@oomol-lab/open-connector 1.7.0 → 1.8.0

package/src/server/storage/connection-request-store.js

@@ -1,3 +1,4 @@
+import { queueSaasConnections, queueSaasRequests } from "./saas-project-store.js";
 /** Shared SQL lifecycle for SQLite, PostgreSQL and D1. Secrets use the runtime's codec. */
 export class ConnectionRequestStore {
     transaction;
@@ -10,16 +11,7 @@ export class ConnectionRequestStore {
         const now = Date.parse(pending.createdAt);
         const value = await this.secretCodec.encode(JSON.stringify(pending));
         await this.transaction([
-            {
-                sql: "delete from connection_requests where expires_at <= ?",
-                values: [new Date(now - 86_400_000).toISOString()],
-            },
-            {
-                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_superseded',
-          error_message = 'A newer authorization request replaced this request.', value = null, updated_at = ?
-          where owner = ? and service = ? and phase = 'pending' and expires_at > ?`,
-                values: [now, pending.owner, pending.service, pending.createdAt],
-            },
+            ...this.retireRequests(pending.owner, pending.service, now),
             {
                 sql: `insert into connection_requests (id, owner, service, state, phase, status, value, expires_at, created_at, updated_at)
           values (?, ?, ?, ?, 'pending', 'initiated', ?, ?, ?, ?)`,
@@ -63,7 +55,7 @@ export class ConnectionRequestStore {
     async claim(state) {
         const [[row]] = await this.transaction([
             {
-                sql: "update connection_requests set phase = 'processing', updated_at = ? where state = ? and phase = 'pending' and expires_at > ? returning value",
+                sql: "update connection_requests set phase = 'processing', updated_at = ? where kind = 'local' and state = ? and phase = 'pending' and expires_at > ? returning value",
                 values: [Date.now(), state, new Date().toISOString()],
             },
         ]);
@@ -75,7 +67,7 @@ export class ConnectionRequestStore {
         await this.transaction([
             {
                 sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = ?, error_message = ?, value = null, updated_at = ?
-        where id = ? and phase = 'processing'`,
+        where kind = 'local' and id = ? and phase = 'processing'`,
                 values: [errorCode, errorMessage, Date.now(), id],
             },
         ]);
@@ -84,17 +76,32 @@ export class ConnectionRequestStore {
         const id = pending.target?.id ?? crypto.randomUUID();
         const revision = crypto.randomUUID();
         const value = await this.secretCodec.encode(JSON.stringify(credential));
+        const accountId = credential.authType !== "no_auth" && credential.metadata.providerAccountVerified === true
+            ? credential.profile.accountId
+            : null;
         signal?.throwIfAborted();
         const now = new Date();
-        const active = "exists (select 1 from connection_requests where id = ? and phase = 'processing')";
+        const active = "exists (select 1 from connection_requests where kind = 'local' and id = ? and phase = 'processing')";
         const write = pending.target
             ? {
-                sql: `update connections set value = ?, revision = ?, updated_at = ? where id = ? and revision = ? and ${active} returning id`,
-                values: [value, revision, now.toISOString(), id, pending.target.revision, pending.connectionRequestId],
+                sql: `update connections set value = ?, revision = ?, updated_at = ?, source = 'local',
+            managed_project_id = null, provider_config_id = null, external_user_id = null, remote_account_id = null, local_request_id = null, provider_account_id = ? where id = ? and revision = ? and ${active}
+            and (not exists (select 1 from trigger_subscriptions where connection_id = connections.id and mode <> 'resource-set' and status in ('active', 'deleting'))
+              or (provider_account_id is not null and provider_account_id = ?)) returning id`,
+                values: [
+                    value,
+                    revision,
+                    now.toISOString(),
+                    accountId,
+                    id,
+                    pending.target.revision,
+                    pending.connectionRequestId,
+                    accountId,
+                ],
             }
             : {
