@opengeni/api-router 0.5.2 → 0.5.4

package/src/routes/codex.ts

@@ -33,14 +33,18 @@ import {
   fetchCodexUsageForAccount,
   getCodexCredentialStatus,
   getCodexRotationSettings,
+  listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
   loadCodexCredentialForRun,
   renameCodexAccount,
   setActiveCodexCredential,
+  setInitialActiveCodexCredential,
   updateCodexRotationSettings,
   upsertCodexSubscriptionCredential,
+  withCodexCapacityMutation,
   CODEX_ROTATION_STRATEGIES,
   type CodexAccountStatus,
+  type CodexCapacityWakeTarget,
   type CodexRotationStrategy,
 } from "@opengeni/db";
 
@@ -63,8 +67,16 @@ function codexAccountJson(row: CodexAccountStatus) {
     expiresAt: row.expiresAt,
     lastRefreshAt: row.lastRefreshAt,
     lastError: row.lastError,
-    fiveHour: buildCodexUsageWindowFromCache(row.primaryUsedPercent, row.primaryResetAt, CODEX_FIVE_HOUR_WINDOW_SECONDS),
-    weekly: buildCodexUsageWindowFromCache(row.secondaryUsedPercent, row.secondaryResetAt, CODEX_WEEKLY_WINDOW_SECONDS),
+    fiveHour: buildCodexUsageWindowFromCache(
+      row.primaryUsedPercent,
+      row.primaryResetAt,
+      CODEX_FIVE_HOUR_WINDOW_SECONDS,
+    ),
+    weekly: buildCodexUsageWindowFromCache(
+      row.secondaryUsedPercent,
+      row.secondaryResetAt,
+      CODEX_WEEKLY_WINDOW_SECONDS,
+    ),
     usageCheckedAt: row.usageCheckedAt,
     // P3 rotation cooldown: when set and in the future, this account is cooling-down.
     exhaustedUntil: row.exhaustedUntil,
@@ -74,20 +86,28 @@ function codexAccountJson(row: CodexAccountStatus) {
 // The /codex/usage{,/refresh,/:id} wire wrapper: the rich normalized payload
 // carries its own `status`, surfaced at the top level for back-compat with the
 // existing CodexUsage = { status; usage } shape.
-function codexUsageJson(payload: CodexUsagePayload): { status: CodexUsagePayload["status"]; usage: CodexUsagePayload } {
+function codexUsageJson(payload: CodexUsagePayload): {
+  status: CodexUsagePayload["status"];
+  usage: CodexUsagePayload;
+} {
   return { status: payload.status, usage: payload };
 }
 
-function codexModelsForPicker(slugs: string[]): Array<{ id: string; label: string; provider: string; providerLabel: string; api: "responses" }> {
-  return slugs
-    .filter((slug) => (/^gpt-5/.test(slug) || slug.includes("codex")) && slug !== "codex-auto-review")
-    .map((slug) => ({
-      id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
-      label: slug.replace(/^gpt-/, "GPT-"),
-      provider: CODEX_PROVIDER_ID,
-      providerLabel: CODEX_PROVIDER_LABEL,
-      api: "responses" as const,
-    }));
+export function codexModelsForPicker(
+  liveSlugs: readonly string[],
+): Array<{ id: string; label: string; provider: string; providerLabel: string; api: "responses" }> {
+  const available = new Set(liveSlugs);
+  const missing = CODEX_FALLBACK_MODEL_SLUGS.filter((slug) => !available.has(slug));
+  if (missing.length > 0) {
+    throw new Error(`Codex catalog is missing required models: ${missing.join(", ")}`);
+  }
+  return CODEX_FALLBACK_MODEL_SLUGS.map((slug) => ({
+    id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
+    label: slug.replace(/^gpt-/, "GPT-"),
+    provider: CODEX_PROVIDER_ID,
+    providerLabel: CODEX_PROVIDER_LABEL,
+    api: "responses" as const,
+  }));
 }
 import { createSignedState, readSignedState } from "@opengeni/github";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -95,7 +115,46 @@ import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
 
