streamby-core 0.29.7 → 0.29.9

package/dist/middleware/routes/storage.js

@@ -13,6 +13,7 @@ const manager_1 = require("../../models/manager");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const auth_1 = require("../../utils/auth");
 const encryption_1 = require("../../utils/encryption");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
@@ -46,36 +47,43 @@ function getRawFoldersCollection() {
         return null;
     return (0, connectionManager_1.getConnection)(activeId).client.db().collection('storage_folders');
 }
-function connFilter(projectId, connId, extra) {
-    const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
-    const connMatch = isBuiltin
-        ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
-        : { storageConnectionId: connId };
-    return { projectId, ...connMatch, ...(extra ?? {}) };
-}
-async function resolveConnAdapter(connId, project, globalAdapter) {
-    if (connId === 'builtin' || connId.startsWith('builtin-'))
-        return globalAdapter;
-    const conn = project.storageConnections?.find((c) => c.id === connId);
-    if (!conn)
-        return { error: 'Storage connection not found', status: 404 };
-    if (!(0, encryption_1.isEncryptionKeySet)())
-        return { error: 'Encryption key not set', status: 500 };
-    const credential = project.credentials?.find((c) => c.id === conn.credentialId);
-    if (!credential)
-        return { error: 'Credential not found in project', status: 400 };
-    try {
-        const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
-        return new s3_1.S3Adapter(s3Config);
-    }
-    catch (e) {
-        return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
-    }
-}
 function storageRouter(config) {
     const router = (0, express_1.Router)();
     const adapter = config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
     const Project = (0, manager_1.getModel)('projects');
+    function connFilter(projectId, connId, extra) {
+        const isBuiltin = (0, builtinAccess_1.isBuiltinStorageId)(connId, config);
+        const connMatch = isBuiltin
+            ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
+            : { storageConnectionId: connId };
+        return { projectId, ...connMatch, ...(extra ?? {}) };
+    }
+    async function resolveConnAdapter(connId, project, auth) {
+        if ((0, builtinAccess_1.isBuiltinStorageId)(connId, config)) {
+            if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, connId, config, 'storage'))) {
+                return { error: 'Access to this built-in storage is not permitted', status: 403 };
+            }
+            const provider = config.storageProviders.find(p => p.id === connId);
+            if (!provider)
+                return { error: 'Storage provider not found', status: 404 };
+            return provider.type === 's3' ? new s3_1.S3Adapter(provider.config) : adapter;
+        }
+        const conn = project.storageConnections?.find((c) => c.id === connId);
+        if (!conn)
+            return { error: 'Storage connection not found', status: 404 };
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            return { error: 'Encryption key not set', status: 500 };
+        const credential = project.credentials?.find((c) => c.id === conn.credentialId);
+        if (!credential)
+            return { error: 'Credential not found in project', status: 400 };
+        try {
+            const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
+            return new s3_1.S3Adapter(s3Config);
+        }
+        catch (e) {
+            return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+        }
+    }
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
@@ -301,7 +309,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl)
@@ -340,7 +348,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -366,7 +374,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -402,7 +410,7 @@ function storageRouter(config) {
             if (!validateContentType(contentType, fileName, fileDoc.category)) {
                 return res.status(400).json({ message: `File does not match category ${fileDoc.category}` });
             }
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl) {
@@ -450,7 +458,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -549,11 +557,14 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
+            const isBuiltin = (0, builtinAccess_1.isBuiltinStorageId)(connId, config);
+            if (isBuiltin && !(await (0, builtinAccess_1.assertBuiltinAccess)(auth, connId, config, 'storage'))) {
+                return res.status(403).json({ message: 'Access to this built-in storage is not permitted' });
+            }
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const folderId = crypto_1.default.randomUUID();
-            const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
             const folderDoc = {
                 _id: new mongodb_1.ObjectId(),
                 folderId,
@@ -717,6 +728,7 @@ function storageRouter(config) {
                 r2: { value: 'cloudflare-r2', name: 'Cloudflare R2' },
             };
             const storages = (config.storageProviders || []).map(provider => ({
+                id: provider.id,
                 ...STORAGE_DISPLAY[provider.type],
                 type: provider.type,
             }));

