallCallback = async (c) => {
@@ -3753,30 +5266,30 @@ function registerGitHubRoutes(app, deps) {
     const installationIdRaw = c.req.query("installation_id");
     const setupAction = c.req.query("setup_action") ?? null;
     if (!state) {
-      throw new HTTPException11(400, { message: "missing GitHub installation state" });
+      throw new HTTPException13(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState2(state, githubStateSecret);
+    const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string") {
-      throw new HTTPException11(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
     }
     requireGitHubStateCookie(c, state);
-    const grant = await requireAccessGrant9(c, deps, statePayload.workspaceId, "github:manage");
+    const grant = await requireAccessGrant10(c, deps, statePayload.workspaceId, "github:manage");
     if (grant.accountId !== statePayload.accountId) {
-      throw new HTTPException11(403, { message: "GitHub installation state does not match this workspace" });
+      throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
     }
     if (setupAction === "request" && !installationIdRaw) {
       return c.html(githubSetupPendingHtml());
     }
     const installationId = parsePositiveInteger(installationIdRaw);
     if (installationId === null) {
-      throw new HTTPException11(400, { message: "missing or invalid GitHub installation_id" });
+      throw new HTTPException13(400, { message: "missing or invalid GitHub installation_id" });
     }
     if (!code) {
       const clientId = settings.githubClientId?.trim();
       if (!clientId) {
-        throw new HTTPException11(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
+        throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
       }
-      const oauthState = createSignedState3(githubStateSecret, {
+      const oauthState = createSignedState4(githubStateSecret, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         installationId
@@ -3801,15 +5314,15 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException11(400, { message: "missing GitHub OAuth code" });
+      throw new HTTPException13(400, { message: "missing GitHub OAuth code" });
     }
     if (!state) {
-      throw new HTTPException11(400, { message: "missing GitHub OAuth state" });
+      throw new HTTPException13(400, { message: "missing GitHub OAuth state" });
     }
-    const statePayload = readSignedState2(state, githubStateSecret);
+    const statePayload = readSignedState3(state, githubStateSecret);
     const installationId = parsePositiveInteger(String(statePayload?.installationId ?? ""));
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || installationId === null) {
-      throw new HTTPException11(400, { message: "invalid or expired GitHub OAuth state" });
+      throw new HTTPException13(400, { message: "invalid or expired GitHub OAuth state" });
     }
     requireGitHubStateCookie(c, state);
     return await completeGitHubInstallationBinding(deps, c, {
@@ -3822,19 +5335,19 @@ function registerGitHubRoutes(app, deps) {
 async function completeGitHubInstallationBinding(deps, c, input) {
   const { db, settings } = deps;
   if (!input.statePayload.workspaceId || !input.statePayload.accountId) {
-    throw new HTTPException11(400, { message: "invalid or expired GitHub installation state" });
+    throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
   }
-  const grant = await requireAccessGrant9(c, deps, input.statePayload.workspaceId, "github:manage");
+  const grant = await requireAccessGrant10(c, deps, input.statePayload.workspaceId, "github:manage");
   if (grant.accountId !== input.statePayload.accountId) {
-    throw new HTTPException11(403, { message: "GitHub installation state does not match this workspace" });
+    throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
   }
   try {
     const installation = await verifyGitHubInstallationAccessForUser(settings, { code: input.code, installationId: input.installationId });
     if (!installation) {
-      throw new HTTPException11(404, { message: "GitHub App installation was not found for this app" });
+      throw new HTTPException13(404, { message: "GitHub App installation was not found for this app" });
     }
     if (installation.suspended) {
-      throw new HTTPException11(409, { message: "GitHub App installation is suspended" });
+      throw new HTTPException13(409, { message: "GitHub App installation is suspended" });
     }
     await upsertGitHubInstallation(db, {
       accountId: grant.accountId,
@@ -3847,13 +5360,13 @@ async function completeGitHubInstallationBinding(deps, c, input) {
     deleteCookie(c, githubStateCookie, { path: "/v1/github" });
     return c.html(githubSetupSuccessHtml(installation.accountLogin ?? `installation ${input.installationId}`, returnUrl));
   } catch (error) {
-    if (error instanceof HTTPException11) {
+    if (error instanceof HTTPException13) {
       throw error;
     }
     if (error instanceof GitHubAppConfigurationError2) {
-      throw new HTTPException11(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+      throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
     }
-    throw new HTTPException11(502, { message: error instanceof Error ? error.message : String(error) });
+    throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
   }
 }
 function setGitHubStateCookie(c, deps, state) {
@@ -3867,7 +5380,7 @@ function setGitHubStateCookie(c, deps, state) {
 }
 function requireGitHubStateCookie(c, state) {
   if (getCookie(c, githubStateCookie) !== state) {
-    throw new HTTPException11(400, { message: "invalid or expired GitHub installation browser state" });
+    throw new HTTPException13(400, { message: "invalid or expired GitHub installation browser state" });
   }
 }
 function isSecureRequest(c, deps) {
@@ -3934,8 +5447,8 @@ import {
   updatePackInstallationStatus
 } from "@opengeni/db";
 import { getDocumentBase as getDocumentBase2 } from "@opengeni/documents";
-import { HTTPException as HTTPException12 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
+import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant11 } from "@opengeni/core";
 import { requireLimit as requireLimit5 } from "@opengeni/core";
 import { validateEnvironmentAttachment } from "@opengeni/core";
 import {
@@ -3954,7 +5467,7 @@ function registerPackRoutes(app, deps) {
   const { settings, db, objectStorage, workflowClient } = deps;
   app.get("/v1/workspaces/:workspaceId/packs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant10(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant11(c, deps, workspaceId, "workspace:read");
     return c.json({
       packs: await listWorkspaceCapabilityPacks(db, workspaceId),
       installations: await listPackInstallations(db, workspaceId)
@@ -3962,10 +5475,10 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant10(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
-      throw new HTTPException12(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
+      throw new HTTPException14(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
     }
     const { pack, created } = await registerWorkspacePack(db, {
       accountId: grant.accountId,
@@ -3976,13 +5489,13 @@ function registerPackRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/packs/:packId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant10(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
