@opengeni/api-router 3.0.1-canary.2 → 3.0.1-canary.4

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-PRCUIL5L.js";
+} from "./chunk-RSMCZIG2.js";
 
 // src/index.ts
 import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";

package/dist/integrations/marketplace-plugin.d.ts

@@ -52,8 +52,8 @@ export declare function marketplacePlugin(url: string): {
         category: string;
         keywords: never[];
         author: {
-            url?: never;
             name: string;
+            url?: never;
             email?: never;
         };
         version: string;
@@ -78,9 +78,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;
@@ -124,9 +124,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;
@@ -170,9 +170,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;
@@ -216,9 +216,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;
@@ -262,9 +262,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;
@@ -308,9 +308,9 @@ export declare function marketplacePlugin(url: string): {
         installation: string;
         upstream: {
             source: {
-                url?: never;
                 source: string;
                 path: string;
+                url?: never;
             };
             policy: {
                 installation: string;

package/dist/routes/managed-sign-in-methods.d.ts

@@ -0,0 +1,6 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+export declare function admitManagedSignInMutation(context: Context, deps: ApiRouteDeps): Promise<void>;
+export declare function registerManagedSignInMethodRoutes(app: Hono, deps: ApiRouteDeps): void;
+/** Intercept only database-backed, product-issued explicit connect states. */
+export declare function handleManagedSignInConnectCallback(context: Context, deps: ApiRouteDeps, provider: "google" | "github"): Promise<Response | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.0.1-canary.2",
+  "version": "3.0.1-canary.4",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,24 +43,24 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.6.0-canary.7",
-    "@opengeni/artifact-tool": "^0.3.29-canary.2",
-    "@opengeni/capabilities": "^0.3.4-canary.2",
-    "@opengeni/codemode": "^0.5.9-canary.2",
-    "@opengeni/codex": "^0.2.23-canary.4",
-    "@opengeni/config": "^1.2.2-canary.2",
-    "@opengeni/contracts": "^4.1.0-canary.2",
-    "@opengeni/core": "^3.0.1-canary.2",
-    "@opengeni/db": "^5.0.1-canary.2",
-    "@opengeni/documents": "^0.8.30-canary.2",
-    "@opengeni/events": "^0.4.28-canary.2",
-    "@opengeni/github": "^0.7.13-canary.2",
-    "@opengeni/network": "^0.3.1-canary.19",
-    "@opengeni/observability": "^0.8.29-canary.2",
-    "@opengeni/runtime": "^3.0.1-canary.2",
-    "@opengeni/storage": "^0.2.130-canary.2",
-    "@opengeni/tool-gateway": "^0.1.10-canary.2",
-    "@opengeni/xai-subscription": "^0.1.4-canary.19",
+    "@opengeni/agent-proto": "^0.6.0-canary.9",
+    "@opengeni/artifact-tool": "^0.3.29-canary.4",
+    "@opengeni/capabilities": "^0.3.4-canary.4",
+    "@opengeni/codemode": "^0.5.9-canary.4",
+    "@opengeni/codex": "^0.2.23-canary.6",
+    "@opengeni/config": "^1.2.2-canary.4",
+    "@opengeni/contracts": "^4.1.0-canary.4",
+    "@opengeni/core": "^3.0.1-canary.4",
+    "@opengeni/db": "^5.0.1-canary.4",
+    "@opengeni/documents": "^0.8.30-canary.4",
+    "@opengeni/events": "^0.4.28-canary.4",
+    "@opengeni/github": "^0.7.13-canary.4",
+    "@opengeni/network": "^0.3.1-canary.21",
+    "@opengeni/observability": "^0.8.29-canary.4",
