@agent-native/core 0.152.0 → 0.153.0

package/dist/workspace-connections/actions/upsert-workspace-user-group.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertWorkspaceUserGroupManager, upsertWorkspaceUserGroup, } from "../groups.js";
+export default defineAction({
+    description: "Create or update a reusable workspace user group and its member list. Only workspace owners and admins can change groups.",
+    schema: z.object({
+        id: z.string().optional().describe("Existing user group ID to update."),
+        name: z.string().describe("Group name, such as Rev Ops."),
+        memberEmails: z
+            .array(z.string().email())
+            .default([])
+            .describe("Workspace member email addresses in this group."),
+    }),
+    run: async (args, ctx) => {
+        await assertWorkspaceUserGroupManager(ctx?.orgId, ctx?.userEmail);
+        return upsertWorkspaceUserGroup({
+            ...args,
+            orgId: ctx?.orgId,
+            createdByEmail: ctx?.userEmail,
+        });
+    },
+});

package/dist/workspace-connections/credential-key-aliases.d.ts

@@ -0,0 +1,3 @@
+export declare function credentialKeyAliases(provider: string, key: string): string[];
+export declare function credentialKeyMatches(provider: string, requestedKey: string, refKey: string): boolean;
+export declare function lookupKeysForRef(provider: string, requestedKey: string, refKey: string): string[];

package/dist/workspace-connections/credential-key-aliases.js

@@ -0,0 +1,31 @@
+const PROVIDER_CREDENTIAL_KEY_ALIASES = {
+    hubspot: {
+        HUBSPOT_ACCESS_TOKEN: ["HUBSPOT_PRIVATE_APP_TOKEN", "HUBSPOT_SECRET_KEY"],
+        HUBSPOT_PRIVATE_APP_TOKEN: ["HUBSPOT_ACCESS_TOKEN", "HUBSPOT_SECRET_KEY"],
+        // This alias is only considered after the connection has been identified
+        // as HubSpot. Key names alone never identify a provider.
+        HUBSPOT_SECRET_KEY: ["HUBSPOT_PRIVATE_APP_TOKEN", "HUBSPOT_ACCESS_TOKEN"],
+    },
+};
+function normalizeCredentialKey(key) {
+    return key.trim().toUpperCase();
+}
+function uniqueStrings(values) {
+    return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
+}
+export function credentialKeyAliases(provider, key) {
+    const aliases = PROVIDER_CREDENTIAL_KEY_ALIASES[provider.trim().toLowerCase()]?.[normalizeCredentialKey(key)] ?? [];
+    return uniqueStrings([key, ...aliases]);
+}
+export function credentialKeyMatches(provider, requestedKey, refKey) {
+    const requested = new Set(credentialKeyAliases(provider, requestedKey).map(normalizeCredentialKey));
+    return requested.has(normalizeCredentialKey(refKey));
+}
+export function lookupKeysForRef(provider, requestedKey, refKey) {
+    return uniqueStrings([
+        refKey,
+        ...credentialKeyAliases(provider, refKey),
+        requestedKey,
+        ...credentialKeyAliases(provider, requestedKey),
+    ]);
+}

package/dist/workspace-connections/credentials.js

@@ -1,41 +1,17 @@
 import { resolveCredentialForScope, } from "../credentials/index.js";
 import { readAppSecret } from "../secrets/storage.js";
 import { getCredentialContext, getRequestContext, runWithRequestContext, } from "../server/request-context.js";
+import { credentialKeyMatches, lookupKeysForRef, } from "./credential-key-aliases.js";
 import { listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, } from "./store.js";
-const PROVIDER_CREDENTIAL_KEY_ALIASES = {
-    hubspot: {
-        HUBSPOT_ACCESS_TOKEN: ["HUBSPOT_PRIVATE_APP_TOKEN"],
-        HUBSPOT_PRIVATE_APP_TOKEN: ["HUBSPOT_ACCESS_TOKEN"],
-    },
-};
 function normalizeRequired(value, label) {
     const normalized = value.trim();
     if (!normalized)
         throw new Error(`${label} is required.`);
     return normalized;
 }
-function normalizeCredentialKey(key) {
-    return key.trim().toUpperCase();
-}
 function uniqueStrings(values) {
     return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
 }
-function credentialKeyAliases(provider, key) {
-    const aliases = PROVIDER_CREDENTIAL_KEY_ALIASES[provider.trim().toLowerCase()]?.[normalizeCredentialKey(key)] ?? [];
-    return uniqueStrings([key, ...aliases]);
-}
-function credentialKeyMatches(provider, requestedKey, refKey) {
-    const requested = new Set(credentialKeyAliases(provider, requestedKey).map(normalizeCredentialKey));
-    return requested.has(normalizeCredentialKey(refKey));
-}
-function lookupKeysForRef(provider, requestedKey, refKey) {
-    return uniqueStrings([
-        refKey,
-        ...credentialKeyAliases(provider, refKey),
-        requestedKey,
-        ...credentialKeyAliases(provider, requestedKey),
-    ]);
-}
 function publicCredentialRef(ref, source) {
     return {
         key: ref.key,

