@opengeni/core 3.0.1 → 3.1.2

package/src/domain/personal-connection-delegations.ts

@@ -1,8 +1,10 @@
 import type { McpServerConfig, Settings } from "@opengeni/config";
 import type {
   AccessGrant,
+  ConnectionAccountIntent,
   ConnectionMetadata,
-  McpConnectionAuthoritySelection,
+  McpConnectionAccountBinding,
+  McpConnectionAccountSelection,
   McpPersonalConnectionDelegation,
   McpServerConnectionRef,
   ResourceRef,
@@ -24,17 +26,25 @@ import {
 import {
   getPersonalGitHubRepositorySelectionState,
   getSessionTurnPersonalConnectionDelegations,
+  getSessionTurnMcpAccountBindings,
+  getSessionTurnConnectionAccountIntent,
   getConnectionMetadata,
   getSocialConnection,
   listConnectionsMetadata,
   listSocialConnections,
-  resolvePersonalConnectionAuthoritySelectionOrigin,
+  listOwnedConnectionAccounts,
   namedSubjectHasLiveWorkspaceAuthority,
   type Database,
   type ResolveConnectionCredentialInput,
   type ResolveConnectionCredentialResult,
 } from "@opengeni/db";
 import { personalGitHubRepositoryResources } from "./resources";
+import { ConnectionAccountSelectionError } from "./connection-account-selection-error";
+export { ConnectionAccountSelectionError } from "./connection-account-selection-error";
+import {
+  mcpAccountBindingsFromVisibleConnections,
+  personalDelegationsForAccountBindings,
+} from "./mcp-account-bindings";
 
 export type PersonalConnectionDelegationSource =
   | {
@@ -157,6 +167,67 @@ export function personalConnectionDelegationSourceForGrant(
   return { kind: "subject", subjectId: grant.subjectId, accountId: grant.accountId };
 }
 
+/** Account-picker inventory: shared workspace accounts and this sender's own
+ * personal accounts. Visibility is never an execution grant or a credential
+ * response; every selected connection is validated again at admission/use. */
+export async function listOwnConnectionAccountsForGrant(
+  db: Database,
+  grant: AccessGrant,
+  options: { includeInactive?: boolean } = {},
+): Promise<ConnectionMetadata[]> {
+  const source = personalConnectionDelegationSourceForGrant(grant);
+  const workspace = (await listConnectionsMetadata(db, grant.workspaceId, null)).filter(
+    (connection) =>
+      connection.subjectId === null &&
+      connection.workspaceId === grant.workspaceId &&
+      connection.accountId === grant.accountId &&
+      (options.includeInactive === true || connection.status === "active"),
+  );
+  if (source.kind !== "subject") return workspace;
+  const personal = await listOwnConnectionMetadata(db, {
+    ...source,
+    workspaceId: grant.workspaceId,
+    includeInactive: options.includeInactive === true,
+  });
+  return [...workspace, ...personal];
+}
+
+async function listOwnConnectionMetadata(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    includeInactive?: boolean;
+    /** Read only these owned accounts (a live target fence); omit for all. */
+    connectionIds?: ReadonlySet<string>;
+  },
+): Promise<ConnectionMetadata[]> {
+  const accounts = (await listOwnedConnectionAccounts(db, input)).filter(
+    (account) => !input.connectionIds || input.connectionIds.has(account.connectionId),
+  );
+  const connections: ConnectionMetadata[] = [];
+  // The caller may supply a transaction handle (for example, credential
+  // rotation). Each metadata read opens a nested RLS savepoint on that same
+  // connection, so these reads must not overlap.
