@opengeni/db 0.21.0 → 0.22.2

package/dist/index.js

@@ -12,6 +12,8 @@ import {
   codexSubscriptionCredentials,
   composerDrafts,
   connections,
+  connectorActionPolicies,
+  connectorActionRequests,
   creditLedgerEntries,
   deviceEnrollmentRequests,
   enrollments,
@@ -105,7 +107,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-NK2A36KP.js";
+} from "./chunk-CYGFLLMN.js";
 import {
   migrate,
   runMigrations
@@ -125,7 +127,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-OTJHD33E.js";
+} from "./chunk-BNGEN5QZ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
@@ -172,7 +174,11 @@ import {
   SubmitHumanInputResponseRequest,
   TurnExecutionPolicyV1
 } from "@opengeni/contracts";
-import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
+import {
+  environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3,
+  VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+  VERCEL_AI_GATEWAY_CONNECTION_ROLE
+} from "@opengeni/config";
 import { boundModelToolOutputItem as boundModelToolOutputItem2, isCodexBilledModel } from "@opengeni/codex";
 import { isCodexBilledModel as isCodexBilledModel2 } from "@opengeni/codex";
 import {
@@ -1397,7 +1403,7 @@ async function registerSessionTurnAttemptClaim(db, input) {
       eq4(sessionTurnAttempts.id, input.id)
     )
   ).for("update").limit(1);
-  if (!existing || existing.accountId !== input.accountId || existing.sessionId !== input.sessionId || existing.turnId !== input.turnId || existing.executionGeneration !== input.executionGeneration || existing.temporalWorkflowId !== input.temporalWorkflowId || existing.temporalWorkflowRunId !== input.temporalWorkflowRunId || existing.temporalActivityId !== input.temporalActivityId || existing.state === "closed") {
+  if (!existing || existing.accountId !== input.accountId || existing.sessionId !== input.sessionId || existing.turnId !== input.turnId || existing.executionGeneration !== input.executionGeneration || existing.temporalWorkflowId !== input.temporalWorkflowId || existing.temporalWorkflowRunId !== input.temporalWorkflowRunId || existing.temporalActivityId !== input.temporalActivityId || JSON.stringify(existing.connectorActionPolicies) !== JSON.stringify(input.connectorActionPolicies) || existing.state === "closed") {
     throw new SessionControlInvariantError(
       `Attempt ${input.id} conflicts with a different or closed ownership chain`
     );
@@ -14014,6 +14020,32 @@ async function loadConnectionCredentialForBroker(db, settings, input) {
     }
   );
 }
+async function workspaceVercelAiGatewayConnectionActive(db, workspaceId) {
+  const connections2 = await listConnectionsMetadata(db, workspaceId, null);
+  return connections2.some(
+    (connection) => connection.subjectId === null && connection.providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN && connection.kind === "api_key" && connection.status === "active" && connection.metadata.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE
+  );
+}
+async function loadWorkspaceVercelAiGatewayApiKey(db, settings, workspaceId) {
+  const metadata = (await listConnectionsMetadata(db, workspaceId, null)).find(
+    (connection2) => connection2.subjectId === null && connection2.providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN && connection2.kind === "api_key" && connection2.status === "active" && connection2.metadata.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE
+  );
+  if (!metadata) {
+    return null;
+  }
+  const connection = await loadConnectionCredentialForBroker(db, settings, {
+    workspaceId,
+    connectionId: metadata.id,
+    providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+    kind: "api_key",
+    allowSubjectOwned: false
+  });
+  if (!connection || connection.status !== "active" || connection.metadata.credentialRole !== VERCEL_AI_GATEWAY_CONNECTION_ROLE) {
+    return null;
+  }
