@opengeni/db 0.36.1 → 3.1.0-canary.0

package/dist/connection-authority.d.ts

@@ -0,0 +1,95 @@
+import { ConnectionAuthoritySummary, ConnectionUseAttribution, ConnectionUseAuthorizationResult, type IssueConnectionUseGrantRequest, type ConnectionUseDenialReason as ConnectionUseDenialReasonValue } from "@opengeni/contracts/connection-authority";
+import { type ConnectionKind as ConnectionKindValue, type UserResourceDelegation } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export declare function listSelfConnectionAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<ConnectionAuthoritySummary[]>;
+export declare function issueSelfConnectionUseGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    request: IssueConnectionUseGrantRequest;
+}): Promise<{
+    grantId: string;
+    targetWorkspaceId: string;
+    targetSessionId: string | null;
+    mode: "always" | "once" | "session";
+    context: "user_private" | "workspace_shared";
+    authorityEpoch: number | null;
+    generation: number;
+    status: "active" | "consumed" | "expired" | "revoked";
+    expiresAt: string | null;
+    delegation: {
+        authorityId: string;
+        grantId: string;
+        organizationId: string;
+        workspaceId: string;
+        sessionId: string | null;
+        action: string;
+        mode: "always" | "once" | "session";
+        context: "user_private" | "workspace_shared";
+        authorityEpoch: number | null;
+        authorityGeneration: number;
+        grantGeneration: number;
+        resourceVersionId?: string | null | undefined;
+    };
+    action: "connection.use";
+}>;
+export declare function revokeSelfConnectionUseGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    grantId: string;
+}): Promise<{
+    grantId: string;
+    generation: number;
+    status: "revoked";
+    revokedAt: string;
+}>;
+/**
+ * Resolves the immutable physical origin for one explicit common-user
+ * connection selection. The SECURITY DEFINER database boundary proves the
+ * owning human, active organization membership, target-workspace access, and
+ * exact authority/grant generations without exposing credentials or allowing
+ * an ambient cross-workspace inventory.
+ */
+export declare function resolvePersonalConnectionAuthoritySelectionOrigin(db: Database, input: {
+    accountId: string;
+    targetWorkspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    delegation: UserResourceDelegation;
+}): Promise<string | null>;
+export declare function resolveConnectionUseAuthority(db: Database, input: {
+    snapshot: unknown;
+}): Promise<ConnectionUseAuthorizationResult>;
+export type AcceptedConnectionUseContext = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    physicalRequestId: string;
+    usePhase: "credential_resolution" | "provider_request";
+};
+export type AcceptedConnectionUseResolution = {
+    status: "denied";
+    reason: ConnectionUseDenialReasonValue;
+} | {
+    status: "authorized";
+    originWorkspaceId: string;
+    connectionKind: ConnectionKindValue;
+    attribution: ConnectionUseAttribution;
+};
+export declare function resolveAcceptedConnectionUse(db: Database, input: AcceptedConnectionUseContext & {
+    serverId: string;
+    connectionId?: string;
+    providerDomain: string;
+    connectionKind?: ConnectionKindValue;
+    subjectScope?: "workspace" | "subject";
+    ownerSubjectId?: string;
+}): Promise<AcceptedConnectionUseResolution>;

package/dist/connection-scopes.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Canonical comparison key for provider-reported OAuth scopes.
+ *
+ * Google may return the canonical userinfo scope URLs after the application
+ * requested the standard `email` / `profile` aliases. Microsoft scope names
+ * are case-insensitive. All other providers retain exact comparison.
+ */
+export declare function connectionScopeKey(providerDomain: string, value: string): string;

package/dist/connection-tenancy-backfill.d.ts

@@ -0,0 +1,41 @@
+import { type Database } from "./database.js";
+export type ConnectionAuthorityClassificationReport = {
+    schemaVersion: 1;
+    organizationId: string;
+    runKey: string | null;
+    rewroteConnectionRows: false;
+    receiptId?: string;
+    connections: {
+        total: number;
+        workspaceOwned: number;
+        userOwned: number;
+        deterministicRepairPending: number;
+        unresolved: number;
+    };
+};
+export type ConnectionAuthorityBackfillReport = {
+    schemaVersion: 1;
+    organizationId: string;
+    dryRun: boolean;
+    limit: number;
+    candidates: number;
+    upgraded: number;
+    moreLikely: boolean;
+};
+/**
+ * Full-population connection authority classification. Supplying a fresh run
+ * key writes one immutable migration-0300 receipt and exact unresolved rows.
+ */
+export declare function classifyOrganizationConnectionAuthority(db: Database, input: {
+    organizationId: string;
+    runKey?: string | null;
+}): Promise<ConnectionAuthorityClassificationReport>;
+/**
+ * One bounded, resumable legacy_user -> user upgrade batch. Dry-run is the
+ * default; candidates are claimed with SKIP LOCKED when applying.
+ */
+export declare function backfillOrganizationConnectionAuthority(db: Database, input: {
+    organizationId: string;
+    limit?: number;
+    dryRun?: boolean;
+}): Promise<ConnectionAuthorityBackfillReport>;

