@opengeni/db 0.4.1 → 0.6.1

package/dist/index.js

@@ -7,12 +7,17 @@ import {
   capabilityInstallations,
   codexRotationSettings,
   codexSubscriptionCredentials,
+  connections,
   creditLedgerEntries,
   deviceEnrollmentRequests,
   enrollments,
   fileUploads,
   files,
   githubInstallations,
+  importBatches,
+  integrationOauthClients,
+  integrationOauthStateNonces,
+  knowledgeMemories,
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
@@ -39,7 +44,7 @@ import {
   workspaceMemberships,
   workspacePacks,
   workspaces
-} from "./chunk-T2U4H4Z2.js";
+} from "./chunk-ZIUCA2IO.js";
 import {
   migrate,
   runMigrations
@@ -51,10 +56,10 @@ import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
 import { reasoningEffortForMetadata, CLEARED_RUN_STATE_BLOB } from "@opengeni/contracts";
-import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
 import { isCodexBilledModel } from "@opengeni/codex";
 import { isCodexBilledModel as isCodexBilledModel2 } from "@opengeni/codex";
-import { and, asc, desc, eq, gt, gte, inArray, lt, ne, sql } from "drizzle-orm";
+import { and, asc, desc, eq, gt, gte, inArray, isNull, lt, ne, or, sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 
@@ -100,6 +105,22 @@ function assertKey(key) {
 
 // src/event-payload-sanitizer.ts
 var REPLACEMENT = "\uFFFD";
+var REDACTED = "[redacted]";
+var SENSITIVE_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "headers",
+  "accesstoken",
+  "refreshtoken",
+  "idtoken",
+  "token",
+  "apikey",
+  "secret",
+  "clientsecret",
+  "credential",
+  "credentialencrypted",
+  "encryptedpkceverifier",
+  "codeverifier"
+]);
 function sanitizeEventString(value) {
   let needsWork = false;
   for (let i = 0; i < value.length; i++) {
@@ -158,6 +179,9 @@ function sanitizeSensitiveEventField(key, value) {
   if (key === "mcpCredentialUpdates") {
     return sanitizeMcpCredentialUpdateList(value);
   }
+  if (SENSITIVE_FIELD_NAMES.has(normalizeFieldName(key))) {
+    return REDACTED;
+  }
   return sanitizeEventPayload(value);
 }
 function sanitizeSessionMcpServerList(value) {
@@ -203,6 +227,9 @@ function safeHeaderNames(value) {
 function isPlainObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function normalizeFieldName(key) {
+  return key.toLowerCase().replace(/[-_]/g, "");
+}
 
 // src/index.ts
 import { sql as sql2 } from "drizzle-orm";
@@ -337,6 +364,385 @@ async function fetchCodexUsageForAccount(db, settings, workspaceId, credentialId
   return normalized;
 }
 
+// src/connection-token-resolver.ts
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import { Buffer as Buffer2 } from "buffer";
+import { lookup } from "dns/promises";
+import { isIP } from "net";
+var defaultDeps2 = {
+  loadCredential: loadConnectionCredentialForBroker,
+  recordRefresh: recordConnectionTokenRefresh,
+  setStatus: setConnectionStatus,
+  recordUsed: recordConnectionUsed,
+  refresh: refreshOAuthConnectionCredential,
+  encrypt: encryptEnvironmentValue,
+  keyBytes: environmentsEncryptionKeyBytes2,
+  now: () => /* @__PURE__ */ new Date()
+};
+var inflight2 = /* @__PURE__ */ new Map();
+var REFRESH_WINDOW_MS = 6e4;
+function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
+  const load = async (input) => {
+    const request = {
+      workspaceId: input.workspaceId,
+      providerDomain: input.connectionRef.providerDomain,
+      // I1 deliberately accepts workspace-shared connections only at runtime.
+      allowSubjectOwned: false
+    };
+    if (input.connectionRef.connectionId !== void 0) {
+      request.connectionId = input.connectionRef.connectionId;
+    }
+    if (input.connectionRef.kind !== void 0) {
+      request.kind = input.connectionRef.kind;
+    }
+    if (input.subjectId !== void 0) {
+      request.subjectId = input.subjectId;
+    }
+    return deps.loadCredential(db, settings, request);
+  };
+  const snapshot = async (cred, ref) => {
+    if (cred.status !== "active") {
+      return authNeededForStatus(cred, ref);
+    }
+    const missingScopes = missingRequestedScopes(ref.scopes, cred.grantedScopes);
+    if (missingScopes.length > 0) {
+      return {
+        status: "auth_needed",
+        reason: "insufficient_scope",
+        providerDomain: ref.providerDomain,
+        connectionId: cred.id,
+        scopes: missingScopes,
+        ...ref.resource ? { resource: ref.resource } : {}
+      };
+    }
+    const headers = headersForCredential(cred);
+    if (!headers) {
+      return {
+        status: "auth_needed",
+        reason: "refresh_failed",
+        providerDomain: ref.providerDomain,
+        connectionId: cred.id,
+        ...ref.scopes ? { scopes: ref.scopes } : {},
+        ...ref.resource ? { resource: ref.resource } : {}
+      };
+    }
+    await deps.recordUsed(db, cred.workspaceId, cred.id);
+    return {
+      status: "ok",
+      headers,
+      connectionId: cred.id,
+      expiresAt: cred.expiresAt
+    };
+  };
+  const performRefresh = async (cred, ref) => {
+    const key = deps.keyBytes(settings);
+    if (!key) {
+      throw new Error("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
+    }
+    const refreshed = await deps.refresh(cred, ref, settings);
+    const refreshRecord = {
+      id: cred.id,
+      version: cred.version,
+      workspaceId: cred.workspaceId,
+      credentialEncrypted: deps.encrypt(key, JSON.stringify(refreshed.credential)),
+      expiresAt: refreshed.expiresAt,
+      lastRefreshAt: deps.now()
+    };
+    if (refreshed.grantedScopes !== void 0) {
+      refreshRecord.grantedScopes = refreshed.grantedScopes;
+    }
+    const persisted = await deps.recordRefresh(db, refreshRecord);
+    if (persisted) {
+      const current = await load({
+        workspaceId: cred.workspaceId,
+        serverId: "",
+        connectionRef: { ...ref, connectionId: cred.id }
+      });
+      if (current) {
+        return current;
+      }
+    }
+    const winner = await load({
+      workspaceId: cred.workspaceId,
+      serverId: "",
+      connectionRef: { ...ref, connectionId: cred.id }
+    });
+    if (winner?.status === "active") {
+      return winner;
+    }
+    throw new Error("connection credential changed during token refresh");
+  };
+  const refreshSingleFlight = (cred, ref) => {
+    const key = `${cred.id}:${cred.version}`;
+    const existing = inflight2.get(key);
+    if (existing) {
+      return existing;
+    }
+    const promise = performRefresh(cred, ref).finally(() => {
+      if (inflight2.get(key) === promise) {
+        inflight2.delete(key);
+      }
+    });
+    inflight2.set(key, promise);
+    return promise;
+  };
+  return async (input) => {
+    const ref = input.connectionRef;
+    let cred;
+    try {
+      cred = await load(input);
+    } catch {