+  const apiKey = connection.credential.apiKey;
+  return typeof apiKey === "string" && apiKey.trim().length > 0 ? apiKey : null;
+}
 async function recordConnectionTokenRefresh(db, input) {
   return await withConnectionSubjectRls(
     db,
@@ -19117,6 +19149,510 @@ async function listSessionMcpServersForRun(db, workspaceId, sessionId, attemptId
     });
   });
 }
+var CONNECTOR_ACTION_POLICY_SNAPSHOT_MAX = 2048;
+var CONNECTOR_ACTION_APPROVAL_ID_MAX = 1024;
+var CONNECTOR_ACTION_CONNECTION_ID_MAX = 512;
+var CONNECTOR_ACTION_SERVER_ID_MAX = 256;
+var CONNECTOR_ACTION_NAME_MAX = 512;
+function boundedConnectorActionText(value, label, max) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || Buffer.byteLength(trimmed, "utf8") > max) {
+    throw new Error(`${label} must be between 1 and ${max} UTF-8 bytes`);
+  }
+  return trimmed;
+}
+function connectorActionPolicySelector(toolName, args) {
+  if (args && typeof args === "object" && !Array.isArray(args)) {
+    const action = args.action;
+    if (typeof action === "string" && action.trim().length > 0) {
+      return boundedConnectorActionText(action, "connector action name", CONNECTOR_ACTION_NAME_MAX);
+    }
+  }
+  return toolName;
+}
+function connectorActionEvidenceName(resolved) {
+  return resolved.entry?.actionName ?? "*";
+}
+function connectorActionFingerprint(input) {
+  return createHash6("sha256").update(
+    stableJson3({
+      workspaceId: input.workspaceId,
+      connectionId: input.connectionId,
+      serverId: input.serverId,
+      toolName: input.toolName,
+      actionName: input.actionName,
+      arguments: input.arguments ?? null
+    }),
+    "utf8"
+  ).digest("hex");
+}
+function resolveConnectorActionPolicy(snapshot, input) {
+  const candidates = snapshot.filter(
+    (entry) => entry.connectionId === input.connectionId && (entry.serverId === input.serverId || entry.serverId === "*") && (entry.toolName === input.toolName || entry.toolName === "*") && (entry.actionName === input.actionName || entry.actionName === "*")
+  ).map((entry) => ({
+    entry,
+    specificity: Number(entry.serverId !== "*") + Number(entry.toolName !== "*") + Number(entry.actionName !== "*")
+  })).sort(
+    (left, right) => right.specificity - left.specificity || left.entry.id.localeCompare(right.entry.id)
+  );
+  const selected = candidates[0];
+  if (!selected) return { managed: false };
+  if (candidates[1]?.specificity === selected.specificity) {
+    return { managed: true, source: "ambiguous", entry: null, decision: "block" };
+  }
+  return { managed: true, source: "explicit", entry: selected.entry };
+}
+function connectorActionAuditMetadata(row, extra = {}) {
+  return {
+    requestId: row.id,
+    sessionId: row.sessionId,
+    turnId: row.turnId,
+    attemptId: row.creationAttemptId,
+    creationExecutionGeneration: row.creationExecutionGeneration,
+    executionAttemptId: row.executionAttemptId,
+    executionAttemptGeneration: row.executionAttemptGeneration,
+    approvalId: row.approvalId,
+    initiatorKind: row.initiatorKind,
+    initiatorSubjectId: row.initiatorSubjectId,
+    connectionId: row.connectionId,
+    connectionVersion: row.connectionVersion,
+    serverId: row.serverId,
+    toolName: row.toolName,
+    actionName: row.actionName,
+    policyId: row.policyId,
+    policyVersion: row.policyVersion,
+    policySource: row.policySource,
+    policyDecision: row.policyDecision,
+    actionFingerprint: row.actionFingerprint,
+    ...extra
+  };
+}
+async function insertConnectorActionAudit(db, input) {
+  await db.insert(auditEvents).values({
+    accountId: input.row.accountId,
+    workspaceId: input.row.workspaceId,
+    subjectId: input.subjectId,
+    action: input.action,
+    targetType: "connector_action_request",
+    targetId: input.row.id,
+    metadata: connectorActionAuditMetadata(input.row, input.extra)
+  });
+}
