@opengeni/db 0.13.1 → 0.13.4

package/dist/index.js

@@ -76,7 +76,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-N4WTE6SB.js";
+} from "./chunk-IQOXTFKA.js";
 import {
   migrate,
   runMigrations
@@ -5194,11 +5194,15 @@ var REFRESH_WINDOW_MS = 6e4;
 var CONNECTION_REFRESH_TIMEOUT_MS = 1e4;
 function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
   const load = async (input) => {
+    const subjectOwned = input.connectionRef.subjectScope === "subject";
+    if (subjectOwned && !input.subjectId) {
+      return null;
+    }
     const request = {
       workspaceId: input.workspaceId,
       providerDomain: input.connectionRef.providerDomain,
-      // I1 deliberately accepts workspace-shared connections only at runtime.
-      allowSubjectOwned: false
+      allowSubjectOwned: subjectOwned,
+      ...subjectOwned ? { subjectId: input.subjectId } : {}
     };
     if (input.connectionRef.connectionId !== void 0) {
       request.connectionId = input.connectionRef.connectionId;
@@ -5206,10 +5210,12 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (input.connectionRef.kind !== void 0) {
       request.kind = input.connectionRef.kind;
     }
-    if (input.subjectId !== void 0) {
-      request.subjectId = input.subjectId;
+    const credential = await deps.loadCredential(db, settings, request);
+    if (!credential) return null;
+    if (subjectOwned) {
+      return credential.subjectId === input.subjectId ? credential : null;
     }
-    return deps.loadCredential(db, settings, request);
+    return credential.subjectId === null ? credential : null;
   };
   const snapshot = async (cred, ref, destinationUrl) => {
     if (cred.status !== "active") {
@@ -5244,7 +5250,7 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
         ...ref.selectedResources ? { selectedResources: copySelectedResources(ref.selectedResources) } : {}
       };
     }
-    await deps.recordUsed(db, cred.workspaceId, cred.id);
+    await deps.recordUsed(db, cred.workspaceId, cred.id, cred.subjectId);
     return {
       status: "ok",
       headers,
@@ -5264,7 +5270,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
       workspaceId: cred.workspaceId,
       credentialEncrypted: deps.encrypt(key, JSON.stringify(refreshed.credential)),
       expiresAt: refreshed.expiresAt,
-      lastRefreshAt: deps.now()
+      lastRefreshAt: deps.now(),
+      subjectId: cred.subjectId
     };
     if (refreshed.grantedScopes !== void 0) {
       refreshRecord.grantedScopes = refreshed.grantedScopes;
@@ -5273,7 +5280,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (persisted) {
       const current = await load({
         workspaceId: cred.workspaceId,
-        connectionRef: { ...ref, connectionId: cred.id }
+        connectionRef: { ...ref, connectionId: cred.id },
+        ...cred.subjectId ? { subjectId: cred.subjectId } : {}
       });
       if (current) {
         return current;
@@ -5281,7 +5289,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     }
     const winner = await load({
       workspaceId: cred.workspaceId,
-      connectionRef: { ...ref, connectionId: cred.id }
+      connectionRef: { ...ref, connectionId: cred.id },
+      ...cred.subjectId ? { subjectId: cred.subjectId } : {}
     });
     if (winner?.status === "active") {
       return winner;
@@ -5289,7 +5298,7 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     throw new Error("connection credential changed during token refresh");
   };
   const refreshSingleFlight = (cred, ref) => {
-    const key = `${cred.id}:${cred.version}`;
+    const key = `${cred.subjectId ?? "workspace"}:${cred.id}:${cred.version}`;
     const existing = inflight2.get(key);
     if (existing) {
       return existing;
@@ -5334,7 +5343,8 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
             error instanceof Error ? error.message : String(error),
             {
               id: cred.id,
-              version: cred.version
+              version: cred.version,
+              subjectId: cred.subjectId
             }
           ).catch(() => void 0);
         }
@@ -6151,6 +6161,17 @@ async function bootstrapWorkspace(db, input) {
         updatedAt: /* @__PURE__ */ new Date()
