@opengeni/api-router 3.0.0-canary.0 → 3.0.1-canary.0

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-7IAWEYBH.js";
+} from "./chunk-XZGTKYOA.js";
 
 // src/index.ts
 import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";

package/dist/integrations/fiken.d.ts

@@ -6,7 +6,9 @@ import { type Database } from "@opengeni/db";
 import { type FetchLike } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
 /** Shared native/embedded token adapter. Provider verification happens before
- * persistence; the caller reauthorizes inside its durable commit transaction. */
+ * persistence; the caller reauthorizes inside its durable commit transaction.
+ * That caller must acquire the organization policy fence for `fiken` BEFORE
+ * owner/tenancy locks and invoke the returned writer with that exact tx. */
 export declare function prepareFikenTokenInstall(deps: ApiRouteDeps, grant: Pick<AccessGrant, "accountId" | "workspaceId" | "subjectId">, raw: unknown, expectedVersion?: number): Promise<(tx: Database) => Promise<ConnectionMetadata>>;
 export type FikenOperation = "companies.list" | "contacts.list" | "contact.create" | "products.list" | "invoices.list" | "invoice.get" | "invoice_draft.create" | "bank_accounts.list" | "purchases.list" | "sales.list";
 export declare class FikenProviderError extends Error {

package/dist/integrations/github-lens-connect.d.ts

@@ -65,7 +65,7 @@ export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId
         adapterId: string;
         eventTypes: string[];
         sessionTemplate: {
-            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
+            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
             prompt: string;
             instructions: string | null;
             resources: ({
@@ -104,7 +104,7 @@ export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/integrations/integration-commit-authority.d.ts

@@ -0,0 +1,13 @@
+import { type AccessGrant, type Permission } from "@opengeni/contracts";
+import { type Settings } from "@opengeni/config";
+import { type AccessGrantAuthorization } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+export type IntegrationCommitGrant = AccessGrant & {
+    authorizeCommit: (tx: Database) => Promise<void>;
+};
+/** Keep server-verified provenance alongside the grant across provider work.
+ * Call only inside the policy transaction, before persistence locks. */
+export declare function integrationCommitGrant(authorization: AccessGrantAuthorization, permissions: readonly Permission[], request: {
+    settings: Settings;
+    authorizationHeader?: string | undefined;
+}): Promise<IntegrationCommitGrant>;

