@opengeni/api-router 2.13.0-canary.2 → 3.0.0-canary.1

package/src/routes/connect.ts

@@ -75,6 +75,7 @@ import {
 import { resolveForRoute, validatedIntegrationInstallInput } from "./api-integrations";
 import { executeConnectOperation } from "@opengeni/core";
 import { startMcpOAuth, requireIntegrationsStateSecret } from "../integrations/oauth-client";
+import { OFFICIAL_GMAIL_MCP_URL } from "../integrations/oauth-profiles";
 import { z } from "zod";
 import {
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
@@ -227,6 +228,19 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         ownership: ["workspace"],
         setup: ["oauth"],
       }),
+      ConnectProvider.parse({
+        id: "gmail",
+        label: "Gmail",
+        family: "google",
+        readiness:
+          !external || !canWrite || !personal
+            ? "unsupported"
+            : mcpConfigured
+              ? "available"
+              : "needs_configuration",
+        ownership: personal ? ["personal"] : [],
+        setup: ["oauth"],
+      }),
       ConnectProvider.parse({
         id: "slack-personal",
         label: "My Slack account",
@@ -557,7 +571,9 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
               providerId:
                 connection.metadata.mcpUrl === OPENGENI_PERSONAL_SLACK_MCP_URL
                   ? "slack-personal"
-                  : "mcp-oauth",
+                  : connection.metadata.mcpUrl === OFFICIAL_GMAIL_MCP_URL
+                    ? "gmail"
+                    : "mcp-oauth",
               label: connection.providerDomain,
               ownership: connection.subjectId === null ? "workspace" : "personal",
               status:
@@ -1007,16 +1023,18 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         }),
       );
     }
-    if (["mcp-oauth", "slack-personal"].includes(before.providerId)) {
+    if (["mcp-oauth", "slack-personal", "gmail"].includes(before.providerId)) {
       if (action.type !== "credentials")
         throw new HTTPException(422, { message: "MCP OAuth requires a server URL" });
       const values =
         before.providerId === "slack-personal"
           ? { mcpUrl: OPENGENI_PERSONAL_SLACK_MCP_URL }
-          : z
-              .object({ mcpUrl: z.string().url().max(4096) })
-              .strict()
-              .parse(action.values);
+          : before.providerId === "gmail"
+            ? { mcpUrl: OFFICIAL_GMAIL_MCP_URL }
+            : z
+                .object({ mcpUrl: z.string().url().max(4096) })
+                .strict()
+                .parse(action.values);
       return c.json(
         await executeConnectOperation({
           db: deps.db,
@@ -1552,6 +1570,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
           [
             "mcp-oauth",
             "slack-personal",
+            "gmail",
             "mcp-bearer",
             "mcp-headers",
             "fiken-token",
@@ -1567,18 +1586,27 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             message: "MCP credential setup does not install an API integration instance",
           });
         if (
-          ["mcp-oauth", "slack-personal", "mcp-bearer", "mcp-headers", "fiken-token"].includes(
-            input.providerId,
-          )
+          [
+            "mcp-oauth",
+            "slack-personal",
+            "gmail",
+            "mcp-bearer",
+            "mcp-headers",
+            "fiken-token",
+          ].includes(input.providerId)
         ) {
           if (input.providerId === "slack-personal" && input.ownership !== "personal")
             throw new HTTPException(422, {
               message: "Hosted Slack MCP requires personal ownership",
             });
+          if (input.providerId === "gmail" && input.ownership !== "personal")
+            throw new HTTPException(422, {
+              message: "Gmail requires personal ownership; each user connects their own account",
+            });
           if (input.providerId === "fiken-token" && input.ownership !== "workspace")
             throw new HTTPException(422, { message: "Fiken is workspace-owned" });
           requireEnvironmentEncryption(deps.settings);
-          if (["mcp-oauth", "slack-personal"].includes(input.providerId))
+          if (["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId))
             requireIntegrationsStateSecret(deps.settings);
           const existing = input.reconnectAccountId
             ? await getConnectionMetadata(
@@ -1593,11 +1621,13 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             (!existing ||
               (input.providerId === "fiken-token"
                 ? !isFikenConnection(existing)
-                : ["mcp-oauth", "slack-personal"].includes(input.providerId)
+                : ["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId)
                   ? existing.kind !== "oauth2" ||
                     !existing.metadata.oauthDiscovery ||
                     (input.providerId === "slack-personal" &&
-                      existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL)
+                      existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL) ||
+                    (input.providerId === "gmail" &&
+                      existing.metadata.mcpUrl !== OFFICIAL_GMAIL_MCP_URL)
                   : existing.kind !== "api_key" ||
                     existing.metadata.connectAdapter !== input.providerId) ||
               (existing.subjectId === null ? "workspace" : "personal") !== input.ownership)
@@ -1634,51 +1664,50 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
                 : {}),
               nextAction: {
                 type: "credentials",
-                fields:
-                  input.providerId === "slack-personal"
-                    ? []
-                    : input.providerId === "fiken-token"
-                      ? [
-                          {
-                            name: "apiToken",
-                            label: "Fiken API token",
-                            required: true,
-                            secret: true,
-                          },
-                          {
-                            name: "defaultCompanySlug",
-                            label: "Default company slug (optional)",
-                            required: false,
-                            secret: false,
-                          },
-                        ]
-                      : [
-                          {
-                            name: "mcpUrl",
-                            label: "MCP server URL",
-                            required: true,
-                            secret: false,
-                          },
-                          ...(input.providerId === "mcp-bearer"
+                fields: ["slack-personal", "gmail"].includes(input.providerId)
+                  ? []
+                  : input.providerId === "fiken-token"
+                    ? [
+                        {
+                          name: "apiToken",
+                          label: "Fiken API token",
+                          required: true,
+                          secret: true,
+                        },
+                        {
+                          name: "defaultCompanySlug",
+                          label: "Default company slug (optional)",
+                          required: false,
+                          secret: false,
+                        },
+                      ]
+                    : [
+                        {
+                          name: "mcpUrl",
+                          label: "MCP server URL",
+                          required: true,
+                          secret: false,
+                        },
+                        ...(input.providerId === "mcp-bearer"
+                          ? [
+                              {
+                                name: "token",
+                                label: "Bearer credential",
+                                required: true,
+                                secret: true,
+                              },
+                            ]
+                          : input.providerId === "mcp-headers"
                             ? [
                                 {
-                                  name: "token",
-                                  label: "Bearer credential",
+                                  name: "headers",
+                                  label: "Credential headers (JSON)",
                                   required: true,
                                   secret: true,
                                 },
                               ]
-                            : input.providerId === "mcp-headers"
-                              ? [
-                                  {
-                                    name: "headers",
-                                    label: "Credential headers (JSON)",
-                                    required: true,
-                                    secret: true,
-                                  },
-                                ]
-                              : []),
-                        ],
+                            : []),
+                      ],
               },
               expiresAt: new Date(Date.now() + 15 * 60_000).toISOString(),
             },