-                sql: `insert into connections (id, revision, service, connection_name, value, updated_at)
-        select ?, ?, ?, ?, ?, ? where ${active} returning id`,
+                sql: `insert into connections (id, revision, service, connection_name, value, updated_at, provider_account_id)
+        select ?, ?, ?, ?, ?, ?, ? where ${active} returning id`,
                 values: [
                     id,
                     revision,
@@ -102,17 +109,235 @@ export class ConnectionRequestStore {
                     pending.connectionName,
                     value,
                     now.toISOString(),
+                    accountId,
                     pending.connectionRequestId,
                 ],
             };
-        const [written] = await this.transaction([
+        const results = await this.transaction([
+            { sql: "update connections set revision = revision where id = ?", values: [id] },
+            queueSaasConnections(`id = ? and revision = ? and ${active}`, [
+                id,
+                pending.target?.revision ?? "",
+                pending.connectionRequestId,
+            ]),
             write,
             {
                 sql: `update connection_requests set phase = 'completed', status = 'connected', app_id = ?, value = null, updated_at = ?
-          where id = ? and phase = 'processing' and exists (select 1 from connections where id = ? and revision = ?)`,
+          where kind = 'local' and id = ? and phase = 'processing' and exists (select 1 from connections where id = ? and revision = ?)`,
                 values: [id, now.getTime(), pending.connectionRequestId, id, revision],
             },
         ]);
-        return written.length ? id : undefined;
+        return results[2].length ? id : undefined;
+    }
+    retireRequests(owner, service, now) {
+        const expired = "expires_at <= ?";
+        const superseded = "owner = ? and service = ? and phase = 'pending'";
+        return [
+            queueSaasRequests(expired, [new Date(now - 86_400_000).toISOString()]),
+            queueSaasRequests(superseded, [owner, service]),
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_expired',
+          value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ?
+          where kind = 'saas' and phase <> 'completed' and ${expired}`,
+                values: [now, new Date(now - 86_400_000).toISOString()],
+            },
+            {
+                sql: "delete from connection_requests where expires_at <= ?",
+                values: [new Date(now - 86_400_000).toISOString()],
+            },
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_superseded',
+          error_message = 'A newer authorization request replaced this request.', value = null, candidate_value = null,
+          lease_id = null, lease_until = null, updated_at = ? where ${superseded} and (kind = 'saas' or expires_at > ?)`,
+                values: [now, owner, service, new Date(now).toISOString()],
+            },
+        ];
+    }
+    async createSaas(pending) {
+        if (!this.secretCodec.encrypted)
+            throw new Error("SaaS requests require encrypted storage.");
+        const value = await this.secretCodec.encode(JSON.stringify(pending));
+        const leaseId = crypto.randomUUID();
+        const returnUri = pending.returnUri ? await this.secretCodec.encode(pending.returnUri) : null;
+        const now = Date.now();
+        await this.transaction([
+            ...this.retireRequests(pending.owner, pending.service, now),
+            {
+                sql: `insert into connection_requests
+          (id, owner, service, state, kind, phase, saas_phase, status, value, expires_at, created_at, updated_at,
+           managed_project_id, provider_config_id, external_user_id, lease_id, lease_until, return_uri)
+          values (?, ?, ?, ?, 'saas', 'pending', 'creating', 'initiated', ?, ?, ?, ?,
+          (select managed_project_id from managed_project where managed_project_id = ?), ?, ?, ?, ?, ?)`,
+                values: [
+                    pending.connectionRequestId,
+                    pending.owner,
+                    pending.service,
+                    crypto.randomUUID(),
+                    value,
+                    pending.expiresAt,
+                    Date.parse(pending.createdAt),
+                    now,
+                    pending.managedProjectId,
+                    pending.providerConfigId,
+                    pending.externalUserId,
+                    leaseId,
