@opengeni/core 3.0.1 → 3.1.2

package/src/application/organization-privacy.ts

@@ -0,0 +1,161 @@
+import type { Settings } from "@opengeni/config";
+import type {
+  OrganizationPrivacySettings,
+  UpdateOrganizationPrivacySettingsRequest,
+} from "@opengeni/contracts";
+import {
+  getOrganizationPrivacyPreferences,
+  getPrivateSessionCreatePolicy,
+  SessionTenancyNotActivatedError,
+  updateOrganizationPrivacyPreferences,
+  type Database,
+  type OrganizationPrivacyPreferences,
+} from "@opengeni/db";
+
+/**
+ * Privacy: who can see chats, schedules and their runs. An organization's
+ * owners and admins choose whether Only me is allowed (the private session
+ * setting), the default audience for new chats and schedules, and whether
+ * admins see that other people's Only me schedules exist. A deployment, such
+ * as a product that embeds Opengeni, can only narrow those choices. See
+ * docs/design/privacy-audiences-2026-10-11.md.
+ */
+
+export type PrivacySettings = Pick<
+  Settings,
+  | "privacyOnlyMeAllowed"
+  | "privacyWorkspaceDefaultRequired"
+  | "privacyAdminScheduleSummariesRequired"
+>;
+
+export type PrivacyDeploymentLimits = OrganizationPrivacySettings["limits"];
+
+export function privacyDeploymentLimits(settings: PrivacySettings): PrivacyDeploymentLimits {
+  const onlyMeAllowed = settings.privacyOnlyMeAllowed !== false;
+  return {
+    onlyMeAllowed,
+    // Without Only me, Workspace is the only possible default.
+    defaultVisibilityLocked: !onlyMeAllowed || settings.privacyWorkspaceDefaultRequired === true,
+    adminsSeePrivateSchedulesLocked: settings.privacyAdminScheduleSummariesRequired === true,
+  };
+}
+
+export type EffectiveOrganizationPrivacy = {
+  defaultVisibility: "private" | "workspace";
+  adminsSeePrivateSchedules: boolean;
+};
+
+/** The organization's choices with the deployment's limits applied. */
+export function effectiveOrganizationPrivacy(
+  preferences: Pick<
+    OrganizationPrivacyPreferences,
+    "defaultVisibility" | "adminsSeePrivateSchedules"
+  >,
+  limits: PrivacyDeploymentLimits,
+): EffectiveOrganizationPrivacy {
+  return {
+    defaultVisibility:
+      !limits.defaultVisibilityLocked && preferences.defaultVisibility === "user_private"
+        ? "private"
+        : "workspace",
+    adminsSeePrivateSchedules:
+      limits.adminsSeePrivateSchedulesLocked || preferences.adminsSeePrivateSchedules,
+  };
+}
+
+export async function resolveOrganizationPrivacy(
+  deps: { db: Database; settings: PrivacySettings },
+  accountId: string,
+): Promise<EffectiveOrganizationPrivacy> {
+  return effectiveOrganizationPrivacy(
+    await getOrganizationPrivacyPreferences(deps.db, accountId),
+    privacyDeploymentLimits(deps.settings),
+  );
+}
+
+/**
+ * Refuse a new Only me chat or schedule in a shared workspace when this
+ * deployment turns Only me off. A Personal workspace is only ever its owner's,
+ * so it is unaffected. Existing Only me items keep their audience: narrowing
