@opengeni/api-router 3.0.1 → 4.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.0.1",
+  "version": "4.0.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,22 +44,22 @@
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.6.0",
-    "@opengeni/artifact-tool": "^0.3.29",
+    "@opengeni/artifact-tool": "^0.3.30",
     "@opengeni/capabilities": "^0.3.4",
-    "@opengeni/codemode": "^0.5.9",
-    "@opengeni/codex": "^0.2.23",
-    "@opengeni/config": "^1.2.2",
-    "@opengeni/contracts": "^4.1.0",
-    "@opengeni/core": "^3.0.1",
-    "@opengeni/db": "^5.0.1",
-    "@opengeni/documents": "^0.8.30",
-    "@opengeni/events": "^0.4.28",
-    "@opengeni/github": "^0.7.13",
+    "@opengeni/codemode": "^0.6.0",
+    "@opengeni/codex": "^0.2.24",
+    "@opengeni/config": "^2.0.0",
+    "@opengeni/contracts": "^5.0.0",
+    "@opengeni/core": "^4.0.0",
+    "@opengeni/db": "^6.0.0",
+    "@opengeni/documents": "^0.8.31",
+    "@opengeni/events": "^0.4.29",
+    "@opengeni/github": "^0.7.14",
     "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.29",
-    "@opengeni/runtime": "^3.0.1",
-    "@opengeni/storage": "^0.2.130",
-    "@opengeni/tool-gateway": "^0.1.10",
+    "@opengeni/observability": "^0.8.30",
+    "@opengeni/runtime": "^4.0.0",
+    "@opengeni/storage": "^0.2.131",
+    "@opengeni/tool-gateway": "^0.1.11",
     "@opengeni/xai-subscription": "^0.1.4",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",

package/src/admission-trace.ts

@@ -0,0 +1,14 @@
+import type { Observability } from "@opengeni/observability";
+
+/** Only committed, non-replayed server event identities mint admission anchors. */
+export function recordAcceptedApiAdmission(
+  observability: Observability | undefined,
+  result: { accepted: { id: string }; replay: boolean },
+): void {
+  if (result.replay) return;
+  try {
+    observability?.recordAdmissionTrace(result.accepted.id);
+  } catch {
+    // Telemetry must never turn a committed admission into an HTTP failure.
+  }
+}