       }).where(eq7(workspaceMemberships.id, membership.id));
     }
+    await setRlsContext(tx, {
+      accountId: workspace.accountId,
+      workspaceId: null
+    });
+    const memberships = await tx.select({
+      membership: workspaceMemberships,
+      workspace: workspaces
+    }).from(workspaceMemberships).innerJoin(
+      workspaces,
+      eq7(workspaceMemberships.workspaceId, workspaces.id)
+    ).where(eq7(workspaceMemberships.subjectId, input.subjectId)).orderBy(desc2(workspaces.createdAt));
     return {
       mode: input.accountExternalSource === "opengeni:local" ? "local" : "configured",
       subjectId: input.subjectId,
@@ -6164,15 +6185,13 @@ async function bootstrapWorkspace(db, input) {
           permissions: input.accountPermissions ?? allAccountPermissions
         }
       ],
-      workspaceGrants: [
-        {
-          workspaceId: workspace.id,
-          accountId: account.id,
-          subjectId: input.subjectId,
-          ...input.subjectLabel ? { subjectLabel: input.subjectLabel } : {},
-          permissions: workspacePermissions
-        }
-      ],
+      workspaceGrants: memberships.map((row) => ({
+        workspaceId: row.workspace.id,
+        accountId: row.workspace.accountId,
+        subjectId: input.subjectId,
+        ...input.subjectLabel ? { subjectLabel: input.subjectLabel } : {},
+        permissions: row.membership.permissions
+      })),
       defaultAccountId: account.id,
       defaultWorkspaceId: workspace.id
     };
@@ -8032,36 +8051,48 @@ var connectionMetadataColumns = {
 function connectionSubjectVisibility(subjectId) {
   return subjectId ? or(isNull2(connections.subjectId), eq7(connections.subjectId, subjectId)) : isNull2(connections.subjectId);
 }
+function connectionExactSubject(subjectId) {
+  return subjectId ? eq7(connections.subjectId, subjectId) : isNull2(connections.subjectId);
+}
+async function withConnectionSubjectRls(db, workspaceId, subjectId, fn) {
+  return subjectId ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn) : await withWorkspaceRls(db, workspaceId, fn);
+}
+async function createConnectionInScope(db, input) {
+  const [row] = await db.insert(connections).values({
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId ?? null,
+    providerDomain: input.providerDomain,
+    kind: input.kind,
+    status: input.status ?? "active",
+    credentialEncrypted: input.credentialEncrypted,
+    grantedScopes: input.grantedScopes ?? [],
+    expiresAt: input.expiresAt ?? null,
+    verifiedInstallAt: input.verifiedInstallAt ?? null,
+    verifiedInstallVersion: input.verifiedInstallVersion ?? null,
+    metadata: input.metadata ?? {},
+    createdBySubjectId: input.createdBySubjectId ?? null,
+    updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null
+  }).returning(connectionMetadataColumns);
+  if (!row) {
+    throw new Error("Failed to create connection");
+  }
+  return mapConnectionMetadata(row);
+}
 async function createConnection(db, input) {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const [row] = await scopedDb.insert(connections).values({
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        subjectId: input.subjectId ?? null,
-        providerDomain: input.providerDomain,
-        kind: input.kind,
-        status: input.status ?? "active",
-        credentialEncrypted: input.credentialEncrypted,
-        grantedScopes: input.grantedScopes ?? [],
-        expiresAt: input.expiresAt ?? null,
-        verifiedInstallAt: input.verifiedInstallAt ?? null,
-        verifiedInstallVersion: input.verifiedInstallVersion ?? null,
-        metadata: input.metadata ?? {},
-        createdBySubjectId: input.createdBySubjectId ?? null,
-        updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null
-      }).returning(connectionMetadataColumns);
-      if (!row) {
-        throw new Error("Failed to create connection");
+      if (input.subjectId) {
+        await setSubjectRlsContext(scopedDb, input.subjectId);
       }
-      return mapConnectionMetadata(row);
+      return await createConnectionInScope(scopedDb, input);
     }
   );
 }