+ * is always allowed, widening never happens silently.
+ */
+export async function requireDeploymentAllowsOnlyMe(
+  deps: { db: Database; settings: PrivacySettings },
+  input: { workspaceId: string; actorSubjectId: string },
+): Promise<void> {
+  if (privacyDeploymentLimits(deps.settings).onlyMeAllowed) return;
+  const policy = await getPrivateSessionCreatePolicy(deps.db, input).catch(() => null);
+  if (!policy?.personalWorkspace) throw new SessionTenancyNotActivatedError();
+}
+
+/** Raised when a change would go past what this deployment allows. */
+export class OrganizationPrivacyLockedError extends Error {
+  readonly name = "OrganizationPrivacyLockedError";
+}
+
+function settingsResponse(
+  organizationId: string,
+  preferences: OrganizationPrivacyPreferences,
+  limits: PrivacyDeploymentLimits,
+): OrganizationPrivacySettings {
+  return {
+    organizationId,
+    ...effectiveOrganizationPrivacy(preferences, limits),
+    limits,
+    updatedAt: preferences.updatedAt,
+  };
+}
+
+export async function getOrganizationPrivacySettings(
+  deps: { db: Database; settings: PrivacySettings },
+  organizationId: string,
+): Promise<OrganizationPrivacySettings> {
+  return settingsResponse(
+    organizationId,
+    await getOrganizationPrivacyPreferences(deps.db, organizationId),
+    privacyDeploymentLimits(deps.settings),
+  );
+}
+
+/**
+ * Change the organization's privacy choices. Only an owner or admin may, and
+ * never past the deployment's limits.
+ */
+export async function updateOrganizationPrivacySettings(
+  deps: { db: Database; settings: PrivacySettings },
+  input: {
+    organizationId: string;
+    actorSubjectId: string;
+    request: UpdateOrganizationPrivacySettingsRequest;
+  },
+): Promise<OrganizationPrivacySettings> {
+  const limits = privacyDeploymentLimits(deps.settings);
+  if (input.request.defaultVisibility === "private" && limits.defaultVisibilityLocked) {
+    throw new OrganizationPrivacyLockedError(
+      limits.onlyMeAllowed
+        ? "New chats and schedules always start as Workspace here."
+        : "Only me is turned off here.",
+    );
+  }
+  if (input.request.adminsSeePrivateSchedules === false && limits.adminsSeePrivateSchedulesLocked) {
+    throw new OrganizationPrivacyLockedError(
+      "Admins always see that Only me schedules exist here.",
+    );
+  }
+  const preferences = await updateOrganizationPrivacyPreferences(deps.db, {
+    organizationId: input.organizationId,
+    actorSubjectId: input.actorSubjectId,
+    ...(input.request.defaultVisibility
+      ? {
+          defaultVisibility:
+            input.request.defaultVisibility === "private"
+              ? ("user_private" as const)
+              : ("workspace_shared" as const),
+        }
+      : {}),
+    ...(input.request.adminsSeePrivateSchedules !== undefined
+      ? { adminsSeePrivateSchedules: input.request.adminsSeePrivateSchedules }
+      : {}),
+  });
+  return settingsResponse(input.organizationId, preferences, limits);
+}