package/dist/middleware/routes/storageConnection.js

@@ -5,13 +5,8 @@ const express_1 = require("express");
 const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const VALID_STORAGE_TYPES = ['s3', 'gcs', 'r2', 'azure'];
-const STORAGE_DISPLAY = {
-    s3: 'AWS S3',
-    gcs: 'Google Cloud Storage',
-    r2: 'Cloudflare R2',
-    azure: 'Azure Blob Storage',
-};
 function storageConnectionRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -24,17 +19,16 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const builtinConnections = (config.storageProviders || []).map((provider, i) => ({
-                id: i === 0 ? 'builtin' : `builtin-${i}`,
-                name: STORAGE_DISPLAY[provider.type] || provider.type,
-                type: provider.type,
-                credentialId: '',
-                projectId: req.params.id,
-                createdAt: new Date(0),
-                isBuiltin: true,
+            const connections = project.storageConnections || [];
+            // Recompute availability live for builtins — never trust a stored flag, per
+            // "validate on every use" (TCORE-69). BYOC (source: 'integration') is always available.
+            const data = await Promise.all(connections.map(async (conn) => {
+                if (conn.source !== 'builtin')
+                    return conn;
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
+                return { ...conn, isBuiltin: true, available };
             }));
-            const projectConnections = project.storageConnections || [];
-            return res.status(200).json({ data: [...builtinConnections, ...projectConnections] });
+            return res.status(200).json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch storage connections', details: err.message });
@@ -82,7 +76,7 @@ function storageConnectionRouter(config) {
     router.delete('/projects/:id/connections/storage/:connId', async (req, res) => {
         try {
             const { connId } = req.params;
-            if (connId === 'builtin' || connId.startsWith('builtin-')) {
+            if ((0, builtinAccess_1.isBuiltinStorageId)(connId, config)) {
                 return res.status(403).json({ message: 'Cannot delete a built-in storage connection' });
             }
             const auth = req.auth;

package/dist/middleware/routes/userIntegration.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function userIntegrationRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/userIntegration.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userIntegrationRouter = userIntegrationRouter;
+const express_1 = require("express");
+const builtinAccess_1 = require("../../utils/builtinAccess");
+const userIntegration_1 = require("../../services/userIntegration");
+const sanitize_1 = require("../../utils/sanitize");
+const VALID_KINDS = ['database', 'storage'];
+const VALID_DB_PROVIDERS = ['postgresql', 'mongodb'];
+const VALID_STORAGE_PROVIDERS = ['s3', 'gcs', 'r2', 'azure'];
+function userIntegrationRouter(config) {
+    const router = (0, express_1.Router)();
+    // ─── Combined pool: account integrations + built-ins the user can access ─────
+    router.get('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const owned = await (0, userIntegration_1.listUserIntegrations)(auth.userId);
+            const pool = owned.map(i => ({
+                id: i.id, kind: i.kind, name: i.name, provider: i.provider, source: 'integration', available: true,
+            }));
+            for (const db of config.databases ?? []) {
+                // requiredPlan is not populated here — canUseBuiltin only returns a boolean today,
+                // so there's no plan-level detail to surface without a hook-signature change.
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, db.id, config, 'database');
+                pool.push({ id: db.id, kind: 'database', name: db.id, provider: db.type, source: 'builtin', available });
+            }
+            for (const provider of config.storageProviders ?? []) {
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, provider.id, config, 'storage');
+                pool.push({ id: provider.id, kind: 'storage', name: provider.id, provider: provider.type, source: 'builtin', available });
+            }
+            res.json({ data: pool });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to list integrations', details: err.message });
+        }
+    });
+    // ─── Create ────────────────────────────────────────────────────────────────
+    router.post('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { kind, provider, name, description, credential } = req.body;
+            if (!kind || !VALID_KINDS.includes(kind)) {
+                return res.status(400).json({ message: `kind must be one of: ${VALID_KINDS.join(', ')}` });
+            }
+            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : VALID_STORAGE_PROVIDERS;
+            if (!provider || !validProviders.includes(provider)) {
+                return res.status(400).json({ message: `provider must be one of: ${validProviders.join(', ')}` });
+            }
+            if (!name)
+                return res.status(400).json({ message: 'name is required' });
+            if (credential === undefined || credential === null) {
+                return res.status(400).json({ message: 'credential is required' });
+            }
+            const integration = await (0, userIntegration_1.createUserIntegration)(auth.userId, {
+                kind, provider, name, description, credentialValue: credential,
+            });
+            res.status(201).json({ data: (0, sanitize_1.sanitizeUserIntegration)(integration) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to create integration', details: err.message });
+        }
+    });
+    // ─── Update ────────────────────────────────────────────────────────────────
+    router.patch('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { name, description, credential } = req.body;
+            const updated = await (0, userIntegration_1.updateUserIntegration)(auth.userId, req.params.integrationId, {
+                name, description, credentialValue: credential,
+            });
+            if (!updated)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ data: (0, sanitize_1.sanitizeUserIntegration)(updated) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to update integration', details: err.message });
+        }
+    });
+    // ─── Delete ────────────────────────────────────────────────────────────────
+    router.delete('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const deleted = await (0, userIntegration_1.deleteUserIntegration)(auth.userId, req.params.integrationId);
+            if (!deleted)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ message: 'Integration deleted' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to delete integration', details: err.message });
+        }
+    });
+    return router;
+}