+    "@opengeni/runtime": "^3.0.1-canary.4",
+    "@opengeni/storage": "^0.2.130-canary.4",
+    "@opengeni/tool-gateway": "^0.1.10-canary.4",
+    "@opengeni/xai-subscription": "^0.1.4-canary.21",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -106,6 +106,7 @@ import {
   runManagedAuthProvider,
 } from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
+import { startManagedSignInNotificationDelivery } from "./auth/managed-sign-in-notifications";
 import {
   assertManagedEmailTransportMetadata,
   assertOrganizationUserSetupQueryTransportConfigured,
@@ -207,6 +208,10 @@ import { registerOrganizationMembershipRoutes } from "./routes/organization-memb
 import { registerOrganizationSessionRoutes } from "./routes/organization-sessions";
 import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
 import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedSignInMethodRoutes,
+  handleManagedSignInConnectCallback,
+} from "./routes/managed-sign-in-methods";
 import {
   registerManagedAuthSessionSetRoutes,
   requireManagedAuthProviderRouteAllowed,
@@ -300,6 +305,7 @@ export function createAppComposition(deps: AppDependencies): {
   const managedAuthSessionAdapter =
     deps.managedAuthSessionAdapter ??
     (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
+  if (managedAuth) startManagedSignInNotificationDelivery(deps.db, managedEmailTransport);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -670,10 +676,61 @@ export function createAppComposition(deps: AppDependencies): {
   // wildcard handler or the provider returns its own 404 first.
   registerManagedOnboardingRoutes(app, routeDeps);
   registerManagedAuthSessionSetRoutes(app, routeDeps);
+  registerManagedSignInMethodRoutes(app, routeDeps);
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
       const pathname = new URL(c.req.url).pathname;
       const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
+      if (pathname === "/v1/auth/sign-in/social" && c.req.method === "POST") {
+        const body = await c.req.raw
+          .clone()
+          .json()
+          .catch(() => null);
+        if (
+          !body ||
+          !["google", "github"].includes(body.provider) ||
+          Object.prototype.hasOwnProperty.call(body, "idToken")
+        ) {
+          return c.json(
+            {
+              code: "SIGN_IN_METHOD_OAUTH_REDIRECT_REQUIRED",
+              message: "Use the browser OAuth sign-in redirect",
+            },
+            403,
+          );
+        }
+      }
+      if (oauthCallbackProvider) {
+        const connectResponse = await handleManagedSignInConnectCallback(
+          c,
+          routeDeps,
+          oauthCallbackProvider,
+        );
+        if (connectResponse) return connectResponse;
+      }
+      if (
+        new Set([
+          "link-social",
+          "unlink-account",
+          "list-accounts",
+          "set-password",
+          "change-password",
+          "change-email",
+          "update-user",
+          "delete-user",
+          "get-access-token",
+          "refresh-token",
+          "account-info",
+        ]).has(pathname.slice("/v1/auth/".length))
+      ) {
+        return c.json(
+          {
+            code: "SIGN_IN_METHOD_PRODUCT_ROUTE_REQUIRED",
+            message: "Use personal sign-in method settings",
+          },
+          403,
+        );
+      }
       if (deps.settings.managedAuthSessionSetMode === "legacy") {
         return oauthCallbackProvider
           ? await runManagedAuthProvider(