+  for (const account of accounts) {
+    const connection = await getConnectionMetadata(
+      db,
+      account.originWorkspaceId,
+      account.connectionId,
+      input.subjectId,
+    );
+    if (
+      connection?.accountId === input.accountId &&
+      connection.subjectId === input.subjectId &&
+      connection.authorityId != null &&
+      (input.includeInactive === true || connection.status === "active")
+    )
+      connections.push(connection);
+  }
+  return connections;
+}
+
 export async function authorizedSocialConnectionsForGrant(input: {
   db: Database;
   grant: AccessGrant;
@@ -215,74 +286,12 @@ export async function authorizedSocialConnectionsForGrant(input: {
   return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];
 }
 
-export async function authorizedAtlassianConnectionsForGrant(input: {
+/** Historical native Atlassian grants no longer authorize API execution. */
+export async function authorizedAtlassianConnectionsForGrant(_input: {
   db: Database;
   grant: AccessGrant;
 }): Promise<AuthorizedAtlassianConnection[]> {
-  const workspace = (await listConnectionsMetadata(input.db, input.grant.workspaceId, null)).filter(
-    (connection) =>
-      connection.subjectId === null &&
-      connection.status === "active" &&
-      sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
-  );
-  const source = personalConnectionDelegationSourceForGrant(input.grant);
-  if (source.kind === "none") {
-    return workspace.map((connection) => ({ connection, subjectId: null }));
-  }
-  if (source.kind === "subject") {
-    const visible = await listConnectionsMetadata(
-      input.db,
-      input.grant.workspaceId,
-      source.subjectId,
-    );
-    return visible
-      .filter(
-        (connection) =>
-          connection.status === "active" &&
-          sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
-      )
-      .map((connection) => ({
-        connection,
-        subjectId: connection.subjectId === null ? null : source.subjectId,
-      }));
-  }
-  const delegations = (
-    await getSessionTurnPersonalConnectionDelegations(
-      input.db,
-      input.grant.workspaceId,
-      source.sessionId,
-      source.turnId,
-    )
-  ).filter((item) => item.connectionType === "atlassian");
-  const personal: AuthorizedAtlassianConnection[] = [];
-  for (const delegation of delegations) {
-    if (
-      !(await ownerStillBelongsToWorkspace(input.db, {
-        accountId: input.grant.accountId,
-        workspaceId: input.grant.workspaceId,
-        subjectId: delegation.ownerSubjectId,
-      }))
-    ) {
-      continue;
-    }
-    const connection = await getConnectionMetadata(
-      input.db,
-      input.grant.workspaceId,
-      delegation.connectionId,
-      delegation.ownerSubjectId,
-    );
-    if (
-      !connection ||
-      connection.subjectId !== delegation.ownerSubjectId ||
-      connection.status !== "active" ||
-      !sameProviderDomain(connection.providerDomain, delegation.providerDomain) ||
-      !sameProviderDomain(connection.providerDomain, "api.atlassian.com")
-    ) {
-      continue;
-    }
-    personal.push({ connection, subjectId: delegation.ownerSubjectId });
-  }
-  return [...workspace.map((connection) => ({ connection, subjectId: null })), ...personal];
+  return [];
 }
 
 export function selectedPersonalConnectionServers(
@@ -301,31 +310,30 @@ function isNativeSubjectConnectionRef(
   return ref?.subjectScope === "subject" && ref.authoritySource !== "host";
 }
 
-function canonicalPersonalConnections(connections: ConnectionMetadata[]): ConnectionMetadata[] {
-  return [...connections].sort((left, right) => {
-    const active = Number(right.status === "active") - Number(left.status === "active");
-    if (active !== 0) return active;
-    const updated = Date.parse(right.updatedAt) - Date.parse(left.updatedAt);
-    if (updated !== 0) return updated;
-    const created = Date.parse(right.createdAt) - Date.parse(left.createdAt);
-    if (created !== 0) return created;
-    return right.id.localeCompare(left.id);
-  });
-}
-
 function sameProviderDomain(left: string, right: string): boolean {
   return left.toLowerCase() === right.toLowerCase();
 }
 
+function canonicalConnectionResource(value: string): string {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return value.trim();
+    url.hash = "";
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+    return url.toString();
+  } catch {
+    return value.trim();
+  }
+}
+
 export function personalConnectionDelegationsFromVisibleConnections(input: {
   servers: McpServerConfig[];
   subjectId: string;
   connections: ConnectionMetadata[];
-  authoritySelections?: McpConnectionAuthoritySelection[];
-  rejectUnselectedActivatedConnections?: boolean;
+  authoritySelections?: McpConnectionAccountSelection[];
 }): McpPersonalConnectionDelegation[] {
   const delegations: McpPersonalConnectionDelegation[] = [];
-  const connections = canonicalPersonalConnections(input.connections);
+  const connections = input.connections;
   const selections = new Map(
     (input.authoritySelections ?? []).map((selection) => [selection.serverId, selection]),
   );
@@ -337,52 +345,51 @@ export function personalConnectionDelegationsFromVisibleConnections(input: {
       (candidate) =>
         candidate.subjectId === input.subjectId &&
         candidate.status === "active" &&
+        candidate.authorityId !== undefined &&
+        candidate.authorityId !== null &&
         sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&
         (!ref.kind || candidate.kind === ref.kind) &&
+        (!ref.resource ||
+          (typeof candidate.metadata.resource === "string" &&
+            canonicalConnectionResource(candidate.metadata.resource) ===
+              canonicalConnectionResource(ref.resource))) &&
         (!ref.connectionId || candidate.id === ref.connectionId),
     );
-    // An explicit accepted-work selection is authoritative. Canonical newest
-    // ordering is only the bounded legacy/omission fallback; it must never
-    // replace a caller's exact opaque connection UUID when several accounts
-    // share one server/provider tuple.