-      throw new HTTPException12(409, { message: "built-in packs cannot be unregistered" });
+      throw new HTTPException14(409, { message: "built-in packs cannot be unregistered" });
     }
     if (!await getWorkspacePack(db, workspaceId, packId)) {
-      throw new HTTPException12(404, { message: "pack not found" });
+      throw new HTTPException14(404, { message: "pack not found" });
     }
     const installation = await getPackInstallation(db, workspaceId, packId);
     if (installation && installation.status === "active") {
@@ -3997,12 +5510,12 @@ function registerPackRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/packs/installations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant10(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant11(c, deps, workspaceId, "workspace:read");
     return c.json(await listPackInstallations(db, workspaceId));
   });
   app.get("/v1/workspaces/:workspaceId/packs/:packId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant10(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant11(c, deps, workspaceId, "workspace:read");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     return c.json({
       pack,
@@ -4011,7 +5524,7 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs/:packId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant10(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     await assertPackSandboxImageCompatible(db, workspaceId, pack);
     const existing = await getPackInstallation(db, workspaceId, pack.id);
@@ -4019,13 +5532,13 @@ function registerPackRoutes(app, deps) {
     const storedEnvironmentId = typeof existing?.metadata.environmentId === "string" ? existing.metadata.environmentId : void 0;
     const environmentId = payload.environmentId ?? storedEnvironmentId;
     if (pack.environment?.required && !environmentId) {
-      throw new HTTPException12(422, { message: "this pack requires an environment attachment; pass environmentId" });
+      throw new HTTPException14(422, { message: "this pack requires an environment attachment; pass environmentId" });
     }
     if (environmentId) {
       const environment = await validateEnvironmentAttachment({ settings, db }, grant, workspaceId, environmentId, { preauthorized: !payload.environmentId });
       const missing = (pack.environment?.requiredVariables ?? []).filter((name) => !environment.variables.some((variable) => variable.name === name));
       if (missing.length > 0) {
-        throw new HTTPException12(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
+        throw new HTTPException14(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
       }
     }
     const installation = await enablePackInstallation(db, {
@@ -4042,17 +5555,17 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant10(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
     const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
     const installation = await getPackInstallation(db, workspaceId, pack.id);
     if (installation?.status !== "active") {
-      throw new HTTPException12(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
+      throw new HTTPException14(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
     }
     const payload = MarketingDailyAnalysisTaskRequest.parse(await c.req.json());
     await requireLimit5(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
     const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
     if (connections.length === 0) {
-      throw new HTTPException12(422, { message: "at least one connected social account is required" });
+      throw new HTTPException14(422, { message: "at least one connected social account is required" });
     }
     await validateDocumentBaseIds(db, workspaceId, payload.documentBaseIds);
     const agentConfig = buildMarketingDailyAnalysisAgentConfig({
@@ -4096,7 +5609,7 @@ function registerPackRoutes(app, deps) {
 async function requirePack(db, workspaceId, packId) {
   const pack = await resolveCapabilityPack(db, workspaceId, packId);
   if (!pack) {
-    throw new HTTPException12(404, { message: "pack not found" });
+    throw new HTTPException14(404, { message: "pack not found" });
   }
   return pack;
 }
@@ -4105,13 +5618,13 @@ async function resolveSocialConnections(db, workspaceId, connectionIds) {
   const connections = ids.length > 0 ? await Promise.all(ids.map(async (id) => {
     const connection = await getSocialConnection(db, workspaceId, id);
     if (!connection) {
-      throw new HTTPException12(422, { message: `unknown social connection: ${id}` });
+      throw new HTTPException14(422, { message: `unknown social connection: ${id}` });
     }
     return connection;
   })) : (await listSocialConnections2(db, workspaceId, 500)).filter((connection) => connection.status === "connected");
   const inactive = connections.find((connection) => connection.status !== "connected");
   if (inactive) {
-    throw new HTTPException12(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
+    throw new HTTPException14(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
   }
   return connections;
 }
@@ -4119,7 +5632,7 @@ async function validateDocumentBaseIds(db, workspaceId, documentBaseIds) {
   for (const baseId of [...new Set(documentBaseIds)]) {
     const base = await getDocumentBase2(db, workspaceId, baseId);
     if (!base) {
-      throw new HTTPException12(422, { message: `unknown document base: ${baseId}` });
+      throw new HTTPException14(422, { message: `unknown document base: ${baseId}` });
     }
   }
 }
@@ -4132,7 +5645,7 @@ import {
   listScheduledTasks as listScheduledTasks2,
   updateScheduledTask as updateScheduledTask2
 } from "@opengeni/db";
-import { requireAccessGrant as requireAccessGrant11 } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant12 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage4, requireLimit as requireLimit6 } from "@opengeni/core";
 import {
   createValidatedScheduledTask as createValidatedScheduledTask3,
@@ -4149,7 +5662,7 @@ function registerScheduledTaskRoutes(app, deps) {
   const { settings, db, workflowClient, objectStorage } = deps;
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:manage");
     const rawPayload = await c.req.json();
     const payload = CreateScheduledTaskRequest2.parse(rawPayload);
     await requireLimit6(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
@@ -4159,17 +5672,17 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:run");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:run");
     return c.json(await listScheduledTasks2(db, workspaceId, boundedLimit(c.req.query("limit"))));
   });
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:run");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:run");
     return c.json(await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId")));
   });
   app.patch("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
+    const grant = await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:manage");
     const taskId = c.req.param("taskId");
     const existing = await requireScheduledTaskForApi(db, workspaceId, taskId);
     const rawPayload = await c.req.json();
@@ -4181,7 +5694,7 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/pause", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const task = await updateScheduledTask2(db, workspaceId, existing.id, { status: "paused" });
