@ganju/utils 0.0.15 → 0.0.17

package/dist/schema.js

@@ -10,6 +10,7 @@ const reservedToolName_1 = require("./reservedToolName");
 const slugifyTitle_1 = require("./slugifyTitle");
 const toolConfirmation_1 = require("./toolConfirmation");
 const channelCustomer_1 = require("./channelCustomer");
+const dataTypes_1 = require("./dataTypes");
 // A prompt title becomes a slash command; it must not collide with a command
 // the channel runner handles itself (e.g. `/link`).
 const PROMPT_TITLE = zod_1.z
@@ -427,6 +428,222 @@ const ARTIFACT_REMOVE_RESOURCE = zod_1.z.object({
     userId: zod_1.z.uuid(),
     organizationId: zod_1.z.uuid()
 });
+const DATA_DATABASE_GET = zod_1.z.object({
+    projectId: zod_1.z.uuid(),
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid()
+});
+// The name is what the owner types to delete it; it defaults to the
+// project's slug. `replaceDeleted` starts over while a deleted database is
+// still in its grace period, giving up the chance to restore it.
+const DATA_DATABASE_CREATE = DATA_DATABASE_GET.extend({
+    name: zod_1.z.string().trim().min(1).max(100).optional(),
+    replaceDeleted: zod_1.z.boolean().optional()
+});
+const DATA_DATABASE_DELETE = DATA_DATABASE_GET.extend({
+    confirmName: zod_1.z.string().min(1)
+});
+// The bodies and query strings of the Data API. Each one is what a client
+// sends; the route schemas below add the path's ids. The database object
+// checks every rule again (names, types, relations), so these describe the
+// shape and leave the meaning to it.
+const DATA_IDENTIFIER = zod_1.z.string().min(1).max(63);
+const DATA_DEFAULT_VALUE = zod_1.z.union([
+    zod_1.z.string(),
+    zod_1.z.number(),
+    zod_1.z.boolean(),
+    zod_1.z.null()
+]);
+const DATA_TEXT = (max) => zod_1.z.string().max(max).nullable().optional();
+const DATA_COLUMN_INPUT = zod_1.z.strictObject({
+    name: DATA_IDENTIFIER,
+    type: zod_1.z.enum(dataTypes_1.DATA_COLUMN_TYPES),
+    label: DATA_TEXT(dataTypes_1.DATA_MAX_LABEL),
+    description: DATA_TEXT(dataTypes_1.DATA_MAX_DESCRIPTION),
+    required: zod_1.z.boolean().optional(),
+    unique: zod_1.z.boolean().optional(),
+    filterable: zod_1.z.boolean().optional(),
+    searchable: zod_1.z.boolean().optional(),
+    personal: zod_1.z.boolean().optional(),
+    values: zod_1.z.array(zod_1.z.string().min(1)).max(dataTypes_1.DATA_MAX_ENUM_VALUES).optional(),
+    table: DATA_IDENTIFIER.optional(),
+    onDelete: zod_1.z.enum(dataTypes_1.DATA_ON_DELETE).optional(),
+    min: zod_1.z.number().nullable().optional(),
+    default: DATA_DEFAULT_VALUE.optional()
+});
+// The CLI's schema file holds a list of these.
+const DATA_TABLE_INPUT = zod_1.z.strictObject({
+    name: DATA_IDENTIFIER,
+    label: DATA_TEXT(dataTypes_1.DATA_MAX_LABEL),
+    description: DATA_TEXT(dataTypes_1.DATA_MAX_DESCRIPTION),
+    displayColumn: DATA_IDENTIFIER.nullable().optional(),
+    access: zod_1.z.enum(dataTypes_1.DATA_ACCESS_LEVELS).optional(),
+    customerScoped: zod_1.z.boolean().optional(),
+    history: zod_1.z.boolean().optional(),
+    columns: zod_1.z.array(DATA_COLUMN_INPUT).max(dataTypes_1.DATA_MAX_COLUMNS)
+});
+const DATA_TABLE_PATCH = DATA_TABLE_INPUT.omit({ columns: true }).partial();
+// A null puts the setting back to its default.
+const DATA_COLUMN_PATCH = DATA_COLUMN_INPUT.partial();
+const DATA_TABLE_DROP_BODY = zod_1.z.strictObject({ confirmName: zod_1.z.string().min(1) });
+const DATA_ROW_VALUES = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown());
+// A JSON value carried in a query string, e.g. `where={"status":"open"}`.
+const DATA_JSON_PARAM = zod_1.z.string().transform((text, ctx) => {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'This is JSON, e.g. {"status":"open"}'
+        });
+        return zod_1.z.NEVER;
+    }
+});
+// A comma-separated list in a query string: `sort=-created_at,name`.
+const DATA_LIST_PARAM = zod_1.z.string().transform(text => text
+    .split(',')
+    .map(item => item.trim())
+    .filter(Boolean));
+const DATA_ROW_LIST_QUERY = zod_1.z.strictObject({
+    where: DATA_JSON_PARAM.optional(),
+    sort: DATA_LIST_PARAM.optional(),
+    include: DATA_LIST_PARAM.optional(),
+    limit: zod_1.z.coerce.number().int().min(1).max(dataTypes_1.DATA_MAX_PAGE).optional(),
+    cursor: zod_1.z.string().max(2000).optional(),
