@oomol-lab/open-connector 1.6.5 → 1.8.0

package/src/server/storage/{postgres-runtime-store.js → postgres/runtime-store.js}

@@ -1,13 +1,18 @@
 import { Pool } from "pg";
-import { parseRuntimeActionHttpResult } from "../api/runtime-api.js";
-import { PlainTextSecretCodec } from "../secrets/secret-codec-core.js";
-import { ConnectionRequestStore } from "./connection-request-store.js";
-import { assertPostgresSchemaReady } from "./postgres-migrations.js";
-import { listRunLogs, parseJson, readRunLogRow, readRuntimePolicyRow, readRuntimeTokenRow, readString, runtimeTokenColumns, } from "./runtime-sql.js";
-import { DEFAULT_RUN_LIMIT } from "./runtime-store.js";
+import { parseRuntimeActionHttpResult } from "../../api/runtime-api.js";
+import { PlainTextSecretCodec } from "../../secrets/secret-codec-core.js";
+import { ConnectionRequestStore } from "../connection-request-store.js";
+import { SqlConnectionStore } from "../connection-store.js";
+import { listRunLogs, parseJson, readRunLogRow, readRuntimePolicyRow, readRuntimeTokenRow, readString, runtimeTokenColumns, } from "../runtime-sql.js";
+import { DEFAULT_RUN_LIMIT } from "../runtime-store.js";
+import { SaasProjectStore } from "../saas-project-store.js";
+import { SqlTriggerStore } from "../trigger-store.js";
+import { assertPostgresSchemaReady } from "./migrations.js";
 export class PostgresRuntimeDatabase {
+    saasProjectStore;
     connectionRequestStore;
     connectionStore;
+    triggerStore;
     oauthClientConfigStore;
     oauthStateStore;
     runtimeTokenStore;
@@ -20,7 +25,7 @@ export class PostgresRuntimeDatabase {
     constructor(pool, options) {
         this.pool = pool;
         this.secretCodec = options.secretCodec ?? new PlainTextSecretCodec();
-        this.connectionRequestStore = new ConnectionRequestStore((statements) => runInTransaction(pool, async (client) => {
+        const transaction = (statements) => runInTransaction(pool, async (client) => {
             // Serialize request transitions across processes, including first requests with no row to lock.
             await client.query("select pg_advisory_xact_lock(1326382671, 2)");
             const results = [];
@@ -29,8 +34,11 @@ export class PostgresRuntimeDatabase {
                 results.push((await client.query(sql.replaceAll("?", () => `$${++index}`), values)).rows);
             }
             return results;
-        }), this.secretCodec);
-        this.connectionStore = new PostgresConnectionStore(pool, this.secretCodec);
+        });
+        this.connectionRequestStore = new ConnectionRequestStore(transaction, this.secretCodec);
+        this.connectionStore = new SqlConnectionStore(transaction, this.secretCodec);
+        this.triggerStore = new SqlTriggerStore(transaction, this.secretCodec);
+        this.saasProjectStore = new SaasProjectStore(transaction, this.secretCodec);
         this.oauthClientConfigStore = new PostgresOAuthClientConfigStore(pool, this.secretCodec);
         this.oauthStateStore = new PostgresOAuthStateStore(pool, this.secretCodec);
         this.runtimeTokenStore = new PostgresRuntimeTokenStore(pool);
@@ -63,8 +71,13 @@ export class PostgresRuntimeDatabase {
     }
     async resetRuntimeData() {
         await runInTransaction(this.pool, async (client) => {
+            await client.query("select pg_advisory_xact_lock(1326382671, 2)");
             await client.query(`
-        delete from connections;
+        delete from oauth_sources;
+        delete from saas_cleanup;
+        delete from managed_project;
+        delete from trigger_subscriptions;
+      delete from connections;
         delete from oauth_client_configs;
         delete from oauth_states;
         delete from connection_requests;
@@ -79,7 +92,37 @@ export class PostgresRuntimeDatabase {
     }
     async rotateSecretCodec(nextSecretCodec) {
         await runInTransaction(this.pool, async (client) => {
-            await client.query("lock table connections, oauth_client_configs, oauth_states, connection_requests, idempotency_records in access exclusive mode");
+            await client.query("select pg_advisory_xact_lock(1326382671, 2)");
+            await client.query("lock table connections, oauth_client_configs, oauth_states, connection_requests, idempotency_records, managed_project, oauth_sources, saas_cleanup, instance_identity, trigger_subscriptions in access exclusive mode");
+            const project = await client.query("select value from managed_project where id = 1");
+            if (project.rows.length && !nextSecretCodec.encrypted)
+                throw new Error("SaaS project configuration requires encrypted storage.");
+            for (const row of project.rows) {
+                const value = await nextSecretCodec.encode(await this.secretCodec.decode(readString(row, "value")));
+                await client.query("update managed_project set value = $1 where id = 1", [value]);
+            }
+            const candidates = await client.query("select id, candidate_value from connection_requests where candidate_value is not null");
+            for (const row of candidates.rows) {
+                const value = await nextSecretCodec.encode(await this.secretCodec.decode(readString(row, "candidate_value")));
+                await client.query("update connection_requests set candidate_value = $1 where id = $2", [
+                    value,
+                    readString(row, "id"),
+                ]);
+            }
+            const returnUris = await client.query("select id, return_uri from connection_requests where return_uri is not null");
+            for (const row of returnUris.rows) {
+                const value = await nextSecretCodec.encode(await this.secretCodec.decode(readString(row, "return_uri")));
+                await client.query("update connection_requests set return_uri = $1 where id = $2", [