+function normalizedConnectorActionInvocation(identity, invocation) {
+  const approvalId = boundedConnectorActionText(
+    invocation.approvalId,
+    "connector approval id",
+    CONNECTOR_ACTION_APPROVAL_ID_MAX
+  );
+  const serverId = boundedConnectorActionText(
+    invocation.serverId,
+    "connector server id",
+    CONNECTOR_ACTION_SERVER_ID_MAX
+  );
+  const toolName = boundedConnectorActionText(
+    invocation.toolName,
+    "connector tool name",
+    CONNECTOR_ACTION_NAME_MAX
+  );
+  const policyActionSelector = connectorActionPolicySelector(toolName, invocation.arguments);
+  const connectionId = invocation.connectionId?.trim() ? boundedConnectorActionText(
+    invocation.connectionId,
+    "connector connection id",
+    CONNECTOR_ACTION_CONNECTION_ID_MAX
+  ) : null;
+  return {
+    approvalId,
+    connectionId,
+    serverId,
+    toolName,
+    policyActionSelector,
+    arguments: invocation.arguments
+  };
+}
+function durableConnectorActionInvocation(identity, invocation, resolved) {
+  const actionName = connectorActionEvidenceName(resolved);
+  return {
+    approvalId: invocation.approvalId,
+    connectionId: invocation.connectionId,
+    serverId: invocation.serverId,
+    toolName: invocation.toolName,
+    actionName,
+    actionFingerprint: connectorActionFingerprint({
+      workspaceId: identity.workspaceId,
+      connectionId: invocation.connectionId,
+      serverId: invocation.serverId,
+      toolName: invocation.toolName,
+      actionName,
+      arguments: invocation.arguments
+    })
+  };
+}
+async function connectorActionAttemptSnapshot(db, identity) {
+  const [attempt] = await db.select({
+    accountId: sessionTurnAttempts.accountId,
+    sessionId: sessionTurnAttempts.sessionId,
+    turnId: sessionTurnAttempts.turnId,
+    executionGeneration: sessionTurnAttempts.executionGeneration,
+    state: sessionTurnAttempts.state,
+    connectorActionPolicies: sessionTurnAttempts.connectorActionPolicies
+  }).from(sessionTurnAttempts).where(
+    and11(
+      eq11(sessionTurnAttempts.workspaceId, identity.workspaceId),
+      eq11(sessionTurnAttempts.id, identity.attemptId)
+    )
+  ).limit(1);
+  if (!attempt || attempt.accountId !== identity.accountId || attempt.sessionId !== identity.sessionId || attempt.turnId !== identity.turnId || attempt.executionGeneration !== identity.executionGeneration || !["claimed", "running"].includes(attempt.state)) {
+    throw new Error(`connector action attempt ownership is unavailable: ${identity.attemptId}`);
+  }
+  if (attempt.connectorActionPolicies.length > CONNECTOR_ACTION_POLICY_SNAPSHOT_MAX) {
+    throw new Error("connector action policy snapshot exceeds the runtime bound");
+  }
+  return attempt.connectorActionPolicies;
+}
+function connectorActionRequestMatches(row, input) {
+  const entry = input.resolved.entry;
+  return row.accountId === input.identity.accountId && row.workspaceId === input.identity.workspaceId && row.sessionId === input.identity.sessionId && row.turnId === input.identity.turnId && row.creationAttemptId === input.identity.attemptId && row.creationExecutionGeneration === input.identity.executionGeneration && row.approvalId === input.invocation.approvalId && row.initiatorKind === input.identity.initiator.kind && row.initiatorSubjectId === input.identity.initiator.subjectId && row.connectionId === input.invocation.connectionId && row.serverId === input.invocation.serverId && row.toolName === input.invocation.toolName && row.actionName === input.invocation.actionName && row.policyId === (entry?.id ?? null) && row.policyVersion === (entry?.version ?? null) && row.policySource === input.resolved.source && row.policyDecision === (entry?.policy ?? "block") && row.actionFingerprint === input.invocation.actionFingerprint;
+}
+function connectorActionRequestMatchesLogicalCall(row, identity, invocation) {
+  if (!invocation.connectionId) return false;