+    q: zod_1.z.string().max(500).optional(),
+    timeZone: zod_1.z.string().max(64).optional()
+});
+const DATA_ROW_GET_QUERY = DATA_ROW_LIST_QUERY.pick({
+    include: true,
+    timeZone: true
+});
+const DATA_ROW_CREATE_BODY = zod_1.z.union([
+    zod_1.z.strictObject({ values: DATA_ROW_VALUES }),
+    zod_1.z.strictObject({
+        rows: zod_1.z.array(DATA_ROW_VALUES).min(1).max(dataTypes_1.DATA_MAX_INSERT_ROWS)
+    })
+]);
+const DATA_ROW_VERSION = zod_1.z.number().int().min(1);
+// `set` takes values, or relative changes such as { "stock": { "decrement": 2 } }.
+const DATA_ROW_UPDATE_BODY = zod_1.z.strictObject({
+    set: DATA_ROW_VALUES,
+    version: DATA_ROW_VERSION.optional()
+});
+const DATA_ROW_DELETE_BODY = zod_1.z.strictObject({
+    version: DATA_ROW_VERSION.optional()
+});
+const DATA_ROW_ID = zod_1.z.coerce.number().int().min(1);
+// Without `ids`, every row of the table.
+const DATA_DELETE_PREVIEW_BODY = zod_1.z.strictObject({
+    ids: zod_1.z.array(zod_1.z.number().int().min(1)).min(1).max(dataTypes_1.DATA_IMPACT_MAX_IDS).optional()
+});
+const DATA_WRITE_TARGET = {
+    table: DATA_IDENTIFIER,
+    id: zod_1.z
+        .union([
+        zod_1.z.number().int().min(1),
+        zod_1.z.strictObject({ $ref: zod_1.z.number().int().min(0) })
+    ])
+        .optional(),
+    where: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    expect: zod_1.z.number().int().min(0).optional(),
+    version: DATA_ROW_VERSION.optional()
+};
+// Applied together or not at all. A later step can use an earlier insert's
+// id as { "$ref": <step> }.
+const DATA_WRITE_OPERATION = zod_1.z.discriminatedUnion('op', [
+    zod_1.z.strictObject({
+        op: zod_1.z.literal('insert'),
+        table: DATA_IDENTIFIER,
+        values: DATA_ROW_VALUES.optional(),
+        rows: zod_1.z.array(DATA_ROW_VALUES).min(1).max(dataTypes_1.DATA_MAX_INSERT_ROWS).optional()
+    }),
+    zod_1.z.strictObject({
+        op: zod_1.z.literal('update'),
+        ...DATA_WRITE_TARGET,
+        set: DATA_ROW_VALUES
+    }),
+    zod_1.z.strictObject({ op: zod_1.z.literal('delete'), ...DATA_WRITE_TARGET })
+]);
+const DATA_WRITE_BODY = zod_1.z.strictObject({
+    operations: zod_1.z
+        .array(DATA_WRITE_OPERATION)
+        .min(1)
+        .max(dataTypes_1.DATA_MAX_WRITE_OPERATIONS)
+});
+const DATA_ROW_HISTORY_QUERY = zod_1.z.strictObject({
+    limit: zod_1.z.coerce.number().int().min(1).max(100).optional(),
+    cursor: zod_1.z.coerce.number().int().min(1).optional(),
+    timeZone: zod_1.z.string().max(64).optional()
+});
+// A time within the last 30 days, or a bookmark this API handed out (a drop,
+// a type change, or the restore to undo).
+const DATA_RESTORE_POINT_BODY = zod_1.z.union([
+    zod_1.z.strictObject({
+        timestamp: zod_1.z.union([zod_1.z.iso.datetime({ offset: true }), zod_1.z.number().int()])
+    }),
+    zod_1.z.strictObject({ bookmark: zod_1.z.string().min(1).max(200) })
+]);
+// The database's own settings. `timeZone` is an IANA zone (America/Bogota),
+// or null for UTC: datetimes come back in it for callers that send none.
+const DATA_DATABASE_PATCH = zod_1.z.strictObject({
+    timeZone: zod_1.z
+        .string()
+        .max(100)
+        .refine(zone => {
+        try {
+            new Intl.DateTimeFormat('en-US', { timeZone: zone });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }, 'Use an IANA time zone, such as America/Bogota.')
+        .nullable()
+});
+const DATA_EXPORT_BODY = zod_1.z.strictObject({
+    format: zod_1.z.enum(['jsonl', 'csv']).optional()
+});
+const DATA_EXPORT_QUERY = zod_1.z.strictObject({
+    exportId: zod_1.z.uuid().optional()
+});
+// Without `table`, the export's schema.json.
+const DATA_EXPORT_FILE_QUERY = zod_1.z.strictObject({
+    exportId: zod_1.z.uuid(),
+    table: DATA_IDENTIFIER.optional()
+});
+const DATA_CHANGE_LIST_QUERY = zod_1.z.strictObject({
+    limit: zod_1.z.coerce.number().int().min(1).max(100).optional(),
+    cursor: zod_1.z.uuid().optional()
+});
+// Named queries: a SELECT the owner writes once, with named parameters
+// (`:from`), checked to only read when it is saved.
+const DATA_QUERY_PARAM = zod_1.z.strictObject({
+    name: DATA_IDENTIFIER,
+    type: zod_1.z.enum(['text', 'integer', 'decimal', 'boolean', 'date', 'datetime']),
