@flowdular/sdk 0.3.0 → 0.3.2

package/modules/approvals/src/domain/grant.ts

@@ -0,0 +1,69 @@
+import { APPROVAL_GRANT_INPUT_DIGEST_LENGTH } from '@flowdular/sdk/kernel';
+import { APPROVAL_LIMITS } from './capability.ts';
+
+/**
+ * How long after the approving decision the grant an approved request yields
+ * still verifies. The token is derived from the row and the key on every read,
+ * so the window is measured from `resolvedAt`, not from the read.
+ */
+export const APPROVAL_GRANT_TTL_MS = 60 * 60 * 1_000;
+
+const SUBJECT_PREFIX = 'capability:';
+const CAPABILITY_ID = /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/;
+const INPUT_DIGEST = new RegExp(
+	`^[a-f0-9]{${APPROVAL_GRANT_INPUT_DIGEST_LENGTH}}$`,
+);
+/* Prefix, id, one separator and the digest have to fit the subjectRef bound. */
+export const APPROVAL_GRANT_CAPABILITY_ID_LENGTH =
+	APPROVAL_LIMITS.subjectRef -
+	SUBJECT_PREFIX.length -
+	1 -
+	APPROVAL_GRANT_INPUT_DIGEST_LENGTH;
+
+/** The capability and the exact input an approval is asked for. */
+export interface CapabilitySubject {
+	readonly capabilityId: string;
+	/** `approvalInputDigest` of the invocation input, as the runner computes it. */
+	readonly inputDigest: string;
+}
+
+/**
+ * A `subjectRef` of the form `capability:<capabilityId>:<inputDigest>`. A
+ * request opened with it yields, once approved, a signed grant for exactly
+ * that capability and that input.
+ */
+export function encodeCapabilitySubjectRef(subject: CapabilitySubject): string {
+	if (
+		!CAPABILITY_ID.test(subject.capabilityId) ||
+		subject.capabilityId.length > APPROVAL_GRANT_CAPABILITY_ID_LENGTH
+	) {
+		throw new RangeError(
+			`capabilityId must be a lowercase dot-separated identifier of at most ${APPROVAL_GRANT_CAPABILITY_ID_LENGTH} characters.`,
+		);
+	}
+	if (!INPUT_DIGEST.test(subject.inputDigest)) {
+		throw new RangeError(
+			`inputDigest must be ${APPROVAL_GRANT_INPUT_DIGEST_LENGTH} lowercase hex characters.`,
+		);
+	}
+	return `${SUBJECT_PREFIX}${subject.capabilityId}:${subject.inputDigest}`;
+}
+
+/** Null for a subject reference that names a record rather than a capability. */
+export function decodeCapabilitySubjectRef(
+	subjectRef: string,
+): CapabilitySubject | null {
+	if (!subjectRef.startsWith(SUBJECT_PREFIX)) return null;
+	const separator = subjectRef.lastIndexOf(':');
+	const capabilityId = subjectRef.slice(SUBJECT_PREFIX.length, separator);
+	const inputDigest = subjectRef.slice(separator + 1);
+	if (
+		separator <= SUBJECT_PREFIX.length ||
+		!CAPABILITY_ID.test(capabilityId) ||
+		capabilityId.length > APPROVAL_GRANT_CAPABILITY_ID_LENGTH ||
+		!INPUT_DIGEST.test(inputDigest)
+	) {
+		return null;
+	}
+	return { capabilityId, inputDigest };
+}

package/modules/approvals/src/domain/types.ts

@@ -76,6 +76,20 @@ export interface ApprovalDecision {
 	readonly decidedAt: number;
 }
 
+/** What the ledger records about a request beyond its decisions. */
+export const APPROVAL_AUDIT_ACTIONS = ['grant.issued'] as const;
+
+export type ApprovalAuditAction = (typeof APPROVAL_AUDIT_ACTIONS)[number];
+
+export interface ApprovalAuditEntry {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly requestId: string;
+	readonly action: ApprovalAuditAction;
+	readonly metadata: Readonly<Record<string, string | number>>;
+	readonly occurredAt: number;
+}
+
 /** What an erasure writes over the comment of a decision it keeps. */
 export const ERASED_DECISION_COMMENT = '[erased]';
 