+  return row.accountId === identity.accountId && row.workspaceId === identity.workspaceId && row.sessionId === identity.sessionId && row.turnId === identity.turnId && row.approvalId === invocation.approvalId && row.initiatorKind === identity.initiator.kind && row.initiatorSubjectId === identity.initiator.subjectId && row.connectionId === invocation.connectionId && row.serverId === invocation.serverId && row.toolName === invocation.toolName && row.actionFingerprint === connectorActionFingerprint({
+    workspaceId: identity.workspaceId,
+    connectionId: invocation.connectionId,
+    serverId: invocation.serverId,
+    toolName: invocation.toolName,
+    actionName: row.actionName,
+    arguments: invocation.arguments
+  });
+}
+async function insertConnectorActionRequest(db, input) {
+  const entry = input.resolved.entry;
+  const [inserted] = await db.insert(connectorActionRequests).values({
+    accountId: input.identity.accountId,
+    workspaceId: input.identity.workspaceId,
+    sessionId: input.identity.sessionId,
+    turnId: input.identity.turnId,
+    creationAttemptId: input.identity.attemptId,
+    creationExecutionGeneration: input.identity.executionGeneration,
+    approvalId: input.invocation.approvalId,
+    initiatorKind: input.identity.initiator.kind,
+    initiatorSubjectId: input.identity.initiator.subjectId,
+    connectionId: input.invocation.connectionId,
+    serverId: input.invocation.serverId,
+    toolName: input.invocation.toolName,
+    actionName: input.invocation.actionName,
+    policyId: entry?.id ?? null,
+    policyVersion: entry?.version ?? null,
+    policySource: input.resolved.source,
+    policyDecision: entry?.policy ?? "block",
+    actionFingerprint: input.invocation.actionFingerprint,
+    status: input.status,
+    ...input.status === "executing" ? {
+      executionAttemptId: input.identity.attemptId,
+      executionAttemptGeneration: input.identity.executionGeneration,
+      executionStartedAt: /* @__PURE__ */ new Date()
+    } : {}
+  }).onConflictDoNothing({
+    target: [
+      connectorActionRequests.workspaceId,
+      connectorActionRequests.sessionId,
+      connectorActionRequests.turnId,
+      connectorActionRequests.approvalId
+    ]
+  }).returning();
+  if (inserted) return { row: inserted, inserted: true };
+  const [existing] = await db.select().from(connectorActionRequests).where(
+    and11(
+      eq11(connectorActionRequests.workspaceId, input.identity.workspaceId),
+      eq11(connectorActionRequests.sessionId, input.identity.sessionId),
+      eq11(connectorActionRequests.turnId, input.identity.turnId),
+      eq11(connectorActionRequests.approvalId, input.invocation.approvalId)
+    )
+  ).for("update").limit(1);
+  if (!existing || !connectorActionRequestMatches(existing, input)) {
+    throw new Error("connector action approval id conflicts with different immutable inputs");
+  }
+  return { row: existing, inserted: false };
+}
+async function upsertConnectorActionPolicy(db, input) {
+  const scope = {
+    connectionId: boundedConnectorActionText(
+      input.connectionId,
+      "connector connection id",
+      CONNECTOR_ACTION_CONNECTION_ID_MAX
+    ),
+    serverId: boundedConnectorActionText(
+      input.serverId,
+      "connector server id",
+      CONNECTOR_ACTION_SERVER_ID_MAX
+    ),
+    toolName: boundedConnectorActionText(
+      input.toolName,
+      "connector tool name",
+      CONNECTOR_ACTION_NAME_MAX
+    ),
+    actionName: boundedConnectorActionText(
+      input.actionName,
+      "connector action name",
+      CONNECTOR_ACTION_NAME_MAX
+    )
+  };
+  const subjectId = boundedConnectorActionText(input.subjectId, "policy actor", 1024);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      await assertWorkspaceAccountPairInScope(tx, input.accountId, input.workspaceId);
+      const [existing] = await tx.select().from(connectorActionPolicies).where(
