@opengeni/contracts 0.27.0 → 0.28.1

package/dist/google-drive.js

@@ -1,6 +1,6 @@
 import {
   ConnectionMetadata
-} from "./chunk-S4F2GZPD.js";
+} from "./chunk-3Q5FLMOD.js";
 import "./chunk-KGL5BVGF.js";
 
 // src/google-drive.ts

package/dist/index.d.ts

@@ -249,7 +249,7 @@ export type Permission = z.infer<typeof Permission>;
  * child whose parent was narrowed must inherit the parent's effective subset,
  * never fall back to a different runtime-local default.
  */
-export declare const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS: readonly ["workspace:read", "files:read", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "goals:manage", "sessions:read", "sessions:create", "sessions:control", "variable-sets:use", "variable-sets:manage", "rigs:use", "github:use", "artifacts:read", "artifacts:publish"];
+export declare const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS: readonly ["workspace:read", "files:read", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "goals:manage", "sessions:read", "sessions:create", "sessions:control", "connections:read", "variable-sets:use", "variable-sets:manage", "rigs:use", "github:use", "artifacts:read", "artifacts:publish"];
 /**
  * Exact public catalog for tools served by the broad first-party `opengeni`
  * MCP server. Adding a registration does not make it model-visible: the name
@@ -258,7 +258,7 @@ export declare const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS: readonly ["workspace:r
  * `files_get_download_url` intentionally is not in this catalog. It belongs to
  * the dedicated `files` MCP server.
  */
-export declare const FIRST_PARTY_MCP_TOOL_NAMES: readonly ["set_session_title", "goal_set", "goal_update", "goal_complete", "goal_pause", "memory_search", "memory_save", "memory_correct", "preference_registry_summary", "preference_registry_get", "sandboxes_list", "sandbox_attach", "sandbox_swap", "run_on", "sandbox_provision", "rig_list", "rig_get", "rig_propose_change", "rig_verify", "rig_promote", "sessions_list", "session_get", "session_events", "session_create", "session_send_message", "session_pause", "session_resume", "session_steer", "set_other_session_title", "variable_set_list", "environment_list", "variable_set_set_variable", "environment_set_variable", "github_connect_link", "github_token", "github_repositories_list", "social_connections_list", "social_posts_recent", "social_daily_analysis_context", "scheduled_tasks_list", "scheduled_tasks_get", "scheduled_tasks_create", "scheduled_tasks_update", "scheduled_tasks_pause", "scheduled_tasks_resume", "scheduled_tasks_trigger", "scheduled_tasks_delete", "scheduled_task_runs_list", "slack_bot_list_channels", "slack_bot_channel_history", "slack_bot_thread_replies", "slack_bot_list_users", "slack_bot_list_files", "slack_bot_file_info", "slack_bot_file_content", "slack_bot_post_message", "slack_bot_delete_message", "artifacts_list", "artifacts_get_source", "artifacts_create", "artifacts_publish", "artifacts_rollback"];
+export declare const FIRST_PARTY_MCP_TOOL_NAMES: readonly ["set_session_title", "goal_set", "goal_update", "goal_complete", "goal_pause", "memory_search", "memory_save", "memory_correct", "preference_registry_summary", "preference_registry_get", "sandboxes_list", "sandbox_attach", "sandbox_swap", "run_on", "sandbox_provision", "rig_list", "rig_get", "rig_propose_change", "rig_verify", "rig_promote", "sessions_list", "session_get", "session_events", "session_create", "session_send_message", "session_pause", "session_resume", "session_steer", "set_other_session_title", "variable_set_list", "environment_list", "variable_set_set_variable", "environment_set_variable", "github_connect_link", "github_token", "github_repositories_list", "social_connections_list", "social_posts_recent", "social_daily_analysis_context", "social_search_live", "social_mentions_live", "social_thread_fetch", "social_posts_sync", "social_post_reply", "scheduled_tasks_list", "scheduled_tasks_get", "scheduled_tasks_create", "scheduled_tasks_update", "scheduled_tasks_pause", "scheduled_tasks_resume", "scheduled_tasks_trigger", "scheduled_tasks_delete", "scheduled_task_runs_list", "slack_bot_list_channels", "slack_bot_channel_history", "slack_bot_thread_replies", "slack_bot_list_users", "slack_bot_list_files", "slack_bot_file_info", "slack_bot_file_content", "slack_bot_post_message", "slack_bot_delete_message", "artifacts_list", "artifacts_get_source", "artifacts_create", "artifacts_publish", "artifacts_rollback"];
