@opengeni/api-router 2.5.0 → 2.6.4

package/dist/{chunk-QESX7HDK.js → chunk-XTLI3CBH.js}

@@ -42,6 +42,7 @@ import {
   withSessionRlsActorContext
 } from "@opengeni/db";
 import { requireSessionEventDurableFanoutCapability as requireSessionEventDurableFanoutCapability2 } from "@opengeni/events";
+import { githubAppBotIdentityWarnings } from "@opengeni/github";
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport3 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -122,6 +123,7 @@ import {
 } from "@opengeni/core";
 
 // src/auth/managed-auth.ts
+import { canonicalPublicOrigin } from "@opengeni/config";
 import { ensureManagedAccessForUser } from "@opengeni/db";
 import {
   ensureCanonicalHumanIdentityForAuthUser,
@@ -1298,8 +1300,14 @@ function denied(intent, code) {
 // src/auth/managed-auth-attempt-context.ts
 import { AsyncLocalStorage } from "async_hooks";
 var managedAuthAttemptStorage = new AsyncLocalStorage();
-function runManagedAuthAttempt(transactionId, action) {
-  return managedAuthAttemptStorage.run({ kind: "isolated_transaction", transactionId }, action);
+function runManagedAuthAttempt(transactionId, providerId, action) {
+  return managedAuthAttemptStorage.run(
+    { kind: "isolated_transaction", transactionId, providerId, createdAuthSessionId: null },
+    action
+  );
+}
+function runManagedAuthProvider(providerId, action) {
+  return managedAuthAttemptStorage.run({ kind: "provider", providerId }, action);
 }
 function runManagedAuthDiscardedProviderSession(action) {
   return managedAuthAttemptStorage.run({ kind: "discard_provider_session" }, action);
@@ -1308,6 +1316,18 @@ function currentManagedAuthAttemptId() {
   const context = managedAuthAttemptStorage.getStore();
   return context?.kind === "isolated_transaction" ? context.transactionId : null;
 }
+function currentManagedAuthProviderId() {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" || context?.kind === "provider" ? context.providerId : "credential";
+}
+function recordCurrentManagedAuthSession(authSessionId) {
+  const context = managedAuthAttemptStorage.getStore();
+  if (context?.kind === "isolated_transaction") context.createdAuthSessionId = authSessionId;
+}
+function currentManagedAuthCreatedSessionId() {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" ? context.createdAuthSessionId : null;
+}
 function shouldDiscardCurrentManagedAuthProviderSession() {
   return managedAuthAttemptStorage.getStore()?.kind === "discard_provider_session";
 }
@@ -1320,6 +1340,12 @@ function managedAuthUserCreateOverride(settings, user) {
   if (managedAuthRequiresEmailVerification(settings)) return void 0;
   return { data: { ...user, emailVerified: true } };
 }
+function managedAuthUserCreateAdmission(settings, user, providerId) {
+  if (managedAuthRequiresEmailVerification(settings) && providerId !== "credential" && !user.emailVerified) {
+    return false;
+  }
+  return managedAuthUserCreateOverride(settings, user);
+}
 async function hashManagedAuthPassword(password) {
   return await hashPassword(password);
 }
@@ -1432,7 +1458,24 @@ function createManagedAuth(settings, db, managedEmailTransport) {
       },
       accountLinking: {
         enabled: false
-      }
+      },
+      encryptOAuthTokens: true,
+      storeStateStrategy: "database"
+    },
+    socialProviders: {
+      ...settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret ? {
+        google: {
+          clientId: settings.managedAuthGoogleClientId,
+          clientSecret: settings.managedAuthGoogleClientSecret,
+          prompt: "select_account"
+        }
+      } : {},
+      ...settings.managedAuthGithubClientId && settings.managedAuthGithubClientSecret ? {
+        github: {
+          clientId: settings.managedAuthGithubClientId,
+          clientSecret: settings.managedAuthGithubClientSecret
+        }
+      } : {}
     },
     verification: {
       modelName: "auth_verifications",
@@ -1497,6 +1540,7 @@ function createManagedAuth(settings, db, managedEmailTransport) {
       session: {
         create: {
           before: async (session) => {
+            const providerId = currentManagedAuthProviderId();
             await ensureCanonicalHumanIdentityForAuthUser(db, session.userId);
             const preflightProjection = await getCanonicalHumanIdentityProjection(
               db,
@@ -1510,7 +1554,7 @@ function createManagedAuth(settings, db, managedEmailTransport) {
             if (!preflight.allowed) {
               const exactRecoveryBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
                 authUserId: session.userId,
-                providerId: "credential"
+                providerId
               });
               const recoveryBinding = preflightProjection.loginBindings.find(
                 (binding) => binding.id === exactRecoveryBinding.id && binding.status === "recovery_pending"
@@ -1544,7 +1588,7 @@ function createManagedAuth(settings, db, managedEmailTransport) {
             const projection = await getCanonicalHumanIdentityProjection(db, session.userId);
             const exactBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
               authUserId: session.userId,
-              providerId: "credential"
+              providerId
             });
             const activeBinding = projection.loginBindings.find(
               (binding) => binding.id === exactBinding.id
@@ -1575,6 +1619,7 @@ function createManagedAuth(settings, db, managedEmailTransport) {
             };
           },
           after: async (session) => {
+            recordCurrentManagedAuthSession(session.id);
             if (!shouldDiscardCurrentManagedAuthProviderSession()) return;
             await db.execute(sql`delete from auth_sessions where id = ${session.id}`);
           }
@@ -1582,7 +1627,7 @@ function createManagedAuth(settings, db, managedEmailTransport) {
       },
       user: {
         create: {
-          before: async (user) => managedAuthUserCreateOverride(settings, user),
+          before: async (user) => managedAuthUserCreateAdmission(settings, user, currentManagedAuthProviderId()),
           after: async (user) => {
             if (!user.emailVerified) return;
             await ensureManagedAccessForUser(db, {
@@ -1598,6 +1643,70 @@ function createManagedAuth(settings, db, managedEmailTransport) {
     }
   });
 }
+async function resolveManagedAuthOAuthAttempt(auth, request, provider, publicBaseUrl) {
+  const expectedOrigin = canonicalPublicOrigin(publicBaseUrl);
+  if (!expectedOrigin) return null;
+  const state = new URL(request.url).searchParams.get("state");
+  if (!state) return null;
+  const verification = await (await auth.$context).internalAdapter.findVerificationValue(state);
+  if (!verification?.value) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(verification.value);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const stateData = parsed;
+  const proof = stateData.opengeniManagedAuth;
+  if (!proof || typeof proof !== "object") return null;
+  const value = proof;
+  if (value.version !== 1 || value.provider !== provider || typeof value.transactionId !== "string" || typeof value.authorityHash !== "string" || typeof value.transactionSecretHash !== "string" || typeof value.expectedGeneration !== "string" || typeof value.expectedActorEpoch !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+    value.transactionId
+  ) || !/^[0-9a-f]{64}$/u.test(value.authorityHash) || !/^[0-9a-f]{64}$/u.test(value.transactionSecretHash) || !/^[1-9][0-9]*$/u.test(value.expectedGeneration) || !/^[1-9][0-9]*$/u.test(value.expectedActorEpoch)) {
+    return null;
+  }
+  const callbackURL = typeof stateData.callbackURL === "string" ? stateData.callbackURL : null;
+  const errorURL = typeof stateData.errorURL === "string" ? stateData.errorURL : null;
+  if (!callbackURL || !errorURL || !managedAuthOAuthReturnMatches(callbackURL, expectedOrigin, value.transactionId, "complete") || !managedAuthOAuthReturnMatches(errorURL, expectedOrigin, value.transactionId, "error")) {
+    return null;
+  }
+  return {
+    transactionId: value.transactionId,
+    provider,
+    authorityHash: value.authorityHash,
+    transactionSecretHash: value.transactionSecretHash,
+    expectedGeneration: value.expectedGeneration,
+    expectedActorEpoch: value.expectedActorEpoch
+  };
+}
+async function isolatedManagedAuthOAuthCallbackRequest(auth, request) {
+  const context = await auth.$context;
+  const stateCookieName = context.createAuthCookie("state").name;
+  const headers = new Headers(request.headers);
+  const stateCookie2 = cookiePair(headers.get("cookie"), stateCookieName);
+  if (stateCookie2) headers.set("cookie", stateCookie2);
+  else headers.delete("cookie");
+  headers.delete("authorization");
+  headers.delete("x-forwarded-user");
+  return { request: new Request(request, { headers }), stateCookieName };
+}
+function managedAuthOAuthReturnMatches(raw, expectedOrigin, transactionId, outcome) {
+  try {
+    const url = new URL(raw);
+    return url.origin === expectedOrigin && url.pathname === "/account-auth" && url.searchParams.size === 2 && url.searchParams.get("transaction") === transactionId && url.searchParams.get("social") === outcome && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function cookiePair(header, name) {
+  for (const part of header?.split(";") ?? []) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
+    return `${name}=${part.slice(separator + 1).trim()}`;
+  }
+  return null;
+}
 function betterAuthBaseUrl(settings) {
   const allowedHosts = splitCsv(settings.betterAuthAllowedHosts);
   if (allowedHosts.length === 0) {
@@ -1647,8 +1756,12 @@ function escapeHtml(value) {
 
 // src/app.ts
 import {
+  adoptManagedAuthSession,
   MANAGED_AUTH_SESSION_SET_COOKIE as MANAGED_AUTH_SESSION_SET_COOKIE2,
   ManagedAuthActorChangeError as ManagedAuthActorChangeError2,
+  managedAuthCsrfHash as managedAuthCsrfHash2,
+  managedAuthDerivedUuid as managedAuthDerivedUuid2,
+  managedAuthSecretRequestDigest as managedAuthSecretRequestDigest2,
   managedAuthSha256 as managedAuthSha2562
 } from "@opengeni/core/managed-auth-session-sets";
 
@@ -1662,6 +1775,7 @@ function createBetterAuthSessionAdapter(auth, db) {
       }
       const result = await runManagedAuthAttempt(
         input.transactionId,
+        "credential",
         async () => await auth.api.signInEmail({
           body: {
             email: input.credentials.email,
@@ -2145,6 +2259,7 @@ import {
   stableJson,
   compactSessionEventResult as compactSessionEventResult2,
   sessionEventLatestClassToSemanticClass,
+  MemorySlackPublicationDistribution,
   SessionMcpCredentialUpdateInput,
   ToolAuthNeededPayload,
   VariableSetVariableName,
@@ -2157,6 +2272,7 @@ import {
   SESSION_GOAL_SUCCESS_CRITERIA_MAX_BYTES,
   SESSION_GOAL_TEXT_MAX_BYTES,
   SESSION_INSTRUCTIONS_MAX_CHARACTERS,
+  SESSION_TITLE_MAX_CHARACTERS,
   MAX_SELECTED_VARIABLE_SETS,
   sessionGoalUtf8Bytes,
   TASK_NOTE_LIST_DEFAULT_LIMIT,
@@ -2205,6 +2321,8 @@ import {
   readVariableSetSecretAtomically,
   recordSyncedSocialPosts,
   listVariableSets,
+  MEMORY_CORRECT_TOOL_DESCRIPTION,
+  MEMORY_SAVE_TOOL_DESCRIPTION,
   MEMORY_SEARCH_TOOL_DESCRIPTION,
   requireScheduledTask,
   requireSession,
@@ -2234,7 +2352,11 @@ import {
   acceptSessionHumanInputResponse,
   HumanInputResponseValidationError
 } from "@opengeni/db";
-import { appendAndPublishTurnEventsFenced, publishDurableSessionEvents } from "@opengeni/events";
+import {
+  appendAndPublishEvents as appendAndPublishEvents3,
+  appendAndPublishTurnEventsFenced,
+  publishDurableSessionEvents
+} from "@opengeni/events";
 import { allowedFirstPartyMcpToolsForSession, codemodeWorkspaceUrl } from "@opengeni/config";
 import {
   createSignedState as createSignedState6,
@@ -2252,12 +2374,14 @@ import {
   authorizedSocialConnectionsForGrant,
   authorizedAtlassianConnectionsForGrant,
   buildCapabilityCatalog,
+  correctWorkspaceMemoryWithSlackPublication,
   nativeConnectionCapabilityRecommendations,
   requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization2,
   requireSessionAuthorization as requireSessionAuthorization2,
   requireSessionAuthorizationListScope,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError3,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError2,
+  saveWorkspaceMemoryWithSlackPublication,
   searchCapabilityCatalogItems
 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
@@ -2502,6 +2626,8 @@ import {
   withRunCredentialsSession
 } from "@opengeni/runtime/sandbox";
 import {
+  managedSessionGroupBackend,
+  managedSessionGroupOs,
   providerSettingsForSessionSandboxRuntime,
   relayConfigFromSettings,
   resolveSessionSandboxRuntime,
@@ -3079,15 +3205,19 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
       ctx.waitSignal?.throwIfAborted();
       const pointer = await readActiveSandbox(db, workspaceId, session.id);
       if (!pointer?.activeSandboxId) {
-        if (settings.sandboxBackend !== "none" && settings.sandboxBackend !== "selfhosted") {
+        const groupBackend = managedSessionGroupBackend(
+          settings.sandboxBackend,
+          session.sandboxBackend
+        );
+        if (groupBackend) {
           return await withChannelAOperation(
             services,
             {
               ...ctx,
               session: {
                 ...session,
-                sandboxBackend: settings.sandboxBackend,
-                sandboxOs: "linux"
+                sandboxBackend: groupBackend,
+                sandboxOs: managedSessionGroupOs(session.sandboxBackend, session.sandboxOs)
               }
             },
             readOnly,
@@ -3095,7 +3225,7 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
           );
         }
         throw new HTTPException2(409, {
-          message: "machine-home session has no active Connected Machine"
+          message: "machine-home session has no active Connected Machine or managed sandbox"
         });
       }
       const sandbox = await getSandbox(
@@ -4782,6 +4912,7 @@ import {
   loadIntegrationOAuthClient,
   normalizeBearerScheme,
   replaceIntegrationOAuthClientIfCurrent,
+  resolveNamedManagedPersonalWorkspaceGrant,
   storeIntegrationOAuthClient,
   updateConnection,
   withDatabaseStatementTimeout
@@ -5502,7 +5633,8 @@ function requireIntegrationsStateSecret(settings) {
   return secret;
 }
 async function requireOAuthCallbackGrant(db, state) {
-  const grant = await getWorkspaceGrant(db, state.subjectId, state.workspaceId);
+  const membershipGrant = await getWorkspaceGrant(db, state.subjectId, state.workspaceId);
+  const grant = membershipGrant?.accountId === state.accountId ? membershipGrant : state.personalOwnerVerified ? await resolveNamedManagedPersonalWorkspaceGrant(db, state) : null;
   if (!grant || grant.accountId !== state.accountId || !hasPermission3(grant.permissions, "connections:write")) {
     throw new HTTPException8(403, {
       message: "OAuth subject no longer has permission to write this workspace connection"
@@ -7528,6 +7660,7 @@ import {
   ScheduledTaskSyncError,
   syncCreatedScheduledTask as syncCreatedScheduledTask3,
   syncUpdatedScheduledTask as syncUpdatedScheduledTask3,
+  validateScheduledTaskMachineTarget,
   validateScheduledTaskTarget,
   updateScheduledTaskForApi,
   validatedScheduledTaskUpdate
@@ -8211,7 +8344,32 @@ var SESSION_WAIT_EVENT_TYPES = [
   "goal.cleared",
   "goal.continuation"
 ];
-var SESSION_WAIT_EVENT_TYPE_SET = new Set(SESSION_WAIT_EVENT_TYPES);
+var SESSION_WAIT_COMPLETION_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "turn.superseded",
+  "turn.capacity_waiting",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "session.control.paused",
+  "tool.auth_needed",
+  "credential.auth_needed",
+  "rig.setup.failed",
+  "goal.paused"
+];
+var SESSION_WAIT_COMPLETION_EVENT_TYPE_SET = new Set(
+  SESSION_WAIT_COMPLETION_EVENT_TYPES
+);
+function sessionWaitCompletionEventMatches(event) {
+  if (!SESSION_WAIT_COMPLETION_EVENT_TYPE_SET.has(event.type)) return false;
+  if (event.type !== "turn.completed") return true;
+  if (event.payload === null || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+    return false;
+  }
+  const payload = event.payload;
+  return Object.prototype.hasOwnProperty.call(payload, "output") && !Object.prototype.hasOwnProperty.call(payload, "segmentLimit") && !Object.prototype.hasOwnProperty.call(payload, "maintenance");
+}
 var SESSION_WAIT_OWN_PENDING_EVENT_TYPE = "system.update.pending";
 function ownPendingKindWakes(kind) {
   const wakeClass = SESSION_SYSTEM_UPDATE_WAKE_CLASS[kind];
@@ -8239,6 +8397,10 @@ async function waitForSessionChanges(input) {
   let liveFanout = true;
   let waited = false;
   const ownSessionId = input.source.readOwnPendingUpdateKinds ? input.ownSessionId : null;
+  const targetEventTypeSet = new Set(
+    input.targetEventTypes ?? SESSION_WAIT_EVENT_TYPES
+  );
+  const targetEventMatches = (event) => targetEventTypeSet.has(event.type) && (input.targetEventMatches?.(event) ?? true);
   const targetAfter = /* @__PURE__ */ new Map();
   for (const target of input.targets) {
     const existing = targetAfter.get(target.sessionId);
@@ -8259,7 +8421,7 @@ async function waitForSessionChanges(input) {
     const after = targetAfter.get(sessionId);
     for (const event of events) {
       if (event.sessionId !== sessionId) continue;
-      if (after !== void 0 && event.sequence > after && SESSION_WAIT_EVENT_TYPE_SET.has(event.type)) {
+      if (after !== void 0 && event.sequence > after && targetEventMatches(event)) {
         return true;
       }
       if (sessionId === ownSessionId && event.type === SESSION_WAIT_OWN_PENDING_EVENT_TYPE) {
@@ -8290,7 +8452,7 @@ async function waitForSessionChanges(input) {
     const changed = [];
     for (const { target, read } of targetReads) {
       const events = read.events.filter(
-        (event) => event.sequence > target.afterSequence && SESSION_WAIT_EVENT_TYPE_SET.has(event.type)
+        (event) => event.sequence > target.afterSequence && targetEventMatches(event)
       );
       if (events.length === 0) continue;
       changed.push({
@@ -9119,6 +9281,8 @@ import {
   renewSandboxProviderExpiration
 } from "@opengeni/runtime/sandbox";
 import {
+  managedSessionGroupBackend as managedSessionGroupBackend2,
+  managedSessionGroupOs as managedSessionGroupOs2,
   providerSettingsForSessionSandboxRuntime as providerSettingsForSessionSandboxRuntime2,
   relayConfigFromSettings as relayConfigFromSettings2,
   resolveSessionSandboxRuntime as resolveSessionSandboxRuntime2
@@ -9178,7 +9342,21 @@ async function sessionAttachEnvironment(services, workspaceId, session, attachSu
 }
 async function attachViewer(services, input) {
   const { db, settings } = services;
-  const { accountId, workspaceId, session } = input;
+  const { accountId, workspaceId } = input;
+  const groupBackend = managedSessionGroupBackend2(
+    settings.sandboxBackend,
+    input.session.sandboxBackend
+  );
+  if (!groupBackend) {
+    throw new HTTPException10(409, {
+      message: "session has no managed sandbox group to attach"
+    });
+  }
+  const session = groupBackend === input.session.sandboxBackend ? input.session : {
+    ...input.session,
+    sandboxBackend: groupBackend,
+    sandboxOs: managedSessionGroupOs2(input.session.sandboxBackend, input.session.sandboxOs)
+  };
   const viewerId = input.viewerId ?? crypto.randomUUID();
   const attachSubjectId = claimableSubjectId(input.viewerSubjectId ?? null);
   const attachAuthorityEpoch = attachSubjectId ? await getSessionAuthorityEpoch(db, { accountId, workspaceId, sessionId: session.id }) : null;
@@ -15872,17 +16050,19 @@ function mutationAnnotations(title, options) {
 
 // src/mcp/company-brain-governed-writes.ts
 import {
-  AGENT_AUTHORED_DURABLE_TEXT_STYLE,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE,
   AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_SKILL_STYLE,
   PREFERENCE_REGISTRY_DESCRIPTOR_DESCRIPTION_MAX_CHARS,
   PREFERENCE_REGISTRY_STABLE_KEY_MAX_CHARS,
   PREFERENCE_REGISTRY_TITLE_MAX_CHARS,
   WorkspaceInstructionPolicyTarget
 } from "@opengeni/contracts";
 import { createCompanyBrainLearningPolicyRouter } from "@opengeni/core";
+import { PreferenceRegistryStableKeyConflictError } from "@opengeni/db";
 import * as z6 from "zod/v4";
 var reason = z6.string().trim().min(1).max(4096);
 var evidence = {
@@ -15903,6 +16083,20 @@ var taskNotePromotion = {
 };
 function registerCompanyBrainGovernedWriteTools(input) {
   const router = input.router ?? createCompanyBrainLearningPolicyRouter({ db: input.db });
+  const writeResult = async (write) => {
+    try {
+      return input.json(await write());
+    } catch (error) {
+      if (error instanceof PreferenceRegistryStableKeyConflictError) {
+        return input.json({
+          status: "not_proposed",
+          code: "preference_stable_key_conflict",
+          message: error.message
+        });
+      }
+      throw error;
+    }
+  };
   input.server.registerTool(
     "knowledge_propose",
     {
@@ -15911,8 +16105,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "propose_knowledge", ...request }
         })
@@ -15927,8 +16121,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "correct_knowledge", ...request }
         })
@@ -15943,8 +16137,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "promote_task_note_knowledge", ...request }
         })
@@ -15954,7 +16148,7 @@ function registerCompanyBrainGovernedWriteTools(input) {
   input.server.registerTool(
     "task_note_promote_instruction_policy",
     {
-      description: `Atomically promote one still-active note from this exact root task tree into an inactive workspace instruction-policy draft. The note bytes remain exact evidence and draft content. Use this only for a universal always-on rule, never for an incident, fact, decision, outcome, or conditional procedure. Once a human activates the draft, those bytes are composed verbatim into the prompt of every session the target applies to, so a note over ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters is rejected here rather than truncated: write a fresh minimal imperative note instead of promoting a long working note. The frozen learning policy records a decision receipt, but mandatory policy still requires human activation even under Automatic; this never widens scope.`,
+      description: `Atomically promote one still-active note from this exact root task tree into a workspace instruction-policy proposal. The note bytes remain exact evidence and draft content. Use this only for a universal always-on rule, never for an incident, fact, decision, outcome, or conditional procedure. Once active, those bytes are composed verbatim into the prompt of every session the target applies to, so a note over ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters is rejected here rather than truncated: write a fresh minimal imperative note instead of promoting a long working note. Off creates nothing; Review first keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt. This never widens scope.`,
       inputSchema: {
         ...taskNotePromotion,
         target: WorkspaceInstructionPolicyTarget,
@@ -15964,8 +16158,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "promote_task_note_instruction_policy", ...request }
         })
@@ -15989,8 +16183,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "promote_task_note_preference", ...request }
         })
@@ -16000,7 +16194,7 @@ function registerCompanyBrainGovernedWriteTools(input) {
   input.server.registerTool(
     "instruction_policy_propose",
     {
-      description: `Materialize an evidence-backed inactive workspace instruction-policy draft. Use this only for a minimal universal rule, never for an incident, fact, decision, outcome, or conditional procedure. Once a human activates it, this content is composed verbatim into the prompt of every session the target applies to (every session in this workspace for a global charter or policy, every session bound to the role for a role policy), so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_DURABLE_TEXT_STYLE} The frozen learning policy records a decision receipt, but this tool cannot activate mandatory behavior, including when learning mode is Automatic; a human must activate the draft.`,
+      description: `Materialize an evidence-backed workspace instruction-policy proposal. Use this only for a minimal universal rule, never for an incident, fact, decision, outcome, or conditional procedure. Once active, this content is composed verbatim into the prompt of every session the target applies to (every session in this workspace for a global charter or policy, every session bound to the role for a role policy), so keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE} Off creates nothing; Review first keeps the proposal inactive; Autonomous may activate an eligible proposal through the governed instruction lifecycle with an undoable receipt.`,
       inputSchema: {
         ...evidence,
         target: WorkspaceInstructionPolicyTarget,
@@ -16015,8 +16209,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "propose_instruction_policy", ...request }
         })
@@ -16026,7 +16220,7 @@ function registerCompanyBrainGovernedWriteTools(input) {
   input.server.registerTool(
     "preference_propose",
     {
-      description: `Materialize an evidence-backed workspace Skill proposal in the structured preference authority. Use this only for reusable conditional how-to guidance, never for an incident, fact, decision, outcome, or universal always-on rule. Its short title and description are what get composed into every session prompt; the content is retrieved on demand, so its length is retrieval cost rather than standing prompt cost. Keep the content under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_DURABLE_TEXT_STYLE} Under Suggest it stays inactive for human review; under Automatic an eligible decision is activated through the governed preference lifecycle with an undoable receipt. It never creates mandatory authority.`,