     await syncUpdatedScheduledTask2({ db, workflowClient, previous: existing, task });
@@ -4189,7 +5702,7 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/resume", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:manage");
     const existing = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     const task = await updateScheduledTask2(db, workspaceId, existing.id, { status: "active" });
     await syncUpdatedScheduledTask2({ db, workflowClient, previous: existing, task });
@@ -4197,7 +5710,7 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/trigger", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:run");
+    const grant = await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:run");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     await requireLimit6(deps, { accountId: grant.accountId, workspaceId, action: "agent_run:create", quantity: 1, model: task.agentConfig.model ?? deps.settings.openaiModel });
     const body = await c.req.json().catch(() => ({}));
@@ -4221,7 +5734,7 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:manage");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:manage");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     await workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId: task.temporalScheduleId });
     await deleteScheduledTask2(db, workspaceId, task.id);
@@ -4229,7 +5742,7 @@ function registerScheduledTaskRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/scheduled-tasks/:taskId/runs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant11(c, deps, workspaceId, "scheduled_tasks:run");
+    await requireAccessGrant12(c, deps, workspaceId, "scheduled_tasks:run");
     const task = await requireScheduledTaskForApi(db, workspaceId, c.req.param("taskId"));
     return c.json(await listScheduledTaskRuns2(db, workspaceId, task.id, boundedLimit(c.req.query("limit"))));
   });
@@ -4281,14 +5794,14 @@ import {
   recordStreamAcknowledgment,
   reorderQueuedSessionTurns,
   requestSessionCompaction,
-  requireSession as requireSession2,
+  requireSession as requireSession3,
   setSessionCodexPin,
   revokeViewer,
   setSessionGoalStatus as setSessionGoalStatus2,
   updatePtySessionActivity,
   updateQueuedSessionTurn
 } from "@opengeni/db";
-import { appendAndPublishEvents as appendAndPublishEvents4, coalesceSessionEventDeltas } from "@opengeni/events";
+import { appendAndPublishEvents as appendAndPublishEvents5, coalesceSessionEventDeltas } from "@opengeni/events";
 
 // src/sandbox/channel-a.ts
 import { applyGitAuthPointerEnvironment, hasGitHubRepositorySelection, stableSandboxEnvironmentForRun } from "@opengeni/config";
@@ -4302,8 +5815,8 @@ import {
   readLease as readLease2,
   releaseLeaseHolder
 } from "@opengeni/db";
-import { appendAndPublishEvents as appendAndPublishEvents2 } from "@opengeni/events";
-import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { appendAndPublishEvents as appendAndPublishEvents3 } from "@opengeni/events";
+import { HTTPException as HTTPException15 } from "hono/http-exception";
 import {
   establishSandboxSessionFromEnvelope,
   serializeEstablishedSandboxEnvelope,
@@ -4318,7 +5831,7 @@ async function withChannelA(services, ctx, fn) {
   const { db, settings, bus } = services;
   const { accountId, workspaceId, session, subjectId } = ctx;
   if (session.sandboxBackend === "none") {
-    throw new HTTPException13(409, { message: "sandbox not available" });
+    throw new HTTPException15(409, { message: "sandbox not available" });
   }
   const sandboxGroupId = session.sandboxGroupId;
   const viewerId = crypto.randomUUID();
@@ -4346,7 +5859,7 @@ async function withChannelA(services, ctx, fn) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException13(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
+    throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
   }
   let established;
   let leaseSnapshot = acquired.lease;
@@ -4354,7 +5867,7 @@ async function withChannelA(services, ctx, fn) {
     const envelope = await getSandboxSessionEnvelope(db, workspaceId, session.id);
     const workspaceEnvironment = await loadWorkspaceEnvironmentForRun(db, settings, workspaceId, session.environmentId);
     const settingsForSession = session.sandboxBackend !== settings.sandboxBackend ? { ...settings, sandboxBackend: session.sandboxBackend } : settings;
-    const environment = stableSandboxEnvironmentForRun(settingsForSession, workspaceEnvironment?.values ?? {});
+    const environment = stableSandboxEnvironmentForRun(settingsForSession, workspaceEnvironment?.values ?? {}, { workspaceId });
     if (hasGitHubRepositorySelection(session.resources)) {
       applyGitAuthPointerEnvironment(environment, githubAppBotIdentity(settings));
     }
@@ -4369,7 +5882,7 @@ async function withChannelA(services, ctx, fn) {
         });
       } catch (error) {
         await failWarmingToCold(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
-        throw new HTTPException13(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+        throw new HTTPException15(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
       }
       const resumeEnvelope = await serializeEstablishedSandboxEnvelope(established) ?? envelope ?? null;
       const committed = await commitWarmingToWarm(db, {
@@ -4384,7 +5897,7 @@ async function withChannelA(services, ctx, fn) {
         leaseTtlMs
       });
       if (!committed.committed || !committed.lease) {
-        throw new HTTPException13(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
+        throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
       }
       leaseSnapshot = committed.lease;
     } else {
@@ -4398,7 +5911,7 @@ async function withChannelA(services, ctx, fn) {
       });
     }
     const emit = async (events) => {
-      await appendAndPublishEvents2(
+      await appendAndPublishEvents3(
         db,
         bus,
         workspaceId,
@@ -4423,11 +5936,11 @@ async function withChannelA(services, ctx, fn) {
   }
 }
 function mapChannelAError(error) {
-  if (error instanceof HTTPException13) return error;
-  if (error instanceof ChannelAValidationError) return new HTTPException13(400, { message: error.message });
-  if (error instanceof ChannelANotFoundError) return new HTTPException13(404, { message: error.message });
-  if (error instanceof ChannelAConflictError) return new HTTPException13(409, { message: error.message });
-  if (error instanceof ChannelAUnsupportedError) return new HTTPException13(409, { message: error.message });
+  if (error instanceof HTTPException15) return error;
+  if (error instanceof ChannelAValidationError) return new HTTPException15(400, { message: error.message });
+  if (error instanceof ChannelANotFoundError) return new HTTPException15(404, { message: error.message });
+  if (error instanceof ChannelAConflictError) return new HTTPException15(409, { message: error.message });
+  if (error instanceof ChannelAUnsupportedError) return new HTTPException15(409, { message: error.message });
   return error;
 }
 async function dropEstablishedHandle(established) {
@@ -4436,11 +5949,11 @@ async function dropEstablishedHandle(established) {
 
 // src/routes/sessions.ts
 import { negotiateCapabilities } from "@opengeni/runtime/sandbox";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant12 } from "@opengeni/core";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
