@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/connections.ts

@@ -1,4 +1,25 @@
 import { createHash, createHmac } from "node:crypto";
+import { verifyDirectModelAccess } from "@opengeni/core";
+import {
+  assertClaudeWorkspaceCredential,
+  prepareClaudeWorkspaceCredential,
+} from "../claude-workspace-connection";
+import {
+  createConnectionIdempotently,
+  upsertWorkspaceProviderApiKeyConnection,
+  rotateWorkspaceProviderApiKeyConnection,
+  revokeWorkspaceProviderApiKeyConnections,
+  workspaceProviderApiKeyConnectionSpec,
+  type WorkspaceProviderApiKeyConnectionKind,
+  getConnectionCreationResult,
+  ConnectionCreateIdempotencyError,
+} from "@opengeni/db";
+import { sql } from "drizzle-orm";
+import { assertOrganizationIntegrationAllowed } from "@opengeni/contracts";
+import {
+  withOrganizationIntegrationAcquisition,
+  withOrganizationIntegrationPolicyFence,
+} from "@opengeni/db/organization-integration-policy";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import {
   startSlackBotInstall,
@@ -7,6 +28,9 @@ import {
 import {
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+  WORKSPACE_OPPER_CONNECTION_DOMAIN,
+  WORKSPACE_OPPER_CONNECTION_ROLE,
+  opperCredentialProblem,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
 } from "@opengeni/config";
@@ -21,6 +45,7 @@ import {
 import {
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   ApiIntegrationOAuthStartRequest,
+  DirectModelProviderMetadata,
   ConnectionResponse,
   CreateConnectionRequest,
   FikenInstallRequest,
@@ -31,6 +56,8 @@ import {
   ListConnectionsResponse,
   OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
   OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+  OPPER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  OPPER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
   OpenGeniSlackBotInstallRequest,
   OAuthStartRequest,
   OAuthStartResponse,
@@ -59,7 +86,9 @@ import {
 } from "@opengeni/contracts/personal-github";
 import {
   hasPermission,
+  listOwnConnectionAccountsForGrant,
   hasReservedFikenMetadata,
+  ONEPASSWORD_CREDENTIAL_ROLE,
   hasReservedOpenGeniSlackBotMetadata,
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata,
@@ -74,27 +103,21 @@ import {
   finishConnectOperation,
   getConnectAttempt,
   decryptEnvironmentValue,
-  createConnection,
   withWorkspaceSubjectRls,
   type Database,
   encryptEnvironmentValue,
+  brokeredCredentialBundleProblem,
   getConnectionMetadata,
   listConnectionsMetadata,
   listSlackInstallationBindings,
   persistSlackBotInstallationWithSuccessAudit,
   recordSlackBotInstallCallbackFailure,
   revokeConnection,
-  revokeWorkspaceOpenRouterConnections,
-  revokeWorkspaceVercelAiGatewayConnections,
   revokeConnectionWithSlackBotSuccessAudit,
-  rotateWorkspaceVercelAiGatewayConnection,
-  rotateWorkspaceOpenRouterConnection,
   SlackBotLifecycleSuccessAuditError,
   SlackInstallationBindingConflictError,
   updateConnection,
   updateSlackBotDocumentDestination,
-  upsertWorkspaceVercelAiGatewayConnection,
-  upsertWorkspaceOpenRouterConnection,
   type SlackBotInstallCallbackFailureReason,
   type SlackBotInstallCallbackFailureStage,
 } from "@opengeni/db";
@@ -114,6 +137,7 @@ import {
   isApiIntegrationProviderOAuthState,
   startApiIntegrationProviderOAuth,
 } from "../integrations/provider-oauth";
+import { offerClaudeDefaultModels } from "../claude-default-models";
 import { disconnectPersonalGitHub } from "../integrations/personal-github";
 import {
   browseAtlassianSources,
@@ -126,12 +150,14 @@ import {
 import {
   completeMcpOAuthCallback,
   integrationBaseUrl,
+  oauthStateFailureReturn,
   startMcpOAuth,
 } from "../integrations/oauth-client";
 import {
   assertPersonalConnectionOwnerPrincipal,
   isPersonalConnectionOwnerPrincipal,
   requireLegacyOAuthActor,
+  requireProviderConsentInBrowser,
 } from "../connection-ownership";
 import { canonicalProviderDomain } from "../integrations/provider-domain";
 import { externalActorContinuationForAuthorization } from "@opengeni/core";
@@ -152,6 +178,7 @@ import {
 } from "@opengeni/contracts";
 import { readSignedState } from "@opengeni/github";
 import { oauthStateTtlMs, requireIntegrationsStateSecret } from "../integrations/oauth-client";
+import { parseRequestJson } from "../http/request-body";
 
 type OpenGeniSlackInstallState = {
   connectAttemptId?: string;
@@ -185,6 +212,26 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/connections/accounts", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+    const includeInactive = c.req.query("includeInactive");
+    if (
+      includeInactive !== undefined &&
+      includeInactive !== "true" &&
+      includeInactive !== "false"
+    ) {
+      throw new HTTPException(400, { message: "includeInactive must be true or false" });
+    }
+    return c.json(
+      ListConnectionsResponse.parse({
+        connections: await listOwnConnectionAccountsForGrant(db, grant, {
+          includeInactive: includeInactive === "true",
+        }),
+      }),
+    );
+  });
+
   app.get("/v1/workspaces/:workspaceId/connections/slack-bot/bindings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
@@ -198,17 +245,72 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/connections/operations/:operationId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "connections:read");
+    const operationId = CreateConnectionRequest.shape.operationId
+      .unwrap()
+      .parse(c.req.param("operationId"));
+    const connection = await getConnectionCreationResult(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      operationId,
+    });
+    if (!connection) throw new HTTPException(404, { message: "Connection operation not found" });
+    return c.json(ConnectionResponse.parse({ connection }));
+  });
+
   app.post("/v1/workspaces/:workspaceId/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
     const grant = access.grant;
     const beforeCommit = externalContinuationCommitAuthorizer(access);
-    const payload = CreateConnectionRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateConnectionRequest);
+    if (
+      payload.metadata?.directModelProvider !== undefined ||
+      String(payload.metadata?.credentialRole ?? "").startsWith("direct_")
+    ) {
+      const config = DirectModelProviderMetadata.safeParse(payload.metadata?.directModelProvider);
+      const domain = config.success
+        ? new URL(config.data.endpoint ?? "https://api.openai.com/v1").hostname
+        : null;
+      if (
+        !config.success ||
+        payload.subjectId !== null ||
+        payload.kind !== "api_key" ||
+        canonicalProviderDomain(payload.providerDomain) !== domain ||
+        payload.metadata?.credentialRole !== `direct_${config.data.provider}` ||
+        typeof payload.credential.apiKey !== "string" ||
+        !payload.credential.apiKey.trim() ||
+        !payload.operationId ||
+        payload.expiresAt
+      ) {
+        throw new HTTPException(422, {
+          message:
+            "Invalid OpenAI or Azure OpenAI connection: provide a key, model, and official provider endpoint",
+        });
+      }
+      payload.metadata = { ...payload.metadata, directModelProvider: config.data };
+      if (payload.verifyModelAccess) {
+        await verifyDirectModelAccess(
+          config.data,
+          payload.credential.apiKey as string,
+          deps.directModelFetch,
+        );
+      }
+    } else if (payload.verifyModelAccess) {
+      throw new HTTPException(422, {
+        message: "Model checks require an OpenAI or Azure OpenAI connection",
+      });
+    }
+    const directModelKey = payload.metadata?.directModelProvider !== undefined;
     // All writes in this closure must use the caller-owned scoped transaction.
