@opengeni/core 2.7.2-canary.0 → 2.7.5-canary.1

package/dist/access/index.d.ts

@@ -68,6 +68,16 @@ export declare function accessGrantAuthorizationFromContext(context: AccessConte
  * access resolver are present in `resolvedAccessGrantAuthorizations`.
  */
 export declare function requireAccountAdminAuthorizationStamp(authorization: AccessGrantAuthorization): AccountAdminAuthorizationStamp;
+/**
+ * Verify that an access authorization was minted by the canonical request
+ * resolver for this exact subject and workspace.
+ *
+ * This is the protocol-neutral boundary for request-local services that need
+ * the authenticated grant rather than a caller-supplied grant-shaped object.
+ * Object identity is intentional: matching fields alone are not proof that the
+ * request authenticated the named subject.
+ */
+export declare function requireResolvedAccessGrantAuthorization(authorization: AccessGrantAuthorization, workspaceId: string): AccessGrant;
 /**
  * Resolve the exact built-in single-user local administrator for an account.
  *

package/dist/application/api-integration-servers.d.ts

@@ -0,0 +1,20 @@
+import { type IntegrationInvocationAuthority } from "@opengeni/capabilities";
+import type { Settings } from "@opengeni/config";
+import type { ToolAuthNeededPayload } from "@opengeni/contracts";
+import type { ApiIntegrationRuntime, ResolveConnectionCredentialInput, ResolveConnectionCredentialResult } from "@opengeni/db";
+import type { FetchLike } from "@opengeni/network";
+import type { LocalMcpServerRegistration } from "@opengeni/runtime";
+export type BuildApiIntegrationServersInput = {
+    settings: Settings;
+    integrations: readonly ApiIntegrationRuntime[];
+    authority: Omit<IntegrationInvocationAuthority, "connectionRef">;
+    resolveCredential: (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+    onAuthNeeded?: (payload: ToolAuthNeededPayload) => Promise<void> | void;
+    fetchImpl?: FetchLike;
+};
+/**
+ * Compile active persisted API facets into ordinary in-process MCP providers.
+ * The caller supplies its authority resolver, so agent attempts and current
+ * humans use the same provider assembly without sharing credentials or policy.
+ */
+export declare function buildApiIntegrationMcpServers(input: BuildApiIntegrationServersInput): LocalMcpServerRegistration[];

package/dist/domain/github-action-policies.d.ts

@@ -0,0 +1,36 @@
+import type { GitHubActionPolicyActor, GitHubActionPolicyActorState, GitHubActionPolicyDecision, GitHubActionPolicyGroup } from "@opengeni/contracts";
+import { type ConnectorActionPolicySnapshotEntry, type Database } from "@opengeni/db";
+import { GITHUB_REST_MCP_APP_SERVER_ID, GITHUB_REST_MCP_PERSONAL_SERVER_ID } from "@opengeni/runtime/github-rest-mcp";
+export declare const GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES: {
+    readonly routine: ("issue_comment" | "issue_create" | "issue_update" | "pull_request_comment" | "pull_request_create" | "pull_request_request_review" | "pull_request_update" | "ref_create")[];
+    readonly review: readonly ["pull_request_review_submit"];
+    readonly merge: readonly ["pull_request_merge"];
+};
+export type GitHubActionPolicyActorBinding = {
+    actor: GitHubActionPolicyActor;
+    label: string;
+    connectionId: string;
+    serverId: typeof GITHUB_REST_MCP_APP_SERVER_ID | typeof GITHUB_REST_MCP_PERSONAL_SERVER_ID;
+};
+export declare function projectGitHubActionPolicyActor(policies: readonly ConnectorActionPolicySnapshotEntry[], binding: GitHubActionPolicyActorBinding): GitHubActionPolicyActorState;
+export declare function listGitHubActionPolicyActors(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    actors: readonly GitHubActionPolicyActorBinding[];
+}): Promise<GitHubActionPolicyActorState[]>;
+export declare function updateGitHubActionPolicyGroup(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    actor: GitHubActionPolicyActorBinding;
+    group: GitHubActionPolicyGroup;
+    decision: GitHubActionPolicyDecision;
+}): Promise<GitHubActionPolicyActorState>;
+export declare function githubAppActionPolicyActor(input: {
+    installationId: number;
+    accountLogin: string | null;
+}): GitHubActionPolicyActorBinding;
+export declare function personalGitHubActionPolicyActor(input: {
+    connectionId: string;
+    githubLogin: string;
+}): GitHubActionPolicyActorBinding;