+                    value,
+                    readString(row, "id"),
+                ]);
+            }
+            const triggerRows = await client.query("select id, value from trigger_subscriptions");
+            for (const row of triggerRows.rows)
+                await client.query("update trigger_subscriptions set value = $1 where id = $2", [
+                    await nextSecretCodec.encode(await this.secretCodec.decode(readString(row, "value"))),
+                    readString(row, "id"),
+                ]);
             const connectionRows = await client.query("select service, connection_name, value from connections");
             const connections = await Promise.all(connectionRows.rows.map(async (row) => ({
                 service: readString(row, "service"),
@@ -167,86 +210,6 @@ class PostgresMarketplaceStore {
         await this.pool.query("insert into provider_preferences (service, enabled, created_at, updated_at) values ($1, $2, $3, $4) on conflict(service) do update set enabled = excluded.enabled, updated_at = excluded.updated_at", [preference.service, preference.enabled, preference.createdAt, preference.updatedAt]);
     }
 }
-class PostgresConnectionStore {
-    pool;
-    secretCodec;
-    constructor(pool, secretCodec) {
-        this.pool = pool;
-        this.secretCodec = secretCodec;
-    }
-    async get(service, connectionName) {
-        const result = await this.pool.query("select id, revision, value from connections where service = $1 and connection_name = $2", [service, connectionName]);
-        const row = result.rows[0];
-        return row
-            ? {
-                id: readString(row, "id"),
-                revision: readString(row, "revision"),
-                service,
-                connectionName,
-                credential: parseJson(await this.secretCodec.decode(readString(row, "value"))),
-            }
-            : undefined;
-    }
-    async set(service, connectionName, credential) {
-        const result = await this.pool.query(`
-        insert into connections (id, revision, service, connection_name, value, updated_at)
-        values ($1, $2, $3, $4, $5, $6)
-        on conflict(service, connection_name) do update set
-          revision = excluded.revision,
-          value = excluded.value,
-          updated_at = excluded.updated_at
-        returning id, revision
-      `, [
-            crypto.randomUUID(),
-            crypto.randomUUID(),
-            service,
-            connectionName,
-            await this.secretCodec.encode(JSON.stringify(credential)),
-            new Date().toISOString(),
-        ]);
-        const row = result.rows[0];
-        return {
-            id: readString(row, "id"),
-            revision: readString(row, "revision"),
-            service,
-            connectionName,
-            credential,
-        };
-    }
-    async updateCredential(input) {
-        const result = await this.pool.query(`
-        update connections
-        set revision = $1, value = $2, updated_at = $3
-        where service = $4 and connection_name = $5 and id = $6 and revision = $7
-        returning id
-      `, [
-            crypto.randomUUID(),
-            await this.secretCodec.encode(JSON.stringify(input.credential)),
-            new Date().toISOString(),
-            input.service,
-            input.connectionName,
-            input.id,
-            input.revision,
-        ]);
-        return (result.rowCount ?? 0) > 0;
-    }
-    async delete(service, connectionName) {
-        await this.pool.query("delete from connections where service = $1 and connection_name = $2", [
-            service,
-            connectionName,
-        ]);
-    }
-    async list() {
-        const result = await this.pool.query("select id, revision, service, connection_name, value from connections order by service, connection_name");
-        return await Promise.all(result.rows.map(async (row) => ({
-            id: readString(row, "id"),
-            revision: readString(row, "revision"),
-            service: readString(row, "service"),
-            connectionName: readString(row, "connection_name"),
-            credential: parseJson(await this.secretCodec.decode(readString(row, "value"))),
-        })));
-    }
-}
 class PostgresOAuthClientConfigStore {
     pool;
     secretCodec;
@@ -313,7 +276,7 @@ class PostgresRuntimeTokenStore {
         insert into runtime_tokens (
           ${runtimeTokenColumns}
         )
-        values ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+        values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
       `, [
             record.id,
             record.name,
@@ -322,6 +285,7 @@ class PostgresRuntimeTokenStore {
             JSON.stringify(record.blockedActions),
             JSON.stringify(record.allowedProxies),
             JSON.stringify(record.allowedConnections ?? []),
+            JSON.stringify(record.allowedTriggers ?? []),
             record.createdAt,
             record.lastUsedAt ?? null,
         ]);
@@ -346,14 +310,15 @@ class PostgresRuntimeTokenStore {
     async updatePolicy(id, policy) {
         const result = await this.pool.query(`
         update runtime_tokens
-        set allowed_actions = $1, blocked_actions = $2, allowed_proxies = $3, allowed_connections = $4
-        where id = $5
+        set allowed_actions = $1, blocked_actions = $2, allowed_proxies = $3, allowed_connections = $4, allowed_triggers = $5
+        where id = $6
         returning ${runtimeTokenColumns}
       `, [
             JSON.stringify(policy.allowedActions),
             JSON.stringify(policy.blockedActions),
             JSON.stringify(policy.allowedProxies),
             JSON.stringify(policy.allowedConnections ?? []),
+            JSON.stringify(policy.allowedTriggers ?? []),
             id,
         ]);
         const row = result.rows[0];