package/dist/models/Model.js

@@ -45,11 +45,11 @@ class Model {
                     // Handle members filter for SQL projects
                     const userId = processedFilter.members.$elemMatch.userId;
                     const schema = this.schema || 'streamby'; // Default to 'streamby' if schema not provided
-                    const query = `
-            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
-            FROM "${schema}"."projects" p
-            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
-            WHERE pm."userId" = $1
+                    const query = `
+            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
+            FROM "${schema}"."projects" p
+            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
+            WHERE pm."userId" = $1
           `;
                     const result = await connection.query(query, [userId]);
                     sqlResults = result.rows.map(row => ({
@@ -219,10 +219,10 @@ class Model {
         else {
             const matchKey = value.id !== undefined ? 'id' : Object.keys(value)[0];
             const matchVal = String(value[matchKey]);
-            await connection.query(`UPDATE ${tbl} SET "${field}" = (
-          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
-          FROM jsonb_array_elements("${field}") elem
-          WHERE elem->>'${matchKey}' != $1
+            await connection.query(`UPDATE ${tbl} SET "${field}" = (
+          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
+          FROM jsonb_array_elements("${field}") elem
+          WHERE elem->>'${matchKey}' != $1
         ) WHERE id = $2`, [matchVal, id]);
         }
     }

package/dist/services/backfillBuiltinConnections.d.ts

@@ -0,0 +1,2 @@
+import { StreamByConfig } from '../types';
+export declare function backfillBuiltinConnections(config: StreamByConfig): Promise<void>;

package/dist/services/backfillBuiltinConnections.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.backfillBuiltinConnections = backfillBuiltinConnections;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+// Pre-BYOC, every project appeared connected to every configured builtin because
+// storageConnection.ts/dbConnection.ts SYNTHESIZED builtins at read time instead of
+// persisting them (see storageConnection.ts's old GET handler). Now that connections must
+// be real rows on the project, this seeds those rows once for projects that predate the
+// change — so existing projects don't silently lose access on deploy.
+//
+// Guarded by ProjectInfo.builtinBackfilledAt: runs once per project, ever. An admin who
+// later disconnects a builtin on purpose won't have it silently reappear on the next boot.
+async function backfillBuiltinConnections(config) {
+    if (!config.databases?.length && !config.storageProviders?.length)
+        return;
+    const Project = (0, manager_1.getModel)('projects');
+    const allProjects = await Project.find({});
+    const pending = allProjects.filter(p => !p.builtinBackfilledAt);
+    if (!pending.length)
+        return;
+    for (const project of pending) {
+        const now = new Date();
+        const dbConnections = (config.databases ?? []).map(db => ({
+            id: crypto_1.default.randomUUID(),
+            name: db.id,
+            dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: db.id,
+            source: 'builtin',
+        }));
+        const storageConnections = (config.storageProviders ?? []).map(provider => ({
+            id: crypto_1.default.randomUUID(),
+            name: provider.id,
+            type: provider.type,
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: provider.id,
+            source: 'builtin',
+        }));
+        await Project.update({ _id: project.id }, {
+            dbConnections: [...(project.dbConnections ?? []), ...dbConnections],
+            storageConnections: [...(project.storageConnections ?? []), ...storageConnections],
+            builtinBackfilledAt: now,
+        });
+    }
+    console.log(`✅ Backfilled built-in connections for ${pending.length} project(s).`);
+}