package/dist/domain/pr-review.d.ts

@@ -80,7 +80,7 @@ export declare const prReviewAutomationAdapter: {
                 eager?: boolean | undefined;
                 optional?: boolean | undefined;
             }[];
-            firstPartyMcpTools: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_set" | "goal_update" | "goal_wait" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
+            firstPartyMcpTools: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_remove" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_propose" | "interaction_discover" | "interaction_request_human" | "knowledge_correct" | "knowledge_propose" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_search" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[];
             firstPartyMcpPermissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
             model: string | null;
             reasoningEffort: "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh" | null;

package/dist/index.d.ts

@@ -23,6 +23,7 @@ export * from "./domain/product-integration-pack.js";
 export * from "./domain/personal-connection-delegations.js";
 export * from "./domain/resources.js";
 export * from "./domain/github-repository-bindings.js";
+export * from "./domain/github-action-policies.js";
 export * from "./domain/session-tool-policy.js";
 export * from "./domain/scheduled-tasks.js";
 export * from "./domain/sessions.js";
@@ -49,5 +50,6 @@ export * from "./application/composer-submit.js";
 export * from "./application/session-commands.js";
 export * from "./application/session-tenancy.js";
 export * from "./application/user-resource-grants.js";
+export * from "./application/api-integration-servers.js";
 export * from "./editable-artifact-live.js";
 export * from "./editable-artifacts.js";

package/dist/index.js

@@ -731,7 +731,6 @@ import {
   verifyDirectWorkspaceMutationSettlement,
   verifyRetainedProcessMutationSettlement
 } from "@opengeni/db";
-import { settleSessionBackgroundCommandForRetainedProcess } from "@opengeni/db/session-background-commands";
 import { appendAndPublishEvents } from "@opengeni/events";
 import {
   isProviderSandboxGoneDuringRoutedOperation,
@@ -965,14 +964,9 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       reason: proof.reason,
       idleGraceMs: settings.sandboxIdleGraceMs
     });
-    const backgroundSettlement = retainedProcessBackgroundSettlement(settlement.process, proof);
-    await settleSessionBackgroundCommandForRetainedProcess(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      retainedProcessId: process.id,
-      ...backgroundSettlement
-    });
+    if (settlement.backgroundCommandEvents.length > 0 && bus) {
+      await bus.publish(ids.workspaceId, ids.sessionId, settlement.backgroundCommandEvents).catch(() => void 0);
+    }
   } : void 0;
   const resolver = makeActiveBackendResolver({
     workspaceId: ids.workspaceId,
@@ -1027,6 +1021,7 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     } : {}
   });
   const proxy = new RoutingSandboxSession({
+    bindActiveRouteOnFirstResolve: true,
     defaultResolved: {
       session: established.session,
       sandboxId: null,
@@ -2086,6 +2081,13 @@ function requireAccountAdminAuthorizationStamp(authorization) {
     permission: "account:admin"
   });
 }
+function requireResolvedAccessGrantAuthorization(authorization, workspaceId) {
+  const { grant } = authorization;
+  if (!resolvedAccessGrantAuthorizations.has(authorization) || !authorization.contextIntegrity || authorization.authenticatedSubjectId !== grant.subjectId || grant.workspaceId !== workspaceId) {
+    throw new HTTPException(403, { message: "workspace access authorization is invalid" });
+  }
+  return grant;
+}
 async function requireCanonicalLocalAccountAdministrator(c, deps, accountId) {
   if (c.req.header("authorization")) {
     throw new HTTPException(401, { message: "organization administrator session required" });
@@ -7940,6 +7942,111 @@ function applyGitHubRepositoryBindings(resources, bindings) {
   });
 }
 