package/dist/connection-token-resolver.d.ts

@@ -1,9 +1,11 @@
 import { environmentsEncryptionKeyBytes, type McpServerConnectionRef, type Settings } from "@opengeni/config";
 import type { ConnectionCredentialPlacement, ConnectionKind, ConnectionCredentialsPort, ConnectionStatus, McpConnectionResourceScope, McpCredentialAuthNeededReason, McpCredentialsRequest, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
+import { type ConnectionUseAttribution, type ConnectionUseAuthorizationResult } from "@opengeni/contracts/connection-authority";
 import { type DnsLookup, type FetchLike } from "@opengeni/network";
 export { isPrivateAddress } from "@opengeni/network";
 import { encryptEnvironmentValue } from "./environment-crypto.js";
 import type { Database } from "./database.js";
+import type { AcceptedConnectionUseContext, AcceptedConnectionUseResolution } from "./connection-authority.js";
 export type ConnectionCredentialForBroker = {
     id: string;
     accountId: string;
@@ -17,6 +19,8 @@ export type ConnectionCredentialForBroker = {
     expiresAt: Date | null;
     lastRefreshAt: Date | null;
     version: number;
+    /** Immutable execution authority generation; distinct from token refresh version. */
+    authorityGeneration?: number;
     metadata: Record<string, unknown>;
 };
 export type ConnectionCredentialLookupInput = {
@@ -26,6 +30,7 @@ export type ConnectionCredentialLookupInput = {
     kind?: ConnectionKind;
     subjectId?: string | null;
     allowSubjectOwned?: boolean;
+    expectedAuthorityGeneration?: number;
 };
 export type ConnectionTokenRefreshInput = {
     id: string;
@@ -34,6 +39,7 @@ export type ConnectionTokenRefreshInput = {
     credentialEncrypted: string;
     expiresAt: Date | null;
     grantedScopes?: string[];
+    metadata?: Record<string, unknown>;
     lastRefreshAt: Date;
     subjectId?: string | null;
 };
@@ -50,6 +56,14 @@ export type ResolveConnectionCredentialResult = {
     connectionId: string;
     /** Exact durable version when the credential came from the local connection store. */
     connectionVersion?: number;
+    /** Metadata-only owner attribution from the immediate pre-use fence. */
+    connectionUseAttribution?: ConnectionUseAttribution;
+    /**
+     * Revalidate the exact accepted attempt immediately before one target
+     * provider request. Credential lookup/refresh is a separate audited
+     * boundary and must not manufacture a provider-request fact by itself.
+     */
+    authorizeProviderRequest?: () => Promise<boolean>;
     expiresAt?: Date | null;
 } | {
     status: "auth_needed";
@@ -75,6 +89,10 @@ export type ResolveConnectionCredentialInput = {
     /** Defaults to header-only MCP transport. */
     credentialTarget?: "mcp" | "http_api";
     forceRefresh?: boolean;
+    /** Exact immutable accepted-work authority; never credential-bearing. */
+    connectionUseAuthority?: unknown;
+    /** Exact accepted attempt plus one stable physical-provider request id. */
+    connectionUseContext?: AcceptedConnectionUseContext;
 };
 export type HostMcpCredentialResolverContext = {
     accountId: string;
@@ -87,7 +105,6 @@ export type HostMcpCredentialResolverContext = {
     initiator: TurnInitiator;
     initiatorContext: TurnInitiatorContext;
     surface: McpCredentialsRequest["surface"];
-    allowOfficialGmailRestDestination?: boolean;
 };
 export declare class HostMcpCredentialScopeError extends Error {
     constructor(field: "accountId" | "workspaceId" | "sessionId");
@@ -111,6 +128,17 @@ export type ConnectionBrokerDeps = {
     encrypt: typeof encryptEnvironmentValue;
     keyBytes: typeof environmentsEncryptionKeyBytes;
     now: () => Date;
+    authorizeUse?: (db: Database, input: {
+        snapshot: unknown;
+    }) => Promise<ConnectionUseAuthorizationResult>;
+    authorizeAcceptedUse?: (db: Database, input: AcceptedConnectionUseContext & {
+        serverId: string;
+        connectionId?: string;
+        providerDomain: string;
+        connectionKind?: ConnectionKind;
+        subjectScope?: "workspace" | "subject";
+        ownerSubjectId?: string;
+    }) => Promise<AcceptedConnectionUseResolution>;
 };
 export type PermanentConnectionRefreshFailure = {
     workspaceId: string;
@@ -152,4 +180,5 @@ export declare function refreshOAuthConnectionCredential(cred: ConnectionCredent
     credential: Record<string, unknown>;
     expiresAt: Date | null;
     grantedScopes?: string[];
+    metadata?: Record<string, unknown>;
 }>;