+        and11(
+          eq11(connectorActionPolicies.workspaceId, input.workspaceId),
+          eq11(connectorActionPolicies.connectionId, scope.connectionId),
+          eq11(connectorActionPolicies.serverId, scope.serverId),
+          eq11(connectorActionPolicies.toolName, scope.toolName),
+          eq11(connectorActionPolicies.actionName, scope.actionName)
+        )
+      ).for("update").limit(1);
+      if (existing?.policy === input.policy) return { policy: existing, changed: false };
+      const now = /* @__PURE__ */ new Date();
+      const [row] = existing ? await tx.update(connectorActionPolicies).set({
+        policy: input.policy,
+        version: existing.version + 1,
+        updatedBySubjectId: subjectId,
+        updatedAt: now
+      }).where(eq11(connectorActionPolicies.id, existing.id)).returning() : await tx.insert(connectorActionPolicies).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        ...scope,
+        policy: input.policy,
+        createdBySubjectId: subjectId,
+        updatedBySubjectId: subjectId
+      }).returning();
+      if (!row) throw new Error("Failed to persist connector action policy");
+      await tx.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId,
+        action: "connector.action.policy_changed",
+        targetType: "connector_action_policy",
+        targetId: row.id,
+        metadata: {
+          connectionId: row.connectionId,
+          serverId: row.serverId,
+          toolName: row.toolName,
+          actionName: row.actionName,
+          policy: row.policy,
+          version: row.version,
+          previousPolicy: existing?.policy ?? null,
+          previousVersion: existing?.version ?? null
+        }
+      });
+      return { policy: row, changed: true };
+    })
+  );
+}
+async function prepareConnectorActionApproval(db, identity, invocation) {
+  const normalized = normalizedConnectorActionInvocation(identity, invocation);
+  if (!normalized.connectionId) {
+    return { managed: false, decision: "unmanaged" };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: identity.accountId, workspaceId: identity.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const snapshot = await connectorActionAttemptSnapshot(tx, identity);
+      const resolved = resolveConnectorActionPolicy(snapshot, {
+        connectionId: normalized.connectionId,
+        serverId: normalized.serverId,
+        toolName: normalized.toolName,
+        actionName: normalized.policyActionSelector
+      });
+      if (!resolved.managed) return { managed: false, decision: "unmanaged" };
+      const durable = durableConnectorActionInvocation(
+        identity,
+        { ...normalized, connectionId: normalized.connectionId },
+        resolved
+      );
+      const decision = resolved.entry?.policy ?? "block";
+      if (decision === "allow") {
+        return {
+          managed: true,
+          decision,
+          actionFingerprint: durable.actionFingerprint
+        };
+      }
+      const { row, inserted } = await insertConnectorActionRequest(tx, {
+        identity,
+        invocation: durable,
+        resolved,
+        status: decision === "ask" ? "pending" : "blocked"
+      });
+      if (inserted) {
+        await insertConnectorActionAudit(tx, {
+          row,
+          action: decision === "ask" ? "connector.action.approval_requested" : "connector.action.blocked",
+          subjectId: identity.initiator.subjectId,
+          extra: { outcome: decision }
+        });
+      }
+      return {
+        managed: true,
+        decision,
+        requestId: row.id,
+        actionFingerprint: row.actionFingerprint
+      };
+    })
+  );
+}
+async function beginConnectorActionExecution(db, identity, invocation) {
+  const normalized = normalizedConnectorActionInvocation(identity, invocation);
+  if (!normalized.connectionId) {