+    if (!selection && eligible.length > 1) {
+      throw new ConnectionAccountSelectionError(
+        `Choose an account for ${server.id}: multiple connected accounts match.`,
+        {
+          version: 1,
+          reason: "ambiguous_account",
+          accounts: [{ serverId: server.id, connectionId: null, reason: "selection_unavailable" }],
+        },
+      );
+    }
     const connection = selection
       ? eligible.find((candidate) => candidate.id === selection.connectionId)
       : eligible[0];
     if (!connection) continue;
-    if (connection.authorityId) {
-      if (
-        !selection ||
-        selection.connectionId !== connection.id ||
-        selection.userDelegation.authorityId !== connection.authorityId
-      ) {
-        if (input.rejectUnselectedActivatedConnections) {
-          throw new Error(
-            `scheduled connection authority selection is required for activated server ${server.id}`,
-          );
-        }
-        // Activated organization-user connections are never admitted through
-        // the legacy owner tuple. The caller must select one exact opaque grant.
-        continue;
-      }
-      selections.delete(server.id);
-    } else if (selection) {
-      throw new Error(`connection authority is not available for legacy server ${server.id}`);
-    }
+    selections.delete(server.id);
     delegations.push({
       serverId: server.id,
       connectionId: connection.id,
-      ...(selection ? { originWorkspaceId: connection.workspaceId } : {}),
+      originWorkspaceId: connection.workspaceId,
       ownerSubjectId: input.subjectId,
       providerDomain: connection.providerDomain,
       kind: connection.kind,
-      ...(selection ? { userDelegation: selection.userDelegation } : {}),
     });
   }
   if (selections.size > 0) {
-    throw new Error(
-      `connection authority selection did not match an active selected server: ${[
-        ...selections.keys(),
-      ].join(", ")}`,
+    throw new ConnectionAccountSelectionError(
+      `Selected account is unavailable for: ${[...selections.keys()].join(", ")}`,
+      {
+        version: 1,
+        reason: "selected_account_unavailable",
+        accounts: [...selections.values()].map((selection) => ({
+          ...selection,
+          reason: "selection_unavailable",
+        })),
+      },
     );
   }
   return delegations;
@@ -393,39 +400,27 @@ export function personalConnectionDelegationsFromParent(input: {
   parentDelegations: McpPersonalConnectionDelegation[];
   personalGitHubResources?: ResourceRef[];
   targetSessionId?: string;
-  rejectActivatedConnections?: boolean;
 }): McpPersonalConnectionDelegation[] {
-  // Every successor is new logical work. `once` remains bound to the original
-  // accepted turn, `session` may be re-admitted only into that exact session,
-  // and `always` may cross to another authorized session.
-  const childEligible = (delegation: McpPersonalConnectionDelegation) => {
-    const authority = delegation.userDelegation;
-    if (!authority) return true;
-    if (authority.mode === "once") return false;
-    if (authority.mode === "session") return authority.sessionId === input.targetSessionId;
-    return true;
-  };
   const mcp = input.servers.flatMap((server) => {
     const ref = server.connectionRef;
     if (!isNativeSubjectConnectionRef(ref)) return [];
     const delegation = input.parentDelegations.find(
       (candidate) =>
+        candidate.connectionType !== "atlassian" &&
         candidate.serverId === server.id &&
         sameProviderDomain(candidate.providerDomain, ref.providerDomain) &&
         (!ref.kind || !candidate.kind || candidate.kind === ref.kind),
     );
-    return delegation && childEligible(delegation) ? [{ ...delegation }] : [];
+    return delegation ? [{ ...delegation }] : [];
   });
   const projected = [
     ...mcp,
     ...input.parentDelegations
       .filter(
         (item) =>
-          childEligible(item) &&
-          (item.connectionType === "social" ||
-            item.connectionType === "atlassian" ||
-            item.connectionType === "github_personal" ||
-            item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID),
+          item.connectionType === "social" ||
+          item.connectionType === "github_personal" ||
+          item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
       )
       .map((item) => ({ ...item })),
   ];
@@ -464,14 +459,6 @@ export function personalConnectionDelegationsFromParent(input: {
   ) {
     throw new Error("agent-created personal GitHub repository authority is unavailable");
   }
-  if (