package/src/app.ts

@@ -1,7 +1,7 @@
 import { registerConnectCallbackReturns } from "./integrations/connect-callback-return";
 import { registerFeedbackRoutes } from "./routes/feedback";
 import { codemodeSessionRequest } from "./codemode";
-import { SiteSessionPathError } from "@opengeni/contracts";
+import { SiteSessionPathError, OrganizationIntegrationDeniedError } from "@opengeni/contracts";
 import { registerModelConnectionAccessRoutes } from "./routes/model-connection-access";
 import {
   canonicalizeConfiguredModelId,
@@ -55,7 +55,7 @@ import {
 } from "@opengeni/db";
 import { requireSessionEventDurableFanoutCapability } from "@opengeni/events";
 import { githubAppBotIdentityWarnings } from "@opengeni/github";
-import { createObservability } from "@opengeni/observability";
+import { createObservability, withTraceContext } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { handleMcpRequestWithClientAbort } from "./mcp/request-abort";
@@ -106,6 +106,7 @@ import {
   runManagedAuthProvider,
 } from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
+import { startManagedSignInNotificationDelivery } from "./auth/managed-sign-in-notifications";
 import {
   assertManagedEmailTransportMetadata,
   assertOrganizationUserSetupQueryTransportConfigured,
@@ -149,11 +150,11 @@ import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
 import { registerOrganizationModelProviderRoutes } from "./routes/organization-model-providers";
+import { registerOrganizationIntegrationPolicyRoutes } from "./routes/organization-integration-policy";
 import { registerSuperGrokRoutes } from "./routes/supergrok";
 import { registerConnectionRoutes } from "./routes/connections";
 import { registerConnectRoutes } from "./routes/connect";
-import { registerHostMcpBindingRoutes } from "./routes/host-mcp-bindings";
-import { registerHostMcpResolverRoutes } from "./routes/host-mcp-resolvers";
+
 import { registerExternalIdentityLinkRoutes } from "./routes/external-identity-links";
 import { registerDocumentRoutes } from "./routes/documents";
 import { registerKnowledgeRoutes } from "./routes/knowledge";
@@ -178,7 +179,6 @@ import { registerApiIntegrationRoutes } from "./routes/api-integrations";
 import { registerIntegrationFacetRoutes } from "./routes/integration-facets";
 import { registerInteractionResourceRoutes } from "./routes/interaction-resources";
 import { registerPrReviewRoutes } from "./routes/pr-review";
-import { registerPackRoutes } from "./routes/packs";
 import { registerAutomationRoutes } from "./routes/automations";
 import { registerPluginRoutes } from "./routes/plugins";
 import { registerSkillRoutes } from "./routes/skills";
@@ -206,13 +206,16 @@ import { registerOrganizationMembershipRoutes } from "./routes/organization-memb
 import { registerOrganizationSessionRoutes } from "./routes/organization-sessions";
 import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
 import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedSignInMethodRoutes,
+  handleManagedSignInConnectCallback,
+} from "./routes/managed-sign-in-methods";
 import {
   registerManagedAuthSessionSetRoutes,
   requireManagedAuthProviderRouteAllowed,
   scrubManagedAuthProviderResponse,
 } from "./routes/managed-auth-session-sets";
 import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
-import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
 import { createFfmpegTranscriptionSegmenter } from "./transcription/segmenter";
@@ -299,6 +302,7 @@ export function createAppComposition(deps: AppDependencies): {
   const managedAuthSessionAdapter =
     deps.managedAuthSessionAdapter ??
     (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
+  if (managedAuth) startManagedSignInNotificationDelivery(deps.db, managedEmailTransport);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -538,70 +542,76 @@ export function createAppComposition(deps: AppDependencies): {
     const route = routeLabel(url.pathname);
     const correlationId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
     const start = performance.now();
-    const span = observability.startSpan(`HTTP ${c.req.method} ${route}`, {
-      "http.request.method": c.req.method,
-      "opengeni.route": route,
+    const span = observability.startSpan(
+      `HTTP ${c.req.method} ${route}`,
+      {
+        "http.request.method": c.req.method,
+        "opengeni.route": route,
+      },
+      { parent: null },
+    );
+    return await withTraceContext(span, async () => {
+      try {
+        await next();
+        const status = c.res.status || 200;
+        const durationSeconds = (performance.now() - start) / 1000;
+        observability.recordHttpRequest({
+          method: c.req.method,
+          route,
+          status,
+          durationSeconds,
+        });
+        span.end({
+          attributes: {
+            "http.response.status_code": status,
+            "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+          },
+        });
+        observability.info("HTTP request completed", {
+          method: c.req.method,
+          route,
+          status,
+          durationMs: Math.round(durationSeconds * 1000),
+          traceId: span.traceId,
+          spanId: span.spanId,
+          correlationId,
+        });
+      } catch (error) {
+        const status = httpStatusForError(error);
+        const errorCode = errorCodeForStatus(status);
+        const durationSeconds = (performance.now() - start) / 1000;
+        observability.recordHttpRequest({
+          method: c.req.method,
+          route,
+          status,
+          durationSeconds,
+        });
+        observability.incrementCounter({
+          name: "opengeni_http_errors_total",
+          help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
+          labels: { route, status: String(status), code: errorCode },
+        });
+        span.end({
+          attributes: {
+            "http.response.status_code": status,
+            "opengeni.duration_ms": Math.round(durationSeconds * 1000),
+          },
+          error,
+        });
+        observability.error("HTTP request failed", {
+          method: c.req.method,
+          route,
+          status,
+          durationMs: Math.round(durationSeconds * 1000),
+          traceId: span.traceId,
+          spanId: span.spanId,
+          correlationId,
+          errorCode,
+          errorClass: "HttpOperationError",
+        });
+        throw error;
+      }
     });
-    try {
-      await next();
-      const status = c.res.status || 200;
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-      });
-      observability.info("HTTP request completed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-      });
-    } catch (error) {
-      const status = httpStatusForError(error);
-      const errorCode = errorCodeForStatus(status);
-      const durationSeconds = (performance.now() - start) / 1000;
-      observability.recordHttpRequest({
-        method: c.req.method,
-        route,
-        status,
-        durationSeconds,
-      });
-      observability.incrementCounter({
-        name: "opengeni_http_errors_total",
-        help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
-        labels: { route, status: String(status), code: errorCode },
-      });
-      span.end({
-        attributes: {
-          "http.response.status_code": status,
-          "opengeni.duration_ms": Math.round(durationSeconds * 1000),
-        },
-        error,
-      });
-      observability.error("HTTP request failed", {
-        method: c.req.method,
-        route,
-        status,
-        durationMs: Math.round(durationSeconds * 1000),
-        traceId: span.traceId,
-        spanId: span.spanId,
-        correlationId,
-        errorCode,
-        errorClass: "HttpOperationError",
-      });
-      throw error;
-    }
   });
 