+      return authNeeded(ref, "refresh_failed");
+    }
+    if (!cred) {
+      return authNeeded(ref, "missing_connection");
+    }
+    if (cred.status !== "active") {
+      return authNeededForStatus(cred, ref);
+    }
+    if (shouldRefresh(cred, input.forceRefresh === true, deps.now())) {
+      try {
+        cred = await refreshSingleFlight(cred, ref);
+      } catch (error) {
+        if (isPermanentRefreshError(error)) {
+          await deps.setStatus(db, input.workspaceId, "needs_reauth", error instanceof Error ? error.message : String(error), {
+            id: cred.id,
+            version: cred.version
+          }).catch(() => void 0);
+        }
+        return authNeeded(ref, "refresh_failed", cred.id);
+      }
+    }
+    return await snapshot(cred, ref);
+  };
+}
+var ConnectionRefreshHttpError = class extends Error {
+  httpStatus;
+  constructor(httpStatus) {
+    super(`connection refresh failed with HTTP ${httpStatus}`);
+    this.name = "ConnectionRefreshHttpError";
+    this.httpStatus = httpStatus;
+  }
+};
+function isPermanentRefreshError(error) {
+  return error instanceof ConnectionRefreshHttpError && error.httpStatus >= 400 && error.httpStatus < 500 && error.httpStatus !== 408 && error.httpStatus !== 429;
+}
+function shouldRefresh(cred, force, now) {
+  if (cred.kind !== "oauth2") {
+    return false;
+  }
+  if (force) {
+    return true;
+  }
+  if (!cred.expiresAt) {
+    return false;
+  }
+  return cred.expiresAt.getTime() <= now.getTime() + REFRESH_WINDOW_MS;
+}
+function authNeeded(ref, reason, connectionId) {
+  return {
+    status: "auth_needed",
+    reason,
+    providerDomain: ref.providerDomain,
+    ...connectionId ? { connectionId } : {},
+    ...ref.scopes ? { scopes: ref.scopes } : {},
+    ...ref.resource ? { resource: ref.resource } : {}
+  };
+}
+function authNeededForStatus(cred, ref) {
+  if (cred.status === "revoked") {
+    return authNeeded(ref, "missing_connection", cred.id);
+  }
+  return authNeeded(ref, cred.expiresAt && cred.expiresAt.getTime() <= Date.now() ? "expired" : "refresh_failed", cred.id);
+}
+function missingRequestedScopes(requested, granted) {
+  if (!requested?.length) {
+    return [];
+  }
+  const grantedSet = new Set(granted);
+  return requested.filter((scope) => !grantedSet.has(scope));
+}
+function headersForCredential(cred) {
+  if (cred.kind === "api_key") {
+    return stringRecord(cred.credential.headers);
+  }
+  if (cred.kind === "oauth2") {
+    const accessToken = stringValue(cred.credential.access_token);
+    if (!accessToken) {
+      return null;
+    }
+    const tokenType = stringValue(cred.credential.token_type) || "Bearer";
+    return { authorization: `${tokenType} ${accessToken}` };
+  }
+  return stringRecord(cred.credential.headers);
+}
+async function refreshOAuthConnectionCredential(cred, ref, settings) {
+  if (cred.kind !== "oauth2") {
+    return { credential: cred.credential, expiresAt: cred.expiresAt, grantedScopes: cred.grantedScopes };
+  }
+  const refreshToken = stringValue(cred.credential.refresh_token);
+  const tokenEndpoint = stringValue(cred.credential.token_endpoint) ?? stringValue(cred.metadata.tokenEndpoint) ?? stringValue(cred.metadata.token_endpoint);
+  if (!refreshToken || !tokenEndpoint) {
+    throw new Error("connection has no refresh token endpoint");
+  }
+  if (settings) {
+    await assertOAuthEndpointAllowed(tokenEndpoint, settings);
+  }
+  const body = new URLSearchParams();
+  body.set("grant_type", "refresh_token");
+  body.set("refresh_token", refreshToken);
+  const clientId = stringValue(cred.credential.client_id) ?? stringValue(cred.metadata.clientId) ?? stringValue(cred.metadata.client_id);
+  const clientSecret = stringValue(cred.credential.client_secret);
+  const authMethod = stringValue(cred.credential.token_endpoint_auth_method) ?? "none";
+  if (clientId) {
+    body.set("client_id", clientId);
+  }
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+  if (clientSecret && authMethod === "client_secret_post") {
+    body.set("client_secret", clientSecret);
+  } else if (clientId && clientSecret && authMethod === "client_secret_basic") {
+    headers.authorization = `Basic ${Buffer2.from(`${clientId}:${clientSecret}`).toString("base64")}`;
+  }
+  const resource = ref.resource ?? stringValue(cred.credential.resource);
+  if (resource) {
+    body.set("resource", resource);
+  }
+  if (ref.scopes?.length) {
+    body.set("scope", ref.scopes.join(" "));
+  }
+  const response = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers,
+    body,
+    redirect: "manual"
+  });
+  if (response.status >= 300 && response.status < 400) {
+    throw new ConnectionRefreshHttpError(response.status);
+  }
+  if (!response.ok) {
+    throw new ConnectionRefreshHttpError(response.status);
+  }
+  const payload = await response.json();
+  const accessToken = stringValue(payload.access_token);
+  if (!accessToken) {
+    throw new Error("connection refresh response did not include access_token");
+  }
+  const expiresAt = expiresAtFromTokenResponse(payload, cred.expiresAt);
+  const scopeText = stringValue(payload.scope);
+  const nextCredential = {
+    ...cred.credential,
+    access_token: accessToken,
+    refresh_token: stringValue(payload.refresh_token) ?? refreshToken,
+    token_type: stringValue(payload.token_type) ?? stringValue(cred.credential.token_type) ?? "Bearer",
+    ...expiresAt ? { expires_at: expiresAt.toISOString() } : {},
+    ...resource ? { resource } : {},
+    ...scopeText ? { scope: scopeText } : {},
+    ...clientSecret ? { client_secret: clientSecret, token_endpoint_auth_method: authMethod } : {}
+  };
+  return {
+    credential: nextCredential,
+    expiresAt,
+    ...scopeText ? { grantedScopes: scopeText.split(/\s+/).filter(Boolean) } : {}
+  };
+}
+function expiresAtFromTokenResponse(payload, fallback) {
+  const expiresAt = stringValue(payload.expires_at);
+  if (expiresAt) {
+    const parsed = new Date(expiresAt);
+    return Number.isNaN(parsed.getTime()) ? fallback : parsed;
+  }
+  const expiresIn = typeof payload.expires_in === "number" ? payload.expires_in : void 0;
+  if (expiresIn && Number.isFinite(expiresIn) && expiresIn > 0) {
+    return new Date(Date.now() + expiresIn * 1e3);
+  }
+  return fallback;
+}
+function stringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    if (typeof raw !== "string") {
+      return null;
+    }
+    out[key] = raw;
+  }
+  return out;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+async function assertOAuthEndpointAllowed(rawUrl, settings) {
+  if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
+    return;
+  }
+  const url = new URL(rawUrl);
+  if (url.protocol !== "https:") {
