@opengeni/db 1.2.1-canary.37222965366001 → 1.3.0

package/dist/api-integration-approvals.d.ts

@@ -0,0 +1,13 @@
+import type { StoredApiIntegrationRevision } from "./capability-integrations.js";
+export declare function apiIntegrationToolEffect(revision: StoredApiIntegrationRevision, toolId: string): string | null;
+export declare function apiIntegrationToolMeaningUnchanged(previous: StoredApiIntegrationRevision | null, next: StoredApiIntegrationRevision, toolId: string): boolean;
+/** Omission preserves a choice only for the same account and executable meaning.
+ * An explicit list (including []) replaces the legacy auto-approval selection. */
+export declare function apiIntegrationRequiredApprovals(input: {
+    revision: StoredApiIntegrationRevision;
+    previousRevision: StoredApiIntegrationRevision | null;
+    selectedTools: readonly string[];
+    previousConfig: Record<string, unknown> | null;
+    sameAuthority: boolean;
+    autoApprovedTools?: readonly string[];
+}): string[];

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-GDN5TSZP.js";
-import "./chunk-O2Y5E5M3.js";
-import "./chunk-FWQNHNOU.js";
+} from "./chunk-6UKNJ43T.js";
+import "./chunk-LRSIODCQ.js";
+import "./chunk-DSNEIW5E.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/capability-reconciliation.js

@@ -1,7 +1,7 @@
 import {
   withWorkspaceRls
-} from "./chunk-O2Y5E5M3.js";
-import "./chunk-FWQNHNOU.js";
+} from "./chunk-LRSIODCQ.js";
+import "./chunk-DSNEIW5E.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/{chunk-LXPFNG4L.js → chunk-3XHC5KC5.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-O2Y5E5M3.js";
+} from "./chunk-LRSIODCQ.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3592,4 +3592,4 @@ export {
   PostgresEditableArtifactLiveReadStore,
   transactionallyAuthorizeEditableArtifactActor
 };
-//# sourceMappingURL=chunk-LXPFNG4L.js.map
+//# sourceMappingURL=chunk-3XHC5KC5.js.map

package/dist/{chunk-VDPCIFKL.js → chunk-6S5T6FSP.js}

@@ -1,16 +1,16 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-6EIEGHPK.js";
+} from "./chunk-BRVBLQAL.js";
 import {
   lockSessionEventWriteRows
-} from "./chunk-CYP72JTQ.js";
+} from "./chunk-OEFNTGR3.js";
 import {
   withRlsContext,
   withSessionActivityRlsContext
-} from "./chunk-O2Y5E5M3.js";
+} from "./chunk-LRSIODCQ.js";
 import {
   sandboxRetainedProcesses
-} from "./chunk-FWQNHNOU.js";
+} from "./chunk-DSNEIW5E.js";
 
 // src/retained-provider-commands.ts
 import { and, eq, sql } from "drizzle-orm";
@@ -299,4 +299,4 @@ export {
   retainedProcessCancellationRequested,
   requestRetainedProcessDeadlineCancellation
 };
-//# sourceMappingURL=chunk-VDPCIFKL.js.map
+//# sourceMappingURL=chunk-6S5T6FSP.js.map

package/dist/{chunk-GDN5TSZP.js → chunk-6UKNJ43T.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-O2Y5E5M3.js";
+} from "./chunk-LRSIODCQ.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -318,4 +318,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-GDN5TSZP.js.map
+//# sourceMappingURL=chunk-6UKNJ43T.js.map

