@opengeni/db 0.17.1 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.17.1",
+  "version": "0.19.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,8 +51,8 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.9",
-    "@opengeni/config": "^0.8.1",
-    "@opengeni/contracts": "^0.27.0",
+    "@opengeni/config": "^0.9.1",
+    "@opengeni/contracts": "^0.28.1",
     "@opengeni/network": "^0.1.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"

package/src/index.ts

@@ -153,6 +153,7 @@ import {
   asc,
   desc,
   eq,
+  getTableColumns,
   gt,
   gte,
   inArray,
@@ -237,6 +238,7 @@ export * from "./session-queue-commands";
 export * from "./new-session-drafts";
 export * from "./workspace-instruction-policies";
 export * from "./preference-registry";
+export * from "./memory-governance";
 export { interruptedToolCallResult } from "./session-tool-call-settlement";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
 export {
@@ -3381,10 +3383,31 @@ export type CreateSocialConnectionInput = {
   status: SocialConnectionStatus;
   scopes?: string[];
   credentialRef?: string | null;
+  credentialEncrypted?: string | null;
   tokenMetadata?: Record<string, unknown>;
   metadata?: Record<string, unknown>;
 };
 
+export type UpsertSocialOAuthConnectionInput = {
+  accountId: string;
+  workspaceId: string;
+  provider: SocialProvider;
+  accountHandle: string;
+  accountName?: string | null;
+  externalAccountId?: string | null;
+  scopes: string[];
+  credentialEncrypted: string;
+  tokenMetadata?: Record<string, unknown>;
+};
+
+export type UpdateSocialConnectionCredentialInput = {
+  workspaceId: string;
+  connectionId: string;
+  credentialEncrypted?: string | null;
+  status?: SocialConnectionStatus;
+  tokenMetadata?: Record<string, unknown>;
+};
+
 export type CreateSocialPostInput = {
   accountId: string;
   workspaceId: string;
@@ -5085,6 +5108,21 @@ function connectionExactSubject(subjectId?: string | null): SQL {
     : isNull(schema.connections.subjectId);
 }
 
