@flowdular/sdk 0.2.4 → 0.3.0

package/modules/access/src/services/review.ts

@@ -0,0 +1,178 @@
+import {
+	ACCESS_LIMITS,
+	type AccessReview,
+	type AccessReviewMember,
+	type AccessReviewProvider,
+	type AccessReviewRole,
+	type AccessReviewSection,
+	type AccessReviewToken,
+} from '../domain/types.ts';
+import type {
+	AccessDirectory,
+	DirectoryMember,
+	DirectoryRole,
+} from './directory.ts';
+
+/**
+ * The scopes of the role a membership is assigned, by role id and by role key.
+ * The key is the fallback: a membership written before roles became rows keeps
+ * the role string and no id, and a review that ignored that would report every
+ * scope of those members as an extra grant.
+ */
+function roleScopeIndex(
+	roles: readonly DirectoryRole[],
+): (member: DirectoryMember) => ReadonlySet<string> {
+	const byId = new Map<string, ReadonlySet<string>>();
+	const byKey = new Map<string, ReadonlySet<string>>();
+	for (const role of roles) {
+		const scopes: ReadonlySet<string> = new Set(role.scopes);
+		byId.set(role.id, scopes);
+		byKey.set(role.key, scopes);
+	}
+	const none: ReadonlySet<string> = new Set();
+	return (member) =>
+		(member.roleId === null ? undefined : byId.get(member.roleId)) ??
+		byKey.get(member.role) ??
+		none;
+}
+
+function reviewMember(
+	member: DirectoryMember,
+	granted: ReadonlySet<string>,
+): AccessReviewMember {
+	return {
+		accountId: member.accountId,
+		email: member.email,
+		displayName: member.displayName,
+		role: member.role,
+		roleId: member.roleId,
+		accountStatus: member.status,
+		membershipStatus: member.membershipStatus,
+		scopeCount: member.scopes.length,
+		/* The scope universe is the declared permissions of the installed
+		   modules, so this stays a handful of entries even for a member somebody
+		   granted everything. */
+		extraScopes: member.scopes.filter((scope) => !granted.has(scope)).sort(),
+	};
+}
+
+/**
+ * The review rows of one page of memberships. The row shape and the extra-grant
+ * rule are the review's, so a file of the review carries exactly what the screen
+ * shows; only how many members are read at a time differs.
+ */
+export function reviewMembers(
+	members: readonly DirectoryMember[],
+	roles: readonly DirectoryRole[],
+): readonly AccessReviewMember[] {
+	const scopesOf = roleScopeIndex(roles);
+	return members.map((member) => reviewMember(member, scopesOf(member)));
+}
+
+/**
+ * Who holds what in one workspace, read live from auth.core. Every field is
+ * copied across by name, so nothing the directory happens to carry beyond the
+ * declared shape reaches a response. Time is O(members plus roles plus tokens
+ * plus providers); the counts are exact even where a listing is capped.
+ */
+export async function buildReview(
+	directory: AccessDirectory,
+	tenantId: string,
+	now: number,
+): Promise<AccessReview> {
+	const [members, roles, tokens, providers] = await Promise.all([
+		directory.members(tenantId),
+		directory.roles(tenantId),
+		directory.tokens(tenantId),
+		directory.providers(tenantId),
+	]);
+
+	const scopesOf = roleScopeIndex(roles);
+	const holders = new Map<string, number>();
+	const reviewed: AccessReviewMember[] = [];
+	let activeMembers = 0;
+	let extraScopeGrants = 0;
+	for (const member of members) {
+		const entry = reviewMember(member, scopesOf(member));
+		extraScopeGrants += entry.extraScopes.length;
+		if (member.membershipStatus === 'active' && member.status === 'active') {
+			activeMembers += 1;
+		}
+		const roleKey = member.roleId ?? member.role;
+		holders.set(roleKey, (holders.get(roleKey) ?? 0) + 1);
+		if (reviewed.length < ACCESS_LIMITS.members) reviewed.push(entry);
+	}
+
+	const reviewedRoles: AccessReviewRole[] = roles
+		.slice(0, ACCESS_LIMITS.roles)
+		.map((role) => ({
+			id: role.id,
+			key: role.key,
+			name: role.name,
+			builtin: role.builtin,
+			scopes: role.scopes,
+			holders: (holders.get(role.id) ?? 0) + (holders.get(role.key) ?? 0),
+		}));
+
+	const labels = new Map(
+		members.map((member) => [member.accountId, member.email]),
+	);
+	/* A review answers who holds access now, so a revoked or expired token is
+	   not access any more. Both events stay visible in the activity report. */
+	const usable = tokens.filter(
+		(token) =>
+			token.revokedAt === null &&
+			(token.expiresAt === null || token.expiresAt > now),
+	);
+	const reviewedTokens: AccessReviewToken[] = usable
+		.slice(0, ACCESS_LIMITS.tokens)
+		.map((token) => ({
+			id: token.id,
+			label: token.label,
+			prefix: token.prefix,
+			accountId: token.accountId,
+			accountLabel: labels.get(token.accountId) ?? null,
+			scopes: token.scopes,
+			createdAt: token.createdAt,
+			expiresAt: token.expiresAt,
+			lastUsedAt: token.lastUsedAt,
+		}));
+
+	const reviewedProviders: AccessReviewProvider[] = providers
+		.slice(0, ACCESS_LIMITS.providers)
+		.map((provider) => ({
+			id: provider.id,
+			key: provider.key,
+			label: provider.label,
+			issuer: provider.issuer,
+			status: provider.status,
+			scope: provider.scope,
+			jitEnabled: provider.jitEnabled,
+			jitRole: provider.jitRole,
+			allowedDomains: provider.allowedDomains,
+			updatedAt: provider.updatedAt,
+		}));
+
+	const capped: AccessReviewSection[] = [];
+	if (reviewed.length < members.length) capped.push('members');
+	if (reviewedRoles.length < roles.length) capped.push('roles');
+	if (reviewedTokens.length < usable.length) capped.push('tokens');
+	if (reviewedProviders.length < providers.length) capped.push('providers');
+
+	return {
+		generatedAt: now,
+		members: reviewed,
+		roles: reviewedRoles,
+		tokens: reviewedTokens,
+		providers: reviewedProviders,
+		counts: {
+			members: members.length,
+			activeMembers,
+			roles: roles.length,
+			extraScopeGrants,
+			tokens: usable.length,
+			providers: providers.length,
+		},
+		capped,
+	};
+}