package/dist/workspace-connections/groups.d.ts

@@ -0,0 +1,32 @@
+export interface WorkspaceUserGroup {
+    id: string;
+    orgId: string;
+    name: string;
+    memberEmails: string[];
+    createdByEmail: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UpsertWorkspaceUserGroupInput {
+    id?: string;
+    name: string;
+    memberEmails: string[];
+    orgId?: string | null;
+    createdByEmail?: string;
+}
+export interface UpdateWorkspaceUserGroupMembersInput {
+    id: string;
+    memberEmails: string[];
+    operation: "add" | "remove";
+    orgId?: string | null;
+}
+export declare function normalizeWorkspaceUserGroupIds(value: unknown): string[];
+export declare function ensureWorkspaceUserGroupsTable(): Promise<void>;
+export declare function listWorkspaceUserGroupsForOrg(orgId: string, groupIds?: string[]): Promise<WorkspaceUserGroup[]>;
+export declare function listWorkspaceUserGroups(): Promise<WorkspaceUserGroup[]>;
+export declare function assertWorkspaceUserGroupIds(groupIds: string[] | undefined, orgId: string | null | undefined): Promise<string[] | undefined>;
+export declare function assertWorkspaceUserGroupManager(orgId: string | null | undefined, userEmail: string | undefined): Promise<void>;
+export declare function upsertWorkspaceUserGroup(input: UpsertWorkspaceUserGroupInput): Promise<WorkspaceUserGroup>;
+export declare function updateWorkspaceUserGroupMembers(input: UpdateWorkspaceUserGroupMembersInput): Promise<WorkspaceUserGroup>;
+export declare function deleteWorkspaceUserGroup(id: string, orgId?: string | null): Promise<boolean>;
+export declare function workspaceUserGroupsIncludeUser(orgId: string | null | undefined, groupIds: string[] | undefined, userEmail: string): Promise<boolean>;

