@opengeni/db 5.0.1 → 6.0.0-canary.35585322809001

package/dist/automations.d.ts

@@ -49,8 +49,6 @@ export declare function createAutomationSource(db: Database, input: {
     createdBySubjectId: string;
     request: CreateAutomationSourceRequest;
     webhookSecretEncrypted: string;
-    packInstallationId?: string | null;
-    packConnectorId?: string | null;
 }): Promise<AutomationSource>;
 export declare function resolveAutomationWebhookEndpoint(db: Database, endpointId: string): Promise<{
     accountId: string;

package/dist/canonical-human-identities.d.ts

@@ -59,6 +59,10 @@ export type ApplyCanonicalHumanIdentityOperationInput = {
     providerId?: string | null;
     providerAccountId?: string | null;
     reason: string;
+    verifiedRecovery?: {
+        authSessionId: string;
+        requestDigest: string;
+    };
     actorFence?: {
         authorityHash: string;
         actorEpoch: string;

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-7HMK3B45.js";
-import "./chunk-DPONPYJD.js";
-import "./chunk-F73UKJY6.js";
+} from "./chunk-RL2MUXM3.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/capability-components.d.ts

@@ -3,7 +3,7 @@ import { sql, type SQLWrapper } from "drizzle-orm";
 import type { Database } from "./database.js";
 import { type SkillSourceReleaseReceipt } from "./skill-source-release.js";
 export type CapabilityComponentOwnerIdentity = {
-    kind: "direct" | "plugin" | "pack" | "migration";
+    kind: "direct" | "plugin" | "migration";
     id: string;
 };
 export declare class CapabilityComponentVersionConflictError extends Error {
@@ -12,13 +12,11 @@ export declare class CapabilityComponentVersionConflictError extends Error {
     constructor(pluginKey: string);
 }
 /**
- * An owner row is runtime-effective only while its lifecycle-owning Plugin or
- * v2 Pack installation is active. Direct, migration, and legacy textual Pack
- * ownership is intrinsic so the rolling migration does not hide pre-v2 shared
- * components before those Packs are reinstalled into the normalized ledger.
+ * Plugin ownership is effective only while its installation is active.
+ * Direct and migration ownership is intrinsic.
  */
 export declare function effectiveCapabilityOwnerSql(ownerKind: SQLWrapper, ownerId: SQLWrapper): ReturnType<typeof sql>;
-/** Serialize one workspace-local component identity across direct, Plugin, and Pack installers. */
+/** Serialize one workspace-local component identity across direct and Plugin installers. */
 export declare function lockCapabilityComponentIdentity(db: Database, workspaceId: string, pluginKey: string): Promise<void>;
 /**
  * A child installation selects exactly one immutable Plugin version. Changing
@@ -30,10 +28,4 @@ export declare function assertCapabilityComponentVersionCanChange(db: Database,
     pluginInstallationId: string;
     owner: CapabilityComponentOwnerIdentity;
 }): Promise<void>;
-/**
- * Delete physically ownerless facet installations and disable now-empty child
- * components. Inactive lifecycle owners still preserve storage: a Pack may
- * have claimed a component while its installation is pending or repairing,
- * even though that owner is intentionally hidden from runtime reads.
- */
-export declare function cleanupOrphanedCapabilityComponents(db: Database, workspaceId: string, facetInstallationIds: string[], skillActor?: SkillActor): Promise<SkillSourceReleaseReceipt[]>;
+export declare function cleanupOrphanedCapabilityComponents(db: Database, workspaceId: string, facetInstallationIds: string[], skillActor?: SkillActor, lockedSkillHeadIds?: readonly string[]): Promise<SkillSourceReleaseReceipt[]>;