package/modules/access/translations/en.json

@@ -0,0 +1,155 @@
+{
+	"module.name": "Access review",
+	"navigation.review": "Access review",
+	"navigation.reviewDescription": "Who holds what in this workspace right now.",
+	"navigation.activity": "Access activity",
+	"navigation.activityDescription": "What changed and what administrators did, between two dates.",
+	"navigation.attestations": "Attestations",
+	"navigation.attestationsDescription": "Recorded reviews of this workspace's access.",
+	"common.administration": "Administration",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.loading": "Loading…",
+	"common.accessDenied": "Access denied",
+	"common.cancel": "Cancel",
+	"common.never": "Never",
+	"common.noMatchTitle": "Nothing matches",
+	"common.noMatchHint": "Change the search to widen the list.",
+	"status.active": "Active",
+	"status.disabled": "Disabled",
+	"category.membership": "Membership",
+	"category.role": "Role",
+	"category.scope": "Scopes",
+	"category.token": "API token",
+	"category.provider": "Provider",
+	"category.settings": "Settings",
+	"category.security": "Security",
+	"review.title": "Access review",
+	"review.description": "Who holds what in this workspace, read from the authentication core at the moment you asked.",
+	"review.denied": "You need the access review permission to see who holds what.",
+	"review.tabsLabel": "Review sections",
+	"review.tab.members": "Members ({count})",
+	"review.tab.roles": "Roles ({count})",
+	"review.tab.tokens": "API tokens ({count})",
+	"review.tab.providers": "Providers ({count})",
+	"review.kpi.members": "Members",
+	"review.kpi.membersNote": "{count} active in this workspace",
+	"review.kpi.extraScopes": "Scopes beyond a role",
+	"review.kpi.extraScopesNote": "Grants held on top of the assigned role",
+	"review.kpi.tokens": "Usable API tokens",
+	"review.kpi.tokensNote": "Neither revoked nor expired",
+	"review.kpi.providers": "Identity providers",
+	"review.kpi.providersNote": "Ways into this workspace besides a password",
+	"review.note": "Read live from the authentication core. Nothing on this screen is stored by the access module.",
+	"review.cappedNote": "This list stops at {count} rows. The counts above still cover the whole workspace.",
+	"review.column.member": "Member",
+	"review.column.role": "Role",
+	"review.column.status": "Status",
+	"review.column.scopes": "Scopes",
+	"review.column.extraScopes": "Beyond the role",
+	"review.column.roleName": "Role",
+	"review.column.roleKind": "Kind",
+	"review.column.holders": "Members",
+	"review.column.roleScopes": "Scopes",
+	"review.column.tokenLabel": "Token",
+	"review.column.tokenHolder": "Holder",
+	"review.column.tokenScopes": "Scopes",
+	"review.column.expires": "Expires",
+	"review.column.lastUsed": "Last used",
+	"review.column.provider": "Provider",
+	"review.column.issuer": "Issuer",
+	"review.column.joining": "Joining",
+	"review.noExtraScopes": "None",
+	"review.noExpiry": "No expiry",
+	"review.builtin": "Built in",
+	"review.custom": "Custom",
+	"review.jitOn": "Creates {role} for {domains}",
+	"review.jitOff": "Existing members only",
+	"review.anyDomain": "any domain",
+	"review.search.label": "Search members",
+	"review.search.placeholder": "Name or e-mail",
+	"review.members.title": "Members",
+	"review.members.count": "{count} listed",
+	"review.members.caption": "Members of this workspace",
+	"review.members.emptyTitle": "No members",
+	"review.members.emptyHint": "A workspace always keeps one owner, so this list is normally never empty.",
+	"review.roles.title": "Roles",
+	"review.roles.count": "{count} listed",
+	"review.roles.caption": "Roles of this workspace",
+	"review.roles.emptyTitle": "No roles",
+	"review.roles.emptyHint": "The built-in owner and member roles appear here once the workspace is set up.",
+	"review.tokens.title": "API tokens",
+	"review.tokens.count": "{count} listed",
+	"review.tokens.caption": "Usable API tokens of this workspace",
+	"review.tokens.emptyTitle": "No usable tokens",
+	"review.tokens.emptyHint": "Tokens are issued from the security screen and appear here until they are revoked or expire.",