+    throw new Error("OAuth token endpoint must use https outside local/test");
+  }
+  const hostname = url.hostname.toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+    throw new Error("OAuth token endpoint may not target localhost");
+  }
+  const literal = isIP(hostname);
+  const addresses = literal ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
+  if (addresses.some(isPrivateAddress)) {
+    throw new Error("OAuth token endpoint may not target a private network address");
+  }
+}
+function isPrivateAddress(address) {
+  const normalized = normalizeAddress(address);
+  const mapped = ipv4FromMappedIpv6(normalized);
+  if (mapped) {
+    return isPrivateIpv4Address(mapped);
+  }
+  if (normalized.includes(":")) {
+    if (isIP(normalized) !== 6) {
+      return true;
+    }
+    return normalized === "::1" || normalized === "::" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
+  }
+  return isPrivateIpv4Address(normalized);
+}
+function normalizeAddress(address) {
+  const trimmed = address.trim().toLowerCase();
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function ipv4FromMappedIpv6(address) {
+  if (!address.startsWith("::ffff:")) {
+    return null;
+  }
+  const embedded = address.slice("::ffff:".length);
+  if (embedded.includes(".")) {
+    return embedded;
+  }
+  const parts = embedded.split(":");
+  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
+    return null;
+  }
+  const high = Number.parseInt(parts[0], 16);
+  const low = Number.parseInt(parts[1], 16);
+  if (!Number.isInteger(high) || !Number.isInteger(low) || high < 0 || high > 65535 || low < 0 || low > 65535) {
+    return null;
+  }
+  return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+}
+function isPrivateIpv4Address(address) {
+  if (isIP(address) !== 4) {
+    return true;
+  }
+  const parts = address.split(".").map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return true;
+  }
+  const [a, b] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+
 // src/index.ts
 var dbBindings = /* @__PURE__ */ new WeakMap();
 function rlsStrategyFor(db) {
@@ -439,6 +845,8 @@ var allWorkspacePermissions = [
   "github:manage",
   "github:use",
   "api_keys:manage",
+  "connections:read",
+  "connections:write",
   "environments:manage",
   "environments:use",
   "mcp_servers:attach",
@@ -1152,6 +1560,143 @@ async function deleteWorkspacePack(db, workspaceId, packId) {
     return rows.length > 0;
   });
 }
+var registryCapabilitySource = "registry";
+async function createImportBatch(db, input) {
+  const [row] = await db.insert(importBatches).values({
+    source: input.source,
+    snapshotDate: input.snapshotDate,
+    snapshotRef: input.snapshotRef ?? null,
+    attributionNote: input.attributionNote,
+    importedCount: input.importedCount ?? 0,
+    skippedCount: input.skippedCount ?? 0,
+    quarantinedCount: input.quarantinedCount ?? 0,
+    logoFailureCount: input.logoFailureCount ?? 0,
+    staleCount: input.staleCount ?? 0,
+    details: input.details ?? {}
+  }).returning();
+  if (!row) {
+    throw new Error("Failed to create import batch");
+  }
+  return mapImportBatch(row);
+}
+async function updateImportBatchCounts(db, id, input) {
+  const [row] = await db.update(importBatches).set({
+    importedCount: input.importedCount,
+    skippedCount: input.skippedCount,
+    quarantinedCount: input.quarantinedCount,
+    logoFailureCount: input.logoFailureCount,
+    staleCount: input.staleCount,
+    ...input.details ? { details: input.details } : {},
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(eq(importBatches.id, id)).returning();
+  if (!row) {
+    throw new Error(`Import batch not found: ${id}`);
+  }
+  return mapImportBatch(row);
+}
+async function upsertRegistryCapabilityCatalogItem(db, input) {
+  const now = /* @__PURE__ */ new Date();
+  const metadata = {
+    registry: "integrations.sh",
+    providerDomain: input.providerDomain,
+    scopesHint: input.scopesHint ?? [],
+    ...input.metadata
+  };
+  const values = {
+    id: input.id,
+    accountId: null,
+    workspaceId: null,
+    kind: "mcp",
+    source: registryCapabilitySource,
+    name: input.name,
+    description: input.description ?? null,
+    category: "integrations",
+    tags: input.tags ?? ["mcp", "integration", input.tier],
+    homepageUrl: input.homepageUrl ?? `https://${input.providerDomain}`,
+    endpointUrl: input.mcpUrl,
+    installUrl: input.homepageUrl ?? `https://${input.providerDomain}`,
+    authModel: input.authKind === "none" ? null : "credential_ref",
+    providerDomain: input.providerDomain,
+    surfaceType: "mcp",
+    transport: input.transport,
+    mcpUrl: input.mcpUrl,
+    authKind: input.authKind,
+    credentialFacts: input.credentialFacts,
+    tier: input.tier,
+    provenance: input.provenance,
+    logoAssetPath: input.logoAssetPath ?? null,
+    importBatchId: input.importBatchId,
+    stale: false,
+    staleAt: null,
+    metadata,
+    updatedAt: now
+  };
+  const updateValues = {
+    id: values.id,
+    kind: values.kind,
+    name: values.name,
+    description: values.description,
+    category: values.category,
+    tags: values.tags,
+    homepageUrl: values.homepageUrl,
+    endpointUrl: values.endpointUrl,
+    installUrl: values.installUrl,
+    authModel: values.authModel,
+    surfaceType: values.surfaceType,
+    transport: values.transport,
+    authKind: values.authKind,
+    credentialFacts: values.credentialFacts,
+    tier: values.tier,
+    provenance: values.provenance,
+    logoAssetPath: sql`coalesce(excluded.logo_asset_path, ${capabilityCatalogItems.logoAssetPath})`,
+    importBatchId: values.importBatchId,
+    stale: false,
+    staleAt: null,
+    metadata: values.metadata,
+    updatedAt: values.updatedAt
+  };
+  const [row] = await db.insert(capabilityCatalogItems).values(values).onConflictDoUpdate({
+    target: [
+      capabilityCatalogItems.source,
+      capabilityCatalogItems.providerDomain,
+      capabilityCatalogItems.mcpUrl
+    ],
+    set: updateValues
+  }).returning();
+  if (!row) {
+    throw new Error("Failed to upsert registry capability catalog item");
+  }
+  return mapCapabilityCatalogItem(row);
+}
+async function listRegistryCatalogSurfaceKeys(db) {
+  const rows = await db.select({
+    id: capabilityCatalogItems.id,
+    providerDomain: capabilityCatalogItems.providerDomain,
+    mcpUrl: capabilityCatalogItems.mcpUrl
+  }).from(capabilityCatalogItems).where(eq(capabilityCatalogItems.source, registryCapabilitySource));
+  return rows.flatMap((row) => row.providerDomain && row.mcpUrl ? [{ id: row.id, providerDomain: row.providerDomain, mcpUrl: row.mcpUrl }] : []);
+}
+async function markStaleRegistryCatalogItems(db, activeKeys, importBatchId) {
