@opengeni/db 4.2.2 → 4.3.0-canary.0

package/dist/connect-attempts.d.ts

@@ -0,0 +1,60 @@
+import { type ConnectAttempt as Attempt } from "@opengeni/contracts/connect";
+import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
+import { type Database } from "./database.js";
+export type ConnectActorScope = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+};
+/** Live admission under the attempt transaction. Implementations must acquire
+ * their key/membership/link fences in a consistent order and hold them through
+ * commit. No network I/O. The attempt argument is an isolated copy. */
+export type ConnectOperationAuthorization = (tx: Database, attempt: Attempt, origin: ExternalActorContinuation | null) => Promise<void>;
+export declare class ConnectAttemptConflictError extends Error {
+    readonly code = "CONNECT_ATTEMPT_CONFLICT";
+    constructor(message?: string);
+}
+export declare class ConnectAttemptNotFoundError extends Error {
+    readonly code = "CONNECT_ATTEMPT_NOT_FOUND";
+    constructor();
+}
+/** Caller must establish live workspace/actor authority before this storage
+ * seam. RLS scope is a consistency boundary, not proof of authentication. */
+export declare function beginConnectAttempt(db: Database, scope: ConnectActorScope, input: {
+    idempotencyKey: string;
+    requestDigest: string;
+    returnUrl: string;
+    attempt: Attempt;
+    externalContinuation?: ExternalActorContinuation;
+}): Promise<Attempt>;
+export declare function getConnectAttempt(db: Database, scope: ConnectActorScope, id: string): Promise<{
+    attempt: Attempt;
+    returnUrl: string;
+    operationInFlight: boolean;
+}>;
+export declare function listPendingConnectAttempts(db: Database, scope: ConnectActorScope): Promise<Attempt[]>;
+/** A claim is committed before remote effects. Never expire/reclaim it merely
+ * because the caller timed out: the provider may have accepted the operation. */
+export declare function claimConnectOperation(db: Database, scope: ConnectActorScope, input: {
+    attemptId: string;
+    expectedRevision: number;
+    operationId: string;
+    inputDigest: string;
+    authorize?: ConnectOperationAuthorization;
+}): Promise<{
+    status: "claimed";
+    attempt: Attempt;
+} | {
+    status: "replayed";
+    attempt: Attempt;
+}>;
+/** Pass the same transaction to credential/installation persistence through
+ * commit so its receipt and the public setup result become visible atomically.
+ * Do not perform network effects inside commit. */
+export declare function finishConnectOperation(db: Database, scope: ConnectActorScope, input: {
+    attemptId: string;
+    operationId: string;
+    inputDigest: string;
+    commit: (tx: Database, current: Attempt) => Promise<Attempt>;
+    authorize?: ConnectOperationAuthorization;
+}): Promise<Attempt>;

package/dist/connection-setup-authority.d.ts

@@ -0,0 +1,10 @@
+import { Permission } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+/** Callback authority for a server-signed API-key principal. No bearer is stored
+ * in OAuth state. Organization keys remain shared-workspace-only; workspace keys
+ * remain bound to their original workspace. Hold the row lock through commit. */
+export declare function lockConnectionSetupKey(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<Permission[] | null>;