 async function listConnectionsMetadata(db, workspaceId, subjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const rows = await scopedDb.select(connectionMetadataColumns).from(connections).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
@@ -8072,7 +8103,7 @@ async function listConnectionsMetadata(db, workspaceId, subjectId) {
   });
 }
 async function getConnectionMetadata(db, workspaceId, connectionId, subjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb.select(connectionMetadataColumns).from(connections).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
@@ -8083,66 +8114,217 @@ async function getConnectionMetadata(db, workspaceId, connectionId, subjectId) {
     return row ? mapConnectionMetadata(row) : null;
   });
 }
+async function updateConnectionInScope(db, input) {
+  const set = {
+    updatedAt: /* @__PURE__ */ new Date(),
+    ...input.providerDomain !== void 0 ? { providerDomain: input.providerDomain } : {},
+    ...input.subjectId !== void 0 ? { subjectId: input.subjectId } : {},
+    ...input.kind !== void 0 ? { kind: input.kind } : {},
+    ...input.status !== void 0 ? { status: input.status } : {},
+    ...input.credentialEncrypted !== void 0 ? {
+      credentialEncrypted: input.credentialEncrypted,
+      version: sql4`${connections.version} + 1`,
+      lastError: null
+    } : {},
+    ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
+    ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
+    ...input.verifiedInstallAt !== void 0 ? { verifiedInstallAt: input.verifiedInstallAt } : {},
+    ...input.verifiedInstallVersion !== void 0 ? { verifiedInstallVersion: input.verifiedInstallVersion } : {},
+    ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
+    ...input.updatedBySubjectId !== void 0 ? { updatedBySubjectId: input.updatedBySubjectId } : {}
+  };
+  const [row] = await db.update(connections).set(set).where(
+    and7(
+      eq7(connections.workspaceId, input.workspaceId),
+      eq7(connections.id, input.connectionId),
+      connectionSubjectVisibility(input.visibleToSubjectId),
+      ...input.expectedVersion !== void 0 ? [eq7(connections.version, input.expectedVersion)] : []
+    )
+  ).returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
+}
 async function updateConnection(db, input) {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
-      updatedAt: /* @__PURE__ */ new Date(),
-      ...input.providerDomain !== void 0 ? { providerDomain: input.providerDomain } : {},
-      ...input.subjectId !== void 0 ? { subjectId: input.subjectId } : {},
-      ...input.kind !== void 0 ? { kind: input.kind } : {},
-      ...input.status !== void 0 ? { status: input.status } : {},
-      ...input.credentialEncrypted !== void 0 ? {
-        credentialEncrypted: input.credentialEncrypted,
-        version: sql4`${connections.version} + 1`,
-        lastError: null
-      } : {},
-      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
-      ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
-      ...input.verifiedInstallAt !== void 0 ? { verifiedInstallAt: input.verifiedInstallAt } : {},
-      ...input.verifiedInstallVersion !== void 0 ? { verifiedInstallVersion: input.verifiedInstallVersion } : {},
-      ...input.metadata !== void 0 ? { metadata: input.metadata } : {},
-      ...input.updatedBySubjectId !== void 0 ? { updatedBySubjectId: input.updatedBySubjectId } : {}
-    };
-    const [row] = await scopedDb.update(connections).set(set).where(
-      and7(
-        eq7(connections.workspaceId, input.workspaceId),
-        eq7(connections.id, input.connectionId),
-        connectionSubjectVisibility(input.visibleToSubjectId),
-        ...input.expectedVersion !== void 0 ? [eq7(connections.version, input.expectedVersion)] : []
-      )
-    ).returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.visibleToSubjectId,
+    async (scopedDb) => await updateConnectionInScope(scopedDb, input)
+  );
+}
+async function revokeConnectionInScope(db, workspaceId, connectionId, updatedBySubjectId, expectedVersion) {
+  const [row] = await db.update(connections).set({
+    status: "revoked",
+    // The version bump invalidates any in-flight refresh's (id, version) CAS,
+    // so a racing refresh cannot commit and flip the row back to active.