+  const active = new Set([...activeKeys].map((key) => `${key.providerDomain}
+${key.mcpUrl}`));
+  const existing = await listRegistryCatalogSurfaceKeys(db);
+  const stale = existing.filter((row) => !active.has(`${row.providerDomain}
+${row.mcpUrl}`));
+  if (stale.length === 0) {
+    return 0;
+  }
+  const now = /* @__PURE__ */ new Date();
+  const updated = await db.update(capabilityCatalogItems).set({
+    stale: true,
+    staleAt: now,
+    importBatchId,
+    updatedAt: now
+  }).where(and(
+    eq(capabilityCatalogItems.source, registryCapabilitySource),
+    inArray(capabilityCatalogItems.id, stale.map((row) => row.id))
+  )).returning({ id: capabilityCatalogItems.id });
+  return updated.length;
+}
 async function upsertCapabilityCatalogItem(db, input) {
   return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
     const now = /* @__PURE__ */ new Date();
@@ -1169,6 +1714,18 @@ async function upsertCapabilityCatalogItem(db, input) {
       endpointUrl: input.endpointUrl ?? null,
       installUrl: input.installUrl ?? null,
       authModel: input.authModel ?? null,
+      providerDomain: null,
+      surfaceType: null,
+      transport: null,
+      mcpUrl: null,
+      authKind: null,
+      credentialFacts: [],
+      tier: null,
+      provenance: null,
+      logoAssetPath: null,
+      importBatchId: null,
+      stale: false,
+      staleAt: null,
       metadata: input.metadata ?? {},
       updatedAt: now
     };
@@ -1183,6 +1740,18 @@ async function upsertCapabilityCatalogItem(db, input) {
       endpointUrl: values.endpointUrl,
       installUrl: values.installUrl,
       authModel: values.authModel,
+      providerDomain: values.providerDomain,
+      surfaceType: values.surfaceType,
+      transport: values.transport,
+      mcpUrl: values.mcpUrl,
+      authKind: values.authKind,
+      credentialFacts: values.credentialFacts,
+      tier: values.tier,
+      provenance: values.provenance,
+      logoAssetPath: values.logoAssetPath,
+      importBatchId: values.importBatchId,
+      stale: values.stale,
+      staleAt: values.staleAt,
       metadata: values.metadata,
       updatedAt: values.updatedAt
     };
@@ -1198,13 +1767,25 @@ async function upsertCapabilityCatalogItem(db, input) {
 }
 async function listCapabilityCatalogItems(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.select().from(capabilityCatalogItems).where(eq(capabilityCatalogItems.workspaceId, workspaceId)).orderBy(asc(capabilityCatalogItems.kind), asc(capabilityCatalogItems.name));
+    const rows = await scopedDb.select().from(capabilityCatalogItems).where(or(
+      eq(capabilityCatalogItems.workspaceId, workspaceId),
+      and(
+        isNull(capabilityCatalogItems.workspaceId),
+        or(
+          ne(capabilityCatalogItems.source, registryCapabilitySource),
+          eq(capabilityCatalogItems.stale, false)
+        )
+      )
+    )).orderBy(asc(capabilityCatalogItems.kind), asc(capabilityCatalogItems.name));
     return rows.map(mapCapabilityCatalogItem);
   });
 }
 async function getCapabilityCatalogItem(db, workspaceId, capabilityId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.select().from(capabilityCatalogItems).where(and(eq(capabilityCatalogItems.workspaceId, workspaceId), eq(capabilityCatalogItems.id, capabilityId))).limit(1);
+    const [row] = await scopedDb.select().from(capabilityCatalogItems).where(and(
+      eq(capabilityCatalogItems.id, capabilityId),
+      or(eq(capabilityCatalogItems.workspaceId, workspaceId), isNull(capabilityCatalogItems.workspaceId))
+    )).orderBy(asc(sql`(${capabilityCatalogItems.workspaceId} is null)`)).limit(1);
     return row ? mapCapabilityCatalogItem(row) : null;
   });
 }
@@ -1270,19 +1851,30 @@ async function listEnabledMcpCapabilityServers(db, workspaceId) {
     item: capabilityCatalogItems,
     installation: capabilityInstallations
   }).from(capabilityInstallations).innerJoin(capabilityCatalogItems, and(
-    eq(capabilityInstallations.workspaceId, capabilityCatalogItems.workspaceId),
+    or(
+      eq(capabilityInstallations.workspaceId, capabilityCatalogItems.workspaceId),
+      isNull(capabilityCatalogItems.workspaceId)
+    ),
     eq(capabilityInstallations.capabilityId, capabilityCatalogItems.id)
   )).where(and(
     eq(capabilityInstallations.workspaceId, workspaceId),
     eq(capabilityInstallations.kind, "mcp"),
     eq(capabilityInstallations.status, "active")
   )).orderBy(asc(capabilityCatalogItems.name)));
-  return rows.flatMap(({ item, installation }) => {
+  const preferredByInstallation = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const existing = preferredByInstallation.get(row.installation.id);
+    if (!existing || existing.item.workspaceId === null && row.item.workspaceId !== null) {
+      preferredByInstallation.set(row.installation.id, row);
+    }
+  }
+  return [...preferredByInstallation.values()].flatMap(({ item, installation }) => {
     if (!item.endpointUrl || !mcpConnectivityOk(installation.metadata)) {
       return [];
     }
     const headersEncrypted = encryptedHeadersConfig(installation.config.headersEncrypted);
-    if (item.authModel && !headersEncrypted) {
+    const connectionRef = connectionRefConfig(installation.config.connectionRef);
+    if (item.authModel && !headersEncrypted && !connectionRef) {
       return [];
     }
     const metadata = item.metadata;
@@ -1298,7 +1890,8 @@ async function listEnabledMcpCapabilityServers(db, workspaceId) {
       ...allowedTools ? { allowedTools } : {},
       ...timeoutMs ? { timeoutMs } : {},
       ...cacheToolsList !== void 0 ? { cacheToolsList } : {},
-      ...headersEncrypted ? { headersEncrypted } : {}
+      ...headersEncrypted ? { headersEncrypted } : {},
+      ...connectionRef ? { connectionRef } : {}
     }];
   });
 }
@@ -1329,6 +1922,361 @@ function mcpServerIdForCapability(capabilityId, metadata = {}) {
   const body = capabilityId.replace(/^[^:]+:/, "").toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 44) || "mcp";
   return `cap-${body}-${shortHash(capabilityId)}`;
 }
+var connectionMetadataColumns = {
+  id: connections.id,
+  accountId: connections.accountId,
+  workspaceId: connections.workspaceId,
+  subjectId: connections.subjectId,
+  providerDomain: connections.providerDomain,
+  kind: connections.kind,
+  status: connections.status,
+  grantedScopes: connections.grantedScopes,
+  expiresAt: connections.expiresAt,
+  lastRefreshAt: connections.lastRefreshAt,
+  lastUsedAt: connections.lastUsedAt,
+  lastError: connections.lastError,
+  version: connections.version,
+  metadata: connections.metadata,
+  createdBySubjectId: connections.createdBySubjectId,
+  updatedBySubjectId: connections.updatedBySubjectId,
+  createdAt: connections.createdAt,
+  updatedAt: connections.updatedAt