package/dist/capability-integrations.d.ts

@@ -1,4 +1,4 @@
-import { type McpServerConnectionRef } from "@opengeni/contracts";
+import { type IntegrationSource, type McpServerConnectionRef } from "@opengeni/contracts";
 import { type Database } from "./database.js";
 export type ApiIntegrationProtocol = "openapi" | "graphql";
 export type ApiIntegrationToolSafety = "read" | "write" | "destructive";
@@ -144,7 +144,7 @@ export type ApiIntegrationRuntime = {
     revision: StoredApiIntegrationRevision;
 };
 export type ApiIntegrationOwner = {
-    kind: "direct" | "plugin" | "pack" | "migration";
+    kind: "direct" | "plugin" | "migration";
     id: string;
     removable: boolean;
 };
@@ -189,14 +189,29 @@ export declare function listInstalledApiIntegrationServerIdsForDelegations(db: D
     ownerSubjectId: string;
     kind?: string | undefined;
 }[]): Promise<string[]>;
-/**
- * Read installed API Integrations from a transaction that already carries the
- * workspace RLS context. This is intentionally separate from the public
- * wrapper so compound Plugin/Pack lifecycle transactions never open a nested
- * transaction or lose their advisory locks.
- */
 export declare function listInstalledApiIntegrationsInRlsContext(scopedDb: Database, workspaceId: string, subjectId?: string): Promise<ApiIntegrationRuntime[]>;
 export declare function getApiIntegrationUninstallPreview(db: Database, workspaceId: string, subjectId: string, capabilityId: string, instanceKey: string): Promise<ApiIntegrationUninstallPreview>;
+/** No discovery or new authority: recover only an exact, currently visible and
+ * directly owned installed source. The installer must still lock and recheck
+ * the snapshot before committing; this read is not installation admission.
+ */
+export declare function getApiIntegrationReconciliationSnapshot(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    source: IntegrationSource;
+    connectionId?: string;
+    instanceKey?: string;
+    expectedRevisionId: string;
+    expectedContentSha256: string;
+    allowedTools?: string[];
+}): Promise<{
+    runtime: ApiIntegrationRuntime;
+    baseServerId: string;
+    name: string;
+    provider: string | null;
+    requiredScopes: string[];
+} | null>;
 export declare function uninstallApiIntegration(db: Database, input: {
     accountId: string;
     workspaceId: string;

package/dist/capability-reconciliation.d.ts

@@ -0,0 +1,5 @@
+import { type Database } from "./database.js";
+/** Retain the installation row through the caller's outer transaction. This is
+ * a no-write reconciliation read; it never activates or alters an installation.
+ * Acquisition callers must already hold the organization policy fence. */
+export declare function withLockedCapabilityInstallation<T>(db: Database, workspaceId: string, capabilityId: string, read: (tx: Database) => Promise<T>): Promise<T>;

package/dist/capability-reconciliation.js

@@ -0,0 +1,21 @@
+import {
+  withWorkspaceRls
+} from "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
+import "./chunk-S2TZ3F4L.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/capability-reconciliation.ts
+import { sql } from "drizzle-orm";
+async function withLockedCapabilityInstallation(db, workspaceId, capabilityId, read) {
+  return withWorkspaceRls(db, workspaceId, async (tx) => {
+    await tx.execute(sql`select id from capability_installations
+      where workspace_id = ${workspaceId}::uuid and capability_id = ${capabilityId}
+      for update`);
+    return read(tx);
+  });
+}
+export {
+  withLockedCapabilityInstallation
+};
+//# sourceMappingURL=capability-reconciliation.js.map

package/dist/capability-reconciliation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capability-reconciliation.ts"],"sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { withWorkspaceRls, type Database } from \"./database\";\n\n/** Retain the installation row through the caller's outer transaction. This is\n * a no-write reconciliation read; it never activates or alters an installation.\n * Acquisition callers must already hold the organization policy fence. */\nexport async function withLockedCapabilityInstallation<T>(\n  db: Database,\n  workspaceId: string,\n  capabilityId: string,\n  read: (tx: Database) => Promise<T>,\n) {\n  return withWorkspaceRls(db, workspaceId, async (tx) => {\n    await tx.execute(sql`select id from capability_installations\n      where workspace_id = ${workspaceId}::uuid and capability_id = ${capabilityId}\n      for update`);\n    return read(tx);\n  });\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,WAAW;AAMpB,eAAsB,iCACpB,IACA,aACA,cACA,MACA;AACA,SAAO,iBAAiB,IAAI,aAAa,OAAO,OAAO;AACrD,UAAM,GAAG,QAAQ;AAAA,6BACQ,WAAW,8BAA8B,YAAY;AAAA,iBACjE;AACb,WAAO,KAAK,EAAE;AAAA,EAChB,CAAC;AACH;","names":[]}