package/modules/approvals/src/index.ts

@@ -30,6 +30,13 @@ export type {
 	ApprovalsRequests,
 	OpenApprovalInput,
 } from './domain/capability.ts';
+export {
+	APPROVAL_GRANT_CAPABILITY_ID_LENGTH,
+	APPROVAL_GRANT_TTL_MS,
+	decodeCapabilitySubjectRef,
+	encodeCapabilitySubjectRef,
+} from './domain/grant.ts';
+export type { CapabilitySubject } from './domain/grant.ts';
 
 export {
 	APPROVAL_DECISIONS,
@@ -38,6 +45,8 @@ export {
 	isTerminalApprovalStatus,
 } from './domain/types.ts';
 export type {
+	ApprovalAuditAction,
+	ApprovalAuditEntry,
 	ApprovalDecision,
 	ApprovalDecisionKind,
 	ApprovalMember,

package/modules/approvals/src/platform.ts

@@ -1,3 +1,4 @@
+import { approvalGrantKeyringFromEnvironment } from '@flowdular/sdk/kernel';
 import type {
 	PlatformServerComposition,
 	PlatformServerContext,
@@ -96,6 +97,9 @@ export function createServerComposition(
 			context.capabilities.get<NotificationPublisher>(
 				NOTIFICATIONS_PUBLISH_CAPABILITY,
 			),
+		/* Without FD_APPROVAL_GRANT_KEY an approved capability request yields no
+		   grant, and the runner and the harness keep refusing the capability. */
+		grants: approvalGrantKeyringFromEnvironment(context.environment),
 	});
 	/* The runtime opens its database leases lazily, so the capability is a
 	   forwarder rather than a resolved object: registration must not force a
@@ -106,6 +110,10 @@ export function createServerComposition(
 			open: async (input) => (await runtime.service()).capability().open(input),
 			get: async (tenantId, id) =>
 				(await runtime.service()).capability().get(tenantId, id),
+			grant: async (tenantId, id, subjectModule) =>
+				(await runtime.service())
+					.capability()
+					.grant(tenantId, id, subjectModule),
 			list: async (tenantId, filter) =>
 				(await runtime.service()).capability().list(tenantId, filter),
 			cancel: async (tenantId, id, actorAccountId) =>

package/modules/approvals/src/server/runtime.ts

@@ -7,6 +7,7 @@ import {
 	DATABASE_CAPABILITY_IDS,
 	DATABASE_DIALECT_IDS,
 } from '@flowdular/sdk/database';
+import type { ApprovalGrantKeyring } from '@flowdular/sdk/kernel';
 import type { JobRunner } from '@flowdular/sdk/server';
 import type { ApprovalMember } from '../domain/types.ts';
 import {
@@ -42,6 +43,8 @@ export interface ApprovalsRuntimeOptions {
 	readonly notifications?: NotificationPublisherResolver;
 	readonly callbacks?: ApprovalCallbackRegistry;
 	readonly repository?: ApprovalsRepository;
+	/** Signs the grant an approved capability request yields; absent means none. */
+	readonly grants?: ApprovalGrantKeyring | undefined;
 	readonly now?: () => number;
 }
 
@@ -122,6 +125,7 @@ export function createApprovalsRuntime(
 			...(options.notifications
 				? { notifications: options.notifications }
 				: {}),
+			...(options.grants ? { grants: options.grants } : {}),
 			...(options.now ? { now: options.now } : {}),
 		}));
 

package/modules/approvals/src/services/approvals-service.ts

@@ -1,12 +1,21 @@
 import { randomUUID } from 'node:crypto';
+import {
+	issueApprovalGrant,
+	type ApprovalGrantKeyring,
+} from '@flowdular/sdk/kernel';
 import {
 	APPROVAL_LIMITS,
 	type ApprovalRequestFilter,
 	type ApprovalsRequests,
 	type OpenApprovalInput,
 } from '../domain/capability.ts';
+import {
+	APPROVAL_GRANT_TTL_MS,
+	decodeCapabilitySubjectRef,
+} from '../domain/grant.ts';
 import {
 	APPROVAL_STATUSES,
+	type ApprovalAuditEntry,
 	type ApprovalDecideOutcome,
 	type ApprovalDecision,
 	type ApprovalListPage,
@@ -61,6 +70,8 @@ export interface ApprovalsServiceOptions {
 	readonly defaultExpiryDays: (tenantId: string) => number | Promise<number>;
 	readonly notifications?: NotificationPublisherResolver;
 	readonly callbacks?: ApprovalCallbackRegistry;
+	/** Signs the grant an approved capability request yields; absent means none is issued. */
+	readonly grants?: ApprovalGrantKeyring | undefined;
 	readonly now?: () => number;
 }
 
