@opengeni/api-router 3.0.1 → 3.1.2

package/dist/integration-connect-metrics.d.ts

@@ -0,0 +1,35 @@
+import type { ConnectAttemptTransition } from "@opengeni/db";
+import type { Observability } from "@opengeni/observability";
+export declare function connectMetricProvider(providerId: string): string;
+/** `http_404`/`upstream_http_502` collapse to a status class; other codes keep a closed grammar. */
+export declare function boundedConnectReason(value: string | null | undefined): string;
+export declare function observeConnectAttemptTransition(observability: Observability | null | undefined, transition: ConnectAttemptTransition): void;
+export declare function isOAuthCallbackRoute(route: string): boolean;
+/**
+ * Classify one provider callback response from its status and redirect only.
+ * A popup (Connect attempt) callback returns to its exact opener URL without
+ * a result marker; its outcome is counted by `opengeni_connect_attempts_total`
+ * and here as `handoff`.
+ */
+export declare function classifyOAuthCallback(input: {
+    route: string;
+    status: number;
+    location: string | null;
+}): {
+    flow: string;
+    provider: string;
+    outcome: string;
+    stage: string;
+    reason: string;
+} | null;
+export declare function observeOAuthCallback(observability: Observability | null | undefined, input: {
+    route: string;
+    status: number;
+    location: string | null;
+}): void;
+export declare function observeOAuthStart(observability: Observability | null | undefined, input: {
+    flow: string;
+    outcome: "success" | "failure";
+    stage?: string;
+    reason?: string;
+}): void;

package/dist/integration-endpoint-test.d.ts

@@ -0,0 +1,20 @@
+import { CredentialProviderResponse, type IntegrationEndpointTestResult } from "@opengeni/contracts";
+import { pinnedFetch, type OutboundNetworkSettings } from "@opengeni/network";
+export type IntegrationEndpointTestInput = {
+    kind: "webhook" | "credential-provider";
+    url: string;
+    secret: string;
+    /** The exact body to sign and send. */
+    body: string;
+    /** Extra identity headers (the webhook event id). */
+    headers?: Record<string, string>;
+    timeoutMs: number;
+    settings: OutboundNetworkSettings;
+    fetch?: typeof pinnedFetch;
+    now?: () => number;
+};
+/** What went wrong reaching the endpoint, in words an administrator can act on. */
+export declare function integrationTestNetworkError(error: unknown): string;
+/** The names of what a run would receive. Values are dropped here. */
+export declare function credentialProviderTestSummary(response: CredentialProviderResponse): NonNullable<IntegrationEndpointTestResult["credentials"]>;
+export declare function sendIntegrationEndpointTest(input: IntegrationEndpointTestInput): Promise<IntegrationEndpointTestResult>;

package/dist/integrations/api-integrations.d.ts

@@ -1,5 +1,5 @@
 import { type IntegrationCredentialResolver, type IntegrationInvocationAuthority, type IntegrationTransport } from "@opengeni/capabilities";
-import { ApiIntegrationPreview, type IntegrationSource } from "@opengeni/contracts";
+import { ApiIntegrationPreview, type IntegrationSourceInput } from "@opengeni/contracts";
 import type { StoredApiIntegrationRevision } from "@opengeni/db";
 export type ApiIntegrationConnectionDescriptor = {
     id: string;
@@ -16,7 +16,7 @@ export type ResolvedApiIntegrationPreview = {
     authScheme: Record<string, unknown>;
 };
 export declare function resolveApiIntegrationPreview(input: {
-    source: IntegrationSource;
+    source: IntegrationSourceInput;
     connection: ApiIntegrationConnectionDescriptor | null;
     transport: IntegrationTransport;
     credentialResolver?: IntegrationCredentialResolver;