+// src/domain/github-action-policies.ts
+import {
+  listConnectorActionPolicies,
+  resolveConnectorActionPolicy,
+  upsertConnectorActionPolicies
+} from "@opengeni/db";
+import {
+  GITHUB_REST_MCP_APP_SERVER_ID,
+  GITHUB_REST_MCP_PERSONAL_SERVER_ID,
+  GITHUB_REST_WRITE_TOOL_NAMES
+} from "@opengeni/runtime/github-rest-mcp";
+var GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES = {
+  routine: GITHUB_REST_WRITE_TOOL_NAMES.filter(
+    (toolName) => toolName !== "pull_request_review_submit" && toolName !== "pull_request_merge"
+  ),
+  review: ["pull_request_review_submit"],
+  merge: ["pull_request_merge"]
+};
+var groupedToolNames = Object.values(GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES).flat();
+if (groupedToolNames.length !== new Set(groupedToolNames).size || GITHUB_REST_WRITE_TOOL_NAMES.some((toolName) => !groupedToolNames.includes(toolName))) {
+  throw new Error("GitHub action policy groups must cover every write tool exactly once");
+}
+function effectiveToolDecision(policies, actor, toolName) {
+  const resolved = resolveConnectorActionPolicy(policies, {
+    connectionId: actor.connectionId,
+    serverId: actor.serverId,
+    toolName,
+    actionName: toolName
+  });
+  if (!resolved.managed) return "allow";
+  if (resolved.entry) return resolved.entry.policy;
+  return resolved.decision;
+}
+function effectiveGroupDecision(policies, actor, group) {
+  const decisions = new Set(
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[group].map(
+      (toolName) => effectiveToolDecision(policies, actor, toolName)
+    )
+  );
+  return decisions.size === 1 ? decisions.values().next().value : "mixed";
+}
+function projectGitHubActionPolicyActor(policies, binding) {
+  const groups = {
+    routine: effectiveGroupDecision(policies, binding, "routine"),
+    review: effectiveGroupDecision(policies, binding, "review"),
+    merge: effectiveGroupDecision(policies, binding, "merge")
+  };
+  return binding.actor.kind === "workspace_app" ? {
+    kind: "workspace_app",
+    installationId: binding.actor.installationId,
+    label: binding.label,
+    groups
+  } : {
+    kind: "personal",
+    connectionId: binding.actor.connectionId,
+    label: binding.label,
+    groups
+  };
+}
+async function listGitHubActionPolicyActors(db, input) {
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: input.actors.map((actor) => actor.connectionId)
+  });
+  return input.actors.map((actor) => projectGitHubActionPolicyActor(policies, actor));
+}
+async function updateGitHubActionPolicyGroup(db, input) {
+  await upsertConnectorActionPolicies(
+    db,
+    GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES[input.group].map((toolName) => ({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      connectionId: input.actor.connectionId,
+      serverId: input.actor.serverId,
+      toolName,
+      actionName: toolName,
+      policy: input.decision
+    }))
+  );
+  const policies = await listConnectorActionPolicies(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    connectionIds: [input.actor.connectionId]
+  });
+  return projectGitHubActionPolicyActor(policies, input.actor);
+}
+function githubAppActionPolicyActor(input) {
+  return {
+    actor: { kind: "workspace_app", installationId: input.installationId },
+    label: input.accountLogin ? `OpenGeni bot on ${input.accountLogin}` : "OpenGeni bot",
+    connectionId: `github-app:${input.installationId}`,
+    serverId: GITHUB_REST_MCP_APP_SERVER_ID
+  };
+}
+function personalGitHubActionPolicyActor(input) {
+  return {
+    actor: { kind: "personal", connectionId: input.connectionId },
+    label: `@${input.githubLogin}`,
+    connectionId: input.connectionId,
+    serverId: GITHUB_REST_MCP_PERSONAL_SERVER_ID
+  };
+}
+
 // src/domain/session-tool-policy.ts
 import {
   SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
@@ -14920,6 +15027,7 @@ import {
   getSandbox as getSandbox5,
   getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
+  newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
   publicNewSessionDraftOptions,
@@ -14933,6 +15041,7 @@ function hasOwn(value, key) {
 }
 function mapNewSessionDraft(row) {
   if (!row) return null;
+  const selectedProjectChannelId = newSessionDraftSelectedProjectChannelId(row);
   return NewSessionDraft.parse({
     revision: row.revision,
     text: row.text,
@@ -14942,6 +15051,7 @@ function mapNewSessionDraft(row) {
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...selectedProjectChannelId !== void 0 ? { selectedProjectChannelId } : {},
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString()
@@ -15102,6 +15212,7 @@ async function saveActorNewSessionDraft(deps, grant, workspaceId, rawInput, cano
