@elevasis/core 0.45.0 → 0.47.0

package/src/knowledge/queries.ts

@@ -4,6 +4,30 @@ import { OntologyIdSchema, ontologyGraphNodeId } from '../organization-model/ont
 import type { OrganizationModel } from '../organization-model/types'
 import { listAllSystems } from '../organization-model/helpers'
 
+// ---------------------------------------------------------------------------
+// Domain-item constants
+// ---------------------------------------------------------------------------
+
+/**
+ * The six graph-projected domain-item kinds supported by `omDescribe`.
+ * Each maps to a collection on `OrganizationModel` and a graph node kind.
+ */
+export const DOMAIN_ITEM_KINDS = ['clients', 'roles', 'policies', 'customers', 'offerings', 'goals'] as const
+export type DomainItemKind = (typeof DOMAIN_ITEM_KINDS)[number]
+
+/**
+ * Bare-id prefix to domain map used for back-compat resolution.
+ * e.g. `client:<uuid>` → `clients`
+ */
+const BARE_PREFIX_TO_DOMAIN: Record<string, DomainItemKind> = {
+  client: 'clients',
+  role: 'roles',
+  policy: 'policies',
+  customer: 'customers',
+  offering: 'offerings',
+  goal: 'goals'
+}
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -265,6 +289,8 @@ export type KnowledgeMount =
   | 'all-systems'
   | 'all-resources'
   | 'all-roles'
+  | 'by-domain'
+  | 'by-item'
 
 /**
  * The result of parsing a Knowledge Map path string.
@@ -272,15 +298,17 @@ export type KnowledgeMount =
  * Shape: `{ mount: KnowledgeMount, args: string[] }`
  *
  * Per-mount arg arrays:
- * - `by-system`:    `[systemId]`   (e.g. `['sales.crm']`)
- * - `by-ontology`:  `[ontologyId]` (e.g. `['sales.crm:object/deal']`)
- * - `by-kind`:      `[kind]`       (e.g. `['playbook']`)
- * - `by-owner`:     `[ownerId]`    (e.g. `['role.ops-lead']`)
- * - `graph`:        `[nodeId, verb]` where verb is `'governs'` or `'governed-by'`
- * - `node`:         `[nodeId]`     (single node lookup, no sub-path)
- * - `all-systems`:  `[]`           (no args — returns all systems flattened)
- * - `all-resources`:`[]`           (no args — returns all resources)
- * - `all-roles`:    `[]`           (no args — returns all roles)
+ * - `by-system`:    `[systemId]`      (e.g. `['sales.crm']`)
+ * - `by-ontology`:  `[ontologyId]`    (e.g. `['sales.crm:object/deal']`)
+ * - `by-kind`:      `[kind]`          (e.g. `['playbook']`)
+ * - `by-owner`:     `[ownerId]`       (e.g. `['role.ops-lead']`)
+ * - `graph`:        `[nodeId, verb]`  where verb is `'governs'` or `'governed-by'`
+ * - `node`:         `[nodeId]`        (single node lookup, no sub-path)
+ * - `all-systems`:  `[]`              (no args — returns all systems flattened)
+ * - `all-resources`:`[]`              (no args — returns all resources)
+ * - `all-roles`:    `[]`              (no args — returns all roles)
+ * - `by-domain`:    `[domain]`        (e.g. `['clients']`) — enumerate all items in domain
+ * - `by-item`:      `[domain, itemId]` (e.g. `['clients', '<uuid>']`) — single domain-item
  */
 export interface ParsedKnowledgePath {
   mount: KnowledgeMount
@@ -301,6 +329,8 @@ export interface ParsedKnowledgePath {
  *   `/all-systems`                    -> `{ mount: ‘all-systems’,  args: [] }`
  *   `/all-resources`                  -> `{ mount: ‘all-resources’,args: [] }`
  *   `/all-roles`                      -> `{ mount: ‘all-roles’,    args: [] }`
+ *   `/by-domain/<domain>`             -> `{ mount: ‘by-domain’,    args: [‘<domain>’] }`
+ *   `/by-item/<domain>/<itemId>`      -> `{ mount: ‘by-item’,      args: [‘<domain>’, ‘<itemId>’] }`
  *
  * The path MUST start with `/`.  Trailing slashes are stripped before parsing.
  *
@@ -384,6 +414,31 @@ export function parsePath(pathString: string): ParsedKnowledgePath {
     return { mount: 'all-roles', args: [] }
   }
 