+    description: zod_1.z.string().max(300).nullish(),
+    required: zod_1.z.boolean().optional()
+});
+const DATA_QUERY_INPUT = zod_1.z.strictObject({
+    name: DATA_IDENTIFIER,
+    description: zod_1.z.string().max(300).nullish(),
+    sql: zod_1.z.string().min(1).max(10_000),
+    params: zod_1.z.array(DATA_QUERY_PARAM).max(20).optional(),
+    // Channel bots may run it from data-query.
+    assistant: zod_1.z.boolean().optional()
+});
+const DATA_QUERY_RUN_BODY = zod_1.z.strictObject({
+    params: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
+    limit: zod_1.z.number().int().min(1).max(500).optional(),
+    timeZone: zod_1.z.string().max(100).optional()
+});
+const DATA_TABLE_PARAMS = DATA_DATABASE_GET.extend({ table: DATA_IDENTIFIER });
+const DATA_COLUMN_PARAMS = DATA_TABLE_PARAMS.extend({
+    column: DATA_IDENTIFIER
+});
+const DATA_ROW_PARAMS = DATA_TABLE_PARAMS.extend({ id: DATA_ROW_ID });
+const DATA_QUERY_PATH_PARAMS = DATA_DATABASE_GET.extend({ name: DATA_IDENTIFIER });
 const ARTIFACT_UPLOAD_RESOURCE_FILE = zod_1.z.object({
     resourceId: zod_1.z.uuid(),
     projectId: zod_1.z.uuid(),
@@ -975,7 +1192,17 @@ const CUSTOM_CODE_TOOL = zod_1.z.object({
     description: zod_1.z.string().max(2000).optional(),
     inputSchema: SCHEMA_DEFINITION.default({ type: 'object', properties: {} }),
     outputSchema: SCHEMA_DEFINITION.optional(),
-    annotations: TOOL_ANNOTATIONS.optional()
+    annotations: TOOL_ANNOTATIONS.optional(),
+    // What this function may do through ctx.data. Absent means everything: it
+    // is the owner's code. Narrowing matters most for a function a channel bot
+    // calls after reading customer text, and the broker enforces it, since
+    // anything in the script can be edited.
+    data: zod_1.z
+        .strictObject({
+        access: zod_1.z.enum(['read', 'write']).optional(),
+        tables: zod_1.z.array(zod_1.z.string().min(1).max(63)).max(50).optional()
+    })
+        .optional()
 });
 // The manifest a `ganju deploy` (or the dashboard) uploads alongside a bundle.
 // Names must be unique within one script: apps/mcp registers them into a single
@@ -1201,6 +1428,15 @@ const CUSTOM_CODE_BROKER_SECRET = zod_1.z.object({
     // (they carry no id inside the script). See CREDENTIAL_PROVIDER_CUSTOM_CODE.
     name: zod_1.z.string().min(1).max(200)
 });
+// One ctx.data call. `call` is the token the dispatcher signed for the
+// function being run, which the script hands back: the broker reads the
+// function's name from it, never from the script, and applies that
+// function's `data` narrowing.
+const CUSTOM_CODE_BROKER_DATA = zod_1.z.object({
+    call: zod_1.z.string().min(1).max(4000),
+    op: zod_1.z.enum(['describe', 'query', 'write', 'run']),
+    args: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).default({})
+});
 const CUSTOM_CODE_BROKER_RESOURCE_SEARCH = zod_1.z.object({
     query: zod_1.z.string().min(1).max(2000),
     limit: zod_1.z.number().int().positive().max(20).default(5)
@@ -1505,6 +1741,36 @@ exports.Schema = {
     ARTIFACT_UPDATE_RESOURCE_VIEW,
     ARTIFACT_GET_RESOURCE,
     ARTIFACT_GET_RESOURCE_BY_ID,
+    DATA_DATABASE_GET,
+    DATA_DATABASE_CREATE,
+    DATA_DATABASE_DELETE,
+    DATA_COLUMN_INPUT,
+    DATA_TABLE_INPUT,
+    DATA_TABLE_PATCH,
+    DATA_COLUMN_PATCH,
+    DATA_TABLE_DROP_BODY,
+    DATA_ROW_LIST_QUERY,
+    DATA_ROW_GET_QUERY,
+    DATA_ROW_CREATE_BODY,
+    DATA_ROW_UPDATE_BODY,
+    DATA_ROW_DELETE_BODY,
+    DATA_DELETE_PREVIEW_BODY,
+    DATA_WRITE_OPERATION,
+    DATA_WRITE_BODY,
+    DATA_ROW_HISTORY_QUERY,
+    DATA_RESTORE_POINT_BODY,
+    DATA_EXPORT_BODY,
+    DATA_EXPORT_QUERY,
+    DATA_EXPORT_FILE_QUERY,
+    DATA_CHANGE_LIST_QUERY,
+    DATA_TABLE_PARAMS,
+    DATA_DATABASE_PATCH,
+    DATA_QUERY_PARAM,
+    DATA_QUERY_INPUT,
+    DATA_QUERY_RUN_BODY,
+    DATA_QUERY_PATH_PARAMS,
+    DATA_COLUMN_PARAMS,
+    DATA_ROW_PARAMS,
     ARTIFACT_REMOVE_RESOURCE,
     ARTIFACT_UPLOAD_RESOURCE_FILE,
     ARTIFACT_DOWNLOAD_RESOURCE_FILE,
@@ -1566,6 +1832,7 @@ exports.Schema = {
     CUSTOM_CODE_INVOKE_RESPONSE,
     CUSTOM_CODE_BROKER_CONNECTION,
     CUSTOM_CODE_BROKER_SECRET,
+    CUSTOM_CODE_BROKER_DATA,
     CUSTOM_CODE_BROKER_RESOURCE_SEARCH,
     CUSTOM_CODE_BROKER_RESOURCE_READ,
     CUSTOM_CODE_BROKER_RESOURCE_CREATE,