-type CodexConnectState = { workspaceId?: string; deviceAuthId?: string; userCode?: string; iat?: number };
+type CodexConnectState = {
+  workspaceId?: string;
+  deviceAuthId?: string;
+  userCode?: string;
+  iat?: number;
+};
+
+async function signalCodexCapacityTargets(
+  deps: ApiRouteDeps,
+  targets: CodexCapacityWakeTarget[],
+): Promise<void> {
+  await Promise.allSettled(
+    targets.map((target) =>
+      deps.workflowClient.signalCodexCapacity
+        ? deps.workflowClient.signalCodexCapacity({
+            accountId: target.accountId,
+            workspaceId: target.workspaceId,
+            sessionId: target.sessionId,
+            workflowId: target.workflowId,
+            wakeRevision: target.wakeRevision,
+            workflowWakeRevision: target.workflowWakeRevision,
+          })
+        : deps.workflowClient.wakeSessionWorkflow({
+            accountId: target.accountId,
+            workspaceId: target.workspaceId,
+            sessionId: target.sessionId,
+            workflowId: target.workflowId,
+            wakeRevision: target.workflowWakeRevision,
+          }),
+    ),
+  );
+}
+
+async function signalPendingCodexCapacityTargets(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<void> {
+  const targets = await listPendingCodexCapacityWakeTargets(deps.db, workspaceId).catch(() => []);
+  await signalCodexCapacityTargets(deps, targets);
+}
 
 const CODEX_DEVICE_EXPIRY_SECONDS = 15 * 60; // the device code expires 15 min after start (spec §1.1)
 
@@ -111,10 +170,22 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     try {
       start = await startDeviceCode();
     } catch (error) {
-      throw new HTTPException(502, { message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login" });
+      throw new HTTPException(502, {
+        message:
+          error instanceof CodexDeviceError ? error.message : "failed to start Codex device login",
+      });
     }
-    const state = createSignedState(githubStateSecret, { workspaceId, deviceAuthId: start.deviceAuthId, userCode: start.userCode });
-    return c.json({ userCode: start.userCode, verificationUri: start.verificationUri, intervalSeconds: start.intervalSeconds, state });
+    const state = createSignedState(githubStateSecret, {
+      workspaceId,
+      deviceAuthId: start.deviceAuthId,
+      userCode: start.userCode,
+    });
+    return c.json({
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      intervalSeconds: start.intervalSeconds,
+      state,
+    });
   });
 
   // Poll for authorization: pending | expired | connected (persists on success).
@@ -122,21 +193,36 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const { state } = (await c.req.json()) as { state?: string };
-    const payload = (state ? readSignedState(state, githubStateSecret) : null) as unknown as CodexConnectState | null;
-    if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
+    const payload = (state
+      ? readSignedState(state, githubStateSecret)
+      : null) as unknown as CodexConnectState | null;
+    if (
+      !payload ||
+      payload.workspaceId !== workspaceId ||
+      !payload.deviceAuthId ||
+      !payload.userCode
+    ) {
       throw new HTTPException(400, { message: "codex connect state is invalid or expired" });
     }
     // The device code itself expires 15 minutes after start; surface that to the
     // client (the 1-hour signed-state TTL is longer than the device window).
-    if (typeof payload.iat === "number" && Date.now() / 1000 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS) {
+    if (
+      typeof payload.iat === "number" &&
+      Date.now() / 1000 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS
+    ) {
       return c.json({ status: "expired" });
     }
 