+    version: sql4`${connections.version} + 1`,
+    // Status-only revocation does not replace the verified credential or bot
+    // identity. Carry the marker to the same new CAS version so the dedicated
+    // reinstall path can still recognize (but not use) the inactive row.
+    verifiedInstallVersion: sql4`case
+        when ${connections.verifiedInstallAt} is null then null
+        else ${connections.version} + 1
+      end`,
+    updatedBySubjectId: updatedBySubjectId ?? null,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(
+    and7(
+      eq7(connections.workspaceId, workspaceId),
+      eq7(connections.id, connectionId),
+      // Same visibility rule as get/update: shared rows plus the caller's own
+      // subject rows. Cross-subject revocation (admin janitorial) arrives with
+      // the subject-connections UX in I5, deliberately not before.
+      connectionSubjectVisibility(updatedBySubjectId),
+      ...expectedVersion !== void 0 ? [eq7(connections.version, expectedVersion)] : []
+    )
+  ).returning(connectionMetadataColumns);
+  return row ? mapConnectionMetadata(row) : null;
 }
 async function revokeConnection(db, workspaceId, connectionId, updatedBySubjectId) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.update(connections).set({
-      status: "revoked",
-      // The version bump invalidates any in-flight refresh's (id, version) CAS,
-      // so a racing refresh cannot commit and flip the row back to active.
-      version: sql4`${connections.version} + 1`,
-      // Status-only revocation does not replace the verified credential or bot
-      // identity. Carry the marker to the same new CAS version so the dedicated
-      // reinstall path can still recognize (but not use) the inactive row.
-      verifiedInstallVersion: sql4`case
-          when ${connections.verifiedInstallAt} is null then null
-          else ${connections.version} + 1
-        end`,
-      updatedBySubjectId: updatedBySubjectId ?? null,
-      updatedAt: /* @__PURE__ */ new Date()
-    }).where(
-      and7(
-        eq7(connections.workspaceId, workspaceId),
-        eq7(connections.id, connectionId),
-        // Same visibility rule as get/update: shared rows plus the caller's own
-        // subject rows. Cross-subject revocation (admin janitorial) arrives with
-        // the subject-connections UX in I5, deliberately not before.
-        connectionSubjectVisibility(updatedBySubjectId)
-      )
-    ).returning(connectionMetadataColumns);
-    return row ? mapConnectionMetadata(row) : null;
+  return await withConnectionSubjectRls(
+    db,
+    workspaceId,
+    updatedBySubjectId,
+    async (scopedDb) => await revokeConnectionInScope(scopedDb, workspaceId, connectionId, updatedBySubjectId)
+  );
+}
+var SlackBotLifecycleSuccessAuditError = class extends Error {
+  constructor() {
+    super("OpenGeni Slack bot lifecycle success audit failed");
+    this.name = "SlackBotLifecycleSuccessAuditError";
+  }
+};
+async function insertSlackBotLifecycleSuccessAuditInScope(db, input) {
+  try {
+    await db.insert(auditEvents).values({
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      action: input.action,
+      targetType: "connection",
+      targetId: input.connectionId,
+      metadata: {
+        credentialRole: input.credentialRole,
+        credentialLabel: input.credentialLabel,
+        connectionId: input.connectionId,
+        slackTeamId: input.slackTeamId,
+        outcome: "succeeded"
+      }
+    });
+  } catch {
+    throw new SlackBotLifecycleSuccessAuditError();
+  }
+}
+async function assertWorkspaceAccountPairInScope(db, accountId, workspaceId) {
+  const [workspace] = await db.select({ id: workspaces.id }).from(workspaces).where(and7(eq7(workspaces.id, workspaceId), eq7(workspaces.accountId, accountId))).limit(1);
+  if (!workspace) {
+    throw new Error("Workspace does not belong to the expected account");
+  }
+}
+async function withSlackBotLifecycleRls(db, input, fn) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      return await fn(scopedDb);
+    }
+  );
+}
+async function createConnectionWithSlackBotSuccessAudit(db, input) {
+  if (input.connection.accountId !== input.accountId || input.connection.workspaceId !== input.workspaceId) {