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...input.selectedProjectChannelId !== void 0 ? { selectedProjectChannelId: input.selectedProjectChannelId } : {},
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
           // API keys and delegated service actors (for example the first-party
@@ -15508,7 +15619,7 @@ async function controlAgentSessionWorkstream(deps, context, input) {
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true
+          controlRequested: input.action === "pause"
         });
       }
     }
@@ -15796,7 +15907,7 @@ async function controlHumanSessionWorkstreamWithOutcome(deps, context, input) {
           wakeRevision: result.workflowWake.wakeRevision,
           shouldSignal: true,
           interruptionCount: result.interruptionCount,
-          controlRequested: true
+          controlRequested: input.action === "pause"
         });
       }
     }
@@ -16009,6 +16120,143 @@ async function revokeManagedHumanUserResourceGrant(deps, authorization, workspac
     grantId
   });
 }
+
+// src/application/api-integration-servers.ts
+import {
+  createGraphqlMcpServer,
+  createOpenApiMcpServer,
+  createPinnedIntegrationTransport,
+  directIntegrationTransport,
+  IntegrationInvocationError
+} from "@opengeni/capabilities";
+function buildApiIntegrationMcpServers(input) {
+  const transport = createPinnedIntegrationTransport({
+    network: input.settings,
+    ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+  });
+  return input.integrations.map((integration) => {
+    const authority = {
+      ...input.authority,
+      ...integration.connectionRef?.connectionId ? { connectionRef: integration.connectionRef.connectionId } : {}
+    };
+    const credentialResolver = integration.connectionRef ? integrationCredentialResolver(input, integration, "execution") : void 0;
+    const buildServer = (serverTransport, serverCredentialResolver = credentialResolver) => integration.revision.protocol === "openapi" ? createOpenApiMcpServer({
+      revision: integration.revision,
+      transport: serverTransport,
+      authority,
+      ...serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}
+    }) : createGraphqlMcpServer({
+      revision: integration.revision,
+      endpoint: integration.baseUrl,
+      transport: serverTransport,
+      authority,
+      ...serverCredentialResolver ? { credentialResolver: serverCredentialResolver } : {}
+    });
+    const server = buildServer(transport);
+    const preflightCredentialResolver = integration.connectionRef ? integrationCredentialResolver(input, integration, "preflight") : void 0;
+    const preflightServer = preflightCredentialResolver ? buildServer(providerBlockingPreflightTransport, preflightCredentialResolver) : null;
+    return {
+      id: integration.serverId,
+      server,
+      approvalAuthority: {
+        kind: "api_integration",
+        capabilityId: integration.capabilityId,
+        pluginKey: integration.pluginKey,
+        pluginInstallationId: integration.pluginInstallationId,
+        installationVersion: integration.installationVersion,
+        instanceId: integration.instanceId,
+        instanceKey: integration.instanceKey,
+        instanceVersion: integration.instanceVersion,
+        definitionId: integration.definitionId,
+        definitionProvenance: integration.definitionProvenance,
+        revisionId: integration.revision.id,
+        baseUrl: integration.baseUrl,
+        providerDomain: integration.providerDomain,
+        connectionRef: integration.connectionRef,
+        connectionAuthorityGeneration: integration.connectionAuthorityGeneration
+      },
+      ...integration.connectionRef?.connectionId ? { resolvedConnectionId: integration.connectionRef.connectionId } : {},
+      ...credentialResolver ? {
+        preflightCall: async (toolName, args, options) => await preflightApiIntegrationCall(preflightServer, toolName, args, options)
+      } : {}
+    };
+  });
+}
+var providerBlockingPreflightTransport = directIntegrationTransport(async () => {
+  throw new Error("integration provider request blocked by preflight");
+});
+async function preflightApiIntegrationCall(server, toolName, args, options) {
+  try {
+    await server.callTool(toolName, args, null, options);
+  } catch (error) {
+    if (error instanceof IntegrationInvocationError && error.code === "request_failed") return;
+    throw error;
+  }
+  throw new Error("integration preflight unexpectedly crossed the provider request boundary");
+}
+function integrationCredentialResolver(input, integration, credentialResolutionMode) {
+  const connectionRef = integration.connectionRef;
