@opengeni/db 4.2.2 → 4.3.2-canary.0

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-SNLIKELL.js";
-import "./chunk-B2KR3TEM.js";
-import "./chunk-S4Y42VSX.js";
+} from "./chunk-DVSLOUEI.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-S4Y42VSX.js → chunk-AI4NC6XW.js}

@@ -61,6 +61,7 @@ __export(schema_exports, {
   composerDrafts: () => composerDrafts,
   computerSessionAssociations: () => computerSessionAssociations,
   computerSessions: () => computerSessions,
+  connectAttempts: () => connectAttempts,
   connectionDisconnectOperations: () => connectionDisconnectOperations,
   connectionUseAuditFacts: () => connectionUseAuditFacts,
   connectionUseOnceConsumptionReceipts: () => connectionUseOnceConsumptionReceipts,
@@ -93,6 +94,7 @@ __export(schema_exports, {
   enrollmentOsValues: () => enrollmentOsValues,
   enrollmentStatusValues: () => enrollmentStatusValues,
   enrollments: () => enrollments,
+  externalIdentities: () => externalIdentities,
   feedbackSubmissions: () => feedbackSubmissions,
   fileUploads: () => fileUploads,
   files: () => files,
@@ -110,6 +112,9 @@ __export(schema_exports, {
   hostExportCursorState: () => hostExportCursorState,
   hostExportDeadLetters: () => hostExportDeadLetters,
   hostExportOutbox: () => hostExportOutbox,
+  hostMcpBindings: () => hostMcpBindings,
+  hostMcpDelegations: () => hostMcpDelegations,
+  hostMcpTurnAuthorities: () => hostMcpTurnAuthorities,
   imageGenerationOperations: () => imageGenerationOperations,
   importBatches: () => importBatches,
   integrationFacetBindingOwners: () => integrationFacetBindingOwners,
@@ -6504,7 +6509,11 @@ var workspaces = pgTable20(
   (table) => ({
     account: index19("workspaces_account_idx").on(table.accountId),
     accountSlug: uniqueIndex20("workspaces_account_slug_idx").on(table.accountId, table.slug).where(sql16`${table.slug} is not null`),
-    external: uniqueIndex20("workspaces_external_idx").on(table.externalSource, table.externalId),
+    external: uniqueIndex20("workspaces_external_idx").on(
+      table.accountId,
+      table.externalSource,
+      table.externalId
+    ),
     sandboxViewerForceDrain: index19("workspaces_sandbox_viewer_force_drain_idx").on(table.id).where(sql16`${table.sandboxViewerForceDrainReason} is not null`),
     sandboxViewerForceDrainValid: check11(
       "workspaces_sandbox_viewer_force_drain_check",
@@ -6819,6 +6828,41 @@ var workspaceMemberships = pgTable20(
     account: index19("workspace_memberships_account_idx").on(table.accountId)
   })
 );
+var externalIdentities = pgTable20(
+  "external_identities",
+  {
+    id: uuid20("id").primaryKey(),
+    accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    source: text20("source").notNull(),
+    externalId: text20("external_id").notNull(),
+    subjectId: text20("subject_id").notNull(),
+    organizationMembershipId: uuid20("organization_membership_id").notNull(),
+    personalWorkspaceId: uuid20("personal_workspace_id").notNull(),
+    status: text20("status").notNull().default("active"),
+    authorizationRevision: bigint14("authorization_revision", { mode: "number" }).notNull().default(1),
+    createdAt: timestamp20("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp20("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    mapping: uniqueIndex20("external_identities_account_id_source_external_id_key").on(
+      table.accountId,
+      table.source,
+      table.externalId
+    ),
+    subject: uniqueIndex20("external_identities_account_id_subject_id_key").on(
+      table.accountId,
+      table.subjectId
+    ),
+    membership: foreignKey({
+      columns: [table.organizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId]
+    }),
+    personalWorkspace: foreignKey({
+      columns: [table.personalWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    })
+  })
+);
 var organizationMemberships = pgTable20(
   "organization_memberships",
   {
@@ -7147,7 +7191,8 @@ var organizationMembershipLifecycleEvents = pgTable20(
     id: uuid20("id").primaryKey().defaultRandom(),
     accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     operationId: uuid20("operation_id").notNull(),
-    actorMembershipId: uuid20("actor_membership_id").notNull(),
+    actorMembershipId: uuid20("actor_membership_id"),
+    actorServiceSubject: text20("actor_service_subject"),
     targetMembershipId: uuid20("target_membership_id"),
     kind: text20("kind").notNull(),
     priorAuthorizationRevision: bigint14("prior_authorization_revision", {
@@ -7177,6 +7222,10 @@ var organizationMembershipLifecycleEvents = pgTable20(
     kindValid: check11(
       "organization_membership_lifecycle_events_kind_check",
       sql16`${table.kind} in ('invite', 'accept', 'revoke_invitation', 'change_role', 'suspend', 'reactivate', 'offboard', 'retention')`
+    ),
+    actorKindValid: check11(