     let poll: Awaited<ReturnType<typeof pollDeviceCode>>;
     try {
-      poll = await pollDeviceCode({ deviceAuthId: payload.deviceAuthId, userCode: payload.userCode });
+      poll = await pollDeviceCode({
+        deviceAuthId: payload.deviceAuthId,
+        userCode: payload.userCode,
+      });
     } catch (error) {
-      throw new HTTPException(502, { message: error instanceof CodexDeviceError ? error.message : "codex device poll failed" });
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex device poll failed",
+      });
     }
     if (poll.status === "pending") {
       return c.json({ status: "pending" });
@@ -147,42 +233,65 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     let tokens: Awaited<ReturnType<typeof exchangeDeviceCode>>;
     try {
-      tokens = await exchangeDeviceCode({ authorizationCode: poll.authorizationCode, codeVerifier: poll.codeVerifier });
+      tokens = await exchangeDeviceCode({
+        authorizationCode: poll.authorizationCode,
+        codeVerifier: poll.codeVerifier,
+      });
     } catch (error) {
-      throw new HTTPException(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
+      throw new HTTPException(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed",
+      });
     }
     const id = parseIdToken(tokens.idToken);
     const key = environmentsEncryptionKeyBytes(settings);
     if (!key) {
-      throw new HTTPException(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
+      throw new HTTPException(500, {
+        message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured",
+      });
     }
-    const upserted = await upsertCodexSubscriptionCredential(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      credentialEncrypted: encryptEnvironmentValue(
-        key,
-        JSON.stringify({ access_token: tokens.accessToken, refresh_token: tokens.refreshToken, id_token: tokens.idToken }),
-      ),
-      chatgptAccountId: id.chatgptAccountId,
-      scopes: null, // device grant scopes are discovered at runtime, not asserted here
-      planType: id.planType,
-      isFedramp: id.isFedramp,
-      expiresAt: accessTokenExpiry(tokens.accessToken),
-      lastRefreshAt: new Date(),
-      accountEmail: id.email ?? null,
-      label: id.email ?? id.chatgptAccountId ?? null,
-    });
+    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
+    const mutation = await withCodexCapacityMutation(
+      db,
+      { workspaceId, reason: "codex_credential_connected" },
+      async (tx) => {
+        const upserted = await upsertCodexSubscriptionCredential(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          credentialEncrypted: encryptEnvironmentValue(
+            key,
+            JSON.stringify({
+              access_token: tokens.accessToken,
+              refresh_token: tokens.refreshToken,
+              id_token: tokens.idToken,
+            }),
+          ),
+          chatgptAccountId: id.chatgptAccountId,
+          scopes: null, // device grant scopes are discovered at runtime, not asserted here
+          planType: id.planType,
+          isFedramp: id.isFedramp,
+          expiresAt: accessTokenExpiry(tokens.accessToken),
+          lastRefreshAt: new Date(),
+          accountEmail: id.email ?? null,
+          label: id.email ?? id.chatgptAccountId ?? null,
+        });
+        return { result: upserted, changed: true };
+      },
+    );
+    const upserted = mutation.result;
     // Ensure the per-workspace rotation-settings row exists, then auto-activate
     // the FIRST account only. Additional new accounts do NOT auto-activate — a
     // manual switch is required (no auto-rotation in P1). A re-connect of the
     // already-active account is a no-op for the pointer.
-    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
+    // Keep both rotation bits false on first connect. The deployment flag makes
+    // the compatible allocator available, but the workspace-local cutover bit
+    // is enabled only by an explicit settings write after every worker replica
+    // understands leasing.
     const rotation = await getCodexRotationSettings(db, workspaceId);
     let isActive = rotation?.activeCredentialId === upserted.id;
     if (!isActive && rotation?.activeCredentialId == null) {
-      await setActiveCodexCredential(db, workspaceId, upserted.id);
-      isActive = true;
+      isActive = await setInitialActiveCodexCredential(db, workspaceId, upserted.id);
     }
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ status: "connected", plan: id.planType, accountId: upserted.id, isActive });
   });
 