+  if (!connectionRef) throw new Error("Integration credential resolver requires a connection");
+  const expectedAuthorityGeneration = integration.connectionAuthorityGeneration;
+  if (expectedAuthorityGeneration === null) {
+    throw new Error("Integration credential resolver requires a connection authority generation");
+  }
+  return {
+    resolve: async (request) => {
+      const result = await input.resolveCredential({
+        workspaceId: input.authority.workspaceId,
+        serverId: integration.serverId,
+        toolName: request.operationKey,
+        connectionRef,
+        destinationUrl: request.destinationUrl,
+        credentialTarget: "http_api",
+        forceRefresh: request.forceRefresh === true,
+        credentialResolutionMode,
+        expectedAuthorityGeneration
+      });
+      if (result.status === "auth_needed") {
+        await publishAuthNeeded(
+          input,
+          integration.serverId,
+          request.operationKey,
+          result,
+          connectionRef
+        );
+        return null;
+      }
+      const destination = new URL(request.destinationUrl);
+      return {
+        audience: { origin: destination.origin, pathPrefix: "/" },
+        placements: result.placements ?? Object.entries(result.headers).map(([name, value]) => ({
+          carrier: "header",
+          name,
+          value
+        })),
+        ...result.authorizeProviderRequest ? { authorizeProviderRequest: result.authorizeProviderRequest } : {},
+        ...result.expiresAt ? { expiresAt: result.expiresAt.toISOString() } : {},
+        ...connectionRef.scopes ? { scope: [...connectionRef.scopes] } : {}
+      };
+    }
+  };
+}
+async function publishAuthNeeded(input, serverId, toolName, result, connectionRef) {
+  try {
+    await input.onAuthNeeded?.({
+      serverId,
+      toolName,
+      providerDomain: result.providerDomain,
+      ...result.provider ? { provider: result.provider } : {},
+      reason: result.reason,
+      ...result.connectionId ? { connectionId: result.connectionId } : {},
+      ...result.authoritySource === "host" || connectionRef.authoritySource === "host" ? { authoritySource: "host" } : {},
+      ...result.scopes ? { scopes: result.scopes } : {},
+      ...result.resource ? { resource: result.resource } : {},
+      ...result.selectedResources ? { selectedResources: result.selectedResources } : {},
+      ...result.authorizationUrl ? { authorizationUrl: result.authorizationUrl } : {}
+    });
+  } catch {
+  }
+}
 export {
   CODEX_COMPACTION_V2_PROVIDER_LOCKED,
   CONVERSATION_ATTACHMENT_MAX_COUNT,
@@ -16071,6 +16319,7 @@ export {
   EditableArtifactSnapshotVerificationError,
   EditableArtifactStaleBaseError,
   EditableArtifactUndoTargetError,
+  GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES,
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
@@ -16168,6 +16417,7 @@ export {
   authorizedSocialConnectionsForGrant,
   automationRequestDigest,
   availableToolRefs,
+  buildApiIntegrationMcpServers,
   buildAutomationAcceptedExecution,
   buildCapabilityCatalog,
   buildFleetContextForSession,
@@ -16276,6 +16526,7 @@ export {
   getManagedHumanSessionCreateCapabilities,
   getManagedSession,
   getWorkspaceInsights,
+  githubAppActionPolicyActor,
   googleDrivePublicationDelegationFromVisibleConnections,
   governedLearningEvidenceIsSlackDerived,
   governedLearningSlackImportance,
@@ -16306,6 +16557,7 @@ export {
   legacySandboxRuntimeFromPacks,
   listCapabilityPacks,
   listFleet,
+  listGitHubActionPolicyActors,
   listGitHubRepositoryBindingCandidates,
   listManagedHumanUserResourceAuthorities,
   listRigChangesForApi,
@@ -16353,6 +16605,7 @@ export {
   personalConnectionDelegationsEqual,
   personalConnectionDelegationsFromParent,
   personalConnectionDelegationsFromVisibleConnections,
+  personalGitHubActionPolicyActor,
   personalGitHubRepositoryResources,
   portableSkillCapabilityId,
   portableSkillPluginKey,
@@ -16367,6 +16620,7 @@ export {
   preferredFikenConnection,
   preflightCreateTimeSandboxTarget,
   previewCapabilityPackInstallation,
+  projectGitHubActionPolicyActor,
   promoteSetupAppendChange,
   promoteVerifiedDefinitionEditChangeForApi,
   proposeRigChangeForApi,
@@ -16399,6 +16653,7 @@ export {
   requireOpenGeniSlackBotConnection,
   requirePermission,
   requireQueuedTurnForApi,
+  requireResolvedAccessGrantAuthorization,
   requireRigChangeForApi,
   requireRigForApi,
   requireScheduledTaskForApi,
@@ -16472,6 +16727,7 @@ export {
   syncCreatedScheduledTask,
   syncUpdatedScheduledTask,
   unboundGitHubRepositoryResources,
+  updateGitHubActionPolicyGroup,
   updateManagedHumanSessionVisibility,
   updateRigForApi,
   updateScheduledTaskForApi,