package/src/server/storage/runtime-database.d.ts

@@ -2,14 +2,18 @@ import type { IConnectionStore } from "../../connection-service.ts";
 import type { IMarketplaceStore } from "../../marketplace/marketplace-service.ts";
 import type { IOAuthClientConfigStore } from "../../oauth/oauth-client-config-service.ts";
 import type { IOAuthStateStore } from "../../oauth/oauth-flow-service.ts";
+import type { TriggerStore } from "../../triggers/store.ts";
 import type { ConnectionRequestStore } from "./connection-request-store.ts";
 import type { IIdempotencyStore } from "./idempotency-store.ts";
 import type { IRuntimePolicyStore } from "./runtime-policy-store.ts";
 import type { IRunLogStore } from "./runtime-store.ts";
 import type { IRuntimeTokenStore } from "./runtime-token-service.ts";
+import type { SaasProjectStore } from "./saas-project-store.ts";
 export interface RuntimeDatabase {
+    saasProjectStore: SaasProjectStore;
     connectionRequestStore: ConnectionRequestStore;
     connectionStore: IConnectionStore;
+    triggerStore: TriggerStore;
     oauthClientConfigStore: IOAuthClientConfigStore;
     oauthStateStore: IOAuthStateStore;
     runtimeTokenStore: IRuntimeTokenStore;

package/src/server/storage/runtime-sql.d.ts

@@ -7,7 +7,7 @@ import type { RuntimeTokenRecord } from "./runtime-token-service.ts";
 /** One row a runtime store backend read back from its database driver. */
 export type RuntimeRow = Record<string, unknown>;
 /** The `runtime_tokens` columns every token query reads back, in the order `readRuntimeTokenRow` decodes. */
-export declare const runtimeTokenColumns = "id, name, token_hash, allowed_actions, blocked_actions, allowed_proxies, allowed_connections, created_at, last_used_at";
+export declare const runtimeTokenColumns = "id, name, token_hash, allowed_actions, blocked_actions, allowed_proxies, allowed_connections, allowed_triggers, created_at, last_used_at";
 /** Read a column the query selected as a string, rejecting anything the schema cannot produce. */
 export declare function readString(row: RuntimeRow, key: string): string;
 /** Parse a JSON column, trusting the shape the store wrote. */