+  // /by-domain/<domain>  — enumerate all items in a domain
+  if (first === 'by-domain') {
+    if (rest.length === 0) {
+      throw new Error(`parsePath: /by-domain requires a domain argument, got: "${pathString}"`)
+    }
+    const domain = rest[0]
+    if (!(DOMAIN_ITEM_KINDS as readonly string[]).includes(domain)) {
+      throw new Error(`parsePath: /by-domain unknown domain "${domain}". Supported: ${DOMAIN_ITEM_KINDS.join(', ')}`)
+    }
+    return { mount: 'by-domain', args: [domain] }
+  }
+
+  // /by-item/<domain>/<itemId>  — single domain-item resolution
+  if (first === 'by-item') {
+    if (rest.length < 2) {
+      throw new Error(`parsePath: /by-item requires <domain>/<itemId>, got: "${pathString}"`)
+    }
+    const domain = rest[0]
+    if (!(DOMAIN_ITEM_KINDS as readonly string[]).includes(domain)) {
+      throw new Error(`parsePath: /by-item unknown domain "${domain}". Supported: ${DOMAIN_ITEM_KINDS.join(', ')}`)
+    }
+    const itemId = rest.slice(1).join('/')
+    return { mount: 'by-item', args: [domain, itemId] }
+  }
+
   // /<nodeId>  (single node)
   // first must not be a recognized mount prefix
   if (segments.length === 1) {
@@ -391,7 +446,7 @@ export function parsePath(pathString: string): ParsedKnowledgePath {
   }
 
   throw new Error(
-    `parsePath: unrecognized path pattern "${pathString}". Supported: /by-system/<id>, /by-kind/<kind>, /by-owner/<id>, /graph/<nodeId>/governs, /graph/<nodeId>/governed-by, /<nodeId>, /all-systems, /all-resources, /all-roles`
+    `parsePath: unrecognized path pattern "${pathString}". Supported: /by-system/<id>, /by-kind/<kind>, /by-owner/<id>, /by-domain/<domain>, /by-item/<domain>/<itemId>, /graph/<nodeId>/governs, /graph/<nodeId>/governed-by, /<nodeId>, /all-systems, /all-resources, /all-roles`
   )
 }
 
@@ -763,6 +818,58 @@ function collectOntologyEntries(scope: {
 // omDescribe — neighborhood view for any OM node ID
 // ---------------------------------------------------------------------------
 
+/**
+ * Location context for a domain-item node in the organization graph.
+ */
+export interface OmDescribeDomainItemLocation {
+  /** Human-readable label for the domain (e.g. "Clients"). */
+  domainLabel: string
+  /** Graph node id for this item (e.g. `client:<uuid>`). */
+  graphNodeId: string
+  /** Parent graph node ids reachable via `contains` edges (e.g. `['organization-model']`). */
+  containsParentIds: string[]
+}
+
+/**
+ * A single governing knowledge node reference returned by domain-item describe.
+ */
+export interface OmDescribeDomainItemKnowledgeRef {
+  id: string
+  title: string
+  knowledgeKind: string
+}
+
+/**
+ * Structured neighborhood view of a domain-item node.
+ *
+ * Returned by `omDescribe` for `item:<domain>:<id>` and bare-id forms
+ * (e.g. `client:<uuid>`). Carries the full domain record payload, graph
+ * location, and any governing knowledge nodes.
+ */
+export interface OmDescribeDomainItem {
+  kind: 'domain-item'
+  /** The `item:<domain>:<id>` canonical reference string. */
+  id: string
+  /** The domain collection this item belongs to (e.g. `'clients'`). */
+  domain: DomainItemKind
+  /** Human-readable name or label for this item. */
+  name: string
+  /** Graph node location: graph id, domain label, and parentage. */
+  location: OmDescribeDomainItemLocation
+  /**
+   * Full domain record payload. Shape varies by domain:
+   * - `clients`: full `ClientProfile` (identity, branding, links, prompts, config, etc.)
+   * - `roles`: id, title, responsibilities, responsibleFor, reportsToId
+   * - `policies`: id, label, description, trigger, appliesTo, actions
+   * - `customers`: id, name, description, jobsToBeDone, pains, gains, firmographics
+   * - `offerings`: id, name, description, pricingModel, price, targetSegmentIds
+   * - `goals`: id, description, periodStart, periodEnd, keyResults
+   */
+  record: Record<string, unknown>
+  /** Knowledge nodes that govern this domain item via `governs` edges. */
+  governingKnowledge: OmDescribeDomainItemKnowledgeRef[]
+}
+
 /**
  * Structured neighborhood view of a single OM node.
  *
@@ -778,6 +885,7 @@ export type OmDescribeResult =
   | OmDescribeOntology
   | OmDescribeRole
   | OmDescribePolicy
+  | OmDescribeDomainItem
 