+	"review.tokens.note": "Revoked and expired tokens are not access any more, so they are left out. Their issue and revocation stay in the activity report.",
+	"review.providers.title": "Identity providers",
+	"review.providers.count": "{count} listed",
+	"review.providers.caption": "Identity providers of this workspace",
+	"review.providers.emptyTitle": "No identity providers",
+	"review.providers.emptyHint": "Members sign in with a password until a provider is configured.",
+	"review.providers.note": "Which member is linked to which provider is not readable yet, so this lists the providers and the rules by which people join through them.",
+	"review.error.load": "The review could not be loaded.",
+	"activity.title": "Access activity",
+	"activity.description": "What changed between two dates, and what administrators did, read from the platform audit trail.",
+	"activity.denied": "You need the access review permission to see this activity.",
+	"activity.tabsLabel": "Activity reports",
+	"activity.tab.diff": "Changes",
+	"activity.tab.activity": "Administrative activity",
+	"activity.diff.title": "Changes in this period",
+	"activity.activity.title": "Administrative activity",
+	"activity.count": "{count} loaded",
+	"activity.caption": "Recorded changes of this workspace",
+	"activity.range": "Period",
+	"activity.from": "From",
+	"activity.to": "To",
+	"activity.reversed": "The end of the period is before its start.",
+	"activity.more": "Load more",
+	"activity.note": "The trail is read in pages, newest first. Legal holds and erasures live in the audit module's own trail and are not part of this report yet.",
+	"activity.emptyHint": "Widen the period, or change the report, to see more.",
+	"activity.diff.emptyTitle": "Nothing changed in this period",
+	"activity.activity.emptyTitle": "No administrative activity in this period",
+	"activity.column.time": "When",
+	"activity.column.category": "Kind",
+	"activity.column.action": "Action",
+	"activity.column.actor": "Who",
+	"activity.column.subject": "Subject",
+	"activity.error.load": "The report could not be loaded.",
+	"attestations.title": "Attestations",
+	"attestations.description": "Every recorded review of this workspace's access, with the counts as they stood.",
+	"attestations.denied": "You need the access review permission to see the attestations.",
+	"attestations.table.title": "Recorded attestations",
+	"attestations.count": "{count} loaded",
+	"attestations.caption": "Attestations of this workspace",
+	"attestations.emptyTitle": "No attestation yet",
+	"attestations.emptyHint": "Record one from the review screen once you have been through it.",
+	"attestations.more": "Load more",
+	"attestations.note": "An attestation is never edited or removed. A later review is recorded beside it.",
+	"attestations.noNote": "No note",
+	"attestations.membersValue": "{total} ({active} active)",
+	"attestations.column.period": "Period",
+	"attestations.column.reviewer": "Reviewer",
+	"attestations.column.members": "Members",
+	"attestations.column.extraScopes": "Beyond a role",
+	"attestations.column.tokens": "Tokens",
+	"attestations.column.note": "Note",
+	"attestations.error.load": "The attestations could not be loaded.",
+	"attest.action": "Record attestation",
+	"attest.title": "Record an attestation",
+	"attest.subtitle": "The counts are taken from the review as it stands now.",
+	"attest.from": "Period from",
+	"attest.to": "Period to",
+	"attest.note": "Note",
+	"attest.noteHelp": "What the next reviewer should know. At most 2000 characters.",
+	"attest.record": "Record",
+	"attest.recording": "Recording…",
+	"attest.evidence": "Recorded as: {members} members, {scopes} scopes beyond a role, {tokens} usable tokens.",
+	"attest.error.record": "The attestation could not be recorded.",
+	"error.request": "The access review request failed.",
+	"error.code.INVALID_INPUT": "The period is not a pair of calendar dates.",
+	"error.code.RANGE_REVERSED": "The end of the period is before its start.",
+	"error.code.RANGE_TOO_LONG": "A period covers at most 366 days.",
+	"error.code.CURSOR_INVALID": "That page is no longer valid. Load the report again.",
+	"error.code.CSRF_REJECTED": "Your session proof was refused. Reload the page and try again."
+}