 export declare const FirstPartyMcpToolName: z.ZodEnum<{
     artifacts_create: "artifacts_create";
     artifacts_get_source: "artifacts_get_source";
@@ -319,17 +319,22 @@ export declare const FirstPartyMcpToolName: z.ZodEnum<{
     slack_bot_thread_replies: "slack_bot_thread_replies";
     social_connections_list: "social_connections_list";
     social_daily_analysis_context: "social_daily_analysis_context";
+    social_mentions_live: "social_mentions_live";
+    social_post_reply: "social_post_reply";
     social_posts_recent: "social_posts_recent";
+    social_posts_sync: "social_posts_sync";
+    social_search_live: "social_search_live";
+    social_thread_fetch: "social_thread_fetch";
     variable_set_list: "variable_set_list";
     variable_set_set_variable: "variable_set_set_variable";
 }>;
 export type FirstPartyMcpToolName = z.infer<typeof FirstPartyMcpToolName>;
 /**
- * Every catalogued OpenGeni tool is selected by default. Registration-time
- * authorization remains the independent access boundary; an explicit session
- * policy may narrow this model-visible set.
+ * Connector-wide tools are explicit-only. Ordinary session omission selects
+ * the non-connector catalog, while an explicit session policy may still select
+ * any catalogued connector tool and remains independently permission-gated.
  */
-export declare const DEFAULT_FIRST_PARTY_MCP_TOOLS: readonly ["set_session_title", "goal_set", "goal_update", "goal_complete", "goal_pause", "memory_search", "memory_save", "memory_correct", "preference_registry_summary", "preference_registry_get", "sandboxes_list", "sandbox_attach", "sandbox_swap", "run_on", "sandbox_provision", "rig_list", "rig_get", "rig_propose_change", "rig_verify", "rig_promote", "sessions_list", "session_get", "session_events", "session_create", "session_send_message", "session_pause", "session_resume", "session_steer", "set_other_session_title", "variable_set_list", "environment_list", "variable_set_set_variable", "environment_set_variable", "github_connect_link", "github_token", "github_repositories_list", "social_connections_list", "social_posts_recent", "social_daily_analysis_context", "scheduled_tasks_list", "scheduled_tasks_get", "scheduled_tasks_create", "scheduled_tasks_update", "scheduled_tasks_pause", "scheduled_tasks_resume", "scheduled_tasks_trigger", "scheduled_tasks_delete", "scheduled_task_runs_list", "slack_bot_list_channels", "slack_bot_channel_history", "slack_bot_thread_replies", "slack_bot_list_users", "slack_bot_list_files", "slack_bot_file_info", "slack_bot_file_content", "slack_bot_post_message", "slack_bot_delete_message", "artifacts_list", "artifacts_get_source", "artifacts_create", "artifacts_publish", "artifacts_rollback"];
+export declare const DEFAULT_FIRST_PARTY_MCP_TOOLS: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "variable_set_list" | "variable_set_set_variable")[];
 export declare function prefixedMcpToolName(registryId: string, toolName: string): string;
 export declare const ProductAccessMode: z.ZodEnum<{
     configured: "configured";
@@ -1247,7 +1252,12 @@ export declare const DelegatedAccessTokenPayload: z.ZodObject<{
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>>;
@@ -3691,7 +3701,12 @@ export declare const UpdateSessionToolPolicyRequest: z.ZodUnion<readonly [z.ZodO
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>;
@@ -4386,7 +4401,12 @@ export declare const NewSessionDraftOptions: z.ZodObject<{
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>>;
@@ -4568,7 +4588,12 @@ export declare const NewSessionDraft: z.ZodObject<{
             slack_bot_thread_replies: "slack_bot_thread_replies";
             social_connections_list: "social_connections_list";