package/dist/connection-token-resolver.d.ts

@@ -1,5 +1,5 @@
 import { environmentsEncryptionKeyBytes, type McpServerConnectionRef, type Settings } from "@opengeni/config";
-import type { ConnectionCredentialPlacement, ConnectionKind, ConnectionCredentialsPort, ConnectionStatus, McpConnectionResourceScope, McpCredentialAuthNeededReason, McpCredentialsRequest, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
+import type { ConnectionCredentialPlacement, ConnectionKind, ConnectionCredentialsPort, ConnectionStatus, McpConnectionResourceScope, McpCredentialAuthNeededReason, McpCredentialsRequest, McpGatewayCredentialsRequest, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
 import { type ConnectionUseAttribution, type ConnectionUseAuthorizationResult } from "@opengeni/contracts/connection-authority";
 import { type DnsLookup, type FetchLike } from "@opengeni/network";
 export { isPrivateAddress } from "@opengeni/network";
@@ -113,6 +113,11 @@ export type HostMcpCredentialResolverContext = {
     initiator: TurnInitiator;
     initiatorContext: TurnInitiatorContext;
     surface: McpCredentialsRequest["surface"];
+    /** Backend-owned attempt liveness, independent of binding delegation. */
+    authorizeExecution?: (request: McpCredentialsRequest) => Promise<boolean>;
+    /** Backend-owned live validator. Never populate from caller JSON or a host
+     * credential response. Omission denies every explicit durable reference. */
+    authorizeDurableBinding?: (request: McpCredentialsRequest) => Promise<boolean>;
 };
 export declare class HostMcpCredentialScopeError extends Error {
     constructor(field: "accountId" | "workspaceId" | "sessionId");
@@ -126,7 +131,11 @@ export declare class HostMcpCredentialBindingError extends Error {
  * reach a request; the returned object is a fresh copy so a host cannot mutate
  * headers after resolution.
  */
-export declare function buildHostConnectionTokenResolver(resolve: NonNullable<ConnectionCredentialsPort["mcpCredentials"]>, context: HostMcpCredentialResolverContext): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+export declare function buildHostConnectionTokenResolver(resolve: NonNullable<ConnectionCredentialsPort["mcpCredentials"]>, suppliedContext: HostMcpCredentialResolverContext): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+/** Authenticated request-time adapter. No synthetic session/turn authority and
+ * no durable binding admission; every physical use must retain live API proof. */
+export declare function buildHostGatewayConnectionTokenResolver(resolve: NonNullable<ConnectionCredentialsPort["mcpGatewayCredentials"]>, suppliedContext: Pick<McpGatewayCredentialsRequest, "accountId" | "workspaceId" | "authority">, reauthorize: () => Promise<void>): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+export declare function normalizedHostCredentialHeaders(headers: Record<string, string>, allowEmpty?: boolean): Record<string, string>;
 export type ConnectionBrokerDeps = {
     loadCredential: (db: Database, settings: Settings, input: ConnectionCredentialLookupInput) => Promise<ConnectionCredentialForBroker | null>;
     recordRefresh: (db: Database, input: ConnectionTokenRefreshInput) => Promise<boolean>;

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-SGJDIF2D.js";
+import "./chunk-Y5XFVJJM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-FPTI4NP4.js";
-import "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-YGBOVXC7.js";
+import "./chunk-SGJDIF2D.js";
+import "./chunk-Y5XFVJJM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/external-identities.d.ts

@@ -0,0 +1,16 @@
+import { Permission } from "@opengeni/contracts";
+import { ExternalIdentity } from "@opengeni/contracts/external-identities";
+import { type Database } from "./database.js";
+/** Pass an open transaction to retain the key lock through the protected write. */
+export declare function lockActiveExternalOrganizationKey(tx: Database, accountId: string, keyId: string): Promise<Permission[] | null>;
+/** Transaction-local fence shared with organization member lifecycle writers.
+ * Caller must pass an open transaction, not a pool-level database handle. */
+export declare function lockExternalWorkspaceMembershipLifecycle(tx: Database, accountId: string): Promise<void>;
+/** Internal lifecycle seam. Caller must authenticate an organization key and
+ * establish its exact account before invoking; this does not admit HTTP users.
+ * It never creates shared-workspace membership or reactivates removed users. */
+export declare function ensureExternalIdentity(db: Database, input: {
+    accountId: string;
+    externalId: string;
+    source?: string;
+}): Promise<ExternalIdentity>;