@@ -71,6 +82,7 @@ export class ApprovalsService {
 	readonly #defaultExpiryDays: ApprovalsServiceOptions['defaultExpiryDays'];
 	readonly #notifications: NotificationPublisherResolver | undefined;
 	readonly #callbacks: ApprovalCallbackRegistry;
+	readonly #grants: ApprovalGrantKeyring | undefined;
 	readonly #now: () => number;
 
 	constructor(options: ApprovalsServiceOptions) {
@@ -80,6 +92,7 @@ export class ApprovalsService {
 		this.#defaultExpiryDays = options.defaultExpiryDays;
 		this.#notifications = options.notifications;
 		this.#callbacks = options.callbacks ?? createApprovalCallbackRegistry();
+		this.#grants = options.grants;
 		this.#now = options.now ?? Date.now;
 	}
 
@@ -186,6 +199,48 @@ export class ApprovalsService {
 		);
 	}
 
+	/**
+	 * The grant an approved capability request yields, derived from the row and
+	 * the current key on every read: the same claims sign to the same token
+	 * under the same key, and a rotated key signs a fresh one that verifies the
+	 * same. Nothing is issued for any other state, or once the window closed.
+	 */
+	grantFor(request: ApprovalRequest): string | undefined {
+		if (!this.#grants || request.status !== 'approved') return undefined;
+		if (request.resolvedAt === null) return undefined;
+		const subject = decodeCapabilitySubjectRef(request.subjectRef);
+		if (!subject) return undefined;
+		const expiresAt = request.resolvedAt + APPROVAL_GRANT_TTL_MS;
+		if (expiresAt <= this.#now()) return undefined;
+		return issueApprovalGrant(this.#grants, {
+			tenantId: request.tenantId,
+			capabilityId: subject.capabilityId,
+			inputDigest: subject.inputDigest,
+			requestId: request.id,
+			issuedAt: request.resolvedAt,
+			expiresAt,
+			nonce: request.id,
+		}).token;
+	}
+
+	/* The token reaches only the module that asked the question: a holder of
+	   the capability naming another module's request is answered null. */
+	async grant(
+		tenantId: string,
+		id: string,
+		subjectModule: string,
+	): Promise<string | null> {
+		const module = bounded(
+			subjectModule,
+			'subjectModule',
+			1,
+			APPROVAL_LIMITS.subjectModule,
+		);
+		const request = await this.get(tenantId, id);
+		if (!request || request.subjectModule !== module) return null;
+		return this.grantFor(request) ?? null;
+	}
+
 	async detail(
 		tenantId: string,
 		id: string,
@@ -458,6 +513,8 @@ export class ApprovalsService {
 		return {
 			open: (input) => this.open(input),
 			get: (tenantId, id) => this.get(tenantId, id),
+			grant: (tenantId, id, subjectModule) =>
+				this.grant(tenantId, id, subjectModule),
 			list: (tenantId, filter) => this.list(tenantId, filter),
 			cancel: async (tenantId, id, actorAccountId) =>
 				(await this.cancel(tenantId, id, actorAccountId)).request,
@@ -476,6 +533,28 @@ export class ApprovalsService {
 		return request;
 	}
 
+	/* The moment a capability request is approved is the moment its grant can
+	   be read, so that is what the ledger records, under the deciding
+	   transaction, with what the grant will say and which key signs it. */
+	#grantIssued(resolved: ApprovalRequest): ApprovalAuditEntry | null {
+		if (!this.#grants || resolved.status !== 'approved') return null;
+		const subject = decodeCapabilitySubjectRef(resolved.subjectRef);
+		if (!subject || resolved.resolvedAt === null) return null;
+		return {
+			id: randomUUID(),
+			tenantId: resolved.tenantId,
+			requestId: resolved.id,
+			action: 'grant.issued',
+			metadata: {
+				capabilityId: subject.capabilityId,
+				inputDigest: subject.inputDigest,
+				keyId: this.#grants.keyId,
+				expiresAt: resolved.resolvedAt + APPROVAL_GRANT_TTL_MS,
+			},
+			occurredAt: resolved.resolvedAt,
+		};
+	}
+
 	/* Only a member who may read the request is told its state; every caller
 	   settles readability before this runs. */
 	#assertPending(request: ApprovalRequest): void {
@@ -512,6 +591,7 @@ export class ApprovalsService {
 			},
 			resolve,
 			resolvedAt: decidedAt,
+			audit: (resolved) => this.#grantIssued(resolved),
 		});
 		if (result.outcome === 'not-found') {
 			throw new ApprovalsServiceError(

package/modules/approvals/src/services/database-repository.ts

@@ -8,6 +8,8 @@ import type {
 import { integer, runDatabaseMigrations } from '@flowdular/sdk/database';
 import { keysetWhere } from '@flowdular/sdk/server';
 import type {
+	ApprovalAuditAction,
+	ApprovalAuditEntry,
 	ApprovalDecision,
 	ApprovalDecisionKind,
 	ApprovalListPage,
@@ -55,6 +57,15 @@ interface RequestRow {
 	created_at: number | bigint | string;
 }
 