-    input.rejectActivatedConnections &&
-    inherited.some((delegation) => delegation.userDelegation)
-  ) {
-    throw new Error(
-      "scheduled connection authority is not available until task occurrence authority is activated",
-    );
-  }
   return inherited;
 }
 
@@ -484,14 +471,14 @@ export function personalConnectionDelegationsFromParent(input: {
 export function googleDrivePublicationDelegationFromVisibleConnections(input: {
   subjectId: string;
   connections: ConnectionMetadata[];
-  authoritySelection?: McpConnectionAuthoritySelection;
-  rejectUnselectedActivatedConnection?: boolean;
+  authoritySelection?: McpConnectionAccountSelection;
 }): McpPersonalConnectionDelegation | null {
   const selection = input.authoritySelection;
   const eligible = input.connections.filter((connection) => {
     if (
       connection.subjectId !== input.subjectId ||
       connection.status !== "active" ||
+      !connection.authorityId ||
       connection.kind !== "oauth2" ||
       !sameProviderDomain(connection.providerDomain, GOOGLE_DRIVE_PROVIDER_DOMAIN) ||
       !googleDriveScopesAllowCapability(connection.grantedScopes, "publish_file")
@@ -510,26 +497,25 @@ export function googleDrivePublicationDelegationFromVisibleConnections(input: {
     ? eligible.filter((connection) => connection.id === selection.connectionId)
     : eligible;
   if (selection && selectedEligible.length !== 1) {
-    throw new Error("Google Drive publication authority selection is unavailable");
+    throw new ConnectionAccountSelectionError(
+      "Google Drive publication authority selection is unavailable",
+      {
+        version: 1,
+        reason: "selected_account_unavailable",
+        accounts: [
+          {
+            serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
+            connectionId: selection.connectionId,
+            reason: "selection_unavailable",
+          },
+        ],
+      },
+    );
   }
   if (!selection && selectedEligible.length !== 1) return null;
   const connection = selectedEligible[0]!;
-  if (connection.authorityId) {
-    if (
-      !selection ||
-      selection.serverId !== GOOGLE_DRIVE_PUBLICATION_SERVER_ID ||
-      selection.connectionId !== connection.id ||
-      selection.userDelegation.authorityId !== connection.authorityId
-    ) {
-      if (input.rejectUnselectedActivatedConnection) {
-        throw new Error(
-          "scheduled connection authority selection is required for activated Google Drive publication",
-        );
-      }
-      return null;
-    }
-  } else if (selection) {
-    throw new Error("connection authority is not available for legacy Google Drive publication");
+  if (selection && selection.serverId !== GOOGLE_DRIVE_PUBLICATION_SERVER_ID) {
+    throw new Error("Google Drive publication account selection is invalid");
   }
   // Freeze the exact output destination on the accepted delegation: a later
   // connection-settings change must never redirect an already-accepted turn's
@@ -542,44 +528,20 @@ export function googleDrivePublicationDelegationFromVisibleConnections(input: {
   return {
     serverId: GOOGLE_DRIVE_PUBLICATION_SERVER_ID,
     connectionId: connection.id,
-    ...(selection ? { originWorkspaceId: connection.workspaceId } : {}),
+    originWorkspaceId: connection.workspaceId,
     ownerSubjectId: input.subjectId,
     providerDomain: connection.providerDomain,
     kind: connection.kind,
-    ...(selection ? { userDelegation: selection.userDelegation } : {}),
     outputDestination: frozenMetadata.outputDestination,
   };
 }
 
-export function personalAtlassianDelegationsFromVisibleConnections(input: {
+/** Native Atlassian credentials remain stored but are not new turn authority. */
+export function personalAtlassianDelegationsFromVisibleConnections(_input: {
   subjectId: string;
   connections: ConnectionMetadata[];
-  rejectActivatedConnections?: boolean;
 }): McpPersonalConnectionDelegation[] {
-  const eligible = input.connections.filter(
-    (connection) =>
-      connection.subjectId === input.subjectId &&
-      connection.status === "active" &&
-      sameProviderDomain(connection.providerDomain, "api.atlassian.com"),
-  );
-  if (input.rejectActivatedConnections && eligible.some((connection) => connection.authorityId)) {
-    throw new Error(
-      "scheduled connection authority selection is required for activated Atlassian access",
-    );
-  }
-  // Atlassian's first-party multi-call adapter is a named successor. Until it
-  // can consume an accepted snapshot, common-authority rows are omitted rather
-  // than falling through the legacy owner-tuple resolver.