+      description: `Materialize an evidence-backed workspace Skill proposal in the structured preference authority. Use this only for reusable conditional how-to guidance, never for an incident, fact, decision, outcome, or universal always-on rule. Its short title and description are what get composed into every session prompt; the content is retrieved on demand, so its length is retrieval cost rather than standing prompt cost. Keep the content under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters. ${AGENT_AUTHORED_SKILL_STYLE} Under Suggest it stays inactive for human review; under Automatic an eligible decision is activated through the governed preference lifecycle with an undoable receipt. It never creates mandatory authority.`,
       inputSchema: {
         ...evidence,
         stableKey: z6.string().trim().min(1).max(PREFERENCE_REGISTRY_STABLE_KEY_MAX_CHARS),
@@ -16045,8 +16239,8 @@ function registerCompanyBrainGovernedWriteTools(input) {
     },
     async (request) => {
       await input.authorize();
-      return input.json(
-        await router.write({
+      return writeResult(
+        () => router.write({
           attempt: input.attempt,
           request: { kind: "propose_preference", ...request }
         })
@@ -16090,7 +16284,7 @@ function registerCompanyProfileAgentAdminTools(input) {
   input.server.registerTool(
     "company_profile_propose",
     {
-      description: `Prepare the organization's small, stable identity: identity says who the organization is, and mission says why it exists. Once activated, both fields are mandatory prompt context in every root session for the whole organization, so use one plain descriptive statement per field with no products, customers, goals, constraints, procedures, or marketing copy. Those details belong in organization-scoped Documents and are retrieved only when relevant. Each field is bounded to ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters for agent-authored proposals. This creates only an immutable inactive proposal for the exact live turn initiated by the organization owner and does not use workspace learning policy. The receipt returns the exact \`humanInput\` payload; call \`request_human_input\` with it verbatim, then call \`company_profile_confirm\` with the returned requestId.`,
+      description: `Prepare the organization's small, stable identity: identity says who the organization is, and mission says why it exists. Once activated, both fields are mandatory prompt context in every root session for the whole organization, so use one plain descriptive statement per field with no products, customers, goals, constraints, procedures, or marketing copy. Those details belong in organization-scoped Documents and are retrieved only when relevant. Each field is bounded to ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters for agent-authored proposals. This is independent of workspace learning policy and follows the organization owner's Agent-managed identity mode. Off creates nothing. Review first returns status=confirmation_required with the exact \`humanInput\` payload; call \`request_human_input\` with it verbatim, then call \`company_profile_confirm\` with the returned requestId. Autonomous may return status=activated immediately after exact live-owner, stale-head, and compare-and-swap checks; do not ask for another confirmation in that case.`,
       inputSchema: {
         operationId: z7.string().uuid(),
         identity: scalar,
@@ -16170,6 +16364,7 @@ import {
   agentAuthoredDurableTextTooLongMessage
 } from "@opengeni/contracts";
 import { RememberError, createRememberRouter } from "@opengeni/core";
+import { PreferenceRegistryStableKeyConflictError as PreferenceRegistryStableKeyConflictError2 } from "@opengeni/db";
 import * as z8 from "zod/v4";
 var laneContentMaxChars = {
   instruction_policy: AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS2,
@@ -16188,7 +16383,7 @@ function registerRememberTools(input) {
   input.server.registerTool(
     "remember",
     {
-      description: `Durably remember something the user explicitly asked to keep for this workspace. Route by purpose: lane=knowledge for a fact, decision, incident, bug fix, or outcome that should become searchable Memory; lane=preference creates a Skill for reusable conditional how-to guidance; lane=instruction_policy is only for a universal always/never rule that should apply to nearly every task. Write the instruction lane as the shortest complete rule, at most ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS2} characters and normally 1-3 imperative sentences, with no numbered steps, examples, rationale, or restated defaults. Keep a Skill under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS2} characters; only its one-sentence descriptor is composed and the full instructions are retrieved on demand. Do not copy one item into multiple lanes. Under Automatic learning a Skill may activate immediately; otherwise the receipt returns status=confirmation_required with the exact \`humanInput\` payload: call \`request_human_input\` with it verbatim, then call \`remember_confirm\` with the returned requestId. Workspace instructions and Memory always need that confirmation. Do not use this for facts you merely inferred; use knowledge_propose or task notes for those. Confirmed lane=knowledge content keeps its reviewed claim provenance and materializes its exact approved text into Memory for later \`memory_search\` retrieval.`,
+      description: `Create governed durable knowledge, a Skill, or a mandatory workspace instruction. When the agent-only memory_save tool is available, use it instead for ordinary durable facts, decisions, incidents, bug fixes, and confirmed outcomes; those Memory writes are autonomous and independent of Learning mode. Use lane=knowledge only when memory_save is unavailable and the user explicitly requests reviewed workspace knowledge; lane=preference creates a Skill for reusable conditional how-to guidance; lane=instruction_policy is only for a universal always/never rule that should apply to nearly every task. Write the instruction lane as the shortest complete rule, at most ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS2} characters and normally 1-3 imperative sentences, with no numbered steps, examples, rationale, or restated defaults. Keep a Skill under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS2} characters with one clear trigger and outcome, only the necessary steps, checks, and exceptions, and a one-sentence descriptor. Do not copy one item into multiple lanes. Under Autonomous learning, an eligible Skill or workspace instruction may activate immediately through its governed lifecycle. Under Review first, it remains inactive and the receipt returns status=confirmation_required with the exact \`humanInput\` payload: call \`request_human_input\` with it verbatim, then call \`remember_confirm\` with the returned requestId. Off creates no governed change. Reviewed Knowledge always needs confirmation. Do not use lane=knowledge for facts you merely inferred; use memory_save when available, otherwise knowledge_propose or task notes. Confirmed lane=knowledge content keeps its reviewed claim provenance and materializes its exact approved text into Memory for later \`memory_search\` retrieval.`,
       inputSchema: {
         lane: z8.enum(["preference", "instruction_policy", "knowledge"]),
         ...laneFields,
@@ -16220,9 +16415,20 @@ function registerRememberTools(input) {
         title: request.title ?? content.slice(0, 80),
         description: request.description ?? content.slice(0, 200)
       } : lane === "instruction_policy" ? { ...base, lane, target: request.target } : { ...base, lane, subject: request.subject ?? content.slice(0, 80) };
-      return input.json(
-        await router.remember({ attempt: input.attempt, request: rememberRequest })
-      );
+      try {
+        return input.json(
+          await router.remember({ attempt: input.attempt, request: rememberRequest })
+        );
+      } catch (error) {
+        if (error instanceof PreferenceRegistryStableKeyConflictError2) {
+          return input.json({
+            status: "not_remembered",
+            code: "preference_stable_key_conflict",
+            message: error.message
+          });
+        }
+        throw error;
+      }
     }
   );
   input.server.registerTool(
@@ -18450,6 +18656,7 @@ function observeWorkDiscovery(observability, observation) {
 // src/mcp/server.ts
 var ORCHESTRATION_FAILURE_CODE_MAX_LENGTH = 128;
 var ORCHESTRATION_FAILURE_MESSAGE_MAX_UTF8_BYTES = 1024;
+var MCP_DISCOVERY_QUERY_MAX_UTF16_CODE_UNITS = WORK_DISCOVERY_QUERY_MAX_CHARS * 8;
 function boundedOrchestrationFailureMessage(value) {
   const normalized = value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
   if (!normalized) return "OpenGeni could not complete the request.";
@@ -18534,9 +18741,6 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   goal_complete: { sessionRequired: true, allOf: ["goals:manage"] },
   goal_pause: { sessionRequired: true, allOf: ["goals:manage"] },
   memory_search: { sessionRequired: true, allOf: ["documents:search"] },
-  // Retired: never registered, so these are never consulted. The map must stay
-  // total over the tool-name union, which still carries both names so that
-  // previously written scheduled-task snapshots keep parsing.
   memory_save: { sessionRequired: true, allOf: ["documents:search"] },
   memory_correct: { sessionRequired: true, allOf: ["documents:search"] },
   preference_registry_summary: {
@@ -19699,6 +19903,14 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
             agentConfig: task.agentConfig,
             missingTargetStatus: 404
           });
+          await validateScheduledTaskMachineTarget({
+            settings: deps.settings,
+            db: deps.db,
+            grant,
+            runMode: task.runMode,
+            agentConfig: task.agentConfig,
+            requireOnline: true
+          });
           await requireLimit3(deps, {
             accountId: grant.accountId,
             workspaceId: grant.workspaceId,
@@ -21103,6 +21315,7 @@ function registerPreferenceRegistryTools(server, deps, grant, json) {
   );
 }
 var MemoryKindSchema = z43.enum(["preference", "semantic", "procedural", "decision", "episodic"]);
+var MemoryWriteKindSchema = z43.enum(["semantic", "decision", "episodic"]);
 function scheduledTaskReceipt(operation, task, outcome, changed, options = {}) {
   return mcpMutationReceipt({
     operation,
@@ -21150,11 +21363,34 @@ function scheduledTaskUpdateChangesState(task, update) {
   if (update.personalConnectionDelegations !== void 0) return true;
   return false;
 }
+function memorySlackPublicationActor(actor, sessionId, fallbackOwnerLabel) {
+  return {
+    actor: {
+      kind: actor.initiator.kind === "subject" ? "human" : "service",
+      subjectId: actor.initiator.subjectId,
+      initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+      sessionId,
+      turnId: actor.turnId,
+      attemptId: actor.attemptId
+    },
+    ownerLabel: actor.initiator.label ?? fallbackOwnerLabel
+  };
+}
+function memoryPreview(text) {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  return normalized.length <= 120 ? normalized : `${normalized.slice(0, 119)}\u2026`;
+}
 function registerMemoryTools(server, deps, grant, sessionId, json, promptMode) {
+  const publicationInputSchema = z43.object({
+    importance: z43.enum(["major", "normal", "minor"]),
+    audience: z43.literal("workspace"),
+    slackMode: z43.enum(["auto", "review", "never"]),
+    shareSummary: z43.string().trim().min(1).max(4096)
+  });
   server.registerTool(
     "memory_search",
     {
-      description: `${MEMORY_SEARCH_TOOL_DESCRIPTION} Legacy preference-kind records are excluded from this tool because structured preferences are the only behavioral authority. To save something the user explicitly asked to keep, use \`remember\`; for your own findings use task notes and their promotion tools.`,
+      description: `${MEMORY_SEARCH_TOOL_DESCRIPTION} All existing Memory kinds are searchable. Legacy preference and procedure records are historical context, not active instructions; Skills and workspace instructions remain the behavioral authorities. When workspace Memory is enabled, use memory_save autonomously for durable facts, decisions, incidents, fixes, and outcomes, and memory_correct when an existing record is wrong or outdated.`,
       inputSchema: {
         query: z43.string().min(1),
         kind: MemoryKindSchema.optional(),
@@ -21175,6 +21411,195 @@ function registerMemoryTools(server, deps, grant, sessionId, json, promptMode) {
       )
     })
   );
+  if (exactAgentAttemptClaims(grant) === null) return;
+  server.registerTool(
+    "memory_save",
+    {
+      description: MEMORY_SAVE_TOOL_DESCRIPTION,
+      inputSchema: {
+        text: z43.string().min(1),
+        kind: MemoryWriteKindSchema,
+        confidence: z43.number().min(0).max(1).optional(),
+        replaces_id: z43.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional()
+      }
+    },
+    async ({ text, kind, confidence, replaces_id, slack_publication }) => {
+      const actor = await requireLiveAgentAttemptAuthorization2(deps.db, grant, sessionId);
+      const result = await saveWorkspaceMemoryWithSlackPublication(
+        deps.db,
+        {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          sessionId,
+          text,
+          kind,
+          ...confidence !== void 0 ? { confidence } : {},
+          ...replaces_id ? { replacesId: replaces_id } : {},
+          origin: "agent"
+        },
+        slack_publication ? {
+          distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+          actor: memorySlackPublicationActor(actor, sessionId, grant.subjectLabel ?? null).actor,
+          ownerLabel: actor.initiator.label ?? grant.subjectLabel ?? null
+        } : null,
+        deps.getDocumentServices().embedder
+      );
+      let timelineWarning = null;
+      try {
+        await appendAndPublishEvents3(deps.db, deps.bus, grant.workspaceId, sessionId, [
+          {
+            type: "memory.saved",
+            payload: {
+              memoryId: result.memory.id,
+              kind: result.memory.kind,
+              preview: memoryPreview(result.memory.text),
+              deduped: result.deduped,
+              ...result.superseded ? { supersededMemoryId: result.superseded.id } : {}
+            }
+          }
+        ]);
+      } catch {
+        timelineWarning = "Memory committed, but its session timeline event could not be recorded.";
+        console.warn("workspace memory save: committed without session timeline event", {
+          errorClass: "MemoryTimelineOperationError",
+          errorCode: "memory_save_timeline_append_failed",
+          origin: "api",
+          workspaceId: grant.workspaceId,
+          sessionId,
+          memoryId: result.memory.id
+        });
+      }
+      const changed = !result.deduped || result.updated || result.superseded !== null;
+      const outcome = result.updated || result.superseded !== null ? "updated" : result.deduped ? "unchanged" : "created";
+      return json(
+        mcpMutationReceipt({
+          operation: "memory_save",
+          committed: true,
+          outcome,
+          changed,
+          resource: {
+            type: "knowledge_memory",
+            id: result.memory.id,
+            state: result.memory.status
+          },
+          relatedResources: result.superseded ? [
+            {
+              type: "knowledge_memory",
+              id: result.superseded.id,
+              state: result.superseded.status
+            }
+          ] : void 0,
+          timestamp: result.memory.updatedAt,
+          idempotency: { status: "not_supported" },
+          warnings: [
+            ...!result.embedded ? ["Memory committed without a vector embedding; keyword search remains available."] : [],
+            ...timelineWarning ? [timelineWarning] : []
+          ],
+          facts: {
+            deduped: result.deduped,
+            dedupeReason: result.dedupeReason,
+            updatedInPlace: result.updated,
+            embedded: result.embedded,
+            slackPublicationDecision: result.slackPublication.decision?.eligible ? "eligible" : result.slackPublication.decision?.reason ?? "not_requested",
+            slackPublicationId: result.slackPublication.enqueue?.kind === "enqueued" || result.slackPublication.enqueue?.kind === "replayed" ? result.slackPublication.enqueue.publication.id : null,
+            slackPublicationState: result.slackPublication.enqueue?.kind === "enqueued" || result.slackPublication.enqueue?.kind === "replayed" ? result.slackPublication.enqueue.publication.state : null
+          }
+        })
+      );
+    }
+  );
+  server.registerTool(
+    "memory_correct",
+    {
+      description: MEMORY_CORRECT_TOOL_DESCRIPTION,
+      inputSchema: {
+        id: z43.string().min(1),
+        reason: z43.string().min(1).optional(),
+        replacement_text: z43.string().min(1).optional(),
+        slack_publication: publicationInputSchema.optional()
+      }
+    },
+    async ({ id, reason: reason2, replacement_text, slack_publication }) => {
+      const actor = await requireLiveAgentAttemptAuthorization2(deps.db, grant, sessionId);
+      const result = await correctWorkspaceMemoryWithSlackPublication(
+        deps.db,
+        {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          sessionId,
+          id,
+          ...reason2 ? { reason: reason2 } : {},
+          ...replacement_text ? { replacementText: replacement_text } : {},
+          origin: "agent"
+        },
+        slack_publication ? {
+          distribution: MemorySlackPublicationDistribution.parse(slack_publication),
+          actor: memorySlackPublicationActor(actor, sessionId, grant.subjectLabel ?? null).actor,
+          ownerLabel: actor.initiator.label ?? grant.subjectLabel ?? null
+        } : null,
+        deps.getDocumentServices().embedder
+      );
+      let timelineWarning = null;
+      try {
+        await appendAndPublishEvents3(deps.db, deps.bus, grant.workspaceId, sessionId, [
+          {
+            type: "memory.corrected",
+            payload: {
+              memoryId: result.memory.id,
+              kind: result.memory.kind,
+              preview: memoryPreview(result.memory.text),
+              action: result.action,
+              ...reason2 ? { reason: memoryPreview(reason2) } : {},
+              ...result.replacement ? {
+                replacementMemoryId: result.replacement.id,
+                replacementPreview: memoryPreview(result.replacement.text)
+              } : {}
+            }
+          }
+        ]);
+      } catch {
+        timelineWarning = "Memory correction committed, but its session timeline event could not be recorded.";
+        console.warn("workspace memory correction: committed without session timeline event", {
+          errorClass: "MemoryTimelineOperationError",
+          errorCode: "memory_correct_timeline_append_failed",
+          origin: "api",
+          workspaceId: grant.workspaceId,
+          sessionId,
+          memoryId: result.memory.id
+        });
+      }
+      return json(
+        mcpMutationReceipt({
+          operation: "memory_correct",
+          committed: true,
+          outcome: "updated",
+          changed: true,
+          resource: {
+            type: "knowledge_memory",
+            id: result.memory.id,
+            state: result.memory.status
+          },
+          relatedResources: result.replacement ? [
+            {
+              type: "knowledge_memory",
+              id: result.replacement.id,
+              state: result.replacement.status
+            }
+          ] : void 0,
+          timestamp: (result.replacement ?? result.memory).updatedAt,
+          idempotency: { status: "not_supported" },
+          warnings: timelineWarning ? [timelineWarning] : [],
+          facts: {
+            correctionAction: result.action,
+            slackPublicationDecision: result.slackPublication.decision?.eligible ? "eligible" : result.slackPublication.decision?.reason ?? "not_requested",
+            slackPublicationId: result.slackPublication.enqueue?.kind === "enqueued" || result.slackPublication.enqueue?.kind === "replayed" ? result.slackPublication.enqueue.publication.id : null,
+            slackPublicationState: result.slackPublication.enqueue?.kind === "enqueued" || result.slackPublication.enqueue?.kind === "replayed" ? result.slackPublication.enqueue.publication.state : null
+          }
+        })
+      );
+    }
+  );
 }
 function registerFleetTools(server, deps, grant, sessionId, json) {
   const services = {
@@ -21668,7 +22093,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           includeLastMessage: z43.boolean().optional(),
           orderBy: z43.enum(["createdAt", "updatedAt", "relevance"]).optional(),
           updatedAfter: z43.string().max(64).optional(),
-          query: z43.string().max(WORK_DISCOVERY_QUERY_MAX_CHARS).optional(),
+          query: z43.string().max(MCP_DISCOVERY_QUERY_MAX_UTF16_CODE_UNITS).optional(),
           statuses: z43.array(
             z43.enum([
               "queued",
@@ -21920,7 +22345,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
     server.registerTool(
       "session_wait",
       {
-        description: `Block until a watched session has new durable events after your cursor, until your own session has pending machine input (a child result, an agent message, a steer), or until maxWaitSeconds (default ${SESSION_WAIT_DEFAULT_SECONDS}, max ${SESSION_WAIT_MAX_SECONDS}) elapses. Use this for short waits inside the current turn instead of sleeping and polling session_events/session_get/sessions_list while a child or peer session works; for long waits end this turn with goal_wait rather than looping session_wait for hours while holding the turn and sandbox. Pass each target's sessionId and afterSequence (its last seen sequence, 0 for a new session); returns immediately when anything already changed. Only turn lifecycle, agent.message.completed, blocking failures, goal facts, and session status/control changes count as a change; raw deltas, tool receipts, and sandbox diagnostics never wake it. Each changed target returns a bounded compact summary of up to ${SESSION_WAIT_EVENTS_PER_TARGET} exact durable events plus latestSequence (pass it back as the next afterSequence) and hasMore (drill down with session_events after=latestSequence). ownPendingUpdates > 0 means your own session has machine input that is delivered only when your next turn is claimed: finish this turn to receive it, or pass includeOwnPendingUpdates=false to keep waiting on the targets. timedOut=true means nothing changed; liveFanout=false means the live bus was unavailable and the wait relied on the deadline re-check. The whole result is byte-bounded: summaries are shortened first, then newest rows dropped, so a changed target may come back with events=[] and hasMore=true; read those rows with session_events after=latestSequence. The wait cannot exceed ${SESSION_WAIT_MAX_SECONDS} seconds because the MCP client request timeout is 60 seconds.`,
+        description: `Block until a watched session has new durable events after your cursor, until your own session has pending machine input (a child result, an agent message, a steer), or until maxWaitSeconds (default ${SESSION_WAIT_DEFAULT_SECONDS}, max ${SESSION_WAIT_MAX_SECONDS}) elapses. Use this for short waits inside the current turn instead of sleeping and polling session_events/session_get/sessions_list while a child or peer session works; for long waits end this turn with goal_wait rather than looping session_wait for hours while holding the turn and sandbox. Pass each target's sessionId and afterSequence (its last seen sequence, 0 for a new session). waitFor=change is the backward-compatible default and returns on turn lifecycle, agent.message.completed, blocking failures, goal facts, or session status/control changes. waitFor=completion is the child-result join: it ignores progress, completed commentary messages, goal facts, maintenance turns, and continuation segment settlements and returns only for a result-bearing final turn or a blocking state. A goal.completed event records goal state but is not a terminal child result. Raw deltas, tool receipts, sandbox diagnostics, and unrelated progress never wake either mode. Each changed target returns a bounded compact summary of up to ${SESSION_WAIT_EVENTS_PER_TARGET} exact durable events plus latestSequence (pass it back as the next afterSequence) and hasMore (drill down with session_events after=latestSequence). ownPendingUpdates > 0 means your own session has machine input that is delivered only when your next turn is claimed: finish this turn to receive it, or pass includeOwnPendingUpdates=false to keep waiting on the targets. timedOut=true means nothing changed; liveFanout=false means the live bus was unavailable and the wait relied on the deadline re-check. The whole result is byte-bounded: summaries are shortened first, then newest rows dropped, so a changed target may come back with events=[] and hasMore=true; read those rows with session_events after=latestSequence. The wait cannot exceed ${SESSION_WAIT_MAX_SECONDS} seconds because the MCP client request timeout is 60 seconds.`,
         inputSchema: {
           targets: z43.array(
             z43.object({
@@ -21931,10 +22356,13 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           includeOwnPendingUpdates: z43.boolean().optional().describe(
             "Also return when your own session has pending machine input (default true)."
           ),
+          waitFor: z43.enum(["change", "completion"]).optional().describe(
+            "change (default) returns on relevant activity; completion ignores messages, goal/progress, maintenance, and continuation segments until a result-bearing final turn or blocker."