package/dist/external-identity-links.d.ts

@@ -0,0 +1,74 @@
+import { ConfirmExternalIdentityLinkRequest, ExternalIdentityLink, ExternalIdentityLinkPage, ExternalIdentityReference, type ExternalIdentity } from "@opengeni/contracts/external-identities";
+import { type Database } from "./database.js";
+export declare class ExternalIdentityLinkConflictError extends Error {
+    readonly name = "ExternalIdentityLinkConflictError";
+    constructor();
+}
+/** Internal persistence seam. The API must prove a host external actor and
+ * freeze its key permission ceiling before calling. No login is provisioned. */
+export declare function beginExternalIdentityLink(db: Database, identity: ExternalIdentity, raw: unknown): Promise<{
+    link: {
+        id: string;
+        accountId: string;
+        externalIdentityId: string;
+        externalIdentity?: {
+            externalId: string;
+            source: string;
+        } | undefined;
+        nativeSubjectId: string | null;
+        status: "active" | "expired" | "pending" | "revoked";
+        revision: number;
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        expiresAt: string | null;
+    };
+    challenge: string;
+    confirmBefore: string;
+}>;
+/** Caller proves either exact host identity or native login, never a caller's
+ * claimed subject. The challenge is intentionally absent from every read. */
+export declare function getExternalIdentityLink(db: Database, input: {
+    accountId: string;
+    linkId: string;
+    subjectId: string;
+}): Promise<ExternalIdentityLink | null>;
+/** Bounded inventory of the verified participant's links. Neither account-wide
+ * access nor a supplied cursor reveals another participant's pending requests. */
+export declare function listExternalIdentityLinks(db: Database, input: {
+    accountId: string;
+    subjectId: string;
+    cursor?: string;
+}): Promise<ExternalIdentityLinkPage>;
+/** Consent-screen projection, only after canonical native login admission.
+ * The short-lived challenge proves which host request the human is approving. */
+export declare function previewExternalIdentityLink(db: Database, input: {
+    accountId: string;
+    linkId: string;
+    challenge: string;
+}): Promise<{
+    link: ExternalIdentityLink;
+    externalIdentity: ExternalIdentityReference;
+} | null>;
+/** Must only receive the canonical native-session subject after explicit UI
+ * consent. Possession of the challenge alone is not native authentication. */
+export declare function confirmExternalIdentityLink(db: Database, input: {
+    accountId: string;
+    linkId: string;
+    nativeSubjectId: string;
+    request: ConfirmExternalIdentityLinkRequest;
+}): Promise<ExternalIdentityLink>;
+export declare function revokeExternalIdentityLink(db: Database, input: {
+    accountId: string;
+    linkId: string;
+    subjectId: string;
+    expectedRevision: number;
+}): Promise<ExternalIdentityLink>;
+/** Live linked admission primitive. It retains membership/link locks when
+ * called in an open transaction. Never uses old creator audit as authority. */
+export declare function resolveExternalIdentityLink(db: Database, input: {
+    identity: ExternalIdentity;
+    linkId: string;
+    expectedRevision: number;
+}): Promise<{
+    link: ExternalIdentityLink;
+    personalWorkspaceId: string;
+} | null>;

package/dist/external-link-work.d.ts

@@ -0,0 +1,51 @@
+import { type ScheduledTask } from "@opengeni/contracts";
+import { ExternalLinkWorkSnapshot } from "@opengeni/contracts/external-identities";
+import { type Database } from "./database.js";
+type Scope = {
+    accountId: string;
+    workspaceId: string;
+};
+type Source = {
+    kind: "direct";
+} | {
+    kind: "causal" | "child";
+    turnId: string;
+} | {
+    kind: "scheduled";
+    taskId: string;
+    taskRevision: number;
+};
+/** Does not consult or resurrect the key used at creation. Its immutable
+ * permission ceiling is already captured; membership/link revocation is live. */
+export declare function externalLinkWorkSnapshotIsLive(db: Database, raw: unknown): Promise<boolean>;
+export declare function getExternalLinkTurnSnapshot(db: Database, scope: Scope, turnId: string): Promise<ExternalLinkWorkSnapshot | null>;
+/** null is an ordinary native/external turn; a revoked linked turn is false,
+ * never null. Callers must not fall back to unlinked authority after denial. */
+export declare function getExternalLinkTurnAuthorization(db: Database, scope: Scope, turnId: string): Promise<{
+    authorized: boolean;
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+} | null>;
+export declare function captureExternalLinkTurnAuthority(db: Database, input: Scope & {
+    sessionId: string;
+    turnId: string;
+    snapshot: ExternalLinkWorkSnapshot;
+    source?: Source;
+}): Promise<void>;
+export declare function inheritExternalLinkTurnAuthority(db: Database, input: Scope & {
+    sessionId: string;
+    turnId: string;
+    sourceTurnId: string;
+    kind: "causal" | "child";
+}): Promise<void>;
+export declare function getExternalLinkTaskSnapshot(db: Database, input: Scope & {
+    taskId: string;
+    taskRevision: number;
+}): Promise<ExternalLinkWorkSnapshot | null>;
+export declare function captureExternalLinkTaskAuthority(db: Database, task: ScheduledTask, raw: ExternalLinkWorkSnapshot): Promise<void>;
+export declare function cloneExternalLinkTaskAuthority(db: Database, task: ScheduledTask, sourceRevision: number): Promise<void>;
+export declare function captureScheduledExternalLinkTurnAuthority(db: Database, input: Scope & {
+    sessionId: string;
+    turnId: string;
+    runId: string;
+}): Promise<void>;
+export {};