package/dist/services/userIntegration.d.ts

@@ -0,0 +1,16 @@
+import { IntegrationKind, UserIntegration } from '../types';
+export declare function listUserIntegrations(userId: string): Promise<UserIntegration[]>;
+export declare function createUserIntegration(userId: string, input: {
+    kind: IntegrationKind;
+    provider: string;
+    name: string;
+    description?: string;
+    credentialValue: unknown;
+}): Promise<UserIntegration>;
+export declare function updateUserIntegration(userId: string, integrationId: string, updates: {
+    name?: string;
+    description?: string;
+    credentialValue?: unknown;
+}): Promise<UserIntegration | null>;
+export declare function deleteUserIntegration(userId: string, integrationId: string): Promise<boolean>;
+export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string): Promise<unknown | null>;

package/dist/services/userIntegration.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listUserIntegrations = listUserIntegrations;
+exports.createUserIntegration = createUserIntegration;
+exports.updateUserIntegration = updateUserIntegration;
+exports.deleteUserIntegration = deleteUserIntegration;
+exports.getDecryptedIntegrationCredential = getDecryptedIntegrationCredential;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+function encryptCredential(kind, value) {
+    return kind === 'storage' ? (0, encryption_1.encrypt)(JSON.stringify(value)) : (0, encryption_1.encrypt)(String(value));
+}
+async function listUserIntegrations(userId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    return UserIntegrationModel.find({ userId });
+}
+async function createUserIntegration(userId, input) {
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot create integration.');
+    }
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const now = new Date();
+    const integration = {
+        id: crypto_1.default.randomUUID(),
+        userId,
+        kind: input.kind,
+        provider: input.provider,
+        name: input.name,
+        description: input.description,
+        encryptedCredential: encryptCredential(input.kind, input.credentialValue),
+        createdAt: now,
+        updatedAt: now,
+    };
+    return UserIntegrationModel.create(integration);
+}
+async function updateUserIntegration(userId, integrationId, updates) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const existing = await UserIntegrationModel.findOne({ id: integrationId, userId });
+    if (!existing)
+        return null;
+    const $set = { updatedAt: new Date() };
+    if (updates.name !== undefined)
+        $set.name = updates.name;
+    if (updates.description !== undefined)
+        $set.description = updates.description;
+    if (updates.credentialValue !== undefined) {
+        if (!(0, encryption_1.isEncryptionKeySet)()) {
+            throw new Error('Encryption key is not set. Cannot update integration.');
+        }
+        $set.encryptedCredential = encryptCredential(existing.kind, updates.credentialValue);
+    }
+    return UserIntegrationModel.update({ id: integrationId, userId }, $set);
+}
+async function deleteUserIntegration(userId, integrationId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const deletedCount = await UserIntegrationModel.delete({ id: integrationId, userId });
+    return deletedCount > 0;
+}
+async function getDecryptedIntegrationCredential(userId, integrationId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const integration = await UserIntegrationModel.findOne({ id: integrationId, userId });
+    if (!integration)
+        return null;
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot decrypt integration credential.');
+    }
+    const decrypted = (0, encryption_1.decrypt)(integration.encryptedCredential);
+    return integration.kind === 'storage' ? JSON.parse(decrypted) : decrypted;
+}

