@opengeni/db 1.0.1 → 3.1.0-canary.0

package/dist/attached-browser-devices.d.ts

@@ -20,6 +20,13 @@ export declare function reconcileAttachedBrowserInventory(db: Database, input: {
     enrollmentId: string;
     snapshot: AttachedBrowserInventorySnapshotValue;
 }): Promise<ReconcileAttachedBrowserInventoryResult>;
+/** Lock the device row first (same order as inventory) and prove the live
+ *  physical generation still matches this controller placement. */
+export declare function attachedDeviceGenerationMatches(tx: Database, input: {
+    workspaceId: string;
+    deviceId: string;
+    placementInstanceId: string;
+}): Promise<boolean>;
 /** Immediately mark every live Chrome profile on a cleanly disconnected agent
  *  offline. Historical endpoint rows remain discoverable and reconnect in place. */
 export declare function disconnectAttachedBrowserDevices(db: Database, input: {

package/dist/automations.d.ts

@@ -0,0 +1,154 @@
+import { AutomationAcceptedExecution, AutomationNormalizedEvent, type AutomationRun, type AutomationSource, type AutomationTrigger, type CreateAutomationSourceRequest, type CreateAutomationTriggerRequest, type UpdateAutomationSourceRequest, type UpdateAutomationTriggerRequest } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export declare class AutomationDeliveryConflictError extends Error {
+    readonly name = "AutomationDeliveryConflictError";
+    constructor();
+}
+export declare class AutomationRevisionConflictError extends Error {
+    readonly name = "AutomationRevisionConflictError";
+    constructor();
+}
+export declare class AutomationAuthorityRevokedError extends Error {
+    readonly name = "AutomationAuthorityRevokedError";
+    constructor(message?: string);
+}
+export type AutomationSourceSecret = AutomationSource & {
+    webhookSecretEncrypted: string;
+};
+export type AutomationTriggerWithRevision = AutomationTrigger & {
+    sourceStatus: "active" | "disabled";
+    sourceVersion: number;
+    sourceConfiguration: Record<string, unknown>;
+};
+export type AutomationStoredEvent = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+    sourceVersion: number;
+    sourceConfiguration: Record<string, unknown>;
+    matchedTriggerRevisions: Array<{
+        triggerId: string;
+        revision: number;
+    }>;
+    deliveryKey: string;
+    requestDigest: string;
+    normalizedEvent: AutomationNormalizedEvent;
+    status: "accepted" | "ignored" | "failed";
+    ignoredReason: string | null;
+    errorCode: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type AutomationRunExecution = AutomationRun & {
+    acceptedExecution: AutomationAcceptedExecution;
+};
+export declare function createAutomationSource(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    createdBySubjectId: string;
+    request: CreateAutomationSourceRequest;
+    webhookSecretEncrypted: string;
+    packInstallationId?: string | null;
+    packConnectorId?: string | null;
+}): Promise<AutomationSource>;
+export declare function resolveAutomationWebhookEndpoint(db: Database, endpointId: string): Promise<{
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+} | null>;
+export declare function getAutomationSourceSecret(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+}): Promise<AutomationSourceSecret | null>;
+export declare function listAutomationSources(db: Database, workspaceId: string): Promise<AutomationSource[]>;
+export declare function updateAutomationSource(db: Database, input: {
+    workspaceId: string;
+    sourceId: string;
+    request: UpdateAutomationSourceRequest;
+    webhookSecretEncrypted?: string;
+}): Promise<AutomationSource | null>;
+export declare function createAutomationTrigger(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    createdBySubjectId: string;
+    request: CreateAutomationTriggerRequest;
+    adapterId: string;
+}): Promise<AutomationTrigger>;
+export declare function listAutomationTriggers(db: Database, workspaceId: string): Promise<AutomationTrigger[]>;
+export declare function listActiveAutomationTriggersForSource(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+}): Promise<AutomationTriggerWithRevision[]>;
+export declare function getAutomationTriggerRevisions(db: Database, input: {
+    workspaceId: string;
+    refs: Array<{
+        triggerId: string;
+        revision: number;
+    }>;
+}): Promise<AutomationTrigger[]>;
+export declare function updateAutomationTrigger(db: Database, input: {
+    workspaceId: string;
+    triggerId: string;
+    subjectId: string;
+    request: UpdateAutomationTriggerRequest;
+}): Promise<AutomationTrigger | null>;
+export declare function recordAutomationEvent(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+    sourceVersion: number;
+    sourceConfiguration: Record<string, unknown>;
+    matchedTriggerRevisions: Array<{
+        triggerId: string;
+        revision: number;
+    }>;
+    deliveryKey: string;
+    requestDigest: string;
+    normalizedEvent: AutomationNormalizedEvent;
+    ignoredReason?: string | null;
+}): Promise<{
+    event: AutomationStoredEvent;
+    duplicate: boolean;
+}>;
+export declare function createAutomationRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sourceId: string;
+    triggerId: string;
+    triggerRevision: number;
+    eventId: string;
+    occurrenceKey: string;
+    acceptedExecution: AutomationAcceptedExecution;
+}): Promise<{
+    run: AutomationRunExecution;
+    duplicate: boolean;
+}>;
+export declare function listAutomationRuns(db: Database, workspaceId: string, limit?: number): Promise<AutomationRun[]>;
+export declare function getAutomationRunExecution(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+}): Promise<AutomationRunExecution | null>;
+export declare function claimAutomationRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+}): Promise<AutomationRunExecution | null>;
+export declare function assertAutomationRunAuthorityInTransaction(db: Database, input: {
+    workspaceId: string;
+    runId: string;
+    triggerId: string;
+    triggerRevision: number;
+    sourceId: string;
+    sourceVersion: number;
+    sessionId: string;
+}): Promise<void>;
+export declare function settleAutomationRun(db: Database, input: {
+    workspaceId: string;
+    runId: string;
+    status: "skipped" | "failed";
+    errorCode: string;
+}): Promise<void>;