package/src/auth/managed-auth-attempt-context.ts

@@ -11,6 +11,15 @@ type ManagedAuthAttemptContext =
   | { kind: "discard_provider_session" };
 
 const managedAuthAttemptStorage = new AsyncLocalStorage<ManagedAuthAttemptContext>();
+const managedLinkIntentStorage = new AsyncLocalStorage<string>();
+
+export function runManagedSignInConnect<T>(intentId: string, action: () => T): T {
+  return managedLinkIntentStorage.run(intentId, action);
+}
+
+export function currentManagedSignInConnectIntent(): string | undefined {
+  return managedLinkIntentStorage.getStore();
+}
 
 export function runManagedAuthAttempt<T>(
   transactionId: string,

package/src/auth/managed-auth-session-adapter.ts

@@ -8,6 +8,17 @@ import type { ManagedAuth } from "@opengeni/core";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { runManagedAuthAttempt } from "./managed-auth-attempt-context";
 
+/** Server-only proof for a product-owned endpoint; never returned to a browser. */
+export async function managedAuthSelectedProofHeaders(
+  auth: ManagedAuth,
+  token: string,
+): Promise<Headers> {
+  const context = await auth.$context;
+  return new Headers({
+    cookie: `${context.authCookies.sessionToken.name}=${signedCookieValue(token, context.secret)}`,
+  });
+}
+
 export function createBetterAuthSessionAdapter(
   auth: ManagedAuth,
   db: Database,

package/src/auth/managed-auth.ts

@@ -14,16 +14,18 @@ import {
 } from "@opengeni/db/canonical-human-identities";
 import { betterAuth } from "better-auth";
 import { createEmailVerificationToken } from "better-auth/api";
-import { hashPassword } from "better-auth/crypto";
+import { hashPassword, verifyPassword } from "better-auth/crypto";
 import { sql } from "drizzle-orm";
 import { Pool } from "pg";
 
 import { decideCanonicalHumanSessionAdmission } from "./canonical-human-session-admission";
+import { deliverManagedSignInNotification } from "./managed-sign-in-notifications";
 import {
   currentManagedAuthProviderId,
   currentManagedAuthAttemptId,
   recordCurrentManagedAuthSession,
   shouldDiscardCurrentManagedAuthProviderSession,
+  currentManagedSignInConnectIntent,
 } from "./managed-auth-attempt-context";
 
 // `ManagedAuth` (the Better Auth `Auth<any>` alias) is owned by @opengeni/core
@@ -66,6 +68,10 @@ export async function hashManagedAuthPassword(password: string): Promise<string>
   return await hashPassword(password);
 }
 
+export async function verifyManagedAuthPassword(password: string, hash: string): Promise<boolean> {
+  return await verifyPassword({ password, hash });
+}
+
 export function createManagedAuth(
   settings: Settings,
   db: Database,
@@ -180,7 +186,18 @@ export function createManagedAuth(
         updatedAt: "updated_at",
       },
       accountLinking: {
-        enabled: false,
+        enabled: true,
+        requireLocalEmailVerified: true,
+        trustedProviders: [],
+        allowDifferentEmails: false,
+      },
+      additionalFields: {
+        managedLinkIntentId: {
+          type: "string",
+          fieldName: "managed_link_intent_id",
+          input: false,
+          returned: false,
+        },
       },
       encryptOAuthTokens: true,
       storeStateStrategy: "database",
@@ -264,6 +281,26 @@ export function createManagedAuth(
       },
     },
     databaseHooks: {
+      account: {
+        create: {
+          before: async (account) => ({
+            data: {
+              ...account,
+              ...(currentManagedSignInConnectIntent()
+                ? { managedLinkIntentId: currentManagedSignInConnectIntent() }
+                : {}),
+            },
+          }),
+          after: async (account) => {
+            if (
+              !["google", "github"].includes(account.providerId) ||
+              currentManagedSignInConnectIntent()
+            )
+              return;
+            await deliverManagedSignInNotification(db, managedEmailTransport, account.id);
+          },
+        },
+      },
       session: {
         create: {
           before: async (session) => {