+function personalSlackCanonicalConnectionOrder(): SQL[] {
+  return [
+    sql`case ${schema.connections.status}
+      when 'active' then 0
+      when 'needs_reauth' then 1
+      when 'error' then 2
+      when 'revoked' then 3
+      else 4
+    end`,
+    desc(schema.connections.updatedAt),
+    desc(schema.connections.createdAt),
+    desc(schema.connections.id),
+  ];
+}
+
 async function withConnectionSubjectRls<T>(
   db: Database,
   workspaceId: string,
@@ -5345,6 +5383,7 @@ export type SlackInteractionInboxEntry = {
   claimHolderId: string | null;
   claimExpiresAt: Date | null;
   attemptCount: number;
+  retryAt: Date | null;
   lastErrorCode: string | null;
   processedAt: Date | null;
   createdAt: Date;
@@ -5368,6 +5407,9 @@ export type SlackInteraction = {
   lastDeliveredSessionEventSequence: number;
   deliveryClaimHolderId: string | null;
   deliveryClaimExpiresAt: Date | null;
+  deliveryAttemptCount: number;
+  deliveryRetryAt: Date | null;
+  deliveryLastErrorCode: string | null;
   ackSlackMessageTs: string | null;
   progressCount: number;
   terminalDeliveryState: "open" | "completed" | "failed" | "cancelled" | "blocked";
@@ -5486,6 +5528,7 @@ export async function enqueueSlackInteractionInbox(
     | "claimHolderId"
     | "claimExpiresAt"
     | "attemptCount"
+    | "retryAt"
     | "lastErrorCode"
     | "processedAt"
     | "createdAt"
@@ -5548,6 +5591,7 @@ export async function settleSlackInteractionInbox(
         status: input.outcome,
         claimHolderId: null,
         claimExpiresAt: null,
+        retryAt: null,
         processedAt: sql`now()`,
         lastErrorCode: input.errorCode ?? null,
         updatedAt: sql`now()`,
@@ -5570,6 +5614,7 @@ export async function releaseSlackInteractionInbox(
     entry: Pick<SlackInteractionInboxEntry, "id" | "accountId" | "workspaceId">;
     claimHolderId: string;
     errorCode: string;
+    retryAt: Date;
   },
 ): Promise<boolean> {
   return await withRlsContext(db, input.entry, async (scopedDb) => {
@@ -5579,6 +5624,7 @@ export async function releaseSlackInteractionInbox(
         status: "pending",
         claimHolderId: null,
         claimExpiresAt: null,
+        retryAt: input.retryAt,
         lastErrorCode: input.errorCode,
         updatedAt: sql`now()`,
       })
@@ -5604,6 +5650,9 @@ export async function getOrCreateSlackInteraction(
     | "lastDeliveredSessionEventSequence"
     | "deliveryClaimHolderId"
     | "deliveryClaimExpiresAt"
+    | "deliveryAttemptCount"
+    | "deliveryRetryAt"
+    | "deliveryLastErrorCode"
     | "ackSlackMessageTs"
     | "progressCount"
     | "terminalDeliveryState"
@@ -5943,7 +5992,13 @@ export async function reopenSlackInteractionDelivery(
   return await withRlsContext(db, input, async (scopedDb) => {
     const rows = await scopedDb
       .update(schema.slackInteractions)
-      .set({ terminalDeliveryState: "open", updatedAt: sql`now()` })
+      .set({
+        terminalDeliveryState: "open",
+        deliveryAttemptCount: 0,
+        deliveryRetryAt: null,
+        deliveryLastErrorCode: null,
+        updatedAt: sql`now()`,
+      })
       .where(eq(schema.slackInteractions.id, input.id))
       .returning({ id: schema.slackInteractions.id });
     return rows.length === 1;
@@ -5966,6 +6021,9 @@ export async function advanceSlackInteractionDelivery(
         ...(input.ackSlackMessageTs !== undefined
           ? { ackSlackMessageTs: input.ackSlackMessageTs }
           : {}),
+        deliveryAttemptCount: 0,
+        deliveryRetryAt: null,
+        deliveryLastErrorCode: null,
         updatedAt: sql`now()`,
       })
       .where(
@@ -6005,12 +6063,42 @@ export async function releaseSlackInteractionDelivery(
   });
 }
 