+          ),
           maxWaitSeconds: z43.number().int().min(1).max(SESSION_WAIT_MAX_SECONDS).optional()
         }
       },
-      async ({ targets, includeOwnPendingUpdates, maxWaitSeconds }, extra) => {
+      async ({ targets, includeOwnPendingUpdates, waitFor, maxWaitSeconds }, extra) => {
         const distinct = new Set(targets.map((target) => target.sessionId));
         if (distinct.size !== targets.length) {
           throw new Error("session_wait targets must name distinct sessions");
@@ -21944,6 +22372,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           await requireSession(deps.db, grant.workspaceId, target.sessionId);
         }
         const ownSessionId = includeOwnPendingUpdates === false ? null : callerSessionId;
+        const targetEventTypes = waitFor === "completion" ? SESSION_WAIT_COMPLETION_EVENT_TYPES : SESSION_WAIT_EVENT_TYPES;
         const signal = extra?.signal;
         const workspaceId = grant.workspaceId;
         return json(
@@ -21951,6 +22380,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             targets,
             ownSessionId,
             maxWaitMs: (maxWaitSeconds ?? SESSION_WAIT_DEFAULT_SECONDS) * 1e3,
+            targetEventTypes,
+            targetEventMatches: waitFor === "completion" ? sessionWaitCompletionEventMatches : void 0,
             signal,
             source: {
               reauthorizeTargets: async (sessionIds) => {
@@ -21969,7 +22400,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
                   direction: "after",
                   limit: SESSION_WAIT_EVENTS_PER_TARGET,
                   payloadMode: "full",
-                  includeTypes: SESSION_WAIT_EVENT_TYPES,
+                  includeTypes: targetEventTypes,
                   maxBytes: SESSION_EVENT_MCP_MAX_BYTES * 4
                 });
                 return { events: page.events, hasMore: page.hasMore };
@@ -21989,6 +22420,9 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
   if (can("sessions:create") && sessionCreateVisible) {
     const sessionCreateInput = z43.object({
       initialMessage: z43.string().min(1),
+      title: z43.string().min(1).max(SESSION_TITLE_MAX_CHARACTERS).optional().describe(
+        "Concise semantic title for the child session. Omit only when the delegated goal or initial message already provides a suitable title; OpenGeni derives a sensitive-safe bounded fallback from that text."
+      ),
       instructions: z43.string().min(1).max(SESSION_INSTRUCTIONS_MAX_CHARACTERS).optional(),
       goal: z43.unknown().optional(),
       resources: z43.array(z43.unknown()).optional(),
@@ -22047,7 +22481,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
     server.registerTool(
       "session_create",
       {
-        description: "Spawn a new agent session (a worker). The child inherits this session's visibility; a private session can only create a same-owner private child. Give a goal-bearing child its delegated objective. Its goal.rootConstraints may be an exact applicable subset of this accepted turn's frozen root constraints; omit that field to inherit all of them. Omit sandbox for the safe default: compatible children share the creator's box, while a different Variable Set, Rig, or machineTarget gets its own box. Use 'new' for deliberate isolation or {groupId} for a strict compatible sibling join. Put targetSandboxId and its optional workingDir together inside machineTarget; a machineTarget is always an own-box create even when the parent is backend none. To create a non-delegating leaf, pass a narrowed firstPartyMcpTools list that omits session_create; do not use a child-local depth override. Public REST/SDK callers retain advanced absolute depth and explicit shared-placement controls.",
+        description: "Spawn a new agent session (a worker) only for a concrete, bounded subtask that can run independently and has a defined integration point in your current work. Do not delegate work you will also perform yourself; track the child and join its actual result before completing dependent work. Give the child a concise semantic title; if omitted, OpenGeni derives one from its delegated goal or initial message. The child inherits this session's visibility; a private session can only create a same-owner private child. Give a goal-bearing child its delegated objective. Its goal.rootConstraints may be an exact applicable subset of this accepted turn's frozen root constraints; omit that field to inherit all of them. Omit sandbox for the safe default: compatible children share the creator's box, while a different Variable Set, Rig, or machineTarget gets its own box. Use 'new' for deliberate isolation or {groupId} for a strict compatible sibling join. Put targetSandboxId and its optional workingDir together inside machineTarget; a machineTarget is always an own-box create even when the parent is backend none. To create a non-delegating leaf, pass a narrowed firstPartyMcpTools list that omits session_create; do not use a child-local depth override. Public REST/SDK callers retain advanced absolute depth and explicit shared-placement controls.",
         inputSchema: sessionCreateInput
       },
       async (args) => {
@@ -22060,14 +22494,21 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           if (callerSessionId !== null) {
             await authorizeFirstPartySession(deps, grant, callerSessionId, "session.child.create");
           }
-          const { machineTarget, ...request } = args;
-          const result = await createSessionForRequestWithOutcome(deps, grant, grant.workspaceId, {
-            ...request,
-            ...machineTarget ? {
-              targetSandboxId: machineTarget.targetSandboxId,
-              ...machineTarget.workingDir !== void 0 ? { workingDir: machineTarget.workingDir } : {}
-            } : {}
-          });
+          const { machineTarget, title, ...request } = args;
+          const result = await createSessionForRequestWithOutcome(
+            deps,
+            grant,
+            grant.workspaceId,
+            {
+              ...request,
+              ...machineTarget ? {
+                targetSandboxId: machineTarget.targetSandboxId,
+                ...machineTarget.workingDir !== void 0 ? { workingDir: machineTarget.workingDir } : {}
+              } : {}
+            },
+            void 0,
+            title === void 0 ? {} : { automaticTitleCandidate: title }
+          );
           return json(sessionCreateMutationReceipt(result, Boolean(request.idempotencyKey)));
         } catch (error) {
           return orchestrationFailureResult("session_create", error);
@@ -23821,7 +24262,7 @@ function registerCapabilityRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "capabilities:manage");
     const payload = CreateCapabilityCatalogItemRequest.parse(await c.req.json());
     return c.json(
       await createCatalogItem({ db, accountId: grant.accountId, workspaceId, payload }),
@@ -23849,7 +24290,7 @@ function registerCapabilityRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "capabilities:manage");
     const payload = EnableCapabilityRequest.parse(await c.req.json());
     const installation = await enableCapability({
       db,
@@ -23864,7 +24305,7 @@ function registerCapabilityRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/disable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant3(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "capabilities:manage");
     const installation = await disableCapability({
       db,
       accountId: grant.accountId,
@@ -23990,8 +24431,10 @@ import {
   designateCodexAppsCredential,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
+  disconnectOrganizationCodexAccount,
   encryptEnvironmentValue as encryptEnvironmentValue6,
   ensureCodexRotationSettings,
+  ensureOrganizationCodexRotationSettings,
   fetchCodexUsageForAccount,
   fetchCodexRateLimitResetCreditsForAccount,
   fenceCodexResetRedemptionSend,
@@ -23999,24 +24442,36 @@ import {
   getCodexCredentialStatus,
   getCodexAppsSettings,
   getCodexRotationSettings,
+  getOrganizationCodexRotationSettings,
+  getWorkspaceCodexSubscriptionSource,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
+  listOrganizationCodexAccountStatuses,
   listCodexResetRedemptionRecoveries,
+  nestedPostgresSqlState,
   releaseCodexResetRedemptionClaim,
   updateCodexAllocatorEligibility,
   loadCodexCredentialForRun,
   renameCodexAccount,
+  renameOrganizationCodexAccount,
   setActiveCodexCredential,
+  setActiveOrganizationCodexCredential,
   setInitialActiveCodexCredential,
+  setWorkspaceCodexSubscriptionMode,
+  setWorkspaceCodexSubscriptionModeInTransaction,
+  updateOrganizationCodexRotationSettings,
   updateCodexRotationSettings,
+  upsertOrganizationCodexSubscriptionCredential,
   upsertCodexSubscriptionCredential,
-  withCodexCapacityMutation
+  withCodexCapacityMutation,
+  withSessionCodexCapacityMutation
 } from "@opengeni/db";
 import { createSignedState as createSignedState7, readSignedState as readSignedState6 } from "@opengeni/github";
 import {
   getManagedSession,
   hasPermission as hasPermission11,
-  requireAccessGrant as requireAccessGrant4
+  requireAccessGrant as requireAccessGrant4,
+  requireCanonicalLocalAccountAdministrator
 } from "@opengeni/core";
 import { HTTPException as HTTPException21 } from "hono/http-exception";
 import * as z9 from "zod/v4";
@@ -24085,6 +24540,7 @@ var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
 function codexAccountJson(row, options = {}) {
   return {
     id: row.id,
+    source: row.source,
     chatgptAccountId: row.chatgptAccountId,
     label: row.label,
     email: row.accountEmail,
@@ -24113,7 +24569,7 @@ function codexAccountJson(row, options = {}) {
     // P3 rotation cooldown: when set and in the future, this account is cooling-down.
     exhaustedUntil: row.exhaustedUntil,
     appsDesignated: options.appsCredentialId === row.id,
-    canEnableApps: options.appsCredentialId === null && options.canManageApps === true && options.humanSubjectId !== null && options.humanSubjectId !== void 0 && row.connectedBySubjectId === options.humanSubjectId && row.status === "active"
+    canEnableApps: row.source === "workspace" && options.appsCredentialId === null && options.canManageApps === true && options.humanSubjectId !== null && options.humanSubjectId !== void 0 && row.connectedBySubjectId === options.humanSubjectId && row.status === "active"
   };
 }
 function codexUsageJson(payload) {
@@ -24159,6 +24615,48 @@ async function managedCookieHuman(c, deps) {
     browserSessionHash: await hashCodexBrowserSession(session.session.id)
   };
 }
+async function requireOrganizationCodexHuman(c, deps, organizationId2) {
+  const parsed = z9.string().uuid().safeParse(organizationId2);
+  if (!parsed.success) throw new HTTPException21(422, { message: "invalid organization id" });
+  let human = await managedCookieHuman(c, deps);
+  if (!human && deps.settings.productAccessMode === "local") {
+    const local = await requireCanonicalLocalAccountAdministrator(c, deps, organizationId2);
+    human = {
+      subjectId: local.subjectId,
+      browserSessionHash: await hashCodexBrowserSession(`local:${local.subjectId}`)
+    };
+  }
+  if (!human) {
+    throw new HTTPException21(401, { message: "organization administrator session required" });
+  }
+  try {
+    await getOrganizationCodexRotationSettings(deps.db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "42501") {
+      throw new HTTPException21(403, { message: "organization administration is not authorized" });
+    }
+    if (state === "P0002") {
+      throw new HTTPException21(404, { message: "organization not found" });
+    }
+    throw error;
+  }
+  return human;
+}
+async function requireWorkspaceCodexManagementSource(deps, workspaceId) {
+  const source = await getWorkspaceCodexSubscriptionSource(deps.db, workspaceId);
+  if (source.effectiveSource === "organization") {
+    throw new HTTPException21(409, {
+      message: "this Codex subscription is managed in Organization settings"
+    });
+  }
+  if (source.effectiveSource === "disabled") {
+    throw new HTTPException21(409, { message: "Codex is disabled for this workspace" });
+  }
+}
 function requireSameOriginBrowserMutation(c, deps) {
   const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
@@ -24166,13 +24664,13 @@ function requireSameOriginBrowserMutation(c, deps) {
       message: "JSON browser request required"
     });
   }
-  if (!deps.settings.publicBaseUrl) {
+  if (deps.settings.productAccessMode !== "local" && !deps.settings.publicBaseUrl) {
     throw new HTTPException21(503, {
       message: "managed browser origin is not configured"
     });
   }
-  const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
-  if (c.req.header("origin") !== expectedOrigin) {
+  const origin = c.req.header("origin");
+  if (deps.settings.productAccessMode === "local" ? !localBrowserOriginMatchesRequest(c, origin) : origin !== new URL(deps.settings.publicBaseUrl).origin) {
     throw new HTTPException21(403, {
       message: "same-origin browser request required"
     });
@@ -24183,6 +24681,30 @@ function requireSameOriginBrowserMutation(c, deps) {
     });
   }
 }
+function localBrowserOriginMatchesRequest(c, value) {
+  if (!value) return false;
+  let origin;
+  try {
+    origin = new URL(value);
+  } catch {
+    return false;
+  }
+  if (origin.origin !== value || origin.origin === "null" || origin.protocol !== "http:" && origin.protocol !== "https:") {
+    return false;
+  }
+  const forwardedProtocol = c.req.header("x-forwarded-proto")?.trim().toLowerCase();
+  const protocol = forwardedProtocol ? `${forwardedProtocol}:` : new URL(c.req.url).protocol;
+  if (protocol !== "http:" && protocol !== "https:") return false;
+  const forwardedHost = c.req.header("x-forwarded-host") ?? c.req.header("host");
+  if (!forwardedHost || /[\s,/?#@\\]/u.test(forwardedHost)) return false;
+  let request;
+  try {
+    request = new URL(`${protocol}//${forwardedHost}`);
+  } catch {
+    return false;
+  }
+  return origin.protocol === request.protocol && origin.hostname === request.hostname && (request.port === "" || origin.port === request.port);
+}
 async function requireRedemptionHuman(c, deps, workspaceId) {
   if (deps.settings.productAccessMode !== "managed") {
     throw new HTTPException21(403, {
@@ -24201,7 +24723,7 @@ async function requireRedemptionHuman(c, deps, workspaceId) {
       message: "managed browser session required"
     });
   }
-  const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+  const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
   if (grant.subjectId !== human.subjectId) {
     throw new HTTPException21(403, {
       message: "managed browser identity mismatch"
@@ -24432,9 +24954,244 @@ async function signalPendingCodexCapacityTargets(deps, workspaceId) {
 var CODEX_DEVICE_EXPIRY_SECONDS = 15 * 60;
 function registerCodexRoutes(app, deps) {
   const { db, settings, githubStateSecret } = deps;
+  app.get("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant4(c, deps, workspaceId, "workspace:read");
+    return c.json(await getWorkspaceCodexSubscriptionSource(db, workspaceId));
+  });
+  app.patch("/v1/workspaces/:workspaceId/codex/source", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    const parsed = z9.object({ mode: z9.enum(["automatic", "workspace", "organization", "disabled"]) }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException21(400, { message: "a valid Codex source mode is required" });
+    }
+    try {
+      return c.json(
+        await setWorkspaceCodexSubscriptionMode(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          mode: parsed.data.mode
+        })
+      );
+    } catch (error) {
+      if (error instanceof Error && (error.message.includes("personal workspaces") || error.message.includes("active turns are using it"))) {
+        throw new HTTPException21(409, { message: error.message });
+      }
+      throw error;
+    }
+  });
+  app.get("/v1/organizations/:organizationId/codex/accounts", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    const [accounts, rotation] = await Promise.all([
+      listOrganizationCodexAccountStatuses(db, {
+        organizationId: organizationId2,
+        actorSubjectId: human.subjectId
+      }),
+      getOrganizationCodexRotationSettings(db, {
+        organizationId: organizationId2,
+        actorSubjectId: human.subjectId
+      })
+    ]);
+    return c.json({
+      accounts: accounts.map((account) => codexAccountJson(account)),
+      activeAccountId: rotation?.activeCredentialId ?? null,
+      settings: {
+        rotationEnabled: rotation?.rotationEnabled ?? false,
+        rotationStrategy: "sharded",
+        activeCredentialId: rotation?.activeCredentialId ?? null
+      }
+    });
+  });
+  app.post("/v1/organizations/:organizationId/codex/connect/start", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    let start;
+    try {
+      start = await startDeviceCode();
+    } catch (error) {
+      throw new HTTPException21(502, {
+        message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login"
+      });
+    }
+    return c.json({
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      intervalSeconds: start.intervalSeconds,
+      state: createSignedState7(githubStateSecret, {
+        organizationId: organizationId2,
+        actorSubjectId: human.subjectId,
+        deviceAuthId: start.deviceAuthId,
+        userCode: start.userCode
+      })
+    });
+  });
+  app.post("/v1/organizations/:organizationId/codex/connect/poll", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    const { state } = await c.req.json().catch(() => null);
+    const payload = state ? readSignedState6(state, githubStateSecret) : null;
+    if (!payload || payload.organizationId !== organizationId2 || payload.actorSubjectId !== human.subjectId || !payload.deviceAuthId || !payload.userCode) {
+      throw new HTTPException21(400, { message: "codex connect state is invalid or expired" });
+    }
+    if (typeof payload.iat === "number" && Date.now() / 1e3 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS) {
+      return c.json({ status: "expired" });
+    }
+    let poll;
+    try {
+      poll = await pollDeviceCode({
+        deviceAuthId: payload.deviceAuthId,
+        userCode: payload.userCode
+      });
+    } catch (error) {
+      throw new HTTPException21(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex device poll failed"
+      });
+    }
+    if (poll.status === "pending") return c.json({ status: "pending" });
+    if (poll.status === "expired") return c.json({ status: "expired" });
+    let tokens;
+    try {
+      tokens = await exchangeDeviceCode({
+        authorizationCode: poll.authorizationCode,
+        codeVerifier: poll.codeVerifier
+      });
+    } catch (error) {
+      throw new HTTPException21(502, {
+        message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed"
+      });
+    }
+    const key = environmentsEncryptionKeyBytes2(settings);
+    if (!key) {
+      throw new HTTPException21(500, {
+        message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured"
+      });
+    }
+    const id = parseIdToken(tokens.idToken);
+    await ensureOrganizationCodexRotationSettings(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId
+    });
+    const upserted = await upsertOrganizationCodexSubscriptionCredential(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId,
+      credentialEncrypted: encryptEnvironmentValue6(
+        key,
+        JSON.stringify({
+          access_token: tokens.accessToken,
+          refresh_token: tokens.refreshToken,
+          id_token: tokens.idToken
+        })
+      ),
+      chatgptAccountId: id.chatgptAccountId,
+      scopes: null,
+      planType: id.planType,
+      isFedramp: id.isFedramp,
+      expiresAt: accessTokenExpiry(tokens.accessToken),
+      lastRefreshAt: /* @__PURE__ */ new Date(),
+      accountEmail: id.email ?? null,
+      label: id.email ?? id.chatgptAccountId ?? null
+    });
+    await signalCodexCapacityTargets(deps, upserted.wakeTargets);
+    const rotation = await getOrganizationCodexRotationSettings(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId
+    });
+    return c.json({
+      status: "connected",
+      plan: id.planType,
+      accountId: upserted.id,
+      isActive: rotation?.activeCredentialId === upserted.id
+    });
+  });
+  app.post("/v1/organizations/:organizationId/codex/accounts/:accountId/activate", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    const credentialId = c.req.param("accountId");
+    const activation = await setActiveOrganizationCodexCredential(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId,
+      credentialId
+    });
+    if (!activation.activated) {
+      throw new HTTPException21(404, { message: "codex account not found" });
+    }
+    await signalCodexCapacityTargets(deps, activation.wakeTargets);
+    return c.json({ activated: true, accountId: credentialId });
+  });
+  app.patch("/v1/organizations/:organizationId/codex/settings", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    const parsed = z9.object({ rotationEnabled: z9.boolean() }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException21(400, { message: "rotationEnabled is required" });
+    }
+    const updated = await updateOrganizationCodexRotationSettings(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId,
+      rotationEnabled: parsed.data.rotationEnabled
+    });
+    if (!updated) throw new HTTPException21(404, { message: "Codex settings not found" });
+    await signalCodexCapacityTargets(deps, updated.wakeTargets);
+    return c.json({
+      rotationEnabled: updated.rotationEnabled,
+      rotationStrategy: "sharded",
+      activeCredentialId: updated.activeCredentialId
+    });
+  });
+  app.patch("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    const body4 = await c.req.json().catch(() => null);
+    const renamed = await renameOrganizationCodexAccount(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId,
+      credentialId: c.req.param("accountId"),
+      label: typeof body4?.label === "string" ? body4.label : null
+    });
+    if (!renamed) throw new HTTPException21(404, { message: "codex account not found" });
+    const accounts = await listOrganizationCodexAccountStatuses(db, {
+      organizationId: organizationId2,
+      actorSubjectId: human.subjectId
+    });
+    const row = accounts.find((account) => account.id === c.req.param("accountId"));
+    if (!row) throw new HTTPException21(404, { message: "codex account not found" });
+    return c.json(codexAccountJson(row));
+  });
+  app.delete("/v1/organizations/:organizationId/codex/accounts/:accountId", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    requireSameOriginBrowserMutation(c, deps);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId2);
+    let result;
+    try {
+      result = await disconnectOrganizationCodexAccount(db, {
+        organizationId: organizationId2,
+        actorSubjectId: human.subjectId,
+        credentialId: c.req.param("accountId")
+      });
+    } catch (error) {
+      const cause = error?.cause;
+      const message = cause instanceof Error ? cause.message : error instanceof Error ? error.message : "";
+      if (message.includes("active turns are using it")) {
+        throw new HTTPException21(409, {
+          message: "Codex subscription cannot disconnect while active turns are using it"
+        });
+      }
+      throw error;
+    }
+    await signalCodexCapacityTargets(deps, result.wakeTargets);
+    return c.json({ disconnected: result.removed, newActiveId: result.newActiveCredentialId });
+  });
   app.post("/v1/workspaces/:workspaceId/codex/connect/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant4(c, deps, workspaceId, "connections:write");
     let start;
     try {
       start = await startDeviceCode();
@@ -24457,7 +25214,7 @@ function registerCodexRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/codex/connect/poll", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
     const { state } = await c.req.json();
     const payload = state ? readSignedState6(state, githubStateSecret) : null;
     if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
@@ -24504,47 +25261,56 @@ function registerCodexRoutes(app, deps) {
         message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured"
       });
     }
-    await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
-    const mutation = await withCodexCapacityMutation(
-      db,
-      { workspaceId, reason: "codex_credential_connected" },
-      async (tx) => {
-        const upserted2 = await upsertCodexSubscriptionCredential(tx, {
-          accountId: grant.accountId,
-          workspaceId,
-          credentialEncrypted: encryptEnvironmentValue6(
-            key,
-            JSON.stringify({
-              access_token: tokens.accessToken,
-              refresh_token: tokens.refreshToken,
-              id_token: tokens.idToken
-            })
-          ),
-          chatgptAccountId: id.chatgptAccountId,
-          scopes: null,
-          // device grant scopes are discovered at runtime, not asserted here
-          planType: id.planType,
-          isFedramp: id.isFedramp,
-          expiresAt: accessTokenExpiry(tokens.accessToken),
-          lastRefreshAt: /* @__PURE__ */ new Date(),
-          accountEmail: id.email ?? null,
-          label: id.email ?? id.chatgptAccountId ?? null,
-          connectedBySubjectId: connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null
-        });
-        return { result: upserted2, changed: upserted2.kind === "upserted" };