package/dist/sdkConstants.d.ts

@@ -9,6 +9,7 @@ export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = "/resources/list";
 export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = "/resources/create";
 export declare const CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = "/resources/delete";
 export declare const CUSTOM_CODE_BROKER_PATH_SEND_FILE = "/send-file";
+export declare const CUSTOM_CODE_BROKER_PATH_DATA = "/data";
 export declare const CUSTOM_CODE_BINDING_VERSION = "GANJU_SCRIPT_VERSION";
 export declare const CUSTOM_CODE_HEALTH_TOOL = "__ganju_health";
 export declare const CUSTOM_CODE_MAX_LOGS = 50;

package/dist/sdkConstants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdkConstants.d.ts","sourceRoot":"","sources":["../src/sdkConstants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,iBAAiB,CAAC;AAKzD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAChE,eAAO,MAAM,8BAA8B,YAAY,CAAC;AACxD,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,iCAAiC,eAAe,CAAC;AAY9D,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAOlE,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAKxD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,0BAA0B,OAAQ,CAAC"}
+{"version":3,"file":"sdkConstants.d.ts","sourceRoot":"","sources":["../src/sdkConstants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,iBAAiB,CAAC;AAKzD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,kCAAkC,gBAAgB,CAAC;AAChE,eAAO,MAAM,8BAA8B,YAAY,CAAC;AACxD,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,sCAAsC,oBAAoB,CAAC;AACxE,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,wCAAwC,sBAAsB,CAAC;AAC5E,eAAO,MAAM,iCAAiC,eAAe,CAAC;AAC9D,eAAO,MAAM,4BAA4B,UAAU,CAAC;AAYpD,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAOlE,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAKxD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,0BAA0B,OAAQ,CAAC"}