package/dist/integrations/atlassian.d.ts

@@ -1,3 +1,7 @@
+type AtlassianRequestAuthority = {
+    connectionUseContext?: Omit<AcceptedConnectionUseContext, "physicalRequestId" | "usePhase">;
+};
+import type { AcceptedConnectionUseContext } from "@opengeni/db";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type { AccessGrant, ScheduledTask } from "@opengeni/contracts";
 import { AtlassianOAuthStartResponse, type AtlassianDisconnectRequest, type AtlassianLifecycleActionRequest, type AtlassianOAuthStartRequest } from "@opengeni/contracts/atlassian";
@@ -22,7 +26,7 @@ export declare function completeAtlassianOAuthCallback(deps: ApiRouteDeps, input
     redirectTo: string;
     exactReturn?: boolean;
 }>;
-export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
+export declare function browseAtlassianSources(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;
@@ -30,6 +34,7 @@ export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
     connection: {
         id: string;
         authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -63,7 +68,7 @@ export declare function browseAtlassianSources(deps: ApiRouteDeps, input: {
         webUrl: string;
     }[];
 }>;
-export declare function searchAtlassianLive(deps: ApiRouteDeps, input: {
+export declare function searchAtlassianLive(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;
@@ -91,7 +96,7 @@ export declare function searchAtlassianLive(deps: ApiRouteDeps, input: {
     updatedAt: string | null;
     url: string;
 })[]>;
-export declare function getAtlassianLiveItem(deps: ApiRouteDeps, input: {
+export declare function getAtlassianLiveItem(deps: ApiRouteDeps, input: AtlassianRequestAuthority & {
     workspaceId: string;
     subjectId: string;
     connectionId: string;

package/dist/integrations/fiken.d.ts

@@ -6,7 +6,9 @@ import { type Database } from "@opengeni/db";
 import { type FetchLike } from "@opengeni/network";
 import { HTTPException } from "hono/http-exception";
 /** Shared native/embedded token adapter. Provider verification happens before
- * persistence; the caller reauthorizes inside its durable commit transaction. */
+ * persistence; the caller reauthorizes inside its durable commit transaction.
+ * That caller must acquire the organization policy fence for `fiken` BEFORE
+ * owner/tenancy locks and invoke the returned writer with that exact tx. */
 export declare function prepareFikenTokenInstall(deps: ApiRouteDeps, grant: Pick<AccessGrant, "accountId" | "workspaceId" | "subjectId">, raw: unknown, expectedVersion?: number): Promise<(tx: Database) => Promise<ConnectionMetadata>>;
 export type FikenOperation = "companies.list" | "contacts.list" | "contact.create" | "products.list" | "invoices.list" | "invoice.get" | "invoice_draft.create" | "bank_accounts.list" | "purchases.list" | "sales.list";
 export declare class FikenProviderError extends Error {