-      }
-    );
-    const upserted = mutation.result;
+    const mutation = await withSessionCodexCapacityMutation(db, { workspaceId, reason: "codex_credential_connected" }, async (tx) => {
+      const upserted2 = await upsertCodexSubscriptionCredential(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        credentialEncrypted: encryptEnvironmentValue6(
+          key,
+          JSON.stringify({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: tokens.idToken
+          })
+        ),
+        chatgptAccountId: id.chatgptAccountId,
+        scopes: null,
+        // device grant scopes are discovered at runtime, not asserted here
+        planType: id.planType,
+        isFedramp: id.isFedramp,
+        expiresAt: accessTokenExpiry(tokens.accessToken),
+        lastRefreshAt: /* @__PURE__ */ new Date(),
+        accountEmail: id.email ?? null,
+        label: id.email ?? id.chatgptAccountId ?? null,
+        connectedBySubjectId: connectingHuman?.subjectId === grant.subjectId ? connectingHuman.subjectId : null
+      });
+      if (upserted2.kind === "unresolved_redemption") {
+        return { result: { upserted: upserted2, isActive: false }, changed: false };
+      }
+      await ensureCodexRotationSettings(tx, grant.accountId, workspaceId);
+      await setInitialActiveCodexCredential(tx, workspaceId, upserted2.id);
+      const source = await getWorkspaceCodexSubscriptionSource(tx, workspaceId);
+      await setWorkspaceCodexSubscriptionModeInTransaction(tx, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        mode: source.workspaceKind === "personal" ? "automatic" : "workspace"
+      });
+      const rotation = await getCodexRotationSettings(tx, workspaceId);
+      return {
+        result: {
+          upserted: upserted2,
+          isActive: rotation?.activeCredentialId === upserted2.id
+        },
+        changed: true
+      };
+    });
+    const { upserted, isActive } = mutation.result;
     if (upserted.kind === "unresolved_redemption") {
       throw new HTTPException21(409, {
         message: "this subscription has an unresolved reset redemption; recover it before changing ownership"
       });
     }
-    const rotation = await getCodexRotationSettings(db, workspaceId);
-    let isActive = rotation?.activeCredentialId === upserted.id;
-    if (!isActive && rotation?.activeCredentialId == null) {
-      isActive = await setInitialActiveCodexCredential(db, workspaceId, upserted.id);
-    }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ status: "connected", plan: id.planType, accountId: upserted.id, isActive });
   });
@@ -24555,7 +25321,10 @@ function registerCodexRoutes(app, deps) {
     if (!status) {
       return c.json({ connected: false });
     }
-    const accounts = await listCodexAccountStatuses(db, workspaceId);
+    const [accounts, source] = await Promise.all([
+      listCodexAccountStatuses(db, workspaceId),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId)
+    ]);
     const activeRow = accounts.find((account) => account.id === status.credentialId) ?? null;
     const activeAccount = activeRow ? {
       id: activeRow.id,
@@ -24595,17 +25364,19 @@ function registerCodexRoutes(app, deps) {
       // ClientModel[] the picker surfaces under the "no credits" group
       activeAccount,
       // the account a session runs on when unpinned (label for the indicator)
-      accountCount: accounts.length
+      accountCount: accounts.length,
+      source
     });
   });
   app.get("/v1/workspaces/:workspaceId/codex/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:read");
-    const [accounts, rotation, apps, human] = await Promise.all([
+    const [accounts, rotation, apps, human, source] = await Promise.all([
       listCodexAccountStatuses(db, workspaceId),
       getCodexRotationSettings(db, workspaceId),
       getCodexAppsSettings(db, workspaceId),
-      managedCookieHuman(c, deps)
+      managedCookieHuman(c, deps),
+      getWorkspaceCodexSubscriptionSource(db, workspaceId)
     ]);
     const activeAccountId = rotation?.activeCredentialId ?? null;
     const humanSubjectId = human?.subjectId === grant.subjectId ? human.subjectId : null;
@@ -24619,6 +25390,7 @@ function registerCodexRoutes(app, deps) {
         })
       ),
       activeAccountId,
+      source,
       apps: {
         available: settings.codexConnectedAppsEnabled,
         credentialId: apps.credentialId,
@@ -24637,6 +25409,7 @@ function registerCodexRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     if (!settings.codexConnectedAppsEnabled) {
       throw new HTTPException21(409, { message: "Codex Apps is disabled for this deployment" });
     }
@@ -24679,6 +25452,7 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
     const parsed = z9.object({ expectedVersion: z9.number().int().nonnegative() }).safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
@@ -24703,7 +25477,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -24722,7 +25497,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const body4 = await c.req.json().catch(() => ({}));
     const patch = {};
     if (typeof body4.rotationEnabled === "boolean") {
@@ -24759,7 +25535,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const body4 = await c.req.json();
     const label = typeof body4.label === "string" ? body4.label : null;
@@ -24776,7 +25553,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/codex/accounts/:accountId/allocator", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const parsed = z9.object({
       enabled: z9.boolean(),
       expectedVersion: z9.number().int().positive()
@@ -24809,7 +25587,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
@@ -24830,7 +25609,8 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant4(c, deps, workspaceId, "connections:write");
+    await requireWorkspaceCodexManagementSource(deps, workspaceId);
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
@@ -24913,7 +25693,7 @@ function registerCodexRoutes(app, deps) {
     const grant = await requireAccessGrant4(c, deps, workspaceId, "workspace:read");
     const human = await managedCookieHuman(c, deps);
     const accounts = await listCodexAccountStatuses(db, workspaceId);
-    const ownerRecoveries = human && human.subjectId === grant.subjectId && hasPermission11(grant.permissions, "workspace:admin") ? await listCodexResetRedemptionRecoveries(db, {
+    const ownerRecoveries = human && human.subjectId === grant.subjectId && hasPermission11(grant.permissions, "connections:write") ? await listCodexResetRedemptionRecoveries(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: human.subjectId
@@ -24928,14 +25708,17 @@ function registerCodexRoutes(app, deps) {
         const account = queue.shift();
         if (!account) return;
         const canResumeRedemption = Boolean(
-          human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission11(grant.permissions, "workspace:admin")
+          account.source === "workspace" && human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission11(grant.permissions, "connections:write")
         );
         const canRedeem = canResumeRedemption && account.status === "active";
-        const redemptionAccess = codexRedemptionAccess({
+        const redemptionAccess = account.source === "organization" ? {
+          ownership: "managed_human_unavailable",
+          canClaimUnownedViaReconnect: false
+        } : codexRedemptionAccess({
           connectedBySubjectId: account.connectedBySubjectId,
           grantSubjectId: grant.subjectId,
           managedHumanSubjectId: human?.subjectId ?? null,
-          canManage: hasPermission11(grant.permissions, "workspace:admin")
+          canManage: hasPermission11(grant.permissions, "connections:write")
         });
         overview[account.id] = await fetchCodexAccountOverview(
           deps,
@@ -24971,17 +25754,20 @@ function registerCodexRoutes(app, deps) {
       await Promise.all(
         accounts.filter((account) => overview[account.id] == null).map(async (account) => {
           const canResumeRedemption = Boolean(
-            human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission11(grant.permissions, "workspace:admin")
+            account.source === "workspace" && human && human.subjectId === grant.subjectId && human.subjectId === account.connectedBySubjectId && hasPermission11(grant.permissions, "connections:write")
           );
           const fallback = await fetchCodexAccountOverview(
             deps,
             workspaceId,
             account,
-            codexRedemptionAccess({
+            account.source === "organization" ? {
+              ownership: "managed_human_unavailable",
+              canClaimUnownedViaReconnect: false
+            } : codexRedemptionAccess({
               connectedBySubjectId: account.connectedBySubjectId,
               grantSubjectId: grant.subjectId,
               managedHumanSubjectId: human?.subjectId ?? null,
-              canManage: hasPermission11(grant.permissions, "workspace:admin")
+              canManage: hasPermission11(grant.permissions, "connections:write")
             }),
             false,
             canResumeRedemption,
@@ -25012,6 +25798,11 @@ function registerCodexRoutes(app, deps) {
       const accounts = await listCodexAccountStatuses(db, workspaceId);
       const account = accounts.find((candidate) => candidate.id === credentialId);
       if (!account) throw new HTTPException21(404, { message: "codex account not found" });
+      if (account.source === "organization") {
+        throw new HTTPException21(409, {
+          message: "organization Codex subscriptions are managed in Organization settings"
+        });
+      }
       let existing = await getCodexResetRedemptionAttempt(db, workspaceId, parsed.data.attemptId);
       if (account.connectedBySubjectId !== human.subjectId) {
         throw new HTTPException21(403, {
@@ -26259,7 +27050,8 @@ import {
   getConnectionMetadata as getConnectionMetadata5,
   getWorkspaceGrant as getWorkspaceGrant6,
   loadConnectionCredentialForBroker as loadConnectionCredentialForBroker4,
-  persistProviderOAuthConnection
+  persistProviderOAuthConnection,
+  resolveNamedManagedPersonalWorkspaceGrant as resolveNamedManagedPersonalWorkspaceGrant2
 } from "@opengeni/db";
 import { createSignedState as createSignedState9, readSignedState as readSignedState8 } from "@opengeni/github";
 import {
@@ -26742,7 +27534,8 @@ async function providerFetch3(deps, url, init) {
   }
 }
 async function requireProviderOAuthGrant(deps, state) {
-  const grant = await getWorkspaceGrant6(deps.db, state.subjectId, state.workspaceId);
+  const membershipGrant = await getWorkspaceGrant6(deps.db, state.subjectId, state.workspaceId);
+  const grant = membershipGrant?.accountId === state.accountId ? membershipGrant : state.personalOwnerVerified ? await resolveNamedManagedPersonalWorkspaceGrant2(deps.db, state) : null;
   if (!grant || grant.accountId !== state.accountId || !hasPermission12(grant.permissions, "connections:write")) {
     throw new ProviderOAuthCallbackError("connection_conflict");
   }
@@ -28477,7 +29270,7 @@ import {
   requireAccessGrant as requireAccessGrant7,
   requireAccountAdminAuthorizationStamp,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization2,
-  saveWorkspaceMemoryWithSlackPublication
+  saveWorkspaceMemoryWithSlackPublication as saveWorkspaceMemoryWithSlackPublication2
 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage4, requireLimit as requireLimit4 } from "@opengeni/core";
 
@@ -29605,7 +30398,7 @@ function registerDocumentRoutes(app, deps) {
     }
     if (payload.status === "active") {
       try {
-        const result = await saveWorkspaceMemoryWithSlackPublication(
+        const result = await saveWorkspaceMemoryWithSlackPublication2(
           db,
           {
             accountId: grant.accountId,
@@ -30472,6 +31265,7 @@ import {
   readMachineMetricsLatestForWorkspace
 } from "@opengeni/db";
 import { MachineView, MetricSample } from "@opengeni/contracts";
+import { managedSessionGroupBackend as managedSessionGroupBackend3 } from "@opengeni/core";
 import { selfhostedHeartbeatLiveness } from "@opengeni/runtime/sandbox";
 var ACTIVE_UPDATE_STATUSES = /* @__PURE__ */ new Set([
   "requested",
@@ -30603,7 +31397,8 @@ async function listMachines(services, input) {
     }
   }
   const machines = [];
-  if (session && session.sandboxBackend !== "none") {
+  const groupBackend = session ? managedSessionGroupBackend3(services.settings.sandboxBackend, session.sandboxBackend) : null;
+  if (session && groupBackend) {
     const groupActive = activeSandboxId === null;
     const groupLease = await readLease3(db, workspaceId, session.sandboxGroupId);
     machines.push(
@@ -30611,7 +31406,7 @@ async function listMachines(services, input) {
         sandboxId: session.sandboxGroupId,
         enrollmentId: null,
         name: "session sandbox",
-        kind: session.sandboxBackend === "selfhosted" ? "selfhosted" : "modal",
+        kind: groupBackend === "opensandbox" ? "opensandbox" : "modal",
         state: "online",
         active: groupActive,
         isSessionGroup: true,
@@ -31568,12 +32363,37 @@ function trimmedVariableSetName(name) {
 }
 
 // src/routes/api-keys.ts
-import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
-import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
+import {
+  CreateApiKeyRequest,
+  CreateApiKeyResponse,
+  CreateOrganizationApiKeyRequest
+} from "@opengeni/contracts";
+import {
+  createApiKey,
+  createOrganizationApiKey as createOrganizationApiKeyRecord,
+  listApiKeys,
+  listOrganizationApiKeys,
+  OrganizationApiKeyLimitExceededError,
+  revokeApiKey,
+  revokeOrganizationApiKey
+} from "@opengeni/db";
+import { configuredStaticUsageLimits } from "@opengeni/config";
 import { zValidator } from "@hono/zod-validator";
 import { HTTPException as HTTPException31 } from "hono/http-exception";
-import { requireAccessGrant as requireAccessGrant12 } from "@opengeni/core";
+import {
+  accountScopedApiKeyWorkspaceAuthority,
+  requireAccessContext,
+  requireAccessGrant as requireAccessGrant12,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization6
+} from "@opengeni/core";
 import { requireLimit as requireLimit5 } from "@opengeni/core";
+var organizationApiKeyPermissions = [
+  "account:read",
+  "workspace:create",
+  "workspace:read",
+  "workspace:admin",
+  "api_keys:manage"
+];
 function registerApiKeyRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/api-keys", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -31585,10 +32405,16 @@ function registerApiKeyRoutes(app, deps) {
     zValidator("json", CreateApiKeyRequest.omit({ workspaceId: true })),
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant12(c, deps, workspaceId, "api_keys:manage");
+      const authorization = await requireAccessGrantAuthorization6(
+        c,
+        deps,
+        workspaceId,
+        "api_keys:manage"
+      );
+      const grant = authorization.grant;
       const body4 = c.req.valid("json");
       const permissions = body4.permissions.length > 0 ? body4.permissions : ["workspace:read"];
-      ensureDelegablePermissions(grant.permissions, permissions);
+      ensureDelegablePermissions(authorization, permissions);
       await requireLimit5(deps, {
         accountId: grant.accountId,
         workspaceId,
@@ -31615,11 +32441,72 @@ function registerApiKeyRoutes(app, deps) {
     await requireAccessGrant12(c, deps, workspaceId, "api_keys:manage");
     return c.json(await revokeApiKey(deps.db, workspaceId, c.req.param("apiKeyId")));
   });
+  app.get("/v1/organizations/:organizationId/api-keys", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId2);
+    return c.json({ apiKeys: await listOrganizationApiKeys(deps.db, organizationId2) });
+  });
+  app.post(
+    "/v1/organizations/:organizationId/api-keys",
+    zValidator("json", CreateOrganizationApiKeyRequest),
+    async (c) => {
+      const organizationId2 = c.req.param("organizationId");
+      const context = await requireAccessContext(c, deps);
+      requireOrganizationApiKeyControlPermission(context, organizationId2);
+      const body4 = c.req.valid("json");
+      const token = generateApiKeyToken();
+      try {
+        const apiKey = await createOrganizationApiKeyRecord(deps.db, {
+          accountId: organizationId2,
+          name: body4.name,
+          description: body4.description ?? null,
+          prefix: token.slice(0, 14),
+          keyHash: await sha256Hex2(token),
+          permissions: organizationApiKeyPermissions,
+          expiresAt: body4.expiresAt ? new Date(body4.expiresAt) : null,
+          maxActiveKeys: organizationApiKeyLimit(deps),
+          rotationSourceApiKeyId: authenticatedApiKeyId(context)
+        });
+        return c.json(CreateApiKeyResponse.parse({ apiKey, token }), 201);
+      } catch (error) {
+        if (error instanceof OrganizationApiKeyLimitExceededError) {
+          throw new HTTPException31(429, { message: error.message });
+        }
+        throw error;
+      }
+    }
+  );
+  app.delete("/v1/organizations/:organizationId/api-keys/:apiKeyId", async (c) => {
+    const organizationId2 = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId2);
+    const apiKey = await revokeOrganizationApiKey(deps.db, organizationId2, c.req.param("apiKeyId"));
+    if (!apiKey) {
+      throw new HTTPException31(404, { message: "API key not found" });
+    }
+    return c.json(apiKey);
+  });
 }
-function ensureDelegablePermissions(grantPermissions, requested) {
+function requireAccountPermission(context, accountId, permission) {
+  const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
+  if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
+    throw new HTTPException31(403, { message: `missing permission: ${permission}` });
+  }
+}
+function ensureDelegablePermissions(authorization, requested) {
+  const grantPermissions = authorization.grant.permissions;
   if (grantPermissions.includes("workspace:admin")) {
+    const accountLiteralPermissions = /* @__PURE__ */ new Set([
+      "account:read",
+      "account:admin",
+      "workspace:create",
+      "billing:read",
+      "billing:manage"
+    ]);
+    const workspaceLiteralPermissions = /* @__PURE__ */ new Set(["members:manage", "secrets:read"]);
     const highTrustMissing = requested.filter(
-      (permission) => permission === "secrets:read" && !grantPermissions.includes("secrets:read")
+      (permission) => accountLiteralPermissions.has(permission) && !authorization.accountGrant?.permissions.includes(permission) || workspaceLiteralPermissions.has(permission) && !grantPermissions.includes(permission)
     );
     if (highTrustMissing.length === 0) return;
     throw new HTTPException31(403, {
@@ -31633,6 +32520,23 @@ function ensureDelegablePermissions(grantPermissions, requested) {
     });
   }
 }
+function requireOrganizationApiKeyControlPermission(context, organizationId2) {
+  requireAccountPermission(context, organizationId2, "api_keys:manage");
+  if (!context.subjectId.startsWith("api_key:")) return;
+  const authority = accountScopedApiKeyWorkspaceAuthority(context);
+  if (!authority || authority.accountId !== organizationId2 || !authority.permissions.includes("api_keys:manage")) {
+    throw new HTTPException31(403, { message: "organization API key authority required" });
+  }
+}
+function authenticatedApiKeyId(context) {
+  return context.subjectId.startsWith("api_key:") ? context.subjectId.slice("api_key:".length) : null;
+}
+function organizationApiKeyLimit(deps) {
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  return configuredStaticUsageLimits(deps.settings).maxApiKeysPerWorkspace ?? null;
+}
 function generateApiKeyToken() {
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);
@@ -31666,10 +32570,10 @@ import {
 } from "@opengeni/db";
 import { HTTPException as HTTPException32 } from "hono/http-exception";
 import Stripe from "stripe";
-import { requireAccessContext } from "@opengeni/core";
+import { requireAccessContext as requireAccessContext2 } from "@opengeni/core";
 function registerBillingRoutes(app, deps) {
   app.get("/v1/billing", async (c) => {
-    const context = await requireAccessContext(c, deps);
+    const context = await requireAccessContext2(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     return c.json({
       mode: deps.settings.billingMode,
@@ -31677,7 +32581,7 @@ function registerBillingRoutes(app, deps) {
     });
   });
   app.get("/v1/billing/usage", async (c) => {
-    const context = await requireAccessContext(c, deps);
+    const context = await requireAccessContext2(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     const workspaceId = c.req.query("workspaceId");
     if (workspaceId && !context.workspaceGrants.some(
@@ -31695,7 +32599,7 @@ function registerBillingRoutes(app, deps) {
     });
   });
   app.get("/v1/billing/entitlements", async (c) => {
-    const context = await requireAccessContext(c, deps);
+    const context = await requireAccessContext2(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     return c.json({
       accountId,
@@ -31707,7 +32611,7 @@ function registerBillingRoutes(app, deps) {
     if (deps.settings.billingMode !== "stripe") {
       throw new HTTPException32(404, { message: "stripe billing is not enabled" });
     }
-    const context = await requireAccessContext(c, deps);
+    const context = await requireAccessContext2(c, deps);
     const parsed = CreateCheckoutRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException32(400, {
@@ -31749,7 +32653,7 @@ function registerBillingRoutes(app, deps) {
     if (deps.settings.billingMode !== "stripe") {
       throw new HTTPException32(404, { message: "stripe billing is not enabled" });
     }
-    const context = await requireAccessContext(c, deps);
+    const context = await requireAccessContext2(c, deps);
     const parsed = CreateBillingPortalRequest.safeParse(await c.req.json());
     if (!parsed.success) {
       throw new HTTPException32(400, {
@@ -33176,7 +34080,7 @@ function safeControlRequestId(value) {
 
 // src/interaction-frame-proxy.ts
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHmac as createHmac7, randomBytes as randomBytes8 } from "crypto";
-import { canonicalPublicOrigin } from "@opengeni/config";
+import { canonicalPublicOrigin as canonicalPublicOrigin2 } from "@opengeni/config";
 import { WebSocket as UpstreamWebSocket } from "ws";
 var INTERACTION_FRAME_PROXY_PATH = "/v1/interaction/frame-proxy";
 var INTERACTION_FRAME_PROXY_PROTOCOL_PREFIX = "opengeni-frame-proxy.";
@@ -33196,7 +34100,7 @@ function placementUsesInteractionFrameProxy(backend, options) {
   return options?.openSandboxSignedEndpoints !== true;
 }
 function resolveInteractionFrameProxyRequestUrl(input) {
-  const publicOrigin = canonicalPublicOrigin(input.publicBaseUrl) ?? (input.webBaseUrl?.startsWith("https://") ? canonicalPublicOrigin(input.webBaseUrl) : null);
+  const publicOrigin = canonicalPublicOrigin2(input.publicBaseUrl) ?? (input.webBaseUrl?.startsWith("https://") ? canonicalPublicOrigin2(input.webBaseUrl) : null);
   if (publicOrigin) return `${publicOrigin}/`;
   const request = new URL(input.requestUrl);
   const forwardedProto = firstForwardedValue(input.forwardedProto)?.toLowerCase();
@@ -33497,6 +34401,13 @@ var STALE_INTERACTION_ERROR_CODES = /* @__PURE__ */ new Set([
   "frame_stale",
   "attempt_stale"
 ]);
+var COMPUTER_FRAME_EVIDENCE_MISMATCH_REASONS = /* @__PURE__ */ new Set([
+  "frame_session_mismatch",
+  "frame_target_mismatch",
+  "frame_controller_mismatch",
+  "frame_media_mismatch",
+  "frame_digest_mismatch"
+]);
 function observeBrowserActionResult(observability, startedAtMs, request, receipt) {
   interactionOperationMetricObserver(observability)({
     resource: "browser",
@@ -33515,6 +34426,21 @@ function observeComputerActionResult(observability, startedAtMs, request, receip
     durationMs: elapsedMs(startedAtMs)
   });
 }
+function observeComputerFrameEvidenceMismatch(observability, reason2) {
+  if (!observability || !COMPUTER_FRAME_EVIDENCE_MISMATCH_REASONS.has(reason2)) return;
+  try {
+    observability.incrementCounter({
+      name: "opengeni_computer_frame_evidence_mismatches_total",
+      help: "Computer frame evidence rejected at the controller-to-API boundary by bounded reason.",
+      labels: { reason: reason2 }
+    });
+  } catch {
+  }
+  try {
+    observability.warn("Computer frame evidence mismatch", { reason: reason2 });
+  } catch {
+  }
+}
 function observeLifecycleResult(observability, startedAtMs, response) {
   interactionOperationMetricObserver(observability)({
     resource: response.operation.resourceKind === "browser_session" ? "browser" : "computer",
@@ -36476,14 +37402,19 @@ function assertCreateReplay(request, session) {
   }
 }
 async function ensureHeadedBrowserDisplayStack(session, headless, linkedComputer) {
-  if (!browserNeedsStandaloneDisplayStack({ headless, linkedComputer })) return;
+  if (!browserNeedsStandaloneDisplayStack({
+    headless,
+    linkedComputer,
+    nativeBrowserControl: typeof session.ensureBrowserControl === "function"
+  }))
+    return;
   if (typeof session.exec !== "function" && typeof session.execCommand !== "function") return;
   await ensureDisplayStack2(session, {
     telemetryContext: { callerKind: "viewer" }
   });
 }
 function browserNeedsStandaloneDisplayStack(input) {
-  return !input.headless && !input.linkedComputer;
+  return !input.headless && !input.linkedComputer && !input.nativeBrowserControl;
 }
 async function ensureLinkedComputerController(deps, grant, browser, placement, client) {
   if (!browser.linkedComputerSessionId) return null;