             social_daily_analysis_context: "social_daily_analysis_context";
+            social_mentions_live: "social_mentions_live";
+            social_post_reply: "social_post_reply";
             social_posts_recent: "social_posts_recent";
+            social_posts_sync: "social_posts_sync";
+            social_search_live: "social_search_live";
+            social_thread_fetch: "social_thread_fetch";
             variable_set_list: "variable_set_list";
             variable_set_set_variable: "variable_set_set_variable";
         }>>>;
@@ -4750,7 +4775,12 @@ export declare const SaveNewSessionDraftRequest: z.ZodObject<{
             slack_bot_thread_replies: "slack_bot_thread_replies";
             social_connections_list: "social_connections_list";
             social_daily_analysis_context: "social_daily_analysis_context";
+            social_mentions_live: "social_mentions_live";
+            social_post_reply: "social_post_reply";
             social_posts_recent: "social_posts_recent";
+            social_posts_sync: "social_posts_sync";
+            social_search_live: "social_search_live";
+            social_thread_fetch: "social_thread_fetch";
             variable_set_list: "variable_set_list";
             variable_set_set_variable: "variable_set_set_variable";
         }>>>;
@@ -6512,6 +6542,7 @@ export declare const SocialProvider: z.ZodEnum<{
     facebook: "facebook";
     instagram: "instagram";
     linkedin: "linkedin";
+    reddit: "reddit";
     tiktok: "tiktok";
     x: "x";
     youtube: "youtube";
@@ -6532,6 +6563,7 @@ export declare const SocialConnection: z.ZodObject<{
         facebook: "facebook";
         instagram: "instagram";
         linkedin: "linkedin";
+        reddit: "reddit";
         tiktok: "tiktok";
         x: "x";
         youtube: "youtube";
@@ -6558,6 +6590,7 @@ export declare const CreateSocialConnectionRequest: z.ZodObject<{
         facebook: "facebook";
         instagram: "instagram";
         linkedin: "linkedin";
+        reddit: "reddit";
         tiktok: "tiktok";
         x: "x";
         youtube: "youtube";
@@ -6586,6 +6619,7 @@ export declare const SocialPost: z.ZodObject<{
         facebook: "facebook";
         instagram: "instagram";
         linkedin: "linkedin";
+        reddit: "reddit";
         tiktok: "tiktok";
         x: "x";
         youtube: "youtube";
@@ -6611,6 +6645,20 @@ export declare const CreateSocialPostRequest: z.ZodObject<{
     raw: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;
+export declare const SocialOAuthProviderId: z.ZodEnum<{
+    reddit: "reddit";
+    x: "x";
+}>;
+export type SocialOAuthProviderId = z.infer<typeof SocialOAuthProviderId>;
+export declare const SocialOAuthStartRequest: z.ZodObject<{
+    provider: z.ZodEnum<{
+        reddit: "reddit";
+        x: "x";
+    }>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    returnPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SocialOAuthStartRequest = z.infer<typeof SocialOAuthStartRequest>;
 export declare const ConnectionKind: z.ZodEnum<{
     api_key: "api_key";
     app_install: "app_install";
@@ -6673,6 +6721,15 @@ export declare const ConnectionMetadata: z.ZodObject<{
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type ConnectionMetadata = z.infer<typeof ConnectionMetadata>;
+type PersonalSlackCanonicalConnection = Pick<ConnectionMetadata, "id" | "status" | "createdAt" | "updatedAt">;
+/**
+ * Canonical ordering for duplicate subject-owned Personal Slack rows.
+ *
+ * PostgreSQL broker lookup mirrors this exact sequence: usable status first,
+ * then newest update, newest creation, and immutable UUID descending.
+ */
+export declare function comparePersonalSlackCanonicalConnections(left: PersonalSlackCanonicalConnection, right: PersonalSlackCanonicalConnection): number;
+export declare function selectCanonicalPersonalSlackConnection<T extends PersonalSlackCanonicalConnection>(connections: readonly T[]): T | null;
 export declare const ConnectionCredentialBundle: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 export type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;