 export interface OmDescribeSystem {
   kind: 'system'
@@ -868,18 +976,40 @@ export interface OmDescribePolicy {
  * Detection rules (highest priority first):
  * - Contains `:<ontology-kind>/<local-id>` → ontology
  * - Starts with `knowledge.` → knowledge
- * - Starts with `role.` → role
- * - Starts with `policy.` → policy
+ * - Starts with `role.` (dotted) → role (OM role, NOT domain-item bare form)
+ * - Starts with `policy.` (dotted) → policy (OM policy, NOT domain-item bare form)
+ * - Starts with `item:<domain>:` → domain-item (canonical form)
+ * - Starts with a bare domain prefix followed by `:` → domain-item (back-compat)
  * - Resolves via `getSystem()` → system
  * - Matches a key in `model.resources` → resource
  */
-function detectKind(model: OrganizationModel, id: string): OmSearchHitKind | undefined {
+function detectKind(model: OrganizationModel, id: string): OmSearchHitKind | 'domain-item' | undefined {
   if (/:(object|action|event|catalog|link|interface|value-type|property|group|endpoint)\//.test(id)) {
     return 'ontology'
   }
   if (id.startsWith('knowledge.')) return 'knowledge'
+  // Dotted role/policy forms (e.g. role.ops-lead, policy.approve-large-deals) — OM search kinds.
+  // These must be checked BEFORE the bare colon forms so 'role.' does not collide with 'role:'.
   if (id.startsWith('role.')) return 'role'
   if (id.startsWith('policy.')) return 'policy'
+  // Canonical domain-item form: item:<domain>:<id>
+  if (id.startsWith('item:')) {
+    const afterItem = id.slice('item:'.length)
+    const colonIdx = afterItem.indexOf(':')
+    if (colonIdx > 0) {
+      const domain = afterItem.slice(0, colonIdx)
+      if ((DOMAIN_ITEM_KINDS as readonly string[]).includes(domain)) return 'domain-item'
+    }
+    return undefined
+  }
+  // Bare domain-item prefix forms: client:<id>, role:<id>, policy:<id>,
+  // customer:<id>, offering:<id>, goal:<id>.
+  // These use a colon separator (NOT a dot), so 'role:' is distinct from 'role.'.
+  const firstColon = id.indexOf(':')
+  if (firstColon > 0) {
+    const prefix = id.slice(0, firstColon)
+    if (prefix in BARE_PREFIX_TO_DOMAIN) return 'domain-item'
+  }
   if (model.systems && getSystemByPath(model.systems, id)) return 'system'
   if (model.resources?.[id]) return 'resource'
   return undefined
@@ -929,6 +1059,8 @@ export function omDescribe(model: OrganizationModel, id: string): OmDescribeResu
       return describeRole(model, id)
     case 'policy':
       return describePolicy(model, id)
+    case 'domain-item':
+      return describeDomainItem(model, id)
   }
 }
 