package/dist/sdkConstants.js

@@ -11,7 +11,7 @@
 // The rule for this file: nothing lands here unless the SDK reads it at runtime,
 // and it imports nothing.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CUSTOM_CODE_MAX_LOG_LENGTH = exports.CUSTOM_CODE_MAX_LOGS = exports.CUSTOM_CODE_HEALTH_TOOL = exports.CUSTOM_CODE_BINDING_VERSION = exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_READ = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_SEARCH = exports.CUSTOM_CODE_BROKER_PATH_SECRET = exports.CUSTOM_CODE_BROKER_PATH_CONNECTION = exports.CUSTOM_CODE_BROKER_ORIGIN = exports.CUSTOM_CODE_BINDING_BROKER = exports.CUSTOM_CODE_BINDING_TOKEN = void 0;
+exports.CUSTOM_CODE_MAX_LOG_LENGTH = exports.CUSTOM_CODE_MAX_LOGS = exports.CUSTOM_CODE_HEALTH_TOOL = exports.CUSTOM_CODE_BINDING_VERSION = exports.CUSTOM_CODE_BROKER_PATH_DATA = exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_READ = exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_SEARCH = exports.CUSTOM_CODE_BROKER_PATH_SECRET = exports.CUSTOM_CODE_BROKER_PATH_CONNECTION = exports.CUSTOM_CODE_BROKER_ORIGIN = exports.CUSTOM_CODE_BINDING_BROKER = exports.CUSTOM_CODE_BINDING_TOKEN = void 0;
 // Bindings injected into every user script at upload time. The token is a
 // secret_text binding rotated on each publish; the broker is a service binding.
 // Names are part of the SDK's contract with the script, so they can't be
@@ -30,6 +30,7 @@ exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_LIST = '/resources/list';
 exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE = '/resources/create';
 exports.CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE = '/resources/delete';
 exports.CUSTOM_CODE_BROKER_PATH_SEND_FILE = '/send-file';
+exports.CUSTOM_CODE_BROKER_PATH_DATA = '/data';
 // Injected at upload time and echoed back by the health probe below. Uploading a
 // script into the dispatch namespace is not read-your-writes: dispatching to the
 // name immediately afterwards can still reach the previous edition. Tool names

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ganju/utils",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "Shared constants, schemas and helpers for Ganju",
   "license": "Apache-2.0",
   "author": "MontoyaAndres <andresmontoyafcb@gmail.com>",
@@ -62,11 +62,26 @@
       "types": "./dist/sdkConstants.d.ts",
       "import": "./dist/sdkConstants.js",
       "require": "./dist/sdkConstants.js"
+    },
+    "./data": {
+      "types": "./dist/data.d.ts",
+      "import": "./dist/data.js",
+      "require": "./dist/data.js"
+    },
+    "./dataApi": {
+      "types": "./dist/dataApi.d.ts",
+      "import": "./dist/dataApi.js",
+      "require": "./dist/dataApi.js"
+    },
+    "./dataImport": {
+      "types": "./dist/dataImport.d.ts",
+      "import": "./dist/dataImport.js",
+      "require": "./dist/dataImport.js"
     }
   },
   "scripts": {
     "build": "tsc",
-    "test": "node --import ./test/resolveSourceImports.mjs --test --disable-warning=MODULE_TYPELESS_PACKAGE_JSON 'test/**/*.test.ts'",
+    "test": "TZ=UTC node --import ./test/resolveSourceImports.mjs --test --disable-warning=MODULE_TYPELESS_PACKAGE_JSON 'test/**/*.test.ts'",
     "prepublishOnly": "npm run build",
     "clean": "rm -rf dist && rm -rf node_modules"
   },

package/src/constants.ts

@@ -22,6 +22,7 @@ import {
   CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE,
   CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE,
   CUSTOM_CODE_BROKER_PATH_SEND_FILE,
+  CUSTOM_CODE_BROKER_PATH_DATA,
   CUSTOM_CODE_HEALTH_TOOL,
   CUSTOM_CODE_MAX_LOGS,
   CUSTOM_CODE_MAX_LOG_LENGTH
@@ -144,6 +145,11 @@ const OAUTH_TOKEN_URLS: Record<string, string> = {
 // MCP-proxy OAuth, in both apps/api and apps/mcp).
 const CREDENTIAL_REFRESH_BUFFER_MS = 60 * 1000;
 
+// A refresh the token endpoint rejects (4xx) without a reauth code still flags
+// the credential once its access token has been expired this long, so the
+// owner sees it as expired instead of every call failing behind "Connected".
+const CREDENTIAL_REFRESH_GIVE_UP_MS = 60 * 60 * 1000;
+
 const GOOGLE_CALENDAR_API_BASE = 'https://www.googleapis.com/calendar/v3';
 
 const GOOGLE_DRIVE_API_BASE = 'https://www.googleapis.com/drive/v3';
@@ -228,7 +234,18 @@ const ONE_DRIVE_TAB_LABELS: ReadonlyArray<{
   { value: ONE_DRIVE_TAB_DRIVES, label: ONE_DRIVE_TAB_LABEL_DRIVES }
 ];
 
-const REAUTH_ERROR_CODES = ['invalid_grant', 'invalid_token'];
+// Token-endpoint error codes that mean the stored refresh token is dead and
+// only a reconnect brings it back. `unauthorized_client` is Google's answer
+// when a token no longer belongs to the app it is refreshed with.
+const REAUTH_ERROR_CODES = [
+  'invalid_grant',
+  'invalid_token',
+  'unauthorized_client'
+];
+
+// Token-endpoint error codes that are about our own client id / secret, not
+// the user's token: a reconnect can't fix them, so they never flag one.
+const OAUTH_CLIENT_ERROR_CODES = ['invalid_client'];
 
 const RESOURCE_TYPE_TOOLTIP_MIN_WIDTH = 300;
 