-  return eligible
-    .filter((connection) => !connection.authorityId)
-    .map((connection) => ({
-      serverId: `atlassian:${connection.id}`,
-      connectionId: connection.id,
-      ownerSubjectId: input.subjectId,
-      providerDomain: connection.providerDomain,
-      kind: connection.kind,
-      connectionType: "atlassian" as const,
-    }));
+  return [];
 }
 
 async function personalGitHubDelegationFromVisibleConnections(input: {
@@ -588,7 +550,7 @@ async function personalGitHubDelegationFromVisibleConnections(input: {
   subjectId: string;
   connections: ConnectionMetadata[];
   resources: ResourceRef[];
-  authoritySelection?: McpConnectionAuthoritySelection;
+  authoritySelection?: McpConnectionAccountSelection;
 }): Promise<McpPersonalConnectionDelegation | null> {
   const resources = personalGitHubRepositoryResources(input.resources);
   if (resources.length === 0) {
@@ -602,27 +564,41 @@ async function personalGitHubDelegationFromVisibleConnections(input: {
     throw new Error("accepted work may use only one personal GitHub account");
   }
   const authoritySelection = input.authoritySelection;
-  if (!authoritySelection) {
-    throw new Error("personal GitHub repository resources require explicit connection authority");
-  }
+  const credentialBindingId = [...bindingIds][0]!;
   const connection = input.connections.find(
     (candidate) =>
-      candidate.id === authoritySelection.connectionId &&
+      (!authoritySelection || candidate.id === authoritySelection.connectionId) &&
       candidate.subjectId === input.subjectId &&
       candidate.status === "active" &&
-      isPersonalGitHubConnection(candidate),
+      isPersonalGitHubConnection(candidate) &&
+      PersonalGitHubConnectionMetadata.safeParse(candidate.metadata).data?.credentialBindingId ===
+        credentialBindingId,
   );
   if (
     !connection ||
     !connection.authorityId ||
-    connection.authorityId !== authoritySelection.userDelegation.authorityId ||
     connection.grantedScopes.length !== 1 ||
     connection.grantedScopes[0] !== "repo"
   ) {
+    if (authoritySelection) {
+      throw new ConnectionAccountSelectionError(
+        "personal GitHub connection authority selection is unavailable",
+        {
+          version: 1,
+          reason: "selected_account_unavailable",
+          accounts: [
+            {
+              serverId: PERSONAL_GITHUB_CONNECTION_SURFACE_ID,
+              connectionId: authoritySelection.connectionId,
+              reason: "selection_unavailable",
+            },
+          ],
+        },
+      );
+    }
     throw new Error("personal GitHub connection authority selection is unavailable");
   }
   const metadata = PersonalGitHubConnectionMetadata.parse(connection.metadata);
-  const credentialBindingId = [...bindingIds][0]!;
   if (metadata.credentialBindingId !== credentialBindingId) {
     throw new Error("personal GitHub credential binding does not match the selected connection");
   }
@@ -669,7 +645,6 @@ async function personalGitHubDelegationFromVisibleConnections(input: {
     providerDomain: "github.com",
     kind: "oauth2",
     connectionType: "github_personal",
-    userDelegation: authoritySelection.userDelegation,
     personalGitHubRepositorySelection: {
       credentialBindingId,
       connectionAuthorityGeneration: selection.connectionAuthorityGeneration,
@@ -689,13 +664,12 @@ export function personalConnectionDelegationsEqual(
     const other = byServer.get(delegation.serverId);
     return (
       other?.connectionId === delegation.connectionId &&
+      other.canonicalServerId === delegation.canonicalServerId &&
       other.originWorkspaceId === delegation.originWorkspaceId &&
       other.ownerSubjectId === delegation.ownerSubjectId &&
       sameProviderDomain(other.providerDomain, delegation.providerDomain) &&
       other.kind === delegation.kind &&
       other.connectionType === delegation.connectionType &&
-      JSON.stringify(other.userDelegation ?? null) ===
-        JSON.stringify(delegation.userDelegation ?? null) &&
       JSON.stringify(other.personalGitHubRepositorySelection ?? null) ===
         JSON.stringify(delegation.personalGitHubRepositorySelection ?? null)
     );
@@ -776,11 +750,7 @@ export function withFrozenPersonalConnectionDelegations(input: {
         : publicationDelegations.length === 1
           ? publicationDelegations[0]!