package/src/routes/editable-artifacts.ts

@@ -909,7 +909,7 @@ function normalizeArtifactIdList(value: readonly string[]): readonly string[] {
   return ids;
 }
 
-function isInvisibleListCandidate(error: unknown): boolean {
+export function isInvisibleListCandidate(error: unknown): boolean {
   return (
     (error instanceof EditableArtifactDomainError &&
       (error.code === "forbidden" || error.code === "not_found")) ||
@@ -1050,7 +1050,7 @@ async function readBoundedJson(request: Request, maxBytes: number): Promise<unkn
   }
 }
 
-function editableArtifactHttpError(error: unknown): unknown {
+export function editableArtifactHttpError(error: unknown): unknown {
   if (error instanceof EditableArtifactDurableExportError) {
     switch (error.code) {
       case "invalid_request":

package/src/sandbox-file-artifacts.ts

@@ -22,6 +22,7 @@ import {
   prepareGeneratedWorkspaceFile,
   getSessionAuthorityProjection,
   requireWorkspace,
+  recordSandboxFilePublication,
   withSessionRlsActorContext,
 } from "@opengeni/db";
 import { retryWhileMissing, type ObjectHead, type ObjectStorage } from "@opengeni/storage";
@@ -225,6 +226,12 @@ async function publishSandboxFileArtifactInScope(
   if (!artifact) {
     throw new HTTPException(502, { message: "published sandbox artifact is not ready" });
   }
+  await recordSandboxFilePublication(deps.db, {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    fileId: file.id,
+    sourceSessionId: input.session.id,
+  });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
     sandboxPath: `/workspace/${path}`,
@@ -300,7 +307,7 @@ export function sandboxFileContentType(filename: string): string {
   );
 }
 
-function sandboxArtifactIdentity(input: {
+export function sandboxArtifactIdentity(input: {
   workspaceId: string;
   sessionId: string;
   path: string;
@@ -330,7 +337,7 @@ function uuidFromDigest(digest: string, startByte: number): string {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
-function assertSandboxArtifactFile(
+export function assertSandboxArtifactFile(
   file: NonNullable<Awaited<ReturnType<typeof getFile>>>,
   expected: {
     filename: string;