@opengeni/db 3.1.0-canary.0 → 3.2.0-canary.0

package/dist/connection-tenancy-backfill.d.ts

@@ -22,6 +22,50 @@ export type ConnectionAuthorityBackfillReport = {
     upgraded: number;
     moreLikely: boolean;
 };
+export type ConnectionAuthorityConvergenceClassification = "connection_backfill_ready" | "membership_backfill_eligible" | "membership_lifecycle_review_required" | "external_subject_requires_classification" | "missing_login_identity" | "organization_identity_mismatch" | "missing_owner_workspace_membership" | "conflicting_authority_rows" | "legacy_shape_unrecognized";
+export type ConnectionAuthorityConvergenceAction = "run_connection_backfill" | "run_membership_backfill_then_connection_backfill" | "review_membership_lifecycle_do_not_reactivate_automatically" | "classify_external_subject_then_migrate_via_authorized_connection_lifecycle" | "restore_login_identity_then_recheck" | "correct_organization_identity_through_supported_account_lifecycle_then_recheck" | "establish_owner_workspace_membership_through_supported_membership_lifecycle_then_recheck" | "repair_conflicting_connection_authority_rows_under_incident_procedure" | "repair_unrecognized_connection_authority_shape_under_incident_procedure";
+export type ConnectionAuthorityConvergenceEvidence = {
+    schemaVersion: 1;
+    organizationId: string;
+    limit: number;
+    afterConnectionId: string | null;
+    items: Array<{
+        connectionId: string;
+        subjectId: string | null;
+        classification: ConnectionAuthorityConvergenceClassification;
+        action: ConnectionAuthorityConvergenceAction;
+    }>;
+    returned: number;
+    hasMore: boolean;
+    nextCursor: string | null;
+    /** Full-organization totals. They are deliberately independent of the page cursor. */
+    remaining: {
+        total: number;
+        autoRemediable: number;
+        manualReview: number;
+        byClassification: {
+            connectionBackfillReady: number;
+            membershipBackfillEligible: number;
+            membershipLifecycleReviewRequired: number;
+            externalSubjectRequiresClassification: number;
+            missingLoginIdentity: number;
+            organizationIdentityMismatch: number;
+            missingOwnerWorkspaceMembership: number;
+            conflictingAuthorityRows: number;
+            legacyShapeUnrecognized: number;
+        };
+    };
+};
+/**
+ * Read one bounded evidence page while also returning cursor-independent
+ * full-organization residual totals. The database routine holds a read-only,
+ * invocation-exact FORCE-RLS capability and never writes connection authority.
+ */
+export declare function inspectOrganizationConnectionAuthorityConvergence(db: Database, input: {
+    organizationId: string;
+    limit?: number;
+    afterConnectionId?: string | null;
+}): Promise<ConnectionAuthorityConvergenceEvidence>;
 /**
  * Full-population connection authority classification. Supplying a fresh run
  * key writes one immutable migration-0300 receipt and exact unresolved rows.

package/dist/database.d.ts

@@ -157,7 +157,7 @@ export declare function registerDbBinding(db: Database, binding: {
     userProfileLookup?: UserProfileLookup;
 }): void;
 export declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
-export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig, sessionTenancyFence?: "shared" | "none"): Promise<T>;
 /**
  * Run one bounded database operation on a transaction-pinned backend.
  *
@@ -175,7 +175,7 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
  */
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
-}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none"): Promise<T>;
 export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 /**
  * Run one of several ordered workspace activity scopes inside a caller-owned
@@ -199,8 +199,8 @@ export declare function retryRlsPersistence<T>(db: Database, context: RlsContext
  * `session_pins` uses this helper so FORCE RLS rejects another member's rows
  * even if a future query accidentally omits its explicit subject predicate.
  */
-export declare function withWorkspaceSubjectRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
-export declare function withWorkspaceSubjectSessionActivityRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+export declare function withWorkspaceSubjectRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig, sessionTenancyFence?: "shared" | "none"): Promise<T>;
+export declare function withWorkspaceSubjectSessionActivityRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none"): Promise<T>;
 /** Apply and verify actor-private RLS on an already transaction-pinned handle. */
 export declare function setSubjectRlsContext(db: Database, subjectId: string): Promise<void>;
 export declare function withWorkspaceUsageLock<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-SCPUJS53.js";
-import "./chunk-PR2WMLOQ.js";
+} from "./chunk-AZHW7R5V.js";
+import "./chunk-KRLPEMLH.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-NMUBV7Z5.js";
-import "./chunk-SCPUJS53.js";
-import "./chunk-PR2WMLOQ.js";
+} from "./chunk-2EH4WRHL.js";
+import "./chunk-AZHW7R5V.js";
+import "./chunk-KRLPEMLH.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/index.d.ts

@@ -1899,6 +1899,16 @@ export type SlackInteraction = {
      * one-time onboarding hint. `null` means the decision is unresolved.
      */
     firstTaskHint: boolean | null;
+    /**
+     * The routed workspace's name, frozen when the interaction bound.
+     *
+     * Null means "do not say where this went": either routing is off, or the
+     * person had exactly one workspace to begin with, and a constant footer on
+     * every message would be noise. It is frozen rather than looked up at post
+     * time because a rename between the original post and a reconciliation would
+     * make the ledger's byte comparison raise.
+     */
+    routedWorkspaceLabel: string | null;
     progressCount: number;
     terminalDeliveryState: "open" | "completed" | "failed" | "cancelled" | "blocked";
     createdAt: Date;
@@ -2017,8 +2027,9 @@ export declare function releaseSlackInteractionInbox(db: Database, input: {
     errorCode: string;
     retryAt: Date;
 }): Promise<boolean>;
-export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "initiatingSlackUserId" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "firstTaskHint" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt"> & {
+export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "initiatingSlackUserId" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "firstTaskHint" | "routedWorkspaceLabel" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt"> & {
     initiatingSlackUserId?: string | null;
+    routedWorkspaceLabel?: string | null;
 }): Promise<{
     created: boolean;
     interaction: SlackInteraction;