+import { requireAccessGrant as requireAccessGrant13 } from "@opengeni/core";
 
 // src/sandbox/viewer.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { applyGitAuthPointerEnvironment as applyGitAuthPointerEnvironment2, hasGitHubRepositorySelection as hasGitHubRepositorySelection2, resolveStreamTokenSecret, stableSandboxEnvironmentForRun as stableSandboxEnvironmentForRun2 } from "@opengeni/config";
 import { githubAppBotIdentity as githubAppBotIdentity2 } from "@opengeni/github";
 import {
@@ -4457,8 +5970,8 @@ import {
   releaseLeaseHolder as releaseLeaseHolder2,
   SandboxLeaseSupersededError as SandboxLeaseSupersededError2
 } from "@opengeni/db";
-import { appendAndPublishEvents as appendAndPublishEvents3 } from "@opengeni/events";
-import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { appendAndPublishEvents as appendAndPublishEvents4 } from "@opengeni/events";
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 import {
   DESKTOP_STREAM_PORT,
   ensureDisplayStack,
@@ -4485,7 +5998,7 @@ async function sessionAttachEnvironment(services, workspaceId, session) {
     session.environmentId
   );
   const settingsForSession = session.sandboxBackend !== services.settings.sandboxBackend ? { ...services.settings, sandboxBackend: session.sandboxBackend } : services.settings;
-  const environment = stableSandboxEnvironmentForRun2(settingsForSession, workspaceEnvironment?.values ?? {});
+  const environment = stableSandboxEnvironmentForRun2(settingsForSession, workspaceEnvironment?.values ?? {}, { workspaceId });
   if (hasGitHubRepositorySelection2(session.resources)) {
     applyGitAuthPointerEnvironment2(environment, githubAppBotIdentity2(services.settings));
   }
@@ -4520,7 +6033,7 @@ async function attachViewer(services, input) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException14(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
+    throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
   }
   if (acquired.role === "spawner") {
     const expectedEpoch = acquired.lease.leaseEpoch;
@@ -4561,12 +6074,12 @@ async function attachViewer(services, input) {
       };
     } catch (error) {
       if (error instanceof SandboxLeaseSupersededError2) {
-        throw new HTTPException14(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
+        throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
       }
       await failWarmingToCold2(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
       await release();
-      if (error instanceof HTTPException14) throw error;
-      throw new HTTPException14(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+      if (error instanceof HTTPException16) throw error;
+      throw new HTTPException16(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
     } finally {
       await dropEstablishedHandle2(established);
     }
@@ -4715,7 +6228,7 @@ async function mintDesktopStream(services, input) {
         viewerId
       };
       try {
-        await appendAndPublishEvents3(db, bus, workspaceId, session.id, [
+        await appendAndPublishEvents4(db, bus, workspaceId, session.id, [
           { type: "stream.url.rotated", payload }
         ]);
       } catch {
@@ -4910,7 +6423,7 @@ function viewerIdAsUuid(rawViewerId) {
   if (UUID_RE.test(rawViewerId)) {
     return rawViewerId;
   }
-  const hex = createHash("sha256").update(`opengeni:stream-viewer:${rawViewerId}`).digest("hex");
+  const hex = createHash2("sha256").update(`opengeni:stream-viewer:${rawViewerId}`).digest("hex");
   const b = hex.slice(0, 32).split("");
   b[12] = "5";
   const variantNibble = parseInt(b[16], 16) & 3 | 8;
@@ -4920,7 +6433,7 @@ function viewerIdAsUuid(rawViewerId) {
 }
 
 // src/routes/sessions.ts
-import { settingsWithEnabledCapabilityMcpServers, settingsWithSessionMcpServerMetadata } from "@opengeni/core";
+import { settingsWithEnabledCapabilityMcpServers as settingsWithEnabledCapabilityMcpServers2, settingsWithSessionMcpServerMetadata } from "@opengeni/core";
 import {
   normalizeResources,
   validateFileResources,
@@ -5019,76 +6532,76 @@ function registerSessionRoutes(app, deps) {
   const { settings, db, bus, workflowClient, objectStorage } = deps;
   app.post("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:create");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:create");
     const session = await createSessionForRequest2(deps, grant, workspaceId, await c.req.json());
     return c.json(session, 202);
   });
   app.get("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     return c.json(await listSessions2(db, workspaceId, boundedLimit(c.req.query("limit"))));
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const session = await getSession4(db, workspaceId, c.req.param("sessionId"));
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     return c.json(session);
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/codex-account", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     const body = await c.req.json();
     const target = typeof body.target === "string" ? body.target : "";
     if (!target) {
-      throw new HTTPException15(400, { message: 'target is required ("auto" or an account id)' });
+      throw new HTTPException17(400, { message: 'target is required ("auto" or an account id)' });
     }
     const pinned = target === "auto" ? null : target;
     const ok = await setSessionCodexPin(db, workspaceId, sessionId, pinned);
     if (!ok) {
-      throw new HTTPException15(404, { message: "session or codex account not found" });
+      throw new HTTPException17(404, { message: "session or codex account not found" });
     }
     return c.json({ pinned: target === "auto" ? "auto" : target });
   });
   app.patch("/v1/workspaces/:workspaceId/sessions/:sessionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const payload = UpdateSessionRequest.parse(await c.req.json());
     await updateSessionTitle2({ db, bus }, workspaceId, sessionId, payload.title, "user");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     return c.json(session);
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/goal", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const goal = await getSessionGoal2(db, workspaceId, sessionId);
     if (!goal) {
-      throw new HTTPException15(404, { message: "session goal not found" });
+      throw new HTTPException17(404, { message: "session goal not found" });
     }
     return c.json(goal);
   });
   app.patch("/v1/workspaces/:workspaceId/sessions/:sessionId/goal", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const payload = UpdateSessionGoalRequest.parse(await c.req.json());
     const existing = await getSessionGoal2(db, workspaceId, sessionId);
     if (!existing) {
-      throw new HTTPException15(404, { message: "session goal not found" });
+      throw new HTTPException17(404, { message: "session goal not found" });
     }
     if (existing.status === "completed") {
-      throw new HTTPException15(409, { message: "session goal is completed; set a new goal instead" });
+      throw new HTTPException17(409, { message: "session goal is completed; set a new goal instead" });
     }
     if (payload.status === "paused") {
       const { goal: goal2, changed: changed2 } = await setSessionGoalStatus2(db, workspaceId, sessionId, {
@@ -5097,7 +6610,7 @@ function registerSessionRoutes(app, deps) {
         pausedReason: "api"
       });
       if (changed2) {