   const accessKeyBoundary = requireAccessKey(deps.settings);
@@ -669,10 +679,61 @@ export function createAppComposition(deps: AppDependencies): {
   // wildcard handler or the provider returns its own 404 first.
   registerManagedOnboardingRoutes(app, routeDeps);
   registerManagedAuthSessionSetRoutes(app, routeDeps);
+  registerManagedSignInMethodRoutes(app, routeDeps);
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
       const pathname = new URL(c.req.url).pathname;
       const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
+      if (pathname === "/v1/auth/sign-in/social" && c.req.method === "POST") {
+        const body = await c.req.raw
+          .clone()
+          .json()
+          .catch(() => null);
+        if (
+          !body ||
+          !["google", "github"].includes(body.provider) ||
+          Object.prototype.hasOwnProperty.call(body, "idToken")
+        ) {
+          return c.json(
+            {
+              code: "SIGN_IN_METHOD_OAUTH_REDIRECT_REQUIRED",
+              message: "Use the browser OAuth sign-in redirect",
+            },
+            403,
+          );
+        }
+      }
+      if (oauthCallbackProvider) {
+        const connectResponse = await handleManagedSignInConnectCallback(
+          c,
+          routeDeps,
+          oauthCallbackProvider,
+        );
+        if (connectResponse) return connectResponse;
+      }
+      if (
+        new Set([
+          "link-social",
+          "unlink-account",
+          "list-accounts",
+          "set-password",
+          "change-password",
+          "change-email",
+          "update-user",
+          "delete-user",
+          "get-access-token",
+          "refresh-token",
+          "account-info",
+        ]).has(pathname.slice("/v1/auth/".length))
+      ) {
+        return c.json(
+          {
+            code: "SIGN_IN_METHOD_PRODUCT_ROUTE_REQUIRED",
+            message: "Use personal sign-in method settings",
+          },
+          403,
+        );
+      }
       if (deps.settings.managedAuthSessionSetMode === "legacy") {
         return oauthCallbackProvider
           ? await runManagedAuthProvider(
@@ -1256,8 +1317,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerPersonalGitHubGitBrokerRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerConnectRoutes(app, routeDeps);
-  registerHostMcpBindingRoutes(app, routeDeps);
-  registerHostMcpResolverRoutes(app, routeDeps);
+
   registerExternalIdentityLinkRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
   registerApiIntegrationRoutes(app, routeDeps);
@@ -1268,7 +1328,6 @@ export function createAppComposition(deps: AppDependencies): {
   registerEnvironmentRoutes(app, routeDeps);
   registerChannelRoutes(app, routeDeps);
   registerRigRoutes(app, routeDeps);
-  registerPackRoutes(app, routeDeps);
   registerAutomationRoutes(app, routeDeps);
   registerPrReviewRoutes(app, routeDeps);
   registerPluginRoutes(app, routeDeps);
@@ -1278,6 +1337,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
   registerOrganizationModelProviderRoutes(app, routeDeps);
+  registerOrganizationIntegrationPolicyRoutes(app, routeDeps);
   registerModelConnectionAccessRoutes(app, routeDeps);
   registerSuperGrokRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
@@ -1288,7 +1348,6 @@ export function createAppComposition(deps: AppDependencies): {
   registerOrganizationSessionRoutes(app, routeDeps);
   registerOrganizationRecoveryRoutes(app, routeDeps);
   registerUserResourceAuthorityRoutes(app, routeDeps);
-  registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
@@ -1311,7 +1370,10 @@ export function createAppComposition(deps: AppDependencies): {
   app.onError((rawError, c) => {
     // One central mapping for every Send/Steer/control route: a bounded
     // control-prefix wait that expired is a known, retryable, not-applied 503.
-    const error = workspaceControlBusyHttpError(rawError) ?? rawError;
+    const error =
+      rawError instanceof OrganizationIntegrationDeniedError
+        ? new HTTPException(403, { message: rawError.message })
+        : (workspaceControlBusyHttpError(rawError) ?? rawError);
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
@@ -1861,6 +1923,10 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions$/,
     label: "/v1/workspaces/:workspaceId/sessions",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/session-message-search$/,
+    label: "/v1/workspaces/:workspaceId/session-message-search",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/control-events\/stream$/,
     label: "/v1/workspaces/:workspaceId/control-events/stream",
@@ -2373,26 +2439,7 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/environments\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/environments/:id",
   },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs$/,
-    label: "/v1/workspaces/:workspaceId/packs",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/installations$/,
-    label: "/v1/workspaces/:workspaceId/packs/installations",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/marketing-social-daily-analysis\/scheduled-tasks$/,
-    label: "/v1/workspaces/:workspaceId/packs/marketing-social-daily-analysis/scheduled-tasks",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+\/enable$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id/enable",
-  },
-  {
-    pattern: /^\/v1\/workspaces\/[^/]+\/packs\/[^/]+$/,
-    label: "/v1/workspaces/:workspaceId/packs/:id",
-  },
+
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/plugins\/preview$/,
     label: "/v1/workspaces/:workspaceId/plugins/preview",