+      "organization_membership_lifecycle_events_actor_kind_check",
+      sql16`(${table.actorMembershipId} is not null and ${table.actorServiceSubject} is null) or (${table.actorMembershipId} is null and ${table.actorServiceSubject} is not null and ${table.actorServiceSubject} ~ '^api_key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$')`
     )
   })
 );
@@ -9376,6 +9425,36 @@ var integrationOauthClients = pgTable20(
     authorizationServer: index19("integration_oauth_clients_as_idx").on(table.authorizationServer)
   })
 );
+var hostMcpTurnAuthorities = pgTable20(
+  "host_mcp_turn_authorities",
+  {
+    turnId: uuid20("turn_id").notNull().references(() => sessionTurns.id, { onDelete: "cascade" }),
+    serverId: text20("server_id").notNull(),
+    accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid20("workspace_id").notNull(),
+    sessionId: uuid20("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
+    ownerSubjectId: text20("owner_subject_id").notNull(),
+    bindingId: uuid20("binding_id").notNull().references(() => hostMcpBindings.id),
+    delegationId: uuid20("delegation_id").notNull().references(() => hostMcpDelegations.id),
+    canonicalSnapshot: jsonb16("canonical_snapshot").$type().notNull(),
+    createdAt: timestamp20("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    pk: primaryKey9({ columns: [table.turnId, table.serverId] }),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    serverBounds: check11(
+      "host_mcp_turn_authorities_server_id_check",
+      sql16`octet_length(${table.serverId}) between 1 and 1024`
+    ),
+    snapshotBounds: check11(
+      "host_mcp_turn_authorities_canonical_snapshot_check",
+      sql16`jsonb_typeof(${table.canonicalSnapshot}) = 'object' and octet_length(${table.canonicalSnapshot}::text) <= 262144`
+    )
+  })
+);
 var integrationOauthStateNonces = pgTable20(
   "integration_oauth_state_nonces",
   {
@@ -9392,6 +9471,122 @@ var integrationOauthStateNonces = pgTable20(
     expires: index19("integration_oauth_state_nonces_expires_idx").on(table.expiresAt)
   })
 );
+var hostMcpBindings = pgTable20(
+  "host_mcp_bindings",
+  {
+    id: uuid20("id").primaryKey(),
+    accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid20("workspace_id").notNull(),
+    ownerSubjectId: text20("owner_subject_id").notNull(),
+    authorizationRevision: bigint14("authorization_revision", { mode: "number" }).notNull(),
+    operationId: uuid20("operation_id").notNull(),
+    requestDigest: text20("request_digest").notNull(),
+    definition: jsonb16("definition").notNull(),
+    generation: bigint14("generation", { mode: "number" }).notNull().default(1),
+    status: text20("status").notNull().default("active"),
+    createdAt: timestamp20("created_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp20("revoked_at", { withTimezone: true })
+  },
+  (table) => ({
+    workspace: foreignKey({
+      name: "host_mcp_bindings_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    owner: foreignKey({
+      name: "host_mcp_bindings_member_owner_fk",
+      columns: [table.accountId, table.ownerSubjectId],
+      foreignColumns: [organizationMemberships.accountId, organizationMemberships.subjectId]
+    }),
+    operation: uniqueIndex20("host_mcp_bindings_workspace_id_owner_subject_id_operation_id_key").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.operationId
+    ),
+    inventory: index19("host_mcp_bindings_owner_idx").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.createdAt,
+      table.id
+    )
+  })
+);
+var hostMcpDelegations = pgTable20(
+  "host_mcp_delegations",
+  {
+    id: uuid20("id").primaryKey(),
+    accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid20("workspace_id").notNull(),
+    ownerSubjectId: text20("owner_subject_id").notNull(),
+    ownerAuthorizationRevision: bigint14("owner_authorization_revision", {
+      mode: "number"
+    }).notNull(),
+    bindingId: uuid20("binding_id").notNull().references(() => hostMcpBindings.id),
+    bindingGeneration: bigint14("binding_generation", { mode: "number" }).notNull(),
+    operationId: uuid20("operation_id").notNull(),
+    requestDigest: text20("request_digest").notNull(),
+    grantDefinition: jsonb16("grant_definition").notNull(),
+    generation: bigint14("generation", { mode: "number" }).notNull().default(1),
+    status: text20("status").notNull().default("active"),
+    createdAt: timestamp20("created_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp20("revoked_at", { withTimezone: true })
+  },
+  (table) => ({
+    workspace: foreignKey({
+      name: "host_mcp_delegations_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    owner: foreignKey({
+      name: "host_mcp_delegations_member_owner_fk",
+      columns: [table.accountId, table.ownerSubjectId],
+      foreignColumns: [organizationMemberships.accountId, organizationMemberships.subjectId]