+    return { allowed: true, managed: false };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: identity.accountId, workspaceId: identity.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const snapshot = await connectorActionAttemptSnapshot(tx, identity);
+      const [existing] = await tx.select().from(connectorActionRequests).where(
+        and11(
+          eq11(connectorActionRequests.workspaceId, identity.workspaceId),
+          eq11(connectorActionRequests.sessionId, identity.sessionId),
+          eq11(connectorActionRequests.turnId, identity.turnId),
+          eq11(connectorActionRequests.approvalId, normalized.approvalId)
+        )
+      ).for("update").limit(1);
+      if (existing && !connectorActionRequestMatchesLogicalCall(existing, identity, normalized)) {
+        throw new Error("connector action approval id conflicts with different immutable inputs");
+      }
+      let row = existing;
+      let inserted = false;
+      if (!row) {
+        const resolved = resolveConnectorActionPolicy(snapshot, {
+          connectionId: normalized.connectionId,
+          serverId: normalized.serverId,
+          toolName: normalized.toolName,
+          actionName: normalized.policyActionSelector
+        });
+        if (!resolved.managed) return { allowed: true, managed: false };
+        const durable = durableConnectorActionInvocation(
+          identity,
+          { ...normalized, connectionId: normalized.connectionId },
+          resolved
+        );
+        const decision = resolved.entry?.policy ?? "block";
+        const created = await insertConnectorActionRequest(tx, {
+          identity,
+          invocation: durable,
+          resolved,
+          status: decision === "ask" ? "pending" : decision === "block" ? "blocked" : "executing"
+        });
+        row = created.row;
+        inserted = created.inserted;
+        if (inserted) {
+          await insertConnectorActionAudit(tx, {
+            row,
+            action: decision === "ask" ? "connector.action.approval_requested" : decision === "block" ? "connector.action.blocked" : "connector.action.execution_started",
+            subjectId: identity.initiator.subjectId,
+            extra: { outcome: decision === "allow" ? "started" : decision }
+          });
+        }
+      }
+      if (row.status === "approved") {
+        const [executing] = await tx.update(connectorActionRequests).set({
+          status: "executing",
+          executionAttemptId: identity.attemptId,
+          executionAttemptGeneration: identity.executionGeneration,
+          executionStartedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        }).where(eq11(connectorActionRequests.id, row.id)).returning();
+        if (!executing) throw new Error("Approved connector action request disappeared");
+        row = executing;
+        await insertConnectorActionAudit(tx, {
+          row,
+          action: "connector.action.execution_started",
+          subjectId: identity.initiator.subjectId,
+          extra: { outcome: "started" }
+        });
+        return {
+          allowed: true,
+          managed: true,
+          requestId: row.id,
+          actionFingerprint: row.actionFingerprint
+        };
+      }
+      if (row.status === "executing") {
+        if (inserted) {
+          return {
+            allowed: true,
+            managed: true,
+            requestId: row.id,
+            actionFingerprint: row.actionFingerprint
+          };
+        }
+        const [uncertain] = await tx.update(connectorActionRequests).set({
+          status: "uncertain",
+          outcome: "retry_after_execution_started",
+          executionFinishedAt: /* @__PURE__ */ new Date(),
+          updatedAt: /* @__PURE__ */ new Date()
+        }).where(eq11(connectorActionRequests.id, row.id)).returning();
