@opengeni/db 5.0.0-canary.1 → 5.0.1-canary.1

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-7HMK3B45.js";
-import "./chunk-DPONPYJD.js";
-import "./chunk-F73UKJY6.js";
+} from "./chunk-E4X5HQ5P.js";
+import "./chunk-TDXX22IZ.js";
+import "./chunk-BGMK3XV6.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/capability-integrations.d.ts

@@ -1,4 +1,4 @@
-import { type McpServerConnectionRef } from "@opengeni/contracts";
+import { type IntegrationSource, type McpServerConnectionRef } from "@opengeni/contracts";
 import { type Database } from "./database.js";
 export type ApiIntegrationProtocol = "openapi" | "graphql";
 export type ApiIntegrationToolSafety = "read" | "write" | "destructive";
@@ -197,6 +197,27 @@ export declare function listInstalledApiIntegrationServerIdsForDelegations(db: D
  */
 export declare function listInstalledApiIntegrationsInRlsContext(scopedDb: Database, workspaceId: string, subjectId?: string): Promise<ApiIntegrationRuntime[]>;
 export declare function getApiIntegrationUninstallPreview(db: Database, workspaceId: string, subjectId: string, capabilityId: string, instanceKey: string): Promise<ApiIntegrationUninstallPreview>;
+/** No discovery or new authority: recover only an exact, currently visible and
+ * directly owned installed source. The installer must still lock and recheck
+ * the snapshot before committing; this read is not installation admission.
+ */
+export declare function getApiIntegrationReconciliationSnapshot(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    source: IntegrationSource;
+    connectionId?: string;
+    instanceKey?: string;
+    expectedRevisionId: string;
+    expectedContentSha256: string;
+    allowedTools?: string[];
+}): Promise<{
+    runtime: ApiIntegrationRuntime;
+    baseServerId: string;
+    name: string;
+    provider: string | null;
+    requiredScopes: string[];
+} | null>;
 export declare function uninstallApiIntegration(db: Database, input: {
     accountId: string;
     workspaceId: string;

package/dist/capability-reconciliation.d.ts

@@ -0,0 +1,5 @@
+import { type Database } from "./database.js";
+/** Retain the installation row through the caller's outer transaction. This is
+ * a no-write reconciliation read; it never activates or alters an installation.
+ * Acquisition callers must already hold the organization policy fence. */
+export declare function withLockedCapabilityInstallation<T>(db: Database, workspaceId: string, capabilityId: string, read: (tx: Database) => Promise<T>): Promise<T>;

package/dist/capability-reconciliation.js

@@ -0,0 +1,21 @@
+import {
+  withWorkspaceRls
+} from "./chunk-TDXX22IZ.js";
+import "./chunk-BGMK3XV6.js";
+import "./chunk-S2TZ3F4L.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/capability-reconciliation.ts
+import { sql } from "drizzle-orm";
+async function withLockedCapabilityInstallation(db, workspaceId, capabilityId, read) {
+  return withWorkspaceRls(db, workspaceId, async (tx) => {
+    await tx.execute(sql`select id from capability_installations
+      where workspace_id = ${workspaceId}::uuid and capability_id = ${capabilityId}
+      for update`);
+    return read(tx);
+  });
+}
+export {
+  withLockedCapabilityInstallation
+};
+//# sourceMappingURL=capability-reconciliation.js.map

package/dist/capability-reconciliation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capability-reconciliation.ts"],"sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { withWorkspaceRls, type Database } from \"./database\";\n\n/** Retain the installation row through the caller's outer transaction. This is\n * a no-write reconciliation read; it never activates or alters an installation.\n * Acquisition callers must already hold the organization policy fence. */\nexport async function withLockedCapabilityInstallation<T>(\n  db: Database,\n  workspaceId: string,\n  capabilityId: string,\n  read: (tx: Database) => Promise<T>,\n) {\n  return withWorkspaceRls(db, workspaceId, async (tx) => {\n    await tx.execute(sql`select id from capability_installations\n      where workspace_id = ${workspaceId}::uuid and capability_id = ${capabilityId}\n      for update`);\n    return read(tx);\n  });\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,WAAW;AAMpB,eAAsB,iCACpB,IACA,aACA,cACA,MACA;AACA,SAAO,iBAAiB,IAAI,aAAa,OAAO,OAAO;AACrD,UAAM,GAAG,QAAQ;AAAA,6BACQ,WAAW,8BAA8B,YAAY;AAAA,iBACjE;AACb,WAAO,KAAK,EAAE;AAAA,EAChB,CAAC;AACH;","names":[]}

package/dist/{chunk-HQDVI2DB.js → chunk-26BQCKRE.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-DPONPYJD.js";
+} from "./chunk-TDXX22IZ.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3540,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-HQDVI2DB.js.map
+//# sourceMappingURL=chunk-26BQCKRE.js.map

package/dist/{chunk-MWMXWHJD.js → chunk-3LMHK5AL.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-DPONPYJD.js";
+} from "./chunk-TDXX22IZ.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-MWMXWHJD.js.map
+//# sourceMappingURL=chunk-3LMHK5AL.js.map