@cleocode/core 2026.6.13 → 2026.6.14

package/dist/store/schema/cleo-global/services.d.ts

@@ -0,0 +1,493 @@
+/**
+ * Global-scope `cleo.db` — **universal service-credential vault** (3 tables).
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W1a ·
+ * task T11937). The **service** half of the universal vault — machine-wide OAuth /
+ * API credentials for third-party SERVICES (github, google, notion, figma, …) —
+ * cannibalized from onecli's `app_connections` / `app_configs` /
+ * `agent_app_connections`, DROPPING every org / project / billing column (the
+ * vault is machine-wide, exactly like the `accounts` LLM-credential pool — T11709,
+ * the established precedent this directory mirrors). Three tables:
+ *
+ *  - `service_connections` — one user-connected credential per `(provider, label)`:
+ *    the encrypted token blob + non-secret metadata (scopes, expiry, username).
+ *  - `service_configs` — per-provider BYOC (bring-your-own-client) OAuth app:
+ *    enabled flag + encrypted client secret + non-secret settings (client id,
+ *    scopes). One row per provider.
+ *  - `agent_service_grants` — per-agent access to a connection, plus the
+ *    `session_policy` (block / rate-limit / manual-approval) the trust gate
+ *    evaluates BEFORE any decrypt (T11937 AC4 — policy-before-decrypt).
+ *
+ * ## NOT the LLM credential pool (`accounts`) — do not confuse the two
+ *
+ * `accounts` (T11709) holds MODEL-API credentials (the pool the LLM runner picks
+ * from). These `service_*` tables hold SERVICE-API credentials (the things an
+ * agent's tools call: github, gmail, …). Different physical names, different
+ * consumers, different egress path. The crypto, ISO-timestamp typing, and
+ * accessor patterns are shared by design.
+ *
+ * ## Encrypted at rest (global KDF — reuse, no new crypto · T11710)
+ *
+ * `credentials_enc` (the `{access_token, refresh_token}` JSON blob) and
+ * `client_secret_enc` (the BYOC client secret) are `encryptGlobal()` ciphertext
+ * (packages/core/src/crypto/credentials.ts), NEVER plaintext. They keep the
+ * versioned `0x01 + 12B IV + 16B authTag` framing and decrypt via the project-
+ * INDEPENDENT KDF `HMAC-SHA256(machine-key || globalSalt, id)` with
+ * `id = service:${provider}:${label}` — so a service credential decrypts
+ * consistently for the machine regardless of the reading project's cwd.
+ *
+ * ## E10 typing (per docs/migration/sqlite-schema-canonical.md)
+ *
+ * TEXT ISO-8601 timestamps (`*_at`, GLOB-checked in the migration); named enums
+ * ({@link SERVICE_CONNECTION_STATUSES}); typed booleans (`enabled`); JSON-as-TEXT
+ * (`scopes`, `metadata`, `settings`, `session_policy`). The consolidated
+ * schema-parity gate (T11364) re-derives the CHECK set from THIS metadata, so the
+ * forward migration's CHECKs must match it exactly.
+ *
+ * @task T11937
+ * @epic T11765
+ * @saga T10409
+ * @see ../../../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (T11710)
+ * @see ./accounts.ts — `accounts` (the SIBLING LLM-credential-pool table, T11709)
+ * @see ../../service-connections-accessor.ts — the store CRUD + sealed-handle egress
+ * @see ../../service-trust-gate.ts — policy-before-decrypt grant evaluation
+ * @see ../../../../migrations/drizzle-cleo-global — the forward migration
+ */
+/**
+ * Legal `service_connections.status` values — the lifecycle of a connection.
+ *
+ * - `active` — usable; the token is (or can be refreshed to) valid.
+ * - `expired` — the access token (and refresh, if any) has lapsed; needs re-auth.
+ * - `revoked` — the user (or provider) revoked the grant; never usable again.
+ *
+ * @task T11937
+ */
+export declare const SERVICE_CONNECTION_STATUSES: readonly ["active", "expired", "revoked"];
+/** TypeScript union derived from {@link SERVICE_CONNECTION_STATUSES}. */
+export type ServiceConnectionStatus = (typeof SERVICE_CONNECTION_STATUSES)[number];
+/**
+ * `service_connections` — one user-connected service credential per `(provider, label)`.
+ *
+ * `credentials_enc` is the `encryptGlobal()` ciphertext of the
+ * `{access_token, refresh_token}` JSON blob (NEVER plaintext). `scopes` is the
+ * JSON-serialized granted scope list; `metadata` is non-secret JSON (e.g. the
+ * connected `username`/`email`) safe to display. The `(provider, label)` pair is
+ * unique. The OAuth build/exchange/refresh that POPULATES `credentials_enc` is
+ * T11939 — this table is the clean seam it writes into.
+ *
+ * @task T11937
+ */
+export declare const serviceConnections: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "service_connections";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        provider: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string enum";