-        await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+        await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
           type: "goal.paused",
           payload: {
             goalId: goal2.id,
@@ -5112,11 +6625,11 @@ function registerSessionRoutes(app, deps) {
       return c.json(goal2);
     }
     if (existing.status !== "paused") {
-      throw new HTTPException15(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
+      throw new HTTPException17(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
     }
     const { goal, changed } = await setSessionGoalStatus2(db, workspaceId, sessionId, { status: "active" });
     if (changed) {
-      await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+      await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
         type: "goal.resumed",
         payload: {
           goalId: goal.id,
@@ -5132,19 +6645,19 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/context/clear", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const clearBody = ClearSessionContextRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!clearBody.success) {
-      throw new HTTPException15(400, { message: "context clear requires an explicit { confirm: true }" });
+      throw new HTTPException17(400, { message: "context clear requires an explicit { confirm: true }" });
     }
-    const session = await requireSession2(db, workspaceId, sessionId);
+    const session = await requireSession3(db, workspaceId, sessionId);
     if (session.status === "queued" || session.status === "running" || session.status === "requires_action") {
-      throw new HTTPException15(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
+      throw new HTTPException17(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
     }
     const result = await clearSessionContext(db, { accountId: grant.accountId, workspaceId, sessionId });
-    await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+    await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
       type: "session.context.cleared",
       payload: {
         clearedBy: "api",
@@ -5156,7 +6669,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/context/compact", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     CompactSessionContextRequest.parse(await c.req.json().catch(() => ({})) ?? {});
@@ -5172,7 +6685,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/events", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const after = eventSequence(c.req.query("after"), 0);
@@ -5188,7 +6701,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const after = Number(c.req.query("after") ?? c.req.header("Last-Event-ID") ?? 0);
@@ -5196,29 +6709,29 @@ function registerSessionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/turns", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     return c.json(await listSessionTurns(db, workspaceId, sessionId, boundedLimit(c.req.query("limit"))));
   });
   app.patch("/v1/workspaces/:workspaceId/sessions/:sessionId/turns/:turnId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     const turnId = c.req.param("turnId");
     await assertSessionExists(db, workspaceId, sessionId);
     const existing = await requireQueuedTurnForApi(db, workspaceId, sessionId, turnId);
     const payload = UpdateSessionTurnRequest.parse(await c.req.json());
     assertConfiguredModel(settings, payload.model);
-    const session = await requireSession2(db, workspaceId, sessionId);
+    const session = await requireSession3(db, workspaceId, sessionId);
     const runtimeSettings = settingsWithSessionMcpServerMetadata(
-      await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings),
+      await settingsWithEnabledCapabilityMcpServers2(db, workspaceId, settings),
       session.mcpServers
     );
     const resources = payload.resources !== void 0 ? normalizeResources(payload.resources) : existing.resources;
     const tools = payload.tools !== void 0 ? validateToolRefs(payload.tools, runtimeSettings) : existing.tools;
     if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-      throw new HTTPException15(503, { message: "object storage is not configured" });
+      throw new HTTPException17(503, { message: "object storage is not configured" });
     }
     await validateFileResources(db, workspaceId, resources);
     await validateGitHubRepositorySelection(db, workspaceId, [...session.resources, ...resources]);
@@ -5231,7 +6744,7 @@ function registerSessionRoutes(app, deps) {
       resources,
       tools
     });
-    await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+    await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
       type: "turn.updated",
       turnId: turn.id,
       payload: { turnId: turn.id }
@@ -5240,12 +6753,12 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/turns/reorder", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     await assertSessionExists(db, workspaceId, sessionId);
     const payload = ReorderSessionTurnsRequest.parse(await c.req.json());
     const turns = await reorderQueuedSessionTurns(db, workspaceId, sessionId, payload.turnIds);
-    await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+    await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
       type: "turn.updated",
       payload: { reorderedTurnIds: payload.turnIds }
     }]);
@@ -5254,13 +6767,13 @@ function registerSessionRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/sessions/:sessionId/turns/:turnId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     const turnId = c.req.param("turnId");
     await assertSessionExists(db, workspaceId, sessionId);
     await requireQueuedTurnForApi(db, workspaceId, sessionId, turnId);
     const turn = await cancelQueuedSessionTurn(db, workspaceId, turnId);
-    await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [{
+    await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
       type: "turn.cancelled",
       turnId: turn.id,
       payload: { turnId: turn.id, triggerEventId: turn.triggerEventId }
@@ -5269,7 +6782,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/events", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
     const rawEvent = await c.req.json();
     const event = ClientSessionEvent.parse(rawEvent);
@@ -5286,19 +6799,19 @@ function registerSessionRoutes(app, deps) {
       });
       return c.json(accepted2, 202);
     }
-    const session = await requireSession2(db, workspaceId, sessionId);
+    const session = await requireSession3(db, workspaceId, sessionId);
     if (event.type === "user.approvalDecision" && session.status !== "requires_action") {
-      throw new HTTPException15(409, { message: `session is ${session.status}; no approval is pending` });
+      throw new HTTPException17(409, { message: `session is ${session.status}; no approval is pending` });
     }
     const eventsToAppend = [{
       type: event.type,
       payload: event.payload,
       ...event.clientEventId ? { clientEventId: event.clientEventId } : {}
     }];
-    const appended = await appendAndPublishEvents4(db, bus, workspaceId, sessionId, eventsToAppend);
+    const appended = await appendAndPublishEvents5(db, bus, workspaceId, sessionId, eventsToAppend);
     const accepted = appended[0];
     if (!accepted) {
-      throw new HTTPException15(500, { message: "failed to append client event" });
+      throw new HTTPException17(500, { message: "failed to append client event" });