package/src/application/prepared-mcp-connection.ts

@@ -0,0 +1,133 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import {
+  CapabilityCatalogItem,
+  McpServerConnectionRef,
+  stableJson,
+  type AccessGrant,
+  type ConnectionMetadata,
+} from "@opengeni/contracts";
+import type { ConnectOwnership, PreparedMcpSetup } from "@opengeni/contracts/connect";
+import type { Settings } from "@opengeni/config";
+import { getCapabilityCatalogItem, type Database } from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+import {
+  createCatalogItem,
+  prepareCapabilityEnable,
+  validateMcpCapabilityConnection,
+  type McpCapabilityProbe,
+} from "../domain/capabilities";
+
+/** Initialize/list tools before committing anything. Secret headers stay in this
+ * invocation; the installation contains only an ordinary native connection ref.
+ * The caller commits the connection and this installation in one authorized
+ * Connect operation, so retries cannot leave an orphan credential or catalog. */
+export async function prepareMcpConnectionActivation(input: {
+  grant: AccessGrant;
+  settings: Settings;
+  setup: PreparedMcpSetup;
+  ownership: ConnectOwnership;
+  headers: Record<string, string>;
+  probe?: McpCapabilityProbe;
+}) {
+  const { grant, settings, ownership } = input;
+  const setup = structuredClone(input.setup);
+  const endpoint = new URL(setup.endpointUrl).toString();
+  const key = createHash("sha256")
+    .update(stableJson({ endpoint, ownership }))
+    .digest("hex")
+    .slice(0, 32);
+  const capabilityId = `mcp:custom-${key}`;
+  const item = CapabilityCatalogItem.parse({
+    id: capabilityId,
+    kind: "mcp",
+    source: "manual",
+    name: setup.name,
+    endpointUrl: endpoint,
+    authModel: "native_connection",
+    runtime: { available: true, mcpServerId: `custom-${key}` },
+    metadata: { mcpServerId: `custom-${key}` },
+  });
+  const connectivity = await validateMcpCapabilityConnection(
+    item,
+    input.probe,
+    { ...input.headers },
+    settings,
+  );
+  return {
+    capabilityId,
+    commit: async (db: Database, connection: ConnectionMetadata) => {
+      const existing = await getCapabilityCatalogItem(db, grant.workspaceId, capabilityId);
+      if (existing && (existing.kind !== "mcp" || existing.endpointUrl !== endpoint))
+        throw new HTTPException(409, { message: "MCP catalog definition changed; reload setup" });
+      if (!existing)
+        await createCatalogItem({
+          db,
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          payload: {
+            id: capabilityId,
+            kind: "mcp",
+            source: "manual",
+            name: setup.name,
+            endpointUrl: endpoint,
+            authModel: "native_connection",
+            category: "custom",
+            tags: [],
+            metadata: item.metadata,
+          },
+        });
+      const connectionRef: McpServerConnectionRef = {
+        providerDomain: new URL(endpoint).hostname,
+        subjectScope: ownership === "personal" ? "subject" : "workspace",
+        accountSelection: "all_eligible",
+        kind: "api_key",
+        resource: endpoint,
+      };
+      const prepared = await prepareCapabilityEnable({
+        db,
+        grant,
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        settings,
+        capabilityId,
+        payload: {
+          onlyIfUninstalled: true,
+          config: {},
+          headers: {},
+          metadata: {},
+          connectionRef,
+        },
+        verifiedConnection: {
+          id: connection.id,
+          version: connection.version,
+          endpointUrl: endpoint,
+          connectivity,
+        },
+      });
+      const installation = await prepared.commit(db);
+      const savedRef = McpServerConnectionRef.safeParse(installation.config.connectionRef);
+      const retainedExactPin =
+        savedRef.success &&
+        savedRef.data.authoritySource !== "host" &&
+        savedRef.data.connectionId === connection.id &&
+        savedRef.data.providerDomain === connectionRef.providerDomain &&
+        (savedRef.data.subjectScope ?? "workspace") === connectionRef.subjectScope &&
+        (savedRef.data.kind ?? connection.kind) === connection.kind &&
+        (!savedRef.data.resource || savedRef.data.resource === endpoint);
+      // onlyIfUninstalled preserves existing account choices. Do not report a
+      // newly saved account as usable when a different binding was preserved;
+      // throw inside Connect's transaction so its credential also rolls back.
+      // Reconnecting the exact pinned account keeps the pin and its restrictions.
+      if (
+        installation.status !== "active" ||
+        (!retainedExactPin && !isDeepStrictEqual(installation.config.connectionRef, connectionRef))
+      ) {
+        throw new HTTPException(409, {
+          message: "MCP account selection changed; review the existing connection before setup",
+        });
+      }
+      return installation;
+    },
+  };
+}