+            data: "active" | "expired" | "revoked";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["active", "expired", "revoked"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        credentialsEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        scopes: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        metadata: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        connectedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_connections";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/** Row type for `service_connections` SELECT queries. */
+export type ServiceConnectionRow = typeof serviceConnections.$inferSelect;
+/** Row type for `service_connections` INSERT/UPSERT operations. */
+export type NewServiceConnectionRow = typeof serviceConnections.$inferInsert;
+/**
+ * `service_configs` — per-provider BYOC (bring-your-own-client) OAuth app config.
+ *
+ * When a user brings their own OAuth client (rather than using CLEO's first-party
+ * app), the client id + non-secret OAuth settings live in `settings` (JSON) and
+ * the client SECRET lives encrypted in `client_secret_enc`. One row per provider
+ * (`UNIQUE(provider)`). `enabled` toggles whether the BYOC config is used. This
+ * is the clean seam the OAuth flow (T11939) reads to prefer a user client over
+ * the registry default.
+ *
+ * @task T11937
+ */
+export declare const serviceConfigs: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "service_configs";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        provider: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        enabled: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        clientSecretEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        settings: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "service_configs";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/** Row type for `service_configs` SELECT queries. */
+export type ServiceConfigRow = typeof serviceConfigs.$inferSelect;
+/** Row type for `service_configs` INSERT/UPSERT operations. */
+export type NewServiceConfigRow = typeof serviceConfigs.$inferInsert;
+/**
+ * `agent_service_grants` — per-agent access to a service connection + policy.
+ *
+ * A grant authorizes one `agent_id` to use one `service_connection_id`, carrying
+ * the `session_policy` JSON (block / rate-limit / manual-approval) the trust gate
+ * (T11937 AC4) evaluates BEFORE any `decryptGlobal`. ABSENCE of a grant denies;
+ * a `block` policy denies; only a passing policy lets the store decrypt. The
+ * composite `(agent_id, service_connection_id)` is the primary key.
+ *
+ * `service_connection_id` references `service_connections(id)` — both tables live
+ * in the SAME global `cleo.db` file (Pattern A), so the FK is in-file and
+ * enforceable. The FK is declared natively (intra-domain, single global file —
+ * mirrors the agent-registry FK convention).
+ *
+ * @task T11937
+ */
+export declare const agentServiceGrants: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "agent_service_grants";
+    schema: undefined;
+    columns: {
+        agentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "agent_service_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        serviceConnectionId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "agent_service_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        sessionPolicy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "agent_service_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "agent_service_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "agent_service_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/** Row type for `agent_service_grants` SELECT queries. */
+export type AgentServiceGrantRow = typeof agentServiceGrants.$inferSelect;
+/** Row type for `agent_service_grants` INSERT/UPSERT operations. */
+export type NewAgentServiceGrantRow = typeof agentServiceGrants.$inferInsert;
+//# sourceMappingURL=services.d.ts.map

package/dist/store/schema/cleo-global/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,2CAA4C,CAAC;AAErF,yEAAyE;AACzE,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4C9B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC1E,mEAAmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8B1B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAClE,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B9B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC1E,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC"}