package/modules/access/translations/pl.json

@@ -0,0 +1,155 @@
+{
+	"module.name": "Przegląd dostępu",
+	"navigation.review": "Przegląd dostępu",
+	"navigation.reviewDescription": "Kto ma jaki dostęp w tej przestrzeni w tej chwili.",
+	"navigation.activity": "Aktywność dostępu",
+	"navigation.activityDescription": "Co się zmieniło i co zrobili administratorzy między dwiema datami.",
+	"navigation.attestations": "Poświadczenia",
+	"navigation.attestationsDescription": "Zapisane przeglądy dostępu w tej przestrzeni.",
+	"common.administration": "Administracja",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.loading": "Wczytywanie…",
+	"common.accessDenied": "Brak dostępu",
+	"common.cancel": "Anuluj",
+	"common.never": "Nigdy",
+	"common.noMatchTitle": "Brak dopasowań",
+	"common.noMatchHint": "Zmień wyszukiwanie, aby poszerzyć listę.",
+	"status.active": "Aktywny",
+	"status.disabled": "Wyłączony",
+	"category.membership": "Członkostwo",
+	"category.role": "Rola",
+	"category.scope": "Uprawnienia",
+	"category.token": "Token API",
+	"category.provider": "Dostawca",
+	"category.settings": "Ustawienia",
+	"category.security": "Bezpieczeństwo",
+	"review.title": "Przegląd dostępu",
+	"review.description": "Kto ma jaki dostęp w tej przestrzeni, odczytane z modułu uwierzytelniania w chwili zapytania.",
+	"review.denied": "Potrzebujesz uprawnienia do przeglądu dostępu, aby zobaczyć, kto co posiada.",
+	"review.tabsLabel": "Sekcje przeglądu",
+	"review.tab.members": "Osoby ({count})",
+	"review.tab.roles": "Role ({count})",
+	"review.tab.tokens": "Tokeny API ({count})",
+	"review.tab.providers": "Dostawcy ({count})",
+	"review.kpi.members": "Osoby",
+	"review.kpi.membersNote": "Aktywnych w tej przestrzeni: {count}",
+	"review.kpi.extraScopes": "Uprawnienia ponad rolę",
+	"review.kpi.extraScopesNote": "Nadania poza zakresem przypisanej roli",
+	"review.kpi.tokens": "Używalne tokeny API",
+	"review.kpi.tokensNote": "Ani odwołane, ani wygasłe",
+	"review.kpi.providers": "Dostawcy tożsamości",
+	"review.kpi.providersNote": "Drogi do przestrzeni inne niż hasło",
+	"review.note": "Dane czytane na żywo z modułu uwierzytelniania. Moduł dostępu nie przechowuje niczego z tego ekranu.",
+	"review.cappedNote": "Ta lista kończy się na {count} wierszach. Liczniki powyżej obejmują całą przestrzeń.",
+	"review.column.member": "Osoba",
+	"review.column.role": "Rola",
+	"review.column.status": "Status",
+	"review.column.scopes": "Uprawnienia",
+	"review.column.extraScopes": "Ponad rolę",
+	"review.column.roleName": "Rola",
+	"review.column.roleKind": "Rodzaj",
+	"review.column.holders": "Osoby",
+	"review.column.roleScopes": "Uprawnienia",
+	"review.column.tokenLabel": "Token",
+	"review.column.tokenHolder": "Właściciel",
+	"review.column.tokenScopes": "Uprawnienia",
+	"review.column.expires": "Wygasa",
+	"review.column.lastUsed": "Ostatnio użyty",
