@inkeep/agents-core 0.58.13 → 0.58.15

package/dist/data-access/runtime/conversations.d.ts

@@ -16,21 +16,21 @@ declare const listConversations: (db: AgentsRunDatabaseClient) => (params: {
   total: number;
 }>;
 declare const createConversation: (db: AgentsRunDatabaseClient) => (params: ConversationInsert) => Promise<{
-  id: string;
   tenantId: string;
   projectId: string;
   agentId: string | null;
-  title: string | null;
+  id: string;
+  metadata: ConversationMetadata | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   userId: string | null;
+  activeSubAgentId: string;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
-  activeSubAgentId: string;
+  title: string | null;
   lastContextResolution: string | null;
 }>;
 declare const updateConversation: (db: AgentsRunDatabaseClient) => (params: {
@@ -85,21 +85,21 @@ declare const getConversation: (db: AgentsRunDatabaseClient) => (params: {
   scopes: ProjectScopeConfig;
   conversationId: string;
 }) => Promise<{
-  id: string;
   tenantId: string;
   projectId: string;
   agentId: string | null;
-  title: string | null;
+  id: string;
+  metadata: ConversationMetadata | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   userId: string | null;
+  activeSubAgentId: string;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
-  activeSubAgentId: string;
+  title: string | null;
   lastContextResolution: string | null;
 } | undefined>;
 declare const createOrGetConversation: (db: AgentsRunDatabaseClient) => (input: ConversationInsert) => Promise<{
@@ -121,21 +121,21 @@ declare const createOrGetConversation: (db: AgentsRunDatabaseClient) => (input:
   metadata?: ConversationMetadata | null | undefined;
   contextConfigId?: string | undefined;
 } | {
-  id: string;
   tenantId: string;
   projectId: string;
   agentId: string | null;
-  title: string | null;
+  id: string;
+  metadata: ConversationMetadata | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   userId: string | null;
+  activeSubAgentId: string;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
-  activeSubAgentId: string;
+  title: string | null;
   lastContextResolution: string | null;
 }>;
 /**
@@ -153,21 +153,21 @@ declare const getActiveAgentForConversation: (db: AgentsRunDatabaseClient) => (p
   scopes: ProjectScopeConfig;
   conversationId: string;
 }) => Promise<{
-  id: string;
   tenantId: string;
   projectId: string;
   agentId: string | null;
-  title: string | null;
+  id: string;
+  metadata: ConversationMetadata | null;
   createdAt: string;
   updatedAt: string;
-  metadata: ConversationMetadata | null;
   userId: string | null;
+  activeSubAgentId: string;
   ref: {
     type: "commit" | "tag" | "branch";
     name: string;
     hash: string;
   } | null;
-  activeSubAgentId: string;
+  title: string | null;
   lastContextResolution: string | null;
 } | undefined>;
 /**

package/dist/data-access/runtime/conversations.js

@@ -1,5 +1,6 @@
 import { conversations, messages } from "../../db/runtime/runtime-schema.js";
 import { getConversationId } from "../../utils/conversations.js";
+import { projectScopedWhere } from "../manage/scope-helpers.js";
 import { and, count, desc, eq, inArray } from "drizzle-orm";
 
 //#region src/data-access/runtime/conversations.ts
@@ -8,7 +9,7 @@ const listConversations = (db) => async (params) => {
 	const page = pagination?.page || 1;
 	const limit = Math.min(pagination?.limit || 20, 200);
 	const offset = (page - 1) * limit;
-	const whereConditions = [eq(conversations.tenantId, params.scopes.tenantId), eq(conversations.projectId, params.scopes.projectId)];
+	const whereConditions = [projectScopedWhere(conversations, params.scopes)];
 	if (userId) whereConditions.push(eq(conversations.userId, userId));