@@ -37477,6 +38408,7 @@ import {
   BrowserControlServerUnsupportedError as BrowserControlServerUnsupportedError2,
   BrowserControlTransportError as BrowserControlTransportError4,
   BrowserControlUnsupportedError as BrowserControlUnsupportedError2,
+  ComputerFrameEvidenceMismatchError,
   buildSelfhostedBackendSession as buildSelfhostedBackendSession3,
   buildStreamUrl as buildStreamUrl2,
   exposedPortEndpointFromUrl as exposedPortEndpointFromUrl3,
@@ -37484,6 +38416,7 @@ import {
   NatsControlRpc as NatsControlRpc5,
   NatsOpStreamTransport as NatsOpStreamTransport3,
   provisionBrowserControlClient as provisionBrowserControlClient2,
+  validateComputerControlFrameEvidence,
   renewSandboxProviderExpiration as renewSandboxProviderExpiration3
 } from "@opengeni/runtime/sandbox";
 import { HTTPException as HTTPException36 } from "hono/http-exception";
@@ -37507,6 +38440,38 @@ function connectedMachineComputerAccessError(state, requiresControl) {
 }
 
 // src/routes/computer-sessions.ts
+var MODEL_COMPUTER_FRAME_MAX_BYTES = 256 * 1024;
+function validateComputerFrameForApi(frame, expected) {
+  return validateComputerControlFrameEvidence(frame, expected);
+}
+async function captureModelComputerFrame(sessionClient, expected) {
+  let captured = validateComputerFrameForApi(
+    await sessionClient.capture(expected.targetId, {
+      format: "jpeg",
+      quality: 55,
+      maxWidth: 1024,
+      maxHeight: 768
+    }),
+    expected
+  );
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    captured = validateComputerFrameForApi(
+      await sessionClient.capture(expected.targetId, {
+        format: "jpeg",
+        quality: 30,
+        maxWidth: 640,
+        maxHeight: 480
+      }),
+      expected
+    );
+  }
+  if (captured.data.byteLength > MODEL_COMPUTER_FRAME_MAX_BYTES) {
+    throw new BrowserControlProtocolError2(
+      "computer screenshot could not honor the model image byte bound"
+    );
+  }
+  return captured;
+}
 function registerComputerSessionRoutes(app, deps) {
   const channelServices = {
     db: deps.db,
@@ -37754,6 +38719,46 @@ function registerComputerSessionRoutes(app, deps) {
       return context.json(result);
     }
   );
+  app.get(
+    "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, computerSessionId } = await routePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam2(context, "targetId");
+      const frame = await withActiveComputerController(
+        context,
+        grant,
+        workspaceId,
+        computerSessionId,
+        "session.read",
+        "computer.read",
+        async ({ sessionClient, binding }) => {
+          try {
+            return await captureModelComputerFrame(sessionClient, {
+              computerSessionId,
+              controllerGeneration: binding.controllerGeneration,
+              targetId
+            });
+          } catch (error) {
+            if (error instanceof ComputerFrameEvidenceMismatchError) {
+              observeComputerFrameEvidenceMismatch(deps.observability, error.reason);
+            }
+            throw error;
+          }
+        }
+      );
+      return new Response(frame.data.slice().buffer, {
+        status: 200,
+        headers: {
+          "cache-control": "no-store",
+          "content-type": frame.mediaType,
+          "x-opengeni-computer-frame": frame.metadataHeader
+        }
+      });
+    }
+  );
   app.get(
     "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/clipboard",
     async (context) => {
@@ -39614,7 +40619,7 @@ import {
 } from "@opengeni/contracts/personal-github";
 import {
   requireAccessGrant as requireAccessGrant17,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization6
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization7
 } from "@opengeni/core";
 import {
   getPersonalGitHubRepositorySelectionState as getPersonalGitHubRepositorySelectionState2,
@@ -39982,7 +40987,7 @@ function registerPersonalGitHubRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/connections/github/oauth/start", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization6(c, deps, workspaceId, "connections:write");
+    const access = await requireAccessGrantAuthorization7(c, deps, workspaceId, "connections:write");
     assertPersonalConnectionOwnerPrincipal(access, "My GitHub account");
     const payload = PersonalGitHubOAuthStartRequest.parse(await c.req.json().catch(() => ({})));
     return c.json(
@@ -39996,7 +41001,7 @@ function registerPersonalGitHubRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/connections/:connectionId/github/reconnect", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization6(c, deps, workspaceId, "connections:write");
+    const access = await requireAccessGrantAuthorization7(c, deps, workspaceId, "connections:write");
     assertPersonalConnectionOwnerPrincipal(access, "My GitHub account");
     const payload = PersonalGitHubOAuthStartRequest.omit({ connectionId: true }).parse(
       await c.req.json().catch(() => ({}))
@@ -40015,7 +41020,7 @@ function registerPersonalGitHubRoutes(app, deps) {
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const connectionId = c.req.param("connectionId");
-      const access = await requireAccessGrantAuthorization6(
+      const access = await requireAccessGrantAuthorization7(
         c,
         deps,
         workspaceId,
@@ -40066,7 +41071,7 @@ function registerPersonalGitHubRoutes(app, deps) {
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const connectionId = c.req.param("connectionId");
-      const access = await requireAccessGrantAuthorization6(
+      const access = await requireAccessGrantAuthorization7(
         c,
         deps,
         workspaceId,
@@ -40113,7 +41118,7 @@ function registerPersonalGitHubRoutes(app, deps) {
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const connectionId = c.req.param("connectionId");
-      const access = await requireAccessGrantAuthorization6(
+      const access = await requireAccessGrantAuthorization7(
         c,
         deps,
         workspaceId,
@@ -41132,7 +42137,7 @@ function registerApiIntegrationRoutes(app, deps, overrides = {}) {
   });
   app.post("/v1/workspaces/:workspaceId/integrations/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant18(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant18(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallApiIntegrationRequest.parse(await c.req.json());
     const resolved = await resolveForRoute({
       deps,
@@ -41227,7 +42232,7 @@ function registerApiIntegrationRoutes(app, deps, overrides = {}) {
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant18(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant18(c, deps, workspaceId, "capabilities:manage");
       const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
       const instanceKey = decodeURIComponent(c.req.param("instanceKey"));
       const payload = UninstallApiIntegrationRequest.parse(await c.req.json());
@@ -41353,7 +42358,7 @@ import {
 import {
   hasPermission as hasPermission16,
   requireAccessGrant as requireAccessGrant19,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization7
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization8
 } from "@opengeni/core";
 import {
   configureIntegrationFacet as configureIntegrationFacet2,
@@ -41398,11 +42403,11 @@ function registerIntegrationFacetRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/source",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const authorization = await requireAccessGrantAuthorization7(
+      const authorization = await requireAccessGrantAuthorization8(
         c,
         deps,
         workspaceId,
-        "workspace:admin"
+        "capabilities:manage"
       );
       const { grant } = authorization;
       try {
@@ -41417,7 +42422,10 @@ function registerIntegrationFacetRoutes(app, deps) {
               facetKey: decoded(c.req.param("facetKey")),
               payload: await c.req.json(),
               canManageOrganizationDestination: authorization.accountGrant?.permissions.includes("account:admin") === true,
-              canManageWorkspaceDestination: hasPermission16(grant.permissions, "workspace:admin"),
+              canManageWorkspaceDestination: hasPermission16(
+                grant.permissions,
+                "capabilities:manage"
+              ),
               canManagePersonalDestination: authorization.contextIntegrity && authorization.authenticatedSubjectId === grant.subjectId
             })
           )
@@ -41453,7 +42461,7 @@ function registerIntegrationFacetRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant19(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant19(c, deps, workspaceId, "capabilities:manage");
       const payload = UpsertIntegrationFacetRequest.parse(await c.req.json());
       const capabilityId = decoded(c.req.param("capabilityId"));
       const instanceKey = decoded(c.req.param("instanceKey"));
@@ -41525,7 +42533,7 @@ function registerIntegrationFacetRoutes(app, deps) {
       `/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey/${action}`,
       async (c) => {
         const workspaceId = c.req.param("workspaceId");
-        const grant = await requireAccessGrant19(c, deps, workspaceId, "workspace:admin");
+        const grant = await requireAccessGrant19(c, deps, workspaceId, "capabilities:manage");
         const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
         try {
           return c.json(
@@ -41553,7 +42561,7 @@ function registerIntegrationFacetRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey/facets/:facetKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant19(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant19(c, deps, workspaceId, "capabilities:manage");
       const payload = MutateIntegrationFacetRequest.parse(await c.req.json());
       try {
         return c.json(
@@ -41676,6 +42684,8 @@ var WORKSPACE_CONTROL_REPLAY_PAGE_SIZE = 100;
 var SSE_QUEUED_FRAME_MAX_COUNT = 1;
 var SSE_WRITE_STALL_TIMEOUT_MS = 3e4;
 var SSE_HEARTBEAT_INTERVAL_MS = 15e3;
+var HTTP1_BROWSER_SSE_BATCH_MAX_BYTES = 512 * 1024;
+var HTTP1_BROWSER_SSE_BATCH_CONTENT_TYPE = "application/vnd.opengeni.sse-batch";
 var activeSseStreams = {
   session: 0,
   workspace_control: 0,
@@ -41684,16 +42694,21 @@ var activeSseStreams = {
 function createByteBoundedSseStream(options = {}) {
   const maxQueuedBytes = options.maxQueuedBytes ?? SESSION_EVENT_SSE_FRAME_MAX_BYTES;
   const stallTimeoutMs = options.stallTimeoutMs ?? SSE_WRITE_STALL_TIMEOUT_MS;
+  const connectionLifetimeMs = options.connectionLifetimeMs;
   if (!Number.isSafeInteger(maxQueuedBytes) || maxQueuedBytes <= 0) {
     throw new RangeError("SSE byte high-water mark must be a positive safe integer");
   }
   if (!Number.isSafeInteger(stallTimeoutMs) || stallTimeoutMs <= 0) {
     throw new RangeError("SSE write stall timeout must be a positive safe integer");
   }
+  if (connectionLifetimeMs !== void 0 && (!Number.isSafeInteger(connectionLifetimeMs) || connectionLifetimeMs <= 0)) {
+    throw new RangeError("SSE connection lifetime must be a positive safe integer");
+  }
   const encoder4 = new TextEncoder();
   let controller;
   let stopped = false;
   let capacityWake = null;
+  let lifetimeTimer = null;
   let queuedFrames = 0;
   let queuedBytes = 0;
   const wakeWriter = () => {
@@ -41704,6 +42719,10 @@ function createByteBoundedSseStream(options = {}) {
   const stop = (settle) => {
     if (stopped) return;
     stopped = true;
+    if (lifetimeTimer !== null) {
+      clearTimeout(lifetimeTimer);
+      lifetimeTimer = null;
+    }
     wakeWriter();
     options.onStop?.();
     try {
@@ -41733,6 +42752,9 @@ function createByteBoundedSseStream(options = {}) {
       size: () => 1
     }
   );
+  if (connectionLifetimeMs !== void 0) {
+    lifetimeTimer = setTimeout(() => stop(() => controller.close()), connectionLifetimeMs);
+  }
   return {
     stream,
     write: async (frame) => {
@@ -41845,6 +42867,17 @@ function createLatestWinsDelivery(send, onError) {
   };
 }
 async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal, options = {}) {
+  if (isHttp1BrowserBatch(options)) {
+    const events = await listSessionEvents(db, workspaceId, sessionId, {
+      after,
+      limit: SESSION_REPLAY_PAGE_SIZE
+    });
+    await options.reauthorize?.();
+    return finiteSseBatchResponse(
+      coalesceSessionEventDeltas(events).map(formatSessionEventSse),
+      options
+    );
+  }
   const durableFanout = requireSessionEventDurableFanoutCapability(bus);
   const heartbeatIntervalMs = resolveHeartbeatInterval(options.heartbeatIntervalMs);
   let lastSent = after;
@@ -41878,6 +42911,7 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
     release?.();
   };
   const channel = createByteBoundedSseStream({
+    connectionLifetimeMs: options.connectionLifetimeMs,
     maxQueuedBytes: options.maxQueuedBytes ?? SESSION_EVENT_SSE_FRAME_MAX_BYTES,
     ...options.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: options.stallTimeoutMs },
     onObservation: sseObservationReporter("session", options),
@@ -41887,11 +42921,11 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
   const fail = (error) => {
     channel.fail(retryableSseFailure("session event stream delivery failed", error));
   };
-  stopReauthorization = startSseReauthorization(options, channel.stopped, fail);
+  stopReauthorization = startSseReauthorization(options, channel.stopped, channel.close);
   let writeTail = Promise.resolve();
   const writeFrame = (frame) => {
     const write = writeTail.then(async () => {
-      await options.reauthorize?.();
+      await reauthorizeSseOrClose(options, channel);
       if (!await channel.write(frame)) throw new SseStreamStoppedError();
     });
     writeTail = write.catch(() => {
@@ -42010,14 +43044,7 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
     signal.addEventListener("abort", abort, { once: true });
     detachAbortListener = () => signal.removeEventListener("abort", abort);
   }
-  return new Response(channel.stream, {
-    headers: {
-      "Content-Type": "text/event-stream; charset=utf-8",
-      "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive",
-      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
-    }
-  });
+  return await sseHttpResponse(channel.stream, options);
 }
 async function replaySessionEvents(loadPage, send, after, pageSize = SESSION_REPLAY_PAGE_SIZE) {
   let cursor = after;
@@ -42043,6 +43070,19 @@ async function replaySessionEvents(loadPage, send, after, pageSize = SESSION_REP
   }
 }
 async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal, options = {}) {
+  if (isHttp1BrowserBatch(options)) {
+    const events = await listWorkspaceControlEvents(
+      db,
+      workspaceId,
+      after,
+      WORKSPACE_CONTROL_REPLAY_PAGE_SIZE
+    );
+    await options.reauthorize?.();
+    return finiteSseBatchResponse(
+      events.sort((left, right) => left.sequence - right.sequence).map(formatWorkspaceControlEventSse),
+      options
+    );
+  }
   const heartbeatIntervalMs = resolveHeartbeatInterval(options.heartbeatIntervalMs);
   let lastSent = after;
   let bootstrapping = true;
@@ -42070,6 +43110,7 @@ async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal, op
     release?.();
   };
   const channel = createByteBoundedSseStream({
+    connectionLifetimeMs: options.connectionLifetimeMs,
     maxQueuedBytes: options.maxQueuedBytes ?? SESSION_EVENT_SSE_FRAME_MAX_BYTES,
     ...options.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: options.stallTimeoutMs },
     onObservation: sseObservationReporter("workspace_control", options),
@@ -42079,11 +43120,11 @@ async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal, op
   const fail = (error) => {
     channel.fail(retryableSseFailure("workspace control stream delivery failed", error));
   };
-  stopReauthorization = startSseReauthorization(options, channel.stopped, fail);
+  stopReauthorization = startSseReauthorization(options, channel.stopped, channel.close);
   let writeTail = Promise.resolve();
   const writeFrame = (frame) => {
     const write = writeTail.then(async () => {
-      await options.reauthorize?.();
+      await reauthorizeSseOrClose(options, channel);
       if (!await channel.write(frame)) throw new SseStreamStoppedError();
     });
     writeTail = write.catch(() => {
@@ -42168,20 +43209,39 @@ async function sseWorkspaceControlStream(db, bus, workspaceId, after, signal, op
     signal.addEventListener("abort", abort, { once: true });
     detachAbortListener = () => signal.removeEventListener("abort", abort);
   }
-  return new Response(channel.stream, {
-    headers: {
-      "Content-Type": "text/event-stream; charset=utf-8",
-      "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive",
-      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
-    }
-  });
+  return await sseHttpResponse(channel.stream, options);
 }
 async function sseWorkspaceLiveStream(db, bus, accountId, workspaceId, controlAfter, interactionAfter, signal, options = {}) {
+  if (isHttp1BrowserBatch(options)) {
+    const [controlEvents, interactionState] = await Promise.all([
+      listWorkspaceControlEvents(db, workspaceId, controlAfter, WORKSPACE_CONTROL_REPLAY_PAGE_SIZE),
+      getWorkspaceInteractionRevisionState(db, { accountId, workspaceId })
+    ]);
+    await options.reauthorize?.();
+    const frames = [];
+    if (interactionState.revision > interactionAfter) {
+      frames.push(
+        formatWorkspaceInteractionRevisionSse(
+          WorkspaceInteractionRevisionEvent.parse({
+            workspaceId,
+            sequence: interactionState.revision,
+            revision: interactionState.revision,
+            type: "workspace.interaction.changed",
+            occurredAt: (interactionState.updatedAt ?? /* @__PURE__ */ new Date()).toISOString()
+          })
+        )
+      );
+    }
+    frames.push(
+      ...controlEvents.sort((left, right) => left.sequence - right.sequence).map(formatWorkspaceControlEventSse)
+    );
+    return finiteSseBatchResponse(frames, options);
+  }
   const upstream = new AbortController();
   let stopReauthorization = () => {
   };
   const channel = createByteBoundedSseStream({
+    connectionLifetimeMs: options.connectionLifetimeMs,
     maxQueuedBytes: options.maxQueuedBytes ?? SESSION_EVENT_SSE_FRAME_MAX_BYTES,
     ...options.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: options.stallTimeoutMs },
     onObservation: sseObservationReporter("workspace_interaction", options),
@@ -42197,18 +43257,19 @@ async function sseWorkspaceLiveStream(db, bus, accountId, workspaceId, controlAf
   };
   if (signal.aborted) abort();
   else signal.addEventListener("abort", abort, { once: true });
-  stopReauthorization = startSseReauthorization(options, channel.stopped, (error) => {
-    channel.fail(retryableSseFailure("workspace live stream authorization failed", error));
-  });
+  stopReauthorization = startSseReauthorization(options, channel.stopped, channel.close);
   const upstreamOptions = {
     ...options,
+    connectionLifetimeMs: void 0,
+    finiteResponseMaxBytes: void 0,
+    finiteResponseMediaType: void 0,
     reauthorize: void 0,
     reauthorizeAfterMs: void 0
   };
   let writeTail = Promise.resolve(true);
   const write = (frame) => {
     const pending = writeTail.then(async () => {
-      await options.reauthorize?.();
+      await reauthorizeSseOrClose(options, channel);
       return await channel.write(frame);
     });
     writeTail = pending.catch(() => false);
@@ -42269,16 +43330,28 @@ async function sseWorkspaceLiveStream(db, bus, accountId, workspaceId, controlAf
       if (!upstream.signal.aborted && !channel.stopped()) channel.fail(error);
     }
   })();
-  return new Response(channel.stream, {
-    headers: {
-      "Content-Type": "text/event-stream; charset=utf-8",
-      "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive",
-      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
-    }
-  });
+  return await sseHttpResponse(channel.stream, options);
 }
 async function sseWorkspaceInteractionRevisionStream(db, accountId, workspaceId, after, signal, options = {}) {
+  if (isHttp1BrowserBatch(options)) {
+    const state = await getWorkspaceInteractionRevisionState(db, {
+      accountId,
+      workspaceId
+    });
+    await options.reauthorize?.();
+    const frames = state.revision > after ? [
+      formatWorkspaceInteractionRevisionSse(
+        WorkspaceInteractionRevisionEvent.parse({
+          workspaceId,
+          sequence: state.revision,
+          revision: state.revision,
+          type: "workspace.interaction.changed",
+          occurredAt: (state.updatedAt ?? /* @__PURE__ */ new Date()).toISOString()
+        })
+      )
+    ] : [];
+    return finiteSseBatchResponse(frames, options);
+  }
   const heartbeatIntervalMs = resolveHeartbeatInterval(options.heartbeatIntervalMs);
   const pollIntervalMs = resolveInteractionPollInterval(options.pollIntervalMs);
   let lastSent = after;
@@ -42291,6 +43364,7 @@ async function sseWorkspaceInteractionRevisionStream(db, accountId, workspaceId,
   let closeMetrics = () => {
   };
   const channel = createByteBoundedSseStream({
+    connectionLifetimeMs: options.connectionLifetimeMs,
     maxQueuedBytes: options.maxQueuedBytes ?? SESSION_EVENT_SSE_FRAME_MAX_BYTES,
     ...options.stallTimeoutMs === void 0 ? {} : { stallTimeoutMs: options.stallTimeoutMs },
     onObservation: sseObservationReporter("workspace_interaction", options),
@@ -42302,11 +43376,9 @@ async function sseWorkspaceInteractionRevisionStream(db, accountId, workspaceId,
     }
   });
   closeMetrics = observeSseConnection("workspace_interaction", after, options.observability);
-  stopReauthorization = startSseReauthorization(options, channel.stopped, (error) => {
-    channel.fail(retryableSseFailure("workspace interaction stream authorization failed", error));
-  });
+  stopReauthorization = startSseReauthorization(options, channel.stopped, channel.close);
   const write = async (frame) => {
-    await options.reauthorize?.();
+    await reauthorizeSseOrClose(options, channel);
     const accepted = await channel.write(frame);
     if (accepted) lastWriteAt = Date.now();
     return accepted;
@@ -42316,7 +43388,10 @@ async function sseWorkspaceInteractionRevisionStream(db, accountId, workspaceId,
       if (!await write(": connected\n\n")) return;
       for (; ; ) {
         if (stopRequested || signal.aborted || channel.stopped()) return;
-        const state = await getWorkspaceInteractionRevisionState(db, { accountId, workspaceId });
+        const state = await getWorkspaceInteractionRevisionState(db, {
+          accountId,
+          workspaceId
+        });
         if (state.revision > lastSent) {
           const event = WorkspaceInteractionRevisionEvent.parse({
             workspaceId,
@@ -42344,14 +43419,7 @@ async function sseWorkspaceInteractionRevisionStream(db, accountId, workspaceId,
     signal.addEventListener("abort", abort, { once: true });
     detachAbortListener = () => signal.removeEventListener("abort", abort);
   }
-  return new Response(channel.stream, {
-    headers: {
-      "Content-Type": "text/event-stream; charset=utf-8",
-      "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive",
-      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
-    }
-  });
+  return await sseHttpResponse(channel.stream, options);
 }
 function observeSseConnection(stream, after, observability) {
   activeSseStreams[stream] += 1;
@@ -42400,6 +43468,117 @@ async function replayWorkspaceControlEvents(loadPage, send, after, pageSize) {
 }
 var SseStreamStoppedError = class extends Error {
 };
+async function reauthorizeSseOrClose(options, channel) {
+  try {
+    await options.reauthorize?.();
+  } catch {
+    channel.close();
+    throw new SseStreamStoppedError();
+  }
+}
+function browserSseDeliveryOptions(transport) {
+  return transport === "http1-bounded" ? {
+    finiteResponseMaxBytes: HTTP1_BROWSER_SSE_BATCH_MAX_BYTES,
+    finiteResponseMediaType: "http1-browser-batch"
+  } : {};
+}
+async function sseHttpResponse(stream, options) {
+  const maxBytes = options.finiteResponseMaxBytes;
+  let body4 = stream;
+  let contentLength = null;
+  if (maxBytes !== void 0) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < SESSION_EVENT_SSE_FRAME_MAX_BYTES || maxBytes > HTTP1_BROWSER_SSE_BATCH_MAX_BYTES) {
+      throw new RangeError(
+        `finite SSE batch limit must be between ${SESSION_EVENT_SSE_FRAME_MAX_BYTES} and ${HTTP1_BROWSER_SSE_BATCH_MAX_BYTES} bytes`
+      );
+    }
+    body4 = await collectFiniteSseBatch(stream, maxBytes);
+    contentLength = body4.byteLength;
+  }
+  return new Response(body4, {
+    headers: {
+      // A bounded HTTP/1 poll carries the same SSE-framed bytes the SDK
+      // already parses, but it is an ordinary finite response at the browser
+      // transport boundary. Keeping `text/event-stream` here lets Chromium
+      // retain an orphaned fetch in its shared per-origin SSE pool after the
+      // initiating document is replaced, starving unrelated finite reads in
+      // every tab. HTTP/2 and other unbounded streams keep the standard media
+      // type; only the explicit `http1-bounded` fallback uses this vendor type.
+      "Content-Type": contentLength !== null && options.finiteResponseMediaType === "http1-browser-batch" ? `${HTTP1_BROWSER_SSE_BATCH_CONTENT_TYPE}; charset=utf-8` : "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      // A known-length response is already terminal and leaves the HTTP/1
+      // socket reusable. Only a genuinely live SSE response needs an explicit
+      // close when its stream ends.