+	"review.column.provider": "Dostawca",
+	"review.column.issuer": "Wystawca",
+	"review.column.joining": "Dołączanie",
+	"review.noExtraScopes": "Brak",
+	"review.noExpiry": "Bez terminu",
+	"review.builtin": "Wbudowana",
+	"review.custom": "Własna",
+	"review.jitOn": "Tworzy rolę {role} dla {domains}",
+	"review.jitOff": "Tylko istniejące osoby",
+	"review.anyDomain": "dowolnej domeny",
+	"review.search.label": "Szukaj osób",
+	"review.search.placeholder": "Nazwa lub e-mail",
+	"review.members.title": "Osoby",
+	"review.members.count": "Na liście: {count}",
+	"review.members.caption": "Osoby w tej przestrzeni",
+	"review.members.emptyTitle": "Brak osób",
+	"review.members.emptyHint": "Przestrzeń zawsze zachowuje jednego właściciela, więc ta lista zwykle nie bywa pusta.",
+	"review.roles.title": "Role",
+	"review.roles.count": "Na liście: {count}",
+	"review.roles.caption": "Role w tej przestrzeni",
+	"review.roles.emptyTitle": "Brak ról",
+	"review.roles.emptyHint": "Wbudowane role właściciela i członka pojawią się tu po skonfigurowaniu przestrzeni.",
+	"review.tokens.title": "Tokeny API",
+	"review.tokens.count": "Na liście: {count}",
+	"review.tokens.caption": "Używalne tokeny API tej przestrzeni",
+	"review.tokens.emptyTitle": "Brak używalnych tokenów",
+	"review.tokens.emptyHint": "Tokeny wydaje się na ekranie bezpieczeństwa i widać je tu do odwołania lub wygaśnięcia.",
+	"review.tokens.note": "Odwołane i wygasłe tokeny nie dają już dostępu, więc ich tu nie ma. Ich wydanie i odwołanie zostaje w raporcie aktywności.",
+	"review.providers.title": "Dostawcy tożsamości",
+	"review.providers.count": "Na liście: {count}",
+	"review.providers.caption": "Dostawcy tożsamości tej przestrzeni",
+	"review.providers.emptyTitle": "Brak dostawców tożsamości",
+	"review.providers.emptyHint": "Do czasu skonfigurowania dostawcy osoby logują się hasłem.",
+	"review.providers.note": "Powiązania konkretnych osób z dostawcami nie da się jeszcze odczytać, więc lista pokazuje dostawców i zasady dołączania przez nich.",
+	"review.error.load": "Nie udało się wczytać przeglądu.",
+	"activity.title": "Aktywność dostępu",
+	"activity.description": "Co zmieniło się między dwiema datami i co zrobili administratorzy, na podstawie dziennika platformy.",
+	"activity.denied": "Potrzebujesz uprawnienia do przeglądu dostępu, aby zobaczyć tę aktywność.",
+	"activity.tabsLabel": "Raporty aktywności",
+	"activity.tab.diff": "Zmiany",
+	"activity.tab.activity": "Działania administracyjne",
+	"activity.diff.title": "Zmiany w tym okresie",
+	"activity.activity.title": "Działania administracyjne",
+	"activity.count": "Wczytano: {count}",
+	"activity.caption": "Zapisane zmiany w tej przestrzeni",
+	"activity.range": "Okres",
+	"activity.from": "Od",
+	"activity.to": "Do",
+	"activity.reversed": "Koniec okresu wypada przed jego początkiem.",
+	"activity.more": "Wczytaj więcej",