package/dist/canonical-human-identities.js

@@ -9,9 +9,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-LTG3S6ZY.js";
-import "./chunk-ZWREYEWA.js";
-import "./chunk-6ZYKCRFO.js";
+} from "./chunk-EULAN2NP.js";
+import "./chunk-SCPUJS53.js";
+import "./chunk-PR2WMLOQ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/capability-integrations.d.ts

@@ -174,6 +174,19 @@ export declare class ApiIntegrationInstallationVersionConflictError extends Erro
 }
 export declare function installApiIntegration(db: Database, input: InstallApiIntegrationInput): Promise<InstalledApiIntegration>;
 export declare function listInstalledApiIntegrations(db: Database, workspaceId: string, subjectId?: string): Promise<ApiIntegrationRuntime[]>;
+/**
+ * Exact runnable API-integration server ids for a scheduled service run.
+ * Only runtime ids and the minimum delegation-matching metadata are selected;
+ * no integration definition, credential, token, endpoint, or tool schema is
+ * materialized before incident admission.
+ */
+export declare function listInstalledApiIntegrationServerIdsForDelegations(db: Database, workspaceId: string, delegations: readonly {
+    serverId: string;
+    connectionId: string;
+    providerDomain: string;
+    ownerSubjectId: string;
+    kind?: string | undefined;
+}[]): Promise<string[]>;
 /**
  * Read installed API Integrations from a transaction that already carries the
  * workspace RLS context. This is intentionally separate from the public