@@ -198,12 +307,23 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     const activeRow = accounts.find((account) => account.id === status.credentialId) ?? null;
     const activeAccount = activeRow
-      ? { id: activeRow.id, label: activeRow.label ?? activeRow.accountEmail ?? activeRow.planType ?? activeRow.chatgptAccountId, chatgptAccountId: activeRow.chatgptAccountId }
+      ? {
+          id: activeRow.id,
+          label:
+            activeRow.label ??
+            activeRow.accountEmail ??
+            activeRow.planType ??
+            activeRow.chatgptAccountId,
+          chatgptAccountId: activeRow.chatgptAccountId,
+        }
       : null;
     let valid = false;
-    let models = codexModelsForPicker([...CODEX_FALLBACK_MODEL_SLUGS]); // offline fallback list
+    let models: ReturnType<typeof codexModelsForPicker> = [];
+    let catalogError: string | null = null;
     try {
-      const cred = status.credentialId ? await loadCodexCredentialForRun(db, settings, workspaceId, status.credentialId) : null;
+      const cred = status.credentialId
+        ? await loadCodexCredentialForRun(db, settings, workspaceId, status.credentialId)
+        : null;
       if (cred) {
         const live = await fetchCodexModels({
           accessToken: cred.tokens.accessToken,
@@ -211,20 +331,23 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
           isFedramp: cred.isFedramp,
           clientVersion: CODEX_CLIENT_VERSION,
         });
-        valid = live.ok;
-        if (live.ok && live.slugs.length > 0) {
-          models = codexModelsForPicker(live.slugs); // prefer the live catalog
+        if (live.ok) {
+          models = codexModelsForPicker(live.slugs);
+          valid = true;
+        } else {
+          catalogError = `Codex models request failed with status ${live.status}`;
         }
       }
-    } catch {
+    } catch (error) {
       valid = false;
+      catalogError = error instanceof Error ? error.message : String(error);
     }
     return c.json({
       connected: status.connected,
       plan: status.planType,
       valid,
       expiresAt: status.expiresAt,
-      lastError: status.lastError,
+      lastError: catalogError ?? status.lastError,
       models, // ClientModel[] the picker surfaces under the "no credits" group
       activeAccount, // the account a session runs on when unpinned (label for the indicator)
       accountCount: accounts.length,
@@ -258,10 +381,19 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const accountId = c.req.param("accountId");
-    const activated = await setActiveCodexCredential(db, workspaceId, accountId);
+    const mutation = await withCodexCapacityMutation(
+      db,
+      { workspaceId, reason: "codex_active_credential_changed" },
+      async (tx) => {
+        const activated = await setActiveCodexCredential(tx, workspaceId, accountId);
+        return { result: activated, changed: activated };
+      },
+    );
+    const activated = mutation.result;
     if (!activated) {
       throw new HTTPException(404, { message: "codex account not found" });
     }
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ activated: true, accountId });
   });
 
@@ -270,7 +402,10 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const body = (await c.req.json().catch(() => ({}))) as { rotationEnabled?: unknown; rotationStrategy?: unknown };
+    const body = (await c.req.json().catch(() => ({}))) as {
+      rotationEnabled?: unknown;
+      rotationStrategy?: unknown;
+    };
     const patch: { rotationEnabled?: boolean; rotationStrategy?: CodexRotationStrategy } = {};
     if (typeof body.rotationEnabled === "boolean") {
       patch.rotationEnabled = body.rotationEnabled;
@@ -285,10 +420,19 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(400, { message: "no settings to update" });
     }
     await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
-    const updated = await updateCodexRotationSettings(db, workspaceId, patch);
+    const mutation = await withCodexCapacityMutation(
+      db,
+      { workspaceId, reason: "codex_rotation_settings_changed" },
+      async (tx) => {
+        const updated = await updateCodexRotationSettings(tx, workspaceId, patch);
+        return { result: updated, changed: updated !== null };
+      },
+    );
+    const updated = mutation.result;
     if (!updated) {
       throw new HTTPException(404, { message: "codex rotation settings not found" });
     }
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({
       rotationEnabled: updated.rotationEnabled,
       rotationStrategy: updated.rotationStrategy,
@@ -321,7 +465,16 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const accountId = c.req.param("accountId");
-    const result = await disconnectCodexAccount(db, workspaceId, accountId);
+    const mutation = await withCodexCapacityMutation(
+      db,
+      { workspaceId, reason: "codex_credential_disconnected" },
+      async (tx) => {
+        const result = await disconnectCodexAccount(tx, workspaceId, accountId);
+        return { result, changed: result.removed };
+      },
+    );
+    const result = mutation.result;
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
   });
 