           : null;
-      if (
-        !delegation ||
-        (!delegation.userDelegation &&
-          !(await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId)))
-      ) {
+      if (!delegation || !(await input.ownerHasWorkspaceMembership(delegation.ownerSubjectId))) {
         return personalAuthorityUnavailable(request);
       }
       effectiveRequest = {
@@ -802,6 +772,214 @@ export function withFrozenPersonalConnectionDelegations(input: {
   };
 }
 
+/** Freeze all native account routes without conflating workspace ownership
+ * with the exact causal human required for personal connections. */
+export async function freezeConnectionAccounts(
+  input: Parameters<typeof freezePersonalConnectionDelegations>[0] & { accountId: string },
+): Promise<{
+  mcpAccountBindings: McpConnectionAccountBinding[] | null;
+  personalConnectionDelegations: McpPersonalConnectionDelegation[];
+  /**
+   * What the request decided, to be stored on the accepted turn: whose
+   * personal accounts it may use and which accounts were explicitly picked.
+   * Agent-created work carries its parent turn's intent (null when the parent
+   * predates intent).
+   */
+  connectionAccountIntent: ConnectionAccountIntent | null;
+}> {
+  const selectedIds = new Set(input.tools.map((tool) => tool.id));
+  const servers = input.settings.mcpServers.filter(
+    (server) =>
+      selectedIds.has(server.id) &&
+      server.connectionRef &&
+      server.connectionRef.authoritySource !== "host",
+  );
+  const serverIds = new Set(servers.map((server) => server.id));
+  let mcpAccountBindings: McpConnectionAccountBinding[];
+  let connectionAccountIntent: ConnectionAccountIntent | null;
+  if (input.source.kind === "turn") {
+    if (input.authoritySelections?.length) {
+      throw new ConnectionAccountSelectionError(
+        "Agent-created work inherits the exact parent accounts",
+        { version: 1, reason: "parent_accounts_required", accounts: [] },
+      );
+    }
+    connectionAccountIntent = await getSessionTurnConnectionAccountIntent(
+      input.db,
+      input.workspaceId,
+      input.source.sessionId,
+      input.source.turnId,
+    );
+    const inherited = await getSessionTurnMcpAccountBindings(
+      input.db,
+      input.workspaceId,
+      input.source.sessionId,
+      input.source.turnId,
+    );
+    if (inherited === null) {
+      return {
+        mcpAccountBindings: null,
+        personalConnectionDelegations: await freezePersonalConnectionDelegations(input),
+        connectionAccountIntent,
+      };
+    }
+    mcpAccountBindings = inherited.filter((binding) => serverIds.has(binding.canonicalServerId));
+  } else {
+    connectionAccountIntent = {
+      version: 1,
+      principal:
+        input.source.kind === "subject"
+          ? { kind: "subject", subjectId: input.source.subjectId }
+          : { kind: "none" },
+      selections: [...(input.authoritySelections ?? [])],
+    };
+    mcpAccountBindings = mcpAccountBindingsFromVisibleConnections({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.source.kind === "subject" ? input.source.subjectId : null,
+      servers,
+      connections: await visibleMcpAccountConnections(input.db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        source: input.source,
+      }),
+      ...(input.authoritySelections
+        ? {
+            selections: input.authoritySelections.filter((selection) =>
+              serverIds.has(selection.serverId),
+            ),
+          }
+        : {}),
+    });
+  }
+  // Dedicated first-party publication/repository/social surfaces keep their
+  // existing selection and authority contracts; they are not generic MCP routes.
+  const special = await freezePersonalConnectionDelegations({
+    ...input,
+    settings: {
+      ...input.settings,
+      mcpServers: input.settings.mcpServers.filter((server) => !serverIds.has(server.id)),
+    },
+    ...(input.authoritySelections
+      ? {
+          authoritySelections: input.authoritySelections.filter(
+            (selection) => !serverIds.has(selection.serverId),
+          ),
+        }
+      : {}),
+  });
+  return {
+    mcpAccountBindings,
+    personalConnectionDelegations: [
+      ...personalDelegationsForAccountBindings(mcpAccountBindings),
+      ...special,
+    ],
+    connectionAccountIntent,
+  };
+}
+
+/** Shared workspace accounts plus the entitled owner's own active accounts. */
+export async function visibleMcpAccountConnections(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    source: Exclude<PersonalConnectionDelegationSource, { kind: "turn" }>;
+  },
+): Promise<ConnectionMetadata[]> {
+  const personal =
+    input.source.kind === "subject" &&
+    (await ownerStillBelongsToWorkspace(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.source.subjectId,
+    }))
+      ? await listOwnConnectionMetadata(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: input.source.subjectId,
+        })
+      : [];
+  const workspace = await listConnectionsMetadata(db, input.workspaceId, null);
+  return [...workspace.filter((connection) => connection.subjectId === null), ...personal];
+}
+
+/**
+ * `visibleMcpAccountConnections` restricted to exact connection ids, for a live
+ * target fence. The same visibility rules apply (shared workspace accounts;
+ * the entitled owner's own active accounts while the owner still belongs to
+ * the workspace), but unrelated accounts are never read. An id read on the
+ * wrong side, or no longer visible, is simply absent.