package/dist/workspace-connections/groups.js

@@ -0,0 +1,288 @@
+import { randomUUID } from "node:crypto";
+import { getDbExec, intType, isPostgres, retryOnDdlRace, safeJsonParse, } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+import { isOrgMember } from "../org/membership.js";
+import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+function workspaceUserGroupsTable() {
+    return isPostgres()
+        ? "public.workspace_user_groups"
+        : "workspace_user_groups";
+}
+function isDuplicateObjectError(err) {
+    const code = String(err?.code ?? "");
+    const message = String(err?.message ?? err)
+        .toLowerCase()
+        .trim();
+    return (code === "42710" ||
+        message.includes("already exists") ||
+        message.includes("duplicate"));
+}
+function normalizeMemberEmails(value) {
+    if (!Array.isArray(value))
+        return [];
+    return Array.from(new Set(value
+        .filter((entry) => typeof entry === "string")
+        .map((email) => email.trim().toLowerCase())
+        .filter(Boolean)));
+}
+export function normalizeWorkspaceUserGroupIds(value) {
+    if (!Array.isArray(value))
+        return [];
+    return Array.from(new Set(value
+        .filter((entry) => typeof entry === "string")
+        .map((id) => id.trim())
+        .filter(Boolean)));
+}
+function normalizeGroupName(value) {
+    const name = typeof value === "string" ? value.trim() : "";
+    if (!name)
+        throw new Error("Workspace user group name is required.");
+    if (name.length > 80) {
+        throw new Error("Workspace user group names must be 80 characters or less.");
+    }
+    return name;
+}
+function iso(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === "number")
+        return new Date(value).toISOString();
+    const parsed = Date.parse(String(value ?? ""));
+    return Number.isFinite(parsed)
+        ? new Date(parsed).toISOString()
+        : new Date(0).toISOString();
+}
+function requireWorkspaceUserGroupScope() {
+    const orgId = getRequestOrgId()?.trim();
+    const userEmail = getRequestUserEmail()?.trim().toLowerCase();
+    if (!orgId) {
+        throw new Error("Workspace user groups require an active workspace.");
+    }
+    if (!userEmail) {
+        throw new Error("Workspace user groups require an authenticated user.");
+    }
+    return { orgId, userEmail };
+}
+function parseRow(row) {
+    return {
+        id: String(row.id ?? ""),
+        orgId: String(row.org_id ?? ""),
+        name: String(row.name ?? ""),
+        memberEmails: normalizeMemberEmails(safeJsonParse(row.member_emails_json, [])),
+        createdByEmail: String(row.created_by_email ?? ""),
+        createdAt: iso(row.created_at),
+        updatedAt: iso(row.updated_at),
+    };
+}
+async function ensureWorkspaceUserGroupColumns(client, table) {
+    const columns = [
+        ["org_id", "TEXT NOT NULL DEFAULT ''"],
+        ["name", "TEXT NOT NULL DEFAULT ''"],
+        ["member_emails_json", "TEXT NOT NULL DEFAULT '[]'"],
+        ["created_by_email", "TEXT NOT NULL DEFAULT ''"],
+        ["created_at", `${intType()} NOT NULL DEFAULT 0`],
+        ["updated_at", `${intType()} NOT NULL DEFAULT 0`],
+    ];
+    for (const [name, definition] of columns) {
+        try {
+            await retryOnDdlRace(() => client.execute(isPostgres()
+                ? `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${name} ${definition}`
+                : `ALTER TABLE ${table} ADD COLUMN ${name} ${definition}`));
+        }
+        catch (error) {
+            if (!isDuplicateObjectError(error))
+                throw error;
+        }
+    }
+}
+let initPromise;
+export async function ensureWorkspaceUserGroupsTable() {
+    if (!initPromise) {
+        initPromise = (async () => {
+            const client = getDbExec();
+            const table = workspaceUserGroupsTable();
+            const createSql = `
+        CREATE TABLE IF NOT EXISTS ${table} (
+          id TEXT PRIMARY KEY,
+          org_id TEXT NOT NULL DEFAULT '',
+          name TEXT NOT NULL DEFAULT '',
+          member_emails_json TEXT NOT NULL DEFAULT '[]',
+          created_by_email TEXT NOT NULL DEFAULT '',
+          created_at ${intType()} NOT NULL DEFAULT 0,
+          updated_at ${intType()} NOT NULL DEFAULT 0
+        )
+      `;
+            if (isPostgres()) {
+                await ensureTableExists("workspace_user_groups", createSql);
+                await ensureWorkspaceUserGroupColumns(client, table);
+                await ensureIndexExists("idx_workspace_user_groups_org_updated", `CREATE INDEX IF NOT EXISTS idx_workspace_user_groups_org_updated ON ${table} (org_id, updated_at)`);
+                return;
+            }
+            await retryOnDdlRace(() => client.execute(createSql));
+            await ensureWorkspaceUserGroupColumns(client, table);
+            await retryOnDdlRace(() => client.execute(`CREATE INDEX IF NOT EXISTS idx_workspace_user_groups_org_updated ON ${table} (org_id, updated_at)`));
+        })().catch((error) => {
+            initPromise = undefined;
+            throw error;
+        });
+    }
+    return initPromise;
+}
+export async function listWorkspaceUserGroupsForOrg(orgId, groupIds) {
+    const normalizedOrgId = orgId.trim();
+    if (!normalizedOrgId)
+        return [];
+    await ensureWorkspaceUserGroupsTable();
+    const client = getDbExec();
+    const table = workspaceUserGroupsTable();
+    const normalizedIds = normalizeWorkspaceUserGroupIds(groupIds);
+    const args = [normalizedOrgId];
+    let filter = "org_id = ?";
+    if (normalizedIds.length > 0) {
+        filter += ` AND id IN (${normalizedIds.map(() => "?").join(", ")})`;
+        args.push(...normalizedIds);
+    }
+    const { rows } = await client.execute({
+        sql: `SELECT * FROM ${table} WHERE ${filter} ORDER BY updated_at DESC, name ASC`,
+        args,
+    });
+    return rows.map((row) => parseRow(row));
+}
+export async function listWorkspaceUserGroups() {
+    const { orgId } = requireWorkspaceUserGroupScope();