 	const conversationList = await db.select().from(conversations).where(and(...whereConditions)).orderBy(desc(conversations.updatedAt)).limit(limit).offset(offset);
 	const total = (await db.select({ count: count() }).from(conversations).where(and(...whereConditions)))[0]?.count || 0;
@@ -31,13 +32,13 @@ const updateConversation = (db) => async (params) => {
 	const [updated] = await db.update(conversations).set({
 		...params.data,
 		updatedAt: now
-	}).where(and(eq(conversations.tenantId, params.scopes.tenantId), eq(conversations.projectId, params.scopes.projectId), eq(conversations.id, params.conversationId))).returning();
+	}).where(and(projectScopedWhere(conversations, params.scopes), eq(conversations.id, params.conversationId))).returning();
 	return updated;
 };
 const deleteConversation = (db) => async (params) => {
 	try {
-		await db.delete(messages).where(and(eq(messages.tenantId, params.scopes.tenantId), eq(messages.projectId, params.scopes.projectId), eq(messages.conversationId, params.conversationId)));
-		await db.delete(conversations).where(and(eq(conversations.tenantId, params.scopes.tenantId), eq(conversations.projectId, params.scopes.projectId), eq(conversations.id, params.conversationId)));
+		await db.delete(messages).where(and(projectScopedWhere(messages, params.scopes), eq(messages.conversationId, params.conversationId)));
+		await db.delete(conversations).where(and(projectScopedWhere(conversations, params.scopes), eq(conversations.id, params.conversationId)));
 		return true;
 	} catch (error) {
 		console.error("Error deleting conversation:", error);
@@ -52,7 +53,7 @@ const updateConversationActiveSubAgent = (db) => async (params) => {
 	});
 };
 const getConversation = (db) => async (params) => {
-	return await db.query.conversations.findFirst({ where: and(eq(conversations.tenantId, params.scopes.tenantId), eq(conversations.projectId, params.scopes.projectId), eq(conversations.id, params.conversationId)) });
+	return await db.query.conversations.findFirst({ where: and(projectScopedWhere(conversations, params.scopes), eq(conversations.id, params.conversationId)) });
 };
 const createOrGetConversation = (db) => async (input) => {
 	const conversationId = input.id || getConversationId();
@@ -132,13 +133,8 @@ function applyContextWindowManagement(messageHistory, maxTokens) {
 */
 const getConversationHistory = (db) => async (params) => {
 	const { scopes, conversationId, options = {} } = params;
-	const { tenantId, projectId } = scopes;
 	const { limit = options.limit ?? 50, includeInternal = options.includeInternal ?? false, maxOutputTokens, messageTypes } = options;
-	const whereConditions = [
-		eq(messages.tenantId, tenantId),
-		eq(messages.projectId, projectId),
-		eq(messages.conversationId, conversationId)
-	];
+	const whereConditions = [projectScopedWhere(messages, scopes), eq(messages.conversationId, conversationId)];
 	if (!includeInternal) whereConditions.push(eq(messages.visibility, "user-facing"));
 	if (messageTypes && messageTypes.length > 0) whereConditions.push(inArray(messages.messageType, messageTypes));
 	const chronologicalHistory = (await db.select().from(messages).where(and(...whereConditions)).orderBy(desc(messages.createdAt)).limit(limit)).reverse();
@@ -149,7 +145,7 @@ const getConversationHistory = (db) => async (params) => {
 * Get active agent for a conversation
 */
 const getActiveAgentForConversation = (db) => async (params) => {
-	return await db.query.conversations.findFirst({ where: and(eq(conversations.tenantId, params.scopes.tenantId), eq(conversations.projectId, params.scopes.projectId), eq(conversations.id, params.conversationId)) });
+	return await db.query.conversations.findFirst({ where: and(projectScopedWhere(conversations, params.scopes), eq(conversations.id, params.conversationId)) });
 };
 /**
 * Set active agent for a conversation (upsert operation)