@@ -330,7 +483,16 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const removed = await disconnectAllCodexAccounts(db, workspaceId);
+    const mutation = await withCodexCapacityMutation(
+      db,
+      { workspaceId, reason: "codex_credentials_disconnected" },
+      async (tx) => {
+        const removed = await disconnectAllCodexAccounts(tx, workspaceId);
+        return { result: removed, changed: removed > 0 };
+      },
+    );
+    const removed = mutation.result;
+    await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ disconnected: removed > 0 });
   });
 
@@ -345,6 +507,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, { message: "codex subscription is not connected" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
+    await signalPendingCodexCapacityTargets(deps, workspaceId);
     return c.json(codexUsageJson(payload));
   });
 
@@ -361,6 +524,7 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, { message: "codex account not found" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
+    await signalPendingCodexCapacityTargets(deps, workspaceId);
     return c.json(codexUsageJson(payload));
   });
 
@@ -373,21 +537,38 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const accounts = await listCodexAccountStatuses(db, workspaceId);
-    const usage: Record<string, { status: CodexUsagePayload["status"]; usage: CodexUsagePayload }> = {};
+    const usage: Record<string, { status: CodexUsagePayload["status"]; usage: CodexUsagePayload }> =
+      {};
     const queue = [...accounts];
     const CONCURRENCY = 4;
     const worker = async (): Promise<void> => {
       for (;;) {
         const account = queue.shift();
         if (!account) return;
-        const settled = await Promise.allSettled([fetchCodexUsageForAccount(db, settings, workspaceId, account.id)]);
+        const settled = await Promise.allSettled([
+          fetchCodexUsageForAccount(db, settings, workspaceId, account.id),
+        ]);
         const result = settled[0];
-        usage[account.id] = result.status === "fulfilled"
-          ? codexUsageJson(result.value)
-          : { status: "error", usage: { status: "error", planType: null, fiveHour: null, weekly: null, limitReached: false, fetchedAt: new Date().toISOString() } };
+        usage[account.id] =
+          result.status === "fulfilled"
+            ? codexUsageJson(result.value)
+            : {
+                status: "error",
+                usage: {
+                  status: "error",
+                  planType: null,
+                  fiveHour: null,
+                  weekly: null,
+                  limitReached: false,
+                  fetchedAt: new Date().toISOString(),
+                },
+              };
       }
     };
-    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker()));
+    await Promise.all(
+      Array.from({ length: Math.min(CONCURRENCY, Math.max(1, accounts.length)) }, () => worker()),
+    );
+    await signalPendingCodexCapacityTargets(deps, workspaceId);
     return c.json({ usage });
   });
 }

package/src/routes/connections.ts

@@ -27,7 +27,7 @@ import {
 import { canonicalProviderDomain } from "../integrations/provider-domain";
 
 export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { db, settings } = deps;
+  const { db, settings, observability } = deps;
 
   function assertIntegrationsEnabled(): void {
     if (!settings.integrationsEnabled) {
@@ -38,9 +38,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
-    return c.json(ListConnectionsResponse.parse({
-      connections: await listConnectionsMetadata(db, workspaceId, grant.subjectId),
-    }));
+    return c.json(
+      ListConnectionsResponse.parse({
+        connections: await listConnectionsMetadata(db, workspaceId, grant.subjectId),
+      }),
+    );
   });
 