+    throw new Error("Slack bot connection and lifecycle audit tenant must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await createConnectionInScope(scopedDb, input.connection);
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.connected",
+      connectionId: connection.id
+    });
+    return connection;
   });
 }
+async function updateConnectionWithSlackBotSuccessAudit(db, input) {
+  if (input.connection.workspaceId !== input.workspaceId) {
+    throw new Error("Slack bot connection and lifecycle audit workspace must match");
+  }
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await updateConnectionInScope(scopedDb, input.connection);
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.reinstalled",
+      connectionId: connection.id
+    });
+    return connection;
+  });
+}
+async function revokeConnectionWithSlackBotSuccessAudit(db, input) {
+  return await withSlackBotLifecycleRls(db, input, async (scopedDb) => {
+    const connection = await revokeConnectionInScope(
+      scopedDb,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId,
+      input.expectedVersion
+    );
+    if (!connection) return null;
+    if (connection.accountId !== input.accountId) {
+      throw new Error("Slack bot connection and lifecycle audit account must match");
+    }
+    await insertSlackBotLifecycleSuccessAuditInScope(scopedDb, {
+      ...input,
+      action: "slack_bot.disconnected",
+      connectionId: connection.id
+    });
+    return connection;
+  });
+}
+async function recordSlackBotInstallCallbackFailure(db, input) {
+  if (!/^[a-f0-9]{64}$/.test(input.callbackDigest)) {
+    throw new Error("Slack callback digest must be a lowercase SHA-256 value");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await setSubjectRlsContext(scopedDb, input.subjectId);
+      await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
+      await scopedDb.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`slack-callback-failure:${input.workspaceId}:${input.callbackDigest}`}, 0))`
+      );
+      const [existing] = await scopedDb.select({ id: auditEvents.id }).from(auditEvents).where(
+        and7(
+          eq7(auditEvents.accountId, input.accountId),
+          eq7(auditEvents.workspaceId, input.workspaceId),
+          eq7(auditEvents.action, "slack_bot.install.callback.failed"),
+          eq7(auditEvents.targetType, "slack_oauth_callback"),
+          eq7(auditEvents.targetId, input.callbackDigest)
+        )
+      ).limit(1);
+      if (existing) return false;
+      await scopedDb.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "slack_bot.install.callback.failed",
+        targetType: "slack_oauth_callback",
+        targetId: input.callbackDigest,
+        metadata: {
+          outcome: "failed",
+          installMode: input.installMode,
+          stage: input.stage,
+          reason: input.reason
+        }
+      });
+      return true;
+    }
+  );
+}
 async function claimSlackBotPostOperation(db, input) {
   const claimLeaseMs = Math.max(1, Math.min(Math.trunc(input.claimLeaseMs), 12e4));
   return await withRlsContext(
@@ -8302,13 +8484,16 @@ async function getSlackBotPostOperation(db, workspaceId, connectionId, operation
   });
 }
 async function loadConnectionCredentialForBroker(db, settings, input) {
+  if (input.allowSubjectOwned && !input.subjectId) {
+    return null;
+  }
   const key = environmentsEncryptionKeyBytes3(settings);
   if (!key) {
     throw new Error(
       "connection credential present but OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured"
     );
   }
-  const subjectPredicate = input.allowSubjectOwned ? connectionSubjectVisibility(input.subjectId) : isNull2(connections.subjectId);
+  const subjectPredicate = input.allowSubjectOwned ? connectionExactSubject(input.subjectId) : isNull2(connections.subjectId);
   const conditions = [
     eq7(connections.workspaceId, input.workspaceId),
     subjectPredicate
@@ -8321,70 +8506,81 @@ async function loadConnectionCredentialForBroker(db, settings, input) {
       conditions.push(eq7(connections.kind, input.kind));
     }
   }
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.select().from(connections).where(and7(...conditions)).orderBy(