+    return listWorkspaceUserGroupsForOrg(orgId);
+}
+export async function assertWorkspaceUserGroupIds(groupIds, orgId) {
+    if (groupIds === undefined)
+        return undefined;
+    const normalized = normalizeWorkspaceUserGroupIds(groupIds);
+    if (normalized.length === 0)
+        return normalized;
+    const normalizedOrgId = orgId?.trim();
+    if (!normalizedOrgId) {
+        throw new Error("User groups require a workspace. Personal connections are only available to you.");
+    }
+    const groups = await listWorkspaceUserGroupsForOrg(normalizedOrgId, normalized);
+    const found = new Set(groups.map((group) => group.id));
+    const missing = normalized.filter((id) => !found.has(id));
+    if (missing.length > 0) {
+        throw new Error(`User groups were not found in this workspace: ${missing.join(", ")}.`);
+    }
+    return normalized;
+}
+export async function assertWorkspaceUserGroupManager(orgId, userEmail) {
+    const normalizedOrgId = orgId?.trim();
+    const normalizedEmail = userEmail?.trim().toLowerCase();
+    if (!normalizedOrgId || !normalizedEmail) {
+        throw new Error("Only workspace admins can manage user groups.");
+    }
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+        args: [normalizedOrgId, normalizedEmail],
+    });
+    const role = String(rows[0]?.role ?? "");
+    if (role !== "owner" && role !== "admin") {
+        throw new Error("Only workspace admins can manage user groups.");
+    }
+}
+export async function upsertWorkspaceUserGroup(input) {
+    const requestScope = requireWorkspaceUserGroupScope();
+    const orgId = input.orgId?.trim() || requestScope.orgId;
+    if (orgId !== requestScope.orgId) {
+        throw new Error("User groups must belong to the active workspace.");
+    }
+    const name = normalizeGroupName(input.name);
+    const memberEmails = normalizeMemberEmails(input.memberEmails);
+    const missing = (await Promise.all(memberEmails.map(async (email) => (await isOrgMember(orgId, email)) ? null : email))).filter((email) => Boolean(email));
+    if (missing.length > 0) {
+        throw new Error(`Group members must belong to this workspace: ${missing.join(", ")}.`);
+    }
+    await ensureWorkspaceUserGroupsTable();
+    const client = getDbExec();
+    const table = workspaceUserGroupsTable();
+    const id = input.id?.trim() || randomUUID();
+    const now = Date.now();
+    const createdByEmail = input.createdByEmail?.trim().toLowerCase() || requestScope.userEmail;
+    const update = await client.execute({
+        sql: `UPDATE ${table}
+      SET name = ?, member_emails_json = ?, updated_at = ?
+      WHERE id = ? AND org_id = ?`,
+        args: [name, JSON.stringify(memberEmails), now, id, orgId],
+    });
+    if (update.rowsAffected === 0) {
+        await client.execute({
+            sql: `INSERT INTO ${table}
+        (id, org_id, name, member_emails_json, created_by_email, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                id,
+                orgId,
+                name,
+                JSON.stringify(memberEmails),
+                createdByEmail,
+                now,
+                now,
+            ],
+        });
+    }
+    const groups = await listWorkspaceUserGroupsForOrg(orgId, [id]);
+    const group = groups[0];
+    if (!group)
+        throw new Error(`User group "${id}" was not found after upsert.`);
+    return group;
+}
+export async function updateWorkspaceUserGroupMembers(input) {
+    const requestScope = requireWorkspaceUserGroupScope();
+    const orgId = input.orgId?.trim() || requestScope.orgId;
+    if (orgId !== requestScope.orgId) {
+        throw new Error("User groups must belong to the active workspace.");
+    }
+    const id = input.id.trim();
+    if (!id)
+        throw new Error("A user group is required.");
+    const group = (await listWorkspaceUserGroupsForOrg(orgId, [id]))[0];
+    if (!group)
+        throw new Error(`User group "${id}" was not found.`);
+    const memberEmails = normalizeMemberEmails(input.memberEmails);
+    const missing = (await Promise.all(memberEmails.map(async (email) => (await isOrgMember(orgId, email)) ? null : email))).filter((email) => Boolean(email));
+    if (missing.length > 0) {
+        throw new Error(`Group members must belong to this workspace: ${missing.join(", ")}.`);
+    }
+    const existing = new Set(group.memberEmails);
+    const nextMembers = input.operation === "add"
+        ? Array.from(new Set([...existing, ...memberEmails]))
+        : group.memberEmails.filter((email) => !memberEmails.includes(email));
+    return upsertWorkspaceUserGroup({
+        id: group.id,
+        name: group.name,
+        memberEmails: nextMembers,
+        orgId,
+        createdByEmail: requestScope.userEmail,
+    });
+}
+export async function deleteWorkspaceUserGroup(id, orgId) {
+    const requestScope = requireWorkspaceUserGroupScope();
+    const normalizedOrgId = orgId?.trim() || requestScope.orgId;
+    if (normalizedOrgId !== requestScope.orgId) {
+        throw new Error("User groups must belong to the active workspace.");
+    }
+    const normalizedId = id.trim();
+    if (!normalizedId)
+        throw new Error("A user group is required.");
+    await ensureWorkspaceUserGroupsTable();
+    const result = await getDbExec().execute({
+        sql: `DELETE FROM ${workspaceUserGroupsTable()} WHERE id = ? AND org_id = ?`,
+        args: [normalizedId, normalizedOrgId],
+    });
+    return result.rowsAffected > 0;
+}
+export async function workspaceUserGroupsIncludeUser(orgId, groupIds, userEmail) {
+    const normalizedOrgId = orgId?.trim();
+    const normalizedEmail = userEmail.trim().toLowerCase();
+    const normalizedIds = normalizeWorkspaceUserGroupIds(groupIds);
+    if (!normalizedOrgId || !normalizedEmail || normalizedIds.length === 0) {
+        return false;
+    }
+    const groups = await listWorkspaceUserGroupsForOrg(normalizedOrgId, normalizedIds);
+    return groups.some((group) => group.memberEmails.includes(normalizedEmail));
+}