 export declare const CreateConnectionRequest: z.ZodObject<{
@@ -7528,7 +7585,12 @@ export declare const Session: z.ZodObject<{
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>;
@@ -7932,7 +7994,12 @@ export declare const CreateSessionResponse: z.ZodObject<{
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>;
@@ -8342,7 +8409,12 @@ export declare const SessionListResponse: z.ZodObject<{
             slack_bot_thread_replies: "slack_bot_thread_replies";
             social_connections_list: "social_connections_list";
             social_daily_analysis_context: "social_daily_analysis_context";
+            social_mentions_live: "social_mentions_live";
+            social_post_reply: "social_post_reply";
             social_posts_recent: "social_posts_recent";
+            social_posts_sync: "social_posts_sync";
+            social_search_live: "social_search_live";
+            social_thread_fetch: "social_thread_fetch";
             variable_set_list: "variable_set_list";
             variable_set_set_variable: "variable_set_set_variable";
         }>>;
@@ -8741,7 +8813,12 @@ export declare const SessionListResponse: z.ZodObject<{
             slack_bot_thread_replies: "slack_bot_thread_replies";
             social_connections_list: "social_connections_list";
             social_daily_analysis_context: "social_daily_analysis_context";
+            social_mentions_live: "social_mentions_live";
+            social_post_reply: "social_post_reply";
             social_posts_recent: "social_posts_recent";
+            social_posts_sync: "social_posts_sync";
+            social_search_live: "social_search_live";
+            social_thread_fetch: "social_thread_fetch";
             variable_set_list: "variable_set_list";
             variable_set_set_variable: "variable_set_set_variable";
         }>>;
@@ -9148,7 +9225,12 @@ export declare const SessionLineageResponse: z.ZodObject<{
             slack_bot_thread_replies: "slack_bot_thread_replies";
             social_connections_list: "social_connections_list";
             social_daily_analysis_context: "social_daily_analysis_context";
+            social_mentions_live: "social_mentions_live";
+            social_post_reply: "social_post_reply";
             social_posts_recent: "social_posts_recent";
+            social_posts_sync: "social_posts_sync";
+            social_search_live: "social_search_live";
+            social_thread_fetch: "social_thread_fetch";
             variable_set_list: "variable_set_list";
             variable_set_set_variable: "variable_set_set_variable";
         }>>;
@@ -11705,7 +11787,12 @@ export declare const CreateSessionRequest: z.ZodPreprocess<z.ZodObject<{
         slack_bot_thread_replies: "slack_bot_thread_replies";
         social_connections_list: "social_connections_list";
         social_daily_analysis_context: "social_daily_analysis_context";
+        social_mentions_live: "social_mentions_live";
+        social_post_reply: "social_post_reply";
         social_posts_recent: "social_posts_recent";
+        social_posts_sync: "social_posts_sync";
+        social_search_live: "social_search_live";
+        social_thread_fetch: "social_thread_fetch";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
     }>>>;
@@ -14461,6 +14548,21 @@ export declare const ClientConfig: z.ZodObject<{
         mode: z.ZodLiteral<"managedSession">;
         session: z.ZodLiteral<"cookie">;
     }, z.core.$strip>], "mode">>;
+    analytics: z.ZodDefault<z.ZodObject<{
+        consentRequired: z.ZodBoolean;
+        providers: z.ZodObject<{
+            reo: z.ZodOptional<z.ZodObject<{
+                clientId: z.ZodString;
+            }, z.core.$strip>>;
+            posthog: z.ZodOptional<z.ZodObject<{
+                projectKey: z.ZodString;
+                host: z.ZodString;
+            }, z.core.$strip>>;
+            ga4: z.ZodOptional<z.ZodObject<{
+                measurementId: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
     structuredServices: z.ZodDefault<z.ZodObject<{
         fileSystem: z.ZodBoolean;
         git: z.ZodBoolean;