package/dist/types/index.d.ts

@@ -17,8 +17,12 @@ export interface StorageConnection {
     createdAt: Date;
     description?: string;
     isBuiltin?: boolean;
+    integrationId?: string;
+    source?: 'builtin' | 'integration';
+    available?: boolean;
 }
 export type StorageProvider = {
+    id: string;
     type: StorageProviderType;
     config: S3Config;
 };
@@ -73,6 +77,8 @@ export interface ProjectInfo {
     apiConnections?: ApiConnection[];
     dbConnections?: DbConnection[];
     storageConnections?: StorageConnection[];
+    pipelines?: PipelineRef[];
+    builtinBackfilledAt?: Date;
 }
 export interface Credential {
     id: string;
@@ -106,10 +112,7 @@ export interface DatabaseCredential {
     main?: boolean;
 }
 export interface StreamByConfig {
-    storageProviders: {
-        type: StorageProviderType;
-        config: S3Config;
-    }[];
+    storageProviders: StorageProvider[];
     authProvider: AuthProvider;
     databases?: DatabaseCredential[];
     adapter?: StorageAdapter;
@@ -117,6 +120,7 @@ export interface StreamByConfig {
     websocket?: {
         server: WebSocketServer;
     };
+    canUseBuiltin?: (auth: Auth, builtinId: string, kind: 'database' | 'storage') => boolean | Promise<boolean>;
 }
 export interface Notification {
     _id?: string;
@@ -153,6 +157,21 @@ export interface DbConnection {
     projectId: string;
     createdAt: Date;
     description?: string;
+    isBuiltin?: boolean;
+    integrationId?: string;
+    source?: 'builtin' | 'integration';
+}
+export type IntegrationKind = 'database' | 'storage';
+export interface UserIntegration {
+    id: string;
+    userId: string;
+    kind: IntegrationKind;
+    provider: ExternalDbType | StorageProviderType;
+    name: string;
+    description?: string;
+    encryptedCredential: string;
+    createdAt: Date;
+    updatedAt: Date;
 }
 export interface ColumnDefinition {
     name: string;
@@ -168,6 +187,23 @@ export interface NodeSchema {
     nodes: any[];
     edges: any[];
 }
+export interface Pipeline {
+    _id?: string;
+    id: string;
+    projectId: string;
+    name: string;
+    description?: string | null;
+    order: number;
+    nodeSchema: NodeSchema | null;
+    createdBy: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface PipelineRef {
+    id: string;
+    name: string;
+    order: number;
+}
 export interface Export {
     _id?: string;
     id: string;

package/dist/utils/builtinAccess.d.ts

@@ -0,0 +1,4 @@
+import { Auth, StreamByConfig } from '../types';
+export declare function assertBuiltinAccess(auth: Auth, builtinId: string, config: StreamByConfig, kind: 'database' | 'storage'): Promise<boolean>;
+export declare function isBuiltinStorageId(id: string, config: StreamByConfig): boolean;
+export declare function isBuiltinDb(id: string, config: StreamByConfig): boolean;

package/dist/utils/builtinAccess.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBuiltinAccess = assertBuiltinAccess;
+exports.isBuiltinStorageId = isBuiltinStorageId;
+exports.isBuiltinDb = isBuiltinDb;
+// Gates access to a built-in database/storage provider. Delegates to config.canUseBuiltin
+// when the mounting app implements it (e.g. Nhexa-API checking user_subscriptions);
+// defaults to allow when absent, preserving pre-BYOC behavior for deploys without gating.
+async function assertBuiltinAccess(auth, builtinId, config, kind) {
+    if (!config.canUseBuiltin)
+        return true;
+    return config.canUseBuiltin(auth, builtinId, kind);
+}
+function isBuiltinStorageId(id, config) {
+    return (config.storageProviders ?? []).some(p => p.id === id);
+}
+function isBuiltinDb(id, config) {
+    return (config.databases ?? []).some(db => db.id === id);
+}

package/dist/utils/sanitize.d.ts

@@ -1 +1,2 @@
 export declare function sanitizeProject(project: any): any;
+export declare function sanitizeUserIntegration(integration: any): any;

package/dist/utils/sanitize.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeProject = sanitizeProject;
+exports.sanitizeUserIntegration = sanitizeUserIntegration;
 function sanitizeProject(project) {
     if (!project)
         return project;
@@ -9,3 +10,9 @@ function sanitizeProject(project) {
         credentials: project.credentials?.map(({ id, key }) => ({ id, key })) ?? [],
     };
 }
+function sanitizeUserIntegration(integration) {
+    if (!integration)
+        return integration;
+    const { encryptedCredential, ...rest } = integration;
+    return rest;
+}