@keystrokehq/keystroke 0.0.173 → 0.0.175

package/dist/{dist-Dz0i7l87.cjs → dist-CIhk3fW1.cjs}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-DHdmVzO2.cjs");
-const require_dist$1 = require("./dist--zLOSTcG.cjs");
+const require_dist$1 = require("./dist-B3WT5qgl.cjs");
 let node_async_hooks = require("node:async_hooks");
 require("node:fs");
 let zod_v3 = require("zod/v3");
@@ -13258,7 +13258,7 @@ async function connectMcpServer(name, options) {
 }
 async function createTransport(url, transport, requestInit, fetchImpl) {
 	if (transport === "sse") {
-		const { SSEClientTransport } = await Promise.resolve().then(() => require("./sse-D1mtozXN.cjs"));
+		const { SSEClientTransport } = await Promise.resolve().then(() => require("./sse-CO21wkJ1.cjs"));
 		return new SSEClientTransport(url, {
 			requestInit,
 			fetch: fetchImpl
@@ -17163,12 +17163,6 @@ function credentialScopeAnd(scopeType, ...conditions) {
 async function selectCredentialInstanceById$1(id) {
 	return (await getDb$1().select().from(credentialInstances).where(eq(credentialInstances.id, id)).limit(1))[0];
 }
-async function listCredentialInstancesByScope$1(options) {
-	const db = getDb$1();
-	const conditions = [options.scopeId === null ? and(eq(credentialInstances.scopeType, options.scopeType), isNull(credentialInstances.scopeId)) : and(eq(credentialInstances.scopeType, options.scopeType), eq(credentialInstances.scopeId, options.scopeId))];
-	if (options.slug) conditions.push(eq(credentialInstances.slug, options.slug));
-	return db.select().from(credentialInstances).where(credentialScopeAnd(options.scopeType, ...conditions));
-}
 async function selectCredentialInstancesForScope$1(slug, scopeType, scopeId) {
 	const db = getDb$1();
 	const scopeCondition = scopeId === null ? and(eq(credentialInstances.scopeType, scopeType), isNull(credentialInstances.scopeId)) : and(eq(credentialInstances.scopeType, scopeType), eq(credentialInstances.scopeId, scopeId));
@@ -17570,6 +17564,20 @@ const organizations = pgTable("organizations", {
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull(),
 	deletedAt: timestamp("deleted_at", { withTimezone: true })
 }, (table) => [uniqueIndex$1("organizations_slug_unique").on(table.slug)]);
+const apps = pgTable("apps", {
+	id: text$1("id").primaryKey(),
+	organizationId: text$1("organization_id").references(() => organizations.id, { onDelete: "cascade" }),
+	slug: text$1("slug").notNull(),
+	name: text$1("name").notNull(),
+	description: text$1("description").notNull(),
+	category: text$1("category").notNull(),
+	logo: text$1("logo"),
+	authKind: text$1("auth_kind").$type().notNull(),
+	oauthScopes: jsonb("oauth_scopes").$type().notNull(),
+	source: text$1("source").$type().notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [uniqueIndex$1("apps_slug_idx").on(table.slug), index$1("apps_organization_id_idx").on(table.organizationId)]);
 const oauthApps = pgTable("oauth_apps", {
 	id: text$1("id").primaryKey(),
 	organizationId: text$1("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
@@ -17692,6 +17700,7 @@ buildPgSchema({
 	authDeviceCodes: { pg: authDeviceCodes },
 	authJwks: { pg: authJwks },
 	authApiKeys: { pg: authApiKeys },
+	apps: { pg: apps },
 	oauthApps: { pg: oauthApps },
 	oauthConnections: { pg: oauthConnections },
 	secretValues: { pg: secretValues }
@@ -17848,9 +17857,6 @@ async function selectCredentialInstanceById(id) {
 async function selectCredentialInstancesForScope(key, scopeType, scopeId) {
 	return (await selectCredentialInstancesForScope$1(key, scopeType, scopeId)).map(normalizeLocalRow);
 }
-async function listCredentialInstancesByScope(options) {
-	return (await listCredentialInstancesByScope$1(options)).map(normalizeLocalRow);
-}
 //#endregion
 //#region ../credentials/dist/index.mjs
 var MissingCredentialsError = class extends Error {
@@ -18026,20 +18032,6 @@ function createCredentialBackend(options = {}) {
 	}
 	return createLocalCredentialBackend(options);
 }
-const CHAIN_TO_SCOPE = {
-	organization: {
-		scopeType: require_dist$1.CREDENTIAL_SCOPE_LEVEL_TO_SCOPE_TYPE.organization,
-		contextKey: "orgId"
-	},
-	project: {
-		scopeType: require_dist$1.CREDENTIAL_SCOPE_LEVEL_TO_SCOPE_TYPE.project,