+                    now + 45_000,
+                    returnUri,
+                ],
+            },
+        ]);
+        return { pending, leaseId, phase: "creating", remoteRequestId: null, pollAttempts: 0 };
+    }
+    async claimSaas(id, owner, now = Date.now()) {
+        const leaseId = crypto.randomUUID();
+        const [[row]] = await this.transaction([
+            {
+                sql: `update connection_requests set lease_id = ?, lease_until = ?, updated_at = ?
+        where id = ? and owner = ? and kind = 'saas' and phase = 'pending' and expires_at > ?
+        and next_poll_at <= ? and (lease_until is null or lease_until <= ?) returning *`,
+                values: [leaseId, now + 45_000, now, id, owner, new Date(now - 86_400_000).toISOString(), now, now],
+            },
+        ]);
+        if (!row)
+            return undefined;
+        return {
+            pending: JSON.parse(await this.secretCodec.decode(row.value)),
+            leaseId,
+            pollAttempts: Number(row.poll_attempts),
+            phase: row.saas_phase,
+            remoteRequestId: row.remote_request_id,
+            candidate: row.candidate_value
+                ? {
+                    ...JSON.parse(await this.secretCodec.decode(row.candidate_value)),
+                    connectedAccountId: row.remote_account_id,
+                }
+                : undefined,
+        };
+    }
+    async saveSaasRequest(lease, remoteRequestId, expiresAt) {
+        const now = Date.now();
+        const [[row]] = await this.transaction([
+            {
+                sql: `update connection_requests set remote_request_id = ?, expires_at = coalesce(?, expires_at), saas_phase = 'pending', updated_at = ?
+        where id = ? and kind = 'saas' and phase = 'pending' and saas_phase = 'creating' and lease_id = ? and lease_until > ? returning id`,
+                values: [remoteRequestId, expiresAt ?? null, now, lease.pending.connectionRequestId, lease.leaseId, now],
+            },
+        ]);
+        return !!row;
+    }
+    async saveSaasCandidate(lease, candidate) {
+        const value = await this.secretCodec.encode(JSON.stringify({ profile: candidate.profile, status: candidate.status, comment: candidate.comment }));
+        const now = Date.now();
+        const [[row]] = await this.transaction([
+            {
+                sql: `update connection_requests set remote_account_id = ?, candidate_value = ?, saas_phase = 'candidate', updated_at = ?
+        where id = ? and kind = 'saas' and phase = 'pending' and saas_phase = 'pending'
+        and lease_id = ? and lease_until > ? returning id`,
+                values: [candidate.connectedAccountId, value, now, lease.pending.connectionRequestId, lease.leaseId, now],
+            },
+        ]);
+        return !!row;
+    }
+    async releaseSaas(lease, nextPollAt, failed = false) {
+        const now = Date.now();
+        const [[row]] = await this.transaction([
+            {
+                sql: `update connection_requests set lease_id = null, lease_until = null, next_poll_at = ?, poll_attempts = ?
+        where id = ? and kind = 'saas' and phase = 'pending' and lease_id = ? and lease_until > ? returning id`,
+                values: [
+                    Math.max(nextPollAt, now + 2_000),
+                    failed ? lease.pollAttempts + 1 : 0,
+                    lease.pending.connectionRequestId,
+                    lease.leaseId,
+                    now,
+                ],
+            },
+        ]);
+        return !!row;
+    }
+    async failSaas(lease, code, message) {
+        const now = Date.now();
+        const active = "id = ? and lease_id = ? and lease_until > ? and phase = 'pending' and kind = 'saas'";
+        const values = [lease.pending.connectionRequestId, lease.leaseId, now];
+        const [, rows] = await this.transaction([
+            queueSaasRequests(active, values),
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = ?, error_message = ?,
+          value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ? where ${active} returning id`,
+                values: [code, message, now, ...values],
+            },
+        ]);
+        return rows.length > 0;
+    }
+    async getSaasReturnUri(id, owner) {
+        const [[row]] = await this.transaction([
+            {
+                sql: "select return_uri from connection_requests where id = ? and owner = ? and kind = 'saas' and phase = 'completed' and expires_at > ?",