package/src/auth/managed-auth-attempt-context.ts

@@ -11,6 +11,15 @@ type ManagedAuthAttemptContext =
   | { kind: "discard_provider_session" };
 
 const managedAuthAttemptStorage = new AsyncLocalStorage<ManagedAuthAttemptContext>();
+const managedLinkIntentStorage = new AsyncLocalStorage<string>();
+
+export function runManagedSignInConnect<T>(intentId: string, action: () => T): T {
+  return managedLinkIntentStorage.run(intentId, action);
+}
+
+export function currentManagedSignInConnectIntent(): string | undefined {
+  return managedLinkIntentStorage.getStore();
+}
 
 export function runManagedAuthAttempt<T>(
   transactionId: string,

package/src/auth/managed-auth-session-adapter.ts

@@ -8,6 +8,17 @@ import type { ManagedAuth } from "@opengeni/core";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { runManagedAuthAttempt } from "./managed-auth-attempt-context";
 
+/** Server-only proof for a product-owned endpoint; never returned to a browser. */
+export async function managedAuthSelectedProofHeaders(
+  auth: ManagedAuth,
+  token: string,
+): Promise<Headers> {
+  const context = await auth.$context;
+  return new Headers({
+    cookie: `${context.authCookies.sessionToken.name}=${signedCookieValue(token, context.secret)}`,
+  });
+}
+
 export function createBetterAuthSessionAdapter(
   auth: ManagedAuth,
   db: Database,