+ */
+export async function visibleMcpAccountConnectionsByIds(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    source: Exclude<PersonalConnectionDelegationSource, { kind: "turn" }>;
+    workspaceConnectionIds: readonly string[];
+    personalConnectionIds: readonly string[];
+  },
+): Promise<ConnectionMetadata[]> {
+  const workspace: ConnectionMetadata[] = [];
+  // `db` may be one bounded transaction: these reads must not overlap.
+  for (const connectionId of new Set(input.workspaceConnectionIds)) {
+    const connection = await getConnectionMetadata(db, input.workspaceId, connectionId, null);
+    if (connection && connection.subjectId === null) workspace.push(connection);
+  }
+  const personalIds = new Set(input.personalConnectionIds);
+  const personal =
+    input.source.kind === "subject" &&
+    personalIds.size > 0 &&
+    (await ownerStillBelongsToWorkspace(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.source.subjectId,
+    }))
+      ? await listOwnConnectionMetadata(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: input.source.subjectId,
+          connectionIds: personalIds,
+        })
+      : [];
+  return [...workspace, ...personal];
+}
+
+/**
+ * Every account a fresh, selection-free freeze would bind for the generic MCP
+ * routes among `tools`: exactly what `freezeConnectionAccounts` binds when no
+ * account is chosen. The same entitlement contract applies: `source` is a
+ * grant-derived or frozen-owner subject, never a looked-up one. Read-only; it
+ * never persists a delegation.
+ */
+export async function availableMcpAccountBindings(input: {
+  db: Database;
+  accountId: string;
+  workspaceId: string;
+  settings: Pick<Settings, "mcpServers">;
+  tools: ToolRef[];
+  source: Exclude<PersonalConnectionDelegationSource, { kind: "turn" }>;
+  /** Result of `visibleMcpAccountConnections` for the same source, when already read. */
+  connections?: ConnectionMetadata[];
+}): Promise<McpConnectionAccountBinding[]> {
+  const selectedIds = new Set(input.tools.map((tool) => tool.id));
+  const servers = input.settings.mcpServers.filter(
+    (server) =>
+      selectedIds.has(server.id) &&
+      server.connectionRef &&
+      server.connectionRef.authoritySource !== "host",
+  );
+  if (servers.length === 0) return [];
+  return mcpAccountBindingsFromVisibleConnections({
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.source.kind === "subject" ? input.source.subjectId : null,
+    servers,
+    connections: input.connections ?? (await visibleMcpAccountConnections(input.db, input)),
+  });
+}
+
 export async function freezePersonalConnectionDelegations(input: {
   db: Database;
   workspaceId: string;
@@ -809,8 +987,7 @@ export async function freezePersonalConnectionDelegations(input: {
   tools: ToolRef[];
   resources?: ResourceRef[];
   source: PersonalConnectionDelegationSource;
-  authoritySelections?: McpConnectionAuthoritySelection[];
-  rejectUnselectedActivatedConnections?: boolean;
+  authoritySelections?: McpConnectionAccountSelection[];
   /** Exact first-party export tool + permission gate, not broad opengeni attachment. */
   googleDrivePublicationEnabled?: boolean;
   /** Exact first-party Atlassian tool + permission gate. */
@@ -853,16 +1030,13 @@ export async function freezePersonalConnectionDelegations(input: {
       ),
       personalGitHubResources,
       ...(input.targetSessionId ? { targetSessionId: input.targetSessionId } : {}),
-      ...(input.rejectUnselectedActivatedConnections !== undefined
-        ? { rejectActivatedConnections: input.rejectUnselectedActivatedConnections }
-        : {}),
     });
     return inherited.filter((item) => {
       if (item.serverId === GOOGLE_DRIVE_PUBLICATION_SERVER_ID) {
         return input.googleDrivePublicationEnabled === true;
       }
       if (item.connectionType === "atlassian") {
-        return includeFirstPartyConnections && input.atlassianEnabled === true;
+        return false;
       }
       if (item.connectionType === "social") {
         return includeFirstPartyConnections;
@@ -876,54 +1050,23 @@ export async function freezePersonalConnectionDelegations(input: {
     workspaceId: input.workspaceId,
     subjectId: ownerSubjectId,
   });
-  const targetLocalConnections = await listConnectionsMetadata(
-    input.db,
-    input.workspaceId,
-    ownerSubjectId,
-  );
-  const portableSelections = await Promise.all(