package/dist/integrations/github-lens-connect.d.ts

@@ -1,71 +1,13 @@
 import { type GitHubInstallationBindingProof } from "@opengeni/contracts";
 import { type ApiRouteDeps } from "@opengeni/core";
 import { type Database } from "@opengeni/db";
-export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId: string): Promise<{
-    installation: {
-        skillWrites?: {
-            operationId: string;
-            skillId: string;
-            revisionId: string;
-            outcome: "applied" | "pending" | "preserved";
-            decision?: "rejected" | undefined;
-            pendingReason?: "approval" | "source_finalization" | undefined;
-            skillReview?: {
-                sourceOperationId: string;
-                skillId: string;
-                revisionId: string;
-                expectedRevisionId: string | null;
-                expectedScopeVersion: number;
-            } | undefined;
-            replayed: boolean;
-        }[] | undefined;
-        skillPublications?: {
-            operationId: string;
-            skillId: string;
-            revisionId: string;
-            outcome: "applied" | "pending" | "preserved";
-            decision?: "rejected" | undefined;
-            pendingReason?: "approval" | "source_finalization" | undefined;
-            skillReview?: {
-                sourceOperationId: string;
-                skillId: string;
-                revisionId: string;
-                expectedRevisionId: string | null;
-                expectedScopeVersion: number;
-            } | undefined;
-            replayed: boolean;
-            sourceOperationId: string;
-            activationEventId: string | null;
-        }[] | undefined;
-        skillReleases?: {
-            skillId: string;
-            revisionId: string | null;
-            disposition: "deactivated" | "inactive" | "preserved";
-            eventId: string | null;
-            warning: string | null;
-        }[] | undefined;
-        id: string;
-        accountId: string;
-        workspaceId: string;
-        packId: string;
-        status: "active" | "disabled" | "installing" | "needs_attention";
-        version: number;
-        manifestSnapshot: Record<string, unknown> | null;
-        manifestDigest: string | null;
-        selectedRigId: string | null;
-        installedBySubjectId: string | null;
-        metadata: Record<string, unknown>;
-        enabledAt: string;
-        updatedAt: string;
-    };
+export declare function requireGitHubLensConnect(deps: ApiRouteDeps): Promise<{
     template: {
-        id: string;
-        name: string;
-        description: string;
-        adapterId: string;
+        adapterId: "source-control.pull-request.v1";
         eventTypes: string[];
+        configuration: {};
         sessionTemplate: {
-            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
+            bundledSkillIds?: ("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-schedules" | "builtin:opengeni-secrets" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[] | undefined;
             prompt: string;
             instructions: string | null;
             resources: ({
@@ -85,6 +27,7 @@ export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId
                 connectionId?: string | undefined;
                 githubInstallationId?: number | undefined;
                 githubRepositoryId?: number | undefined;
+                optional?: boolean | undefined;
             } | {
                 kind: "file";
                 fileId: string;
@@ -103,17 +46,45 @@ export declare function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId
                 id: string;
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
+                allowedTools?: string[] | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
-            firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+            firstPartyMcpTools: ("admin_action_call" | "admin_action_describe" | "admin_actions_search" | "artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enable_screen_control" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "inbox_tidy" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "notification_withdraw" | "notify_user" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "secret_delete" | "secret_get" | "secret_move" | "secret_save" | "secret_search" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_message_status" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_target_get" | "session_target_set" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "site_data_define_collection" | "site_data_describe" | "site_data_export" | "site_data_import" | "site_data_query" | "site_data_reset" | "site_data_write" | "site_files_delete" | "site_files_list" | "site_files_upload" | "site_hostname_check" | "site_publication_apply_fix" | "site_publication_get" | "site_publication_update" | "site_sql_define_query" | "site_sql_enable" | "site_sql_execute" | "site_sql_export" | "site_sql_import" | "site_sql_inspect" | "site_sql_migrate" | "site_sql_query" | "site_sql_reset" | "site_sql_run" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;
             sandboxBackend: "blaxel" | "cloudflare" | "daytona" | "docker" | "e2b" | "local" | "modal" | "none" | "opensandbox" | "runloop" | "selfhosted" | "vercel" | null;
             policyRole: string | null;
             metadata: Record<string, unknown>;
+            agent?: {
+                capabilities?: "all" | "none" | {
+                    webSearch?: boolean | undefined;
+                    humanInput?: boolean | undefined;
+                    skills?: "manage" | "read" | false | undefined;
+                    goals?: boolean | undefined;
+                    subagents?: boolean | undefined;
+                    knowledge?: boolean | undefined;
+                    schedules?: boolean | undefined;
+                    artifacts?: boolean | undefined;
+                    browser?: boolean | undefined;
+                    secrets?: boolean | undefined;
+                    media?: boolean | undefined;
+                    workspaceFiles?: boolean | undefined;
+                    workspaceConnectors?: boolean | undefined;
+                    workspaceAdmin?: boolean | undefined;
+                    from: "all" | "none";
+                } | undefined;
+                identity?: string | null | undefined;
+                instructions?: string | undefined;
+                renderer?: "markdown" | "opengeni" | undefined;
+                vaultPolicy?: {
+                    mode: "all";
+                } | {
+                    mode: "selected";
+                    vaultIds: string[];
+                } | undefined;
+            } | undefined;
+            credentialRestriction?: "developer_setup" | undefined;
         };
-        configuration: Record<string, unknown>;
-        connectionRequirement: string | null;
     };
 }>;
 /** Separate Lens registration/source/automation domain, not a repository-access

package/dist/integrations/google-drive.d.ts

@@ -57,6 +57,7 @@ export declare function browseGoogleDrive(deps: ApiRouteDeps, input: {
     connection: {
         id: string;
         authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;
@@ -113,6 +114,7 @@ export declare function browseGoogleDriveFacetSource(deps: ApiRouteDeps, input:
     connection: {
         id: string;
         authorityId?: string | undefined;
+        connectionAuthorityGeneration?: number | undefined;
         accountId: string;
         workspaceId: string;
         subjectId: string | null;

package/dist/integrations/integration-commit-authority.d.ts

@@ -0,0 +1,13 @@
+import { type AccessGrant, type Permission } from "@opengeni/contracts";
+import { type Settings } from "@opengeni/config";
+import { type AccessGrantAuthorization } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+export type IntegrationCommitGrant = AccessGrant & {
+    authorizeCommit: (tx: Database) => Promise<void>;
+};
+/** Keep server-verified provenance alongside the grant across provider work.
+ * Call only inside the policy transaction, before persistence locks. */
+export declare function integrationCommitGrant(authorization: AccessGrantAuthorization, permissions: readonly Permission[], request: {
+    settings: Settings;
+    authorizationHeader?: string | undefined;
+}): Promise<IntegrationCommitGrant>;