+interface AuditRow {
+	id: string;
+	tenant_id: string;
+	request_id: string;
+	action: ApprovalAuditAction;
+	metadata_json: string;
+	occurred_at: number | bigint | string;
+}
+
 interface DecisionRow {
 	id: string;
 	tenant_id: string;
@@ -125,6 +136,13 @@ const SQL = {
 	resolveRequest: `UPDATE approvals_requests
 	 SET status = $1, resolved_at = $2
 	 WHERE tenant_id = $3 AND id = $4 AND status = 'pending'`,
+	insertAudit: `INSERT INTO approvals_audit
+	 (id, tenant_id, request_id, action, metadata_json, occurred_at)
+	 VALUES ($1, $2, $3, $4, $5, $6)`,
+	listAudit: `SELECT id, tenant_id, request_id, action, metadata_json, occurred_at
+	 FROM approvals_audit
+	 WHERE tenant_id = $1 AND request_id = $2
+	 ORDER BY occurred_at, id`,
 	/* The one cross-tenant read. It returns routing columns only; the request
 	   is read again under the tenant the routing row named before it expires. */
 	dueExpiries: `SELECT tenant_id, id, expires_at, status FROM approvals_requests
@@ -156,6 +174,8 @@ const SQL = {
 	 WHERE tenant_id = $1 AND request_id = ANY($2::text[])`,
 	deleteDecisionsOf: `DELETE FROM approvals_decisions
 	 WHERE tenant_id = $1 AND request_id = ANY($2::text[])`,
+	deleteAuditOf: `DELETE FROM approvals_audit
+	 WHERE tenant_id = $1 AND request_id = ANY($2::text[])`,
 	deleteRequests: `DELETE FROM approvals_requests
 	 WHERE tenant_id = $1 AND id = ANY($2::text[])`,
 	/* PostgreSQL takes no LIMIT on an UPDATE, so the batch is chosen by the
@@ -266,6 +286,17 @@ function requestFrom(row: RequestRow): ApprovalRequest {
 	};
 }
 
+function auditFrom(row: AuditRow): ApprovalAuditEntry {
+	return {
+		id: row.id,
+		tenantId: row.tenant_id,
+		requestId: row.request_id,
+		action: row.action,
+		metadata: JSON.parse(row.metadata_json) as ApprovalAuditEntry['metadata'],
+		occurredAt: integer(row.occurred_at, 'occurredAt'),
+	};
+}
+
 function decisionFrom(row: DecisionRow): ApprovalDecision {
 	return {
 		id: row.id,
@@ -530,13 +561,25 @@ export class DatabaseApprovalsRepository implements ApprovalsRepository {
 					input.tenantId,
 					input.requestId,
 				]);
+				const resolved = {
+					...request,
+					status: terminal,
+					resolvedAt: input.resolvedAt,
+				};
+				const audit = input.audit?.(resolved);
+				if (audit) {
+					await this.#exec(transaction, SQL.insertAudit, [
+						audit.id,
+						input.tenantId,
+						input.requestId,
+						audit.action,
+						JSON.stringify(audit.metadata),
+						audit.occurredAt,
+					]);
+				}
 				return {
 					outcome: 'recorded',
-					request: {
-						...request,
-						status: terminal,
-						resolvedAt: input.resolvedAt,
-					},
+					request: resolved,
 					decisions,
 					resolved: true,
 				} as const;
@@ -545,6 +588,18 @@ export class DatabaseApprovalsRepository implements ApprovalsRepository {
 		);
 	}
 