     // eslint-disable-next-line no-shadow
     const persist = async (db: Database) => {
       assertNotReservedSlackBotMetadata(payload.metadata);
       assertNotReservedFikenMetadata(payload.metadata);
+      assertNotReservedOnePasswordMetadata(payload.metadata);
       assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
       assertNotReservedPersonalGitHubMetadata(payload.metadata);
       const key = requireEnvironmentEncryption(settings);
@@ -217,6 +319,19 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         assertPersonalConnectionOwnerPrincipal(access);
       }
       const providerDomain = canonicalProviderDomain(payload.providerDomain);
+      payload.credential = prepareClaudeWorkspaceCredential(
+        settings,
+        workspaceId,
+        payload.metadata,
+        payload.credential,
+      );
+      assertClaudeWorkspaceCredential(settings, {
+        subjectId,
+        providerDomain,
+        kind: payload.kind,
+        metadata: payload.metadata,
+        credential: payload.credential,
+      });
       assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
       assertNotDirectGoogleDriveOAuth(providerDomain, payload.kind, payload.metadata);
       assertNotDirectAtlassianOAuth(providerDomain, payload.kind, payload.metadata);
@@ -228,6 +343,11 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
         kind: payload.kind,
         metadata: payload.metadata,
       });
+      // Validated model keys store `{ apiKey }` for model execution. Generic
+      // integration credentials still require an explicit broker destination.
+      if (!workspaceProviderKind && !directModelKey)
+        assertBrokeredApiKeyCredential(payload.kind, payload.credential);
+      if (workspaceProviderKind === "opper") assertOpperCredential(payload.credential);
       const connection = workspaceProviderKind
         ? await (async () => {
             const provider = workspaceProviderApiKeyConnectionSpec(workspaceProviderKind);
@@ -261,18 +381,26 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
               metadata,
               updatedBySubjectId: grant.subjectId,
             };
-            const created =
-              workspaceProviderKind === "vercel_gateway"
-                ? await upsertWorkspaceVercelAiGatewayConnection(db, input)
-                : await upsertWorkspaceOpenRouterConnection(db, input);
+            const created = await upsertWorkspaceProviderApiKeyConnection(
+              db,
+              workspaceProviderKind,
+              input,
+            );
             if (!created || created.status === "revoked") {
               throw new HTTPException(409, {
                 message: `${provider.label} is already connected; reload before replacing its key`,
               });
             }
+            if (workspaceProviderKind === "anthropic")
+              await offerClaudeDefaultModels(deps, {
+                accountId: grant.accountId,
+                workspaceId,
+                actorSubjectId: grant.subjectId,
+                providerKind: "anthropic",
+              });
             return created;
           })()
-        : await createConnection(db, {
+        : await createConnectionIdempotently(db, {
             accountId: grant.accountId,
             workspaceId,
             subjectId,
@@ -283,15 +411,56 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
             expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null,
             metadata: payload.metadata,
             createdBySubjectId: grant.subjectId,
+            ...(payload.operationId
+              ? {
+                  operation: {
+                    id: payload.operationId,
+                    requestDigest: workspaceProviderCredentialRequestDigest(key, {
+                      action: "create",
+                      providerDomain,
+                      kind: payload.kind,
+                      subjectId,
+                      credential: payload.credential,
+                      grantedScopes: payload.grantedScopes,
+                      expiresAt: payload.expiresAt
+                        ? new Date(payload.expiresAt).toISOString()
+                        : null,
+                      metadata: payload.metadata,
+                    }),
+                  },
+                }
+              : {}),
+          }).catch((error: unknown) => {
+            if (error instanceof ConnectionCreateIdempotencyError) {
+              throw new HTTPException(409, { message: error.message });
+            }
+            throw error;
           });
       return c.json(ConnectionResponse.parse({ connection }), 201);
     };
-    return beforeCommit
-      ? withWorkspaceSubjectRls(db, workspaceId, grant.subjectId, async (tx) => {
-          await beforeCommit(tx);
-          return persist(tx);
-        })
-      : persist(db);
+    const commit = (database: Database) =>
+      beforeCommit
+        ? withWorkspaceSubjectRls(database, workspaceId, grant.subjectId, async (tx) => {
+            await beforeCommit(tx);
+            return persist(tx);
+          })
+        : persist(database);
+    // Only the canonical workspace model-key lane is outside integration policy.
+    // Generic credentials have no validated protocol/curated target in this contract.
