@opengeni/db 3.7.4 → 3.8.2-canary.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "3.7.4",
+  "version": "3.8.2-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -78,11 +78,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.4.22",
-    "@opengeni/codex": "^0.2.20",
-    "@opengeni/config": "^0.22.5",
-    "@opengeni/contracts": "^2.9.2",
-    "@opengeni/network": "^0.2.3",
+    "@opengeni/codemode": "^0.4.25-canary.0",
+    "@opengeni/codex": "^0.2.20-canary.2",
+    "@opengeni/config": "^0.23.2-canary.0",
+    "@opengeni/contracts": "^2.11.1-canary.0",
+    "@opengeni/network": "^0.2.3-canary.7",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/automations.ts

@@ -223,6 +223,8 @@ export async function createAutomationTrigger(
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Trusted database-only admission seam. Throwing rolls creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
   },
 ): Promise<AutomationTrigger> {
   return await withWorkspaceRls(
@@ -289,6 +291,7 @@ export async function createAutomationTrigger(
             throw new Error("Automation Pack trigger must use its frozen manifest template");
           }
         }
+        await input.beforeCreateCommit?.(tx);
         const [head] = await tx
           .insert(schema.automationTriggers)
           .values({
@@ -438,6 +441,8 @@ export async function updateAutomationTrigger(
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** Trusted database-only admission seam. Throwing rolls the revision back. */
+    beforeUpdateCommit?: (tx: Database) => Promise<void>;
   },
 ): Promise<AutomationTrigger | null> {
   return await withWorkspaceRls(
@@ -478,6 +483,7 @@ export async function updateAutomationTrigger(
             "Pack-owned automation triggers must be managed through their Pack setup API",
           );
         }
+        await input.beforeUpdateCommit?.(tx);
         const revisionNumber = existing.head.currentRevision + 1;
         const [head] = await tx
           .update(schema.automationTriggers)
@@ -696,7 +702,9 @@ export async function claimAutomationRun(
           .for("update")
           .limit(1);
         if (!row) return null;
-        if (row.status === "dispatched" || row.status === "skipped") return mapRunExecution(row);
+        if (row.status === "dispatched" || row.status === "skipped" || row.status === "failed") {
+          return mapRunExecution(row);
+        }
         const [updated] = await tx
           .update(schema.automationRuns)
           .set({

package/src/connection-token-resolver.ts

@@ -114,6 +114,8 @@ export type ResolveConnectionCredentialResult =
   | {
       status: "ok";
       headers: Record<string, string>;
+      /** Credential authority is owned by the embedding host, not the native connection store. */
+      authoritySource?: "host";
       /** Present when the credential bundle or embedding host supplied explicit placements. */
       placements?: ConnectionCredentialPlacement[];
       connectionId: string;
@@ -133,6 +135,8 @@ export type ResolveConnectionCredentialResult =
       status: "auth_needed";
       reason: McpCredentialAuthNeededReason;
       providerDomain: string;
+      /** Credential authority is owned by the embedding host, not the native connection store. */
+      authoritySource?: "host";
       provider?: string;
       connectionId?: string;
       scopes?: string[];
@@ -270,6 +274,9 @@ export function buildHostConnectionTokenResolver(
       serverId: input.serverId,
       connectionRef: {
         providerDomain: input.connectionRef.providerDomain,
+        ...(input.connectionRef.authoritySource
+          ? { authoritySource: input.connectionRef.authoritySource }
+          : {}),
         ...(input.connectionRef.provider ? { provider: input.connectionRef.provider } : {}),
         ...(input.connectionRef.connectionId
           ? { connectionId: input.connectionRef.connectionId }
@@ -303,6 +310,7 @@ export function buildHostConnectionTokenResolver(
         status: "auth_needed",
         reason: result.reason,
         providerDomain: result.providerDomain,
+        authoritySource: "host",
         ...(result.provider ? { provider: result.provider } : {}),
         ...(result.connectionId ? { connectionId: result.connectionId } : {}),
         ...(result.scopes ? { scopes: [...result.scopes] } : {}),
@@ -339,6 +347,7 @@ export function buildHostConnectionTokenResolver(
     return {
       status: "ok",
       headers,
+      authoritySource: "host",
       ...(explicitPlacements ? { placements: explicitPlacements } : {}),
       connectionId: result.connectionId,
       ...(expiresAt !== undefined ? { expiresAt } : {}),
@@ -835,6 +844,9 @@ export function buildConnectionTokenResolver(
     let credentialWorkspaceId = input.workspaceId;
     let expectedAuthorityGeneration: number | undefined;
     let connectionUseAttribution: ConnectionUseAttribution | undefined;
+    if (ref.authoritySource === "host") {
+      return authNeeded(ref, "unsupported_auth", ref.connectionId);
+    }
     // Repository-scoped provider bindings require a broker that can prove the
     // selected-resource boundary. The generic standalone credential store has
     // no provider-specific containment adapter, so it must fail closed instead