package/src/auth/managed-auth.ts

@@ -14,16 +14,18 @@ import {
 } from "@opengeni/db/canonical-human-identities";
 import { betterAuth } from "better-auth";
 import { createEmailVerificationToken } from "better-auth/api";
-import { hashPassword } from "better-auth/crypto";
+import { hashPassword, verifyPassword } from "better-auth/crypto";
 import { sql } from "drizzle-orm";
 import { Pool } from "pg";
 
 import { decideCanonicalHumanSessionAdmission } from "./canonical-human-session-admission";
+import { deliverManagedSignInNotification } from "./managed-sign-in-notifications";
 import {
   currentManagedAuthProviderId,
   currentManagedAuthAttemptId,
   recordCurrentManagedAuthSession,
   shouldDiscardCurrentManagedAuthProviderSession,
+  currentManagedSignInConnectIntent,
 } from "./managed-auth-attempt-context";
 
 // `ManagedAuth` (the Better Auth `Auth<any>` alias) is owned by @opengeni/core
@@ -66,6 +68,10 @@ export async function hashManagedAuthPassword(password: string): Promise<string>
   return await hashPassword(password);
 }
 
+export async function verifyManagedAuthPassword(password: string, hash: string): Promise<boolean> {
+  return await verifyPassword({ password, hash });
+}
+
 export function createManagedAuth(
   settings: Settings,
   db: Database,
@@ -180,7 +186,18 @@ export function createManagedAuth(
         updatedAt: "updated_at",
       },
       accountLinking: {
-        enabled: false,
+        enabled: true,
+        requireLocalEmailVerified: true,
+        trustedProviders: [],
+        allowDifferentEmails: false,
+      },
+      additionalFields: {
+        managedLinkIntentId: {
+          type: "string",
+          fieldName: "managed_link_intent_id",
+          input: false,
+          returned: false,
+        },
       },
       encryptOAuthTokens: true,
       storeStateStrategy: "database",
@@ -264,6 +281,26 @@ export function createManagedAuth(
       },
     },
     databaseHooks: {
+      account: {
+        create: {
+          before: async (account) => ({
+            data: {
+              ...account,
+              ...(currentManagedSignInConnectIntent()
+                ? { managedLinkIntentId: currentManagedSignInConnectIntent() }
+                : {}),
+            },
+          }),
+          after: async (account) => {
+            if (
+              !["google", "github"].includes(account.providerId) ||
+              currentManagedSignInConnectIntent()
+            )
+              return;
+            await deliverManagedSignInNotification(db, managedEmailTransport, account.id);
+          },
+        },
+      },
       session: {
         create: {
           before: async (session) => {