+    const modelKey = workspaceProviderApiKeyConnectionKind({
+      subjectId: createConnectionSubjectId(payload, grant.subjectId),
+      providerDomain: canonicalProviderDomain(payload.providerDomain),
+      kind: payload.kind,
+      metadata: payload.metadata,
+    });
+    return modelKey || directModelKey
+      ? commit(db)
+      : withOrganizationIntegrationAcquisition(
+          db,
+          { accountId: grant.accountId, workspaceId },
+          [null],
+          commit,
+        );
   });
 
   app.post("/v1/workspaces/:workspaceId/connections/slack-bot/install", async (c) => {
@@ -299,15 +468,24 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
     requireLegacyOAuthActor(access);
     const grant = access.grant;
-    const payload = OpenGeniSlackBotInstallRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, OpenGeniSlackBotInstallRequest);
     return c.json(
-      await startSlackBotInstall(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        requestUrl: c.req.url,
-        ...(payload.connectionId ? { connectionId: payload.connectionId } : {}),
-      }),
+      await withOrganizationIntegrationAcquisition(
+        db,
+        { accountId: grant.accountId, workspaceId },
+        ["slack-bot"],
+        (tx) =>
+          startSlackBotInstall(
+            { ...deps, db: tx },
+            {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              requestUrl: c.req.url,
+              ...(payload.connectionId ? { connectionId: payload.connectionId } : {}),
+            },
+          ),
+      ),
     );
   });
 
@@ -329,12 +507,25 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           operationId: `oauth:${state.nonce}`,
           inputDigest: createHash("sha256").update(c.req.query("state")!).digest("hex"),
         };
-        const claim = await claimConnectOperation(db, state, {
-          ...operation,
-          expectedRevision: stored.attempt.revision,
-          authorize: (tx, _attempt, origin) =>
-            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-        });
+        const callbackState = state;
+        const callbackOperation = operation;
+        const claim = await withOrganizationIntegrationPolicyFence(
+          db,
+          callbackState,
+          (policyTx, policy) =>
+            claimConnectOperation(policyTx, callbackState, {
+              ...callbackOperation,
+              expectedRevision: stored.attempt.revision,
+              authorize: (tx, _attempt, origin) =>
+                requireConnectOwnerAuthority(tx, callbackState, "connections:write", origin),
+              authorizeAcquisition: async () => {
+                // Provider denial/cancellation acquires nothing; completed exact
+                // receipts replay before this callback is invoked.
+                if (!c.req.query("error") && c.req.query("code"))
+                  assertOrganizationIntegrationAllowed(policy, "slack-bot");
+              },
+            }),
+        );
         if (claim.status === "replayed")
           return new Response(null, { status: 302, headers: { Location: exactReturnUrl } });
       }
@@ -391,6 +582,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           "Slack installation callback is missing code",
         );
       }
+      await withOrganizationIntegrationAcquisition(db, state, ["slack-bot"], async () => {});
       const slack = requireOpenGeniSlackOAuthSettings(settings);
       const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
       const authorization = await exchangeOpenGeniSlackAuthorizationCode(
@@ -424,35 +616,44 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
           verified,
         });
       if (operation) {
-        await finishConnectOperation(db, acceptedState, {
-          ...operation,
-          authorize: (tx, _attempt, origin) =>
-            requireConnectOwnerAuthority(tx, acceptedState, "connections:write", origin),
-          commit: async (tx, current) => {
-            const connection = await persist(tx);
-            return {
-              ...current,
-              revision: current.revision + 1,
-              state: "complete",
-              credentialsCommitted: true,
-              nextAction: { type: "none" },
-              account: {
-                id: connection.id,
-                version: connection.version,
-                providerId: "slack-bot",
-                label: "Slack workspace bot",
-                ownership: "workspace",
-                status: "connected",
-              },
-            };
-          },
-        });
+        const acceptedOperation = operation;
+        await withOrganizationIntegrationPolicyFence(db, acceptedState, (policyTx, policy) =>
+          finishConnectOperation(policyTx, acceptedState, {
+            ...acceptedOperation,
+            authorize: (tx, _attempt, origin) =>
+              requireConnectOwnerAuthority(tx, acceptedState, "connections:write", origin),
+            commit: async (tx, current) => {
+              assertOrganizationIntegrationAllowed(policy, "slack-bot");
+              const connection = await persist(tx);
+              return {
+                ...current,
+                revision: current.revision + 1,
+                state: "complete",
+                credentialsCommitted: true,
+                nextAction: { type: "none" },
+                account: {
+                  id: connection.id,
+                  version: connection.version,
+                  providerId: "slack-bot",
+                  label: "Slack workspace bot",
+                  ownership: "workspace",
+                  status: "connected",
+                },
+              };
+            },
+          }),
+        );
         return new Response(null, { status: 302, headers: { Location: exactReturnUrl! } });
       }
-      const connection = await db.transaction(async (tx) => {
-        await requireSlackInstallCallbackGrant(tx, acceptedState);
-        return persist(tx);
-      });
+      const connection = await withOrganizationIntegrationAcquisition(
+        db,
+        acceptedState,
+        ["slack-bot"],
+        async (tx) => {
+          await requireSlackInstallCallbackGrant(tx, acceptedState);
+          return persist(tx);
+        },
+      );
       return c.redirect(
         slackInstallReturnUrl(baseUrl, state.returnPath, "connected", connection.id),
         302,
@@ -480,7 +681,12 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       }
       const reason = slackInstallErrorReason(error);
       return c.redirect(
-        slackInstallReturnUrl(baseUrl, state?.returnPath ?? "/integrations", "error", reason),
+        slackInstallReturnUrl(
+          baseUrl,
+          state?.returnPath ?? oauthStateFailureReturn(settings, c.req.query("state")).returnPath,
+          "error",
+          reason,
+        ),
         302,
       );
     }
@@ -499,19 +705,24 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       "connections:write",
     );
     const grant = authorization.grant;
-    const payload = FikenInstallRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, FikenInstallRequest);
     const persist = await prepareFikenTokenInstall(deps, grant, payload);
     const continuation = externalActorContinuationForAuthorization(authorization);
-    const connection = await db.transaction(async (tx) => {
-      await requireConnectOwnerAuthority(tx, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        personalOwnerVerified: isPersonalConnectionOwnerPrincipal(authorization),
-        ...(continuation ? { externalContinuation: continuation } : {}),
-      });
-      return persist(tx);
-    });
+    const connection = await withOrganizationIntegrationAcquisition(
+      db,
+      { accountId: grant.accountId, workspaceId },
+      ["fiken"],
+      async (tx) => {
+        await requireConnectOwnerAuthority(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          personalOwnerVerified: isPersonalConnectionOwnerPrincipal(authorization),
+          ...(continuation ? { externalContinuation: continuation } : {}),
+        });
+        return persist(tx);
+      },
+    );
     return c.json(ConnectionResponse.parse({ connection }), payload.connectionId ? 200 : 201);
   });
 
@@ -523,7 +734,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
     requireLegacyOAuthActor(access);
     const grant = access.grant;
-    const payload = FikenOAuthStartRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, FikenOAuthStartRequest);
     requireEnvironmentEncryption(settings);
     return c.json(
       FikenOAuthStartResponse.parse(
@@ -788,259 +999,356 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       "connections:write",
     );
     const { grant } = authorization;
-    const payload = UpdateConnectionRequest.parse(await c.req.json());
-    assertNotReservedSlackBotMetadata(payload.metadata);
-    assertNotReservedFikenMetadata(payload.metadata);
-    assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
-    assertNotReservedPersonalGitHubMetadata(payload.metadata);
-    const existing = await getConnectionMetadata(
+    const payload = await parseRequestJson(c, UpdateConnectionRequest);
+    // Policy first, then the existing tenancy prefix and exact credential row.