package/src/server/storage/runtime-sql.js

@@ -1,6 +1,6 @@
 import { decodeRunLogCursor, encodeRunLogCursor } from "./runtime-store.js";
 /** The `runtime_tokens` columns every token query reads back, in the order `readRuntimeTokenRow` decodes. */
-export const runtimeTokenColumns = "id, name, token_hash, allowed_actions, blocked_actions, allowed_proxies, allowed_connections, created_at, last_used_at";
+export const runtimeTokenColumns = "id, name, token_hash, allowed_actions, blocked_actions, allowed_proxies, allowed_connections, allowed_triggers, created_at, last_used_at";
 /** Read a column the query selected as a string, rejecting anything the schema cannot produce. */
 export function readString(row, key) {
     const value = row[key];
@@ -32,6 +32,7 @@ export function readRuntimeTokenRow(row) {
         blockedActions: parseJson(readString(row, "blocked_actions")),
         allowedProxies: parseJson(readString(row, "allowed_proxies")),
         allowedConnections: parseJson(readOptionalString(row, "allowed_connections") ?? "[]"),
+        allowedTriggers: parseJson(readString(row, "allowed_triggers")),
         createdAt: readString(row, "created_at"),
         lastUsedAt: readOptionalString(row, "last_used_at"),
     };

package/src/server/storage/runtime-store.d.ts

@@ -7,6 +7,7 @@ export type RunLogCaller = "http" | "mcp" | "web";
  */
 export interface RunLog {
     id: string;
+    remoteExecutionId?: string;
     service: string;
     actionId: string;
     caller: RunLogCaller;

package/src/server/storage/runtime-token-service.d.ts

@@ -8,6 +8,7 @@ export interface RuntimeTokenRecord {
     blockedActions: string[];
     allowedProxies: string[];
     allowedConnections: string[];
+    allowedTriggers?: string[];
     createdAt: string;
     lastUsedAt?: string;
 }
@@ -18,6 +19,7 @@ export interface RuntimeTokenSummary {
     blockedActions: string[];
     allowedProxies: string[];
     allowedConnections: string[];
+    allowedTriggers?: string[];
     createdAt: string;
     lastUsedAt?: string;
 }

package/src/server/storage/runtime-token-service.js

@@ -23,6 +23,7 @@ export class RuntimeTokenService {
             blockedActions: policy.blockedActions,
             allowedProxies: policy.allowedProxies,
             allowedConnections: policy.allowedConnections ?? [],
+            allowedTriggers: policy.allowedTriggers ?? [],
             createdAt: now,
         };
         await this.store.add(record);
@@ -54,6 +55,7 @@ export class RuntimeTokenService {
             blockedActions: matched.blockedActions,
             allowedProxies: matched.allowedProxies,
             allowedConnections: matched.allowedConnections ?? [],
+            allowedTriggers: matched.allowedTriggers ?? [],
         };
     }
     async verifyToken(token) {
@@ -83,6 +85,7 @@ export function summarizeRuntimeToken(record) {
         blockedActions: record.blockedActions,
         allowedProxies: record.allowedProxies,
         allowedConnections: record.allowedConnections,
+        allowedTriggers: record.allowedTriggers ?? [],
         createdAt: record.createdAt,
         lastUsedAt: record.lastUsedAt,
     };