package/dist/integrations/oauth-client.d.ts

@@ -2,7 +2,7 @@ import { type Settings } from "@opengeni/config";
 import { OAuthStartResponse, type ConnectionOwnership, type OAuthStartRequest } from "@opengeni/contracts";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type { Observability } from "@opengeni/observability";
-import { type Database } from "@opengeni/db";
+import { claimConnectOperation, finishConnectOperation, type Database } from "@opengeni/db";
 import { type McpAuthorizationServerMetadata } from "@opengeni/network";
 import { type OAuthProviderProfile } from "./oauth-profiles.js";
 export declare const oauthStateTtlMs: number;
@@ -16,6 +16,8 @@ type OAuthClientDeps = {
     oauthCallbackDeadlineMs?: number | undefined;
 };
 export type OAuthStartContext = {
+    /** Server-selected dedicated adapter identity; never copied from request metadata. */
+    integrationKey?: "gmail" | "slack-personal";
     connectAttemptId?: string;
     externalContinuation?: ExternalActorContinuation;
     accountId: string;
@@ -38,6 +40,121 @@ type AuthorizationServerMetadata = McpAuthorizationServerMetadata;
 export declare const OAUTH_START_DEADLINE_MS = 15000;
 export declare const OAUTH_CALLBACK_DEADLINE_MS = 30000;
 export type OAuthStartStage = "connection_lookup" | "mcp_challenge" | "protected_resource_metadata" | "authorization_server_metadata" | "client_registration";
+/** Policy is the outermost lock. Receipt replay still runs normal authorization,
+ * but the DB calls authorizeAcquisition only for uncommitted progress. Provider
+ * requests must happen after this transaction, never inside either wrapper. */
+export declare function claimOAuthAcquisition(db: Database, scope: Parameters<typeof claimConnectOperation>[1], input: Parameters<typeof claimConnectOperation>[2], integrationKey: string | null, acquiring?: boolean): Promise<{
+    status: "claimed";
+    attempt: import("@opengeni/contracts/connect").ConnectAttempt;
+} | {
+    status: "replayed";
+    attempt: import("@opengeni/contracts/connect").ConnectAttempt;
+}>;
+type IntegrationSourceSelection = Record<string, unknown> & {
+    id: string;
+    syncEnabled: boolean;
+    readPolicy: "allow" | "ask" | "block";
+};
+/** Compare server-bound selections, not provider classification. Removing a
+ * source, disabling sync, or narrowing its read permission acquires no authority.
+ * Generation/timestamp bookkeeping does not turn an unchanged save into setup. */
+export declare function integrationSourceSelectionRequiresAcquisition(previous: readonly IntegrationSourceSelection[], requested: readonly IntegrationSourceSelection[]): boolean;
+export declare function finishOAuthAcquisition(db: Database, scope: Parameters<typeof finishConnectOperation>[1], input: Parameters<typeof finishConnectOperation>[2], integrationKey: string | null): Promise<{
+    id: string;
+    workspaceId: string;
+    providerId: string;
+    ownership: "personal" | "workspace";
+    revision: number;
+    state: "account_selection" | "cancelled" | "complete" | "connected_but_incomplete" | "credential_input" | "expired" | "failed" | "installing" | "preview" | "provider_wait" | "ready" | "requires_user_action" | "resource_selection" | "uncertain";
+    credentialsCommitted: boolean;
+    integrationInstalled: boolean;
+    completionRequirement: "connection" | "integration" | "provider_setup";
+    nextAction: {
+        type: "authorize";
+        url: string;
+    } | {
+        type: "credentials";
+        fields: {
+            name: string;
+            label: string;
+            required: boolean;
+            secret: boolean;
+            options?: {
+                value: string;
+                label: string;
+            }[] | undefined;
+        }[];
+    } | {
+        type: "wait";
+        pollAfterMs: number;
+        userCode?: string | undefined;
+        verificationUrl?: string | undefined;
+    } | {
+        type: "select_account";
+        accounts: {
+            id: string;
+            providerId: string;
+            version?: number | undefined;
+            label: string;
+            ownership: "personal" | "workspace";
+            status: "auth_needed" | "connected" | "disabled";
+        }[];
+    } | {
+        type: "select_resources";
+        resources: {
+            id: string;
+            label: string;
+            kind: string;
+        }[];
+        cursor?: string | undefined;
+    } | {
+        type: "preview";
+        previewId: string;
+        contentHash: string;
+        operations: {
+            id: string;
+            label: string;
+            kind: string;
+        }[];
+    } | {
+        type: "none";
+    };
+    expiresAt: string;
+    account?: {
+        id: string;
+        providerId: string;
+        version?: number | undefined;
+        label: string;
+        ownership: "personal" | "workspace";
+        status: "auth_needed" | "connected" | "disabled";
+    } | undefined;
+    installationTarget?: {
+        instanceKey: string;
+        displayName: string;
+        expectedInstanceVersion?: number | undefined;
+    } | undefined;
+    source?: {
+        kind: "definition";
+        definitionId: string;
+    } | {
+        kind: "openapi";
+        url: string;
+        baseUrl?: string | undefined;
+    } | {
+        kind: "graphql";
+        endpoint: string;
+        name?: string | undefined;
+    } | {
+        kind: "auto";
+        url: string;
+        baseUrl?: string | undefined;
+    } | undefined;
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    } | undefined;
+}>;
 export declare function startMcpOAuth(deps: OAuthClientDeps, context: OAuthStartContext): Promise<OAuthStartResponse>;
 /** Ownership fence for the official Gmail profile, keyed by exact MCP URL. */
 export declare function assertOfficialGmailPersonalOwnership(mcpUrl: string, ownership: ConnectionOwnership): void;

package/dist/integrations/slack-interactions.d.ts

@@ -19,7 +19,7 @@ export declare const SLACK_SESSION_INSTRUCTIONS: string;
  * selection at session creation while keeping Slack mutations out of the model
  * surface; interaction delivery remains owned by the durable delivery pump.
  */
-export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
 export type NormalizedSlackInteraction = {
     providerEventId: string;
     providerMessageId: string;

package/dist/mcp/first-party-tool-permissions.d.ts

@@ -46,6 +46,10 @@ export declare const FIRST_PARTY_TOOL_AUTHORIZATION: {
         sessionRequired: true;
         allOf: "documents:search"[];
     };
+    knowledge_prepare_save: {
+        sessionRequired: true;
+        allOf: "documents:search"[];
+    };
     knowledge_get: {
         sessionRequired: true;
         allOf: "documents:search"[];

package/dist/mcp/scheduled-task-view.d.ts

@@ -82,8 +82,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -205,8 +205,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
+        readonly sourceId?: never;
         kind: "agent_turn";
-        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -389,8 +389,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
+            readonly sourceId?: never;
             kind: "agent_turn";
-            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/routes/api-integrations.d.ts