+    // The locked live identity makes unchanged/reducing updates safe against a
+    // concurrent replacement; all final writes below use this same transaction.
+    return withOrganizationIntegrationPolicyFence(
       db,
-      workspaceId,
-      c.req.param("connectionId"),
-      grant.subjectId,
-    );
-    if (existing && isOpenGeniSlackBotConnection(existing)) {
-      const destination = ConnectorDocumentDestinationSelection.safeParse(
-        payload.metadata?.documentDestination,
-      );
-      const destinationOnlyUpdate =
-        payload.metadata !== undefined &&
-        Object.keys(payload.metadata).length === 1 &&
-        payload.providerDomain === undefined &&
-        payload.subjectId === undefined &&
-        payload.kind === undefined &&
-        payload.status === undefined &&
-        payload.credential === undefined &&
-        payload.grantedScopes === undefined &&
-        payload.expiresAt === undefined;
-      if (!destination.success || !destinationOnlyUpdate) {
-        throw new HTTPException(422, {
-          message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection",
-        });
-      }
-      const destinationSelection = destination.data;
-      if (
-        destinationSelection.authorityKind === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") !== true
-      ) {
-        throw new HTTPException(403, { message: "missing permission: account:admin" });
-      }
-      if (
-        destinationSelection.authorityKind === "workspace" &&
-        !hasPermission(grant.permissions, "workspace:admin")
-      ) {
-        throw new HTTPException(403, { message: "missing permission: workspace:admin" });
-      }
-      if (
-        destinationSelection.authorityKind === "personal" &&
-        (!authorization.contextIntegrity ||
-          authorization.authenticatedSubjectId !== grant.subjectId)
-      ) {
-        throw new HTTPException(403, {
-          message: "personal destination requires the exact actor",
-        });
-      }
-      const metadata = {
-        ...existing.metadata,
-        documentDestination: bindConnectorDocumentDestination(destinationSelection, {
-          accountId: grant.accountId,
-          workspaceId,
-          initiatingSubjectId: grant.subjectId,
-        }),
-      };
-      const connection = await updateSlackBotDocumentDestination(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        connectionId: existing.id,
-        visibleToSubjectId: grant.subjectId,
-        expectedVersion: existing.version,
-        metadata,
-        updatedBySubjectId: grant.subjectId,
-      });
-      if (!connection) {
-        throw new HTTPException(409, {
-          message: "Slack bot connection changed; reload before saving its destination",
-        });
-      }
-      return c.json(ConnectionResponse.parse({ connection }));
-    }
-    if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
-      throw new HTTPException(422, {
-        message: "use the dedicated Google Drive reconnect or source-selection flow",
-      });
-    }
-    if (existing?.metadata.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE) {
-      throw new HTTPException(422, {
-        message: "use the dedicated Integration provider OAuth flow to update this connection",
-      });
-    }
-    if (existing && AtlassianConnectionMetadata.safeParse(existing.metadata).success) {
-      throw new HTTPException(422, {
-        message: "use the dedicated Atlassian reconnect or source-selection flow",
-      });
-    }
-    if (existing && isPersonalGitHubConnection(existing)) {
-      throw new HTTPException(422, {
-        message: "use the dedicated personal GitHub reconnect flow to update this connection",
-      });
-    }
-    if (existing) {
-      const providerDomain = canonicalProviderDomain(
-        payload.providerDomain ?? existing.providerDomain,
-      );
-      const kind = payload.kind ?? existing.kind;
-      const subjectId =
-        payload.subjectId === undefined
-          ? existing.subjectId
-          : writableSubjectId(payload.subjectId, grant.subjectId);
-      const targetWorkspaceProviderKind = workspaceProviderApiKeyConnectionKind({
-        subjectId,
-        providerDomain,
-        kind,
-        metadata: payload.metadata ?? existing.metadata,
-      });
-      if (!workspaceProviderApiKeyConnectionKind(existing) && targetWorkspaceProviderKind) {
-        throw new HTTPException(422, {
-          message:
-            targetWorkspaceProviderKind === "vercel_gateway"
-              ? "use the Vercel AI Gateway connect flow to create this connection"
-              : "use the OpenRouter connect flow to create this connection",
-        });
-      }
-      assertNotDirectPersonalSlackOAuth(providerDomain, kind);
-      assertNotDirectGoogleDriveOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
-      assertNotDirectAtlassianOAuth(providerDomain, kind, payload.metadata ?? existing.metadata);
-      assertNotDirectPersonalGitHubOAuth(
-        providerDomain,
-        kind,
-        payload.metadata ?? existing.metadata,
-      );
-    }
-    // Status is not a free-form field: revocation goes through DELETE, and the
-    // broker owns needs_reauth/error. Reactivating a connection is only
-    // meaningful together with a fresh credential bundle — otherwise a PATCH
-    // could clear the broker's re-auth signal while stale tokens stay in place.