+                values: [id, owner, new Date(Date.now() - 86_400_000).toISOString()],
+            },
+        ]);
+        return row?.return_uri ? this.secretCodec.decode(row.return_uri) : undefined;
+    }
+    async cancelSaas(id, owner) {
+        await this.transaction([
+            queueSaasRequests("id = ? and owner = ?", [id, owner]),
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_cancelled',
+          value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ?
+          where id = ? and owner = ? and kind = 'saas' and phase <> 'completed'`,
+                values: [Date.now(), id, owner],
+            },
+        ]);
+    }
+    async expireSaas(now = Date.now()) {
+        await this.transaction([
+            queueSaasRequests("expires_at <= ?", [new Date(now - 86_400_000).toISOString()]),
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_expired',
+          value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ?
+          where kind = 'saas' and phase <> 'completed' and expires_at <= ?`,
+                values: [now, new Date(now - 86_400_000).toISOString()],
+            },
+        ]);
+    }
+    async completeSaas(lease) {
+        const { pending } = lease;
+        const now = Date.now();
+        const id = pending.target?.id ?? pending.connectionId;
+        const revision = crypto.randomUUID();
+        const active = `id = ? and kind = 'saas' and phase = 'pending' and saas_phase = 'candidate'
+      and lease_id = ? and lease_until > ? and expires_at > ?`;
+        const activeValues = [pending.connectionRequestId, lease.leaseId, now, new Date(now - 86_400_000).toISOString()];
+        const target = pending.target
+            ? "exists (select 1 from connections where id = ? and revision = ? and not exists (select 1 from trigger_subscriptions where connection_id = connections.id and mode <> 'resource-set' and status in ('active', 'deleting')))"
+            : "not exists (select 1 from connections where service = ? and connection_name = ?)";
+        const targetValues = pending.target ? [id, pending.target.revision] : [pending.service, pending.connectionName];
+        const results = await this.transaction([
+            { sql: "update connections set revision = revision where id = ?", values: [id] },
+            queueSaasConnections(`id = ? and revision = ? and exists (select 1 from connection_requests where ${active} and remote_account_id <> connections.remote_account_id)`, [id, pending.target?.revision ?? "", ...activeValues]),
+            {
+                sql: `insert into connections
+          (id, revision, service, connection_name, value, updated_at, source, managed_project_id, provider_config_id, external_user_id, remote_account_id, local_request_id)
+          select ?, ?, service, ?, candidate_value, ?, 'saas', managed_project_id, provider_config_id, external_user_id, remote_account_id, id
+          from connection_requests where ${active} and ${target}
+          on conflict (id) do update set revision = excluded.revision, value = excluded.value, updated_at = excluded.updated_at,
+            source = excluded.source, managed_project_id = excluded.managed_project_id, provider_config_id = excluded.provider_config_id,
+            external_user_id = excluded.external_user_id, remote_account_id = excluded.remote_account_id, local_request_id = excluded.local_request_id returning id`,
+                values: [id, revision, pending.connectionName, new Date(now).toISOString(), ...activeValues, ...targetValues],
+            },
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'connected', app_id = ?, value = null,
+          candidate_value = null, lease_id = null, lease_until = null, updated_at = ?
+          where ${active} and exists (select 1 from connections where id = ? and revision = ?) returning id`,
+                values: [id, now, ...activeValues, id, revision],
+            },
+            queueSaasRequests(active, activeValues),
+            {
+                sql: `update connection_requests set phase = 'completed', status = 'failed', error_code = 'request_key_conflict', error_message = 'The connection changed during authorization.',
+          value = null, candidate_value = null, lease_id = null, lease_until = null, updated_at = ? where ${active} returning id`,
+                values: [now, ...activeValues],
+            },
+        ]);
+        return results[3].length ? "connected" : results[5].length ? "conflict" : "lease_lost";
     }
 }