     }
     const workflowId = workflowIdForSession2(sessionId);
     if (event.type === "user.approvalDecision") {
@@ -5316,7 +6829,7 @@ function registerSessionRoutes(app, deps) {
   });
   function assertOwnershipEnabled() {
     if (!settings.sandboxOwnershipEnabled) {
-      throw new HTTPException15(404, { message: "sandbox ownership is not enabled for this deployment" });
+      throw new HTTPException17(404, { message: "sandbox ownership is not enabled for this deployment" });
     }
   }
   async function resolveSharedExposure(workspaceId, session) {
@@ -5326,12 +6839,12 @@ function registerSessionRoutes(app, deps) {
   }
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/stream-capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "sessions:read");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     const lease = await readGroupLease({ db, settings }, { workspaceId, sandboxGroupId: session.sandboxGroupId });
     const { shared, sharedSessionIds } = await resolveSharedExposure(workspaceId, session);
@@ -5421,16 +6934,16 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/stream-capabilities/acknowledge", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "stream:acknowledge");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "stream:acknowledge");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     const parsed = AcknowledgeStreamRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException15(400, { message: "invalid stream acknowledgment request" });
+      throw new HTTPException17(400, { message: "invalid stream acknowledgment request" });
     }
     const recorded = await recordStreamAcknowledgment(db, {
       accountId: grant.accountId,
@@ -5444,26 +6957,26 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/viewers", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "stream:view");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     const parsed = AttachViewerRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException15(400, { message: "invalid viewer attach request" });
+      throw new HTTPException17(400, { message: "invalid viewer attach request" });
     }
     const wantDesktop = parsed.data.desktop ?? false;
     const { shared } = await resolveSharedExposure(workspaceId, session);
     if (wantDesktop) {
       const ack = await getStreamAcknowledgment(db, { workspaceId, sandboxGroupId: session.sandboxGroupId, subjectId: grant.subjectId });
       if (!ack?.acknowledgedUnredacted) {
-        throw new HTTPException15(409, { message: "stream_acknowledgment_required" });
+        throw new HTTPException17(409, { message: "stream_acknowledgment_required" });
       }
       if (shared && !ack.acknowledgedShared) {
-        throw new HTTPException15(409, { message: "shared_acknowledgment_required" });
+        throw new HTTPException17(409, { message: "shared_acknowledgment_required" });
       }
     }
     const activeSandbox = session.activeSandboxId ? await getSandbox2(db, workspaceId, session.activeSandboxId) : null;
@@ -5557,16 +7070,16 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/viewers/:viewerId/heartbeat", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "stream:view");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     const parsed = ViewerHeartbeatRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException15(400, { message: "viewer heartbeat requires { leaseEpoch }" });
+      throw new HTTPException17(400, { message: "viewer heartbeat requires { leaseEpoch }" });
     }
     const alive = await heartbeatViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -5579,12 +7092,12 @@ function registerSessionRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/sessions/:sessionId/viewers/:viewerId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "stream:view");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     await detachViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -5596,12 +7109,12 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/viewers/:viewerId/revoke", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant12(c, deps, workspaceId, "stream:view");
+    const grant = await requireAccessGrant13(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     const result = await revokeViewer(db, {
       accountId: grant.accountId,
@@ -5614,12 +7127,12 @@ function registerSessionRoutes(app, deps) {
   });
   async function channelAPreamble(c, permission) {
     const workspaceId = c.req.param("workspaceId") ?? "";
-    const grant = await requireAccessGrant12(c, deps, workspaceId, permission);
+    const grant = await requireAccessGrant13(c, deps, workspaceId, permission);
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId") ?? "";
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException15(404, { message: "session not found" });
+      throw new HTTPException17(404, { message: "session not found" });
     }
     return { accountId: grant.accountId, workspaceId, session, subjectId: grant.subjectId };
   }
@@ -5627,7 +7140,7 @@ function registerSessionRoutes(app, deps) {
     const raw = await c.req.json().catch(() => void 0);
     const result = schema.safeParse(raw ?? {});
     if (!result.success) {
-      throw new HTTPException15(400, { message: "invalid request body" });
+      throw new HTTPException17(400, { message: "invalid request body" });
     }
     return result.data;
   }
@@ -5722,7 +7235,7 @@ function registerSessionRoutes(app, deps) {
         const delta = { ptyId, stream: "stdout", chunk: opened.initialOutput, seq: 0 };
         events.push({ type: "terminal.pty.output.delta", payload: delta });
       }
-      await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, events);
+      await appendAndPublishEvents5(db, bus, ctx.workspaceId, ctx.session.id, events);
       return opened.response;
     });
     return c.json(out, 201);
@@ -5732,10 +7245,10 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyWriteRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException15(404, { message: "pty not found or closed" });
+      throw new HTTPException17(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId === null) {
-      throw new HTTPException15(409, { message: "interactive terminal unsupported on this backend" });
+      throw new HTTPException17(409, { message: "interactive terminal unsupported on this backend" });
     }
     let seq = 1;
     await withChannelA({ db, settings, bus }, ctx, async ({ service }) => {
@@ -5743,7 +7256,7 @@ function registerSessionRoutes(app, deps) {
       await updatePtySessionActivity(db, { accountId: ctx.accountId, workspaceId: ctx.workspaceId, ptyId: req.ptyId, execSessionId: pty.execSessionId });
       if (output) {
         const delta = { ptyId: req.ptyId, stream: "stdout", chunk: output, seq: seq++ };
-        await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, [{ type: "terminal.pty.output.delta", payload: delta }]);
+        await appendAndPublishEvents5(db, bus, ctx.workspaceId, ctx.session.id, [{ type: "terminal.pty.output.delta", payload: delta }]);
       }
     });
     return c.body(null, 204);
@@ -5753,7 +7266,7 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyResizeRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException15(404, { message: "pty not found or closed" });
+      throw new HTTPException17(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId !== null) {