-    if (payload.status !== undefined) {
-      if (payload.status !== "active") {
-        throw new HTTPException(400, {
-          message: 'status can only be set to "active"; use DELETE to revoke',
-        });
-      }
-      if (payload.credential === undefined) {
-        throw new HTTPException(400, {
-          message: "reactivating a connection requires a new credential",
-        });
-      }
-    }
-    const existingWorkspaceProviderKind = existing
-      ? workspaceProviderApiKeyConnectionKind(existing)
-      : null;
-    if (existing && existingWorkspaceProviderKind) {
-      const provider = workspaceProviderApiKeyConnectionSpec(existingWorkspaceProviderKind);
-      const providerDomain = canonicalProviderDomain(
-        payload.providerDomain ?? existing.providerDomain,
-      );
-      const subjectId =
-        payload.subjectId === undefined
-          ? existing.subjectId
-          : writableSubjectId(payload.subjectId, grant.subjectId);
-      const kind = payload.kind ?? existing.kind;
-      if (
-        subjectId !== null ||
-        providerDomain !== provider.providerDomain ||
-        kind !== "api_key" ||
-        (payload.metadata?.credentialRole !== undefined &&
-          payload.metadata.credentialRole !== provider.credentialRole)
-      ) {
-        throw new HTTPException(422, {
-          message: `${provider.label} connection identity cannot be changed`,
-        });
-      }
-      if (payload.credential === undefined) {
-        throw new HTTPException(400, {
-          message: `updating a ${provider.label} connection requires a new credential`,
-        });
-      }
-      if (payload.expectedVersion === undefined || payload.operationId === undefined) {
-        throw new HTTPException(400, {
-          message: `updating a ${provider.label} connection requires expectedVersion and operationId`,
-        });
-      }
-      const key = requireEnvironmentEncryption(settings);
-      const grantedScopes = payload.grantedScopes ?? existing.grantedScopes;
-      const expiresAt =
-        payload.expiresAt !== undefined
-          ? payload.expiresAt
-            ? new Date(payload.expiresAt)
-            : null
-          : existing.expiresAt
-            ? new Date(existing.expiresAt)
+      { accountId: grant.accountId, workspaceId },
+      (policyTx, policy) =>
+        // eslint-disable-next-line no-shadow -- every existing final writer must use this exact scoped transaction
+        withWorkspaceSubjectRls(policyTx, workspaceId, grant.subjectId, async (db) => {
+          const initial = await getConnectionMetadata(
+            db,
+            workspaceId,
+            c.req.param("connectionId"),
+            grant.subjectId,
+          );
+          if (
+            initial?.metadata.directModelProvider !== undefined ||
+            payload.metadata?.directModelProvider !== undefined ||
+            String(payload.metadata?.credentialRole ?? "").startsWith("direct_")
+          ) {
+            throw new HTTPException(422, {
+              message:
+                "Disconnect and reconnect OpenAI or Azure OpenAI to replace its key or deployment",
+            });
+          }
+          // Model-key rotation owns an advisory -> credential-row prefix. Do
+          // not take its row first or change that excluded lane's lock order.
+          if (!initial || !workspaceProviderApiKeyConnectionKind(initial)) {
+            await db.execute(
+              sql`select id from connections where workspace_id = ${workspaceId}::uuid and id = ${c.req.param("connectionId")}::uuid and (subject_id is null or subject_id = ${grant.subjectId}) for update`,
+            );
+          }
+          assertNotReservedSlackBotMetadata(payload.metadata);
+          assertNotReservedFikenMetadata(payload.metadata);
+          assertNotReservedOnePasswordMetadata(payload.metadata);
+          assertNotReservedApiIntegrationOAuthMetadata(payload.metadata);
+          assertNotReservedPersonalGitHubMetadata(payload.metadata);
+          const existing = await getConnectionMetadata(
+            db,
+            workspaceId,
+            c.req.param("connectionId"),
+            grant.subjectId,
+          );
+          if (existing && isOpenGeniSlackBotConnection(existing)) {
+            const destination = ConnectorDocumentDestinationSelection.safeParse(
+              payload.metadata?.documentDestination,
+            );
+            const destinationOnlyUpdate =
+              payload.metadata !== undefined &&
+              Object.keys(payload.metadata).length === 1 &&
+              payload.providerDomain === undefined &&
+              payload.subjectId === undefined &&
+              payload.kind === undefined &&
+              payload.status === undefined &&
+              payload.credential === undefined &&
+              payload.grantedScopes === undefined &&
+              payload.expiresAt === undefined;
+            if (!destination.success || !destinationOnlyUpdate) {
+              throw new HTTPException(422, {
+                message:
+                  "use the dedicated Opengeni Slack bot reinstall flow to update this connection",
+              });
+            }
+            const destinationSelection = destination.data;
+            if (
+              destinationSelection.authorityKind === "organization" &&
+              authorization.accountGrant?.permissions.includes("account:admin") !== true
+            ) {
+              throw new HTTPException(403, { message: "missing permission: account:admin" });
+            }
+            if (
+              destinationSelection.authorityKind === "workspace" &&
+              !hasPermission(grant.permissions, "workspace:admin")
+            ) {
+              throw new HTTPException(403, { message: "missing permission: workspace:admin" });
+            }
+            if (
+              destinationSelection.authorityKind === "personal" &&
+              (!authorization.contextIntegrity ||
+                authorization.authenticatedSubjectId !== grant.subjectId)
+            ) {
+              throw new HTTPException(403, {
+                message: "personal destination requires the exact actor",
+              });
+            }
+            const metadata = {
+              ...existing.metadata,
+              documentDestination: bindConnectorDocumentDestination(destinationSelection, {
+                accountId: grant.accountId,
+                workspaceId,
+                initiatingSubjectId: grant.subjectId,
+              }),
+            };
+            if (
+              stableJson(metadata.documentDestination) !==
+              stableJson(existing.metadata.documentDestination)
+            ) {
+              assertOrganizationIntegrationAllowed(policy, "slack-bot");
+            }
+            const connection = await updateSlackBotDocumentDestination(db, {
+              accountId: grant.accountId,
+              workspaceId,
+              connectionId: existing.id,
+              visibleToSubjectId: grant.subjectId,
+              expectedVersion: existing.version,
+              metadata,