@@ -992,10 +1009,14 @@ const RESOURCE_SEARCH_RRF_K = 60;
 // keeps its words.
 const RESOURCE_SEARCH_COMMON_TERM_DIVISOR = 10;
 const RESOURCE_SEARCH_COMMON_TERM_MIN = 5;
-// Second stage, on wherever the Worker has an AI binding: the top fused
-// candidates are re-scored by a cross-encoder, which reads query and chunk
-// together instead of comparing two independently computed vectors. One model
-// call per search; a failure falls back to the fused order.
+// Second stage: the top fused candidates re-scored by a cross-encoder, which
+// reads query and chunk together instead of comparing two independently
+// computed vectors. One model call per search; a failure falls back to the
+// fused order. Off by default: on the golden sets (Spanish and English) the
+// fused order matched or beat it on every set — 10 cases better, 5 worse — and
+// it added 0.5–0.9 s a search plus a ~6 s cold start. The search eval can
+// still turn it on per request to re-measure.
+const RESOURCE_SEARCH_RERANK_ENABLED = false;
 const RESOURCE_SEARCH_RERANK_CANDIDATES = 30;
 const RESOURCE_SEARCH_RERANK_MODEL = '@cf/baai/bge-reranker-base';
 // An identifier in the query (a code mixing letters and digits, a snake_case
@@ -1554,7 +1575,10 @@ const RESERVED_TOOL_NAME_PREFIXES = [
   'slack-',
   CALENDAR_TOOL_KEY_PREFIX,
   CALCOM_TOOL_KEY_PREFIX,
-  WEB_TOOL_KEY_PREFIX
+  WEB_TOOL_KEY_PREFIX,
+  // data-describe, data-query, data-write and data-admin, registered for a
+  // project with a database.
+  'data-'
 ];
 
 // The keys that don't belong to a prefixed group: the RAG core the channel
@@ -1834,6 +1858,10 @@ const MCP_AUTH_KINDS = [MCP_AUTH_KIND_JWT, MCP_AUTH_KIND_INTERNAL];
 const MCP_SESSION_HEADER = 'mcp-session-id';
 
 const MCP_INTERNAL_HEADER = 'x-ganju-internal-secret';
+// Sent with the internal secret by the search eval to measure the reranker:
+// `on` or `off` overrides RESOURCE_SEARCH_RERANK_ENABLED for that request.
+// Ignored on any other request.
+const MCP_EVAL_RERANK_HEADER = 'x-ganju-eval-rerank';
 const MCP_CHANNEL_ID_HEADER = 'x-ganju-channel-id';
 const MCP_CHANNEL_PLATFORM_HEADER = 'x-ganju-channel-platform';
 // The conversation a channel turn belongs to. The MCP worker files that turn's
@@ -1841,6 +1869,11 @@ const MCP_CHANNEL_PLATFORM_HEADER = 'x-ganju-channel-platform';
 // the chat it ran in.
 const MCP_CHANNEL_CONVERSATION_HEADER = 'x-ganju-channel-conversation-id';
 const MCP_CHANNEL_CLIENT_USER_AGENT = 'ganju-channel/0.0.1';
+// The participant a channel turn is for: customer-scoped tables fill and
+// filter their rows with it. Trusted only on the channel's own auth paths.
+const MCP_CHANNEL_PARTICIPANT_HEADER = 'x-ganju-channel-participant-id';
+// The zone the channel resolves dates in; the data tools answer in it.
+const MCP_CHANNEL_TIME_ZONE_HEADER = 'x-ganju-channel-time-zone';
 const JWKS_KV_KEY = 'jwks:v1';
 const JWKS_TTL_SECONDS = 600;
 
@@ -2127,6 +2160,40 @@ const PRICING_TOOL_CALL_PER_M_USD = 5;
 const PRICING_TOOL_CALL_HARD_CAP = 20_000_000;
 const PRICING_CUSTOM_DOMAIN_USD = 15;
 