package/src/server/storage/saas-project-store.d.ts

@@ -0,0 +1,77 @@
+import type { StoredSaasConnection } from "../../connection-service.ts";
+import type { ISecretCodec } from "../secrets/secret-codec-core.ts";
+import type { RequestStatement, RequestTransaction } from "./connection-request-store.ts";
+import type { RuntimeRow } from "./runtime-sql.ts";
+export interface ManagedProject {
+    id: string;
+    projectId: string;
+    baseUrl: string;
+    apiKey: string;
+}
+interface OAuthSourceRecord {
+    service: string;
+    managedProjectId: string;
+    projectId: string;
+    providerConfigId: string;
+}
+export interface SaasCleanup {
+    id: string;
+    managedProjectId: string;
+    providerConfigId: string;
+    externalUserId: string;
+    remoteRequestId: string | null;
+    connectedAccountId: string | null;
+    leaseId: string;
+    attempts: number;
+    service: string | null;
+    requestExpiresAt: string | null;
+}
+export interface InstanceSnapshot {
+    instanceId: string;
+    connections: number;
+    requests: number;
+    sources: number;
+    projects: number;
+    cleanup: number;
+}
+export interface ResetInstanceInput {
+    expectedInstanceId: string;
+    newInstanceId: string;
+}
+/** Queue references before removing their owning rows in the same transaction. */
+export declare function queueSaasConnections(where: string, values: RequestStatement["values"]): RequestStatement;
+export declare function queueSaasRequests(where: string, values: RequestStatement["values"]): RequestStatement;
+/** Persistent project identity, default sources and ordinary account deletion work. */
+export declare class SaasProjectStore {
+    private readonly transaction;
+    private readonly codec;
+    constructor(transaction: RequestTransaction, codec: ISecretCodec);
+    getInstanceId(): Promise<string>;
+    getProject(): Promise<ManagedProject | undefined>;
+    saveProject(project: ManagedProject): Promise<boolean>;
+    deleteProject(id: string): Promise<boolean>;
+    listSources(): Promise<OAuthSourceRecord[]>;
+    getSource(service: string): Promise<{
+        managedProjectId: string;
+        providerConfigId: string;
+    } | undefined>;
+    setSource(service: string, source: {
+        managedProjectId: string;
+        providerConfigId: string;
+    } | undefined): Promise<boolean>;
+    getCleanupStats(): Promise<{
+        pending: number;
+        manual: number;
+        paused: boolean;
+    }>;
+    claimCleanup(now: number, leaseMs?: number): Promise<SaasCleanup | undefined>;
+    saveCleanupAccount(task: SaasCleanup, accountId: string): Promise<boolean>;
+    pauseCleanup(task: SaasCleanup, rejectedKey: string): Promise<void>;
+    inspectInstance(): Promise<InstanceSnapshot>;
+    /** Offline clone maintenance: every delete is guarded by the old identity in the same atomic batch. */
+    resetInstance(input: ResetInstanceInput): Promise<"reset" | "already_reset" | "conflict">;
+    finishCleanup(task: SaasCleanup): Promise<boolean>;
+    retryCleanup(task: SaasCleanup, nextAttemptAt: number, errorCode: string, manual?: boolean): Promise<boolean>;
+}
+export declare function readSaasConnection(row: RuntimeRow, codec: ISecretCodec): Promise<StoredSaasConnection>;
+export {};