package/dist/workspace-connections/index.d.ts

@@ -1,3 +1,5 @@
-export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type MarkWorkspaceConnectionUsedOptions, type MarkWorkspaceConnectionUsedResult, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
+export { credentialKeyAliases, credentialKeyMatches, lookupKeysForRef, } from "./credential-key-aliases.js";
+export { assertWorkspaceUserGroupIds, assertWorkspaceUserGroupManager, deleteWorkspaceUserGroup, ensureWorkspaceUserGroupsTable, listWorkspaceUserGroups, listWorkspaceUserGroupsForOrg, normalizeWorkspaceUserGroupIds, updateWorkspaceUserGroupMembers, upsertWorkspaceUserGroup, workspaceUserGroupsIncludeUser, type UpsertWorkspaceUserGroupInput, type UpdateWorkspaceUserGroupMembersInput, type WorkspaceUserGroup, } from "./groups.js";
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, type ListWorkspaceConnectionProviderCatalogForAppOptions, type ListWorkspaceConnectionGrantsOptions, type ListWorkspaceConnectionsOptions, type ListWorkspaceConnectionsForAppOptions, type MarkWorkspaceConnectionUsedOptions, type MarkWorkspaceConnectionUsedResult, type ResolvedWorkspaceConnectionForApp, type ResolveWorkspaceConnectionForAppOptions, type SerializedWorkspaceConnectionGrant, type SerializedWorkspaceConnection, type SummarizeWorkspaceConnectionProviderForAppOptions, type SummarizeWorkspaceConnectionProviderReadinessOptions, type UpsertWorkspaceConnectionGrantInput, type UpsertWorkspaceConnectionInput, type WorkspaceConnectionAppAccess, type WorkspaceConnectionAppAccessMode, type WorkspaceConnection, type WorkspaceConnectionCredentialRef, type WorkspaceConnectionExplicitGrantSummary, type WorkspaceConnectionForApp, type WorkspaceConnectionForAppSummary, type WorkspaceConnectionGrant, type WorkspaceConnectionGrantAvailability, type WorkspaceConnectionGrantState, type WorkspaceConnectionProviderAppSummary, type WorkspaceConnectionProviderLike, type WorkspaceConnectionProviderCatalogForApp, type WorkspaceConnectionProviderCatalogForAppItem, type WorkspaceConnectionProviderReadiness, type WorkspaceConnectionProviderReadinessStatus, type WorkspaceConnectionPublicCredentialRef, type WorkspaceConnectionStatus, workspaceConnectionIsAvailableToApp, } from "./store.js";
 export { resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, type ResolveWorkspaceConnectionCredentialForAppOptions, type ResolveWorkspaceConnectionCredentialsForAppOptions, type WorkspaceConnectionCredentialBackend, type WorkspaceConnectionCredentialProvenance, type WorkspaceConnectionCredentialResolution, type WorkspaceConnectionCredentialResolutionCheck, type WorkspaceConnectionCredentialResolutionStatus, type WorkspaceConnectionCredentialsResolution, } from "./credentials.js";
 export { registerWorkspaceConnectionLifecycleListener, type WorkspaceConnectionLifecycleEvent, type WorkspaceConnectionLifecycleListener, } from "./lifecycle.js";