+      ...contentLength === null ? { Connection: "close" } : { "Content-Length": String(contentLength) },
+      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
+    }
+  });
+}
+function isHttp1BrowserBatch(options) {
+  return options.finiteResponseMediaType === "http1-browser-batch" && options.finiteResponseMaxBytes !== void 0;
+}
+function finiteSseBatchResponse(frames, options) {
+  const maxBytes = options.finiteResponseMaxBytes;
+  if (maxBytes === void 0 || !Number.isSafeInteger(maxBytes) || maxBytes < SESSION_EVENT_SSE_FRAME_MAX_BYTES || maxBytes > HTTP1_BROWSER_SSE_BATCH_MAX_BYTES) {
+    throw new RangeError(
+      `finite SSE batch limit must be between ${SESSION_EVENT_SSE_FRAME_MAX_BYTES} and ${HTTP1_BROWSER_SSE_BATCH_MAX_BYTES} bytes`
+    );
+  }
+  const encoder4 = new TextEncoder();
+  const chunks = [];
+  let length = 0;
+  for (const frame of frames) {
+    const chunk = encoder4.encode(frame);
+    if (chunk.byteLength > maxBytes) {
+      throw new RangeError(
+        `SSE frame cannot fit in the finite browser batch (${chunk.byteLength} > ${maxBytes} bytes)`
+      );
+    }
+    if (length + chunk.byteLength > maxBytes) break;
+    chunks.push(chunk);
+    length += chunk.byteLength;
+  }
+  const body4 = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body4.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Response(body4, {
+    headers: {
+      "Content-Type": `${HTTP1_BROWSER_SSE_BATCH_CONTENT_TYPE}; charset=utf-8`,
+      "Cache-Control": "no-cache, no-transform",
+      "Content-Length": String(body4.byteLength),
+      ...options.actorEpoch ? { [MANAGED_AUTH_ACTOR_EPOCH_HEADER]: options.actorEpoch } : {}
+    }
+  });
+}
+async function collectFiniteSseBatch(stream, maxBytes) {
+  const reader = stream.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      if (length + next.value.byteLength > maxBytes) {
+        await reader.cancel("finite SSE batch reached its byte limit");
+        break;
+      }
+      chunks.push(next.value);
+      length += next.value.byteLength;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes.buffer;
+}
 function sseObservationReporter(stream, options) {
   return (observation) => {
     options.onObservation?.(observation);
@@ -42492,6 +43671,7 @@ function registerInteractionResourceRoutes(app, deps) {
       nonnegativeSafeIntegerQuery(context, "interactionAfter", 0),
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? void 0,
         reauthorize: async () => {
@@ -42516,6 +43696,7 @@ function registerInteractionResourceRoutes(app, deps) {
       after,
       context.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(context.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch(context.req.raw) ?? void 0,
         reauthorize: async () => {
@@ -43002,7 +44183,7 @@ import {
   getPackInstallation as getPackInstallation2,
   listPrReviewAppRegistrations as listPrReviewAppRegistrations2,
   listPrReviewRepositoryBindings as listPrReviewRepositoryBindings2,
-  nestedPostgresSqlState as nestedPostgresSqlState2,
+  nestedPostgresSqlState as nestedPostgresSqlState3,
   recordAuditEvent as recordAuditEvent9,
   updatePrReviewAppRegistration,
   updatePrReviewRepositoryBinding
@@ -43220,7 +44401,7 @@ import {
   getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
-  nestedPostgresSqlState,
+  nestedPostgresSqlState as nestedPostgresSqlState2,
   PrReviewDispatchAuthorityError,
   recordAuditEvent as recordAuditEvent8,
   resolveManagedGitHubPrReviewRoute,
@@ -44071,7 +45252,7 @@ function registerPrReviewGitHubRoutes(app, deps) {
       if (error instanceof PrReviewDispatchAuthorityError) {
         throw new HTTPException44(409, { message: error.message });
       }
-      if (nestedPostgresSqlState(error) === "23505") {
+      if (nestedPostgresSqlState2(error) === "23505") {
         throw new HTTPException44(409, {
           message: "One of these repositories is already connected to OpenGeni Lens in another workspace"
         });
@@ -44777,7 +45958,7 @@ async function mapPrReviewUniqueConflict(operation, message) {
   try {
     return await operation;
   } catch (error) {
-    if (nestedPostgresSqlState2(error) === "23505") {
+    if (nestedPostgresSqlState3(error) === "23505") {
       throw new HTTPException45(409, { message });
     }
     throw error;
@@ -44869,7 +46050,7 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "capabilities:manage");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
       throw new HTTPException46(409, {
@@ -44885,7 +46066,7 @@ function registerPackRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/packs/:packId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant24(c, deps, workspaceId, "capabilities:manage");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
       throw new HTTPException46(409, {
@@ -44945,7 +46126,7 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs/:packId/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     const payload = InstallPackRequest.parse(await c.req.json());
     const preview = PackInstallationPreview.parse(
@@ -45154,7 +46335,7 @@ function registerPackRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/packs/:packId/installation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     const payload = UninstallPackRequest.parse(await c.req.json());
     const requestDigest = sha2562(
@@ -45240,7 +46421,7 @@ function registerPackRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/packs/:packId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "capabilities:manage");
     const pack = await requirePack(db, workspaceId, c.req.param("packId"));
     if (capabilityPackRequiresInstallationPlan(pack)) {
       throw new HTTPException46(409, {
@@ -45640,7 +46821,7 @@ function registerPluginRoutes(app, deps, overrides = {}) {
   });
   app.post("/v1/workspaces/:workspaceId/plugins/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant25(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant25(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallPluginRequest.parse(await c.req.json());
     const resolved = await resolvePluginPackage({
       deps,
@@ -45766,7 +46947,7 @@ function registerPluginRoutes(app, deps, overrides = {}) {
   });
   app.delete("/v1/workspaces/:workspaceId/plugins/:pluginKey", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant25(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant25(c, deps, workspaceId, "capabilities:manage");
     const pluginKey = decodeURIComponent(c.req.param("pluginKey"));
     const payload = UninstallPluginRequest.parse(await c.req.json());
     try {
@@ -46222,7 +47403,7 @@ function registerSkillRoutes(app, deps, overrides = {}) {
   });
   app.post("/v1/workspaces/:workspaceId/skills/library/:libraryId/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant26(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant26(c, deps, workspaceId, "capabilities:manage");
     const libraryId = decodeURIComponent(c.req.param("libraryId"));
     const payload = InstallLibrarySkillRequest.parse(await c.req.json());
     let loaded;
@@ -46298,7 +47479,7 @@ function registerSkillRoutes(app, deps, overrides = {}) {
   });
   app.post("/v1/workspaces/:workspaceId/skills/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant26(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant26(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallSkillRequest.parse(await c.req.json());
     const resolved = await resolveForRoute2(payload.url, github);
     if (resolved.preview.sourceCommit !== payload.expectedSourceCommit || resolved.preview.contentSha256 !== payload.expectedContentSha256) {
@@ -46358,7 +47539,7 @@ function registerSkillRoutes(app, deps, overrides = {}) {
   });
   app.delete("/v1/workspaces/:workspaceId/skills/:capabilityId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant26(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant26(c, deps, workspaceId, "capabilities:manage");
     const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
     const payload = UninstallSkillRequest.parse(await c.req.json());
     try {
@@ -46512,7 +47693,7 @@ import {
 import { HTTPException as HTTPException50 } from "hono/http-exception";
 import {
   requireAccessGrant as requireAccessGrant28,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization8,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization9,
   requirePermission as requirePermission7
 } from "@opengeni/core";
 import {
@@ -46553,7 +47734,7 @@ async function parseRigRequest(c, schema, label) {
 function registerRigRoutes(app, deps) {
   const { db, workflowClient } = deps;
   async function requireRigMutation(c, workspaceId, permission) {
-    const authorization = await requireAccessGrantAuthorization8(c, deps, workspaceId, permission);
+    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId, permission);
     const rigId = c.req.param("rigId");
     if (!rigId) {
       throw new HTTPException50(400, { message: "rig id is required" });
@@ -46631,7 +47812,7 @@ function registerRigRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/rigs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization8(c, deps, workspaceId);
+    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission7(grant, "rigs:manage");
     const payload = await parseRigRequest(c, CreateRigRequest, "Rig create request");
@@ -46657,7 +47838,7 @@ function registerRigRoutes(app, deps) {
   });
   app.patch("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization8(c, deps, workspaceId);
+    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission7(grant, "rigs:manage");
     const rig = await requireRigForApi2(db, grant, c.req.param("rigId"));
@@ -46672,7 +47853,7 @@ function registerRigRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/rigs/:rigId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization8(c, deps, workspaceId);
+    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission7(grant, "rigs:manage");
     const rig = await requireRigForApi2(db, grant, c.req.param("rigId"));
@@ -46795,6 +47976,7 @@ import {
   syncCreatedScheduledTask as syncCreatedScheduledTask5,
   syncUpdatedScheduledTask as syncUpdatedScheduledTask4,
   updateScheduledTaskForApi as updateScheduledTaskForApi2,
+  validateScheduledTaskMachineTarget as validateScheduledTaskMachineTarget2,
   validateScheduledTaskTarget as validateScheduledTaskTarget2,
   validatedScheduledTaskUpdate as validatedScheduledTaskUpdate2
 } from "@opengeni/core";
@@ -46918,6 +48100,14 @@ function registerScheduledTaskRoutes(app, deps) {
         agentConfig: task.agentConfig,
         missingTargetStatus: 404
       });
+      await validateScheduledTaskMachineTarget2({
+        settings,
+        db,
+        grant,
+        runMode: task.runMode,
+        agentConfig: task.agentConfig,
+        requireOnline: true
+      });
       await requireLimit8(deps, {
         accountId: grant.accountId,
         workspaceId,
@@ -47095,7 +48285,7 @@ import {
   recordStreamAcknowledgment,
   requestSessionCompaction,
   setSessionCodexPinInTransaction,
-  withSessionCodexCapacityMutation,
+  withSessionCodexCapacityMutation as withSessionCodexCapacityMutation2,
   setSessionChannel,
   updateSessionVariableSets,
   ChannelNotFoundError,
@@ -47148,7 +48338,7 @@ import {
   requestSessionBackgroundCommandCancellation
 } from "@opengeni/db/session-background-commands";
 import {
-  appendAndPublishEvents as appendAndPublishEvents3,
+  appendAndPublishEvents as appendAndPublishEvents4,
   boundSessionEventHttpPage,
   coalesceSessionEventDeltas as coalesceSessionEventDeltas2,
   publishDurableSessionEvents as publishDurableSessionEvents3
@@ -47901,7 +49091,7 @@ import {
   getManagedAuthRequestActorEpoch as getManagedAuthRequestActorEpoch2,
   hasPermission as hasPermission18,
   requireAccessGrant as requireAccessGrant30,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization9,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization10,
   requireFreshAccessGrant as requireFreshAccessGrant2,
   requirePermission as requirePermission8,
   requireSessionAuthorization as requireSessionAuthorization7,
@@ -48250,7 +49440,7 @@ function registerSessionRoutes(app, deps) {
       exitCode: process.exitCode,
       reason: process.state === "exited" ? "exit" : "lost"
     };
-    await appendAndPublishEvents3(db, bus, ctx.workspaceId, ctx.session.id, [
+    await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, [
       { type: "terminal.pty.exited", payload: exited }
     ]);
   };
@@ -48331,7 +49521,7 @@ function registerSessionRoutes(app, deps) {
   };
   app.get("/v1/workspaces/:workspaceId/session-tenancy/capabilities", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -48341,7 +49531,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -48375,7 +49565,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/new-session-draft", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -48429,7 +49619,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/sessions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -48685,7 +49875,7 @@ function registerSessionRoutes(app, deps) {
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/visibility", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const sessionId = c.req.param("sessionId");
-    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId);
+    const authorization = await requireAccessGrantAuthorization10(c, deps, workspaceId);
     const parsed = UpdateSessionVisibilityRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
       throw new ApiHttpError(422, {
@@ -48713,7 +49903,7 @@ function registerSessionRoutes(app, deps) {
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/forks", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const sessionId = c.req.param("sessionId");
-    const authorization = await requireAccessGrantAuthorization9(c, deps, workspaceId);
+    const authorization = await requireAccessGrantAuthorization10(c, deps, workspaceId);
     const parsed = ForkSessionRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
       throw new ApiHttpError(422, {
@@ -49356,7 +50546,7 @@ function registerSessionRoutes(app, deps) {
   );
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/pin", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -49409,7 +50599,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/attention", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -49459,7 +50649,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/sessions/:sessionId/archive", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -49541,7 +50731,7 @@ function registerSessionRoutes(app, deps) {
       }
     }
     const pinned = target === "auto" ? null : target;
-    const mutation = await withSessionCodexCapacityMutation(
+    const mutation = await withSessionCodexCapacityMutation2(
       db,
       { workspaceId, reason: "codex_manual_session_pin_changed" },
       async (tx) => {
@@ -50121,7 +51311,7 @@ function registerSessionRoutes(app, deps) {
       }
       throw error;
     });
-    await appendAndPublishEvents3(db, bus, workspaceId, sessionId, [
+    await appendAndPublishEvents4(db, bus, workspaceId, sessionId, [
       {
         type: "session.context.cleared",
         payload: {
@@ -50319,6 +51509,7 @@ function registerSessionRoutes(app, deps) {
       Number.isFinite(after) ? after : 0,
       c.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(c.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch2(c.req.raw) ?? void 0,
         reauthorizeAfterMs: authorization?.reauthorizeAfterMs ?? SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
@@ -50533,7 +51724,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/steer", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -50565,7 +51756,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/composer-draft/submit", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -50587,7 +51778,7 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/events", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization9(
+    const authorization = await requireAccessGrantAuthorization10(
       c,
       deps,
       workspaceId,
@@ -50780,12 +51971,8 @@ function registerSessionRoutes(app, deps) {
       // Human take-control: when the desktop is available + this policy is on
       // (default), the cell is mode "interactive" — the noVNC viewer drives :0
       // (x11vnc runs without -viewonly). Off → mode "read-only" (client disables
-      // take-control). Independent of the agent's computerUseReadOnly.
+      // take-control). Agent interaction uses managed ComputerSession tools.
       desktopInteractive: settings.sandboxDesktopInteractive,
-      // P4.3 computer-use: the agent drives the active display; availability
-      // tracks the desktop tier + a desktop-capable backend.
-      computerUseEnabled: settings.computerUseEnabled,
-      computerUseReadOnly: settings.computerUseReadOnly,
       // Graceful degrade when scoped stream credentials cannot be minted.
       streamTokenSecretAvailable: !streamTokenDegraded(settings),
       desktopAcknowledged: acknowledged,
@@ -51465,7 +52652,7 @@ function registerSessionRoutes(app, deps) {
         };
         events.push({ type: "terminal.pty.output.delta", payload: delta });
       }
-      await appendAndPublishEvents3(db, bus, ctx.workspaceId, ctx.session.id, events);
+      await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, events);
       return opened.response;
     });
     return c.json(out, 201);
@@ -51526,7 +52713,7 @@ function registerSessionRoutes(app, deps) {
           chunk: output,
           seq: seq++
         };
-        await appendAndPublishEvents3(db, bus, ctx.workspaceId, ctx.session.id, [
+        await appendAndPublishEvents4(db, bus, ctx.workspaceId, ctx.session.id, [
           { type: "terminal.pty.output.delta", payload: delta }
         ]);
       }
@@ -52302,7 +53489,7 @@ import {
 } from "@opengeni/db";
 import { HTTPException as HTTPException54 } from "hono/http-exception";
 import { z as z14 } from "zod";
-import { requireAccessGrant as requireAccessGrant31, requireAccessGrantAuthorization as requireAccessGrantAuthorization10 } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant31, requireAccessGrantAuthorization as requireAccessGrantAuthorization11 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
   const { db, settings, observability } = deps;
   app.get("/v1/workspaces/:workspaceId/social/connections", async (c) => {
@@ -52372,7 +53559,7 @@ function registerSocialRoutes(app, deps) {
       });
     }
     const payload = parsed.data;
-    const access = await requireAccessGrantAuthorization10(
+    const access = await requireAccessGrantAuthorization11(
       c,
       deps,
       workspaceId,
@@ -52490,6 +53677,9 @@ function socialHttpException(error) {
 import {
   AddWorkspaceMemberRequest,
   CreateWorkspaceRequest,
+  EnsureWorkspaceRequest,
+  EnsureWorkspaceResponse,
+  ListWorkspaceMemberCandidatesResponse,
   ListWorkspaceMembersResponse,
   SetWorkspaceDefaultRigRequest,
   UpdateWorkspaceMemberRequest,
@@ -52508,45 +53698,134 @@ import {
   allWorkspacePermissions,
   createWorkspace,
   deleteWorkspaceIfQuiescent,
-  getManagedUserByEmail,
+  ensureWorkspaceByExternalIdentity,
+  findWorkspaceByExternalIdentity,
+  getManagedUserProfilesByIds,
   getWorkspaceModelPolicy,
   grantWorkspaceAccess,
   listWorkspaceMembers,
+  listWorkspaceMemberManagementCandidates,
   normalizeWorkspaceMembershipPermissions,
   listWorkspaceControlEvents as listWorkspaceControlEvents2,
+  listSharedWorkspacesForAccount,
   listWorkspacesForSubject,
+  nestedPostgresSqlState as nestedPostgresSqlState4,
   removeWorkspaceMember,
   requireWorkspace,
   getRig,
   setWorkspaceDefaultRig,
   updateWorkspace,
   updateWorkspaceSettings,
+  upsertWorkspaceMemberAsWorkspaceManager,
   upsertWorkspaceModelPolicy,
   workspaceCodexSubscriptionActive,
   workspaceControlRequestLockTimeoutMs as workspaceControlRequestLockTimeoutMs2,
   workspaceXaiSubscriptionActive,
-  workspaceVercelAiGatewayConnectionActive
+  workspaceVercelAiGatewayConnectionActive,
+  WorkspaceExternalIdentityConflictError,
+  WorkspaceLimitExceededError
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import { HTTPException as HTTPException55 } from "hono/http-exception";
 import {
   getManagedAuthRequestActorEpoch as getManagedAuthRequestActorEpoch3,
+  accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority2,
   hasPermission as hasPermission19,
-  requireAccessContext as requireAccessContext2,
+  requireAccessContext as requireAccessContext3,
   requireAccessGrant as requireAccessGrant32,
   requireFreshAccessGrant as requireFreshAccessGrant3
 } from "@opengeni/core";
 import { requireLimit as requireLimit9 } from "@opengeni/core";
 import {
   assertWorkspaceMemberRemovable,
-  controlHumanWorkspace,
-  resolveMemberSubjectId
+  assertWorkspaceMemberUpdateAllowed,
+  controlHumanWorkspace
 } from "@opengeni/core";
+
+// src/workspace-delete-observability.ts
+var DURATION_BUCKETS2 = [
+  5e-3,
+  0.01,
+  0.025,
+  0.05,
+  0.1,
+  0.25,
+  0.5,
+  1,
+  2.5,
+  5,
+  10,
+  30,
+  60,
+  120,
+  300,
+  600,
+  1200,
+  2400,
+  3600
+];
+var INVENTORY_BUCKETS = [0, 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1e3, 5e3, 1e4];
+function recordWorkspaceDeleteObservation(observability, identity, observation) {
+  const labels = { phase: observation.phase, outcome: observation.outcome };
+  observability.observeHistogram({
+    name: "opengeni_workspace_delete_phase_seconds",
+    help: "Workspace deletion transaction and bounded internal phase duration in seconds.",
+    labels,
+    buckets: DURATION_BUCKETS2,
+    value: Math.max(0, observation.durationSeconds)
+  });
+  if (observation.phase === "transaction") {
+    observability.incrementCounter({
+      name: "opengeni_workspace_delete_attempts_total",
+      help: "Workspace deletion attempts by terminal database outcome.",
+      labels: { outcome: observation.outcome }
+    });
+  }
+  for (const [kind, count] of Object.entries(observation.inventory ?? {})) {
+    observability.observeHistogram({
+      name: "opengeni_workspace_delete_inventory_rows",
+      help: "Rows or live owners observed by workspace deletion preflight inventory class.",
+      labels: { kind },
+      buckets: INVENTORY_BUCKETS,
+      value: Math.max(0, Math.floor(count ?? 0))
+    });
+  }
+  observability.info("Workspace deletion phase", {
+    accountId: identity.accountId,
+    workspaceId: identity.workspaceId,
+    phase: observation.phase,
+    outcome: observation.outcome,
+    durationSeconds: observation.durationSeconds,
+    inventoryJson: JSON.stringify(observation.inventory ?? {})
+  });
+}
+function workspaceDeleteObserver(observability, identity) {
+  if (!observability) return void 0;
+  return {
+    onPhase: (observation) => {
+      try {
+        recordWorkspaceDeleteObservation(observability, identity, observation);
+      } catch {
+        try {
+          observability.incrementCounter({
+            name: "opengeni_observability_observer_errors_total",
+            help: "Observability observer failures isolated from product execution.",
+            labels: { observer: "workspace_delete" }
+          });
+        } catch {
+        }
+      }
+    }
+  };
+}
+
+// src/routes/workspaces.ts
 import {
   AI_GATEWAY_REALTIME_MODELS,
   CODEX_REALTIME_MODEL_ID,
   SUPERGROK_REALTIME_MODEL_ID as SUPERGROK_REALTIME_MODEL_ID2,
-  canonicalizeConfiguredModelId
+  canonicalizeConfiguredModelId,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2
 } from "@opengeni/config";
 function canonicalWorkspacePolicyModelIds(settings, modelIds) {
   if (modelIds === null || modelIds === void 0) {
@@ -52567,10 +53846,18 @@ function workspaceUpdateRequestsAccountTransfer(value) {
 }
 function registerWorkspaceRoutes(app, deps) {
   app.get("/v1/access/me", async (c) => {
-    return c.json(await requireAccessContext2(c, deps));
+    return c.json(await requireAccessContext3(c, deps));
   });
   app.get("/v1/workspaces", async (c) => {
-    const context = await requireAccessContext2(c, deps);
+    const context = await requireAccessContext3(c, deps);
+    const accountScopedAuthority = accountScopedApiKeyWorkspaceAuthority2(context);
+    if (accountScopedAuthority && hasPermission19(accountScopedAuthority.permissions, "workspace:read")) {
+      return c.json(
+        (await listSharedWorkspacesForAccount(deps.db, accountScopedAuthority.accountId)).map(
+          (workspace) => Workspace.parse(workspace)
+        )
+      );
+    }
     const readableWorkspaceIds = [
       ...new Set(
         context.workspaceGrants.filter((grant) => hasPermission19(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
@@ -52588,32 +53875,96 @@ function registerWorkspaceRoutes(app, deps) {
       )
     );
   });
+  app.put("/v1/workspaces/external", async (c) => {
+    const context = await requireAccessContext3(c, deps);
+    const payload = EnsureWorkspaceRequest.parse(await c.req.json());
+    requireAccountPermission2(context, payload.accountId, "workspace:create");
+    try {
+      const existing = await findWorkspaceByExternalIdentity(deps.db, {
+        externalSource: payload.externalSource,
+        externalId: payload.externalId
+      });
+      if (existing) {
+        if (existing.accountId !== payload.accountId || existing.kind !== "shared") {
+          throw new WorkspaceExternalIdentityConflictError();
+        }
+        return c.json(
+          EnsureWorkspaceResponse.parse({
+            workspace: existing,
+            created: false
+          })
+        );
+      }
+      await requireLimit9(deps, {
+        accountId: payload.accountId,
+        action: "workspace:create",
+        quantity: 1
+      });
+      const result = await ensureWorkspaceByExternalIdentity(deps.db, {
+        accountId: payload.accountId,
+        externalSource: payload.externalSource,
+        externalId: payload.externalId,
+        name: payload.name,
+        slug: payload.slug ?? null,
+        ...payload.agentInstructions !== void 0 ? { agentInstructions: normalizeAgentInstructions(payload.agentInstructions) } : {},
+        maxWorkspacesPerAccount: workspaceLimit(deps)
+      });
+      const response = EnsureWorkspaceResponse.parse(result);
+      return result.created ? c.json(response, 201) : c.json(response);
+    } catch (error) {
+      if (error instanceof WorkspaceExternalIdentityConflictError) {
+        throw new HTTPException55(409, {
+          message: "external workspace identity is already in use"
+        });
+      }
+      if (error instanceof WorkspaceLimitExceededError) {
+        throw new HTTPException55(429, { message: error.message });
+      }
+      throw error;
+    }
+  });
   app.post("/v1/workspaces", async (c) => {
-    const context = await requireAccessContext2(c, deps);
+    const context = await requireAccessContext3(c, deps);
     const payload = CreateWorkspaceRequest.parse(await c.req.json());
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
-      throw new HTTPException55(409, { message: "account selection is required" });
+      throw new HTTPException55(409, {
+        message: "account selection is required"