package/src/application/sandbox-recovery.ts

@@ -0,0 +1,78 @@
+import type { SandboxRecoveryRequest } from "@opengeni/contracts";
+import { consentPublicSandboxRecovery, readPublicSandboxRecovery } from "@opengeni/db";
+import { requirePermission, type AccessGrantAuthorization } from "../access";
+import type { AppDependencies } from "../dependencies";
+import { requireSessionAuthorization } from "../session-authorization";
+import { requireCanonicalManagedHuman } from "./session-tenancy";
+
+type Dependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
+
+/** The read-only projection also serves the exact built-in local human. Its
+ * provenance stamp is set only by the local resolver, never a bearer claim. */
+export function requireSandboxRecoveryPreviewHuman(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): void {
+  if (
+    authorization.canonicalLocalHumanSession &&
+    authorization.contextIntegrity &&
+    authorization.authenticatedSubjectId === authorization.grant.subjectId &&
+    authorization.grant.workspaceId === workspaceId &&
+    authorization.grant.subjectId === "dev" &&
+    authorization.grant.principalKind === "human_session" &&
+    authorization.grant.metadata?.delegated !== true &&
+    !authorization.grant.serviceInitiator
+  )
+    return;
+  requireCanonicalManagedHuman(authorization, workspaceId);
+}
+
+async function authorize(
+  deps: Dependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sessionId: string,
+  intent: "preview" | "consent",
+) {
+  // Cookie-verification stamp, never principal-shape inference or an actor from
+  // the body. The local human may only read; agents, API keys and delegated
+  // humans cannot accept data loss or broaden the consent mutation.
+  if (intent === "consent") requireCanonicalManagedHuman(authorization, workspaceId);
+  else requireSandboxRecoveryPreviewHuman(authorization, workspaceId);
+  requirePermission(authorization.grant, "sessions:read");
+  requirePermission(authorization.grant, "sessions:control");
+  await requireSessionAuthorization(deps, authorization.grant, {
+    sessionId,
+    operation: "session.control",
+    surface: "core",
+  });
+  return {
+    accountId: authorization.grant.accountId,
+    workspaceId,
+    sessionId,
+    subjectId: authorization.grant.subjectId,
+  };
+}
+
+export async function getManagedHumanSandboxRecovery(
+  deps: Dependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sessionId: string,
+) {
+  return readPublicSandboxRecovery(
+    deps.db,
+    await authorize(deps, authorization, workspaceId, sessionId, "preview"),
+  );
+}
+
+export async function consentManagedHumanSandboxRecovery(
+  deps: Dependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sessionId: string,
+  request: SandboxRecoveryRequest,
+) {
+  const scope = await authorize(deps, authorization, workspaceId, sessionId, "consent");
+  return consentPublicSandboxRecovery(deps.db, { ...scope, request });
+}

package/src/application/session-commands.ts

@@ -17,7 +17,10 @@ import type {
   WorkspaceInferenceControlResponse,
 } from "@opengeni/contracts";
 import { DraftTimelineAnnotations } from "@opengeni/contracts";
+import type { Settings } from "@opengeni/config";
+import { HTTPException } from "hono/http-exception";
 import {
+  checkWorkspaceAllowance,
   deleteSessionQueueItemInTransaction,
   editQueuedTurnInTransaction,
   getComposerDraftInTransaction,
@@ -25,6 +28,8 @@ import {
   getSessionEvent,
   getWorkspaceControlEvent,
   getSessionQueueSnapshot,
+  frozenInitiatorForCommandActor,
+  isCodexBilledTurn,
   moveQueuedTurnInTransaction,
   mutateSessionControlInTransaction,
   mutateWorkspaceControlInTransaction,
@@ -53,6 +58,9 @@ import {
 import type { SessionWorkflowClient } from "../dependencies";
 import { normalizeResources } from "../domain/resources";
 import { validateDraftTimelineAnnotations } from "../domain/timeline-annotations";
+import { initiatingHumanForAllowance } from "../domain/sessions";
+import { coreRoutedSubscriptionFunding, modelFundingForAdmission } from "../billing/limits";
+import { resolveWorkspaceCatalogSettings } from "../model-catalog";
 import {
   requireSessionAuthorization,
   type ResolvedSessionAuthorization,
@@ -148,6 +156,63 @@ function agentActor(context: AgentSessionCommandContext) {
   };
 }
 