package/src/server/storage/saas-project-store.js

@@ -0,0 +1,273 @@
+/** Queue references before removing their owning rows in the same transaction. */
+export function queueSaasConnections(where, values) {
+    return {
+        sql: `insert into saas_cleanup
+      (id, managed_project_id, provider_config_id, external_user_id, remote_account_id, created_at, service)
+      select 'account:' || managed_project_id || ':' || remote_account_id,
+        managed_project_id, provider_config_id, external_user_id, remote_account_id, ?, service
+      from connections where source = 'saas' and (${where})
+      on conflict (id) do nothing`,
+        values: [Date.now(), ...values],
+    };
+}
+export function queueSaasRequests(where, values) {
+    return {
+        sql: `insert into saas_cleanup
+      (id, managed_project_id, provider_config_id, external_user_id, remote_request_id, remote_account_id, status, created_at, service, request_expires_at)
+      select 'request:' || id, managed_project_id, provider_config_id, external_user_id,
+        remote_request_id, remote_account_id,
+        case when remote_request_id is null and remote_account_id is null then 'manual' else 'pending' end, ?, service, expires_at
+      from connection_requests where kind = 'saas' and phase <> 'completed' and (${where})
+      on conflict (id) do nothing`,
+        values: [Date.now(), ...values],
+    };
+}
+/** Persistent project identity, default sources and ordinary account deletion work. */
+export class SaasProjectStore {
+    transaction;
+    codec;
+    constructor(transaction, codec) {
+        this.transaction = transaction;
+        this.codec = codec;
+    }
+    async getInstanceId() {
+        const [, [row]] = await this.transaction([
+            {
+                sql: "insert into instance_identity (id, instance_id) values (1, ?) on conflict (id) do nothing",
+                values: [crypto.randomUUID()],
+            },
+            { sql: "select instance_id from instance_identity where id = 1", values: [] },
+        ]);
+        return row.instance_id;
+    }
+    async getProject() {
+        const [[row]] = await this.transaction([
+            { sql: "select managed_project_id, project_id, base_url, value from managed_project where id = 1", values: [] },
+        ]);
+        return row
+            ? {
+                id: row.managed_project_id,
+                projectId: row.project_id,
+                baseUrl: row.base_url,
+                apiKey: await this.codec.decode(row.value),
+            }
+            : undefined;
+    }
+    async saveProject(project) {
+        if (!this.codec.encrypted)
+            throw new Error("SaaS project configuration requires encrypted storage.");
+        const value = await this.codec.encode(project.apiKey);
+        const [[row]] = await this.transaction([
+            {
+                sql: `insert into managed_project (id, managed_project_id, project_id, base_url, value)
+        values (1, ?, ?, ?, ?) on conflict (id) do update set value = excluded.value, cleanup_paused = 0
+        where managed_project.managed_project_id = excluded.managed_project_id
+          and managed_project.project_id = excluded.project_id and managed_project.base_url = excluded.base_url
+        returning managed_project_id`,
+                values: [project.id, project.projectId, project.baseUrl, value],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async deleteProject(id) {
+        const [[row]] = await this.transaction([
+            {
+                sql: `delete from managed_project where managed_project_id = ?
+        and not exists (select 1 from oauth_sources where managed_project_id = ?)
+        and not exists (select 1 from connections where managed_project_id = ?)
+        and not exists (select 1 from connection_requests where managed_project_id = ? and phase <> 'completed')
+        and not exists (select 1 from saas_cleanup where managed_project_id = ?) returning id`,
+                values: [id, id, id, id, id],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async listSources() {
+        const [rows] = await this.transaction([
+            {
+                sql: `select s.service, s.managed_project_id, p.project_id, s.provider_config_id
+        from oauth_sources s join managed_project p on p.managed_project_id = s.managed_project_id`,
+                values: [],
+            },
+        ]);
+        return rows.map((row) => ({
+            service: row.service,
+            managedProjectId: row.managed_project_id,
+            projectId: row.project_id,
+            providerConfigId: row.provider_config_id,
+        }));
+    }
+    async getSource(service) {
+        const [[row]] = await this.transaction([
+            { sql: "select managed_project_id, provider_config_id from oauth_sources where service = ?", values: [service] },
+        ]);
+        return row
+            ? { managedProjectId: row.managed_project_id, providerConfigId: row.provider_config_id }
+            : undefined;
+    }
+    async setSource(service, source) {
+        if (!source) {
+            await this.transaction([{ sql: "delete from oauth_sources where service = ?", values: [service] }]);
+            return true;
+        }
+        const [[row]] = await this.transaction([
+            {
+                sql: `insert into oauth_sources (service, managed_project_id, provider_config_id)
+        select ?, ?, ? where exists (select 1 from managed_project where managed_project_id = ?)
+        on conflict (service) do update set managed_project_id = excluded.managed_project_id,
+        provider_config_id = excluded.provider_config_id returning service`,
+                values: [service, source.managedProjectId, source.providerConfigId, source.managedProjectId],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async getCleanupStats() {
+        const [rows, [project]] = await this.transaction([
+            { sql: "select status, count(*) as count from saas_cleanup group by status", values: [] },
+            { sql: "select cleanup_paused from managed_project where id = 1", values: [] },
+        ]);
+        return {
+            paused: project?.cleanup_paused === 1,
+            pending: Number(rows.find((row) => row.status === "pending")?.count ?? 0),
+            manual: Number(rows.find((row) => row.status === "manual")?.count ?? 0),