+      });
     }
-    requireAccountPermission(context, accountId, "workspace:create");
-    await requireLimit9(deps, { accountId, action: "workspace:create", quantity: 1 });
-    const workspace = await createWorkspace(deps.db, {
-      accountId,
-      name: payload.name.trim(),
-      slug: payload.slug?.trim() || null,
-      externalSource: payload.externalSource ?? null,
-      externalId: payload.externalId ?? null,
-      ...payload.agentInstructions !== void 0 ? { agentInstructions: normalizeAgentInstructions(payload.agentInstructions) } : {}
-    });
-    await grantWorkspaceAccess(deps.db, {
+    requireAccountPermission2(context, accountId, "workspace:create");
+    await requireLimit9(deps, {
       accountId,
-      workspaceId: workspace.id,
-      subjectId: context.subjectId,
-      role: "owner",
-      permissions: allWorkspacePermissions,
-      ...context.subjectLabel ? { subjectLabel: context.subjectLabel } : {}
+      action: "workspace:create",
+      quantity: 1
     });
-    return c.json(Workspace.parse(workspace), 201);
+    try {
+      const workspace = await createWorkspace(deps.db, {
+        accountId,
+        name: payload.name.trim(),
+        slug: payload.slug?.trim() || null,
+        externalSource: payload.externalSource ?? null,
+        externalId: payload.externalId ?? null,
+        ...payload.agentInstructions !== void 0 ? {
+          agentInstructions: normalizeAgentInstructions(payload.agentInstructions)
+        } : {},
+        maxWorkspacesPerAccount: workspaceLimit(deps)
+      });
+      await grantWorkspaceAccess(deps.db, {
+        accountId,
+        workspaceId: workspace.id,
+        subjectId: context.subjectId,
+        role: "owner",
+        permissions: allWorkspacePermissions,
+        ...context.subjectLabel ? { subjectLabel: context.subjectLabel } : {}
+      });
+      return c.json(Workspace.parse(workspace), 201);
+    } catch (error) {
+      if (error instanceof WorkspaceLimitExceededError) {
+        throw new HTTPException55(429, { message: error.message });
+      }
+      throw error;
+    }
   });
   app.get("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -52637,7 +53988,9 @@ function registerWorkspaceRoutes(app, deps) {
     const workspace = await updateWorkspace(deps.db, workspaceId, {
       ...payload.name !== void 0 ? { name: payload.name.trim() } : {},
       ...payload.slug !== void 0 ? { slug: payload.slug?.trim() || null } : {},
-      ...payload.agentInstructions !== void 0 ? { agentInstructions: normalizeAgentInstructions(payload.agentInstructions) } : {}
+      ...payload.agentInstructions !== void 0 ? {
+        agentInstructions: normalizeAgentInstructions(payload.agentInstructions)
+      } : {}
     });
     return c.json(Workspace.parse(workspace));
   });
@@ -52646,7 +53999,9 @@ function registerWorkspaceRoutes(app, deps) {
     await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException55(400, { message: "invalid workspace settings patch" });
+      throw new HTTPException55(400, {
+        message: "invalid workspace settings patch"
+      });
     }
     const workspace = await updateWorkspaceSettings(deps.db, workspaceId, parsed.data, {
       controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs2()
@@ -52757,11 +54112,15 @@ function registerWorkspaceRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
     if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
-      throw new HTTPException55(400, { message: "workspace-control actor is too large" });
+      throw new HTTPException55(400, {
+        message: "workspace-control actor is too large"
+      });
     }
     const parsed = WorkspaceInferenceControlRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException55(400, { message: "invalid workspace inference-control request" });
+      throw new HTTPException55(400, {
+        message: "invalid workspace inference-control request"
+      });
     }
     return c.json(
       await controlHumanWorkspace(
@@ -52803,6 +54162,7 @@ function registerWorkspaceRoutes(app, deps) {
       after,
       c.req.raw.signal,
       {
+        ...browserSseDeliveryOptions(c.req.query("transport")),
         observability: deps.observability,
         actorEpoch: getManagedAuthRequestActorEpoch3(c.req.raw) ?? void 0,
         reauthorize: async () => {
@@ -52818,7 +54178,9 @@ function registerWorkspaceRoutes(app, deps) {
     if (payload.rigId) {
       const rig = await getRig(deps.db, workspaceId, payload.rigId);
       if (!rig) {
-        throw new HTTPException55(422, { message: `unknown rigId: ${payload.rigId}` });
+        throw new HTTPException55(422, {
+          message: `unknown rigId: ${payload.rigId}`
+        });
       }
     }
     const workspace = await setWorkspaceDefaultRig(deps.db, workspaceId, payload.rigId);
@@ -52827,15 +54189,22 @@ function registerWorkspaceRoutes(app, deps) {
   app.delete("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant32(c, deps, workspaceId, "workspace:admin");
-    const deleted = await deleteWorkspaceIfQuiescent(deps.db, {
+    const deleteObserver = workspaceDeleteObserver(deps.observability, {
       accountId: grant.accountId,
       workspaceId
     });
+    const deleted = await deleteWorkspaceIfQuiescent(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      ...deleteObserver ? { observer: deleteObserver } : {}
+    });
     if (deleted.status === "not_found") {
       throw new HTTPException55(404, { message: "workspace not found" });
     }
     if (deleted.status === "only_workspace") {
-      throw new HTTPException55(409, { message: "cannot delete the account's only workspace" });
+      throw new HTTPException55(409, {
+        message: "cannot delete the account's only workspace"
+      });
     }
     if (deleted.status === "active_sessions") {
       throw new HTTPException55(409, {
@@ -52864,7 +54233,9 @@ function registerWorkspaceRoutes(app, deps) {
       {
         db: deps.db,
         deleteSchedule: async (temporalScheduleId) => {
-          await deps.workflowClient.deleteScheduledTaskSchedule({ temporalScheduleId });
+          await deps.workflowClient.deleteScheduledTaskSchedule({
+            temporalScheduleId
+          });
         },
         ...deps.observability ? { observability: deps.observability } : {}
       },
@@ -52875,25 +54246,71 @@ function registerWorkspaceRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant32(c, deps, workspaceId, "workspace:read");
-    const members = await listWorkspaceMembers(deps.db, workspaceId);
+    const members = await listWorkspacePeople(deps, workspaceId);
     return c.json(workspaceMembersResponse(members));
   });
+  app.get("/v1/workspaces/:workspaceId/member-candidates", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant32(c, deps, workspaceId, "members:manage");
+    try {
+      return c.json(
+        ListWorkspaceMemberCandidatesResponse.parse({
+          members: await listWorkspaceMemberManagementCandidates(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            actorSubjectId: grant.subjectId
+          })
+        })
+      );
+    } catch (error) {
+      rethrowWorkspaceMemberCandidateError(error);
+    }
+  });
   app.post("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant32(c, deps, workspaceId, "members:manage");
     const payload = AddWorkspaceMemberRequest.parse(await c.req.json());
-    const email = payload.email.trim();
-    const subjectId = resolveMemberSubjectId(await getManagedUserByEmail(deps.db, email));
-    await grantWorkspaceAccess(deps.db, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId,
-      subjectLabel: email,
-      ...payload.role !== void 0 ? { role: payload.role } : {},
-      permissions: payload.permissions
-    });
-    const members = await listWorkspaceMembers(deps.db, workspaceId);
-    const member = members.find((candidate) => candidate.subjectId === subjectId);
+    let candidates;
+    try {
+      candidates = await listWorkspaceMemberManagementCandidates(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        actorSubjectId: grant.subjectId
+      });
+    } catch (error) {
+      rethrowWorkspaceMemberCandidateError(error);
+    }
+    const candidate = candidates.find(
+      (entry2) => entry2.organizationMembershipId === payload.organizationMembershipId
+    );
+    if (!candidate) {
+      throw new HTTPException55(404, {
+        message: "this organization member is not available to add"
+      });
+    }
+    const subjectId = candidate.subjectId;
+    const existing = await listWorkspaceMembers(deps.db, workspaceId);
+    if (existing.some((member2) => member2.subjectId === subjectId)) {
+      throw new HTTPException55(409, {
+        message: "this person already has access to the workspace"
+      });
+    }
+    try {
+      await upsertWorkspaceMemberAsWorkspaceManager(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        actorSubjectId: grant.subjectId,
+        targetSubjectId: subjectId,
+        mode: "add",
+        subjectLabel: candidate.name?.trim() || candidate.email || subjectId,
+        role: payload.role ?? "member",
+        permissions: payload.permissions
+      });
+    } catch (error) {
+      rethrowWorkspaceMemberCandidateError(error);
+    }
+    const members = await listWorkspacePeople(deps, workspaceId);
+    const member = members.find((addedMember) => addedMember.subjectId === subjectId);
     if (!member) {
       throw new HTTPException55(500, { message: "failed to add member" });
     }
@@ -52904,20 +54321,32 @@ function registerWorkspaceRoutes(app, deps) {
     const grant = await requireAccessGrant32(c, deps, workspaceId, "members:manage");
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const payload = UpdateWorkspaceMemberRequest.parse(await c.req.json());
-    const existing = await listWorkspaceMembers(deps.db, workspaceId);
+    const existing = await listWorkspacePeople(deps, workspaceId);
     const current = existing.find((member2) => member2.subjectId === subjectId);
     if (!current) {
       throw new HTTPException55(404, { message: "member not found" });
     }
-    await grantWorkspaceAccess(deps.db, {
-      accountId: grant.accountId,
-      workspaceId,
+    assertWorkspaceMemberUpdateAllowed({
+      members: existing,
       subjectId,
-      ...current.subjectLabel ? { subjectLabel: current.subjectLabel } : {},
-      role: payload.role ?? current.role,
-      permissions: payload.permissions
+      callerSubjectId: grant.subjectId,
+      nextPermissions: payload.permissions
     });
-    const members = await listWorkspaceMembers(deps.db, workspaceId);
+    try {
+      await upsertWorkspaceMemberAsWorkspaceManager(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        actorSubjectId: grant.subjectId,
+        targetSubjectId: subjectId,
+        mode: "update",
+        ...current.subjectLabel ? { subjectLabel: current.subjectLabel } : {},
+        role: payload.role ?? current.role,
+        permissions: payload.permissions
+      });
+    } catch (error) {
+      rethrowWorkspaceMemberCandidateError(error);
+    }
+    const members = await listWorkspacePeople(deps, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
       throw new HTTPException55(500, { message: "failed to update member" });
@@ -52929,7 +54358,11 @@ function registerWorkspaceRoutes(app, deps) {
     const grant = await requireAccessGrant32(c, deps, workspaceId, "members:manage");
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const members = await listWorkspaceMembers(deps.db, workspaceId);
-    assertWorkspaceMemberRemovable({ members, subjectId, callerSubjectId: grant.subjectId });
+    assertWorkspaceMemberRemovable({
+      members,
+      subjectId,
+      callerSubjectId: grant.subjectId
+    });
     await removeWorkspaceMember(deps.db, {
       accountId: grant.accountId,
       workspaceId,
@@ -52939,6 +54372,62 @@ function registerWorkspaceRoutes(app, deps) {
     return c.body(null, 204);
   });
 }
+function workspaceLimit(deps) {
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  return configuredStaticUsageLimits2(deps.settings).maxWorkspacesPerAccount ?? null;
+}
+async function listWorkspacePeople(deps, workspaceId) {
+  const members = await listWorkspaceMembers(deps.db, workspaceId);
+  const userIds = members.flatMap(
+    (member) => member.subjectId.startsWith("user:") ? [member.subjectId.slice("user:".length)] : []
+  );
+  const profiles = await getManagedUserProfilesByIds(deps.db, userIds);
+  const profileBySubject = new Map(
+    profiles.map((profile) => [`user:${profile.id}`, profile.name?.trim() || profile.email])
+  );
+  return members.map((member) => ({
+    ...member,
+    subjectLabel: profileBySubject.get(member.subjectId) ?? member.subjectLabel
+  }));
+}
+function rethrowWorkspaceMemberCandidateError(error) {
+  const managementCode = error && typeof error === "object" && "code" in error ? error.code : void 0;
+  if (managementCode === "WORKSPACE_MEMBER_ALREADY_EXISTS") {
+    throw new HTTPException55(409, {
+      message: "this person already has access to the workspace"
+    });
+  }
+  if (managementCode === "WORKSPACE_MEMBER_NOT_FOUND") {
+    throw new HTTPException55(404, { message: "member not found" });
+  }
+  if (managementCode === "WORKSPACE_MEMBER_SELF_UPDATE") {
+    throw new HTTPException55(409, {
+      message: "you cannot change your own workspace access"
+    });
+  }
+  if (managementCode === "WORKSPACE_MEMBER_LAST_ADMIN") {
+    throw new HTTPException55(409, {
+      message: "the workspace must keep at least one administrator"
+    });
+  }
+  const sqlState = nestedPostgresSqlState4(error);
+  if (sqlState === "P0002") {
+    throw new HTTPException55(404, { message: "workspace not found" });
+  }
+  if (sqlState === "42501") {
+    throw new HTTPException55(403, {
+      message: "workspace member management is not allowed"
+    });
+  }
+  if (sqlState === "54000") {
+    throw new HTTPException55(409, {
+      message: "this organization has too many members to show here"
+    });
+  }
+  throw error;
+}
 function normalizeAgentInstructions(value) {
   if (value === null) {
     return null;
@@ -52946,10 +54435,12 @@ function normalizeAgentInstructions(value) {
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : null;
 }
-function requireAccountPermission(context, accountId, permission) {
+function requireAccountPermission2(context, accountId, permission) {
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException55(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException55(403, {
+      message: `missing permission: ${permission}`
+    });
   }
 }
 
@@ -53505,6 +54996,7 @@ function registerWorkspaceLearningRoutes(app, deps) {
 import { randomUUID as randomUUID10 } from "crypto";
 import {
   ActivateCompanyProfileRevisionRequest,
+  CompanyProfileAgentPolicy,
   CompanyProfileConflictResponse,
   CompanyProfileDiffRequest,
   CompanyProfileDiffResponse,
@@ -53514,23 +55006,27 @@ import {
   CompanyProfileOperationReuseResponse,
   CompanyProfileRevision,
   RollbackCompanyProfileRequest,
-  UpdateCompanyProfileRequest
+  UpdateCompanyProfileRequest,
+  UpdateCompanyProfileAgentPolicyRequest
 } from "@opengeni/contracts";
 import {
   requireAccessGrant as requireAccessGrant35,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization11
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization12
 } from "@opengeni/core";
 import {
   activateCompanyProfileRevision,
+  CompanyProfileAgentPolicyError,
   CompanyProfileConflictError,
   CompanyProfileInvalidOperationError,
   CompanyProfileNotFoundError,
   CompanyProfileOperationReuseError,
   diffCompanyProfileRevisions,
   getCompanyProfileRevision,
+  getCompanyProfileAgentPolicy,
   listCompanyProfile,
   rollbackCompanyProfileRevision,
-  updateCompanyProfile
+  updateCompanyProfile,
+  updateCompanyProfileAgentPolicy
 } from "@opengeni/db";
 import { HTTPException as HTTPException58 } from "hono/http-exception";
 import { z as z17 } from "zod";
@@ -53574,6 +55070,15 @@ function profileError(context, error) {
   if (error instanceof CompanyProfileInvalidOperationError) {
     return context.json({ code: "INVALID_COMPANY_PROFILE_OPERATION", message: error.message }, 422);
   }
+  if (error instanceof CompanyProfileAgentPolicyError) {
+    if (error.code === "authority_unavailable") {
+      throw new HTTPException58(403, { message: error.message });
+    }
+    if (error.code === "policy_conflict" || error.code === "operation_reused") {
+      throw new HTTPException58(409, { message: error.message });
+    }
+    throw new HTTPException58(422, { message: error.message });
+  }
   throw error;
 }
 function revisionId(context) {
@@ -53584,6 +55089,54 @@ function revisionId(context) {
 }
 function registerCompanyProfileRoutes(app, deps) {
   const base = "/v1/workspaces/:workspaceId/company-profile";
+  app.get(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization12(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read"
+    );
+    requireDirectAccountAdmin(access);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await getCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId
+          })
+        )
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
+  app.patch(`${base}/agent-policy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization12(
+      context,
+      deps,
+      workspaceId,
+      "workspace:read"
+    );
+    requireDirectAccountAdmin(access);
+    const request = await parseBody3(context, UpdateCompanyProfileAgentPolicyRequest);
+    try {
+      return context.json(
+        CompanyProfileAgentPolicy.parse(
+          await updateCompanyProfileAgentPolicy(deps.db, {
+            accountId: access.grant.accountId,
+            workspaceId,
+            actorSubjectId: access.grant.subjectId,
+            ...request
+          })
+        )
+      );
+    } catch (error) {
+      return profileError(context, error);
+    }
+  });
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant35(context, deps, workspaceId, "workspace:read");
@@ -53605,7 +55158,7 @@ function registerCompanyProfileRoutes(app, deps) {
   });
   app.put(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization11(
+    const access = await requireAccessGrantAuthorization12(
       context,
       deps,
       workspaceId,
@@ -53657,7 +55210,7 @@ function registerCompanyProfileRoutes(app, deps) {
   });
   app.post(`${base}/rollback`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization11(
+    const access = await requireAccessGrantAuthorization12(
       context,
       deps,
       workspaceId,
@@ -53704,7 +55257,7 @@ function registerCompanyProfileRoutes(app, deps) {
   });
   app.post(`${base}/revisions/:revisionId/activate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization11(
+    const access = await requireAccessGrantAuthorization12(
       context,
       deps,
       workspaceId,
@@ -54628,7 +56181,7 @@ import {
 } from "@opengeni/contracts";
 import {
   requireAccessGrant as requireAccessGrant37,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization12
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization13
 } from "@opengeni/core";
 import {
   listSlackTaskPolicy,
@@ -54687,7 +56240,7 @@ function registerSlackTaskPolicyRoutes(app, deps) {
   });
   app.put(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization12(
+    const access = await requireAccessGrantAuthorization13(
       context,
       deps,
       workspaceId,
@@ -55155,7 +56708,7 @@ import {
 import {
   hasPermission as hasPermission22,
   requireAccessGrant as requireAccessGrant40,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization13
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization14
 } from "@opengeni/core";
 import {
   activatePreferenceRegistryRevision,
@@ -55173,7 +56726,7 @@ import {
   PreferenceRegistryInitiatorError,
   PreferenceRegistryInvalidOperationError,
   PreferenceRegistryNotFoundError,
-  PreferenceRegistryStableKeyConflictError,
+  PreferenceRegistryStableKeyConflictError as PreferenceRegistryStableKeyConflictError3,
   rejectPreferenceRegistryProposal,
   supersedePreferenceRegistry
 } from "@opengeni/db";
@@ -55250,7 +56803,7 @@ function preferenceError(context, error) {
   if (error instanceof PreferenceRegistryNotFoundError) {
     return context.json({ code: "PREFERENCE_REGISTRY_NOT_FOUND", message: error.message }, 404);
   }
-  if (error instanceof PreferenceRegistryStableKeyConflictError) {
+  if (error instanceof PreferenceRegistryStableKeyConflictError3) {
     return context.json({ code: error.code, message: error.message }, 409);
   }
   if (error instanceof PreferenceRegistryInvalidOperationError) {
@@ -55303,7 +56856,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/proposals`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55383,7 +56936,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/activate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55412,7 +56965,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/correct`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55441,7 +56994,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/scope`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55470,7 +57023,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/deactivate`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55499,7 +57052,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/supersede`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -55528,7 +57081,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/:preferenceId/reject`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization13(
+    const access = await requireAccessGrantAuthorization14(
       context,
       deps,
       workspaceId,
@@ -56980,7 +58533,8 @@ import {
 } from "@opengeni/contracts";
 import {
   getManagedSession as getManagedSession3,
-  organizationMembershipHttpStatus
+  organizationMembershipHttpStatus,
+  requireCanonicalLocalAccountAdministrator as requireCanonicalLocalAccountAdministrator2
 } from "@opengeni/core";
 import {
   acceptOrganizationInvitation,
@@ -56998,7 +58552,7 @@ import {
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState3,
+  nestedPostgresSqlState as nestedPostgresSqlState5,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -57031,6 +58585,20 @@ async function requireManagedHuman(context, deps) {
   }
   return { session, subjectId: `user:${session.user.id}` };
 }
+async function requireOrganizationAdministrator(context, deps, organizationId2) {
+  if (deps.settings.productAccessMode === "managed") {
+    return await requireManagedHuman(context, deps);
+  }
+  if (deps.settings.productAccessMode === "local") {
+    const { subjectId } = await requireCanonicalLocalAccountAdministrator2(
+      context,
+      deps,
+      organizationId2
+    );
+    return { subjectId };
+  }
+  throw new HTTPException67(401, { message: "organization administrator session required" });
+}
 async function parseBody6(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
@@ -57046,7 +58614,7 @@ function parseId(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error) {
-  const status = organizationMembershipHttpStatus(nestedPostgresSqlState3(error));
+  const status = organizationMembershipHttpStatus(nestedPostgresSqlState5(error));
   if (status !== null) {
     throw new HTTPException67(status, {
       message: status === 403 ? "organization administration is not authorized" : status === 404 ? "organization resource not found" : status === 409 ? "organization membership state changed; refresh and retry" : "invalid organization membership operation"
@@ -57089,7 +58657,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState3(error) === "42501") {
+      if (nestedPostgresSqlState5(error) === "42501") {
         throw new HTTPException67(403, {
           message: "organization membership is not active"
         });
@@ -57126,12 +58694,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.get("/v1/organizations/:organizationId/overview", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     try {
       return context.json(
         OrganizationAdministrationOverview.parse(
@@ -57146,12 +58714,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.patch("/v1/organizations/:organizationId", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     const payload = await parseBody6(context, UpdateOrganizationNameRequest);
     try {
       return context.json(
@@ -57168,12 +58736,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.patch("/v1/organizations/:organizationId/workspaces/:workspaceId", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
     const payload = await parseBody6(context, UpdateOrganizationWorkspaceRequest);
     try {
@@ -57194,12 +58762,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.post("/v1/organizations/:organizationId/workspaces", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     const payload = await parseBody6(context, CreateOrganizationWorkspaceRequest);
     try {
       return context.json(
@@ -57220,12 +58788,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
   app.patch(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/settings",
     async (context) => {
-      const { subjectId } = await requireManagedHuman(context, deps);
       const organizationId2 = parseId(
         OrganizationId,
         context.req.param("organizationId"),
         "organization id"
       );
+      const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
       const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
       const payload = await parseBody6(context, UpdateWorkspaceSettingsRequest2);
       try {
@@ -57350,7 +58918,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState3(error) === "55000") {
+      if (nestedPostgresSqlState5(error) === "55000") {
         throw new HTTPException67(409, {
           message: "private-session readiness is not activated for this organization"
         });
@@ -57539,12 +59107,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   );
   app.get("/v1/organizations/:organizationId/members", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     try {
       return context.json(
         ListOrganizationAdministrationMembersResponse.parse({
@@ -57584,12 +59152,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.get("/v1/organizations/:organizationId/retention-policy", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     try {
       return context.json(
         OrganizationRetentionPolicy.parse(
@@ -57604,12 +59172,12 @@ function registerOrganizationMembershipRoutes(app, deps) {
     }
   });
   app.patch("/v1/organizations/:organizationId/retention-policy", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId2 = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id"
     );
+    const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId2);
     const payload = await parseBody6(context, UpdateOrganizationRetentionPolicyRequest);
     try {
       return context.json(
@@ -57963,7 +59531,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState4,
+  nestedPostgresSqlState as nestedPostgresSqlState6,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup
 } from "@opengeni/db";