package/dist/host-mcp-binding-match.d.ts

@@ -0,0 +1,5 @@
+import { type McpCredentialsRequest } from "@opengeni/contracts";
+/** Metadata comparison only. A caller must independently establish accepted
+ * execution delegation and live owner/workspace authority. A matching registry
+ * row never authorizes a turn, a scheduler, or a nested session by itself. */
+export declare function hostMcpBindingMatchesRequest(rawBinding: unknown, request: McpCredentialsRequest): boolean;

package/dist/host-mcp-bindings.d.ts

@@ -0,0 +1,73 @@
+import { type McpCredentialsRequest } from "@opengeni/contracts";
+import { HostMcpBinding, HostMcpDelegation, HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
+import { type Database } from "./database.js";
+export type HostMcpBindingOwner = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorizationRevision: number;
+};
+/** Resolve the effective member's revision, not the authenticating external
+ * identity revision. Caller must separately prove its authority to act as them. */
+export declare function resolveHostMcpBindingOwner(db: Database, input: Omit<HostMcpBindingOwner, "authorizationRevision">): Promise<HostMcpBindingOwner>;
+export declare class HostMcpBindingConflictError extends Error {
+    constructor();
+}
+export declare class HostMcpDelegationAuthorityError extends Error {
+}
+/** Low-level persistence, not HTTP authentication. Callers must establish the
+ * exact external owner and workspace grant before entering this scoped seam. */
+export declare function createHostMcpBinding(db: Database, owner: HostMcpBindingOwner, raw: unknown): Promise<HostMcpBinding>;
+export declare function getHostMcpBinding(db: Database, owner: HostMcpBindingOwner, id: string): Promise<HostMcpBinding | null>;
+export declare function revokeHostMcpBinding(db: Database, owner: HostMcpBindingOwner, id: string, expectedGeneration: number): Promise<HostMcpBinding>;
+/** Internal persistence only. Caller must first verify owner identity and grant
+ * issuance permission. No worker consumes these rows without accepted-work capture. */
+export declare function issueHostMcpDelegation(db: Database, owner: HostMcpBindingOwner, raw: unknown): Promise<HostMcpDelegation>;
+export declare function getHostMcpDelegation(db: Database, owner: HostMcpBindingOwner, id: string): Promise<HostMcpDelegation | null>;
+export declare function revokeHostMcpDelegation(db: Database, owner: HostMcpBindingOwner, id: string, expectedGeneration: number): Promise<HostMcpDelegation>;
+/** Internal direct-admission boundary, NOT authentication and NOT persistence.
+ * The caller must establish a verified external owner and explicit selection,
+ * and capture the returned authority with accepted work INSIDE `capture`.
+ * Locks remain held through that callback. Historical initiator metadata only
+ * narrows the verified caller's selection; it never establishes who called.
+ * Schedules, continuations and inherited turns need their own frozen causal
+ * authority path and deliberately cannot use this direct-only boundary.
+ */
+export declare function withDirectHostMcpAdmission<T>(db: Database, owner: HostMcpBindingOwner, input: {
+    sessionId: string;
+    turnId: string;
+    delegationId: string;
+    expectedDelegationGeneration: number;
+}, capture: (tx: Database, authority: HostMcpAcceptedAuthority) => Promise<T>): Promise<T>;
+/** Internal direct-turn persistence. The authenticated acceptance transaction
+ * must call this before claim; this does not authenticate the supplied owner.
+ * Exact replay is allowed, but a turn/server selection cannot be replaced. */
+export declare function captureDirectHostMcpAuthority(db: Database, owner: HostMcpBindingOwner, input: Parameters<typeof withDirectHostMcpAdmission>[2]): Promise<HostMcpAcceptedAuthority>;
+/** Copy only the authority of an exact causal turn after its canonical machine
+ * update has been delivered. The insert trigger independently proves delivery,
+ * live generations and byte-equivalent authority; no creator fallback exists.
+ * Revoked selections are omitted, allowing a continuation to explain loss of
+ * access without making its whole session permanently unclaimable. */
+export declare function inheritCausalHostMcpTurnAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    sourceTurnId: string;
+    targetTurnId: string;
+}): Promise<void>;
+/** Initial child turn only. The stored parent-turn pointer was admitted by the
+ * native signed-attempt creation boundary; caller metadata never chooses it. */
+export declare function inheritChildHostMcpTurnAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    subjectId: string;
+}): Promise<void>;
+/** Live consumption of captured direct or same-session causal turn authority.
+ * Request context must come from the accepted attempt, never caller JSON.
+ * Missing/revoked authority denies; infrastructure failures propagate so the
+ * broker reports refresh_failed rather than misclassifying an outage.
+ * The historical function name is retained for existing internal consumers. */
+export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest): Promise<boolean>;

