@opengeni/db 5.0.1 → 6.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -19,6 +19,18 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./connect-attempts": {
+      "types": "./dist/connect-attempts.d.ts",
+      "import": "./dist/connect-attempts.js"
+    },
+    "./capability-reconciliation": {
+      "types": "./dist/capability-reconciliation.d.ts",
+      "import": "./dist/capability-reconciliation.js"
+    },
+    "./organization-integration-policy": {
+      "types": "./dist/organization-integration-policy.d.ts",
+      "import": "./dist/organization-integration-policy.js"
+    },
     "./session-mcp-credential-rotation": {
       "types": "./dist/session-mcp-credential-rotation.d.ts",
       "import": "./dist/session-mcp-credential-rotation.js"
@@ -102,10 +114,10 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.9",
-    "@opengeni/codex": "^0.2.23",
-    "@opengeni/config": "^1.2.2",
-    "@opengeni/contracts": "^4.1.0",
+    "@opengeni/codemode": "^0.6.0",
+    "@opengeni/codex": "^0.2.24",
+    "@opengeni/config": "^2.0.0",
+    "@opengeni/contracts": "^5.0.0",
     "@opengeni/network": "^0.3.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"

package/src/automations.ts

@@ -3,8 +3,6 @@ import {
   StoredAutomationAcceptedExecution,
   AutomationNormalizedEvent,
   StoredAutomationSessionTemplate,
-  StoredCapabilityPack,
-  stableJson,
   type AutomationRun,
   type AutomationSource,
   type AutomationTrigger,
@@ -13,7 +11,7 @@ import {
   type UpdateAutomationSourceRequest,
   type UpdateAutomationTriggerRequest,
 } from "@opengeni/contracts";
-import { and, desc, eq, inArray, isNull, sql } from "drizzle-orm";
+import { and, desc, eq, inArray, ne, sql } from "drizzle-orm";
 import type { Database } from "./database";
 import { withWorkspaceRls } from "./database";
 import * as schema from "./schema";
@@ -85,10 +83,11 @@ export async function createAutomationSource(
     createdBySubjectId: string;
     request: CreateAutomationSourceRequest;
     webhookSecretEncrypted: string;
-    packInstallationId?: string | null;
-    packConnectorId?: string | null;
   },
 ): Promise<AutomationSource> {
+  if (input.request.adapterId === "source-control.pull-request.v1") {
+    throw new Error("PR Review automations require the PR Review setup API");
+  }
   return await withWorkspaceRls(
     db,
     input.workspaceId,
@@ -103,8 +102,7 @@ export async function createAutomationSource(
             adapterId: input.request.adapterId,
             configuration: input.request.configuration,
             webhookSecretEncrypted: input.webhookSecretEncrypted,
-            packInstallationId: input.packInstallationId ?? null,
-            packConnectorId: input.packConnectorId ?? null,
+
             createdBySubjectId: input.createdBySubjectId,
           })
           .returning();
@@ -208,7 +206,7 @@ export async function updateAutomationSource(
         and(
           eq(schema.automationSources.workspaceId, input.workspaceId),
           eq(schema.automationSources.id, input.sourceId),
-          isNull(schema.automationSources.packInstallationId),
+          ne(schema.automationSources.adapterId, "source-control.pull-request.v1"),
         ),
       )
       .returning();
@@ -238,7 +236,6 @@ export async function createAutomationTrigger(
             id: schema.automationSources.id,
             adapterId: schema.automationSources.adapterId,
             status: schema.automationSources.status,
-            packInstallationId: schema.automationSources.packInstallationId,
           })
           .from(schema.automationSources)
           .where(
@@ -254,44 +251,10 @@ export async function createAutomationTrigger(
         if (source.adapterId !== input.adapterId) {
           throw new Error("Automation source and trigger adapter do not match");
         }
-        if (source.packInstallationId !== input.request.packInstallationId) {
-          throw new Error("Automation source and trigger Pack ownership do not match");
-        }
-        if (input.request.packInstallationId) {
-          const [installation] = await tx
-            .select({
-              status: schema.packInstallations.status,
-              manifestSnapshot: schema.packInstallations.manifestSnapshot,
-            })
-            .from(schema.packInstallations)
-            .where(
-              and(
-                eq(schema.packInstallations.workspaceId, input.workspaceId),
-                eq(schema.packInstallations.id, input.request.packInstallationId),
-              ),
-            )
-            .limit(1);
-          const manifest = installation?.manifestSnapshot
-            ? StoredCapabilityPack.safeParse(installation.manifestSnapshot)