package/dist/data-access/runtime/evalRuns.js

@@ -1,15 +1,16 @@
 import { conversations, datasetRun, datasetRunConversationRelations, evaluationResult, evaluationRun } from "../../db/runtime/runtime-schema.js";
+import { projectScopedWhere } from "../manage/scope-helpers.js";
 import { and, desc, eq, gte, inArray, lte } from "drizzle-orm";
 
 //#region src/data-access/runtime/evalRuns.ts
 const getDatasetRunById = (db) => async (params) => {
-	return (await db.select().from(datasetRun).where(and(eq(datasetRun.tenantId, params.scopes.tenantId), eq(datasetRun.projectId, params.scopes.projectId), eq(datasetRun.id, params.scopes.datasetRunId))).limit(1))[0] ?? null;
+	return (await db.select().from(datasetRun).where(and(projectScopedWhere(datasetRun, params.scopes), eq(datasetRun.id, params.scopes.datasetRunId))).limit(1))[0] ?? null;
 };
 const listDatasetRuns = (db) => async (params) => {
-	return await db.select().from(datasetRun).where(and(eq(datasetRun.tenantId, params.scopes.tenantId), eq(datasetRun.projectId, params.scopes.projectId))).orderBy(desc(datasetRun.createdAt));
+	return await db.select().from(datasetRun).where(projectScopedWhere(datasetRun, params.scopes)).orderBy(desc(datasetRun.createdAt));
 };
 const listDatasetRunsByConfig = (db) => async (params) => {
-	return await db.select().from(datasetRun).where(and(eq(datasetRun.tenantId, params.scopes.tenantId), eq(datasetRun.projectId, params.scopes.projectId), eq(datasetRun.datasetRunConfigId, params.scopes.datasetRunConfigId))).orderBy(desc(datasetRun.createdAt));
+	return await db.select().from(datasetRun).where(and(projectScopedWhere(datasetRun, params.scopes), eq(datasetRun.datasetRunConfigId, params.scopes.datasetRunConfigId))).orderBy(desc(datasetRun.createdAt));
 };
 const createDatasetRun = (db) => async (data) => {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -21,10 +22,10 @@ const createDatasetRun = (db) => async (data) => {
 	return created;
 };
 const deleteDatasetRun = (db) => async (params) => {
-	return (await db.delete(datasetRun).where(and(eq(datasetRun.tenantId, params.scopes.tenantId), eq(datasetRun.projectId, params.scopes.projectId), eq(datasetRun.id, params.scopes.datasetRunId))).returning()).length > 0;
+	return (await db.delete(datasetRun).where(and(projectScopedWhere(datasetRun, params.scopes), eq(datasetRun.id, params.scopes.datasetRunId))).returning()).length > 0;
 };
 const getDatasetRunConversationRelations = (db) => async (params) => {
-	return await db.select().from(datasetRunConversationRelations).where(and(eq(datasetRunConversationRelations.tenantId, params.scopes.tenantId), eq(datasetRunConversationRelations.projectId, params.scopes.projectId), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId)));
+	return await db.select().from(datasetRunConversationRelations).where(and(projectScopedWhere(datasetRunConversationRelations, params.scopes), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId)));
 };
 const createDatasetRunConversationRelation = (db) => async (data) => {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -45,25 +46,25 @@ const createDatasetRunConversationRelations = (db) => async (data) => {
 	return await db.insert(datasetRunConversationRelations).values(values).returning();
 };
 const deleteDatasetRunConversationRelation = (db) => async (params) => {
-	return (await db.delete(datasetRunConversationRelations).where(and(eq(datasetRunConversationRelations.tenantId, params.scopes.tenantId), eq(datasetRunConversationRelations.projectId, params.scopes.projectId), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId), eq(datasetRunConversationRelations.conversationId, params.scopes.conversationId))).returning()).length > 0;
+	return (await db.delete(datasetRunConversationRelations).where(and(projectScopedWhere(datasetRunConversationRelations, params.scopes), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId), eq(datasetRunConversationRelations.conversationId, params.scopes.conversationId))).returning()).length > 0;
 };
 const deleteDatasetRunConversationRelationsByRun = (db) => async (params) => {
-	return (await db.delete(datasetRunConversationRelations).where(and(eq(datasetRunConversationRelations.tenantId, params.scopes.tenantId), eq(datasetRunConversationRelations.projectId, params.scopes.projectId), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId))).returning()).length;
+	return (await db.delete(datasetRunConversationRelations).where(and(projectScopedWhere(datasetRunConversationRelations, params.scopes), eq(datasetRunConversationRelations.datasetRunId, params.scopes.datasetRunId))).returning()).length;
 };
 const getDatasetRunConversationRelationByConversation = (db) => async (params) => {
-	return (await db.select().from(datasetRunConversationRelations).where(and(eq(datasetRunConversationRelations.tenantId, params.scopes.tenantId), eq(datasetRunConversationRelations.projectId, params.scopes.projectId), eq(datasetRunConversationRelations.conversationId, params.scopes.conversationId))).limit(1))[0] || null;
+	return (await db.select().from(datasetRunConversationRelations).where(and(projectScopedWhere(datasetRunConversationRelations, params.scopes), eq(datasetRunConversationRelations.conversationId, params.scopes.conversationId))).limit(1))[0] || null;
 };
 const getEvaluationRunById = (db) => async (params) => {
-	return (await db.select().from(evaluationRun).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId), eq(evaluationRun.id, params.scopes.evaluationRunId))).limit(1))[0] ?? null;
+	return (await db.select().from(evaluationRun).where(and(projectScopedWhere(evaluationRun, params.scopes), eq(evaluationRun.id, params.scopes.evaluationRunId))).limit(1))[0] ?? null;
 };
 const listEvaluationRuns = (db) => async (params) => {
-	return await db.select().from(evaluationRun).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId)));
+	return await db.select().from(evaluationRun).where(projectScopedWhere(evaluationRun, params.scopes));
 };
 const listEvaluationRunsByJobConfigId = (db) => async (params) => {