+              updatedBySubjectId: grant.subjectId,
+            });
+            if (!connection) {
+              throw new HTTPException(409, {
+                message: "Slack bot connection changed; reload before saving its destination",
+              });
+            }
+            return c.json(ConnectionResponse.parse({ connection }));
+          }
+          if (existing && GoogleDriveConnectionMetadata.safeParse(existing.metadata).success) {
+            throw new HTTPException(422, {
+              message: "use the dedicated Google Drive reconnect or source-selection flow",
+            });
+          }
+          if (existing?.metadata.credentialRole === API_INTEGRATION_OAUTH_CREDENTIAL_ROLE) {
+            throw new HTTPException(422, {
+              message:
+                "use the dedicated Integration provider OAuth flow to update this connection",
+            });
+          }
+          if (existing && AtlassianConnectionMetadata.safeParse(existing.metadata).success) {
+            throw new HTTPException(422, {
+              message: "use the dedicated Atlassian reconnect or source-selection flow",
+            });
+          }
+          if (existing && isPersonalGitHubConnection(existing)) {
+            throw new HTTPException(422, {
+              message: "use the dedicated personal GitHub reconnect flow to update this connection",
+            });
+          }
+          if (existing) {
+            const providerDomain = canonicalProviderDomain(
+              payload.providerDomain ?? existing.providerDomain,
+            );
+            const kind = payload.kind ?? existing.kind;
+            const subjectId =
+              payload.subjectId === undefined
+                ? existing.subjectId
+                : writableSubjectId(payload.subjectId, grant.subjectId);
+            const targetWorkspaceProviderKind = workspaceProviderApiKeyConnectionKind({
+              subjectId,
+              providerDomain,
+              kind,
+              metadata: payload.metadata ?? existing.metadata,
+            });
+            if (!workspaceProviderApiKeyConnectionKind(existing) && targetWorkspaceProviderKind) {
+              throw new HTTPException(422, {
+                message:
+                  targetWorkspaceProviderKind === "vercel_gateway"
+                    ? "use the Vercel AI Gateway connect flow to create this connection"
+                    : targetWorkspaceProviderKind === "opper"
+                      ? "use the Opper connect flow to create this connection"
+                      : "use the OpenRouter connect flow to create this connection",
+              });
+            }
+            assertNotDirectPersonalSlackOAuth(providerDomain, kind);
+            assertNotDirectGoogleDriveOAuth(
+              providerDomain,
+              kind,
+              payload.metadata ?? existing.metadata,
+            );
+            assertNotDirectAtlassianOAuth(
+              providerDomain,
+              kind,
+              payload.metadata ?? existing.metadata,
+            );
+            assertNotDirectPersonalGitHubOAuth(
+              providerDomain,
+              kind,
+              payload.metadata ?? existing.metadata,
+            );
+          }
+          // Status is not a free-form field: revocation goes through DELETE, and the
+          // broker owns needs_reauth/error. Reactivating a connection is only
+          // meaningful together with a fresh credential bundle — otherwise a PATCH
+          // could clear the broker's re-auth signal while stale tokens stay in place.
+          if (payload.status !== undefined) {
+            if (payload.status !== "active") {
+              throw new HTTPException(400, {
+                message: 'status can only be set to "active"; use DELETE to revoke',
+              });
+            }
+            if (payload.credential === undefined) {
+              throw new HTTPException(400, {
+                message: "reactivating a connection requires a new credential",
+              });
+            }
+          }
+          const existingWorkspaceProviderKind = existing
+            ? workspaceProviderApiKeyConnectionKind(existing)
             : null;
-      const metadata = workspaceProviderCredentialMetadata(existingWorkspaceProviderKind, {
-        ...existing.metadata,
-        ...(payload.metadata ?? {}),
-      });
-      const input = {
-        accountId: grant.accountId,
-        workspaceId,
-        connectionId: existing.id,
-        expectedVersion: payload.expectedVersion,
-        operationId: payload.operationId,
-        requestDigest: workspaceProviderCredentialRequestDigest(key, {
-          action: "rotate",
-          connectionId: existing.id,
-          expectedVersion: payload.expectedVersion,
-          credential: payload.credential,
-          grantedScopes,
-          expiresAt: expiresAt?.toISOString() ?? null,
-          metadata,
+          if (existing && existingWorkspaceProviderKind) {
+            const provider = workspaceProviderApiKeyConnectionSpec(existingWorkspaceProviderKind);
+            const providerDomain = canonicalProviderDomain(
+              payload.providerDomain ?? existing.providerDomain,
+            );
+            const subjectId =
+              payload.subjectId === undefined
+                ? existing.subjectId
+                : writableSubjectId(payload.subjectId, grant.subjectId);
+            const kind = payload.kind ?? existing.kind;
+            if (
+              subjectId !== null ||
+              providerDomain !== provider.providerDomain ||
+              kind !== "api_key" ||
+              (payload.metadata?.credentialRole !== undefined &&
+                payload.metadata.credentialRole !== provider.credentialRole)
+            ) {
+              throw new HTTPException(422, {
+                message: `${provider.label} connection identity cannot be changed`,
+              });
+            }
+            if (payload.credential === undefined) {
+              throw new HTTPException(400, {
+                message: `updating a ${provider.label} connection requires a new credential`,
+              });
+            }
+            if (payload.expectedVersion === undefined || payload.operationId === undefined) {
+              throw new HTTPException(400, {
+                message: `updating a ${provider.label} connection requires expectedVersion and operationId`,
+              });
+            }
+            payload.credential = prepareClaudeWorkspaceCredential(
+              settings,
+              workspaceId,
+              existing.metadata,
+              payload.credential,
+            );
+            assertClaudeWorkspaceCredential(settings, {
+              subjectId,
+              providerDomain,
+              kind,
+              metadata: existing.metadata,
+              credential: payload.credential,
+            });
+            if (existingWorkspaceProviderKind === "opper")
+              assertOpperCredential(payload.credential);
+            const key = requireEnvironmentEncryption(settings);
+            const grantedScopes = payload.grantedScopes ?? existing.grantedScopes;