+	async listAudit(
+		tenantId: string,
+		requestId: string,
+	): Promise<readonly ApprovalAuditEntry[]> {
+		return (
+			await this.#read<AuditRow>(tenantId, {
+				text: SQL.listAudit,
+				parameters: [tenantId, requestId],
+			})
+		).map(auditFrom);
+	}
+
 	async listDueExpiries(
 		now: number,
 		limit: number,
@@ -655,7 +710,11 @@ export class DatabaseApprovalsRepository implements ApprovalsRepository {
 	): Promise<number> {
 		if (rows.length === 0) return 0;
 		const ids = rows.map((row) => row.id);
-		for (const statement of [SQL.deleteEligibleOf, SQL.deleteDecisionsOf]) {
+		for (const statement of [
+			SQL.deleteEligibleOf,
+			SQL.deleteDecisionsOf,
+			SQL.deleteAuditOf,
+		]) {
 			await this.#exec(transaction, statement, [tenantId, ids]);
 		}
 		await this.#exec(transaction, SQL.deleteRequests, [tenantId, ids]);

package/modules/approvals/src/services/migration.ts

@@ -139,6 +139,29 @@ CREATE INDEX IF NOT EXISTS approvals_requests_created_idx
   ON approvals_requests (tenant_id, created_at, id);
 `;
 
+/* Mirrors migrations/0005_approvals_grant_audit.up.sql byte for byte. */
+export const APPROVALS_MIGRATION_005_GRANT_AUDIT = `-- The grant an approved request yields is derived from the row and the key on
+-- every read, so nothing about the token itself is stored. What is stored is
+-- the fact of its issuance: one row per resolved request whose subject names
+-- a capability, with the capability, the input digest, the key that signs and
+-- the moment the grant stops verifying, written in the deciding transaction.
+CREATE TABLE IF NOT EXISTS approvals_audit (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  metadata_json TEXT NOT NULL,
+  occurred_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS approvals_audit_request_idx
+  ON approvals_audit (tenant_id, request_id, occurred_at, id);
+ALTER TABLE approvals_audit ENABLE ROW LEVEL SECURITY;
+ALTER TABLE approvals_audit FORCE ROW LEVEL SECURITY;
+CREATE POLICY approvals_audit_tenant_policy ON approvals_audit
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+`;
+
 export const databaseMigrations: readonly DatabaseMigration[] = [
 	{
 		id: '0001_approvals_core',
@@ -219,4 +242,15 @@ export const databaseMigrations: readonly DatabaseMigration[] = [
 				() => database.schema.hasIndex('approvals_requests_created_idx'),
 			]),
 	},
+	{
+		id: '0005_approvals_grant_audit',
+		sql: { postgresql: APPROVALS_MIGRATION_005_GRANT_AUDIT },
+		inspectExisting: (database) =>
+			postgresTenantTableState(
+				database,
+				'approvals_audit',
+				'approvals_audit_tenant_policy',
+				[() => database.schema.hasIndex('approvals_audit_request_idx')],
+			),
+	},
 ];

package/modules/approvals/src/services/repository.ts

@@ -1,4 +1,5 @@
 import type {
+	ApprovalAuditEntry,
 	ApprovalDecision,
 	ApprovalListPage,
 	ApprovalRequest,
@@ -37,6 +38,8 @@ export interface DecideApprovalInput {
 		decisions: readonly ApprovalDecision[],
 	) => TerminalApprovalStatus | null;
 	readonly resolvedAt: number;
+	/** Written in the same transaction when the request resolves; null writes nothing. */
+	readonly audit?: (request: ApprovalRequest) => ApprovalAuditEntry | null;
 }
 
 export type DecideApprovalResult =
@@ -101,6 +104,11 @@ export interface ApprovalsRepository {
 	/** Pending requests this account is in the eligibility snapshot of. */
 	countDecidable(tenantId: string, accountId: string): Promise<number>;
 	decide(input: DecideApprovalInput): Promise<DecideApprovalResult>;
+	/** The issuance ledger of one request, oldest first. */
+	listAudit(
+		tenantId: string,
+		requestId: string,
+	): Promise<readonly ApprovalAuditEntry[]>;
 	/** Cross-tenant, routing columns only, on the read-only background lease. */
 	listDueExpiries(
 		now: number,

package/modules/audit/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/audit/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 provides:

package/modules/auth/module.json

@@ -3,7 +3,7 @@
 	"schemaVersion": 1,
 	"id": "auth.core",
 	"package": "@flowdular/module-auth",
-	"version": "0.13.10",
+	"version": "0.13.11",
 	"profile": "full",
 	"capabilities": ["api", "database", "client", "translations", "cli"],
 	"platform": {
@@ -12,7 +12,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		}
 	],
 	"tenancy": "required",