-      desc2(sql4`(${connections.status} = 'active')`),
-      desc2(connections.updatedAt)
-    ).limit(1);
-    if (!row) {
-      return null;
-    }
-    let credential;
-    try {
-      credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
-    } catch (error) {
-      throw new Error(
-        `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error }
-      );
-    }
-    if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
-      throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.allowSubjectOwned ? input.subjectId : null,
+    async (scopedDb) => {
+      const [row] = await scopedDb.select().from(connections).where(and7(...conditions)).orderBy(
+        desc2(sql4`(${connections.status} = 'active')`),
+        desc2(connections.updatedAt)
+      ).limit(1);
+      if (!row) {
+        return null;
+      }
+      let credential;
+      try {
+        credential = JSON.parse(decryptEnvironmentValue(key, row.credentialEncrypted));
+      } catch (error) {
+        throw new Error(
+          `connection credential could not be decrypted for ${row.id}: ${error instanceof Error ? error.message : String(error)}`,
+          { cause: error }
+        );
+      }
+      if (!credential || typeof credential !== "object" || Array.isArray(credential)) {
+        throw new Error(`connection credential bundle for ${row.id} is not a JSON object`);
+      }
+      return {
+        id: row.id,
+        accountId: row.accountId,
+        workspaceId: row.workspaceId,
+        subjectId: row.subjectId,
+        providerDomain: row.providerDomain,
+        kind: row.kind,
+        status: row.status,
+        credential,
+        grantedScopes: row.grantedScopes,
+        expiresAt: row.expiresAt,
+        lastRefreshAt: row.lastRefreshAt,
+        version: row.version,
+        metadata: row.metadata
+      };
     }
-    return {
-      id: row.id,
-      accountId: row.accountId,
-      workspaceId: row.workspaceId,
-      subjectId: row.subjectId,
-      providerDomain: row.providerDomain,
-      kind: row.kind,
-      status: row.status,
-      credential,
-      grantedScopes: row.grantedScopes,
-      expiresAt: row.expiresAt,
-      lastRefreshAt: row.lastRefreshAt,
-      version: row.version,
-      metadata: row.metadata
-    };
-  });
+  );
 }
 async function recordConnectionTokenRefresh(db, input) {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const set = {
-      credentialEncrypted: input.credentialEncrypted,
-      expiresAt: input.expiresAt,
-      lastRefreshAt: input.lastRefreshAt,
-      status: "active",
-      lastError: null,
-      version: sql4`${connections.version} + 1`,
-      updatedAt: /* @__PURE__ */ new Date(),
-      ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
-    };
-    const updated = await scopedDb.update(connections).set(set).where(
-      and7(
-        eq7(connections.id, input.id),
-        eq7(connections.workspaceId, input.workspaceId),
-        eq7(connections.version, input.version),
-        // A refresh may only ever renew a live credential; revoked/errored rows
-        // stay dead even if a status change somewhere forgot to bump version.
-        eq7(connections.status, "active")
-      )
-    ).returning({ id: connections.id });
-    return updated.length > 0;
-  });
+  return await withConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) => {
+      const set = {
+        credentialEncrypted: input.credentialEncrypted,
+        expiresAt: input.expiresAt,
+        lastRefreshAt: input.lastRefreshAt,
+        status: "active",
+        lastError: null,
+        version: sql4`${connections.version} + 1`,
+        updatedAt: /* @__PURE__ */ new Date(),
+        ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
+      };
+      const updated = await scopedDb.update(connections).set(set).where(
+        and7(
+          eq7(connections.id, input.id),
+          eq7(connections.workspaceId, input.workspaceId),
+          eq7(connections.version, input.version),
+          connectionExactSubject(input.subjectId),
+          // A refresh may only ever renew a live credential; revoked/errored rows
+          // stay dead even if a status change somewhere forgot to bump version.