@@ -58012,7 +59580,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState4(error);
+      const sqlState = nestedPostgresSqlState6(error);
       if (sqlState === "22023") {
         throw new HTTPException69(422, {
           message: "invalid organization setup request"
@@ -58092,7 +59660,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState4(error);
+      const sqlState = nestedPostgresSqlState6(error);
       if (sqlState === "22023") {
         throw new HTTPException69(422, {
           message: "invalid account setup request"
@@ -58210,6 +59778,7 @@ import {
   CompleteManagedAuthLoginTransactionResponse,
   LogoutManagedAuthLoginSlotRequest,
   LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_TRANSACTION_TTL_SECONDS,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
   MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
   ManagedAuthDeepLinkResolution,
@@ -58217,7 +59786,9 @@ import {
   ManagedAuthSessionSetProjection,
   ManagedAuthSessionSetErrorCode,
   ResolveManagedAuthDeepLinkRequest,
-  SelectManagedAuthLoginSlotRequest
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
 } from "@opengeni/contracts/managed-auth-session-sets";
 import { hasPermission as hasPermission23, requireSessionAuthorization as requireSessionAuthorization8 } from "@opengeni/core";
 import {
@@ -58260,6 +59831,13 @@ import {
 import { ensureManagedAccessForUser as ensureManagedAccessForUser2, getSession as getSession8 } from "@opengeni/db";
 import { deleteCookie as deleteCookie3, getCookie, setCookie as setCookie3 } from "hono/cookie";
 import { HTTPException as HTTPException70 } from "hono/http-exception";
+import { z as z24 } from "zod";
+var ManagedAuthSocialStartReceipt = z24.object({
+  version: z24.literal(1),
+  requestDigest: z24.string().regex(/^[0-9a-f]{64}$/u),
+  url: z24.string().url().max(4096),
+  stateCookie: z24.string().min(1).max(4096)
+}).strict();
 function registerManagedAuthSessionSetRoutes(app, deps) {
   const noStore = async (context, next) => {
     context.header("cache-control", "no-store");
@@ -58482,6 +60060,125 @@ function registerManagedAuthSessionSetRoutes(app, deps) {
       throwHttp(error);
     }
   });
+  app.post("/v1/auth/session-set/transactions/social", async (context) => {
+    const body4 = await bodyAs(context, StartManagedAuthSocialTransactionRequest);
+    const { authority, actorEpoch } = await requireMutation(context, deps, body4.expectedGeneration);
+    const available = requireAvailable(deps);
+    if (!managedAuthSocialProviderConfigured(deps, body4.provider)) {
+      throw managedAuthApiError(404, "managed_authentication_unavailable");
+    }
+    const transactionSecret = requireTransactionSecret(context, body4.transactionId);
+    const publicBaseUrl = deps.settings.publicBaseUrl;
+    if (!publicBaseUrl) {
+      throw managedAuthApiError(503, "managed_authentication_unavailable", {
+        retryable: true
+      });
+    }
+    const callbackURL = new URL("/account-auth", publicBaseUrl);
+    callbackURL.searchParams.set("transaction", body4.transactionId);
+    callbackURL.searchParams.set("social", "complete");
+    const errorCallbackURL = new URL(callbackURL);
+    errorCallbackURL.searchParams.set("social", "error");
+    try {
+      const authorityHash = managedAuthSha256(authority);
+      const transactionSecretHash = managedAuthSha256(transactionSecret);
+      const requestDigest = digest(deps, {
+        operation: "social_start",
+        authorityHash,
+        actorEpoch,
+        transactionSecretHash,
+        request: body4
+      });
+      const receiptIdentifier = `opengeni-managed-social-start:${authorityHash}:${body4.operationId}`;
+      const receipt = await deps.db.transaction(async (transaction) => {
+        await transaction.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${receiptIdentifier}, 0))`
+        );
+        const authContext = await available.managedAuth.$context;
+        const stored = await authContext.internalAdapter.findVerificationValue(receiptIdentifier);
+        if (stored && new Date(stored.expiresAt).getTime() > Date.now()) {
+          let parsed2;
+          try {
+            parsed2 = ManagedAuthSocialStartReceipt.safeParse(JSON.parse(stored.value));
+          } catch (error) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: error
+            });
+          }
+          if (!parsed2.success) {
+            throw new ManagedAuthCompletionOutcomeUnknownError({
+              cause: parsed2.error
+            });
+          }
+          if (parsed2.data.requestDigest !== requestDigest) {
+            throw new ManagedAuthSessionSetOperationReuseError();
+          }
+          return parsed2.data;
+        }
+        if (stored) {
+          await authContext.internalAdapter.deleteVerificationByIdentifier(receiptIdentifier);
+        }
+        const result = await available.managedAuth.api.signInSocial({
+          body: {
+            provider: body4.provider,
+            disableRedirect: true,
+            callbackURL: callbackURL.toString(),
+            errorCallbackURL: errorCallbackURL.toString(),
+            additionalData: {
+              opengeniManagedAuth: {
+                version: 1,
+                operationId: body4.operationId,
+                provider: body4.provider,
+                transactionId: body4.transactionId,
+                authorityHash,
+                transactionSecretHash,
+                expectedGeneration: body4.expectedGeneration,
+                expectedActorEpoch: actorEpoch
+              }
+            }
+          },
+          headers: isolatedManagedAuthHeaders(context.req.raw),
+          returnHeaders: true
+        });
+        const url = validatedManagedAuthSocialAuthorizationUrl({
+          provider: body4.provider,
+          rawUrl: result.response?.url,
+          expectedClientId: body4.provider === "google" ? deps.settings.managedAuthGoogleClientId : deps.settings.managedAuthGithubClientId,
+          expectedCallbackUrl: new URL(
+            `/v1/auth/callback/${body4.provider}`,
+            publicBaseUrl
+          ).toString()
+        });
+        const stateCookieName = authContext.createAuthCookie("state").name;
+        const stateCookie2 = setCookieHeaders(result.headers).find(
+          (cookie) => cookie.startsWith(`${stateCookieName}=`)
+        );
+        const parsed = ManagedAuthSocialStartReceipt.parse({
+          version: 1,
+          requestDigest,
+          url,
+          stateCookie: stateCookie2
+        });
+        const created = await authContext.internalAdapter.createVerificationValue({
+          identifier: receiptIdentifier,
+          value: JSON.stringify(parsed),
+          expiresAt: new Date(Date.now() + MANAGED_AUTH_TRANSACTION_TTL_SECONDS * 1e3)
+        });
+        if (!created) {
+          throw new ManagedAuthCompletionOutcomeUnknownError();
+        }
+        return parsed;
+      });
+      context.header("set-cookie", receipt.stateCookie, { append: true });
+      return jsonWithActorEpoch(
+        context,
+        actorEpoch,
+        StartManagedAuthSocialTransactionResponse.parse({ url: receipt.url })
+      );
+    } catch (error) {
+      throwHttp(error);
+    }
+  });
   app.delete("/v1/auth/session-set/transactions/:transactionId", async (context) => {
     const body4 = await bodyAs(context, CancelManagedAuthLoginTransactionRequest);
     if (body4.transactionId !== context.req.param("transactionId")) invalid();
@@ -58618,6 +60315,26 @@ function registerManagedAuthSessionSetRoutes(app, deps) {
     );
   });
 }
+function validatedManagedAuthSocialAuthorizationUrl(input) {
+  if (typeof input.rawUrl !== "string") {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  let url;
+  try {
+    url = new URL(input.rawUrl);
+  } catch (error) {
+    throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
+  }
+  const expectedEndpoint = input.provider === "google" ? { origin: "https://accounts.google.com", pathname: "/o/oauth2/v2/auth" } : { origin: "https://github.com", pathname: "/login/oauth/authorize" };
+  const exactlyOne = (name, expected) => {
+    const values = url.searchParams.getAll(name);
+    return values.length === 1 && values[0] !== "" && (expected === void 0 || values[0] === expected);
+  };
+  if (url.origin !== expectedEndpoint.origin || url.pathname !== expectedEndpoint.pathname || url.username || url.password || url.hash || !exactlyOne("client_id", input.expectedClientId) || !exactlyOne("redirect_uri", input.expectedCallbackUrl) || !exactlyOne("state")) {
+    throw new ManagedAuthCompletionOutcomeUnknownError();
+  }
+  return input.rawUrl;
+}
 function requireManagedAuthProviderRouteAllowed(method, pathname) {
   const normalizedMethod = method.toUpperCase();
   const allowed2 = normalizedMethod === "POST" && (/* @__PURE__ */ new Set([
@@ -58626,16 +60343,27 @@ function requireManagedAuthProviderRouteAllowed(method, pathname) {
     "/v1/auth/send-verification-email",
     "/v1/auth/request-password-reset",
     "/v1/auth/reset-password"
-  ])).has(pathname) || normalizedMethod === "GET" && (pathname === "/v1/auth/verify-email" || pathname === "/v1/auth/error" || pathname === "/v1/auth/ok" || /^\/v1\/auth\/reset-password\/[^/]+$/.test(pathname));
+  ])).has(pathname) || normalizedMethod === "GET" && (pathname === "/v1/auth/verify-email" || pathname === "/v1/auth/error" || pathname === "/v1/auth/ok" || /^\/v1\/auth\/callback\/(?:google|github)$/.test(pathname) || /^\/v1\/auth\/reset-password\/[^/]+$/.test(pathname));
   if (!allowed2) throw managedAuthApiError(409, "provider_route_blocked");
 }
+function managedAuthSocialProviderConfigured(deps, provider) {
+  return provider === "google" ? Boolean(
+    deps.settings.managedAuthGoogleClientId && deps.settings.managedAuthGoogleClientSecret
+  ) : Boolean(
+    deps.settings.managedAuthGithubClientId && deps.settings.managedAuthGithubClientSecret
+  );
+}
 async function scrubManagedAuthProviderResponse(response, options = {}) {
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   const headers = new Headers(response.headers);
   headers.set("cache-control", "no-store");
   headers.set("pragma", "no-cache");
   if (options.replacementCookies !== void 0) {
+    const preserved = setCookieHeaders(response.headers).filter(
+      (cookie) => options.preserveCookieNames?.some((name) => cookie.startsWith(`${name}=`))
+    );
     headers.delete("set-cookie");
+    for (const cookie of preserved) headers.append("set-cookie", cookie);
     for (const cookie of options.replacementCookies) headers.append("set-cookie", cookie);
   }
   let body4 = response.body;
@@ -59037,15 +60765,15 @@ import {
 import {
   issueManagedHumanUserResourceGrant,
   listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization14,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization15,
   revokeManagedHumanUserResourceGrant,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError8,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError7,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError2
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState5, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError2 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState7, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError2 } from "@opengeni/db";
 import { HTTPException as HTTPException71 } from "hono/http-exception";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 async function body2(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) throw new HTTPException71(422, { message: "invalid user-resource request" });
@@ -59058,10 +60786,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError7) {
     throw new HTTPException71(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState5(error) === "42501") {
+  if (nestedPostgresSqlState7(error) === "42501") {
     throw new HTTPException71(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState5(error) === "22023") {
+  if (nestedPostgresSqlState7(error) === "22023") {
     throw new HTTPException71(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -59077,7 +60805,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     });
     if (!query.success) throw new HTTPException71(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization14(
+    const access = await requireAccessGrantAuthorization15(
       context,
       deps,
       workspaceId,
@@ -59102,10 +60830,10 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z24.string().uuid().safeParse(context.req.param("authorityId"));
+    const authorityId = z25.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException71(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
-    const access = await requireAccessGrantAuthorization14(
+    const access = await requireAccessGrantAuthorization15(
       context,
       deps,
       workspaceId,
@@ -59132,10 +60860,10 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeUserResourceGrantQuery.safeParse({ scope: context.req.query("scope") });
     if (!query.success) throw new HTTPException71(422, { message: "explicit scope=user required" });
-    const grantId = z24.string().uuid().safeParse(context.req.param("grantId"));
+    const grantId = z25.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException71(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization14(
+    const access = await requireAccessGrantAuthorization15(
       context,
       deps,
       workspaceId,
@@ -59165,15 +60893,15 @@ import {
 import {
   issueManagedHumanUserResourceGrant as issueManagedHumanUserResourceGrant2,
   listManagedHumanUserResourceAuthorities as listManagedHumanUserResourceAuthorities2,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization15,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization16,
   revokeManagedHumanUserResourceGrant as revokeManagedHumanUserResourceGrant2,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError9,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError8,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState6, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState8, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException73 } from "hono/http-exception";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 
 // src/connection-authority-owner.ts
 import {
@@ -59213,10 +60941,10 @@ function lifecycleError2(error) {
   if (error instanceof SessionAuthorizationUnavailableError8) {
     throw new HTTPException73(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState6(error) === "42501") {
+  if (nestedPostgresSqlState8(error) === "42501") {
     throw new HTTPException73(403, { message: "connection authority denied" });
   }
-  if (nestedPostgresSqlState6(error) === "22023") {
+  if (nestedPostgresSqlState8(error) === "22023") {
     throw new HTTPException73(422, { message: "invalid connection authority" });
   }
   throw error;
@@ -59231,7 +60959,7 @@ function registerConnectionAuthorityRoutes(app, deps) {
     });
     if (!query.success) throw new HTTPException73(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization15(
+    const access = await requireAccessGrantAuthorization16(
       context,
       deps,
       workspaceId,
@@ -59253,10 +60981,10 @@ function registerConnectionAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z25.string().uuid().safeParse(context.req.param("authorityId"));
+    const authorityId = z26.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException73(422, { message: "invalid authority id" });
     const request = await body3(context, IssueConnectionUseGrantRequest2);
-    const access = await requireAccessGrantAuthorization15(
+    const access = await requireAccessGrantAuthorization16(
       context,
       deps,
       workspaceId,
@@ -59284,10 +61012,10 @@ function registerConnectionAuthorityRoutes(app, deps) {
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeConnectionUseGrantQuery.safeParse({ scope: context.req.query("scope") });
     if (!query.success) throw new HTTPException73(422, { message: "explicit scope=user required" });
-    const grantId = z25.string().uuid().safeParse(context.req.param("grantId"));
+    const grantId = z26.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException73(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization15(
+    const access = await requireAccessGrantAuthorization16(
       context,
       deps,
       workspaceId,
@@ -59917,7 +61645,7 @@ import {
   controlHumanSessionWorkstream as controlHumanSessionWorkstream2,
   createSessionForRequest as createSessionForRequest2,
   hasPermission as hasPermission24,
-  requireAccessContext as requireAccessContext3,
+  requireAccessContext as requireAccessContext4,
   requireAccessGrant as requireAccessGrant45,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope3
 } from "@opengeni/core";
@@ -63995,7 +65723,7 @@ async function requireManagedSlackLinkHuman(c, deps) {
   if (c.req.header("authorization")) {
     throw new HTTPException74(401, { message: "managed browser sign-in required" });
   }
-  const context = await requireAccessContext3(c, deps);
+  const context = await requireAccessContext4(c, deps);
   if (context.mode !== "managed" || !context.subjectId.startsWith("user:")) {
     throw new HTTPException74(403, { message: "managed browser sign-in required" });
   }
@@ -64495,20 +66223,96 @@ function createAppComposition(deps) {
   registerManagedAuthSessionSetRoutes(app, routeDeps);
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
+      const pathname = new URL(c.req.url).pathname;
+      const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
       if (deps.settings.managedAuthSessionSetMode === "legacy") {
-        return await managedAuth.handler(c.req.raw);
-      }
-      requireManagedAuthProviderRouteAllowed(c.req.method, new URL(c.req.url).pathname);
-      const headers = new Headers(c.req.raw.headers);
-      headers.delete("cookie");
-      headers.delete("authorization");
-      headers.delete("x-forwarded-user");
-      const providerRequest = new Request(c.req.raw, { headers });
+        return oauthCallbackProvider ? await runManagedAuthProvider(
+          oauthCallbackProvider,
+          async () => await managedAuth.handler(c.req.raw)
+        ) : await managedAuth.handler(c.req.raw);
+      }
+      requireManagedAuthProviderRouteAllowed(c.req.method, pathname);
       const authority = getCookie2(c, MANAGED_AUTH_SESSION_SET_COOKIE2);
-      const discardProviderSession = deps.settings.managedAuthSessionSetMode === "broker" || authority !== void 0;
-      const providerResponse = discardProviderSession ? await runManagedAuthDiscardedProviderSession(
-        async () => await managedAuth.handler(providerRequest)
-      ) : await managedAuth.handler(providerRequest);
+      let providerResponse;
+      let preserveCookieNames;
+      if (oauthCallbackProvider) {
+        const attempt = await resolveManagedAuthOAuthAttempt(
+          managedAuth,
+          c.req.raw,
+          oauthCallbackProvider,
+          deps.settings.publicBaseUrl
+        );
+        if (!attempt || !authority || attempt.authorityHash !== managedAuthSha2562(authority)) {
+          throw new HTTPException75(409, { message: "provider_route_blocked" });
+        }
+        const isolated = await isolatedManagedAuthOAuthCallbackRequest(managedAuth, c.req.raw);
+        preserveCookieNames = [isolated.stateCookieName];
+        const handled = await runManagedAuthAttempt(
+          attempt.transactionId,
+          oauthCallbackProvider,
+          async () => {
+            const response = await managedAuth.handler(isolated.request);
+            return {
+              response,
+              authSessionId: currentManagedAuthCreatedSessionId()
+            };
+          }
+        );
+        providerResponse = handled.response;
+        if (!handled.authSessionId && managedAuthOAuthReturnMatches(
+          providerResponse.headers.get("location") ?? "",
+          new URL(deps.settings.publicBaseUrl).origin,
+          attempt.transactionId,
+          "complete"
+        )) {
+          const location = new URL("/account-auth", deps.settings.publicBaseUrl);
+          location.searchParams.set("transaction", attempt.transactionId);
+          location.searchParams.set("social", "error");
+          providerResponse = Response.redirect(location, 302);
+        } else if (handled.authSessionId) {
+          try {
+            await adoptManagedAuthSession({
+              db: deps.db,
+              adapter: managedAuthSessionAdapter,
+              authority,
+              authorityHash: attempt.authorityHash,
+              csrfHash: managedAuthCsrfHash2(authority),
+              operationId: managedAuthDerivedUuid2(
+                "opengeni:managed-auth:social-completion",
+                `${attempt.transactionId}:${attempt.provider}`
+              ),
+              requestDigest: managedAuthSecretRequestDigest2(deps.settings.betterAuthSecret, {
+                operation: "social_completion",
+                transactionId: attempt.transactionId,
+                provider: attempt.provider,
+                expectedGeneration: attempt.expectedGeneration,
+                expectedActorEpoch: attempt.expectedActorEpoch
+              }),
+              expectedGeneration: attempt.expectedGeneration,
+              expectedActorEpoch: attempt.expectedActorEpoch,
+              transactionId: attempt.transactionId,
+              transactionSecretHash: attempt.transactionSecretHash,
+              authSessionId: handled.authSessionId,
+              mode: deps.settings.managedAuthSessionSetMode
+            });
+          } catch {
+            const location = new URL("/account-auth", deps.settings.publicBaseUrl);
+            location.searchParams.set("transaction", attempt.transactionId);
+            location.searchParams.set("social", "error");
+            providerResponse = Response.redirect(location, 302);
+          }
+        }
+      } else {
+        const headers = new Headers(c.req.raw.headers);
+        headers.delete("cookie");
+        headers.delete("authorization");
+        headers.delete("x-forwarded-user");
+        const providerRequest = new Request(c.req.raw, { headers });
+        const discardProviderSession = deps.settings.managedAuthSessionSetMode === "broker" || authority !== void 0;
+        providerResponse = discardProviderSession ? await runManagedAuthDiscardedProviderSession(
+          async () => await managedAuth.handler(providerRequest)
+        ) : await managedAuth.handler(providerRequest);
+      }
       let replacementCookies;
       if (deps.settings.managedAuthSessionSetMode === "broker") {
         replacementCookies = await managedAuthSessionAdapter.createLegacySelectedSessionCookies(
@@ -64536,19 +66340,23 @@ function createAppComposition(deps) {
           }
         }
       }
-      return await scrubManagedAuthProviderResponse(providerResponse, { replacementCookies });
+      return await scrubManagedAuthProviderResponse(providerResponse, {
+        replacementCookies,
+        preserveCookieNames
+      });
     });
   }
-  app.get(
-    "/healthz",
-    (c) => c.json({
+  app.get("/healthz", (c) => {
+    const warnings = githubAppBotIdentityWarnings(deps.settings);
+    return c.json({
       service: deps.settings.serviceName,
       environment: deps.settings.environment,
       deploymentRevision: deps.settings.deploymentRevision,
       ...deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {},
+      ...warnings.length > 0 ? { warnings } : {},
       ok: true
-    })
-  );
+    });
+  });
   app.get("/readyz", async (c) => {
     const result = await runReadinessChecks(readinessChecks(deps), 2e3);
     return c.json(result, result.ok ? 200 : 503);
@@ -64582,6 +66390,7 @@ function createAppComposition(deps) {
         models: configuredModels3(catalogSettings).map(projectClientModel),
         defaultReasoningEffort: deps.settings.openaiReasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
+        defaultSandboxBackend: deps.settings.sandboxBackend,
         mcpServers: deps.settings.mcpServers.map((server) => ({
           id: server.id,
           name: server.name ?? server.id
@@ -64828,6 +66637,10 @@ function createAppComposition(deps) {
   });
   return { app, routeDeps };
 }
+function managedAuthOAuthCallbackProvider(pathname) {
+  const match = pathname.match(/^\/v1\/auth\/callback\/(google|github)$/u);
+  return match?.[1] === "google" || match?.[1] === "github" ? match[1] : null;
+}
 function mutationOutcomeUnknown(error, method) {
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false;
   const cause = error instanceof HTTPException75 ? error.cause : error;
@@ -64909,7 +66722,11 @@ function clientAuthConfig(settings) {
     return {
       mode: "managedSession",
       session: "cookie",
-      emailVerificationRequired: settings.environment !== "local"
+      emailVerificationRequired: settings.environment !== "local",
+      socialProviders: [
+        ...settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret ? ["google"] : [],
+        ...settings.managedAuthGithubClientId && settings.managedAuthGithubClientSecret ? ["github"] : []
+      ]
     };
   }
   if (settings.productAccessMode === "configured") {
@@ -65140,6 +66957,22 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/status$/,
     label: "/v1/workspaces/:workspaceId/codex/status"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/codex\/source$/,
+    label: "/v1/workspaces/:workspaceId/codex/source"
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/(accounts|settings)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/${match[1]}`
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/connect\/(start|poll)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/connect/${match[1]}`
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/accounts\/[^/]+(?:\/activate)?$/,
+    label: "/v1/organizations/:organizationId/codex/accounts/:accountId"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/connect\/(start|poll)$/,
     label: (match) => `/v1/workspaces/:workspaceId/supergrok/connect/${match[1]}`
@@ -65290,6 +67123,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/targets\/[^/]+\/observation$/,
     label: "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/observation"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/targets\/[^/]+\/screenshot$/,
+    label: "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/operations\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/operations/:operationId"
@@ -65462,6 +67299,18 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/api-keys/:id"
   },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys$/,
+    label: "/v1/organizations/:organizationId/api-keys"
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys\/[^/]+$/,
+    label: "/v1/organizations/:organizationId/api-keys/:id"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external$/,
+    label: "/v1/workspaces/external"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/scheduled-tasks$/,
     label: "/v1/workspaces/:workspaceId/scheduled-tasks"
@@ -65931,4 +67780,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-QESX7HDK.js.map
+//# sourceMappingURL=chunk-XTLI3CBH.js.map