+export async function deferSlackInteractionDelivery(
+  db: Database,
+  input: Pick<SlackInteraction, "id" | "accountId" | "workspaceId"> & {
+    claimHolderId: string;
+    retryAt: Date;
+    errorCode: string;
+  },
+): Promise<boolean> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const rows = await scopedDb
+      .update(schema.slackInteractions)
+      .set({
+        deliveryClaimHolderId: null,
+        deliveryClaimExpiresAt: null,
+        deliveryRetryAt: input.retryAt,
+        deliveryLastErrorCode: input.errorCode.slice(0, 128),
+        updatedAt: sql`now()`,
+      })
+      .where(
+        and(
+          eq(schema.slackInteractions.id, input.id),
+          eq(schema.slackInteractions.deliveryClaimHolderId, input.claimHolderId),
+        ),
+      )
+      .returning({ id: schema.slackInteractions.id });
+    return rows.length === 1;
+  });
+}
+
 export async function closeSlackInteractionDelivery(
   db: Database,
   input: Pick<SlackInteraction, "id" | "accountId" | "workspaceId"> & {
     claimHolderId: string;
     sequence: number;
     state: Exclude<SlackInteraction["terminalDeliveryState"], "open">;
+    errorCode?: string | null;
   },
 ): Promise<boolean> {
   return await withRlsContext(db, input, async (scopedDb) => {
@@ -6021,6 +6109,8 @@ export async function closeSlackInteractionDelivery(
         terminalDeliveryState: input.state,
         deliveryClaimHolderId: null,
         deliveryClaimExpiresAt: null,
+        deliveryRetryAt: null,
+        deliveryLastErrorCode: input.errorCode?.slice(0, 128) ?? null,
         updatedAt: sql`now()`,
       })
       .where(
@@ -6059,6 +6149,7 @@ function mapSlackInteractionInbox(
     claimHolderId: slackRowNullableString(row, "claimHolderId", "claim_holder_id"),
     claimExpiresAt: slackRowNullableDate(row, "claimExpiresAt", "claim_expires_at"),
     attemptCount: slackRowNumber(row, "attemptCount", "attempt_count"),
+    retryAt: slackRowNullableDate(row, "retryAt", "retry_at"),
     lastErrorCode: slackRowNullableString(row, "lastErrorCode", "last_error_code"),
     processedAt: slackRowNullableDate(row, "processedAt", "processed_at"),
     createdAt: slackRowDate(row, "createdAt", "created_at"),
@@ -6102,6 +6193,13 @@ function mapSlackInteraction(
       "deliveryClaimExpiresAt",
       "delivery_claim_expires_at",
     ),
+    deliveryAttemptCount: slackRowNumber(row, "deliveryAttemptCount", "delivery_attempt_count"),
+    deliveryRetryAt: slackRowNullableDate(row, "deliveryRetryAt", "delivery_retry_at"),
+    deliveryLastErrorCode: slackRowNullableString(
+      row,
+      "deliveryLastErrorCode",
+      "delivery_last_error_code",
+    ),
     ackSlackMessageTs: slackRowNullableString(row, "ackSlackMessageTs", "ack_slack_message_ts"),
     progressCount: slackRowNumber(row, "progressCount", "progress_count"),
     terminalDeliveryState: slackRowString(
@@ -7058,13 +7156,25 @@ export async function loadConnectionCredentialForBroker(
     async (scopedDb) => {
       // Prefer active rows: a revoke bumps updatedAt, so recency alone would let a
       // freshly revoked connection shadow an active replacement for the provider.
+      // UUID-free Personal Slack lookup additionally mirrors the UI/reconnect
+      // canonical rule through createdAt and immutable UUID tie-breakers. Migration
+      // 0132 can stamp legacy duplicates with the same updatedAt in one transaction.
+      const personalSlackSubjectLookup =
+        !input.connectionId &&
+        input.allowSubjectOwned === true &&
+        input.providerDomain === "slack.com" &&
+        input.kind === "oauth2";
       const [row] = await scopedDb
         .select()
         .from(schema.connections)
         .where(and(...conditions))
         .orderBy(
-          desc(sql`(${schema.connections.status} = 'active')`),
-          desc(schema.connections.updatedAt),
+          ...(personalSlackSubjectLookup
+            ? personalSlackCanonicalConnectionOrder()
+            : [
+                desc(sql`(${schema.connections.status} = 'active')`),
+                desc(schema.connections.updatedAt),
+              ]),
         )
         .limit(1);
       if (!row) {
@@ -7779,7 +7889,10 @@ function memoryVectorLiteral(values: number[]): string {
 }
 
 const agentVisibleMemoryStatuses = [...AGENT_VISIBLE_MEMORY_STATUSES];
-const visibleTextHashUniqueIndexName = "knowledge_memories_workspace_visible_text_hash_uq";
+const visibleTextHashUniqueIndexNames = new Set([
+  "knowledge_memories_workspace_visible_text_hash_uq",
+  "knowledge_memories_scope_visible_text_hash_uq",
+]);
 