package/dist/workspace-connections/index.js

@@ -1,3 +1,5 @@
-export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./store.js";
+export { credentialKeyAliases, credentialKeyMatches, lookupKeysForRef, } from "./credential-key-aliases.js";
+export { assertWorkspaceUserGroupIds, assertWorkspaceUserGroupManager, deleteWorkspaceUserGroup, ensureWorkspaceUserGroupsTable, listWorkspaceUserGroups, listWorkspaceUserGroupsForOrg, normalizeWorkspaceUserGroupIds, updateWorkspaceUserGroupMembers, upsertWorkspaceUserGroup, workspaceUserGroupsIncludeUser, } from "./groups.js";
+export { deleteWorkspaceConnection, ensureWorkspaceConnectionsTable, getWorkspaceConnectionAppAccess, getWorkspaceConnection, getWorkspaceConnectionGrant, listWorkspaceConnectionProviderCatalogForApp, listWorkspaceConnectionGrants, listWorkspaceConnections, listWorkspaceConnectionsForApp, markWorkspaceConnectionUsed, resolveWorkspaceConnectionForApp, revokeWorkspaceConnectionGrant, normalizeWorkspaceConnectionAllowedUsers, serializeWorkspaceConnectionGrant, serializeWorkspaceConnection, summarizeWorkspaceConnectionProviderForApp, summarizeWorkspaceConnectionProviderReadiness, upsertWorkspaceConnectionGrant, upsertWorkspaceConnection, workspaceConnectionIsAvailableToApp, } from "./store.js";
 export { resolveWorkspaceConnectionCredentialForApp, resolveWorkspaceConnectionCredentialsForApp, } from "./credentials.js";
 export { registerWorkspaceConnectionLifecycleListener, } from "./lifecycle.js";

package/dist/workspace-connections/store.d.ts

@@ -17,6 +17,10 @@ export interface WorkspaceConnection {
     scopes: string[];
     config: Record<string, unknown>;
     allowedApps: string[];
+    /** Empty means every member of the owning workspace. */
+    allowedUsers: string[];
+    /** Groups are unioned with allowedUsers; empty means no group restriction. */
+    allowedUserGroups?: string[];
     credentialRefs: WorkspaceConnectionCredentialRef[];
     ownerEmail: string;
     orgId: string | null;
@@ -72,6 +76,8 @@ export interface UpsertWorkspaceConnectionInput {
     scopes?: string[];
     config?: Record<string, unknown>;
     allowedApps?: string[];
+    allowedUsers?: string[];
+    allowedUserGroups?: string[];
     credentialRefs?: WorkspaceConnectionCredentialRef[];
     lastCheckedAt?: Date | number | string | null;
     lastError?: string | null;
@@ -122,6 +128,8 @@ export interface WorkspaceConnectionForAppSummary {
     grantScope: "all-apps" | "selected-apps";
     appAccess: WorkspaceConnectionAppAccess;
     allowedApps: string[];
+    allowedUsers: string[];
+    allowedUserGroups?: string[];
     credentialRefs: WorkspaceConnectionPublicCredentialRef[];
     lastUsedAt: string | null;
     lastCheckedAt: string | null;
@@ -224,6 +232,7 @@ export interface WorkspaceConnectionProviderCatalogForApp {
     };
 }
 export declare function ensureWorkspaceConnectionsTable(): Promise<void>;
+export declare function normalizeWorkspaceConnectionAllowedUsers(value: unknown): string[];
 export declare function serializeWorkspaceConnection(connection: WorkspaceConnection): SerializedWorkspaceConnection;
 export declare function serializeWorkspaceConnectionGrant(grant: WorkspaceConnectionGrant): SerializedWorkspaceConnectionGrant;
 export declare function getWorkspaceConnectionAppAccess(connection: Pick<SerializedWorkspaceConnection, "id" | "allowedApps" | "label">, appId: string, grants?: Pick<SerializedWorkspaceConnectionGrant, "id" | "connectionId" | "appId">[]): WorkspaceConnectionAppAccess;