+          eq7(connections.status, "active")
+        )
+      ).returning({ id: connections.id });
+      return updated.length > 0;
+    }
+  );
 }
 async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withConnectionSubjectRls(db, workspaceId, guard.subjectId, async (scopedDb) => {
     const updated = await scopedDb.update(connections).set({
       status,
       lastError,
@@ -8398,21 +8594,23 @@ async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
       and7(
         eq7(connections.workspaceId, workspaceId),
         eq7(connections.id, guard.id),
-        eq7(connections.version, guard.version)
+        eq7(connections.version, guard.version),
+        connectionExactSubject(guard.subjectId)
       )
     ).returning({ id: connections.id });
     return updated.length > 0;
   });
 }
-async function recordConnectionUsed(db, workspaceId, connectionId) {
-  await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+async function recordConnectionUsed(db, workspaceId, connectionId, subjectId) {
+  await withConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     await scopedDb.update(connections).set({
       lastUsedAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date()
     }).where(
       and7(
         eq7(connections.workspaceId, workspaceId),
-        eq7(connections.id, connectionId)
+        eq7(connections.id, connectionId),
+        connectionExactSubject(subjectId)
       )
     );
   });
@@ -13536,6 +13734,7 @@ async function createSessionInTransaction(tx, input, id) {
     initialMessage: input.initialMessage,
     initialTurnInstructions: input.initialTurnInstructions ?? null,
     resources: input.resources,
+    skills: input.skills ?? [],
     tools: input.tools ?? [],
     toolPolicy: input.toolPolicy ?? null,
     metadata: input.metadata,
@@ -14852,25 +15051,34 @@ async function getSessionLineage(db, workspaceId, sessionId) {
     if (rootRows.length === 0) {
       return null;
     }
-    const ancestorRows = await scopedDb.execute(sql4`
-      with recursive ancestors(id, parent_session_id, depth, path) as (
-        select ${sessions.id}, ${sessions.parentSessionId}, 0, array[${sessions.id}]
+    const ancestorLineageRows = await scopedDb.execute(sql4`
+      with recursive ancestors(id, parent_session_id, depth, path, cycle) as (
+        select ${sessions.id}, ${sessions.parentSessionId}, 0, array[${sessions.id}], false
         from ${sessions}
         where ${sessions.workspaceId} = ${workspaceId}
           and ${sessions.id} = ${sessionId}
         union all
-        select parent.id, parent.parent_session_id, ancestors.depth + 1, ancestors.path || parent.id
+        select
+          parent.id,
+          parent.parent_session_id,
+          ancestors.depth + 1,
+          ancestors.path || parent.id,
+          parent.id = any(ancestors.path)
         from ${sessions} parent
         join ancestors on ancestors.parent_session_id = parent.id
         where parent.workspace_id = ${workspaceId}
-          and ancestors.depth < 10
-          and not parent.id = any(ancestors.path)
+          and not ancestors.cycle
+          and ancestors.depth < 64
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, cycle
       from ancestors
-      where depth > 0
       order by depth desc
     `);
+    const frontier = ancestorLineageRows[0];
+    if (!frontier || frontier.cycle || frontier.parentSessionId !== null || Number(frontier.depth) >= 64) {
+      throw new Error(`session lineage for ${sessionId} has no valid workspace root`);
+    }
+    const ancestorRows = ancestorLineageRows.filter((row) => row.depth > 0);
     const childRows = await scopedDb.execute(sql4`
       with recursive descendants(id, parent_session_id, depth, path) as (
         select child.id, child.parent_session_id, 1, array[${sessionId}, child.id]