-            : null;
-          if (!installation || installation.status !== "active" || !manifest?.success) {
-            throw new Error("Automation Pack installation is not active");
-          }
-          const template = manifest.data.automationTemplates?.find(
-            (candidate) => candidate.id === input.request.packTemplateId,
-          );
-          if (!template || template.adapterId !== input.adapterId) {
-            throw new Error("Automation Pack template does not match the source adapter");
-          }
-          if (
-            stableJson([...new Set(input.request.eventTypes)].sort()) !==
-              stableJson([...new Set(template.eventTypes)].sort()) ||
-            stableJson(input.request.configuration) !== stableJson(template.configuration) ||
-            stableJson(input.request.sessionTemplate) !== stableJson(template.sessionTemplate)
-          ) {
-            throw new Error("Automation Pack trigger must use its frozen manifest template");
-          }
+        if (source.adapterId === "source-control.pull-request.v1") {
+          throw new Error("PR Review automations require the PR Review setup API");
         }
+
         await input.beforeCreateCommit?.(tx);
         const [head] = await tx
           .insert(schema.automationTriggers)
@@ -301,8 +264,7 @@ export async function createAutomationTrigger(
             sourceId: input.request.sourceId,
             name: input.request.name,
             status: input.request.status,
-            packInstallationId: input.request.packInstallationId,
-            packTemplateId: input.request.packTemplateId,
+
             createdBySubjectId: input.createdBySubjectId,
           })
           .returning();
@@ -476,14 +438,13 @@ export async function updateAutomationTrigger(
           .for("update")
           .limit(1);
         if (!existing) return null;
+        if (existing.revision.adapterId === "source-control.pull-request.v1") {
+          throw new Error("PR Review automations require the PR Review setup API");
+        }
         if (existing.head.currentRevision !== input.request.expectedRevision) {
           throw new AutomationRevisionConflictError();
         }
-        if (existing.head.packInstallationId) {
-          throw new Error(
-            "Pack-owned automation triggers must be managed through their Pack setup API",
-          );
-        }
+
         await input.beforeUpdateCommit?.(tx);
         const revisionNumber = existing.head.currentRevision + 1;
         const [head] = await tx
@@ -739,7 +700,6 @@ export async function assertAutomationRunAuthorityInTransaction(
       sourceVersion: schema.automationSources.version,
       triggerStatus: schema.automationTriggers.status,
       currentRevision: schema.automationTriggers.currentRevision,
-      packInstallationId: schema.automationTriggers.packInstallationId,
     })
     .from(schema.automationRuns)
     .innerJoin(
@@ -775,21 +735,7 @@ export async function assertAutomationRunAuthorityInTransaction(
   if (row.currentRevision !== input.triggerRevision) {
     throw new AutomationAuthorityRevokedError("Automation trigger changed before dispatch");
   }
-  if (row.packInstallationId) {
-    const [installation] = await db
-      .select({ status: schema.packInstallations.status })
-      .from(schema.packInstallations)
-      .where(
-        and(
-          eq(schema.packInstallations.workspaceId, input.workspaceId),
-          eq(schema.packInstallations.id, row.packInstallationId),
-        ),
-      )
-      .limit(1);
-    if (!installation || installation.status !== "active") {
-      throw new AutomationAuthorityRevokedError("Automation Pack is no longer active");
-    }
-  }
+
   await db
     .update(schema.automationRuns)
     .set({
@@ -838,8 +784,7 @@ function mapSource(row: SourceRow): AutomationSource {
     configuration: row.configuration,
     status: row.status as AutomationSource["status"],
     version: row.version,
-    packInstallationId: row.packInstallationId,
-    packConnectorId: row.packConnectorId,
+
     hasWebhookSecret: Boolean(row.webhookSecretEncrypted),
     webhookPath: `/v1/webhooks/automations/${row.endpointId}`,
     createdBySubjectId: row.createdBySubjectId,
@@ -866,8 +811,7 @@ function mapTrigger(
     sessionTemplate: StoredAutomationSessionTemplate.parse(revision.sessionTemplate),
     status: head.status as AutomationTrigger["status"],
     revision: revisionNumber,
-    packInstallationId: head.packInstallationId,
-    packTemplateId: head.packTemplateId,
+
     createdBySubjectId: head.createdBySubjectId,
     createdAt: head.createdAt.toISOString(),
     updatedAt: head.updatedAt.toISOString(),