-	return await db.select().from(evaluationRun).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId), eq(evaluationRun.evaluationJobConfigId, params.evaluationJobConfigId)));
+	return await db.select().from(evaluationRun).where(and(projectScopedWhere(evaluationRun, params.scopes), eq(evaluationRun.evaluationJobConfigId, params.evaluationJobConfigId)));
 };
 const getEvaluationRunByJobConfigId = (db) => async (params) => {
-	return (await db.select().from(evaluationRun).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId), eq(evaluationRun.evaluationJobConfigId, params.evaluationJobConfigId))).limit(1))[0] ?? null;
+	return (await db.select().from(evaluationRun).where(and(projectScopedWhere(evaluationRun, params.scopes), eq(evaluationRun.evaluationJobConfigId, params.evaluationJobConfigId))).limit(1))[0] ?? null;
 };
 const createEvaluationRun = (db) => async (data) => {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -77,23 +78,23 @@ const createEvaluationRun = (db) => async (data) => {
 const updateEvaluationRun = (db) => async (params) => {
 	const updateData = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 	for (const [key, value] of Object.entries(params.data)) if (value !== void 0) updateData[key] = value;
-	const [updated] = await db.update(evaluationRun).set(updateData).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId), eq(evaluationRun.id, params.scopes.evaluationRunId))).returning();
+	const [updated] = await db.update(evaluationRun).set(updateData).where(and(projectScopedWhere(evaluationRun, params.scopes), eq(evaluationRun.id, params.scopes.evaluationRunId))).returning();
 	return updated ?? null;
 };
 const deleteEvaluationRun = (db) => async (params) => {
-	return (await db.delete(evaluationRun).where(and(eq(evaluationRun.tenantId, params.scopes.tenantId), eq(evaluationRun.projectId, params.scopes.projectId), eq(evaluationRun.id, params.scopes.evaluationRunId))).returning()).length > 0;
+	return (await db.delete(evaluationRun).where(and(projectScopedWhere(evaluationRun, params.scopes), eq(evaluationRun.id, params.scopes.evaluationRunId))).returning()).length > 0;
 };
 const getEvaluationResultById = (db) => async (params) => {
-	return await db.query.evaluationResult.findFirst({ where: and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.id, params.scopes.evaluationResultId)) }) ?? null;
+	return await db.query.evaluationResult.findFirst({ where: and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.id, params.scopes.evaluationResultId)) }) ?? null;
 };
 const listEvaluationResults = (db) => async (params) => {
-	return await db.query.evaluationResult.findMany({ where: and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId)) });
+	return await db.query.evaluationResult.findMany({ where: projectScopedWhere(evaluationResult, params.scopes) });
 };
 const listEvaluationResultsByRun = (db) => async (params) => {
-	return await db.query.evaluationResult.findMany({ where: and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.evaluationRunId, params.scopes.evaluationRunId)) });
+	return await db.query.evaluationResult.findMany({ where: and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.evaluationRunId, params.scopes.evaluationRunId)) });
 };
 const listEvaluationResultsByConversation = (db) => async (params) => {
-	return await db.query.evaluationResult.findMany({ where: and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.conversationId, params.scopes.conversationId)) });
+	return await db.query.evaluationResult.findMany({ where: and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.conversationId, params.scopes.conversationId)) });
 };
 const createEvaluationResult = (db) => async (data) => {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -116,14 +117,14 @@ const createEvaluationResults = (db) => async (data) => {
 const updateEvaluationResult = (db) => async (params) => {
 	const updateData = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 	for (const [key, value] of Object.entries(params.data)) if (value !== void 0) updateData[key] = value;
-	const [updated] = await db.update(evaluationResult).set(updateData).where(and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.id, params.scopes.evaluationResultId))).returning();
+	const [updated] = await db.update(evaluationResult).set(updateData).where(and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.id, params.scopes.evaluationResultId))).returning();
 	return updated ?? null;
 };
 const deleteEvaluationResult = (db) => async (params) => {
-	return (await db.delete(evaluationResult).where(and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.id, params.scopes.evaluationResultId))).returning()).length > 0;
+	return (await db.delete(evaluationResult).where(and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.id, params.scopes.evaluationResultId))).returning()).length > 0;
 };
 const deleteEvaluationResultsByRun = (db) => async (params) => {
-	return (await db.delete(evaluationResult).where(and(eq(evaluationResult.tenantId, params.scopes.tenantId), eq(evaluationResult.projectId, params.scopes.projectId), eq(evaluationResult.evaluationRunId, params.scopes.evaluationRunId))).returning()).length;
+	return (await db.delete(evaluationResult).where(and(projectScopedWhere(evaluationResult, params.scopes), eq(evaluationResult.evaluationRunId, params.scopes.evaluationRunId))).returning()).length;
 };
 /**
 * Helper to extract plain filter criteria from a Filter wrapper.
@@ -141,7 +142,7 @@ const filterConversationsForJob = (db) => async (params) => {
 	const { scopes, jobFilters: rawJobFilters } = params;
 	const jobFilters = extractPlainFilterCriteria(rawJobFilters);
 	const { tenantId, projectId } = scopes;
-	const whereConditions = [eq(conversations.tenantId, tenantId), eq(conversations.projectId, projectId)];
+	const whereConditions = [projectScopedWhere(conversations, scopes)];
 	if (jobFilters?.conversationIds && Array.isArray(jobFilters.conversationIds) && jobFilters.conversationIds.length > 0) whereConditions.push(inArray(conversations.id, jobFilters.conversationIds));
 	if (jobFilters?.dateRange) {
 		const { startDate, endDate } = jobFilters.dateRange;