package/src/server/storage/connection-store.d.ts

@@ -0,0 +1,16 @@
+import type { IConnectionStore, StoredConnection, StoredLocalConnection } from "../../connection-service.ts";
+import type { ResolvedCredential } from "../../core/types.ts";
+import type { ISecretCodec } from "../secrets/secret-codec-core.ts";
+import type { RequestTransaction } from "./connection-request-store.ts";
+/** Connection writes share the request transaction so replacing/deleting remote references cannot lose cleanup work. */
+export declare class SqlConnectionStore implements IConnectionStore {
+    private readonly transaction;
+    private readonly codec;
+    constructor(transaction: RequestTransaction, codec: ISecretCodec);
+    private read;
+    get(service: string, connectionName: string): Promise<StoredConnection | undefined>;
+    list(): Promise<StoredConnection[]>;
+    set(service: string, connectionName: string, credential: ResolvedCredential): Promise<StoredLocalConnection>;
+    updateCredential(input: StoredLocalConnection, refresh?: boolean): Promise<boolean>;
+    delete(service: string, connectionName: string): Promise<void>;
+}

package/src/server/storage/connection-store.js

@@ -0,0 +1,119 @@
+import { HttpRequestError } from "../api/http-utils.js";
+import { queueSaasConnections, readSaasConnection } from "./saas-project-store.js";
+/** Connection writes share the request transaction so replacing/deleting remote references cannot lose cleanup work. */
+export class SqlConnectionStore {
+    transaction;
+    codec;
+    constructor(transaction, codec) {
+        this.transaction = transaction;
+        this.codec = codec;
+    }
+    async read(row) {
+        if (row.source === "saas")
+            return readSaasConnection(row, this.codec);
+        return {
+            id: row.id,
+            revision: row.revision,
+            service: row.service,
+            connectionName: row.connection_name,
+            credential: JSON.parse(await this.codec.decode(row.value)),
+        };
+    }
+    async get(service, connectionName) {
+        const [[row]] = await this.transaction([
+            {
+                sql: "select * from connections where service = ? and connection_name = ?",
+                values: [service, connectionName],
+            },
+        ]);
+        return row ? this.read(row) : undefined;
+    }
+    async list() {
+        const [rows] = await this.transaction([
+            { sql: "select * from connections order by service, connection_name", values: [] },
+        ]);
+        return Promise.all(rows.map((row) => this.read(row)));
+    }
+    async set(service, connectionName, credential) {
+        const value = await this.codec.encode(JSON.stringify(credential));
+        const [, , [row]] = await this.transaction([
+            {
+                sql: "update connections set revision = revision where service = ? and connection_name = ?",
+                values: [service, connectionName],
+            },
+            queueSaasConnections("service = ? and connection_name = ?", [service, connectionName]),
+            {
+                sql: `insert into connections (id, revision, service, connection_name, value, updated_at, provider_account_id)
+          values (?, ?, ?, ?, ?, ?, ?) on conflict (service, connection_name) do update set
+          revision = excluded.revision, value = excluded.value, updated_at = excluded.updated_at,
+          source = 'local', managed_project_id = null, provider_config_id = null, external_user_id = null,
+          remote_account_id = null, local_request_id = null, provider_account_id = excluded.provider_account_id
+          where not exists (select 1 from trigger_subscriptions where connection_id = connections.id and mode <> 'resource-set' and status in ('active', 'deleting'))
+          or (connections.provider_account_id is not null and connections.provider_account_id = excluded.provider_account_id) returning id, revision`,
+                values: [
+                    crypto.randomUUID(),
+                    crypto.randomUUID(),
+                    service,
+                    connectionName,
+                    value,
+                    new Date().toISOString(),
+                    credential.authType !== "no_auth" && credential.metadata.providerAccountVerified === true
+                        ? credential.profile.accountId
+                        : null,
+                ],
+            },
+        ]);
+        if (!row)
+            throw new HttpRequestError("connection_has_subscriptions", "Cancel or abandon remote Trigger subscriptions before replacing this connection.", 409);
+        return { id: row.id, revision: row.revision, service, connectionName, credential };
+    }
+    async updateCredential(input, refresh = false) {
+        const value = await this.codec.encode(JSON.stringify(input.credential));
+        const [, [row]] = await this.transaction([
+            { sql: "update connections set revision = revision where id = ?", values: [input.id] },
+            {
+                sql: `update connections set revision = ?, value = ?, updated_at = ?, provider_account_id = ?
+        where service = ? and connection_name = ? and id = ? and revision = ? and source = 'local'
+        and (? = 1 or not exists (select 1 from trigger_subscriptions where connection_id = connections.id and mode <> 'resource-set' and status in ('active', 'deleting'))
+        or (provider_account_id is not null and provider_account_id = ?)) returning id`,
+                values: [
+                    crypto.randomUUID(),
+                    value,
+                    new Date().toISOString(),
+                    input.credential.authType !== "no_auth" && input.credential.metadata.providerAccountVerified === true
+                        ? input.credential.profile.accountId
+                        : null,
+                    input.service,
+                    input.connectionName,
+                    input.id,
+                    input.revision,
+                    refresh ? 1 : 0,
+                    input.credential.authType !== "no_auth" && input.credential.metadata.providerAccountVerified === true
+                        ? input.credential.profile.accountId
+                        : null,
+                ],
+            },
+        ]);
+        return row !== undefined;
+    }
+    async delete(service, connectionName) {
+        const [, , , [remaining]] = await this.transaction([
+            {
+                sql: "update connections set revision = revision where service = ? and connection_name = ?",
+                values: [service, connectionName],
+            },
+            queueSaasConnections("service = ? and connection_name = ?", [service, connectionName]),
+            {
+                sql: `delete from connections where service = ? and connection_name = ? and not exists
+        (select 1 from trigger_subscriptions where connection_id = connections.id and mode <> 'resource-set' and status in ('active', 'deleting'))`,
+                values: [service, connectionName],
+            },
+            {
+                sql: "select id from connections where service = ? and connection_name = ?",
+                values: [service, connectionName],
+            },
+        ]);
+        if (remaining)
+            throw new HttpRequestError("connection_has_subscriptions", "Cancel or abandon remote Trigger subscriptions before disconnecting this connection.", 409);
+    }
+}