+// Project data (one SQLite Durable Object per artifact). Cloudflare caps a
+// database at 10 GB; we stop writes that add data at 9 GB so there is room to
+// delete, archive and export.
+const DATA_MAX_DATABASE_BYTES = 9 * GB;
+const DATA_MAX_TABLES_PER_DATABASE = 50;
+const DATA_TRIGGER_RUN_HARD_CAP = 5_000_000;
+// A deleted database can be restored for this long before its storage is
+// freed.
+const DATA_DELETE_GRACE_DAYS = 7;
+const ARTIFACT_DATABASE_STATUS_CREATING = 'CREATING' as 'CREATING';
+const ARTIFACT_DATABASE_STATUS_READY = 'READY' as 'READY';
+const ARTIFACT_DATABASE_STATUS_FAILED = 'FAILED' as 'FAILED';
+const ARTIFACT_DATABASE_STATUS_DELETING = 'DELETING' as 'DELETING';
+// The hourly purge has claimed the row and is emptying the object; a restore
+// can no longer take it back.
+const ARTIFACT_DATABASE_STATUS_PURGING = 'PURGING' as 'PURGING';
+const ARTIFACT_DATABASE_STATUS_DELETED = 'DELETED' as 'DELETED';
+const ARTIFACT_DATABASE_STATUSES = [
+  ARTIFACT_DATABASE_STATUS_CREATING,
+  ARTIFACT_DATABASE_STATUS_READY,
+  ARTIFACT_DATABASE_STATUS_FAILED,
+  ARTIFACT_DATABASE_STATUS_DELETING,
+  ARTIFACT_DATABASE_STATUS_PURGING,
+  ARTIFACT_DATABASE_STATUS_DELETED
+];
+// A purge that claimed a row and never finished (the Worker died) is picked
+// up again after this long.
+const DATA_PURGE_STALE_MS = 60 * 60 * 1000;
+// Rows purged per hourly run: each is a call to its database object.
+const DATA_PURGE_BATCH = 20;
+// last_read_at / last_write_at move at most this often, so they aren't a
+// Postgres write per query.
+const DATA_ACTIVITY_THROTTLE_MS = 60 * 60 * 1000;
+
 interface PlanLimits {
   // null on any field means "no hard limit" for that plan.
   maxProjects: number | null;
@@ -2192,6 +2259,16 @@ interface PlanLimits {
   autoSyncIntervals: ReadonlyArray<
     typeof RESOURCE_SYNC_INTERVAL_DAILY | typeof RESOURCE_SYNC_INTERVAL_WEEKLY
   >;
+  // Whether a project may create a database (tables and rows). Paid-only: the
+  // rows live in a Durable Object we pay storage and rows for. An org that
+  // downgrades keeps its databases, read-only.
+  canUseData: boolean;
+  // Writes that add data stop here, under Cloudflare's 10 GB per database, so
+  // the owner meets a readable "database full" rather than SQLITE_FULL.
+  maxDataBytes: number | null;
+  maxDataTablesPerDatabase: number | null;
+  // Abuse backstop on data trigger runs a month. `null` = no backstop.
+  triggerRunHardCap: number | null;
 }
 
 const PLAN_LIMITS: Record<
@@ -2232,7 +2309,11 @@ const PLAN_LIMITS: Record<
     toolCallHardCap: 10_000,
     includedMessages: 100,
     includedEmbeddedBytes: 5 * MB,
-    autoSyncIntervals: []
+    autoSyncIntervals: [],
+    canUseData: false,
+    maxDataBytes: null,
+    maxDataTablesPerDatabase: null,
+    triggerRunHardCap: 0
   },
   PRO: {
     maxProjects: null,
@@ -2259,7 +2340,11 @@ const PLAN_LIMITS: Record<
     autoSyncIntervals: [
       RESOURCE_SYNC_INTERVAL_DAILY,
       RESOURCE_SYNC_INTERVAL_WEEKLY
-    ]
+    ],
+    canUseData: true,
+    maxDataBytes: DATA_MAX_DATABASE_BYTES,
+    maxDataTablesPerDatabase: DATA_MAX_TABLES_PER_DATABASE,
+    triggerRunHardCap: DATA_TRIGGER_RUN_HARD_CAP
   },
   ENTERPRISE: {
     maxProjects: null,
@@ -2286,7 +2371,11 @@ const PLAN_LIMITS: Record<
     autoSyncIntervals: [
       RESOURCE_SYNC_INTERVAL_DAILY,
       RESOURCE_SYNC_INTERVAL_WEEKLY
-    ]
+    ],
+    canUseData: true,
+    maxDataBytes: DATA_MAX_DATABASE_BYTES,
+    maxDataTablesPerDatabase: DATA_MAX_TABLES_PER_DATABASE,
+    triggerRunHardCap: null
   }
 };
 
@@ -2306,6 +2395,7 @@ const PLAN_FEATURE_EMBEDDED_STORAGE = 'embeddedStorage' as 'embeddedStorage';
 const PLAN_FEATURE_MESSAGE = 'message' as 'message';
 const PLAN_FEATURE_TOOL_CALL = 'toolCall' as 'toolCall';
 const PLAN_FEATURE_RESOURCE_SYNC = 'resourceSync' as 'resourceSync';
+const PLAN_FEATURE_DATA = 'data' as 'data';
 