+/**
+ * Called inside the command's exact live-attempt fence, after receipt recovery
+ * but before any fresh work or Steer interruption. Attribution comes from the
+ * caller's accepted turn, never the target creator or request subject.
+ */
+async function assertFreshAgentCommandAllowance(
+  tx: SessionActivityDatabase,
+  deps: { settings?: Settings },
+  context: AgentSessionCommandContext,
+  targetSessionId: string,
+): Promise<void> {
+  const target = await getSession(tx, context.workspaceId, targetSessionId);
+  if (!target || target.accountId !== context.accountId) {
+    throw new HTTPException(404, { message: "Target session not found" });
+  }
+  let fundedWithoutCredits = false;
+  const frozen = await frozenInitiatorForCommandActor(tx, context.workspaceId, agentActor(context));
+  if (deps.settings) {
+    const { settings } = await resolveWorkspaceCatalogSettings(tx, deps.settings, {
+      accountId: target.accountId,
+      workspaceId: context.workspaceId,
+      retainedProductModelId: target.model,
+    });
+    const codexBilled = await isCodexBilledTurn({
+      db: tx,
+      settings,
+      workspaceId: context.workspaceId,
+      model: target.model,
+      accountId: target.accountId,
+      subjectId: initiatingHumanForAllowance(frozen),
+    });
+    fundedWithoutCredits = modelFundingForAdmission(
+      settings,
+      target.model,
+      codexBilled,
+      await coreRoutedSubscriptionFunding(tx, settings, {
+        accountId: target.accountId,
+        workspaceId: context.workspaceId,
+        model: target.model,
+        subjectId: initiatingHumanForAllowance(frozen),
+      }),
+    ).fundedWithoutCredits;
+  }
+  const refusal = await checkWorkspaceAllowance(tx, {
+    accountId: target.accountId,
+    workspaceId: context.workspaceId,
+    subjectId: initiatingHumanForAllowance(frozen),
+    ...(fundedWithoutCredits ? { fundedWithoutCredits: true } : {}),
+  });
+  if (refusal) {
+    throw new HTTPException(402, {
+      message: refusal.message,
+      cause: { allowed: false, ...refusal },
+    });
+  }
+}
+
 /**
  * Retry only one operation-keyed session command transaction. Callers keep
  * event publication and Temporal wake delivery after this returns, so a
@@ -276,7 +341,8 @@ async function wakeSessionCommand(
 /**
  * Nudge the one bounded dispatcher after a set-based control transaction. The
  * API never materializes descendant session ids; Postgres remains the complete
- * wake ledger and the 10-second Schedule repairs a lost immediate trigger.
+ * wake ledger and the control worker's 10-second repair cadence recovers a
+ * lost immediate trigger.
  */
 async function requestControlWakeDispatch(
   deps: {
@@ -334,6 +400,7 @@ async function publishWorkspaceControlEvent(
 export async function sendAgentSessionMessage(
   deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;
@@ -356,6 +423,8 @@ export async function sendAgentSessionMessage(
           actor: agentActor(context),
           operationKey: input.idempotencyKey,
           text: input.text,
+          assertFreshAdmission: (scoped) =>
+            assertFreshAgentCommandAllowance(scoped, deps, context, input.targetSessionId),
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
         }),
     },
@@ -400,6 +469,7 @@ export async function sendAgentSessionMessage(
 export async function steerAgentSession(
   deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;
@@ -426,6 +496,8 @@ export async function steerAgentSession(
           actor: agentActor(context),
           operationKey: input.idempotencyKey,
           instruction: input.instruction,
+          assertFreshAdmission: (scoped) =>
+            assertFreshAgentCommandAllowance(scoped, deps, context, input.targetSessionId),
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
         }),
     },

package/src/application/session-mcp-credential-rotation.ts

@@ -14,6 +14,7 @@ import { HTTPException } from "hono/http-exception";
 import type { Settings } from "@opengeni/config";
 import {
   requirePermission,
+  hasVerifiedOwningUserAuthorization,
   requireResolvedAccessGrantAuthorization,
   type AccessGrantAuthorization,
 } from "../access";
@@ -24,9 +25,14 @@ import {
   SessionAuthorizationUnavailableError,
   type SessionAuthorizationDependencies,
 } from "../session-authorization";
-import { requireVariableSetEncryption } from "../domain/environments";
+import { requireEnvironmentEncryption } from "../domain/encryption-key";
 import { normalizedSessionMcpCredentialHeaders } from "../domain/sessions";
 import { externalContinuationCommitAuthorizer } from "./external-continuation";
+import {
+  listOwnConnectionAccountsForGrant,
+  personalConnectionDelegationSourceForGrant,
+} from "../domain/personal-connection-delegations";
+import { nativeSessionConnectionReplacement } from "../domain/session-native-connection-replacement";
 