       await withChannelA({ db, settings, bus }, ctx, ({ service }) => service.ptyResize(req, pty.execSessionId));
@@ -5769,7 +7282,7 @@ function registerSessionRoutes(app, deps) {
       await withChannelA({ db, settings, bus }, ctx, ({ service }) => service.ptyClose(req, pty.execSessionId));
       await closePtySession(db, { accountId: ctx.accountId, workspaceId: ctx.workspaceId, ptyId: req.ptyId });
       const exited = { ptyId: req.ptyId, exitCode: 0, reason: "exit" };
-      await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, [{ type: "terminal.pty.exited", payload: exited }]);
+      await appendAndPublishEvents5(db, bus, ctx.workspaceId, ctx.session.id, [{ type: "terminal.pty.exited", payload: exited }]);
     }
     return c.body(null, 204);
   });
@@ -5823,19 +7336,19 @@ import {
   listSocialConnections as listSocialConnections3,
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException18 } from "hono/http-exception";
 import { z as z2 } from "zod";
-import { requireAccessGrant as requireAccessGrant13 } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant14 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
   const { db } = deps;
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant13(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant14(c, deps, workspaceId, "workspace:read");
     return c.json(await listSocialConnections3(db, workspaceId, boundedLimit(c.req.query("limit"))));
   });
   app.post("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant13(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "workspace:admin");
     const payload = CreateSocialConnectionRequest.parse(await c.req.json());
     try {
       return c.json(await createSocialConnection(db, {
@@ -5857,7 +7370,7 @@ function registerSocialRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant13(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant14(c, deps, workspaceId, "workspace:read");
     const since = parseSince(c.req.query("since"));
     const connectionIds = parseConnectionIds(c.req.query("connectionIds") ?? c.req.query("connectionId"));
     return c.json(await listSocialPosts2(db, {
@@ -5869,7 +7382,7 @@ function registerSocialRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant13(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "workspace:admin");
     const payload = CreateSocialPostRequest.parse(await c.req.json());
     try {
       return c.json(await createSocialPost(db, {
@@ -5895,7 +7408,7 @@ function parseSince(raw) {
   }
   const since = new Date(raw);
   if (Number.isNaN(since.getTime())) {
-    throw new HTTPException16(422, { message: "since must be an ISO date-time" });
+    throw new HTTPException18(422, { message: "since must be an ISO date-time" });
   }
   return since;
 }
@@ -5906,7 +7419,7 @@ function parseConnectionIds(raw) {
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
   const parsed = z2.array(z2.string().uuid()).safeParse(values);
   if (!parsed.success) {
-    throw new HTTPException16(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
+    throw new HTTPException18(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
   }
   const ids = parsed.data;
   return [...new Set(ids)];
@@ -5914,12 +7427,12 @@ function parseConnectionIds(raw) {
 function socialHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException16(404, { message });
+    return new HTTPException18(404, { message });
   }
   if (message.includes("duplicate key")) {
-    return new HTTPException16(409, { message: "social connection or post already exists" });
+    return new HTTPException18(409, { message: "social connection or post already exists" });
   }
-  return new HTTPException16(500, { message });
+  return new HTTPException18(500, { message });
 }
 
 // src/routes/workspaces.ts
@@ -5947,8 +7460,8 @@ import {
   requireWorkspace,
   updateWorkspace
 } from "@opengeni/db";
-import { HTTPException as HTTPException17 } from "hono/http-exception";
-import { hasPermission as hasPermission2, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant14 } from "@opengeni/core";
+import { HTTPException as HTTPException19 } from "hono/http-exception";
+import { hasPermission as hasPermission3, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import { assertWorkspaceDeletable, assertWorkspaceMemberRemovable, resolveMemberSubjectId } from "@opengeni/core";
 function registerWorkspaceRoutes(app, deps) {
@@ -5957,7 +7470,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.get("/v1/workspaces", async (c) => {
     const context = await requireAccessContext2(c, deps);
-    const readableWorkspaceIds = [...new Set(context.workspaceGrants.filter((grant) => hasPermission2(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId))];
+    const readableWorkspaceIds = [...new Set(context.workspaceGrants.filter((grant) => hasPermission3(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId))];
     if (readableWorkspaceIds.length > 0) {
       const workspaces = await Promise.all(readableWorkspaceIds.map((workspaceId) => requireWorkspace(deps.db, workspaceId)));
       return c.json(workspaces.map((workspace) => Workspace.parse(workspace)));
@@ -5969,7 +7482,7 @@ function registerWorkspaceRoutes(app, deps) {
     const payload = CreateWorkspaceRequest.parse(await c.req.json());
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
-      throw new HTTPException17(409, { message: "account selection is required" });
+      throw new HTTPException19(409, { message: "account selection is required" });
     }
     requireAccountPermission(context, accountId, "workspace:create");
     await requireLimit7(deps, { accountId, action: "workspace:create", quantity: 1 });
@@ -5993,12 +7506,12 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant14(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
     return c.json(Workspace.parse(await requireWorkspace(deps.db, workspaceId)));
   });
   app.patch("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant14(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant15(c, deps, workspaceId, "workspace:admin");
     const payload = UpdateWorkspaceRequest.parse(await c.req.json());
     const workspace = await updateWorkspace(deps.db, workspaceId, {
       ...payload.name !== void 0 ? { name: payload.name.trim() } : {},
@@ -6009,7 +7522,7 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant14(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "workspace:admin");
     const [workspaceCountForAccount, activeSessionCount] = await Promise.all([
       countWorkspacesForAccount(deps.db, grant.accountId),
       countActiveSessionsForWorkspace(deps.db, workspaceId)
@@ -6024,13 +7537,13 @@ function registerWorkspaceRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant14(c, deps, workspaceId, "workspace:read");
+    await requireAccessGrant15(c, deps, workspaceId, "workspace:read");
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     return c.json(ListWorkspaceMembersResponse.parse({ members }));
   });
   app.post("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant14(c, deps, workspaceId, "members:manage");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "members:manage");
     const payload = AddWorkspaceMemberRequest.parse(await c.req.json());
     const email = payload.email.trim();
     const subjectId = resolveMemberSubjectId(await getManagedUserByEmail(deps.db, email));