+	"activity.note": "Dziennik czytany jest stronami, od najnowszych. Blokady prawne i usunięcia danych są w dzienniku modułu audytu i nie wchodzą jeszcze do tego raportu.",
+	"activity.emptyHint": "Poszerz okres lub zmień raport, aby zobaczyć więcej.",
+	"activity.diff.emptyTitle": "W tym okresie nic się nie zmieniło",
+	"activity.activity.emptyTitle": "Brak działań administracyjnych w tym okresie",
+	"activity.column.time": "Kiedy",
+	"activity.column.category": "Rodzaj",
+	"activity.column.action": "Działanie",
+	"activity.column.actor": "Kto",
+	"activity.column.subject": "Czego dotyczy",
+	"activity.error.load": "Nie udało się wczytać raportu.",
+	"attestations.title": "Poświadczenia",
+	"attestations.description": "Każdy zapisany przegląd dostępu w tej przestrzeni wraz z licznikami z tamtej chwili.",
+	"attestations.denied": "Potrzebujesz uprawnienia do przeglądu dostępu, aby zobaczyć poświadczenia.",
+	"attestations.table.title": "Zapisane poświadczenia",
+	"attestations.count": "Wczytano: {count}",
+	"attestations.caption": "Poświadczenia tej przestrzeni",
+	"attestations.emptyTitle": "Brak poświadczeń",
+	"attestations.emptyHint": "Zapisz je na ekranie przeglądu po jego wykonaniu.",
+	"attestations.more": "Wczytaj więcej",
+	"attestations.note": "Poświadczenia nie są edytowane ani usuwane. Kolejny przegląd zapisuje się obok.",
+	"attestations.noNote": "Bez notatki",
+	"attestations.membersValue": "{total} (aktywnych: {active})",
+	"attestations.column.period": "Okres",
+	"attestations.column.reviewer": "Osoba przeglądająca",
+	"attestations.column.members": "Osoby",
+	"attestations.column.extraScopes": "Ponad rolę",
+	"attestations.column.tokens": "Tokeny",
+	"attestations.column.note": "Notatka",
+	"attestations.error.load": "Nie udało się wczytać poświadczeń.",
+	"attest.action": "Zapisz poświadczenie",
+	"attest.title": "Zapisz poświadczenie",
+	"attest.subtitle": "Liczniki pochodzą z przeglądu w obecnym kształcie.",
+	"attest.from": "Okres od",
+	"attest.to": "Okres do",
+	"attest.note": "Notatka",
+	"attest.noteHelp": "Co powinna wiedzieć kolejna osoba przeglądająca. Najwyżej 2000 znaków.",
+	"attest.record": "Zapisz",
+	"attest.recording": "Zapisywanie…",
+	"attest.evidence": "Zostanie zapisane: osoby {members}, uprawnienia ponad rolę {scopes}, używalne tokeny {tokens}.",
+	"attest.error.record": "Nie udało się zapisać poświadczenia.",
+	"error.request": "Żądanie przeglądu dostępu nie powiodło się.",
+	"error.code.INVALID_INPUT": "Okres nie jest parą dat kalendarzowych.",
+	"error.code.RANGE_REVERSED": "Koniec okresu wypada przed jego początkiem.",
+	"error.code.RANGE_TOO_LONG": "Okres obejmuje najwyżej 366 dni.",
+	"error.code.CURSOR_INVALID": "Ta strona wyników jest już nieaktualna. Wczytaj raport ponownie.",
+	"error.code.CSRF_REJECTED": "Potwierdzenie sesji zostało odrzucone. Odśwież stronę i spróbuj ponownie."
+}