package/dist/index.js

@@ -443,6 +443,8 @@ import {
   SetWorkspaceEnvironmentVariableRequest,
   SocialConnection,
   SocialConnectionStatus,
+  SocialOAuthProviderId,
+  SocialOAuthStartRequest,
   SocialPost,
   SocialProvider,
   StaticUsageLimits,
@@ -620,6 +622,7 @@ import {
   capabilityCatalogItemIsTrustedForExposure,
   compactSessionEventResult,
   compareCodexFleetCanonicalStringsV1,
+  comparePersonalSlackCanonicalConnections,
   createCodexFleetReplayRecordV1,
   createSecretRedactor,
   decodeNativeSnapshotRef,
@@ -664,6 +667,7 @@ import {
   resourceMountPathCollisionKey,
   retainedArtifactReferenceFromFile,
   retainedOutputUnavailable,
+  selectCanonicalPersonalSlackConnection,
   sessionEventJsonBytes,
   sessionEventLatestClassToSemanticClass,
   sessionEventMediaPreview,
@@ -684,7 +688,7 @@ import {
   verifyRelayToken,
   verifyStreamToken,
   workspaceControlUtf8Bytes
-} from "./chunk-S4F2GZPD.js";
+} from "./chunk-3Q5FLMOD.js";
 import {
   OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES,
   OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
@@ -1140,6 +1144,8 @@ export {
   SetWorkspaceEnvironmentVariableRequest,
   SocialConnection,
   SocialConnectionStatus,
+  SocialOAuthProviderId,
+  SocialOAuthStartRequest,
   SocialPost,
   SocialProvider,
   StaticUsageLimits,
@@ -1318,6 +1324,7 @@ export {
   capabilityCatalogItemIsTrustedForExposure,
   compactSessionEventResult,
   compareCodexFleetCanonicalStringsV1,
+  comparePersonalSlackCanonicalConnections,
   createCodexFleetReplayRecordV1,
   createSecretRedactor,
   decodeNativeSnapshotRef,
@@ -1363,6 +1370,7 @@ export {
   resourceMountPathCollisionKey,
   retainedArtifactReferenceFromFile,
   retainedOutputUnavailable,
+  selectCanonicalPersonalSlackConnection,
   sessionEventJsonBytes,
   sessionEventLatestClassToSemanticClass,
   sessionEventMediaPreview,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/contracts",
-  "version": "0.27.0",
+  "version": "0.28.1",
   "description": "Shared zod schemas and wire-contract types for the OpenGeni API.",
   "license": "Apache-2.0",
   "repository": {

package/src/index.ts

@@ -676,6 +676,10 @@ export const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS = [
   "sessions:read",
   "sessions:create",
   "sessions:control",
+  // Read-only connection discovery lets the selected first-party connector
+  // tools resolve an already-installed workspace principal. Credentials stay
+  // inside the broker and remain subject to each tool's own authorization.
+  "connections:read",
   "variable-sets:use",
   "variable-sets:manage",
   "rigs:use",
@@ -732,6 +736,11 @@ export const FIRST_PARTY_MCP_TOOL_NAMES = [
   "social_connections_list",
   "social_posts_recent",
   "social_daily_analysis_context",
+  "social_search_live",
+  "social_mentions_live",
+  "social_thread_fetch",
+  "social_posts_sync",
+  "social_post_reply",
   "scheduled_tasks_list",
   "scheduled_tasks_get",
   "scheduled_tasks_create",
@@ -760,12 +769,13 @@ export const FirstPartyMcpToolName = z.enum(FIRST_PARTY_MCP_TOOL_NAMES);
 export type FirstPartyMcpToolName = z.infer<typeof FirstPartyMcpToolName>;
 