package/dist/host-mcp-task-authority.d.ts

@@ -0,0 +1,47 @@
+import { type ScheduledTask } from "@opengeni/contracts";
+import { HostMcpTaskAuthority, HostMcpBindingDefinition } from "@opengeni/contracts/host-mcp-bindings";
+import { type Database } from "./database.js";
+import { type HostMcpBindingOwner } from "./host-mcp-bindings.js";
+export type SelectedHostMcpTaskGrant = {
+    delegationId: string;
+    generation: number;
+    bindingId: string;
+    bindingGeneration: number;
+    definition: HostMcpBindingDefinition;
+};
+/** Internal capture only. The API/core authenticates the external owner and
+ * rechecks that proof in this same task-write transaction before calling. */
+export declare function captureHostMcpTaskAuthorities(db: Database, owner: HostMcpBindingOwner, task: ScheduledTask, selections: SelectedHostMcpTaskGrant[]): Promise<void>;
+/** Backend-only read; native immutable task-revision proof chooses the owner.
+ * No caller-supplied subject and no ambient workspace account enumeration. */
+export declare function getHostMcpTaskAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    taskId: string;
+    taskAuthorityRevision: number;
+}): Promise<HostMcpTaskAuthority[]>;
+/** Native task revisions are the authority/version boundary, including ordinary
+ * lifecycle edits. Never silently drop or reassign retained host selections. */
+export declare function cloneHostMcpTaskAuthorities(db: Database, task: ScheduledTask, sourceRevision: number): Promise<void>;
+/** Claim-time attachment to the exact accepted run. No host callback or key is
+ * used here; credentials are requested only when the accepted attempt uses MCP. */
+export declare function captureScheduledHostMcpTurnAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    runId: string;
+}): Promise<void>;
+/** Agent-created task: derive selections exclusively from its live accepted
+ * attempt, then re-admit only native successor-eligible grants. No user lookup
+ * or connection inventory is a fallback for a turn with no captured authority. */
+export declare function inheritHostMcpTaskAuthoritiesFromAttempt(db: Database, task: ScheduledTask, source: {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+}, configured: Array<{
+    bindingId: string;
+    bindingGeneration: number;
+    definition: HostMcpBindingDefinition;
+}>): Promise<void>;

package/dist/host-selection-identity.d.ts

@@ -0,0 +1,6 @@
+import { type HostMcpCreateSelection } from "@opengeni/contracts/host-mcp-bindings";
+export type { HostMcpCreateSelection } from "@opengeni/contracts/host-mcp-bindings";
+/** Replay identity only: neither grant admission nor credential authority. */
+export declare function normalizeHostCreateSelection(value: unknown): HostMcpCreateSelection[];
+export declare function metadataWithHostCreateSelection(metadata: Record<string, unknown>, value: unknown): Record<string, unknown>;
+export declare function hostCreateSelectionFromMetadata(metadata: Record<string, unknown>): HostMcpCreateSelection[];