+        if (!uncertain) throw new Error("Executing connector action request disappeared");
+        await insertConnectorActionAudit(tx, {
+          row: uncertain,
+          action: "connector.action.execution_uncertain",
+          subjectId: identity.initiator.subjectId,
+          extra: { outcome: "retry_denied" }
+        });
+        return {
+          allowed: false,
+          managed: true,
+          reason: "uncertain_retry",
+          requestId: uncertain.id,
+          actionFingerprint: uncertain.actionFingerprint
+        };
+      }
+      const reason = row.status === "pending" ? "approval_required" : row.status === "rejected" ? "rejected" : row.status === "blocked" ? "blocked" : "already_executed";
+      return {
+        allowed: false,
+        managed: true,
+        reason,
+        requestId: row.id,
+        actionFingerprint: row.actionFingerprint
+      };
+    })
+  );
+}
+async function completeConnectorActionExecution(db, input) {
+  await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const [existing] = await tx.select().from(connectorActionRequests).where(
+        and11(
+          eq11(connectorActionRequests.workspaceId, input.workspaceId),
+          eq11(connectorActionRequests.id, input.requestId),
+          eq11(connectorActionRequests.executionAttemptId, input.attemptId)
+        )
+      ).for("update").limit(1);
+      if (!existing) throw new Error("Connector action request not found for completion");
+      if (existing.status === input.outcome) return;
+      if (existing.status !== "executing") {
+        throw new Error(`Connector action request cannot complete from ${existing.status}`);
+      }
+      const [row] = await tx.update(connectorActionRequests).set({
+        status: input.outcome,
+        outcome: input.outcome,
+        executionFinishedAt: /* @__PURE__ */ new Date(),
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(eq11(connectorActionRequests.id, existing.id)).returning();
+      if (!row) throw new Error("Connector action request disappeared during completion");
+      await insertConnectorActionAudit(tx, {
+        row,
+        action: input.outcome === "completed" ? "connector.action.execution_completed" : "connector.action.execution_uncertain",
+        subjectId: row.initiatorSubjectId,
+        extra: { outcome: input.outcome }
+      });
+    })
+  );
+}
 async function getNestedAgentDepthDeploymentPolicy(db) {
   const [row] = await db.select({
     maxNestedAgentDepth: nestedAgentDepthConfiguration.maxNestedAgentDepth,
@@ -31178,6 +31714,24 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         const mcpApprovalPolicies = Object.fromEntries(
           policyRows.map((row2) => [row2.serverId, row2.requireApproval ?? false])
         );
+        const connectorPolicyRows = await tx.select({
+          id: connectorActionPolicies.id,
+          connectionId: connectorActionPolicies.connectionId,
+          serverId: connectorActionPolicies.serverId,
+          toolName: connectorActionPolicies.toolName,
+          actionName: connectorActionPolicies.actionName,
+          policy: connectorActionPolicies.policy,
+          version: connectorActionPolicies.version
+        }).from(connectorActionPolicies).where(eq11(connectorActionPolicies.workspaceId, workspaceId)).orderBy(
+          asc5(connectorActionPolicies.connectionId),
+          asc5(connectorActionPolicies.serverId),
+          asc5(connectorActionPolicies.toolName),
+          asc5(connectorActionPolicies.actionName),
+          asc5(connectorActionPolicies.id)
+        ).limit(2049);
+        if (connectorPolicyRows.length > 2048) {
+          throw new Error("Connector action policy snapshot exceeds the 2048-row bound");
+        }
         return await registerSessionTurnAttemptClaim(tx, {
           id: input.attemptId,
           accountId: session.accountId,