 /**
- * Every catalogued OpenGeni tool is selected by default. Registration-time
- * authorization remains the independent access boundary; an explicit session
- * policy may narrow this model-visible set.
+ * Connector-wide tools are explicit-only. Ordinary session omission selects
+ * the non-connector catalog, while an explicit session policy may still select
+ * any catalogued connector tool and remains independently permission-gated.
  */
-export const DEFAULT_FIRST_PARTY_MCP_TOOLS =
-  FIRST_PARTY_MCP_TOOL_NAMES satisfies readonly FirstPartyMcpToolName[];
+export const DEFAULT_FIRST_PARTY_MCP_TOOLS = FIRST_PARTY_MCP_TOOL_NAMES.filter(
+  (name) => !name.startsWith("social_") && !name.startsWith("slack_bot_"),
+) satisfies readonly FirstPartyMcpToolName[];
 
 export function prefixedMcpToolName(registryId: string, toolName: string): string {
   return `${registryId}__${toolName}`;
@@ -5185,6 +5195,7 @@ export type EnablePackRequest = z.infer<typeof EnablePackRequest>;
 
 export const SocialProvider = z.enum([
   "x",
+  "reddit",
   "linkedin",
   "instagram",
   "facebook",
@@ -5257,6 +5268,19 @@ export const CreateSocialPostRequest = z.object({
 });
 export type CreateSocialPostRequest = z.infer<typeof CreateSocialPostRequest>;
 
+// Social OAuth is first-party (X / Reddit REST APIs), distinct from the MCP
+// integrations OAuth flow: these providers have no MCP resource metadata, so
+// endpoints are pinned per provider and tokens live in social_connections.
+export const SocialOAuthProviderId = z.enum(["x", "reddit"]);
+export type SocialOAuthProviderId = z.infer<typeof SocialOAuthProviderId>;
+
+export const SocialOAuthStartRequest = z.object({
+  provider: SocialOAuthProviderId,
+  scopes: z.array(z.string().min(1)).optional(),
+  returnPath: z.string().optional(),
+});
+export type SocialOAuthStartRequest = z.infer<typeof SocialOAuthStartRequest>;
+
 export const ConnectionKind = z.enum(["oauth2", "api_key", "app_install", "delegated"]);
 export type ConnectionKind = z.infer<typeof ConnectionKind>;
 
@@ -5306,6 +5330,70 @@ export const ConnectionMetadata = z.object({
 });
 export type ConnectionMetadata = z.infer<typeof ConnectionMetadata>;
 