package/dist/data-access/runtime/github-work-app-installations.js

@@ -1,5 +1,6 @@
 import { workAppGitHubInstallations, workAppGitHubMcpToolAccessMode, workAppGitHubMcpToolRepositoryAccess, workAppGitHubProjectAccessMode, workAppGitHubProjectRepositoryAccess, workAppGitHubRepositories } from "../../db/runtime/runtime-schema.js";
 import { generateId } from "../../utils/conversations.js";
+import { projectScopedWhere, tenantScopedWhere, toolScopedWhere } from "../manage/scope-helpers.js";
 import { and, count, desc, eq, inArray, ne } from "drizzle-orm";
 
 //#region src/data-access/runtime/github-work-app-installations.ts
@@ -25,13 +26,13 @@ const getInstallationByGitHubId = (db) => async (gitHubInstallationId) => {
 * Get installation by internal ID with tenant validation
 */
 const getInstallationById = (db) => async (params) => {
-	return await db.query.workAppGitHubInstallations.findFirst({ where: and(eq(workAppGitHubInstallations.tenantId, params.tenantId), eq(workAppGitHubInstallations.id, params.id)) }) ?? null;
+	return await db.query.workAppGitHubInstallations.findFirst({ where: and(tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), eq(workAppGitHubInstallations.id, params.id)) }) ?? null;
 };
 /**
 * Get all installations for a tenant
 */
 const getInstallationsByTenantId = (db) => async (params) => {
-	const conditions = [eq(workAppGitHubInstallations.tenantId, params.tenantId)];
+	const conditions = [tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId })];
 	if (!params.includeDisconnected) conditions.push(ne(workAppGitHubInstallations.status, "disconnected"));
 	return await db.select().from(workAppGitHubInstallations).where(and(...conditions)).orderBy(desc(workAppGitHubInstallations.createdAt));
 };
@@ -43,7 +44,7 @@ const updateInstallationStatus = (db) => async (params) => {
 	const [updated] = await db.update(workAppGitHubInstallations).set({
 		status: params.status,
 		updatedAt: now
-	}).where(and(eq(workAppGitHubInstallations.tenantId, params.tenantId), eq(workAppGitHubInstallations.id, params.id))).returning();
+	}).where(and(tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), eq(workAppGitHubInstallations.id, params.id))).returning();
 	return updated ?? null;
 };
 /**
@@ -68,7 +69,7 @@ const disconnectInstallation = (db) => async (params) => {
 	const [updated] = await db.update(workAppGitHubInstallations).set({
 		status: "disconnected",
 		updatedAt: now
-	}).where(and(eq(workAppGitHubInstallations.tenantId, params.tenantId), eq(workAppGitHubInstallations.id, params.id))).returning();
+	}).where(and(tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), eq(workAppGitHubInstallations.id, params.id))).returning();
 	return !!updated;
 };
 /**
@@ -76,7 +77,7 @@ const disconnectInstallation = (db) => async (params) => {
 * Returns the deleted installation if found, null otherwise
 */
 const deleteInstallation = (db) => async (params) => {
-	const [deleted] = await db.delete(workAppGitHubInstallations).where(and(eq(workAppGitHubInstallations.tenantId, params.tenantId), eq(workAppGitHubInstallations.id, params.id))).returning();
+	const [deleted] = await db.delete(workAppGitHubInstallations).where(and(tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), eq(workAppGitHubInstallations.id, params.id))).returning();
 	return deleted ?? null;
 };
 /**
@@ -188,7 +189,7 @@ const getRepositoriesByTenantId = (db) => async (tenantId) => {
 		createdAt: workAppGitHubRepositories.createdAt,
 		updatedAt: workAppGitHubRepositories.updatedAt,
 		installationAccountLogin: workAppGitHubInstallations.accountLogin
-	}).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubInstallations.tenantId, tenantId), ne(workAppGitHubInstallations.status, "disconnected"))).orderBy(workAppGitHubRepositories.repositoryFullName);
+	}).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(tenantScopedWhere(workAppGitHubInstallations, { tenantId }), ne(workAppGitHubInstallations.status, "disconnected"))).orderBy(workAppGitHubRepositories.repositoryFullName);
 };
 /**
 * Set project repository access (full replacement)
@@ -211,7 +212,10 @@ const setProjectRepositoryAccess = (db) => async (params) => {
 		createdAt: now,
 		updatedAt: now
 	})));
-	const toolsWithSelectedMode = await db.select({ toolId: workAppGitHubMcpToolAccessMode.toolId }).from(workAppGitHubMcpToolAccessMode).where(and(eq(workAppGitHubMcpToolAccessMode.tenantId, params.tenantId), eq(workAppGitHubMcpToolAccessMode.projectId, params.projectId), eq(workAppGitHubMcpToolAccessMode.mode, "selected")));
+	const toolsWithSelectedMode = await db.select({ toolId: workAppGitHubMcpToolAccessMode.toolId }).from(workAppGitHubMcpToolAccessMode).where(and(projectScopedWhere(workAppGitHubMcpToolAccessMode, {
+		tenantId: params.tenantId,
+		projectId: params.projectId
+	}), eq(workAppGitHubMcpToolAccessMode.mode, "selected")));
 	for (const { toolId } of toolsWithSelectedMode) {
 		const reposToRemove = (await db.select({
 			id: workAppGitHubMcpToolRepositoryAccess.id,
@@ -261,8 +265,11 @@ const getProjectRepositoryAccessWithDetails = (db) => async (params) => {
 * - Project mode is 'selected' and repository is explicitly in the project's access list
 */
 const checkProjectRepositoryAccess = (db) => async (params) => {