 // Stable code returned on a quota block so clients can branch on it (402).
 const PLAN_LIMIT_ERROR_CODE = 'PLAN_LIMIT_EXCEEDED';
@@ -2475,6 +2565,20 @@ export const constants = {
   PRICING_TOOL_CALL_PER_M_USD,
   PRICING_TOOL_CALL_HARD_CAP,
   PRICING_CUSTOM_DOMAIN_USD,
+  DATA_MAX_DATABASE_BYTES,
+  DATA_MAX_TABLES_PER_DATABASE,
+  DATA_TRIGGER_RUN_HARD_CAP,
+  DATA_DELETE_GRACE_DAYS,
+  DATA_PURGE_BATCH,
+  DATA_ACTIVITY_THROTTLE_MS,
+  ARTIFACT_DATABASE_STATUS_CREATING,
+  ARTIFACT_DATABASE_STATUS_READY,
+  ARTIFACT_DATABASE_STATUS_FAILED,
+  ARTIFACT_DATABASE_STATUS_DELETING,
+  ARTIFACT_DATABASE_STATUS_PURGING,
+  ARTIFACT_DATABASE_STATUS_DELETED,
+  DATA_PURGE_STALE_MS,
+  ARTIFACT_DATABASE_STATUSES,
   PLAN_FEATURE_ORGANIZATION,
   PLAN_FEATURE_PROJECT,
   PLAN_FEATURE_TOOL,
@@ -2489,6 +2593,7 @@ export const constants = {
   PLAN_FEATURE_MESSAGE,
   PLAN_FEATURE_TOOL_CALL,
   PLAN_FEATURE_RESOURCE_SYNC,
+  PLAN_FEATURE_DATA,
   PLAN_LIMIT_ERROR_CODE,
   BILLING_METER_MESSAGES,
   BILLING_METER_SHARED_MESSAGES,
@@ -2577,6 +2682,7 @@ export const constants = {
   SLACK_OAUTH_TOKEN_URL,
   OAUTH_TOKEN_URLS,
   CREDENTIAL_REFRESH_BUFFER_MS,
+  CREDENTIAL_REFRESH_GIVE_UP_MS,
   GOOGLE_CALENDAR_API_BASE,
   GOOGLE_DRIVE_API_BASE,
   GOOGLE_DRIVE_DEFAULT_PAGE_SIZE,
@@ -2612,6 +2718,7 @@ export const constants = {
   ONE_DRIVE_TAB_LABEL_DRIVES,
   ONE_DRIVE_TAB_LABELS,
   REAUTH_ERROR_CODES,
+  OAUTH_CLIENT_ERROR_CODES,
   RESOURCE_TYPE_TOOLTIP_MIN_WIDTH,
   SEARCH_DEBOUNCE_MS,
   GOOGLE_DRIVE_EXPORT_MIME_TYPES,
@@ -2840,6 +2947,7 @@ export const constants = {
   RESOURCE_SEARCH_RRF_K,
   RESOURCE_SEARCH_COMMON_TERM_DIVISOR,
   RESOURCE_SEARCH_COMMON_TERM_MIN,
+  RESOURCE_SEARCH_RERANK_ENABLED,
   RESOURCE_SEARCH_RERANK_CANDIDATES,
   RESOURCE_SEARCH_RERANK_MODEL,
   RESOURCE_SEARCH_EXACT_MAX_RESOURCES,
@@ -2988,6 +3096,7 @@ export const constants = {
   CUSTOM_CODE_BROKER_PATH_RESOURCES_CREATE,
   CUSTOM_CODE_BROKER_PATH_RESOURCES_DELETE,
   CUSTOM_CODE_BROKER_PATH_SEND_FILE,
+  CUSTOM_CODE_BROKER_PATH_DATA,
   CUSTOM_CODE_OUTBOUND_PARAM_ARTIFACT_ID,
   CUSTOM_CODE_OUTBOUND_PARAM_ALLOWED_HOSTS,
   CUSTOM_CODE_PLATFORM_HOSTS,
@@ -3025,10 +3134,13 @@ export const constants = {
   CUSTOM_CODE_RESOURCE_FILE_TOO_LARGE_MESSAGE,
   RESERVED_SLUGS,
   MCP_INTERNAL_HEADER,
+  MCP_EVAL_RERANK_HEADER,
   MCP_CHANNEL_ID_HEADER,
   MCP_CHANNEL_PLATFORM_HEADER,
   MCP_CHANNEL_CONVERSATION_HEADER,
   MCP_CHANNEL_CLIENT_USER_AGENT,
+  MCP_CHANNEL_PARTICIPANT_HEADER,
+  MCP_CHANNEL_TIME_ZONE_HEADER,
   MCP_SESSION_HEADER,
   MCP_REQUEST_METHOD_INITIALIZE,
   MCP_REQUEST_METHOD_PING,