package/dist/{chunk-YOYILDLY.js → chunk-7QWWTVYH.js}

@@ -161,9 +161,15 @@ var ARTIFACT_PIN_RUNTIME_ROUTINES = [
 var ARTIFACT_PINS_TABLE = "artifact_catalog_pins";
 var SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES = [
   "prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)",
-  "read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)"
+  "read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)",
+  "set_organization_slack_bot_access(uuid, uuid, uuid, text, boolean)",
+  "read_organization_slack_bot_access(uuid, uuid, uuid)",
+  "list_organization_slack_bots(uuid, uuid)",
+  "prepare_organization_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, uuid, bigint, text, text, text)",
+  "read_organization_slack_bot_message(uuid, uuid, uuid, uuid)"
 ];
 var SCHEDULED_SLACK_BOT_MESSAGES_TABLE = "scheduled_slack_bot_messages";
+var ORGANIZATION_SLACK_BOT_ACCESS_TABLE = "organization_slack_bot_access";
 var ORGANIZATION_SIGNUP_USE_CASE_RUNTIME_ROUTINES = [
   "record_organization_signup_use_case(uuid, text, text)"
 ];
@@ -1962,6 +1968,7 @@ async function inspectRuntimeDatabasePosture(db, options) {
               ${SANDBOX_FILE_PUBLICATIONS_TABLE},
               ${ARTIFACT_PINS_TABLE},
               ${SCHEDULED_SLACK_BOT_MESSAGES_TABLE},
+              ${ORGANIZATION_SLACK_BOT_ACCESS_TABLE},
               ${ORGANIZATION_SIGNUP_USE_CASES_TABLE},
               ${SLACK_FILE_UPLOAD_OPERATIONS_TABLE},
               'organization_usage_read_capabilities',
@@ -3593,6 +3600,21 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       }
     }
   }
+  const botAccessTables = posture.privateTables.filter(
+    (table) => table.name === ORGANIZATION_SLACK_BOT_ACCESS_TABLE
+  );
+  if (botAccessTables.length !== 1) {
+    if (!options.protectedTables)
+      violations.push("organization Slack bot access relation is missing or ambiguous");
+  } else {
+    const table = botAccessTables[0];
+    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)
+      violations.push("organization Slack bot access lacks active FORCE-RLS isolation");
+    if (table.select || table.insert || table.update || table.delete || table.truncate || table.references || table.trigger || table.owner === expectedRole)
+      violations.push("runtime role has forbidden direct organization Slack bot access authority");
+    if (table.owner !== scheduledSlackMessageTables[0]?.owner)
+      violations.push("organization Slack bot access owner does not match Slack post authority");
+  }
   const signupUseCaseTables = posture.privateTables.filter(
     (table) => table.name === ORGANIZATION_SIGNUP_USE_CASES_TABLE
   );
@@ -5890,6 +5912,16 @@ BEGIN
       REVOKE ALL ON TABLE opengeni_private.organization_signup_use_cases FROM PUBLIC;
       REVOKE ALL ON FUNCTION opengeni_private.record_organization_signup_use_case(uuid,text,text) FROM PUBLIC;
     END IF;
+    IF to_regclass('opengeni_private.organization_slack_bot_access') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.organization_slack_bot_access FROM %I', ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.organization_slack_bot_access FROM PUBLIC;
+      REVOKE ALL ON FUNCTION
+        opengeni_private.set_organization_slack_bot_access(uuid,uuid,uuid,text,boolean),
+        opengeni_private.read_organization_slack_bot_access(uuid,uuid,uuid),
+        opengeni_private.list_organization_slack_bots(uuid,uuid),
+        opengeni_private.prepare_organization_slack_bot_message(uuid,uuid,uuid,uuid,uuid,integer,uuid,bigint,text,text,text),
+        opengeni_private.read_organization_slack_bot_message(uuid,uuid,uuid,uuid) FROM PUBLIC;
+    END IF;
     FOREACH routine_signature IN ARRAY ARRAY[
       'read_sender_connection(uuid,uuid,uuid,text)',
       'validate_mcp_account_bindings(jsonb,jsonb)',
@@ -6140,4 +6172,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-YOYILDLY.js.map
+//# sourceMappingURL=chunk-7QWWTVYH.js.map