@@ -31189,7 +31743,8 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           temporalWorkflowRunId: input.workflowRunId,
           temporalActivityId: input.dispatchId,
           verifiedControlRevision: Number(workspaceControl.revision),
-          mcpApprovalPolicies
+          mcpApprovalPolicies,
+          connectorActionPolicies: connectorPolicyRows
         });
       };
       if (session.activeTurnId !== null) {
@@ -34918,6 +35473,37 @@ async function acceptSessionApprovalDecision(db, input) {
         clientEventId: input.clientEventId ?? null
       }).returning();
       if (!event) throw new Error("Failed to append approval decision");
+      const approvalDecision = input.payload.decision;
+      if (approvalDecision === "approve" || approvalDecision === "reject") {
+        const [connectorRequest] = await tx.update(connectorActionRequests).set({
+          status: approvalDecision === "approve" ? "approved" : "rejected",
+          decision: approvalDecision,
+          decisionBySubjectId: boundedConnectorActionText(
+            input.subjectId,
+            "approval actor",
+            1024
+          ),
+          decisionEventId: event.id,
+          decidedAt: event.occurredAt,
+          updatedAt: /* @__PURE__ */ new Date()
+        }).where(
+          and11(
+            eq11(connectorActionRequests.workspaceId, input.workspaceId),
+            eq11(connectorActionRequests.sessionId, input.sessionId),
+            eq11(connectorActionRequests.turnId, turn.id),
+            eq11(connectorActionRequests.approvalId, approvalId),
+            eq11(connectorActionRequests.status, "pending")
+          )
+        ).returning();
+        if (connectorRequest) {
+          await insertConnectorActionAudit(tx, {
+            row: connectorRequest,
+            action: "connector.action.approval_decided",
+            subjectId: input.subjectId,
+            extra: { decision: approvalDecision }
+          });
+        }
+      }
       await tx.update(sessions).set({
         lastSequence: session.lastSequence + 1,
         updatedAt: /* @__PURE__ */ new Date()
@@ -36214,6 +36800,7 @@ export {
   attachKnowledgeEntityAlias,
   autoResumeSessionBranchInTransaction,
   backfillModelCallFactsFromSessionEvents,
+  beginConnectorActionExecution,
   beginKnowledgeSyncRun,
   beginRigChangeVerificationAttempt,
   beginSandboxRematerialization,
@@ -36257,6 +36844,7 @@ export {
   codexCapacityRefreshBackoffMs,
   commitWarmingToWarm,
   completeCodexResetRedemption,
+  completeConnectorActionExecution,
   completeExpiredFileUploadCleanup,
   completeFileUpload,
   completeFileUploadCleanup,
@@ -36586,6 +37174,7 @@ export {
   loadSocialConnectionCredential,
   loadVariableSetForRun,
   loadWorkspaceEnvironmentForRun,
+  loadWorkspaceVercelAiGatewayApiKey,
   lockSessionEventWriteRows,
   lockWorkspaceInferenceControl,
   markFileUploadFailed,
@@ -36627,6 +37216,7 @@ export {
   persistDrainSnapshot,
   persistWarmSnapshot,
   planWorkspaceCaptureGc,
+  prepareConnectorActionApproval,
   previewColdLostLeaseInstanceBlockers,
   projectEffectiveControlForRelatedAccess,
   projectSessionForRelatedAccess,
@@ -36708,6 +37298,7 @@ export {
   requireWorkspace,
   reserveSessionCommandReceipt,
   reserveToolspaceCallForAttempt,
+  resolveConnectorActionPolicy,
   resolveSlackInstallationRoute,
   resolveWorkspaceMemoryBlock,
   restoreKnowledgeSourceObject,
@@ -36823,6 +37414,7 @@ export {
   upsertBillingCustomer,
   upsertCapabilityCatalogItem,
   upsertCodexSubscriptionCredential,
+  upsertConnectorActionPolicy,
   upsertGitHubInstallation,
   upsertKnowledgeEntity,
   upsertKnowledgeFact,
@@ -36849,6 +37441,7 @@ export {
   withWorkspaceSubjectRls,
   withWorkspaceUsageLock,
   workspaceCaptureAtRevision,
-  workspaceCodexSubscriptionActive
+  workspaceCodexSubscriptionActive,
+  workspaceVercelAiGatewayConnectionActive
 };
 //# sourceMappingURL=index.js.map