package/src/auth/managed-sign-in-notifications.ts

@@ -0,0 +1,81 @@
+import type { ManagedEmailTransport } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+import { sql } from "drizzle-orm";
+import { z } from "zod";
+
+const Claim = z.object({
+  operationId: z.string().uuid(),
+  leaseId: z.string().uuid(),
+  email: z.string().email(),
+  provider: z.enum(["password", "google", "github"]),
+  sender: z.string(),
+});
+const started = new WeakSet<object>();
+
+export async function deliverManagedSignInNotification(
+  db: Database,
+  transport: ManagedEmailTransport,
+  operationId: string | null = null,
+): Promise<"sent" | "failed" | "outcome_unknown"> {
+  try {
+    const result = await db.execute(
+      sql`select claim_managed_sign_in_notification(${operationId}::uuid,${transport.sender},${transport.idempotency.scope},${transport.idempotency.retentionSeconds}::integer) as claim`,
+    );
+    const row = (Array.isArray(result) ? result : result.rows)[0] as { claim: unknown } | undefined;
+    if (!row?.claim) return "outcome_unknown";
+    const claim = Claim.parse(row.claim);
+    let status: "sent" | "failed" | "outcome_unknown" = "outcome_unknown";
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      const response = await Promise.race([
+        transport.send({
+          kind: "sign_in_method_changed",
+          from: claim.sender,
+          to: claim.email,
+          idempotencyKey: `sign-in-method:${claim.operationId}`,
+          subject: "Your OpenGeni sign-in methods changed",
+          text: `Your OpenGeni ${claim.provider} sign-in method changed. If this was not you, reset your password and contact your administrator.`,
+          html: `<p>Your OpenGeni ${claim.provider} sign-in method changed. If this was not you, reset your password and contact your administrator.</p>`,
+        }),
+        new Promise<{ status: "outcome_unknown" }>((resolve) => {
+          timer = setTimeout(() => resolve({ status: "outcome_unknown" }), 5_000);
+        }),
+      ]);
+      status = response.status;
+    } catch {
+      /* Retain the durable unknown claim for idempotent retry. */
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    await db.execute(
+      sql`select settle_managed_sign_in_notification(${claim.operationId}::uuid,${claim.leaseId}::uuid,${status})`,
+    );
+    return status;
+  } catch {
+    // Security state is already committed. A failed claim/ack must never be
+    // reported as a failed method change; its durable obligation remains live.
+    return "outcome_unknown";
+  }
+}
+
+export function startManagedSignInNotificationDelivery(
+  db: Database,
+  transport: ManagedEmailTransport,
+): void {
+  if (started.has(db as object)) return;
+  started.add(db as object);
+  let active = false;
+  const drain = async () => {
+    if (active) return;
+    active = true;
+    try {
+      for (let count = 0; count < 10; count++)
+        if ((await deliverManagedSignInNotification(db, transport)) === "outcome_unknown") break;
+    } finally {
+      active = false;
+    }
+  };
+  const timer = setInterval(() => void drain(), 60_000);
+  (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
+  void drain();
+}

package/src/integrations/github-app-connect.ts

@@ -210,6 +210,18 @@ export async function completeGitHubAppConnect(
       state.providerId,
       acquiring,
     );
+    // Recover a repeated install callback only while its next stage is still
+    // current. A completed/superseded attempt returns home without reopening OAuth.
+    if (
+      claim.status === "replayed" &&
+      state.phase === "install" &&
+      claim.attempt.revision === stored.attempt.revision &&
+      claim.attempt.nextAction.type === "authorize"
+    )
+      return new Response(null, {
+        status: 302,
+        headers: { Location: claim.attempt.nextAction.url },
+      });
     if (claim.status !== "replayed") {
       const provider =
         state.providerId === "github-lens" ? deps.prReviewGithubAppApi : deps.githubAppApi;
@@ -390,14 +402,19 @@ export async function completeGitHubAppConnect(
           },
         };
       }
-      if (acquiring)
-        await finishOAuthAcquisition(
-          deps.db,
-          state,
-          { ...operation, commit: prepared.commit },
-          state.providerId,
-        );
-      else await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
+      const completed = acquiring
+        ? await finishOAuthAcquisition(
+            deps.db,
+            state,
+            { ...operation, commit: prepared.commit },
+            state.providerId,
+          )
+        : await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
+      // Installation is only the first half of consent. Keep this browser on
+      // the exact authorization stage committed above; polling still waits for
+      // the final owner proof before reporting connection completion.
+      if (state.phase === "install" && completed.nextAction.type === "authorize")
+        return new Response(null, { status: 302, headers: { Location: completed.nextAction.url } });
     }
   } catch {
     // Preserve unknown outcomes; never replay provider authorization to recover.