+type PersonalSlackCanonicalConnection = Pick<
+  ConnectionMetadata,
+  "id" | "status" | "createdAt" | "updatedAt"
+>;
+
+const PERSONAL_SLACK_CONNECTION_STATUS_RANK = {
+  active: 0,
+  needs_reauth: 1,
+  error: 2,
+  revoked: 3,
+} as const satisfies Record<ConnectionStatus, number>;
+
+/**
+ * Canonical ordering for duplicate subject-owned Personal Slack rows.
+ *
+ * PostgreSQL broker lookup mirrors this exact sequence: usable status first,
+ * then newest update, newest creation, and immutable UUID descending.
+ */
+export function comparePersonalSlackCanonicalConnections(
+  left: PersonalSlackCanonicalConnection,
+  right: PersonalSlackCanonicalConnection,
+): number {
+  const statusDelta =
+    PERSONAL_SLACK_CONNECTION_STATUS_RANK[left.status] -
+    PERSONAL_SLACK_CONNECTION_STATUS_RANK[right.status];
+  if (statusDelta !== 0) return statusDelta;
+
+  const updatedAtDelta = compareDescending(
+    canonicalConnectionTimestamp(left.updatedAt),
+    canonicalConnectionTimestamp(right.updatedAt),
+  );
+  if (updatedAtDelta !== 0) return updatedAtDelta;
+
+  const createdAtDelta = compareDescending(
+    canonicalConnectionTimestamp(left.createdAt),
+    canonicalConnectionTimestamp(right.createdAt),
+  );
+  if (createdAtDelta !== 0) return createdAtDelta;
+
+  return compareDescending(left.id, right.id);
+}
+
+export function selectCanonicalPersonalSlackConnection<T extends PersonalSlackCanonicalConnection>(
+  connections: readonly T[],
+): T | null {
+  let selected: T | null = null;
+  for (const connection of connections) {
+    if (!selected || comparePersonalSlackCanonicalConnections(connection, selected) < 0) {
+      selected = connection;
+    }
+  }
+  return selected;
+}
+
+function canonicalConnectionTimestamp(value: string): number {
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : Number.NEGATIVE_INFINITY;
+}
+
+function compareDescending(left: number | string, right: number | string): number {
+  if (left === right) return 0;
+  return left > right ? -1 : 1;
+}
+
 export const ConnectionCredentialBundle = z.record(z.string(), z.unknown());
 export type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;
 
@@ -5646,8 +5734,8 @@ export const Session = z.object({
   // Non-default first-party MCP token permissions (manager-style sessions);
   // null means the fixed worker default set.
   firstPartyMcpPermissions: z.array(Permission).nullable(),
-  // Exact model-visible OpenGeni selection. All catalogued tools are selected
-  // by default; [] intentionally selects none.
+  // Exact model-visible OpenGeni selection. The default omits connector-wide
+  // tools; [] intentionally selects none.
   firstPartyMcpTools: z.array(FirstPartyMcpToolName),
   // Per-session third-party MCP servers, metadata only. Credential values are
   // write-only and never appear here.
@@ -7948,7 +8036,8 @@ export const CreateSessionRequest = withVariableSetIdAlias({
   // rejected; creation never silently expands a child beyond that set.
   firstPartyMcpPermissions: z.array(Permission).optional(),
   // Exact model-visible selection from the broad first-party OpenGeni MCP
-  // catalog. Omission selects the full catalog; [] intentionally exposes none.
+  // catalog. Omission selects the safe non-connector default; [] intentionally
+  // exposes none.
   // This does not grant authority: every registered tool is permission-gated.
   firstPartyMcpTools: z.array(FirstPartyMcpToolName).optional(),
   // Third-party MCP servers attached only to this session. For an agent-created
@@ -9326,6 +9415,35 @@ export const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>
     }),
     productAccessMode: ProductAccessMode,
     auth: ClientAuthConfig.default({ mode: "none" }),
+    analytics: z
+      .object({
+        consentRequired: z.boolean(),
+        providers: z.object({
+          reo: z
+            .object({
+              clientId: z
+                .string()
+                .max(128)
+                .regex(/^[A-Za-z0-9_-]+$/u),
+            })
+            .optional(),
+          posthog: z
+            .object({
+              projectKey: z.string().min(1).max(256),
+              host: z.string().url().max(2_048),
+            })
+            .optional(),
+          ga4: z
+            .object({
+              measurementId: z
+                .string()
+                .max(32)
+                .regex(/^G-[A-Z0-9]+$/u),
+            })
+            .optional(),
+        }),
+      })
+      .default({ consentRequired: true, providers: {} }),
     // Server-wide hint: does this deployment support Channel-A structured services
     // at all (P4.4). Per-session availability is negotiated on /stream-capabilities
     // (it depends on the session's pinned backend); this is the coarse on/off the