-    (input.authoritySelections ?? []).map(async (selection) => {
-      const originWorkspaceId = await resolvePersonalConnectionAuthoritySelectionOrigin(input.db, {
-        accountId: selection.userDelegation.organizationId,
-        targetWorkspaceId: input.workspaceId,
-        subjectId: ownerSubjectId,
-        connectionId: selection.connectionId,
-        delegation: selection.userDelegation,
-      });
-      if (!originWorkspaceId) {
-        throw new Error(`connection authority selection is unavailable: ${selection.serverId}`);
-      }
-      const connection = await getConnectionMetadata(
-        input.db,
-        originWorkspaceId,
-        selection.connectionId,
-        ownerSubjectId,
+  if (!membership) {
+    if ((input.authoritySelections?.length ?? 0) > 0) {
+      throw new ConnectionAccountSelectionError(
+        "Selected connection account requires live owner workspace access",
+        { version: 1, reason: "owner_access_unavailable", accounts: [] },
       );
-      if (
-        !connection ||
-        connection.workspaceId !== originWorkspaceId ||
-        connection.subjectId !== ownerSubjectId ||
-        connection.authorityId !== selection.userDelegation.authorityId
-      ) {
-        throw new Error(`connection authority selection is unavailable: ${selection.serverId}`);
-      }
-      return connection;
-    }),
-  );
-  if (!membership && portableSelections.length === 0) {
+    }
     if (personalGitHubResources.length > 0) {
       throw new Error("personal GitHub repository authority requires live causal user authority");
     }
     return [];
   }
-  const visibleConnections = [
-    ...new Map(
-      [...targetLocalConnections, ...portableSelections].map((connection) => [
-        connection.id,
-        connection,
-      ]),
-    ).values(),
-  ];
+  const visibleConnections = await listOwnConnectionMetadata(input.db, {
+    accountId: input.source.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: ownerSubjectId,
+  });
   const selectedMcpServerIds = new Set(servers.map((server) => server.id));
   const supportedSelectionIds = new Set(selectedMcpServerIds);
   if (input.googleDrivePublicationEnabled) {
@@ -936,10 +1079,18 @@ export async function freezePersonalConnectionDelegations(input: {
     (selection) => !supportedSelectionIds.has(selection.serverId),
   );
   if (unsupportedSelections.length > 0) {
-    throw new Error(
+    throw new ConnectionAccountSelectionError(
       `connection authority selection did not match a selected MCP server: ${unsupportedSelections
         .map((selection) => selection.serverId)
         .join(", ")}`,
+      {
+        version: 1,
+        reason: "selected_account_unavailable",
+        accounts: unsupportedSelections.map((selection) => ({
+          ...selection,
+          reason: "connector_unavailable",
+        })),
+      },
     );
   }
   const mcp = personalConnectionDelegationsFromVisibleConnections({
@@ -949,9 +1100,6 @@ export async function freezePersonalConnectionDelegations(input: {
     authoritySelections: (input.authoritySelections ?? []).filter((selection) =>
       selectedMcpServerIds.has(selection.serverId),
     ),
-    ...(input.rejectUnselectedActivatedConnections !== undefined
-      ? { rejectUnselectedActivatedConnections: input.rejectUnselectedActivatedConnections }
-      : {}),
   });
   const personalGitHubAuthoritySelection = (input.authoritySelections ?? []).find(
     (selection) => selection.serverId === PERSONAL_GITHUB_CONNECTION_SURFACE_ID,
@@ -986,9 +1134,6 @@ export async function freezePersonalConnectionDelegations(input: {
     ? personalAtlassianDelegationsFromVisibleConnections({
         subjectId: ownerSubjectId,
         connections: visibleConnections,
-        ...(input.rejectUnselectedActivatedConnections !== undefined
-          ? { rejectActivatedConnections: input.rejectUnselectedActivatedConnections }
-          : {}),
       })
     : [];
   const googleDriveAuthoritySelection = input.googleDrivePublicationEnabled
@@ -1003,9 +1148,6 @@ export async function freezePersonalConnectionDelegations(input: {
         ...(googleDriveAuthoritySelection
           ? { authoritySelection: googleDriveAuthoritySelection }
           : {}),
-        ...(input.rejectUnselectedActivatedConnections !== undefined
-          ? { rejectUnselectedActivatedConnection: input.rejectUnselectedActivatedConnections }
-          : {}),
       })
     : null;
   return [