@keystrokehq/keystroke 0.1.88 → 0.1.90

package/dist/{dist-bKEDQL7p.mjs → dist-CBMAwfqk.mjs}

@@ -14721,6 +14721,12 @@ createRequire(import.meta.url);
 function getDb() {
 	return getDbFromContext();
 }
+function organizationScopeId() {
+	return requireOrganizationScopeId();
+}
+function eqOrganizationScope(table) {
+	return eq(table.organizationId, organizationScopeId());
+}
 function eqProjectScope(table) {
 	return eq(table.projectId, getProjectScopeId());
 }
@@ -14740,9 +14746,6 @@ async function selectActiveAgentByRoute(route) {
 		slug: agents.slug
 	}).from(agents).where(scopedAnd(agents, eq(agents.route, route), isNull(agents.deletedAt))).limit(1))[0];
 }
-function organizationScopeId() {
-	return requireOrganizationScopeId();
-}
 async function insertAgentSession(values) {
 	await getDb().insert(agentSessions).values({
 		...values,
@@ -14801,13 +14804,13 @@ async function selectActiveSkillsBySlugs(slugs) {
 	return getDb().select().from(skills).where(scopedAnd(skills, inArray(skills.slug, slugs), isNull(skills.deletedAt)));
 }
 const MESSAGE_EVENT_TYPE = "message";
-/** Org/user credentials live once in the shared org database; project scope stays per-project. */
+/** Org/user credentials live once per organization; project scope stays per-project. */
 function credentialScopeAnd(scopeType, ...conditions) {
-	if (scopeType === "project") return scopedAnd(credentialInstances, ...conditions);
-	return and(...conditions.filter(Boolean));
+	if (scopeType === "project") return scopedAnd(credentialInstances, eqOrganizationScope(credentialInstances), ...conditions);
+	return and(eqOrganizationScope(credentialInstances), ...conditions.filter(Boolean));
 }
 async function selectCredentialInstanceById(id) {
-	return (await getDb().select().from(credentialInstances).where(eq(credentialInstances.id, id)).limit(1))[0];
+	return (await getDb().select().from(credentialInstances).where(and(eqOrganizationScope(credentialInstances), eq(credentialInstances.id, id))).limit(1))[0];
 }
 async function selectCredentialInstancesForScope(appSlug, scopeType, scopeId) {
 	const db = getDb();
@@ -14816,7 +14819,7 @@ async function selectCredentialInstancesForScope(appSlug, scopeType, scopeId) {
 }
 /** Record that a credential was just resolved/used. Targeted by id; never throws on a missing row. */
 async function touchCredentialInstanceLastUsed(id) {
-	await getDb().update(credentialInstances).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq(credentialInstances.id, id));
+	await getDb().update(credentialInstances).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and(eqOrganizationScope(credentialInstances), eq(credentialInstances.id, id)));
 }
 async function listCredentialAssignmentsByTarget(options) {
 	return getDb().select().from(credentialAssignments).where(scopedAnd(credentialAssignments, eq(credentialAssignments.targetType, options.targetType), eq(credentialAssignments.targetKey, options.targetKey)));
@@ -17714,7 +17717,7 @@ var require_get_vercel_oidc_token = /* @__PURE__ */ __commonJSMin(((exports, mod
 			err = error;
 		}
 		try {
-			const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([await Promise.resolve().then(() => /* @__PURE__ */ __toESM(require_token_util())), await import("./token-CYEqvLAY.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))]);
+			const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([await Promise.resolve().then(() => /* @__PURE__ */ __toESM(require_token_util())), await import("./token-BFGvC19A.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))]);
 			if (!token || isExpired(getTokenPayload(token), options?.expirationBufferMs)) {
 				await refreshToken(options);
 				token = getVercelOidcTokenSync();
@@ -28295,4 +28298,4 @@ createIdGenerator({
 //#endregion
 export { withSpan as $, addAgentSessionDuration as A, listCredentialAssignmentsByTarget as B, safeValidateTypes as C, AISDKError as D, EventSourceParserStream as E, getAgentByRoute as F, selectCredentialInstancesForScope as G, resolveRunSourceFromTraceContext as H, getSession as I, touchCredentialInstanceLastUsed as J, setSessionStatus as K, hasSessionEventAfterSeq as L, createSession as M, decryptCredentialPayload as N, isJSONObject as O, failAgentSession as P, logSystem as Q, isDatabaseInitialized as R, safeParseJSON as S, withUserAgentSuffix as T, selectActiveSkillsBySlugs as U, listSessionEvents as V, selectCredentialInstanceById as W, captureConsole as X, touchSession as Y, getTraceContext as Z, dynamicTool as _, generateText as a, getProjectScopeId as at, jsonSchema as b, isStepCount as c, oauthConnections as ct, toUIMessageStream as d, selectOrganizationById as dt, decryptCredentialPayload$1 as et, wrapLanguageModel as f, selectProjectById as ft, asSchema as g, require_token_error as h, generateObject as i, getOrganizationScopeId as it, appendEvent as j, MESSAGE_EVENT_TYPE as k, output_exports as l, requireOrganizationScopeId as lt, require_token_util as m, eq as mt, convertToModelMessages as n, getBoundProjectScopeId as nt, hasToolCall as o, getServerTenantScopeId as ot, createGateway as p, and as pt, setSessionTitle as q, extractJsonMiddleware as r, getDb$1 as rt, isFileUIPart as s, oauthApps as st, ToolLoopAgent as t, encryptCredentialPayload as tt, readUIMessageStream as u, secretValues as ut, generateId as v, tool as w, parseJSON as x, getRuntimeEnvironmentUserAgent as y, latestSessionEventByTypes as z };
 
-//# sourceMappingURL=dist-bKEDQL7p.mjs.map
+//# sourceMappingURL=dist-CBMAwfqk.mjs.map