+    }),
+    operation: uniqueIndex20(
+      "host_mcp_delegations_workspace_id_owner_subject_id_operation_id_key"
+    ).on(table.workspaceId, table.ownerSubjectId, table.operationId),
+    inventory: index19("host_mcp_delegations_owner_idx").on(
+      table.workspaceId,
+      table.ownerSubjectId,
+      table.bindingId,
+      table.id
+    )
+  })
+);
+var connectAttempts = pgTable20(
+  "connect_attempts",
+  {
+    id: uuid20("id").primaryKey(),
+    accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid20("workspace_id").notNull(),
+    subjectId: text20("subject_id").notNull(),
+    idempotencyKeyHash: text20("idempotency_key_hash").notNull(),
+    requestDigest: text20("request_digest").notNull(),
+    returnUrl: text20("return_url").notNull(),
+    externalContinuation: jsonb16("external_continuation"),
+    projection: jsonb16("projection").notNull(),
+    operationId: text20("operation_id"),
+    operationDigest: text20("operation_digest"),
+    receipts: jsonb16("receipts").notNull().default({}),
+    expiresAt: timestamp20("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp20("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp20("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "connect_attempts_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    idempotency: uniqueIndex20("connect_attempts_actor_idempotency_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.idempotencyKeyHash
+    ),
+    pending: index19("connect_attempts_actor_pending_idx").on(table.workspaceId, table.subjectId, table.createdAt.desc(), table.id.desc()).where(sql16`${table.projection}->>'state' not in ('complete','cancelled','expired')`),
+    expiry: index19("connect_attempts_expiry_idx").on(table.expiresAt, table.id)
+  })
+);
 var mcpOauthClients = pgTable20(
   "mcp_oauth_clients",
   {
@@ -9897,6 +10092,9 @@ var sessions = pgTable20(
     // sessions carrying the same end-user label; 'session' limits it to the
     // own root tree. Enforced only in the core session-authorization seam.
     agentAccess: text20("agent_access").notNull().default("workspace"),
+    // Canonical authenticated user for the frozen cross-session agent scope.
+    // Independent of per-turn initiating users and historical external labels.
+    scopeSubjectId: text20("scope_subject_id"),
     // Opaque end-user label (both set or both null). This is a product label
     // used for scoping and filtering, never a subject and never authority.
     endUserSource: text20("end_user_source"),
@@ -11901,10 +12099,11 @@ var sessionTurns = pgTable20(
     initiatorKind: text20("initiator_kind").notNull().default("service"),
     initiatorSubjectId: text20("initiator_subject_id").notNull().default("unattributed-legacy"),
     initiatorContext: jsonb16("initiator_context").$type().notNull().default({ backfill: true }),
-    // Immutable human authority for exact-attempt governance. Human turns bind
-    // their own subject; trusted continuations/compactions may inherit the
-    // causal turn's value while retaining a service initiator. Null means the
-    // turn has no human preference authority.
+    // Bounded, immutable causal-human selector for named attempt-bound
+    // capabilities. Human turns bind their own subject; trusted continuations
+    // and compactions may inherit the causal turn's value while retaining a
+    // service initiator. It never authorizes by itself. Null means pure service
+    // work has no human-bound authority.
     initiatingHumanSubjectId: text20("initiating_human_subject_id"),
     // Exact goal authority frozen when the logical turn is accepted. The
     // migration trigger fills this for old and rolling writers; claim only
@@ -17556,6 +17755,7 @@ var socialConnections = pgTable20(
   "social_connections",
   {
     id: uuid20("id").primaryKey().defaultRandom(),
+    version: integer18("version").notNull().default(1),
     accountId: uuid20("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid20("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     subjectId: text20("subject_id"),
@@ -18182,6 +18382,7 @@ export {
   workspaceInferenceControls,
   workspaceSessionActivityRevisions,
   workspaceMemberships,
+  externalIdentities,
   organizationMemberships,
   organizationProfileEvents,
   sessionTenancyActivations,
@@ -18232,7 +18433,11 @@ export {
   memorySlackPublicationReceipts,
   slackBotDeleteOperations,
   integrationOauthClients,
+  hostMcpTurnAuthorities,
   integrationOauthStateNonces,
+  hostMcpBindings,
+  hostMcpDelegations,
+  connectAttempts,
   mcpOauthClients,
   mcpOauthAuthorizationRequests,
   mcpOauthAuthorizationCodes,
@@ -18399,4 +18604,4 @@ export {
   feedbackSubmissions,
   schema_exports
 };
-//# sourceMappingURL=chunk-S4Y42VSX.js.map
+//# sourceMappingURL=chunk-AI4NC6XW.js.map