+        };
+    }
+    async claimCleanup(now, leaseMs = 45_000) {
+        const leaseId = crypto.randomUUID();
+        const [[row]] = await this.transaction([
+            {
+                sql: `update saas_cleanup set lease_id = ?, lease_until = ?
+        where id = (select id from saas_cleanup where status = 'pending' and next_attempt_at <= ?
+        and exists (select 1 from managed_project where managed_project_id = saas_cleanup.managed_project_id and cleanup_paused = 0)
+        and (lease_until is null or lease_until <= ?) order by created_at, id limit 1)
+        and (lease_until is null or lease_until <= ?) returning *`,
+                values: [leaseId, now + leaseMs, now, now, now],
+            },
+        ]);
+        return row
+            ? {
+                id: row.id,
+                managedProjectId: row.managed_project_id,
+                providerConfigId: row.provider_config_id,
+                externalUserId: row.external_user_id,
+                remoteRequestId: row.remote_request_id,
+                connectedAccountId: row.remote_account_id,
+                leaseId,
+                attempts: Number(row.attempts),
+                service: row.service,
+                requestExpiresAt: row.request_expires_at,
+            }
+            : undefined;
+    }
+    async saveCleanupAccount(task, accountId) {
+        const [[row]] = await this.transaction([
+            {
+                sql: "update saas_cleanup set remote_account_id = ? where id = ? and lease_id = ? and lease_until > ? returning id",
+                values: [accountId, task.id, task.leaseId, Date.now()],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async pauseCleanup(task, rejectedKey) {
+        const [[project]] = await this.transaction([
+            {
+                sql: "select value from managed_project where managed_project_id = ?",
+                values: [task.managedProjectId],
+            },
+        ]);
+        if (!project || (await this.codec.decode(project.value)) !== rejectedKey)
+            return;
+        await this.transaction([
+            {
+                sql: `update managed_project set cleanup_paused = 1 where managed_project_id = ? and value = ?
+        and exists (select 1 from saas_cleanup where id = ? and lease_id = ? and lease_until > ?)`,
+                values: [task.managedProjectId, project.value, task.id, task.leaseId, Date.now()],
+            },
+        ]);
+    }
+    async inspectInstance() {
+        await this.getInstanceId();
+        const [[row]] = await this.transaction([
+            {
+                sql: `select instance_id,
+        (select count(*) from connections where source = 'saas') as connections,
+        (select count(*) from connection_requests where kind = 'saas') as requests,
+        (select count(*) from oauth_sources) as sources,
+        (select count(*) from managed_project) as projects,
+        (select count(*) from saas_cleanup) as cleanup
+        from instance_identity where id = 1`,
+                values: [],
+            },
+        ]);
+        return {
+            instanceId: row.instance_id,
+            connections: Number(row.connections),
+            requests: Number(row.requests),
+            sources: Number(row.sources),
+            projects: Number(row.projects),
+            cleanup: Number(row.cleanup),
+        };
+    }
+    /** Offline clone maintenance: every delete is guarded by the old identity in the same atomic batch. */
+    async resetInstance(input) {
+        if (!input.expectedInstanceId || !input.newInstanceId || input.expectedInstanceId === input.newInstanceId)
+            throw new Error("Instance reset requires distinct non-empty old and new identities.");
+        const guard = "exists (select 1 from instance_identity where id = 1 and instance_id = ?)";
+        const results = await this.transaction([
+            ...[
+                "delete from connections where source = 'saas' and",
+                "delete from connection_requests where kind = 'saas' and",
+                "delete from oauth_sources where",
+                "delete from saas_cleanup where",
+                "delete from managed_project where",
+            ].map((sql) => ({ sql: `${sql} ${guard}`, values: [input.expectedInstanceId] })),
+            {
+                sql: "update instance_identity set instance_id = ? where id = 1 and instance_id = ? returning instance_id",
+                values: [input.newInstanceId, input.expectedInstanceId],
+            },
+            { sql: "select instance_id from instance_identity where id = 1", values: [] },
+        ]);
+        if (results[5].length)
+            return "reset";
+        return results[6][0]?.instance_id === input.newInstanceId ? "already_reset" : "conflict";
+    }
+    async finishCleanup(task) {
+        const [[row]] = await this.transaction([
+            {
+                sql: "delete from saas_cleanup where id = ? and lease_id = ? and lease_until > ? returning id",
+                values: [task.id, task.leaseId, Date.now()],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async retryCleanup(task, nextAttemptAt, errorCode, manual = false) {
+        const [[row]] = await this.transaction([
+            {
+                sql: `update saas_cleanup set lease_id = null, lease_until = null, attempts = attempts + 1,
+        next_attempt_at = ?, error_code = ?, status = ? where id = ? and lease_id = ? and lease_until > ? returning id`,
+                values: [nextAttemptAt, errorCode, manual ? "manual" : "pending", task.id, task.leaseId, Date.now()],
+            },
+        ]);
+        return row !== undefined;
+    }
+}
+export async function readSaasConnection(row, codec) {
+    const display = JSON.parse(await codec.decode(row.value));
+    return {
+        source: "saas",
+        id: row.id,
+        revision: row.revision,
+        service: row.service,
+        connectionName: row.connection_name,
+        reference: {
+            managedProjectId: row.managed_project_id,
+            providerConfigId: row.provider_config_id,
+            externalUserId: row.external_user_id,
+            connectedAccountId: row.remote_account_id,
+            localRequestId: row.local_request_id,
+        },
+        profile: display.profile,
+        status: display.status,
+        comment: display.comment,
+    };
+}