-	if (((await db.select({ mode: workAppGitHubProjectAccessMode.mode }).from(workAppGitHubProjectAccessMode).where(and(eq(workAppGitHubProjectAccessMode.tenantId, params.tenantId), eq(workAppGitHubProjectAccessMode.projectId, params.projectId))).limit(1))[0]?.mode ?? "selected") === "all") {
-		if ((await db.select({ id: workAppGitHubRepositories.id }).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubRepositories.repositoryFullName, params.repositoryFullName), eq(workAppGitHubInstallations.tenantId, params.tenantId), ne(workAppGitHubInstallations.status, "disconnected"))).limit(1)).length === 0) return {
+	if (((await db.select({ mode: workAppGitHubProjectAccessMode.mode }).from(workAppGitHubProjectAccessMode).where(projectScopedWhere(workAppGitHubProjectAccessMode, {
+		tenantId: params.tenantId,
+		projectId: params.projectId
+	})).limit(1))[0]?.mode ?? "selected") === "all") {
+		if ((await db.select({ id: workAppGitHubRepositories.id }).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubRepositories.repositoryFullName, params.repositoryFullName), tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), ne(workAppGitHubInstallations.status, "disconnected"))).limit(1)).length === 0) return {
 			hasAccess: false,
 			reason: "Repository not found in tenant installations"
 		};
@@ -271,7 +278,7 @@ const checkProjectRepositoryAccess = (db) => async (params) => {
 			reason: "Project has access to all repositories"
 		};
 	}
-	if ((await db.select({ id: workAppGitHubProjectRepositoryAccess.id }).from(workAppGitHubProjectRepositoryAccess).innerJoin(workAppGitHubRepositories, eq(workAppGitHubProjectRepositoryAccess.repositoryDbId, workAppGitHubRepositories.id)).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubProjectRepositoryAccess.projectId, params.projectId), eq(workAppGitHubRepositories.repositoryFullName, params.repositoryFullName), eq(workAppGitHubInstallations.tenantId, params.tenantId), ne(workAppGitHubInstallations.status, "disconnected"))).limit(1)).length === 0) return {
+	if ((await db.select({ id: workAppGitHubProjectRepositoryAccess.id }).from(workAppGitHubProjectRepositoryAccess).innerJoin(workAppGitHubRepositories, eq(workAppGitHubProjectRepositoryAccess.repositoryDbId, workAppGitHubRepositories.id)).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubProjectRepositoryAccess.projectId, params.projectId), eq(workAppGitHubRepositories.repositoryFullName, params.repositoryFullName), tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), ne(workAppGitHubInstallations.status, "disconnected"))).limit(1)).length === 0) return {
 		hasAccess: false,
 		reason: "Repository not in project access list"
 	};
@@ -292,7 +299,7 @@ const clearProjectRepositoryAccess = (db) => async (projectId) => {
 */
 const validateRepositoryOwnership = (db) => async (params) => {
 	if (params.repositoryIds.length === 0) return [];
-	const validRepos = await db.select({ id: workAppGitHubRepositories.id }).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubInstallations.tenantId, params.tenantId), ne(workAppGitHubInstallations.status, "disconnected"), inArray(workAppGitHubRepositories.id, params.repositoryIds)));
+	const validRepos = await db.select({ id: workAppGitHubRepositories.id }).from(workAppGitHubRepositories).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId }), ne(workAppGitHubInstallations.status, "disconnected"), inArray(workAppGitHubRepositories.id, params.repositoryIds)));
 	const validRepoIds = new Set(validRepos.map((r) => r.id));
 	return params.repositoryIds.filter((id) => !validRepoIds.has(id));
 };
@@ -307,7 +314,7 @@ const getRepositoryCount = (db) => async (installationId) => {
 * Get repository counts for all installations belonging to a tenant
 */
 const getRepositoryCountsByTenantId = (db) => async (params) => {
-	const conditions = [eq(workAppGitHubInstallations.tenantId, params.tenantId)];
+	const conditions = [tenantScopedWhere(workAppGitHubInstallations, { tenantId: params.tenantId })];
 	if (!params.includeDisconnected) conditions.push(ne(workAppGitHubInstallations.status, "disconnected"));
 	const results = await db.select({
 		installationId: workAppGitHubInstallations.id,
@@ -327,7 +334,11 @@ const getRepositoryCountsByTenantId = (db) => async (params) => {
 */
 const setMcpToolRepositoryAccess = (db) => async (params) => {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
-	await db.delete(workAppGitHubMcpToolRepositoryAccess).where(and(eq(workAppGitHubMcpToolRepositoryAccess.tenantId, params.tenantId), eq(workAppGitHubMcpToolRepositoryAccess.projectId, params.projectId), eq(workAppGitHubMcpToolRepositoryAccess.toolId, params.toolId)));
+	await db.delete(workAppGitHubMcpToolRepositoryAccess).where(toolScopedWhere(workAppGitHubMcpToolRepositoryAccess, {
+		tenantId: params.tenantId,
+		projectId: params.projectId,
+		toolId: params.toolId
+	}));
 	if (params.repositoryIds.length > 0) await db.insert(workAppGitHubMcpToolRepositoryAccess).values(params.repositoryIds.map((repoId) => ({
 		id: generateId(),
 		toolId: params.toolId,
@@ -343,7 +354,7 @@ const setMcpToolRepositoryAccess = (db) => async (params) => {
 * These entries are used when mode='selected'. Check mode via getMcpToolAccessMode().
 */
 const getMcpToolRepositoryAccess = (db) => async (scope) => {
-	return await db.select().from(workAppGitHubMcpToolRepositoryAccess).where(and(eq(workAppGitHubMcpToolRepositoryAccess.tenantId, scope.tenantId), eq(workAppGitHubMcpToolRepositoryAccess.projectId, scope.projectId), eq(workAppGitHubMcpToolRepositoryAccess.toolId, scope.toolId)));