 function isVisibleTextHashUniqueViolation(error: unknown): boolean {
   const candidate = error as {
@@ -7793,14 +7906,15 @@ function isVisibleTextHashUniqueViolation(error: unknown): boolean {
     return false;
   }
   const constraint = candidate.constraint ?? candidate.constraint_name;
-  if (candidate.code === "23505" && constraint === visibleTextHashUniqueIndexName) {
+  if (candidate.code === "23505" && visibleTextHashUniqueIndexNames.has(String(constraint))) {
     return true;
   }
+  const message = typeof candidate.message === "string" ? candidate.message : null;
   if (
-    typeof candidate.message === "string" &&
-    candidate.message.includes(visibleTextHashUniqueIndexName) &&
+    message !== null &&
+    [...visibleTextHashUniqueIndexNames].some((name) => message.includes(name)) &&
     (candidate.code === "23505" ||
-      candidate.message.includes("duplicate key value violates unique constraint"))
+      message.includes("duplicate key value violates unique constraint"))
   ) {
     return true;
   }
@@ -8594,6 +8708,7 @@ export async function createSocialConnection(
           status: input.status,
           scopes: input.scopes ?? [],
           credentialRef: input.credentialRef ?? null,
+          credentialEncrypted: input.credentialEncrypted ?? null,
           tokenMetadata: input.tokenMetadata ?? {},
           metadata: input.metadata ?? {},
         })
@@ -8606,6 +8721,118 @@ export async function createSocialConnection(
   );
 }
 
+/**
+ * OAuth-callback persistence: reconnecting the same provider account replaces
+ * the stored credential and revives the connection instead of failing on the
+ * (workspace, provider, handle) unique index.
+ */
+export async function upsertSocialOAuthConnection(
+  db: Database,
+  input: UpsertSocialOAuthConnectionInput,
+): Promise<SocialConnection> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const [row] = await scopedDb
+        .insert(schema.socialConnections)
+        .values({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          provider: input.provider,
+          accountHandle: input.accountHandle,
+          accountName: input.accountName ?? null,
+          externalAccountId: input.externalAccountId ?? null,
+          status: "connected",
+          scopes: input.scopes,
+          credentialEncrypted: input.credentialEncrypted,
+          tokenMetadata: input.tokenMetadata ?? {},
+        })
+        .onConflictDoUpdate({
+          target: [
+            schema.socialConnections.workspaceId,
+            schema.socialConnections.provider,
+            schema.socialConnections.accountHandle,
+          ],
+          set: {
+            accountName: input.accountName ?? null,
+            externalAccountId: input.externalAccountId ?? null,
+            status: "connected",
+            scopes: input.scopes,
+            credentialEncrypted: input.credentialEncrypted,
+            tokenMetadata: input.tokenMetadata ?? {},
+            updatedAt: new Date(),
+          },
+        })
+        .returning();
+      if (!row) {
+        throw new Error("Failed to upsert social connection");
+      }
+      return mapSocialConnection(row);
+    },
+  );
+}
+
+/**
+ * Host-side credential read for the social API client. Deliberately not part
+ * of mapSocialConnection so the encrypted bundle never rides along on list or
+ * MCP responses.
+ */
+export async function loadSocialConnectionCredential(
+  db: Database,
+  workspaceId: string,
+  connectionId: string,
+): Promise<{ connection: SocialConnection; credentialEncrypted: string | null } | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select()
+      .from(schema.socialConnections)
+      .where(
+        and(
+          eq(schema.socialConnections.workspaceId, workspaceId),
+          eq(schema.socialConnections.id, connectionId),
+        ),
+      )
+      .limit(1);
+    if (!row) {
+      return null;
+    }
+    return { connection: mapSocialConnection(row), credentialEncrypted: row.credentialEncrypted };
+  });
+}
+
+export async function updateSocialConnectionCredential(
+  db: Database,
+  input: UpdateSocialConnectionCredentialInput,
+): Promise<SocialConnection | null> {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .update(schema.socialConnections)
+      .set({
+        ...(input.credentialEncrypted !== undefined
+          ? { credentialEncrypted: input.credentialEncrypted }
+          : {}),
+        ...(input.status !== undefined ? { status: input.status } : {}),
+        ...(input.tokenMetadata !== undefined ? { tokenMetadata: input.tokenMetadata } : {}),
+        updatedAt: new Date(),
+      })
+      .where(
+        and(
+          eq(schema.socialConnections.workspaceId, input.workspaceId),
+          eq(schema.socialConnections.id, input.connectionId),
+        ),
+      )
+      .returning();
+    return row ? mapSocialConnection(row) : null;
+  });
+}
+
+// List/get never select credential_encrypted (same posture as the broker
+// `connections` helpers): the ciphertext must not ride into API-process memory
+// on every list, where one added debug log or row spread would expose it.
+const { credentialEncrypted: _socialCredentialColumn, ...socialConnectionPublicColumns } =
+  getTableColumns(schema.socialConnections);
+
 export async function listSocialConnections(
   db: Database,
   workspaceId: string,
@@ -8613,7 +8840,7 @@ export async function listSocialConnections(
 ): Promise<SocialConnection[]> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const rows = await scopedDb
-      .select()
+      .select(socialConnectionPublicColumns)
       .from(schema.socialConnections)
       .where(eq(schema.socialConnections.workspaceId, workspaceId))
       .orderBy(desc(schema.socialConnections.createdAt))
@@ -8629,7 +8856,7 @@ export async function getSocialConnection(
 ): Promise<SocialConnection | null> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb
-      .select()
+      .select(socialConnectionPublicColumns)
       .from(schema.socialConnections)
       .where(
         and(
@@ -8691,6 +8918,70 @@ export async function createSocialPost(
   );
 }
 
