@opengeni/db 6.3.0 → 6.4.0-canary.36938443461001

package/dist/automations.d.ts

@@ -4,6 +4,10 @@ export declare class AutomationDeliveryConflictError extends Error {
     readonly name = "AutomationDeliveryConflictError";
     constructor();
 }
+export declare class AutomationCredentialRestrictionConflictError extends Error {
+    readonly name = "AutomationCredentialRestrictionConflictError";
+    constructor();
+}
 export declare class AutomationRevisionConflictError extends Error {
     readonly name = "AutomationRevisionConflictError";
     constructor();
@@ -73,6 +77,8 @@ export declare function createAutomationTrigger(db: Database, input: {
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Canonical server-only creator restriction, never request metadata. */
+    credentialRestriction?: "developer_setup";
     /** Trusted database-only admission seam. Throwing rolls creation back. */
     beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger>;
@@ -94,6 +100,8 @@ export declare function updateAutomationTrigger(db: Database, input: {
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** May add a canonical restriction; can never downgrade the stored ceiling. */
+    credentialRestriction?: "developer_setup";
     /** Trusted database-only admission seam. Throwing rolls the revision back. */
     beforeUpdateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger | null>;
@@ -110,6 +118,8 @@ export declare function recordAutomationEvent(db: Database, input: {
     deliveryKey: string;
     requestDigest: string;
     normalizedEvent: AutomationNormalizedEvent;
+    /** Trusted caller authority; never accepted from normalized adapter/event JSON. */
+    credentialRestriction?: "developer_setup";
     ignoredReason?: string | null;
 }): Promise<{
     event: AutomationStoredEvent;

package/dist/{chunk-OARBNSA4.js → chunk-7ORQCNBA.js}

@@ -151,6 +151,13 @@ var MCP_OPERATION_AUTHORITY_TABLES = [
 ];
 var OWNER_INTERNAL_PRIVATE_ROUTINES = /* @__PURE__ */ new Set([
   "read_sender_connection(uuid, uuid, uuid, text)",
+  // Lifecycle fact writers (migrations 0532 and 0565): owner-run trigger
+  // functions and the migration-owner backfill. Runtime roles may still hold
+  // EXECUTE until a follow-up migration revokes it once no pre-0565 binary
+  // can run; this binary no longer requires it.
+  "capture_product_lifecycle_fact()",
+  "observe_credit_grant()",
+  "backfill_product_lifecycle_facts(text, integer)",
   "validate_mcp_account_bindings(jsonb, jsonb)",
   "fence_mcp_account_bindings()",
   "guard_mcp_operation_immutable()",
@@ -5922,4 +5929,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-OARBNSA4.js.map
+//# sourceMappingURL=chunk-7ORQCNBA.js.map