@@ -1129,3 +1261,127 @@ function describePolicy(model: OrganizationModel, id: string): OmDescribePolicy
     effectKinds: (policy.actions ?? []).map((a) => a.kind)
   }
 }
+
+// ---------------------------------------------------------------------------
+// Domain-item describe helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Human-readable labels for each domain kind.
+ */
+const DOMAIN_LABEL: Record<DomainItemKind, string> = {
+  clients: 'Clients',
+  roles: 'Roles',
+  policies: 'Policies',
+  customers: 'Customers',
+  offerings: 'Offerings',
+  goals: 'Goals'
+}
+
+/**
+ * Graph node id prefix for each domain kind. Mirrors the convention used by
+ * `buildOrganizationGraph` in `organization-model/graph/build.ts`:
+ *   client:<id>, role:<id>, policy:<id>, customer-segment:<id>, offering:<id>, goal:<id>
+ */
+const DOMAIN_GRAPH_PREFIX: Record<DomainItemKind, string> = {
+  clients: 'client',
+  roles: 'role',
+  policies: 'policy',
+  customers: 'customer-segment',
+  offerings: 'offering',
+  goals: 'goal'
+}
+
+/**
+ * Parse a domain-item ref (canonical `item:<domain>:<id>` or bare `<prefix>:<id>`)
+ * into `{ domain, itemId }`. Returns `undefined` when the ref cannot be parsed.
+ */
+function parseDomainItemRef(id: string): { domain: DomainItemKind; itemId: string } | undefined {
+  // Canonical: item:<domain>:<id>
+  if (id.startsWith('item:')) {
+    const afterItem = id.slice('item:'.length)
+    const colonIdx = afterItem.indexOf(':')
+    if (colonIdx <= 0) return undefined
+    const domain = afterItem.slice(0, colonIdx) as DomainItemKind
+    const itemId = afterItem.slice(colonIdx + 1)
+    if (!(DOMAIN_ITEM_KINDS as readonly string[]).includes(domain) || !itemId) return undefined
+    return { domain, itemId }
+  }
+  // Bare prefix: client:<id>, role:<id>, etc.
+  const firstColon = id.indexOf(':')
+  if (firstColon <= 0) return undefined
+  const prefix = id.slice(0, firstColon)
+  const domain = BARE_PREFIX_TO_DOMAIN[prefix]
+  if (!domain) return undefined
+  const itemId = id.slice(firstColon + 1)
+  if (!itemId) return undefined
+  return { domain, itemId }
+}
+
+/**
+ * Build a structured neighborhood view of a domain-item node.
+ *
+ * Accepts canonical `item:<domain>:<id>` or bare back-compat forms
+ * (`client:<uuid>`, `role:<id>`, etc.).
+ */
+function describeDomainItem(model: OrganizationModel, id: string): OmDescribeDomainItem | undefined {
+  const parsed = parseDomainItemRef(id)
+  if (!parsed) return undefined
+
+  const { domain, itemId } = parsed
+
+  // Look up the record in the appropriate domain collection.
+  const collection = model[domain] as Record<string, Record<string, unknown>> | undefined
+  const record = collection?.[itemId]
+  if (!record) return undefined
+
+  // Derive the item's name. Each domain uses a different field for the display name.
+  const name =
+    domain === 'clients'
+      ? String((record['name'] as string | undefined) ?? itemId)
+      : domain === 'roles'
+        ? String((record['title'] as string | undefined) ?? itemId)
+        : domain === 'policies'
+          ? String((record['label'] as string | undefined) ?? itemId)
+          : domain === 'goals'
+            ? String((record['description'] as string | undefined) ?? itemId)
+            : String((record['name'] as string | undefined) ?? itemId)
+
+  // Graph node id follows the build.ts convention.
+  const graphNodeId = `${DOMAIN_GRAPH_PREFIX[domain]}:${itemId}`
+
+  // Contains parentage — all domain items have a single `contains` edge from
+  // `organization-model`. We derive this from the known convention without
+  // building the full graph (avoids heavy dependency).
+  const containsParentIds = ['organization-model']
+
+  // Governing knowledge: knowledge nodes whose links target this item's graph node.
+  const governingKnowledge: OmDescribeDomainItemKnowledgeRef[] = []
+  for (const node of Object.values(model.knowledge ?? {})) {
+    const governs = (node.links ?? []).some((link) => link.nodeId === graphNodeId)
+    if (governs) {
+      governingKnowledge.push({
+        id: node.id,
+        title: node.title,
+        knowledgeKind: node.kind
+      })
+    }
+  }
+
+  // Canonical id is always the `item:<domain>:<id>` form.
+  const canonicalId = `item:${domain}:${itemId}`
+
+  return {
+    kind: 'domain-item',
+    id: canonicalId,
+    domain,
+    name,
+    location: {
+      domainLabel: DOMAIN_LABEL[domain],
+      graphNodeId,
+      containsParentIds
+    },
+    record: record as Record<string, unknown>,
+    governingKnowledge
+  }
+}