-		contextKey: "projectId"
-	},
-	user: {
-		scopeType: require_dist$1.CREDENTIAL_SCOPE_LEVEL_TO_SCOPE_TYPE.user,
-		contextKey: "userId"
-	}
-};
 function toSelectionOption(row) {
 	return {
 		id: row.id,
@@ -18112,21 +18104,12 @@ function withTenantScope(context) {
 		orgId: getServerTenantScopeId()
 	};
 }
-async function listSelectionOptions(key, context) {
-	const scoped = withTenantScope(context);
-	const rows = [];
-	rows.push(...await listCredentialInstancesByScope({
-		key,
-		scopeType: "organization",
-		scopeId: scoped.orgId
-	}));
-	const userId = resolveUserId(key, scoped);
-	if (userId) rows.push(...await listCredentialInstancesByScope({
-		key,
-		scopeType: "user",
-		scopeId: userId
-	}));
-	return rows.map(toSelectionOption);
+function scopeIdForScope(scope, key, context) {
+	switch (scope) {
+		case "organization": return context.orgId;
+		case "project": return context.projectId;
+		case "user": return resolveUserId(key, context);
+	}
 }
 async function resolveAtScope(key, scopeType, scopeId, consumer) {
 	const rows = await selectCredentialInstancesForScope(key, scopeType, scopeId);
@@ -18138,35 +18121,45 @@ async function resolveAtScope(key, scopeType, scopeId, consumer) {
 		throw error;
 	}
 }
+/**
+* Resolution order:
+*   1. A platform-provided binding (explicit instance id in `context.selection`) wins.
+*   2. A scope pinned on the requirement (`.scope("user")`) resolves only at that scope.
+*   3. Otherwise the project default, then the org default. No configurable chain.
+* If nothing matches, throw — there is no binding.
+*/
 async function resolvePolicy(requirement, context, consumer, backend) {
-	const chainAttempted = [];
-	const selectionId = context.selection?.[requirement.key];
+	const attempted = [];
 	const materialBackend = backend ?? createCredentialBackend();
 	const scoped = withTenantScope(context);
-	for (let index = 0; index < requirement.chain.length; index++) {
-		const level = requirement.chain[index];
-		if (level === "selection") {
-			if (selectionId) {
-				chainAttempted.push("selection");
-				return resolveInstanceValue(await resolveSelectedInstance(requirement.key, selectionId, scoped, consumer), requirement, materialBackend);
-			}
-			if (index === requirement.chain.length - 1) throw new NeedsSelectionError({
-				key: requirement.key,
-				options: await listSelectionOptions(requirement.key, scoped),
-				consumer
-			});
-			continue;
-		}
-		const mapping = CHAIN_TO_SCOPE[level];
-		const scopeId = level === "user" ? resolveUserId(requirement.key, scoped) : scoped[mapping.contextKey];
-		if (!scopeId) continue;
-		chainAttempted.push(level);
-		const row = await resolveAtScope(requirement.key, mapping.scopeType, scopeId, consumer);
+	const selectionId = context.selection?.[requirement.key];
+	if (selectionId) return resolveInstanceValue(await resolveSelectedInstance(requirement.key, selectionId, scoped, consumer), requirement, materialBackend);
+	if (requirement.scope) {
+		const scopeId = scopeIdForScope(requirement.scope, requirement.key, scoped);
+		if (scopeId) {
+			attempted.push(requirement.scope);
+			const row = await resolveAtScope(requirement.key, requirement.scope, scopeId, consumer);
+			if (row) return resolveInstanceValue(row, requirement, materialBackend);
+		}
+		throw new MissingCredentialsError({
+			key: requirement.key,
+			chainAttempted: attempted.length > 0 ? attempted : [requirement.scope],
+			consumer
+		});
+	}
+	if (scoped.projectId) {
+		attempted.push("project");
+		const row = await resolveAtScope(requirement.key, "project", scoped.projectId, consumer);
+		if (row) return resolveInstanceValue(row, requirement, materialBackend);
+	}
+	if (scoped.orgId) {
+		attempted.push("organization");
+		const row = await resolveAtScope(requirement.key, "organization", scoped.orgId, consumer);
 		if (row) return resolveInstanceValue(row, requirement, materialBackend);
 	}
 	throw new MissingCredentialsError({
 		key: requirement.key,
-		chainAttempted,
+		chainAttempted: attempted,
 		consumer
 	});
 }
@@ -18489,4 +18482,4 @@ Object.defineProperty(exports, "zodToJsonSchema", {
 	}
 });
 
-//# sourceMappingURL=dist-Dz0i7l87.cjs.map
+//# sourceMappingURL=dist-CIhk3fW1.cjs.map