+	return await db.select().from(workAppGitHubMcpToolRepositoryAccess).where(toolScopedWhere(workAppGitHubMcpToolRepositoryAccess, scope));
 };
 /**
 * Get MCP tool repository access with full repository details.
@@ -355,7 +366,7 @@ const getMcpToolRepositoryAccessWithDetails = (db) => async (scope) => {
 		mode: workAppGitHubMcpToolAccessMode.mode,
 		projectId: workAppGitHubMcpToolAccessMode.projectId,
 		tenantId: workAppGitHubMcpToolAccessMode.tenantId
-	}).from(workAppGitHubMcpToolAccessMode).where(and(eq(workAppGitHubMcpToolAccessMode.tenantId, scope.tenantId), eq(workAppGitHubMcpToolAccessMode.projectId, scope.projectId), eq(workAppGitHubMcpToolAccessMode.toolId, scope.toolId))).limit(1))[0]?.mode === "all") return getProjectRepositoryAccessWithDetails(db)({
+	}).from(workAppGitHubMcpToolAccessMode).where(toolScopedWhere(workAppGitHubMcpToolAccessMode, scope)).limit(1))[0]?.mode === "all") return getProjectRepositoryAccessWithDetails(db)({
 		tenantId: scope.tenantId,
 		projectId: scope.projectId
 	});
@@ -371,13 +382,13 @@ const getMcpToolRepositoryAccessWithDetails = (db) => async (scope) => {
 		createdAt: workAppGitHubRepositories.createdAt,
 		updatedAt: workAppGitHubRepositories.updatedAt,
 		installationAccountLogin: workAppGitHubInstallations.accountLogin
-	}).from(workAppGitHubMcpToolRepositoryAccess).innerJoin(workAppGitHubRepositories, eq(workAppGitHubMcpToolRepositoryAccess.repositoryDbId, workAppGitHubRepositories.id)).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(and(eq(workAppGitHubMcpToolRepositoryAccess.tenantId, scope.tenantId), eq(workAppGitHubMcpToolRepositoryAccess.projectId, scope.projectId), eq(workAppGitHubMcpToolRepositoryAccess.toolId, scope.toolId)));
+	}).from(workAppGitHubMcpToolRepositoryAccess).innerJoin(workAppGitHubRepositories, eq(workAppGitHubMcpToolRepositoryAccess.repositoryDbId, workAppGitHubRepositories.id)).innerJoin(workAppGitHubInstallations, eq(workAppGitHubRepositories.installationDbId, workAppGitHubInstallations.id)).where(toolScopedWhere(workAppGitHubMcpToolRepositoryAccess, scope));
 };
 /**
 * Remove all MCP tool repository access for a specific tool
 */
 const clearMcpToolRepositoryAccess = (db) => async (scope) => {
-	return (await db.delete(workAppGitHubMcpToolRepositoryAccess).where(and(eq(workAppGitHubMcpToolRepositoryAccess.tenantId, scope.tenantId), eq(workAppGitHubMcpToolRepositoryAccess.projectId, scope.projectId), eq(workAppGitHubMcpToolRepositoryAccess.toolId, scope.toolId))).returning()).length;
+	return (await db.delete(workAppGitHubMcpToolRepositoryAccess).where(toolScopedWhere(workAppGitHubMcpToolRepositoryAccess, scope)).returning()).length;
 };
 const isGithubWorkAppTool = (tool) => {
 	return tool.isWorkApp && tool.config.mcp.server.url.includes("/github/mcp");
@@ -408,13 +419,13 @@ const setProjectAccessMode = (db) => async (params) => {
 * Returns 'selected' if no mode is explicitly set (fail-safe default).
 */
 const getProjectAccessMode = (db) => async (params) => {
-	return (await db.select({ mode: workAppGitHubProjectAccessMode.mode }).from(workAppGitHubProjectAccessMode).where(and(eq(workAppGitHubProjectAccessMode.tenantId, params.tenantId), eq(workAppGitHubProjectAccessMode.projectId, params.projectId))).limit(1))[0]?.mode ?? "selected";
+	return (await db.select({ mode: workAppGitHubProjectAccessMode.mode }).from(workAppGitHubProjectAccessMode).where(projectScopedWhere(workAppGitHubProjectAccessMode, params)).limit(1))[0]?.mode ?? "selected";
 };
 /**
 * Delete the access mode entry for a project
 */
 const deleteProjectAccessMode = (db) => async (params) => {
-	return (await db.delete(workAppGitHubProjectAccessMode).where(and(eq(workAppGitHubProjectAccessMode.tenantId, params.tenantId), eq(workAppGitHubProjectAccessMode.projectId, params.projectId))).returning()).length > 0;
+	return (await db.delete(workAppGitHubProjectAccessMode).where(projectScopedWhere(workAppGitHubProjectAccessMode, params)).returning()).length > 0;
 };
 /**
 * Set the access mode for an MCP tool's GitHub repository access.
@@ -447,13 +458,13 @@ const setMcpToolAccessMode = (db) => async (params) => {
 * Returns 'selected' if no mode is explicitly set (fail-safe default).
 */
 const getMcpToolAccessMode = (db) => async (scope) => {
-	return (await db.select({ mode: workAppGitHubMcpToolAccessMode.mode }).from(workAppGitHubMcpToolAccessMode).where(and(eq(workAppGitHubMcpToolAccessMode.tenantId, scope.tenantId), eq(workAppGitHubMcpToolAccessMode.projectId, scope.projectId), eq(workAppGitHubMcpToolAccessMode.toolId, scope.toolId))).limit(1))[0]?.mode ?? "selected";
+	return (await db.select({ mode: workAppGitHubMcpToolAccessMode.mode }).from(workAppGitHubMcpToolAccessMode).where(toolScopedWhere(workAppGitHubMcpToolAccessMode, scope)).limit(1))[0]?.mode ?? "selected";
 };
 /**
 * Delete the access mode entry for an MCP tool
 */
 const deleteMcpToolAccessMode = (db) => async (scope) => {
-	return (await db.delete(workAppGitHubMcpToolAccessMode).where(and(eq(workAppGitHubMcpToolAccessMode.tenantId, scope.tenantId), eq(workAppGitHubMcpToolAccessMode.projectId, scope.projectId), eq(workAppGitHubMcpToolAccessMode.toolId, scope.toolId))).returning()).length > 0;
+	return (await db.delete(workAppGitHubMcpToolAccessMode).where(toolScopedWhere(workAppGitHubMcpToolAccessMode, scope)).returning()).length > 0;
 };
 