package/src/auth/managed-sign-in-notifications.ts

@@ -0,0 +1,81 @@
+import type { ManagedEmailTransport } from "@opengeni/core";
+import type { Database } from "@opengeni/db";
+import { sql } from "drizzle-orm";
+import { z } from "zod";
+
+const Claim = z.object({
+  operationId: z.string().uuid(),
+  leaseId: z.string().uuid(),
+  email: z.string().email(),
+  provider: z.enum(["password", "google", "github"]),
+  sender: z.string(),
+});
+const started = new WeakSet<object>();
+
+export async function deliverManagedSignInNotification(
+  db: Database,
+  transport: ManagedEmailTransport,
+  operationId: string | null = null,
+): Promise<"sent" | "failed" | "outcome_unknown"> {
+  try {
+    const result = await db.execute(
+      sql`select claim_managed_sign_in_notification(${operationId}::uuid,${transport.sender},${transport.idempotency.scope},${transport.idempotency.retentionSeconds}::integer) as claim`,
+    );
+    const row = (Array.isArray(result) ? result : result.rows)[0] as { claim: unknown } | undefined;
+    if (!row?.claim) return "outcome_unknown";
+    const claim = Claim.parse(row.claim);
+    let status: "sent" | "failed" | "outcome_unknown" = "outcome_unknown";
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      const response = await Promise.race([
+        transport.send({
+          kind: "sign_in_method_changed",
+          from: claim.sender,
+          to: claim.email,
+          idempotencyKey: `sign-in-method:${claim.operationId}`,
+          subject: "Your OpenGeni sign-in methods changed",
+          text: `Your OpenGeni ${claim.provider} sign-in method changed. If this was not you, reset your password and contact your administrator.`,
+          html: `<p>Your OpenGeni ${claim.provider} sign-in method changed. If this was not you, reset your password and contact your administrator.</p>`,
+        }),
+        new Promise<{ status: "outcome_unknown" }>((resolve) => {
+          timer = setTimeout(() => resolve({ status: "outcome_unknown" }), 5_000);
+        }),
+      ]);
+      status = response.status;
+    } catch {
+      /* Retain the durable unknown claim for idempotent retry. */
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    await db.execute(
+      sql`select settle_managed_sign_in_notification(${claim.operationId}::uuid,${claim.leaseId}::uuid,${status})`,
+    );
+    return status;
+  } catch {
+    // Security state is already committed. A failed claim/ack must never be
+    // reported as a failed method change; its durable obligation remains live.
+    return "outcome_unknown";
+  }
+}
+
+export function startManagedSignInNotificationDelivery(
+  db: Database,
+  transport: ManagedEmailTransport,
+): void {
+  if (started.has(db as object)) return;
+  started.add(db as object);
+  let active = false;
+  const drain = async () => {
+    if (active) return;
+    active = true;
+    try {
+      for (let count = 0; count < 10; count++)
+        if ((await deliverManagedSignInNotification(db, transport)) === "outcome_unknown") break;
+    } finally {
+      active = false;
+    }
+  };
+  const timer = setInterval(() => void drain(), 60_000);
+  (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
+  void drain();
+}

package/src/connection-ownership.ts

@@ -85,13 +85,7 @@ const RESERVED_MACHINE_SUBJECT_NAMESPACES = [
 export function isPersonalConnectionOwnerPrincipal(access: AccessGrantAuthorization): boolean {
   const { grant } = access;
   return (
-    // The anti-substitution invariant `requireConnectionAuthorityOwner` uses for
-    // the same question: every context grant agrees on principal kind, delegated
-    // flag and service flags, and the selected grant's account resolves to
-    // exactly one matching account grant. Without it a grant whose account has
-    // no matching account grant (a surviving membership row in an organization
-    // where the membership is no longer active) could mint a personal
-    // Connection that the sibling helper would refuse.
+    // Every context grant must agree on the authenticated principal and account.
     access.contextIntegrity &&
     access.authenticatedSubjectId === grant.subjectId &&
     grant.principalKind === "human_session" &&
@@ -132,8 +126,7 @@ export function personalOnlyConnectionPrincipalMessage(label: string): string {
  * rejects every reserved machine-subject namespace as defence-in-depth. The
  * sibling guards a self-service authority surface where the caller claims to
  * *be* the owner (403 "not you"), while this one rejects an ownership *value*
- * that is unavailable to the caller, alongside `assertOwnershipAllowed`'s
- * existing 422 convention.
+ * that is unavailable to the caller (422).
  */
 export function assertPersonalConnectionOwnerPrincipal(
   access: AccessGrantAuthorization,

package/src/editable-artifact-production.ts

@@ -47,6 +47,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
+  recordNativeDocumentInspection,
   dbSql,
   withRlsContext,
   type Database,
@@ -167,6 +168,11 @@ export async function createStandaloneEditableArtifactApplication(input: {
         await touchEditableArtifactSessionLink(input.db, scope, sessionId, artifactId),
     } satisfies EditableArtifactAgentAssociationPort),
     inspector: kernel,
+    recordInspection: async (inspection) => {
+      if (inspection.actor.kind !== "agent")
+        throw new Error("Inspection proof requires an agent attempt");
+      return recordNativeDocumentInspection(input.db, { ...inspection, actor: inspection.actor });
+    },
     officeImports,
     workspaceFiles: new EditableArtifactWorkspaceFileAdapter({
       db: input.db,