@@ -16,6 +16,7 @@ export declare function registerApiIntegrationRoutes(app: Hono, deps: ApiRouteDe
 export declare function resolveForRoute(input: {
     deps: ApiRouteDeps;
     transport: ReturnType<typeof createPinnedIntegrationTransport>;
+    accountId: string;
     workspaceId: string;
     subjectId: string;
     payload: PreviewApiIntegrationRequest | InstallApiIntegrationRequest;

package/dist/routes/organization-integration-policy.d.ts

@@ -0,0 +1,3 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerOrganizationIntegrationPolicyRoutes(app: Hono, deps: ApiRouteDeps): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.0.0-canary.0",
+  "version": "3.0.1-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.6.0-canary.3",
-    "@opengeni/artifact-tool": "^0.3.28-canary.0",
-    "@opengeni/capabilities": "^0.3.3-canary.15",
-    "@opengeni/codemode": "^0.5.8-canary.0",
-    "@opengeni/codex": "^0.2.23-canary.0",
-    "@opengeni/config": "^1.2.1-canary.0",
-    "@opengeni/contracts": "^4.0.0-canary.0",
-    "@opengeni/core": "^3.0.0-canary.0",
-    "@opengeni/db": "^5.0.0-canary.0",
-    "@opengeni/documents": "^0.8.29-canary.0",
-    "@opengeni/events": "^0.4.27-canary.0",
-    "@opengeni/github": "^0.7.12-canary.0",
-    "@opengeni/network": "^0.3.1-canary.15",
-    "@opengeni/observability": "^0.8.28-canary.0",
-    "@opengeni/runtime": "^3.0.0-canary.0",
-    "@opengeni/storage": "^0.2.129-canary.0",
-    "@opengeni/tool-gateway": "^0.1.9-canary.0",
-    "@opengeni/xai-subscription": "^0.1.4-canary.15",
+    "@opengeni/agent-proto": "^0.6.0-canary.5",
+    "@opengeni/artifact-tool": "^0.3.29-canary.0",
+    "@opengeni/capabilities": "^0.3.4-canary.0",
+    "@opengeni/codemode": "^0.5.9-canary.0",
+    "@opengeni/codex": "^0.2.23-canary.2",
+    "@opengeni/config": "^1.2.2-canary.0",
+    "@opengeni/contracts": "^4.1.0-canary.0",
+    "@opengeni/core": "^3.0.1-canary.0",
+    "@opengeni/db": "^5.0.1-canary.0",
+    "@opengeni/documents": "^0.8.30-canary.0",
+    "@opengeni/events": "^0.4.28-canary.0",
+    "@opengeni/github": "^0.7.13-canary.0",
+    "@opengeni/network": "^0.3.1-canary.17",
+    "@opengeni/observability": "^0.8.29-canary.0",
+    "@opengeni/runtime": "^3.0.1-canary.0",
+    "@opengeni/storage": "^0.2.130-canary.0",
+    "@opengeni/tool-gateway": "^0.1.10-canary.0",
+    "@opengeni/xai-subscription": "^0.1.4-canary.17",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -1,7 +1,7 @@
 import { registerConnectCallbackReturns } from "./integrations/connect-callback-return";
 import { registerFeedbackRoutes } from "./routes/feedback";
 import { codemodeSessionRequest } from "./codemode";
-import { SiteSessionPathError } from "@opengeni/contracts";
+import { SiteSessionPathError, OrganizationIntegrationDeniedError } from "@opengeni/contracts";
 import { registerModelConnectionAccessRoutes } from "./routes/model-connection-access";
 import {
   canonicalizeConfiguredModelId,
@@ -149,6 +149,7 @@ import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
 import { registerOrganizationModelProviderRoutes } from "./routes/organization-model-providers";
+import { registerOrganizationIntegrationPolicyRoutes } from "./routes/organization-integration-policy";
 import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
 import { registerConnectRoutes } from "./routes/connect";
@@ -1278,6 +1279,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
   registerOrganizationModelProviderRoutes(app, routeDeps);
+  registerOrganizationIntegrationPolicyRoutes(app, routeDeps);
   registerModelConnectionAccessRoutes(app, routeDeps);
   registerSuperGrokRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
@@ -1311,7 +1313,10 @@ export function createAppComposition(deps: AppDependencies): {
   app.onError((rawError, c) => {
     // One central mapping for every Send/Steer/control route: a bounded
     // control-prefix wait that expired is a known, retryable, not-applied 503.
-    const error = workspaceControlBusyHttpError(rawError) ?? rawError;
+    const error =
+      rawError instanceof OrganizationIntegrationDeniedError
+        ? new HTTPException(403, { message: rawError.message })
+        : (workspaceControlBusyHttpError(rawError) ?? rawError);
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);