 //#endregion

package/dist/data-access/runtime/ledgerArtifacts.js

@@ -1,5 +1,7 @@
 import { ledgerArtifacts } from "../../db/runtime/runtime-schema.js";
 import { generateId } from "../../utils/conversations.js";
+import { projectScopedWhere } from "../manage/scope-helpers.js";
+import { isRetryableError } from "../../retry/retryable-errors.js";
 import { and, count, eq, inArray } from "drizzle-orm";
 
 //#region src/data-access/runtime/ledgerArtifacts.ts
@@ -114,7 +116,7 @@ const upsertLedgerArtifact = (db) => async (params) => {
 		return { created: true };
 	} catch (error) {
 		if (error.message?.includes("UNIQUE") || error.message?.includes("duplicate")) {
-			const existing = await db.select().from(ledgerArtifacts).where(and(eq(ledgerArtifacts.tenantId, scopes.tenantId), eq(ledgerArtifacts.projectId, scopes.projectId), eq(ledgerArtifacts.id, artifactRow.id), eq(ledgerArtifacts.taskId, taskId))).limit(1);
+			const existing = await db.select().from(ledgerArtifacts).where(and(projectScopedWhere(ledgerArtifacts, scopes), eq(ledgerArtifacts.id, artifactRow.id), eq(ledgerArtifacts.taskId, taskId))).limit(1);
 			if (existing.length > 0) return {
 				created: false,
 				existing: existing[0]
@@ -123,14 +125,6 @@ const upsertLedgerArtifact = (db) => async (params) => {
 		const sanitizedError = /* @__PURE__ */ new Error(`Failed to insert artifact ${artifactRow.id}: ${error.message?.split("\nparams:")[0] || error.message}`);
 		sanitizedError.name = error.name;
 		sanitizedError.cause = error.code || error.errno;
-		if (artifactRow.id?.includes("compress_")) console.error("COMPRESSION ARTIFACT FULL ERROR:", {
-			artifactId: artifactRow.id,
-			errorMessage: error.message,
-			errorCode: error.code,
-			errorName: error.name,
-			errorStack: error.stack,
-			fullError: error
-		});
 		throw sanitizedError;
 	}
 };
@@ -173,7 +167,7 @@ const addLedgerArtifacts = (db) => async (params) => {
 		return;
 	} catch (error) {
 		lastError = error;
-		if (!(error.cause.code === "40P01" || error.cause.code === "40001" || error.cause.code === "55P03" || error.message?.includes("database is locked") || error.message?.includes("busy") || error.message?.includes("timeout") || error.message?.includes("deadlock") || error.message?.includes("serialization failure")) || attempt === maxRetries) {
+		if (!isRetryableError(error) || attempt === maxRetries) {
 			await tryFallbackInsert(db, rows, error);
 			return;
 		}
@@ -183,15 +177,6 @@ const addLedgerArtifacts = (db) => async (params) => {
 	const sanitizedError = /* @__PURE__ */ new Error(`Failed to insert ${rows.length} artifacts after ${maxRetries} attempts: ${lastError?.message?.split("\nparams:")[0] || lastError?.message}`);
 	sanitizedError.name = lastError?.name;
 	sanitizedError.cause = lastError?.code || lastError?.errno;
-	if (rows.some((row) => row.id?.includes("compress_"))) console.error("COMPRESSION ARTIFACTS BULK INSERT FULL ERROR:", {
-		artifactCount: rows.length,
-		compressionArtifacts: rows.filter((row) => row.id?.includes("compress_")).map((row) => row.id),
-		errorMessage: lastError?.message,
-		errorCode: lastError?.code,
-		errorName: lastError?.name,
-		errorStack: lastError?.stack,
-		fullError: lastError
-	});
 	throw sanitizedError;
 };
 /**
@@ -203,7 +188,7 @@ const getLedgerArtifacts = (db) => async (params) => {
 	const { scopes, taskId, toolCallId, toolCallIds, artifactId } = params;
 	if (!taskId && !toolCallId && !toolCallIds && !artifactId) throw new Error("At least one of taskId, toolCallId, toolCallIds, or artifactId must be provided");
 	if (toolCallId && toolCallIds) throw new Error("Cannot provide both toolCallId and toolCallIds. Use toolCallIds for batch queries.");
-	const conditions = [eq(ledgerArtifacts.tenantId, scopes.tenantId), eq(ledgerArtifacts.projectId, scopes.projectId)];
+	const conditions = [projectScopedWhere(ledgerArtifacts, scopes)];
 	if (artifactId) conditions.push(eq(ledgerArtifacts.id, artifactId));
 	if (taskId) conditions.push(eq(ledgerArtifacts.taskId, taskId));
 	if (toolCallId) conditions.push(eq(ledgerArtifacts.toolCallId, toolCallId));
@@ -224,25 +209,25 @@ const getLedgerArtifacts = (db) => async (params) => {
 * Get ledger artifacts by context ID
 */
 const getLedgerArtifactsByContext = (db) => async (params) => {
-	return await db.select().from(ledgerArtifacts).where(and(eq(ledgerArtifacts.tenantId, params.scopes.tenantId), eq(ledgerArtifacts.projectId, params.scopes.projectId), eq(ledgerArtifacts.contextId, params.contextId)));
+	return await db.select().from(ledgerArtifacts).where(and(projectScopedWhere(ledgerArtifacts, params.scopes), eq(ledgerArtifacts.contextId, params.contextId)));
 };
 /**
 * Delete ledger artifacts by task ID
 */
 const deleteLedgerArtifactsByTask = (db) => async (params) => {
-	return (await db.delete(ledgerArtifacts).where(and(eq(ledgerArtifacts.tenantId, params.scopes.tenantId), eq(ledgerArtifacts.projectId, params.scopes.projectId), eq(ledgerArtifacts.taskId, params.taskId))).returning()).length > 0;
+	return (await db.delete(ledgerArtifacts).where(and(projectScopedWhere(ledgerArtifacts, params.scopes), eq(ledgerArtifacts.taskId, params.taskId))).returning()).length > 0;
 };
 /**
 * Delete ledger artifacts by context ID
 */
 const deleteLedgerArtifactsByContext = (db) => async (params) => {
-	return (await db.delete(ledgerArtifacts).where(and(eq(ledgerArtifacts.tenantId, params.scopes.tenantId), eq(ledgerArtifacts.projectId, params.scopes.projectId), eq(ledgerArtifacts.contextId, params.contextId))).returning()).length > 0;
+	return (await db.delete(ledgerArtifacts).where(and(projectScopedWhere(ledgerArtifacts, params.scopes), eq(ledgerArtifacts.contextId, params.contextId))).returning()).length > 0;
 };
 /**
 * Count ledger artifacts by task ID
 */
 const countLedgerArtifactsByTask = (db) => async (params) => {
-	const countValue = (await db.select({ count: count() }).from(ledgerArtifacts).where(and(eq(ledgerArtifacts.tenantId, params.scopes.tenantId), eq(ledgerArtifacts.projectId, params.scopes.projectId), eq(ledgerArtifacts.taskId, params.taskId))))[0]?.count;
+	const countValue = (await db.select({ count: count() }).from(ledgerArtifacts).where(and(projectScopedWhere(ledgerArtifacts, params.scopes), eq(ledgerArtifacts.taskId, params.taskId))))[0]?.count;
 	return typeof countValue === "string" ? parseInt(countValue, 10) : countValue || 0;
 };