package/src/server/storage/node-runtime-database.js

@@ -1,5 +1,5 @@
-import { migratePostgresDatabase } from "./postgres-migrations.js";
-import { SqliteRuntimeDatabase } from "./sqlite-runtime-store.js";
+import { migratePostgresDatabase } from "./postgres/migrations.js";
+import { SqliteRuntimeDatabase } from "./sqlite/runtime-store.js";
 export async function createNodeRuntimeDatabase(options) {
     if (options.backend === "sqlite") {
         return new SqliteRuntimeDatabase(options.path, options);
@@ -7,7 +7,7 @@ export async function createNodeRuntimeDatabase(options) {
     const connectionString = options.connectionString.trim();
     assertPostgresDatabaseUrl(connectionString);
     // pg is loaded only when OOMOL_CONNECT_DATABASE_URL selects PostgreSQL; the SQLite default never pays for it.
-    const { PostgresRuntimeDatabase } = await import("./postgres-runtime-store.js");
+    const { PostgresRuntimeDatabase } = await import("./postgres/runtime-store.js");
     return await PostgresRuntimeDatabase.open(connectionString, options);
 }
 /** What `migrate` entry points print without OOMOL_CONNECT_DATABASE_URL: SQLite has no explicit migrate step. */

package/src/server/storage/{postgres-migrations.d.ts → postgres/migrations.d.ts}

@@ -1,5 +1,5 @@
-import type { RuntimeLogger } from "../../core/types.ts";
-import type { MigrationSource } from "./migration-source.ts";
+import type { RuntimeLogger } from "../../../core/types.ts";
+import type { MigrationSource } from "../migration-source.ts";
 import type { Pool } from "pg";
 export interface PostgresMigrationOptions {
     pool: Pool;

package/src/server/storage/{postgres-migrations.js → postgres/migrations.js}

@@ -1,4 +1,4 @@
-import { defaultMigrationSource } from "./migration-source.js";
+import { defaultMigrationSource } from "../migration-source.js";
 const migrationLockNamespace = 1_326_382_671;
 const migrationLockId = 1;
 export async function migratePostgresDatabase(options) {

package/src/server/storage/postgres/runtime-store.d.ts

@@ -0,0 +1,43 @@
+import type { IConnectionStore } from "../../../connection-service.ts";
+import type { RuntimeLogger } from "../../../core/types.ts";
+import type { IMarketplaceStore } from "../../../marketplace/marketplace-service.ts";
+import type { IOAuthClientConfigStore } from "../../../oauth/oauth-client-config-service.ts";
+import type { IOAuthStateStore } from "../../../oauth/oauth-flow-service.ts";
+import type { ISecretCodec } from "../../secrets/secret-codec-core.ts";
+import type { IIdempotencyStore } from "../idempotency-store.ts";
+import type { MigrationSource } from "../migration-source.ts";
+import type { RuntimeDatabase } from "../runtime-database.ts";
+import type { IRuntimePolicyStore } from "../runtime-policy-store.ts";
+import type { IRunLogStore } from "../runtime-store.ts";
+import type { IRuntimeTokenStore } from "../runtime-token-service.ts";
+import { ConnectionRequestStore } from "../connection-request-store.ts";
+import { SaasProjectStore } from "../saas-project-store.ts";
+import { SqlTriggerStore } from "../trigger-store.ts";
+export interface PostgresRuntimeDatabaseOptions {
+    logger?: RuntimeLogger;
+    runLimit?: number;
+    secretCodec?: ISecretCodec;
+    poolMax?: number;
+    connectionTimeoutMs?: number;
+    migrations?: MigrationSource;
+}
+export declare class PostgresRuntimeDatabase implements RuntimeDatabase {
+    readonly saasProjectStore: SaasProjectStore;
+    readonly connectionRequestStore: ConnectionRequestStore;
+    readonly connectionStore: IConnectionStore;
+    readonly triggerStore: SqlTriggerStore;
+    readonly oauthClientConfigStore: IOAuthClientConfigStore;
+    readonly oauthStateStore: IOAuthStateStore;
+    readonly runtimeTokenStore: IRuntimeTokenStore;
+    readonly runtimePolicyStore: IRuntimePolicyStore;
+    readonly runLogStore: IRunLogStore;
+    readonly idempotencyStore: IIdempotencyStore;
+    readonly marketplaceStore: IMarketplaceStore;
+    private readonly pool;
+    private readonly secretCodec;
+    private constructor();
+    static open(connectionString: string, options?: PostgresRuntimeDatabaseOptions): Promise<PostgresRuntimeDatabase>;
+    close(): Promise<void>;
+    resetRuntimeData(): Promise<void>;
+    rotateSecretCodec(nextSecretCodec: ISecretCodec): Promise<void>;
+}