+};
+function connectionSubjectVisibility(subjectId) {
+  return subjectId ? or(isNull(connections.subjectId), eq(connections.subjectId, subjectId)) : isNull(connections.subjectId);
+}
+async function createConnection(db, input) {
+  return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
+    const [row] = await scopedDb.insert(connections).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId ?? null,
+      providerDomain: input.providerDomain,
+      kind: input.kind,
+      status: input.status ?? "active",
+      credentialEncrypted: input.credentialEncrypted,
+      grantedScopes: input.grantedScopes ?? [],
+      expiresAt: input.expiresAt ?? null,
+      metadata: input.metadata ?? {},
+      createdBySubjectId: input.createdBySubjectId ?? null,
+      updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null
+    }).returning(connectionMetadataColumns);
+    if (!row) {
+      throw new Error("Failed to create connection");
+    }
+    return mapConnectionMetadata(row);
+  });
+}
+async function listConnectionsMetadata(db, workspaceId, subjectId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const rows = await scopedDb.select(connectionMetadataColumns).from(connections).where(and(eq(connections.workspaceId, workspaceId), connectionSubjectVisibility(subjectId))).orderBy(desc(connections.createdAt));
+    return rows.map(mapConnectionMetadata);
+  });
+}
+async function getConnectionMetadata(db, workspaceId, connectionId, subjectId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select(connectionMetadataColumns).from(connections).where(and(
+      eq(connections.workspaceId, workspaceId),
+      eq(connections.id, connectionId),
+      connectionSubjectVisibility(subjectId)
+    )).limit(1);
+    return row ? mapConnectionMetadata(row) : null;
+  });
+}
+async function updateConnection(db, input) {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const set = {
+      updatedAt: /* @__PURE__ */ new Date(),
+      ...input.providerDomain !== void 0 ? { providerDomain: input.providerDomain } : {},
+      ...input.subjectId !== void 0 ? { subjectId: input.subjectId } : {},
+      ...input.kind !== void 0 ? { kind: input.kind } : {},
+      ...input.status !== void 0 ? { status: input.status } : {},
+      ...input.credentialEncrypted !== void 0 ? {
+        credentialEncrypted: input.credentialEncrypted,
+        version: sql`${connections.version} + 1`,
+        lastError: null
+      } : {},
+      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
+      ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
+      ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
+      ...input.updatedBySubjectId !== void 0 ? { updatedBySubjectId: input.updatedBySubjectId } : {}
+    };
+    const [row] = await scopedDb.update(connections).set(set).where(and(
+      eq(connections.workspaceId, input.workspaceId),
+      eq(connections.id, input.connectionId),
+      connectionSubjectVisibility(input.visibleToSubjectId),
+      ...input.expectedVersion !== void 0 ? [eq(connections.version, input.expectedVersion)] : []
+    )).returning(connectionMetadataColumns);
+    return row ? mapConnectionMetadata(row) : null;
+  });
+}
+async function revokeConnection(db, workspaceId, connectionId, updatedBySubjectId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.update(connections).set({
+      status: "revoked",
+      // The version bump invalidates any in-flight refresh's (id, version) CAS,
+      // so a racing refresh cannot commit and flip the row back to active.
+      version: sql`${connections.version} + 1`,
+      updatedBySubjectId: updatedBySubjectId ?? null,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(and(
+      eq(connections.workspaceId, workspaceId),
+      eq(connections.id, connectionId),
+      // Same visibility rule as get/update: shared rows plus the caller's own
+      // subject rows. Cross-subject revocation (admin janitorial) arrives with
+      // the subject-connections UX in I5, deliberately not before.
+      connectionSubjectVisibility(updatedBySubjectId)
+    )).returning(connectionMetadataColumns);
+    return row ? mapConnectionMetadata(row) : null;
+  });
+}
+async function loadConnectionCredentialForBroker(db, settings, input) {
+  const key = environmentsEncryptionKeyBytes3(settings);
+  if (!key) {
+    throw new Error("connection credential present but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
+  }
+  const subjectPredicate = input.allowSubjectOwned ? connectionSubjectVisibility(input.subjectId) : isNull(connections.subjectId);
+  const conditions = [
+    eq(connections.workspaceId, input.workspaceId),
+    subjectPredicate
+  ];
+  if (input.connectionId) {
+    conditions.push(eq(connections.id, input.connectionId));
+  } else {
+    conditions.push(eq(connections.providerDomain, input.providerDomain));
+    if (input.kind) {
+      conditions.push(eq(connections.kind, input.kind));
+    }
+  }
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select().from(connections).where(and(...conditions)).orderBy(desc(sql`(${connections.status} = 'active')`), desc(connections.updatedAt)).limit(1);
+    if (!row) {
+      return null;
+    }
+    let credential;
+    try {
+      credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
+    } catch (error) {
+      throw new Error(`connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
+      throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+    }
+    return {
+      id: row.id,
+      accountId: row.accountId,
+      workspaceId: row.workspaceId,
+      subjectId: row.subjectId,
+      providerDomain: row.providerDomain,
+      kind: row.kind,
+      status: row.status,
+      credential,
+      grantedScopes: row.grantedScopes,
+      expiresAt: row.expiresAt,
+      lastRefreshAt: row.lastRefreshAt,
+      version: row.version,
+      metadata: row.metadata
+    };
+  });
+}
+async function recordConnectionTokenRefresh(db, input) {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const set = {
+      credentialEncrypted: input.credentialEncrypted,
+      expiresAt: input.expiresAt,
+      lastRefreshAt: input.lastRefreshAt,
+      status: "active",
+      lastError: null,
+      version: sql`${connections.version} + 1`,
+      updatedAt: /* @__PURE__ */ new Date(),
+      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
+    };
+    const updated = await scopedDb.update(connections).set(set).where(and(
+      eq(connections.id, input.id),
+      eq(connections.workspaceId, input.workspaceId),
+      eq(connections.version, input.version),
+      // A refresh may only ever renew a live credential; revoked/errored rows
+      // stay dead even if a status change somewhere forgot to bump version.