@@ -14885,7 +15093,7 @@ async function getSessionLineage(db, workspaceId, sessionId) {
           and descendants.depth < 5
           and not child.id = any(descendants.path)
       )
-      select id, parent_session_id as "parentSessionId", depth, path
+      select id, parent_session_id as "parentSessionId", depth, path, false as cycle
       from descendants
       order by path
       limit ${descendantLimit + 1}
@@ -22694,6 +22902,12 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         and7(
           eq7(sessionAttemptInterruptions.workspaceId, workspaceId),
           eq7(sessionAttemptInterruptions.sessionId, sessionId),
+          inArray3(sessionAttemptInterruptions.state, [
+            "pending",
+            "delivered",
+            "acknowledged",
+            "settled"
+          ]),
           isNull2(sessionTurnAttempts.quiescedAt)
         )
       ).orderBy(desc2(sessionAttemptInterruptions.requestedAt)).limit(1);
@@ -22905,11 +23119,15 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         desc2(sessionSystemUpdates.createdAt),
         desc2(sessionSystemUpdates.id)
       ).limit(1).for("update");
-      const rows = pendingAgentSteer ? [] : await rawRows(
+      const rows = await rawRows(
         tx,
         sql4`select id, trigger_event_id, metadata from session_turns
               where workspace_id = ${workspaceId} and session_id = ${sessionId}
                 and status = 'queued' and source in ('user', 'api')
+                and (
+                  ${Boolean(pendingAgentSteer)} = false
+                  or metadata->>'delivery' = 'steer'
+                )
               order by position asc, created_at asc, id asc
               limit 1`
       );
@@ -25415,7 +25633,7 @@ async function getSessionQueueSnapshot(db, workspaceId, sessionId) {
     return {
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
-      stoppingPreviousAttempt: latestInterruption !== null && latestInterruption.quiescedAt === null,
+      stoppingPreviousAttempt: latestInterruption !== null && latestInterruption.interruptionState !== "rejected_stale" && latestInterruption.quiescedAt === null,
       items: rows.map(mapSessionTurn)
     };
   });
@@ -26571,6 +26789,7 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     titleSource: row.titleSource ?? null,
     instructions: row.instructions ?? null,
     resources: row.resources,
+    skills: row.skills ?? [],
     tools: row.tools,
     toolPolicy: row.toolPolicy ?? {
       mode: "legacy",
@@ -27314,6 +27533,7 @@ export {
   SessionPinVersionConflictError,
   SessionSpawnDeniedDbError,
   SessionToolPolicyVersionConflictError,
+  SlackBotLifecycleSuccessAuditError,
   WORKSPACE_MEMORY_BLOCK_EMPTY,
   WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED,
   WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET,
@@ -27417,6 +27637,7 @@ export {
   countWorkspacesForAccount,
   createApiKey,
   createConnection,
+  createConnectionWithSlackBotSuccessAudit,
   createDb,
   createDeviceEnrollmentRequest,
   createEnrollment,
@@ -27727,6 +27948,7 @@ export {
   recordRetainedProcessReconciliationProof,
   recordSessionActiveCodexCredential,
   recordSkippedContextCompaction,
+  recordSlackBotInstallCallbackFailure,
   recordStreamAcknowledgment,
   recordStripeWebhookEvent,
   recordUsageEvent,
@@ -27765,6 +27987,7 @@ export {
   retireHostExportConsumer,
   revokeApiKey,
   revokeConnection,
+  revokeConnectionWithSlackBotSuccessAudit,
   revokeEnrollment,
   revokeViewer,
   rewindHostExportConsumer,
@@ -27833,6 +28056,7 @@ export {
   updateCodexAllocatorEligibility,
   updateCodexRotationSettings,
   updateConnection,
+  updateConnectionWithSlackBotSuccessAudit,
   updateImportBatchCounts,
   updateKnowledgeMemory,
   updatePackInstallationStatus,