 /** HMAC domains separate request identity from key availability. The key tag
  * carries no request material and neither fingerprint is returned publicly. */
@@ -70,7 +76,7 @@ export async function rotateSessionMcpCredentialsForRequest(
   const parsed = RotateSessionMcpCredentialsRequest.safeParse(raw);
   if (!parsed.success)
     throw new HTTPException(422, { message: "invalid credential rotation request" });
-  const encryptionKey = requireVariableSetEncryption(deps.settings);
+  const encryptionKey = requireEnvironmentEncryption(deps.settings);
   let request: RotateSessionMcpCredentialsRequest;
   try {
     request = {
@@ -80,11 +86,20 @@ export async function rotateSessionMcpCredentialsForRequest(
           id: update.id,
           expectedCredentialVersion: update.expectedCredentialVersion,
           expectedServerUrl: update.expectedServerUrl,
-          headers: Object.fromEntries(
-            Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
-              .map(([name, value]) => [name.toLowerCase(), value] as const)
-              .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
-          ),
+          ...("nativeConnectionId" in update
+            ? {
+                nativeConnectionId: update.nativeConnectionId,
+                ...(update.replacementServerUrl
+                  ? { replacementServerUrl: update.replacementServerUrl }
+                  : {}),
+              }
+            : {
+                headers: Object.fromEntries(
+                  Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
+                    .map(([name, value]) => [name.toLowerCase(), value] as const)
+                    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+                ),
+              }),
         }))
         .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
     };
@@ -102,20 +117,45 @@ export async function rotateSessionMcpCredentialsForRequest(
     actorType: grant.principalKind === "service" ? ("service" as const) : ("human" as const),
   };
   const externalAuthorize = externalContinuationCommitAuthorizer(authorization);
+  let authorizedGrant = grant;
   try {
     return await rotateSessionMcpCredentialsAtomically(deps.db, {
       ...scope,
       operationKey: request.operationKey,
       ...sessionMcpRotationFingerprint(encryptionKey, scope, request),
-      updates: request.updates.map(({ headers, ...update }) => ({
-        ...update,
-        headersEncrypted: Object.fromEntries(
-          Object.entries(headers).map(([name, value]) => [
-            name,
-            encryptVariableSetValue(encryptionKey, value),
-          ]),
-        ),
-      })),
+      updates: request.updates.map((update) =>
+        "nativeConnectionId" in update
+          ? update
+          : {
+              id: update.id,
+              expectedCredentialVersion: update.expectedCredentialVersion,
+              expectedServerUrl: update.expectedServerUrl,
+              headersEncrypted: Object.fromEntries(
+                Object.entries(update.headers).map(([name, value]) => [
+                  name,
+                  encryptVariableSetValue(encryptionKey, value),
+                ]),
+              ),
+            },
+      ),
+      resolveNativeConnection: async (tx, server, nativeConnectionId, replacementServerUrl) => {
+        const connections = await listOwnConnectionAccountsForGrant(tx, authorizedGrant);
+        const source = personalConnectionDelegationSourceForGrant(authorizedGrant);
+        try {
+          return nativeSessionConnectionReplacement({
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: source.kind === "subject" ? source.subjectId : null,
+            serverUrl: server.url,
+            ...(replacementServerUrl ? { replacementServerUrl } : {}),
+            currentRef: server.connectionRef,
+            nativeConnectionId,
+            connections,
+          });
+        } catch {
+          throw new SessionMcpCredentialRotationError("connection_unavailable");
+        }
+      },
       authorize: async (tx) => {
         await externalAuthorize?.(tx);
         const fresh = await reauthorize(tx);
@@ -133,7 +173,7 @@ export async function rotateSessionMcpCredentialsForRequest(
           const live = await getWorkspaceGrant(tx, fresh.subjectId, fresh.workspaceId);
           if (live) {
             requireRotationGrant(live);
-          } else if (!authorization.canonicalManagedHumanSession) {
+          } else if (!hasVerifiedOwningUserAuthorization(authorization)) {
             throw new HTTPException(403, { message: "credential rotation authority changed" });
           }
           if (!(await subjectHasLiveWorkspaceAuthorityInScope(tx, scope))) {
@@ -145,6 +185,7 @@ export async function rotateSessionMcpCredentialsForRequest(
           operation: "session.mcp.credentials.rotate",
           surface: "http",
         });
+        authorizedGrant = fresh;
       },
     });
   } catch (error) {
@@ -162,7 +203,9 @@ export async function rotateSessionMcpCredentialsForRequest(
             ? 403
             : error.code === "not_found"
               ? 404
-              : error.code === "invalid_request" || error.code === "brokered_server"
+              : error.code === "invalid_request" ||
+                  error.code === "brokered_server" ||
+                  error.code === "connection_unavailable"
                 ? 422
                 : 409;
       throw new HTTPException(status, { message: `credential_rotation_${error.code}` });