+      eq(connections.status, "active")
+    )).returning({ id: connections.id });
+    return updated.length > 0;
+  });
+}
+async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const updated = await scopedDb.update(connections).set({
+      status,
+      lastError,
+      version: sql`${connections.version} + 1`,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(and(
+      eq(connections.workspaceId, workspaceId),
+      eq(connections.id, guard.id),
+      eq(connections.version, guard.version)
+    )).returning({ id: connections.id });
+    return updated.length > 0;
+  });
+}
+async function recordConnectionUsed(db, workspaceId, connectionId) {
+  await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    await scopedDb.update(connections).set({
+      lastUsedAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(and(eq(connections.workspaceId, workspaceId), eq(connections.id, connectionId)));
+  });
+}
+async function loadIntegrationOAuthClient(db, settings, issuer) {
+  const [row] = await db.select().from(integrationOauthClients).where(eq(integrationOauthClients.issuer, issuer)).limit(1);
+  if (!row) {
+    return null;
+  }
+  let clientSecret = null;
+  if (row.clientSecretEncrypted) {
+    const key = environmentsEncryptionKeyBytes3(settings);
+    if (!key) {
+      throw new Error("OAuth client secret present but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
+    }
+    clientSecret = decryptEnvironmentValue(key, row.clientSecretEncrypted);
+  }
+  return {
+    id: row.id,
+    issuer: row.issuer,
+    authorizationServer: row.authorizationServer,
+    clientId: row.clientId,
+    clientSecret,
+    tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+    metadata: row.metadata,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+async function storeIntegrationOAuthClient(db, input) {
+  const [inserted] = await db.insert(integrationOauthClients).values({
+    issuer: input.issuer,
+    authorizationServer: input.authorizationServer,
+    clientId: input.clientId,
+    clientSecretEncrypted: input.clientSecretEncrypted ?? null,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? "none",
+    metadata: input.metadata ?? {}
+  }).onConflictDoNothing({
+    target: integrationOauthClients.issuer
+  }).returning();
+  if (inserted) {
+    return mapStoredIntegrationOAuthClient(inserted);
+  }
+  const [winner] = await db.select().from(integrationOauthClients).where(eq(integrationOauthClients.issuer, input.issuer)).limit(1);
+  if (!winner) {
+    throw new Error(`OAuth client registration conflict winner not found for issuer ${input.issuer}`);
+  }
+  return mapStoredIntegrationOAuthClient(winner);
+}
+function mapStoredIntegrationOAuthClient(row) {
+  return {
+    id: row.id,
+    issuer: row.issuer,
+    authorizationServer: row.authorizationServer,
+    clientId: row.clientId,
+    clientSecretEncrypted: row.clientSecretEncrypted,
+    tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+    metadata: row.metadata,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+async function consumeIntegrationOAuthStateNonce(db, input) {
+  return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
+    await scopedDb.delete(integrationOauthStateNonces).where(and(
+      eq(integrationOauthStateNonces.workspaceId, input.workspaceId),
+      lt(integrationOauthStateNonces.expiresAt, input.now)
+    ));
+    const inserted = await scopedDb.insert(integrationOauthStateNonces).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      nonce: input.nonce,
+      expiresAt: input.expiresAt,
+      usedAt: input.now
+    }).onConflictDoNothing({ target: integrationOauthStateNonces.nonce }).returning({ nonce: integrationOauthStateNonces.nonce });
+    return inserted.length > 0;
+  });
+}
+async function createKnowledgeMemory(db, input) {
+  const text = requireDbString(input.text, "knowledge memory text");
+  const scope = cleanDbString(input.scope) ?? "workspace";
+  return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
+    const [row] = await scopedDb.insert(knowledgeMemories).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      status: input.status ?? "proposed",
+      kind: input.kind ?? "semantic",
+      scope,
+      text,
+      sourceRefs: input.sourceRefs ?? [],
+      confidence: confidenceToStorage(input.confidence ?? 0.5),
+      metadata: input.metadata ?? {},
+      createdBySessionId: input.createdBySessionId ?? null
+    }).returning();
+    if (!row) {
+      throw new Error("Failed to create knowledge memory");
+    }
+    return mapKnowledgeMemory(row);
+  });
+}
+async function updateKnowledgeMemory(db, workspaceId, memoryId, input) {
+  const reviewStatus = input.status === "approved" || input.status === "rejected";
+  const scope = input.scope !== void 0 ? requireDbString(input.scope, "knowledge memory scope") : void 0;
+  const text = input.text !== void 0 ? requireDbString(input.text, "knowledge memory text") : void 0;
+  const reviewedBy = input.reviewedBy === null ? null : input.reviewedBy !== void 0 ? requireDbString(input.reviewedBy, "knowledge memory reviewer") : void 0;
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.update(knowledgeMemories).set({
+      ...input.status !== void 0 ? { status: input.status } : {},
+      ...input.kind !== void 0 ? { kind: input.kind } : {},
+      ...scope !== void 0 ? { scope } : {},
+      ...text !== void 0 ? { text } : {},
+      ...input.sourceRefs !== void 0 ? { sourceRefs: input.sourceRefs } : {},
+      ...input.confidence !== void 0 ? { confidence: confidenceToStorage(input.confidence) } : {},
+      ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
+      // Re-proposing clears review metadata; an explicit reviewedBy in the same
+      // update still wins via the later spread.
+      ...input.status === "proposed" ? { reviewedBy: null, reviewedAt: null } : {},
+      ...reviewedBy !== void 0 ? { reviewedBy } : {},
+      ...reviewStatus ? { reviewedAt: /* @__PURE__ */ new Date() } : {},
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(and(eq(knowledgeMemories.workspaceId, workspaceId), eq(knowledgeMemories.id, memoryId))).returning();
+    if (!row) {
+      throw new Error(`Knowledge memory not found: ${memoryId}`);
+    }
+    return mapKnowledgeMemory(row);
+  });
+}
+async function getKnowledgeMemory(db, workspaceId, memoryId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select().from(knowledgeMemories).where(and(eq(knowledgeMemories.workspaceId, workspaceId), eq(knowledgeMemories.id, memoryId))).limit(1);
+    return row ? mapKnowledgeMemory(row) : null;
+  });
+}
+async function listKnowledgeMemories(db, workspaceId, options = {}) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const conditions = [eq(knowledgeMemories.workspaceId, workspaceId)];
+    if (options.status) {
+      conditions.push(eq(knowledgeMemories.status, options.status));
+    }
+    if (options.kind) {
+      conditions.push(eq(knowledgeMemories.kind, options.kind));
+    }
+    const scope = cleanDbString(options.scope);
+    if (scope) {
+      conditions.push(eq(knowledgeMemories.scope, scope));
+    }
+    const query = cleanDbString(options.query);
+    if (query) {
+      conditions.push(sql`to_tsvector('simple', ${knowledgeMemories.text}) @@ plainto_tsquery('simple', ${query})`);
+    }
+    const limit = Math.min(Math.max(options.limit ?? 20, 1), 100);