package/dist/child-lifecycle-notices.d.ts

@@ -0,0 +1,68 @@
+import { type ChildPausedPayload, type ChildProgressPayload, type ChildRequiresActionPayload, type ChildRequiresActionResolvedPayload, type ChildWaitingCapacityPayload, type HumanInputQuestion } from "@opengeni/contracts";
+export declare function configureChildLifecycleNotices(input: {
+    enabled: boolean;
+}): void;
+export declare function childLifecycleNoticesEnabled(): boolean;
+/** Bounded UTF-8 prefix with an explicit marker; never splits a code point. */
+export declare function boundedChildNoticeText(value: string, maxBytes: number): {
+    text: string;
+    truncated: boolean;
+};
+export declare const CHILD_LIFECYCLE_DEDUPE_PREFIX: {
+    readonly requiresAction: "child-requires-action";
+    readonly requiresActionResolved: "child-requires-action-resolved";
+    readonly paused: "child-paused";
+    readonly waitingCapacity: "child-waiting-capacity";
+    readonly progress: "child-progress";
+};
+export declare function childRequiresActionDedupeKey(input: {
+    childSessionId: string;
+    turnId: string;
+    turnGeneration: number;
+}): string;
+export declare function childRequiresActionResolvedDedupeKey(input: {
+    childSessionId: string;
+    turnId: string;
+    turnGeneration: number;
+    requestId: string | null;
+    approvalId: string | null;
+}): string;
+export declare function childPausedDedupeKey(input: {
+    childSessionId: string;
+    receiptId: string;
+}): string;
+export declare function childWaitingCapacityDedupeKey(input: {
+    childSessionId: string;
+    waiterId: string;
+}): string;
+export declare function childProgressDedupeKey(input: {
+    childSessionId: string;
+    receiptId: string;
+}): string;
+/**
+ * Build the bounded child_requires_action payload from the child's frozen
+ * human-input requests and pending approvals. Only typed, content-free facts
+ * plus one bounded first-question preview per request cross to the parent:
+ * never subject ids, credentials, or raw tool arguments. The whole payload
+ * stays within CHILD_REQUIRES_ACTION_PAYLOAD_MAX_BYTES by dropping trailing
+ * requests and recording `truncated`.
+ */
+export declare function buildChildRequiresActionPayload(input: {
+    childSessionId: string;
+    childTurnId: string;
+    childTurnGeneration: number;
+    humanInputRequests: ReadonlyArray<{
+        id: string;
+        questions: readonly HumanInputQuestion[];
+        allowSkip: boolean;
+        expiresAt?: Date | null;
+    }>;
+    pendingApprovals: readonly unknown[];
+}): ChildRequiresActionPayload;
+export declare function childRequiresActionSummary(childSessionId: string, payload: ChildRequiresActionPayload): string;
+export declare function childRequiresActionResolvedSummary(childSessionId: string, payload: ChildRequiresActionResolvedPayload): string;
+export declare function childPausedSummary(childSessionId: string, payload: ChildPausedPayload): string;
+export declare function childWaitingCapacitySummary(childSessionId: string, payload: ChildWaitingCapacityPayload): string;
+export declare function childProgressSummary(childSessionId: string, payload: ChildProgressPayload): string;
+export declare function boundedChildPausedReason(reason: string | null | undefined): string | null;
+export declare function boundedChildProgressNote(note: string): string;

package/dist/{chunk-LTG3S6ZY.js → chunk-EULAN2NP.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-ZWREYEWA.js";
+} from "./chunk-SCPUJS53.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -256,4 +256,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-LTG3S6ZY.js.map
+//# sourceMappingURL=chunk-EULAN2NP.js.map

package/dist/{chunk-CUPM3FGB.js → chunk-NJVZPWXY.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-ZWREYEWA.js";
+} from "./chunk-SCPUJS53.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-6ZYKCRFO.js";
+} from "./chunk-PR2WMLOQ.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-CUPM3FGB.js.map
+//# sourceMappingURL=chunk-NJVZPWXY.js.map