package/src/canonical-human-identities.ts

@@ -217,6 +217,9 @@ export async function synchronizeCanonicalHumanLoginBindings(
           binding.providerId === account.providerId &&
           binding.providerAccountId === account.providerAccountId,
       );
+      // A revoked/recovery binding is not an invitation to relink. Reconnection
+      // belongs to the explicit OAuth-proof transaction, never a session hook.
+      if (existing && existing.status !== "active") break;
       if (existing?.status === "active") {
         authority = {
           identityId: projection.activeIdentity.id,
@@ -316,6 +319,7 @@ export type ApplyCanonicalHumanIdentityOperationInput = {
   providerId?: string | null;
   providerAccountId?: string | null;
   reason: string;
+  verifiedRecovery?: { authSessionId: string; requestDigest: string };
   actorFence?: {
     authorityHash: string;
     actorEpoch: string;
@@ -328,16 +332,24 @@ export async function applyCanonicalHumanIdentityOperation(
   input: ApplyCanonicalHumanIdentityOperationInput,
 ): Promise<CanonicalHumanIdentityMutationResponseType> {
   try {
-    if (input.actorFence) {
+    if (input.actorFence || input.verifiedRecovery) {
       return await db.transaction(async (tx) => {
         const txDb = tx as unknown as Database;
-        await rawRows(
-          txDb,
-          sql`select managed_auth_actor_mutation_fence(
+        if (input.actorFence)
+          await rawRows(
+            txDb,
+            sql`select managed_auth_actor_mutation_fence(
             ${input.actorFence!.authorityHash}, ${input.actorFence!.actorEpoch}::bigint,
             ${input.actorFence!.requestId}::uuid
           )`,
-        );
+          );
+        if (input.verifiedRecovery)
+          await rawRows(
+            txDb,
+            sql`select assert_managed_sign_in_recovery(
+          ${input.authUserId},${input.verifiedRecovery.authSessionId},${input.bindingId}::uuid,
+          ${JSON.stringify({ operationId: input.operationId, expectedIdentityRevision: input.expectedIdentityRevision, requestDigest: input.verifiedRecovery.requestDigest })}::jsonb)`,
+          );
         return await applyCanonicalHumanIdentityOperationInner(txDb, input);
       });
     }

package/src/capability-components.ts

@@ -6,7 +6,7 @@ import { releaseOrphanedSkillHeads, type SkillSourceReleaseReceipt } from "./ski
 import * as schema from "./schema";
 
 export type CapabilityComponentOwnerIdentity = {
-  kind: "direct" | "plugin" | "pack" | "migration";
+  kind: "direct" | "plugin" | "migration";
   id: string;
 };
 
@@ -19,17 +19,15 @@ export class CapabilityComponentVersionConflictError extends Error {
 }
 
 /**
- * An owner row is runtime-effective only while its lifecycle-owning Plugin or
- * v2 Pack installation is active. Direct, migration, and legacy textual Pack
- * ownership is intrinsic so the rolling migration does not hide pre-v2 shared
- * components before those Packs are reinstalled into the normalized ledger.
+ * Plugin ownership is effective only while its installation is active.
+ * Direct and migration ownership is intrinsic.
  */
 export function effectiveCapabilityOwnerSql(
   ownerKind: SQLWrapper,
   ownerId: SQLWrapper,
 ): ReturnType<typeof sql> {
   return sql`(
-    ${ownerKind} not in ('plugin', 'pack')
+    ${ownerKind} in ('direct', 'migration')
     or (
       ${ownerKind} = 'plugin'
       and exists (
@@ -38,21 +36,10 @@ export function effectiveCapabilityOwnerSql(
           and owning_plugin.status = 'active'
       )
     )
-    or (
-      ${ownerKind} = 'pack'
-      and (
-        ${ownerId} !~ '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
-        or exists (
-          select 1 from ${schema.packInstallations} owning_pack
-          where owning_pack.id::text = ${ownerId}
-            and owning_pack.status = 'active'
-        )
-      )
-    )
   )`;
 }
 
-/** Serialize one workspace-local component identity across direct, Plugin, and Pack installers. */
+/** Serialize one workspace-local component identity across direct and Plugin installers. */
 export async function lockCapabilityComponentIdentity(
   db: Database,
   workspaceId: string,
@@ -104,17 +91,12 @@ export async function assertCapabilityComponentVersionCanChange(
   }
 }
 
-/**
- * Delete physically ownerless facet installations and disable now-empty child
- * components. Inactive lifecycle owners still preserve storage: a Pack may
- * have claimed a component while its installation is pending or repairing,
- * even though that owner is intentionally hidden from runtime reads.
- */
 export async function cleanupOrphanedCapabilityComponents(
   db: Database,
   workspaceId: string,
   facetInstallationIds: string[],
   skillActor?: SkillActor,
+  lockedSkillHeadIds?: readonly string[],
 ): Promise<SkillSourceReleaseReceipt[]> {
   const uniqueIds = [...new Set(facetInstallationIds)];
   if (uniqueIds.length === 0) return [];
@@ -147,6 +129,7 @@ export async function cleanupOrphanedCapabilityComponents(
     workspaceId,
     facetInstallationIds: orphanRows.map((row) => row.facetInstallationId),
     ...(skillActor ? { skillActor } : {}),
+    ...(lockedSkillHeadIds !== undefined ? { lockedHeadIds: lockedSkillHeadIds } : {}),
   });
   await db.delete(schema.capabilityFacetInstallations).where(
     inArray(