+    const rows = await scopedDb.select().from(knowledgeMemories).where(and(...conditions)).orderBy(desc(knowledgeMemories.updatedAt)).limit(limit);
+    return rows.map(mapKnowledgeMemory);
+  });
+}
 async function createSocialConnection(db, input) {
   return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
     const [row] = await scopedDb.insert(socialConnections).values({
@@ -1687,7 +2635,7 @@ async function loadWorkspaceEnvironmentForRun(db, settings, workspaceId, environ
   if (!environmentId) {
     return null;
   }
-  const key = environmentsEncryptionKeyBytes2(settings);
+  const key = environmentsEncryptionKeyBytes3(settings);
   if (!key) {
     throw new Error("workspace environment attached but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
   }
@@ -1768,7 +2716,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
   });
 }
 async function loadCodexCredentialForRun(db, settings, workspaceId, credentialId) {
-  const key = environmentsEncryptionKeyBytes2(settings);
+  const key = environmentsEncryptionKeyBytes3(settings);
   if (!key) {
     throw new Error("codex credential present but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured");
   }
@@ -2186,6 +3134,7 @@ async function insertSessionMcpServers(db, input) {
     allowedTools: server.allowedTools ?? null,
     timeoutMs: server.timeoutMs ?? null,
     cacheToolsList: server.cacheToolsList ?? false,
+    requireApproval: server.requireApproval ?? null,
     headersEncrypted: server.headersEncrypted ?? {}
   }))).returning();
   return rows.map(mapSessionMcpServerMetadata);
@@ -2247,6 +3196,7 @@ async function listSessionMcpServersForRun(db, workspaceId, sessionId, encryptio
         ...row.allowedTools ? { allowedTools: row.allowedTools } : {},
         ...row.timeoutMs ? { timeoutMs: row.timeoutMs } : {},
         ...row.cacheToolsList ? { cacheToolsList: row.cacheToolsList } : {},
+        ...row.requireApproval != null ? { requireApproval: row.requireApproval } : {},
         headers
       };
     });
@@ -2407,6 +3357,17 @@ async function listSessionEvents(db, workspaceId, sessionId, afterOrOptions = 0,
     return (hasBefore ? rows.reverse() : rows).map(mapEvent);
   });
 }
+async function reserveToolspaceCallForTurn(db, workspaceId, sessionId, turnId, limit) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.update(sessionTurns).set({ toolspaceCallCount: sql`${sessionTurns.toolspaceCallCount} + 1` }).where(and(
+      eq(sessionTurns.workspaceId, workspaceId),
+      eq(sessionTurns.sessionId, sessionId),
+      eq(sessionTurns.id, turnId),
+      sql`${sessionTurns.toolspaceCallCount} < ${limit}`
+    )).returning({ count: sessionTurns.toolspaceCallCount });
+    return row ? { reserved: true, count: Number(row.count) } : { reserved: false };
+  });
+}
 function normalizeEventSequence(value, fallback) {
   if (value === void 0 || !Number.isFinite(value)) {
     return fallback;
@@ -3267,6 +4228,16 @@ async function countSandboxLeasesByLiveness(db) {
   }
   return counts;
 }
+async function listCreditBalancesByAccount(db) {
+  const rows = await rawRows(db, sql`
+    select account_id, balance_micros
+    from opengeni_private.credit_balance_by_account()
+  `);
+  return rows.map((row) => ({
+    accountId: row.account_id,
+    balanceMicros: Number(row.balance_micros)
+  }));
+}
 async function listLiveModalSandboxLeaseAttributions(db) {
   const rows = await rawRows(db, sql`
     select lease_id, workspace_id, sandbox_group_id, instance_id, liveness
@@ -3422,6 +4393,7 @@ function mapEnrollment(row) {
     pubkey: row.pubkey,
     exposure: row.exposure,
     hasDisplay: row.hasDisplay,
+    desktopUnavailableReason: row.desktopUnavailableReason ?? null,
     allowScreenControl: row.allowScreenControl,
     status: row.status,
     os: row.os,
@@ -3507,14 +4479,22 @@ async function touchEnrollmentLastSeen(db, input) {
     ));
   });
 }
-async function setEnrollmentHasDisplay(db, input) {
+async function setEnrollmentDisplayState(db, input) {
   return await withRlsContext(db, { accountId: input.accountId, workspaceId: input.workspaceId }, async (scopedDb) => {
-    const rows = await scopedDb.update(enrollments).set({ hasDisplay: input.hasDisplay, updatedAt: /* @__PURE__ */ new Date() }).where(and(
+    const rows = await scopedDb.update(enrollments).set({
+      hasDisplay: input.hasDisplay,
+      desktopUnavailableReason: input.desktopUnavailableReason,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(and(
       eq(enrollments.workspaceId, input.workspaceId),
       eq(enrollments.id, input.enrollmentId),
-      // Only write on a CHANGE — an unchanged display must not churn a write on
-      // every reconnect Hello.
-      ne(enrollments.hasDisplay, input.hasDisplay)
+      // Only write on a CHANGE to EITHER field — an unchanged display state must
+      // not churn a write on every reconnect Hello. `IS DISTINCT FROM` is the
+      // null-safe inequality (a plain `ne` skips NULL rows).
+      or(
+        ne(enrollments.hasDisplay, input.hasDisplay),
+        sql`${enrollments.desktopUnavailableReason} IS DISTINCT FROM ${input.desktopUnavailableReason}`
+      )
     )).returning({ id: enrollments.id });
     return { updated: rows.length > 0 };
   });
@@ -5012,11 +5992,28 @@ function mapWorkspacePack(row) {
     updatedAt: row.updatedAt.toISOString()
   };
 }
+function mapImportBatch(row) {
+  return {
+    id: row.id,
+    source: row.source,
+    snapshotDate: row.snapshotDate.toISOString(),
+    snapshotRef: row.snapshotRef,
+    attributionNote: row.attributionNote,
+    importedCount: row.importedCount,
+    skippedCount: row.skippedCount,
+    quarantinedCount: row.quarantinedCount,
+    logoFailureCount: row.logoFailureCount,
+    staleCount: row.staleCount,
+    details: row.details,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString()
+  };
+}
 function mapCapabilityCatalogItem(row) {
   const runtime = row.kind === "mcp" && row.endpointUrl ? {
     available: true,
     mcpServerId: mcpServerIdForCapability(row.id, row.metadata),
-    transport: "streamable-http",
+    transport: row.transport ?? "streamable-http",
     notes: row.authModel ? "Requires credential headers supplied in the enable request." : null
   } : {
     available: false,
@@ -5024,8 +6021,8 @@ function mapCapabilityCatalogItem(row) {
   };
   return {
     id: row.id,
-    accountId: row.accountId,
-    workspaceId: row.workspaceId,
+    ...row.accountId ? { accountId: row.accountId } : {},
+    ...row.workspaceId ? { workspaceId: row.workspaceId } : {},
     kind: row.kind,
     source: row.source,
     name: row.name,
@@ -5036,10 +6033,25 @@ function mapCapabilityCatalogItem(row) {
     endpointUrl: row.endpointUrl,
     installUrl: row.installUrl,
     authModel: row.authModel,
+    providerDomain: row.providerDomain,
+    surfaceType: row.surfaceType,
+    transport: row.transport,
+    mcpUrl: row.mcpUrl,
+    authKind: row.authKind,
+    credentialFacts: row.credentialFacts,
+    tier: row.tier,
+    provenance: row.provenance,
+    logoAssetPath: row.logoAssetPath,
+    importBatchId: row.importBatchId,
+    stale: row.stale,
+    staleAt: row.staleAt?.toISOString() ?? null,
     tools: [],
     runtime,
     enabled: false,
     enabledReason: null,
+    // Overwritten by applyCapabilityEnablement in @opengeni/core, which knows
+    // the installation; a freshly-read catalog row carries no connection.