   app.post("/v1/workspaces/:workspaceId/connections", async (c) => {
@@ -67,7 +69,12 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
-    const connection = await getConnectionMetadata(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
+    const connection = await getConnectionMetadata(
+      db,
+      workspaceId,
+      c.req.param("connectionId"),
+      grant.subjectId,
+    );
     if (!connection) {
       throw new HTTPException(404, { message: "connection not found" });
     }
@@ -84,26 +91,39 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     // could clear the broker's re-auth signal while stale tokens stay in place.
     if (payload.status !== undefined) {
       if (payload.status !== "active") {
-        throw new HTTPException(400, { message: "status can only be set to \"active\"; use DELETE to revoke" });
+        throw new HTTPException(400, {
+          message: 'status can only be set to "active"; use DELETE to revoke',
+        });
       }
       if (payload.credential === undefined) {
-        throw new HTTPException(400, { message: "reactivating a connection requires a new credential" });
+        throw new HTTPException(400, {
+          message: "reactivating a connection requires a new credential",
+        });
       }
     }
     const key = payload.credential === undefined ? null : requireEnvironmentEncryption(settings);
-    const subjectId = payload.subjectId === undefined ? undefined : writableSubjectId(payload.subjectId, grant.subjectId);
+    const subjectId =
+      payload.subjectId === undefined
+        ? undefined
+        : writableSubjectId(payload.subjectId, grant.subjectId);
     const connection = await updateConnection(db, {
       workspaceId,
       connectionId: c.req.param("connectionId"),
       visibleToSubjectId: grant.subjectId,
       updatedBySubjectId: grant.subjectId,
-      ...(payload.providerDomain !== undefined ? { providerDomain: canonicalProviderDomain(payload.providerDomain) } : {}),
+      ...(payload.providerDomain !== undefined
+        ? { providerDomain: canonicalProviderDomain(payload.providerDomain) }
+        : {}),
       ...(subjectId !== undefined ? { subjectId } : {}),
       ...(payload.kind !== undefined ? { kind: payload.kind } : {}),
       ...(payload.status !== undefined ? { status: payload.status } : {}),
-      ...(payload.credential !== undefined && key ? { credentialEncrypted: encryptCredentialBundle(key, payload.credential) } : {}),
+      ...(payload.credential !== undefined && key
+        ? { credentialEncrypted: encryptCredentialBundle(key, payload.credential) }
+        : {}),
       ...(payload.grantedScopes !== undefined ? { grantedScopes: payload.grantedScopes } : {}),
-      ...(payload.expiresAt !== undefined ? { expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null } : {}),
+      ...(payload.expiresAt !== undefined
+        ? { expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null }
+        : {}),
       ...(payload.metadata !== undefined ? { metadata: payload.metadata } : {}),
     });
     if (!connection) {
@@ -115,7 +135,12 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.delete("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
-    const connection = await revokeConnection(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
+    const connection = await revokeConnection(
+      db,
+      workspaceId,
+      c.req.param("connectionId"),
+      grant.subjectId,
+    );
     if (!connection) {
       throw new HTTPException(404, { message: "connection not found" });
     }
@@ -128,44 +153,57 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:write");
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid OAuth start request",
+      });
     }
     const payload = parsed.data;
-    const result = await startMcpOAuth({ db, settings }, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      requestUrl: c.req.url,
-      payload,
-    });
+    const result = await startMcpOAuth(
+      { db, settings, observability },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        requestUrl: c.req.url,
+        payload,
+      },
+    );
     return c.json(OAuthStartResponse.parse(result));
   });
 
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
-    const result = await completeMcpOAuthCallback({ db, settings }, {
-      code: c.req.query("code"),
-      state: c.req.query("state"),
-      requestUrl: c.req.url,
-    });
+    const result = await completeMcpOAuthCallback(
+      { db, settings, observability },
+      {
+        code: c.req.query("code"),
+        state: c.req.query("state"),
+        requestUrl: c.req.url,
+      },
+    );
     return c.redirect(result.redirectTo, 302);
   });
 
   app.get("/v1/integrations/oauth/client-metadata.json", (c) => {
     const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
     const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
-    return c.json(IntegrationClientMetadata.parse({
-      client_id: metadataUrl,
-      client_name: "OpenGeni",
-      redirect_uris: [`${baseUrl}/v1/integrations/oauth/callback`],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-    }));
+    return c.json(
+      IntegrationClientMetadata.parse({
+        client_id: metadataUrl,
+        client_name: "OpenGeni",
+        redirect_uris: [`${baseUrl}/v1/integrations/oauth/callback`],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+      }),
+    );
   });
 }
 
-function writableSubjectId(requested: string | null | undefined, grantSubjectId: string): string | null {
+function writableSubjectId(
+  requested: string | null | undefined,
+  grantSubjectId: string,
+): string | null {
   if (requested == null) {
     return null;
   }