+            const expiresAt =
+              payload.expiresAt !== undefined
+                ? payload.expiresAt
+                  ? new Date(payload.expiresAt)
+                  : null
+                : existing.expiresAt
+                  ? new Date(existing.expiresAt)
+                  : null;
+            const metadata = workspaceProviderCredentialMetadata(existingWorkspaceProviderKind, {
+              ...existing.metadata,
+              ...(payload.metadata ?? {}),
+            });
+            const input = {
+              accountId: grant.accountId,
+              workspaceId,
+              connectionId: existing.id,
+              expectedVersion: payload.expectedVersion,
+              operationId: payload.operationId,
+              requestDigest: workspaceProviderCredentialRequestDigest(key, {
+                action: "rotate",
+                connectionId: existing.id,
+                expectedVersion: payload.expectedVersion,
+                credential: payload.credential,
+                grantedScopes,
+                expiresAt: expiresAt?.toISOString() ?? null,
+                metadata,
+              }),
+              credentialEncrypted: encryptCredentialBundle(key, payload.credential),
+              grantedScopes,
+              expiresAt,
+              metadata,
+              updatedBySubjectId: grant.subjectId,
+            };
+            const connection = await rotateWorkspaceProviderApiKeyConnection(
+              db,
+              existingWorkspaceProviderKind,
+              input,
+            );
+            if (!connection) {
+              throw new HTTPException(409, {
+                message: `${provider.label} connection changed; reload before replacing its key`,
+              });
+            }
+            return c.json(ConnectionResponse.parse({ connection }));
+          }
+          const key =
+            payload.credential === undefined ? null : requireEnvironmentEncryption(settings);
+          const subjectId =
+            payload.subjectId === undefined
+              ? undefined
+              : writableSubjectId(payload.subjectId, grant.subjectId);
+          if (
+            existing &&
+            (payload.credential !== undefined ||
+              (payload.providerDomain !== undefined &&
+                canonicalProviderDomain(payload.providerDomain) !== existing.providerDomain) ||
+              (payload.kind !== undefined && payload.kind !== existing.kind) ||
+              (subjectId !== undefined && subjectId !== existing.subjectId) ||
+              payload.grantedScopes?.some((scope) => !existing.grantedScopes.includes(scope)) ||
+              (payload.metadata !== undefined &&
+                ["mcpUrl", "resource", "credentialRole"].some(
+                  (field) =>
+                    stableJson(payload.metadata?.[field] ?? null) !==
+                    stableJson(existing.metadata[field] ?? null),
+                )) ||
+              (payload.expiresAt !== undefined &&
+                existing.expiresAt !== null &&
+                (payload.expiresAt === null ||
+                  Date.parse(payload.expiresAt) > Date.parse(existing.expiresAt))) ||
+              (payload.status === "active" && existing.status !== "active"))
+          ) {
+            assertOrganizationIntegrationAllowed(policy, null);
+          }
+          if (payload.credential !== undefined) {
+            assertBrokeredApiKeyCredential(payload.kind ?? existing?.kind, payload.credential);
+          }
+          const connection = await updateConnection(db, {
+            workspaceId,
+            connectionId: c.req.param("connectionId"),
+            visibleToSubjectId: grant.subjectId,
+            updatedBySubjectId: grant.subjectId,
+            ...(payload.providerDomain !== undefined
+              ? { providerDomain: canonicalProviderDomain(payload.providerDomain) }
+              : {}),
+            ...(subjectId !== undefined ? { subjectId } : {}),
+            ...(payload.kind !== undefined ? { kind: payload.kind } : {}),
+            ...(payload.status !== undefined ? { status: payload.status } : {}),
+            ...(payload.credential !== undefined && key
+              ? { credentialEncrypted: encryptCredentialBundle(key, payload.credential) }
+              : {}),
+            ...(payload.grantedScopes !== undefined
+              ? { grantedScopes: payload.grantedScopes }
+              : {}),
+            ...(payload.expiresAt !== undefined
+              ? { expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null }
+              : {}),
+            ...(payload.metadata !== undefined ? { metadata: payload.metadata } : {}),
+          });
+          if (!connection) {
+            throw new HTTPException(404, { message: "connection not found" });
+          }
+          return c.json(ConnectionResponse.parse({ connection }));
         }),
-        credentialEncrypted: encryptCredentialBundle(key, payload.credential),
-        grantedScopes,
-        expiresAt,
-        metadata,
-        updatedBySubjectId: grant.subjectId,
-      };
-      const connection =
-        existingWorkspaceProviderKind === "vercel_gateway"
-          ? await rotateWorkspaceVercelAiGatewayConnection(db, input)
-          : await rotateWorkspaceOpenRouterConnection(db, input);
-      if (!connection) {
-        throw new HTTPException(409, {
-          message: `${provider.label} connection changed; reload before replacing its key`,
-        });
-      }
-      return c.json(ConnectionResponse.parse({ connection }));
-    }
-    const key = payload.credential === undefined ? null : requireEnvironmentEncryption(settings);
-    const subjectId =
-      payload.subjectId === undefined
-        ? undefined
-        : writableSubjectId(payload.subjectId, grant.subjectId);
-    const connection = await updateConnection(db, {
-      workspaceId,
-      connectionId: c.req.param("connectionId"),
-      visibleToSubjectId: grant.subjectId,
-      updatedBySubjectId: grant.subjectId,
-      ...(payload.providerDomain !== undefined
-        ? { providerDomain: canonicalProviderDomain(payload.providerDomain) }
-        : {}),
-      ...(subjectId !== undefined ? { subjectId } : {}),
-      ...(payload.kind !== undefined ? { kind: payload.kind } : {}),
-      ...(payload.status !== undefined ? { status: payload.status } : {}),
-      ...(payload.credential !== undefined && key
-        ? { credentialEncrypted: encryptCredentialBundle(key, payload.credential) }
-        : {}),
-      ...(payload.grantedScopes !== undefined ? { grantedScopes: payload.grantedScopes } : {}),
-      ...(payload.expiresAt !== undefined
-        ? { expiresAt: payload.expiresAt ? new Date(payload.expiresAt) : null }
-        : {}),
-      ...(payload.metadata !== undefined ? { metadata: payload.metadata } : {}),
-    });
-    if (!connection) {
-      throw new HTTPException(404, { message: "connection not found" });
-    }
-    return c.json(ConnectionResponse.parse({ connection }));
+    );
   });
 
   app.delete("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