+    connectionRef: null,
     metadata: row.metadata,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString()
@@ -5089,6 +6101,46 @@ function redactInstallationConfig(config) {
   const { headersEncrypted: _omitted, ...rest } = config;
   return { ...rest, headerNames: Object.keys(headersEncrypted).sort() };
 }
+function mapConnectionMetadata(row) {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    subjectId: row.subjectId,
+    providerDomain: row.providerDomain,
+    kind: row.kind,
+    status: row.status,
+    grantedScopes: row.grantedScopes,
+    expiresAt: row.expiresAt?.toISOString() ?? null,
+    lastRefreshAt: row.lastRefreshAt?.toISOString() ?? null,
+    lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+    lastError: row.lastError,
+    version: row.version,
+    metadata: row.metadata,
+    createdBySubjectId: row.createdBySubjectId,
+    updatedBySubjectId: row.updatedBySubjectId,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString()
+  };
+}
+function mapKnowledgeMemory(row) {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    status: row.status,
+    kind: row.kind,
+    scope: row.scope,
+    text: row.text,
+    sourceRefs: Array.isArray(row.sourceRefs) ? row.sourceRefs : [],
+    confidence: confidenceFromStorage(row.confidence),
+    metadata: row.metadata,
+    createdBySessionId: row.createdBySessionId,
+    reviewedBy: row.reviewedBy,
+    reviewedAt: row.reviewedAt ? row.reviewedAt.toISOString() : null,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString()
+  };
+}
 function mapSocialConnection(row) {
   return {
     id: row.id,
@@ -5176,6 +6228,26 @@ function stringArrayConfig(value) {
   const values = value.filter((item) => typeof item === "string" && item.trim().length > 0);
   return values.length > 0 ? [...new Set(values.map((item) => item.trim()))] : void 0;
 }
+function cleanDbString(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+}
+function requireDbString(value, field) {
+  const trimmed = cleanDbString(value);
+  if (!trimmed) {
+    throw new Error(`${field} is required`);
+  }
+  return trimmed;
+}
+function confidenceToStorage(value) {
+  if (!Number.isFinite(value)) {
+    return 50;
+  }
+  return Math.round(Math.min(Math.max(value, 0), 1) * 100);
+}
+function confidenceFromStorage(value) {
+  return Number((Math.min(Math.max(value, 0), 100) / 100).toFixed(2));
+}
 function positiveIntegerConfig(value) {
   if (typeof value === "number" && Number.isInteger(value) && value > 0) {
     return value;
@@ -5197,7 +6269,36 @@ function encryptedHeadersConfig(value) {
 }
 function mcpConnectivityOk(metadata) {
   const value = metadata.mcpConnectivity;
-  return !!value && typeof value === "object" && "status" in value && value.status === "ok";
+  return !!value && typeof value === "object" && "status" in value && (value.status === "ok" || value.status === "auth_deferred");
+}
+function connectionRefConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  const record = value;
+  if (typeof record.providerDomain !== "string" || record.providerDomain.length === 0) {
+    return void 0;
+  }
+  const ref = { providerDomain: record.providerDomain };
+  if (typeof record.connectionId === "string" && record.connectionId.length > 0) {
+    ref.connectionId = record.connectionId;
+  }
+  if (typeof record.kind === "string" && ["oauth2", "api_key", "app_install", "delegated"].includes(record.kind)) {
+    ref.kind = record.kind;
+  }
+  if (Array.isArray(record.scopes)) {
+    const scopes = record.scopes.filter((scope) => typeof scope === "string" && scope.length > 0);
+    if (scopes.length > 0) {
+      ref.scopes = scopes;
+    }
+  }
+  if (typeof record.resource === "string" && record.resource.length > 0) {
+    ref.resource = record.resource;
+  }
+  if (record.subjectScope === "workspace" || record.subjectScope === "subject") {
+    ref.subjectScope = record.subjectScope;
+  }
+  return ref;
 }
 function shortHash(value) {
   let hash = 2166136261;
@@ -5210,6 +6311,7 @@ function shortHash(value) {
 export {
   CLEARED_RUN_STATE,
   CODEX_ROTATION_STRATEGIES,
+  ConnectionRefreshHttpError,
   MACHINE_METRICS_SERIES_INTERVAL_MS,
   SandboxImageConflictError,
   SandboxLeaseSupersededError,
@@ -5227,6 +6329,7 @@ export {
   approveDeviceEnrollmentRequest,
   bootstrapWorkspace,
   buildCodexTokenResolver,
+  buildConnectionTokenResolver,
   cancelQueuedSessionTurn,
   claimNextQueuedTurn,
   clearSessionContext,
@@ -5236,6 +6339,7 @@ export {
   completeFileUpload,
   confirmDrainCold,
   consumeDeviceEnrollmentRequest,
+  consumeIntegrationOAuthStateNonce,
   consumeSessionCompactionRequest,
   countActiveApiKeysForWorkspace,
   countActiveSessionHistoryItems,
@@ -5251,10 +6355,13 @@ export {
   countWorkspaceEnvironments,
   countWorkspacesForAccount,
   createApiKey,
+  createConnection,
   createDb,
   createDeviceEnrollmentRequest,
   createEnrollment,
   createFileUpload,
+  createImportBatch,
+  createKnowledgeMemory,
   createSandbox,
   createScheduledTask,
   createScheduledTaskRun,
@@ -5301,10 +6408,12 @@ export {
   getCapabilityInstallation,
   getCodexCredentialStatus,
   getCodexRotationSettings,
+  getConnectionMetadata,
   getDeviceEnrollmentRequestByDeviceCode,
   getEnrollment,
   getFile,
   getFileUpload,
+  getKnowledgeMemory,
   getLatestRunState,
   getManagedAccount,
   getManagedUserByEmail,
@@ -5342,21 +6451,26 @@ export {
   insertRecording,
   isCodexBilledModel2 as isCodexBilledModel,
   isCodexBilledTurn,
+  isPrivateAddress,
   isStripeWebhookProcessed,
   listApiKeys,
   listCapabilityCatalogItems,
   listCapabilityInstallations,
   listCodexAccountStatuses,
+  listConnectionsMetadata,
+  listCreditBalancesByAccount,
   listDistinctEnvironmentIdsInGroup,
   listEnabledMcpCapabilityServers,
   listEnrollments,
   listGitHubInstallationIdsForWorkspace,
   listGitHubInstallationsForWorkspace,
+  listKnowledgeMemories,
   listLiveModalSandboxLeaseAttributions,
   listMeterableWarmLeases,
   listOpenPtySessions,
   listPackInstallations,
   listRecordings,
+  listRegistryCatalogSurfaceKeys,
   listSandboxes,
   listScheduledTaskRuns,
   listScheduledTasks,
@@ -5374,8 +6488,11 @@ export {
   listWorkspacePacks,
   listWorkspacesForSubject,
   loadCodexCredentialForRun,
+  loadConnectionCredentialForBroker,
+  loadIntegrationOAuthClient,
   loadWorkspaceEnvironmentForRun,
   markFileUploadFailed,
+  markStaleRegistryCatalogItems,
   markStripeWebhookProcessed,
   mcpServerIdForCapability,
   migrate,
@@ -5395,6 +6512,8 @@ export {
   recordCodexAccountConnectors,
   recordCodexAccountUsage,
   recordCodexTokenRefresh,
+  recordConnectionTokenRefresh,
+  recordConnectionUsed,
   recordLeaseDataPlaneUrl,
   recordLeaseTerminalDataPlaneUrl,
   recordSessionActiveCodexCredential,
@@ -5402,6 +6521,7 @@ export {
   recordStripeWebhookEvent,
   recordUsageEvent,
   recordWarmingSandboxCreated,
+  refreshOAuthConnectionCredential,
   registerDbBinding,
   registerWorkspacePack,
   releaseLeaseHolder,
@@ -5415,7 +6535,9 @@ export {
   requireSession,
   requireSocialConnection,
   requireWorkspace,
+  reserveToolspaceCallForTurn,
   revokeApiKey,
+  revokeConnection,
   revokeEnrollment,
   revokeViewer,
   rlsContextForWorkspace,
@@ -5429,7 +6551,8 @@ export {
   setActiveSandbox,
   setCodexCredentialExhausted,
   setCodexCredentialStatus,
-  setEnrollmentHasDisplay,
+  setConnectionStatus,
+  setEnrollmentDisplayState,
   setRlsContext,
   setSessionCodexPin,
   setSessionGoalLastContinuationTurn,
@@ -5438,9 +6561,13 @@ export {
   setSessionStatus,
   setTemporalWorkflowId,
   setWorkspaceEnvironmentVariable,
+  storeIntegrationOAuthClient,
   sumUsageQuantity,
   touchEnrollmentLastSeen,
   updateCodexRotationSettings,
+  updateConnection,
+  updateImportBatchCounts,
+  updateKnowledgeMemory,
   updatePackInstallationStatus,
   updatePtySessionActivity,
   updateQueuedSessionTurn,
@@ -5457,6 +6584,7 @@ export {
   upsertCodexSubscriptionCredential,
   upsertGitHubInstallation,
   upsertMachineMetricsLatest,
+  upsertRegistryCapabilityCatalogItem,
   upsertSandboxSessionEnvelope,
   upsertSessionGoal,
   wakeParentSessionForChildCompletion,