package/modules/agents/migrations/0022_credential_rotation_inventory.down.sql

@@ -0,0 +1,2 @@
+REVOKE SELECT (tenant_id, credential_key_id)
+  ON agent_provider_connections FROM coreloom_background;

package/modules/agents/migrations/0022_credential_rotation_inventory.up.sql

@@ -0,0 +1,7 @@
+-- The rotation command has to find the connections still sealed with a retired
+-- key before it knows whose they are. It is granted the routing columns and the
+-- key id alone: the nonce, the tag and the ciphertext stay unreadable on this
+-- connection, and every row it re-seals is read again under the tenant that row
+-- named.
+GRANT SELECT (tenant_id, credential_key_id)
+  ON agent_provider_connections TO coreloom_background;

package/modules/agents/migrations/0023_agents_retention_indexes.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS agent_runs_tenant_requested_idx;
+DROP INDEX IF EXISTS agent_runs_tenant_settled_idx;

package/modules/agents/migrations/0023_agents_retention_indexes.up.sql

@@ -0,0 +1,9 @@
+-- The retention sweep of agents.core.runs asks one workspace for its oldest
+-- settled runs, and a subject erasure asks it for the runs one account
+-- requested. Both are bounded batches, so both need a range scan rather than a
+-- pass over the workspace's runs; the export walks the order
+-- agent_runs_tenant_queued_idx already carries and needs no index of its own.
+CREATE INDEX IF NOT EXISTS agent_runs_tenant_settled_idx
+  ON agent_runs (tenant_id, completed_at);
+CREATE INDEX IF NOT EXISTS agent_runs_tenant_requested_idx
+  ON agent_runs (tenant_id, requested_by, id);

package/modules/agents/migrations/0024_agent_meter_refusals.down.sql

@@ -0,0 +1,3 @@
+-- The rows are standing refusals, not history: dropping the table only makes
+-- the next refusal of each workspace and meter record its audit event again.
+DROP TABLE IF EXISTS agent_meter_refusals;