+/**
+ * Idempotent bulk ingest for provider sync: rows already present under the
+ * (workspace, connection, external post id) unique index are skipped, so a
+ * scheduled re-sync never duplicates or fails.
+ */
+export async function recordSyncedSocialPosts(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    posts: Array<{
+      externalPostId: string;
+      url?: string | null;
+      authorHandle?: string | null;
+      text: string;
+      publishedAt: Date;
+      metrics?: Record<string, number>;
+      raw?: Record<string, unknown>;
+    }>;
+  },
+): Promise<{ inserted: number; skipped: number }> {
+  if (input.posts.length === 0) {
+    return { inserted: 0, skipped: 0 };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const connection = await requireSocialConnection(
+        scopedDb,
+        input.workspaceId,
+        input.connectionId,
+      );
+      const rows = await scopedDb
+        .insert(schema.socialPosts)
+        .values(
+          input.posts.map((post) => ({
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            connectionId: input.connectionId,
+            provider: connection.provider,
+            externalPostId: post.externalPostId,
+            url: post.url ?? null,
+            authorHandle: post.authorHandle ?? connection.accountHandle,
+            text: post.text,
+            publishedAt: post.publishedAt,
+            metrics: post.metrics ?? {},
+            raw: post.raw ?? {},
+          })),
+        )
+        .onConflictDoNothing({
+          target: [
+            schema.socialPosts.workspaceId,
+            schema.socialPosts.connectionId,
+            schema.socialPosts.externalPostId,
+          ],
+        })
+        .returning({ id: schema.socialPosts.id });
+      return { inserted: rows.length, skipped: input.posts.length - rows.length };
+    },
+  );
+}
+
 export async function listSocialPosts(
   db: Database,
   options: {
@@ -42139,7 +42430,9 @@ function mapKnowledgeMemory(row: typeof schema.knowledgeMemories.$inferSelect):
   };
 }
 
-function mapSocialConnection(row: typeof schema.socialConnections.$inferSelect): SocialConnection {
+function mapSocialConnection(
+  row: Omit<typeof schema.socialConnections.$inferSelect, "credentialEncrypted">,
+): SocialConnection {
   return {
     id: row.id,
     accountId: row.accountId,