package/modules/auth/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-auth",
-	"version": "0.13.10",
+	"version": "0.13.11",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",

package/modules/auth/spec/module.yaml

@@ -1,6 +1,6 @@
 schemaVersion: 2
 id: auth.core
-specVersion: 0.13.10
+specVersion: 0.13.11
 status: approved
 name: Authentication Core
 description: Provides tenant-aware accounts, password authentication, sessions, scopes, tenant roles, API tokens for machine clients, the module settings store, the auth audit trail, security headers, authentication screens, and server authorization middleware.
@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
 tenancy: required
 locales:
   - en

package/modules/auth/src/middleware/authentication.ts

@@ -70,7 +70,11 @@ export function endpointIdentityFromContext(
 ): EndpointIdentity | null {
 	const principal = principalFromContext(context);
 	return principal
-		? { subjectId: principal.accountId, permissions: new Set(principal.scopes) }
+		? {
+				subjectId: principal.accountId,
+				tenantId: principal.tenantId,
+				permissions: new Set(principal.scopes),
+			}
 		: null;
 }
 

package/modules/auth/src/services/auth-service.ts

@@ -385,6 +385,8 @@ export const AUDIT_ACTIONS = Object.freeze({
 	roleDeleted: 'auth.role.deleted',
 	settingsUpdated: 'settings.updated',
 	settingsFlagChanged: 'settings.flag.changed',
+	moduleActivated: 'system.module.activated',
+	moduleDeactivated: 'system.module.deactivated',
 });
 
 export const AUDIT_ACTION_LIST = Object.freeze(Object.values(AUDIT_ACTIONS));
@@ -886,6 +888,13 @@ export class AuthService {
 		);
 	}
 
+	/** How many members hold the owner role, counted the same way for the same screen. */
+	countTenantOwners(tenantId: string): Promise<number> {
+		return this.#repository.countTenantOwners(
+			this.#identifier(tenantId, 'tenantId'),
+		);
+	}
+
 	/**
 	 * The identity bindings this workspace's own providers assert about its
 	 * members, one bounded page per call. A binding names the account, the
@@ -2912,6 +2921,23 @@ export class AuthService {
 		);
 	}
 
+	/** The one audit row a committed per-workspace module activation change owes. */
+	async recordModuleActivation(
+		actor: AuthActor,
+		change: { readonly moduleId: string; readonly active: boolean },
+	): Promise<void> {
+		await this.#audit(
+			actor.tenantId,
+			this.#actorOf(actor),
+			change.active
+				? AUDIT_ACTIONS.moduleActivated
+				: AUDIT_ACTIONS.moduleDeactivated,
+			'module',
+			change.moduleId,
+			{ active: change.active },
+		);
+	}
+
 	async queryAudit(query: AuditQuery): Promise<AuditActorPage> {
 		const limit = Math.min(
 			Math.max(1, Math.trunc(query.limit)),

package/modules/auth/src/services/database-repository.ts

@@ -939,6 +939,15 @@ export class DatabaseAuthRepository implements AuthRepository {
 		return rows[0] ? integer(rows[0].total, 'total') : 0;
 	}
 
+	async countTenantOwners(tenantId: string): Promise<number> {
+		const rows = await this.#query<CountRow>(tenantId, {
+			text: `SELECT count(*) AS total FROM auth_memberships
+			       WHERE tenant_id = $1 AND role = 'owner'`,
+			parameters: [tenantId],
+		});
+		return rows[0] ? integer(rows[0].total, 'total') : 0;
+	}
+
 	async findTenantMember(
 		tenantId: string,
 		accountId: string,

package/modules/auth/src/services/repository.ts

@@ -363,6 +363,8 @@ export interface AuthRepository {
 	): Promise<TenantMemberSortedPage>;
 	/** How many memberships the workspace holds, an index range over 0030. */
 	countTenantMembers(tenantId: string): Promise<number>;
+	/** How many of those memberships hold the owner role, whatever their status. */
+	countTenantOwners(tenantId: string): Promise<number>;
 	/** One member, for a caller that needs a single account rather than the roll. */
 	findTenantMember(
 		tenantId: string,

package/modules/automations/module.json

@@ -13,7 +13,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/automations/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: agents.core

package/modules/connectors/migrations/0003_connectors_rotation_inventory.down.sql

@@ -0,0 +1,2 @@
+REVOKE SELECT (tenant_id, credential_key_id) ON connectors_instances FROM coreloom_background;
+DROP POLICY IF EXISTS connectors_instances_background_policy ON connectors_instances;