package/dist/database.d.ts

@@ -57,6 +57,13 @@ export type RlsStrategy = "force" | "scoped";
  * `auth_users` directly. Returns the user id, or null when no such user exists.
  */
 export type UserLookup = (db: Database, email: string) => Promise<string | null>;
+export type ManagedUserProfile = {
+    id: string;
+    name: string | null;
+    email: string;
+};
+/** Host identity projection used by organization administration rosters. */
+export type UserProfileLookup = (db: Database, userIds: readonly string[]) => Promise<ManagedUserProfile[]>;
 export type CreateDbOptions = {
     /**
      * The Postgres `search_path` for this connection (Step I, §7.8 runtime half).
@@ -74,6 +81,8 @@ export type CreateDbOptions = {
     rlsStrategy?: RlsStrategy;
     /** Host-provided user-by-email resolver; unset → today's raw `auth_users` query. */
     userLookup?: UserLookup;
+    /** Host-provided user profile projection; unset → standalone `auth_users`. */
+    userProfileLookup?: UserProfileLookup;
     /** postgres-js pool size; defaults to today's `10`. */
     max?: number;
     /**
@@ -94,6 +103,7 @@ export type CreateDbOptions = {
 type DbBinding = {
     rlsStrategy: RlsStrategy;
     userLookup?: UserLookup;
+    userProfileLookup?: UserProfileLookup;
 };
 /** The strategy bound to a handle (or the `"force"` default). */
 export declare function rlsStrategyFor(db: Database): RlsStrategy;
@@ -144,6 +154,7 @@ export declare function createDb(databaseUrl: string, options?: CreateDbOptions)
 export declare function registerDbBinding(db: Database, binding: {
     rlsStrategy?: RlsStrategy;
     userLookup?: UserLookup;
+    userProfileLookup?: UserProfileLookup;
 }): void;
 export declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
 export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
@@ -166,6 +177,14 @@ export declare function withSessionActivityRlsContext<T>(db: Database, context:
     workspaceId: string;
 }, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/**
+ * Run one of several ordered workspace activity scopes inside a caller-owned
+ * transaction. Each scope is fully finalized before restoring the caller's
+ * gate GUCs, so the next workspace can reuse the same outer transaction.
+ */
+export declare function withRestoredSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
+    workspaceId: string;
+}, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
 /**
  * Open one nested savepoint without losing the gate brand. Drizzle correctly
  * preserves the backend-local gate GUCs, but its structural transaction type

package/dist/editable-artifact-durable-export.d.ts

@@ -76,6 +76,9 @@ export type PersistedEditableArtifactMaterializationJob = Readonly<{
     completedAt: string | null;
     result: PersistedEditableArtifactMaterializationResult | null;
 }>;
+export type ReadAuthorizedEditableArtifactMaterializationRequest = ExportContext & Readonly<{
+    jobId: string;
+}>;
 export type PersistedEditableArtifactExportSnapshot = Readonly<{
     modality: PersistedEditableArtifactExportModality;
     snapshotId: string;
@@ -150,4 +153,11 @@ export declare class PostgresEditableArtifactDurableExportStore {
         objectReference: string | null;
     }>>>;
 }
+/**
+ * Reads one canonical materialization through the same exact actor authority
+ * used by editable-artifact export. This is intentionally narrower than the
+ * general store API: publication may verify an already-returned immutable
+ * receipt, but it cannot manufacture or widen artifact authority.
+ */
+export declare function readAuthorizedEditableArtifactMaterialization(db: Database, input: ReadAuthorizedEditableArtifactMaterializationRequest): Promise<PersistedEditableArtifactMaterializationJob | null>;
 export {};

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-Z7VYMNPZ.js";
-import "./chunk-5KTIEDX7.js";
+} from "./chunk-SCPUJS53.js";
+import "./chunk-PR2WMLOQ.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts
@@ -232,6 +232,20 @@ var PostgresEditableArtifactDurableExportStore = class {
     });
   }
 };
+async function readAuthorizedEditableArtifactMaterialization(db, input) {
+  const context = validateContext(input);
+  const jobId = stableId(input.jobId, "job id");
+  return await withRlsContext(db, context.scope, async (tx) => {
+    const artifact = await lockArtifact(tx, context.scope, context.artifactId);
+    if (!artifact) return null;
+    const authorization = await authorize(tx, context);
+    if (!authorization.allowed || authorization.revision !== artifact.authorizationRevision) {
+      return null;
+    }
+    const loaded = await loadJob(tx, context.scope, context.artifactId, jobId, false);
+    return loaded?.job ?? null;
+  });
+}
 async function authorize(tx, request) {
   const actor = request.actor;
   const rows = await rawRows(
@@ -783,6 +797,7 @@ function contractViolation(message) {
 }
 export {
   EditableArtifactDurableExportPersistenceError,
-  PostgresEditableArtifactDurableExportStore
+  PostgresEditableArtifactDurableExportStore,
+  readAuthorizedEditableArtifactMaterialization
 };
 //# sourceMappingURL=editable-artifact-durable-export.js.map