package/src/mcp/server.ts

@@ -5787,7 +5787,7 @@ function registerCapabilityDiscoveryTools(
     "capability_catalog_search",
     {
       description:
-        "Search OpenGeni's reviewed workspace capability catalog when the user asks to add an integration or the task needs a capability that is not currently usable. Search by the outcome needed (for example `GitHub repositories`, `product analytics`, or `Slack notifications`), compare the returned candidates, and prefer a ready or verified exact match. This only reads secret-free metadata; it never installs, connects, or authorizes anything.",
+        "Find integrations in OpenGeni's reviewed workspace catalog when the user asks to add one or needed access is missing. Search by integration name or task outcome. Results describe setup status and provide setup.nextAction when human setup can be requested. Use available tools directly for ready candidates. This reads metadata only and does not connect or authorize anything.",
       inputSchema: {
         query: z4.string().min(1).max(500),
         limit: z4.number().int().min(1).max(20).optional(),
@@ -5817,6 +5817,10 @@ function registerCapabilityDiscoveryTools(
         setup: {
           ...setups[index]!,
           requiredVariables: capabilityRequiredVariables(item),
+          nextAction:
+            setups[index]!.status === "authorization_required"
+              ? { toolName: "capability_authorization_request", capabilityId: item.id }
+              : null,
         },
       }));
       return json({ query, matches });
@@ -5827,7 +5831,7 @@ function registerCapabilityDiscoveryTools(
     "capability_authorization_request",
     {
       description:
-        "After capability_catalog_search and after explaining one chosen recommendation to the user, post exactly one in-session human authorization card for that catalog capability. This tool never grants access, enables a capability, reads a secret, or mints provider credentials; the authenticated user must click and confirm the provider/domain flow. Do not call it for a candidate reported ready or unavailable.",
+        "Show a Connect card in this chat for a suitable capability returned by capability_catalog_search with setup.nextAction. Supply its capability ID and a brief rationale explaining how it helps the task; no separate confirmation is needed before showing the card. Requesting setup needs no integration-management permission and grants no access. The authenticated human completes setup through the card; never ask them to paste credentials into chat. Do not request another card for the same pending setup, or for a candidate reported ready or unavailable.",
       inputSchema: {
         capabilityId: z4.string().min(1).max(512),
         rationale: z4.string().min(1).max(2000),

package/src/routes/canonical-human-identities.ts

@@ -23,6 +23,9 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { admitManagedSignInMutation } from "./managed-sign-in-methods";
+import { managedAuthSecretRequestDigest } from "@opengeni/core/managed-auth-session-sets";
+import { deliverManagedSignInNotification } from "../auth/managed-sign-in-notifications";
 
 const BindingId = z.string().uuid();
 
@@ -86,6 +89,7 @@ async function mutate(
     operationId: string;
     expectedIdentityRevision: number;
     reason: string;
+    verifiedManagedRecovery?: boolean;
   },
 ): Promise<Response> {
   const identity = await requestIdentity(context, deps);
@@ -104,10 +108,27 @@ async function mutate(
         ...(input.providerId ? { providerId: input.providerId } : {}),
         ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
         reason: input.reason,
+        ...(input.verifiedManagedRecovery
+          ? {
+              verifiedRecovery: {
+                authSessionId: identity.authSessionId,
+                requestDigest: managedAuthSecretRequestDigest(
+                  deps.settings.betterAuthSecret!,
+                  input,
+                ),
+              },
+            }
+          : {}),
         ...(actorFence ? { actorFence } : {}),
       }),
     );
     if (actorFence) markManagedAuthRequestActorTransitionApplied(context.req.raw);
+    if (input.verifiedManagedRecovery)
+      await deliverManagedSignInNotification(
+        deps.db,
+        deps.managedEmailTransport,
+        input.operationId,
+      );
     return context.json(response);
   } catch (error) {
     return identityError(context, error);
@@ -132,6 +153,11 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings`, async (context) => {
     const request = await parseBody(context, LinkCanonicalHumanLoginBindingRequest);
+    if (["google", "github", "credential"].includes(request.providerId.trim().toLowerCase())) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with fresh provider proof",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "link",
       ...request,
@@ -141,6 +167,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.delete(`${base}/login-bindings/:bindingId`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with last-method protection",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "unlink",
       bindingId: bindingId(context),
@@ -151,6 +190,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Managed-provider recovery cannot be initiated through raw binding management",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "begin_recovery",
       bindingId: bindingId(context),
@@ -161,11 +213,20 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery/complete`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    const managed = projection.loginBindings.some(
+      (binding) =>
+        binding.id === bindingId(context) &&
+        ["google", "github", "credential"].includes(binding.providerId),
+    );
+    if (managed) await admitManagedSignInMutation(context, deps);
     return await mutate(context, deps, {
       operationType: "recover",
       bindingId: bindingId(context),
       ...request,
       operationId: request.operationId ?? randomUUID(),
+      ...(managed ? { verifiedManagedRecovery: true } : {}),
     });
   });
 }