@@ -1154,21 +1462,13 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
                 slackTeamId: openGeniSlackBotMetadata(existing.metadata)!.slackTeamId,
               })
             : workspaceProviderKind
-              ? workspaceProviderKind === "vercel_gateway"
-                ? await revokeWorkspaceVercelAiGatewayConnections(db, {
-                    accountId: grant.accountId,
-                    workspaceId,
-                    connectionId,
-                    expectedVersion: existing.version,
-                    updatedBySubjectId: grant.subjectId,
-                  })
-                : await revokeWorkspaceOpenRouterConnections(db, {
-                    accountId: grant.accountId,
-                    workspaceId,
-                    connectionId,
-                    expectedVersion: existing.version,
-                    updatedBySubjectId: grant.subjectId,
-                  })
+              ? await revokeWorkspaceProviderApiKeyConnections(db, workspaceProviderKind, {
+                  accountId: grant.accountId,
+                  workspaceId,
+                  connectionId,
+                  expectedVersion: existing.version,
+                  updatedBySubjectId: grant.subjectId,
+                })
               : await revokeConnection(
                   db,
                   workspaceId,
@@ -1186,6 +1486,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    requireProviderConsentInBrowser(access);
     const grant = access.grant;
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
@@ -1215,6 +1516,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     assertIntegrationsEnabled();
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "connections:write");
+    requireProviderConsentInBrowser(access);
     const grant = access.grant;
     const parsed = ApiIntegrationOAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
@@ -1280,7 +1582,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(
       IntegrationClientMetadata.parse({
         client_id: metadataUrl,
-        client_name: "OpenGeni",
+        client_name: "Opengeni",
         redirect_uris: [`${baseUrl}/v1/integrations/oauth/callback`],
         token_endpoint_auth_method: "none",
         grant_types: ["authorization_code", "refresh_token"],
@@ -1319,7 +1621,7 @@ async function persistOpenGeniSlackBotConnection(input: {
     throw new SlackInstallCallbackError(
       422,
       "connection_conflict",
-      "connectionId is not an OpenGeni Slack bot connection",
+      "connectionId is not an Opengeni Slack bot connection",
       "principal_validation",
     );
   }
@@ -1598,28 +1900,6 @@ function assertNotReservedPersonalGitHubMetadata(
   }
 }
 
-type WorkspaceProviderApiKeyConnectionKind = "vercel_gateway" | "openrouter";
-
-function workspaceProviderApiKeyConnectionSpec(
-  providerKind: WorkspaceProviderApiKeyConnectionKind,
-): {
-  providerDomain: string;
-  credentialRole: string;
-  label: string;
-} {
-  return providerKind === "vercel_gateway"
-    ? {
-        providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
-        credentialRole: VERCEL_AI_GATEWAY_CONNECTION_ROLE,
-        label: "Vercel AI Gateway",
-      }
-    : {
-        providerDomain: WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
-        credentialRole: WORKSPACE_OPENROUTER_CONNECTION_ROLE,
-        label: "OpenRouter",
-      };
-}
-
 function workspaceProviderApiKeyConnectionKind(input: {
   subjectId?: string | null;
   providerDomain: string;
@@ -1628,6 +1908,12 @@ function workspaceProviderApiKeyConnectionKind(input: {
 }): WorkspaceProviderApiKeyConnectionKind | null {
   if (input.subjectId != null || input.kind !== "api_key") return null;
   const providerDomain = input.providerDomain.toLowerCase();
+  if (
+    providerDomain === "api.anthropic.com" &&
+    (input.metadata?.credentialRole === "anthropic" ||
+      input.metadata?.credentialRole === "claude_subscription")
+  )
+    return input.metadata.credentialRole;
   if (
     providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN &&
     input.metadata?.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE
@@ -1640,13 +1926,40 @@ function workspaceProviderApiKeyConnectionKind(input: {
   ) {
     return "openrouter";
   }
+  if (
+    providerDomain === WORKSPACE_OPPER_CONNECTION_DOMAIN &&
+    input.metadata?.credentialRole === WORKSPACE_OPPER_CONNECTION_ROLE
+  ) {
+    return "opper";
+  }
   return null;
 }
 
+/** Opper management keys are refused by inference routes; never store one as a model key. */
+function assertOpperCredential(credential: Record<string, unknown>): void {
+  const apiKey = typeof credential.apiKey === "string" ? credential.apiKey : "";
+  const problem = opperCredentialProblem(apiKey);
+  if (problem) throw new HTTPException(422, { message: problem });
+}
+
+/**
+ * A brokered api_key Connection is usable only through `headers` or
+ * `placements`; anything else was previously accepted and then failed every
+ * tool call with a misleading "connect an account" auth-needed notice.
+ */
+function assertBrokeredApiKeyCredential(
+  kind: string | undefined,
+  credential: Record<string, unknown>,
+): void {
+  if (kind !== "api_key") return;
+  const problem = brokeredCredentialBundleProblem(credential);
+  if (problem) throw new HTTPException(422, { message: problem });
+}
+
 function assertNotReservedSlackBotMetadata(metadata: Record<string, unknown> | undefined): void {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException(422, {
-      message: "OpenGeni Slack bot metadata is reserved for the dedicated connection flow",
+      message: "Opengeni Slack bot metadata is reserved for the dedicated connection flow",
     });
   }
 }
@@ -1659,6 +1972,14 @@ function assertNotReservedFikenMetadata(metadata: Record<string, unknown> | unde
   }
 }
 
+function assertNotReservedOnePasswordMetadata(metadata: Record<string, unknown> | undefined): void {
+  if (metadata?.credentialRole === ONEPASSWORD_CREDENTIAL_ROLE) {
+    throw new HTTPException(422, {
+      message: "1Password connections are created by the verified 1Password install flow",
+    });
+  }
+}
+
 function assertNotReservedApiIntegrationOAuthMetadata(
   metadata: Record<string, unknown> | undefined,
 ): void {
@@ -1711,8 +2032,14 @@ function workspaceProviderCredentialMetadata(
     [OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _openRouterOperationDigest,
     [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _operationId,
     [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _operationDigest,
+    [OPPER_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _opperOperationId,
+    [OPPER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _opperOperationDigest,
     ...effectiveMetadata
   } = metadata ?? {};
+  for (const role of ["anthropic", "claude_subscription"]) {
+    delete effectiveMetadata[`${role}CredentialOperationId`];
+    delete effectiveMetadata[`${role}CredentialOperationDigest`];
+  }
   return {
     ...effectiveMetadata,
     credentialRole: workspaceProviderApiKeyConnectionSpec(providerKind).credentialRole,