@@ -6045,19 +7558,19 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException17(500, { message: "failed to add member" });
+      throw new HTTPException19(500, { message: "failed to add member" });
     }
     return c.json(WorkspaceMember.parse(member), 201);
   });
   app.patch("/v1/workspaces/:workspaceId/members/:subjectId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant14(c, deps, workspaceId, "members:manage");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "members:manage");
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const payload = UpdateWorkspaceMemberRequest.parse(await c.req.json());
     const existing = await listWorkspaceMembers(deps.db, workspaceId);
     const current = existing.find((member2) => member2.subjectId === subjectId);
     if (!current) {
-      throw new HTTPException17(404, { message: "member not found" });
+      throw new HTTPException19(404, { message: "member not found" });
     }
     await grantWorkspaceAccess(deps.db, {
       accountId: grant.accountId,
@@ -6070,13 +7583,13 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException17(500, { message: "failed to update member" });
+      throw new HTTPException19(500, { message: "failed to update member" });
     }
     return c.json(WorkspaceMember.parse(member));
   });
   app.delete("/v1/workspaces/:workspaceId/members/:subjectId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant14(c, deps, workspaceId, "members:manage");
+    const grant = await requireAccessGrant15(c, deps, workspaceId, "members:manage");
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     assertWorkspaceMemberRemovable({ members, subjectId, callerSubjectId: grant.subjectId });
@@ -6094,7 +7607,7 @@ function normalizeAgentInstructions(value) {
 function requireAccountPermission(context, accountId, permission) {
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException17(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException19(403, { message: `missing permission: ${permission}` });
   }
 }
 
@@ -6121,7 +7634,7 @@ function createApp(deps) {
   const documentIndexer = deps.documentIndexer ?? {
     indexDocument: async ({ accountId, workspaceId, documentId }) => {
       if (!objectStorage) {
-        throw new HTTPException18(503, { message: "object storage is not configured" });
+        throw new HTTPException20(503, { message: "object storage is not configured" });
       }
       return await indexDocumentNow(deps.db, objectStorage, workspaceId, documentId, getDocumentServices(), {
         beforeEmbed: async ({ chunkCount }) => {
@@ -6258,11 +7771,19 @@ function createApp(deps) {
   })));
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant15(c, routeDeps, workspaceId, "workspace:read");
+    const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
+    const toolspace = isToolspaceGrant(routeDeps.settings, grant) ? await prepareToolspaceMcpSurface({ deps: routeDeps, grant }) : null;
     const transport = new WebStandardStreamableHTTPServerTransport2({ enableJsonResponse: true });
-    const mcp = buildOpenGeniMcpServer(routeDeps, grant, { requestOrigin: new URL(c.req.url).origin });
-    await mcp.connect(transport);
-    return await transport.handleRequest(c.req.raw);
+    const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
+      requestOrigin: new URL(c.req.url).origin,
+      toolspace
+    });
+    try {
+      await mcp.connect(transport);
+      return await transport.handleRequest(c.req.raw);
+    } finally {
+      await toolspace?.close().catch(() => void 0);
+    }
   });
   registerFileRoutes(app, routeDeps);
   registerApiKeyRoutes(app, routeDeps);
@@ -6272,6 +7793,7 @@ function createApp(deps) {
   registerInstallRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
+  registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
@@ -6282,6 +7804,17 @@ function createApp(deps) {
   registerCodexRoutes(app, routeDeps);
   return app;
 }
+async function requireMcpAccessGrant(c, deps, workspaceId) {
+  const grant = await requireAccessGrant16(c, deps, workspaceId);
+  if (hasPermission4(grant.permissions, "workspace:read")) {
+    return grant;
+  }
+  if (isToolspaceGrant(deps.settings, grant)) {
+    return grant;
+  }
+  requirePermission(grant, "workspace:read");
+  return grant;
+}
 function clientAuthConfig(settings) {
   if (settings.productAccessMode === "managed") {
     return { mode: "managedSession", session: "cookie" };
@@ -6302,7 +7835,7 @@ function allowedCorsOrigin(pattern, origin) {
   return new RegExp(`^(?:${pattern})$`).test(origin);
 }
 function httpStatusForError(error) {
-  if (error instanceof HTTPException18) {
+  if (error instanceof HTTPException20) {
     return error.status;
   }
   return 500;
@@ -6401,6 +7934,9 @@ var routeLabelPatterns = [
   { pattern: /^\/v1\/workspaces\/[^/]+\/document-bases\/[^/]+\/documents$/, label: "/v1/workspaces/:workspaceId/document-bases/:id/documents" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/document-bases\/[^/]+\/search$/, label: "/v1/workspaces/:workspaceId/document-bases/:id/search" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/document-bases\/[^/]+$/, label: "/v1/workspaces/:workspaceId/document-bases/:id" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/knowledge\/search$/, label: "/v1/workspaces/:workspaceId/knowledge/search" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/knowledge\/memories\/[^/]+$/, label: "/v1/workspaces/:workspaceId/knowledge/memories/:id" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/knowledge\/memories$/, label: "/v1/workspaces/:workspaceId/knowledge/memories" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/github\/app$/, label: "/v1/workspaces/:workspaceId/github/app" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/github\/repositories$/, label: "/v1/workspaces/:workspaceId/github/repositories" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/github\/repositories\/sync$/, label: "/v1/workspaces/:workspaceId/github/repositories/sync" },
@@ -6419,6 +7955,11 @@ var routeLabelPatterns = [
   { pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+$/, label: "/v1/workspaces/:workspaceId/packs/:id" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/social\/connections$/, label: "/v1/workspaces/:workspaceId/social/connections" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/social\/posts$/, label: "/v1/workspaces/:workspaceId/social/posts" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/connections$/, label: "/v1/workspaces/:workspaceId/connections" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/, label: "/v1/workspaces/:workspaceId/connections/oauth/start" },
+  { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/, label: "/v1/workspaces/:workspaceId/connections/:connectionId" },
+  { pattern: /^\/v1\/integrations\/oauth\/callback$/, label: "/v1/integrations/oauth/callback" },
+  { pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/, label: "/v1/integrations/oauth/client-metadata.json" },
   { pattern: /^\/v1\/enrollments\/device\/start$/, label: "/v1/enrollments/device/start" },
   { pattern: /^\/v1\/enrollments\/device\/poll$/, label: "/v1/enrollments/device/poll" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/enrollments\/device\/approve$/, label: "/v1/workspaces/:workspaceId/enrollments/device/approve" },
@@ -6456,4 +7997,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-2JL5OXRE.js.map
+//# sourceMappingURL=chunk-DQ5TIRDZ.js.map