package/modules/agents/migrations/0024_agent_meter_refusals.up.sql

@@ -0,0 +1,22 @@
+-- A meter refusal stands until the workspace's month turns or its limit is
+-- raised, so recording it on every refused enqueue wrote the same fact to the
+-- hash-chained trail as fast as a caller could retry. This row is the claim
+-- that the refusal has already been recorded: the first refusal of a workspace,
+-- a meter and a month takes it and writes the audit event, and every refusal
+-- behind it is answered without touching the trail.
+--
+-- One row per workspace and meter at a time. The claim removes the rows of
+-- earlier months for that workspace and meter in the same transaction, so the
+-- table is bounded by the meters agents.core declares rather than by time.
+CREATE TABLE IF NOT EXISTS agent_meter_refusals (
+  tenant_id TEXT NOT NULL,
+  meter TEXT NOT NULL,
+  period TEXT NOT NULL,
+  first_refused_at BIGINT NOT NULL,
+  PRIMARY KEY (tenant_id, meter, period)
+);
+ALTER TABLE agent_meter_refusals ENABLE ROW LEVEL SECURITY;
+ALTER TABLE agent_meter_refusals FORCE ROW LEVEL SECURITY;
+CREATE POLICY agent_meter_refusals_tenant_policy ON agent_meter_refusals
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/agents/migrations/0025_agent_list_indexes.down.sql

@@ -0,0 +1,3 @@
+DROP INDEX IF EXISTS agent_runs_tenant_queue_order_idx;
+DROP INDEX IF EXISTS agent_definitions_tenant_updated_idx;
+DROP INDEX IF EXISTS agent_definitions_tenant_name_key_idx;

package/modules/agents/migrations/0025_agent_list_indexes.up.sql

@@ -0,0 +1,11 @@
+-- agents.definitions.list pages by lower(name) or updated_at, each followed by
+-- id, and agent_definitions_tenant_name_idx orders by the raw name, so neither
+-- paged read had an index carrying its order. agents.runs.list orders queued_at
+-- and id in one direction, while agent_runs_tenant_queued_idx carries queued_at
+-- descending beside an ascending id, so the planner sorted every page.
+CREATE INDEX IF NOT EXISTS agent_definitions_tenant_name_key_idx
+  ON agent_definitions (tenant_id, lower(name), id);
+CREATE INDEX IF NOT EXISTS agent_definitions_tenant_updated_idx
+  ON agent_definitions (tenant_id, updated_at, id);
+CREATE INDEX IF NOT EXISTS agent_runs_tenant_queue_order_idx
+  ON agent_runs (tenant_id, queued_at, id);

package/modules/agents/module.json

@@ -3,7 +3,7 @@
 	"schemaVersion": 1,
 	"id": "agents.core",
 	"package": "@flowdular/module-agents",
-	"version": "0.9.1",
+	"version": "0.12.9",
 	"profile": "full",
 	"capabilities": [
 		"api",
@@ -20,11 +20,37 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "0.5.0"
+			"range": "^0.7.0"
 		},
 		{
 			"id": "auth.core",
-			"range": "0.10.0"
+			"range": "^0.13.0"
+		},
+		{
+			"id": "metering.core",
+			"range": "^0.1.0"
+		},
+		{
+			"id": "reports.core",
+			"range": "^0.1.0"
+		}
+	],
+	"provides": [
+		"agents.run-queue",
+		"agents.run-execution.v2",
+		"agents.actions.v1"
+	],
+	"requires": [
+		{
+			"id": "notifications.publish.v1",
+			"optional": true
+		},
+		{
+			"id": "metering.meters.v1"
+		},
+		{
+			"id": "reports.v1",
+			"optional": true
 		}
 	],
 	"tenancy": "required",
@@ -34,5 +60,5 @@
 		"catalog": "src/cli/commands.json",
 		"entry": "src/cli/index.ts"
 	},
-	"platformApi": "0.1.0"
+	"platformApi": "^0.1.0"
 }

package/modules/agents/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-agents",
-	"version": "0.9.1",
+	"version": "0.12.9",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",
@@ -21,6 +21,7 @@
 		"@flowdular/harness": "workspace:*",
 		"@flowdular/kernel": "workspace:*",
 		"@flowdular/module-auth": "workspace:*",
+		"@flowdular/module-reports": "workspace:*",
 		"@flowdular/server": "workspace:*",
 		"@flowdular/ui": "workspace:*",
 		"octane": "0.1.51",