package/dist/{chunk-4SR4HKKA.js → chunk-NMUBV7Z5.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-ZWREYEWA.js";
+} from "./chunk-SCPUJS53.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -17,9 +17,11 @@ import {
   decodeEditableArtifactSerializedCommit
 } from "@opengeni/contracts/editable-artifact-serialized-commit";
 import {
+  EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION,
   EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES,
   EDITABLE_ARTIFACT_PRODUCT_MAX_SNAPSHOT_BYTES
 } from "@opengeni/contracts/editable-artifacts";
+import { EDITABLE_ARTIFACT_LIVE_WIRE_VERSION } from "@opengeni/contracts/editable-artifact-versions";
 import { sql } from "drizzle-orm";
 var EditableArtifactPersistenceError = class extends Error {
   constructor(code, message, options) {
@@ -886,7 +888,6 @@ var PostgresEditableArtifactLiveReadStore = class {
   async readBootstrap(input) {
     const scope = validateScope(input.scope);
     const artifactId = validateStableId(input.artifactId, "artifact id");
-    validateInteger(input.protocolVersion, "live protocol version", 1);
     const resume = validateLiveResume(input.resume);
     const authority = await withRlsContext(
       this.db,
@@ -1076,7 +1077,8 @@ var PostgresEditableArtifactLiveReadStore = class {
       ...common,
       modality: snapshot.modality,
       causalFrontier: snapshot.coveredCausalFrontier,
-      operationProtocolVersion: snapshot.operationProtocolVersion
+      operationProtocolVersion: snapshot.operationProtocolVersion,
+      snapshotVersion: snapshot.crdtStateVersion
     }) : Object.freeze({
       ...common,
       modality: snapshot.modality,
@@ -1670,7 +1672,7 @@ async function loadSnapshotMetadata(db, scope, artifactId, snapshotId) {
 }
 function validateLiveResume(input) {
   if (!isPlainRecord(input)) throw new TypeError("Editable artifact live resume is invalid");
-  const modality = input.modality ?? "spreadsheet";
+  const modality = input.modality;
   if (modality !== "spreadsheet" && modality !== "document" && modality !== "presentation") {
     throw new TypeError("Editable artifact live resume modality is invalid");
   }
@@ -2109,7 +2111,7 @@ function committedTransactionFromRow(row, durableModality) {
     } catch (error) {
       throw new EditableArtifactPersistenceError(
         "corrupt_history",
-        "Stored canonical committed transaction is not a valid OGACO001 envelope",
+        "Stored canonical committed transaction is not a valid OGACO002 envelope",
         { cause: error }
       );
     }
@@ -2641,12 +2643,12 @@ function validateCommittedTransactionProjection(transaction, receipt, operations
     try {
       summary2 = decodeCommittedTransactionSummary(transaction.committedTransactionBytes);
     } catch (error) {
-      throw new TypeError("Canonical committed transaction is not a valid OGACO001 envelope", {
+      throw new TypeError("Canonical committed transaction is not a valid OGACO002 envelope", {
         cause: error
       });
     }
     if (summary2.transactionId !== transaction.serverTransactionId || summary2.dot.replicaId !== transaction.dot.replicaId || summary2.dot.counter !== transaction.dot.counter || summary2.priorStateHash !== transaction.priorStateHash || summary2.stateHash !== transaction.stateHash || summary2.operationProtocolVersion !== transaction.operationProtocolVersion || !sameStringArray(summary2.operationIds, operationIds) || !sameFrontier(summary2.resolvedCausalBase, resolvedCausalBase) || !sameFrontier(summary2.resultingCausalFrontier, resultingCausalFrontier)) {
-      throw new TypeError("Canonical OGACO001 bytes disagree with their durable projection");
+      throw new TypeError("Canonical OGACO002 bytes disagree with their durable projection");
     }
     return;
   }
@@ -3012,6 +3014,10 @@ function validateLiveTicketRecord(input) {
     throw new TypeError("Live ticket lifetime must be 1-60 seconds");
   }
   const modality = validateLiveTicketModality(input.modality);
+  const protocolVersion = validateInteger(input.protocolVersion, "live protocol version", 1);
+  if (protocolVersion !== EDITABLE_ARTIFACT_LIVE_WIRE_VERSION) {
+    throw new TypeError("Live ticket protocol version is unsupported");
+  }
   return Object.freeze({
     tokenDigest: validateHash(input.tokenDigest, "live ticket digest"),
     scope: validateScope(input.scope),
@@ -3019,7 +3025,7 @@ function validateLiveTicketRecord(input) {
     modality,
     actor: validateLiveTicketActor(input.actor),
     allowEdit: validateBoolean(input.allowEdit, "live ticket allowEdit"),
-    protocolVersion: validateInteger(input.protocolVersion, "live protocol version", 1),
+    protocolVersion,
     issuedAt,
     expiresAt
   });
@@ -3241,8 +3247,10 @@ function validateCanonicalIntentBytes(value, requestHashInput) {
   return bytes;
 }
 function validateIntentProtocolVersion(value) {
-  if (value !== 1) throw new TypeError("Intent protocol version must be 1 for OGATX001");
-  return 1;
+  if (value !== EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION) {
+    throw new TypeError("Intent protocol version is unsupported for current OGATX001");
+  }
+  return EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION;
 }
 function validateClientTransactionId(value) {
   if (typeof value !== "string" || value.length < 1 || value.length > 200 || !/^[A-Za-z0-9._:-]+$/.test(value)) {
@@ -3532,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-4SR4HKKA.js.map
+//# sourceMappingURL=chunk-NMUBV7Z5.js.map