package/src/operations/index.ts

@@ -22,17 +22,19 @@ export type {
 
 // Session validation schemas
 export {
-  CreateSessionSchema,
-  ExecuteTurnSchema,
-  ListSessionsQuerySchema,
-  SessionIdParamSchema,
-  ExecutionIdParamsSchema,
-  WebSocketSessionTurnSchema,
-  type CreateSessionInput,
-  type ExecuteTurnInput,
-  type ListSessionsQuery,
-  type WebSocketSessionTurnMessage
-} from './sessions'
+  CreateSessionSchema,
+  ExecuteTurnSchema,
+  ListSessionsQuerySchema,
+  SessionMessagesQuerySchema,
+  SessionIdParamSchema,
+  ExecutionIdParamsSchema,
+  WebSocketSessionTurnSchema,
+  type CreateSessionInput,
+  type ExecuteTurnInput,
+  type ListSessionsQuery,
+  type SessionMessagesQuery,
+  type WebSocketSessionTurnMessage
+} from './sessions'
 
 // Notification types and validation schemas
 export * from './notifications/index'
@@ -46,5 +48,8 @@ export * from './activities/index'
 // Triggers (includes webhook providers and trigger definitions)
 export * from './triggers/index'
 
-// Debug Logs
-export * from './debug-logs/index'
+// Debug Logs
+export * from './debug-logs/index'
+
+// Public agent chat route schemas
+export * from './public-agent-chat'

package/src/operations/public-agent-chat/api-schemas.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod'
+import { UuidSchema } from '../../platform/utils/validation'
+
+export const PublicAgentChatSlugParamSchema = z
+  .object({
+    slug: z.string().min(1).max(120).regex(/^[a-zA-Z0-9._-]+$/)
+  })
+  .strict()
+
+export const PublicAgentChatSessionParamSchema = z
+  .object({
+    sessionId: UuidSchema
+  })
+  .strict()
+
+export const PublicAgentChatAuthorizeSchema = z
+  .object({
+    code: z.string().min(1).max(200).optional(),
+    visitorId: z.string().min(1).max(120).optional()
+  })
+  .strict()
+
+export const PublicAgentChatCreateSessionSchema = z
+  .object({
+    capabilityToken: z.string().min(32).optional(),
+    metadata: z.record(z.string(), z.unknown()).optional()
+  })
+  .strict()
+
+export const PublicAgentChatCapabilityQuerySchema = z
+  .object({
+    token: z.string().min(32)
+  })
+  .strict()
+
+export type PublicAgentChatSlugParams = z.infer<typeof PublicAgentChatSlugParamSchema>
+export type PublicAgentChatSessionParams = z.infer<typeof PublicAgentChatSessionParamSchema>
+export type PublicAgentChatAuthorizeInput = z.infer<typeof PublicAgentChatAuthorizeSchema>
+export type PublicAgentChatCreateSessionInput = z.infer<typeof PublicAgentChatCreateSessionSchema>
+export type PublicAgentChatCapabilityQuery = z.infer<typeof PublicAgentChatCapabilityQuerySchema>

package/src/operations/public-agent-chat/index.ts

@@ -0,0 +1,12 @@
+export {
+  PublicAgentChatSlugParamSchema,
+  PublicAgentChatSessionParamSchema,
+  PublicAgentChatAuthorizeSchema,
+  PublicAgentChatCreateSessionSchema,
+  PublicAgentChatCapabilityQuerySchema,
+  type PublicAgentChatSlugParams,
+  type PublicAgentChatSessionParams,
+  type PublicAgentChatAuthorizeInput,
+  type PublicAgentChatCreateSessionInput,
+  type PublicAgentChatCapabilityQuery
+} from './api-schemas'

package/src/operations/sessions/api-schemas.ts

@@ -113,13 +113,32 @@ export const ExecuteTurnSchema = z
  * - resourceId validated as string (resource identifiers)
  * - Limit bounded (prevents DoS via large result sets)
  */
-export const ListSessionsQuerySchema = z
-  .object({
-    userId: UuidSchema.optional(),
-    resourceId: z.string().optional(),
-    limit: z.coerce.number().int().min(1).max(100).default(20)
-  })
-  .strict()
+export const ListSessionsQuerySchema = z
+  .object({
+    userId: UuidSchema.optional(),
+    resourceId: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(20)
+  })
+  .strict()
+
+/**
+ * Get session messages with cursor pagination
+ * GET /sessions/:sessionId/messages
+ *
+ * Cursor:
+ * - cursor is the last seen message_index
+ * - next page returns rows where message_index > cursor
+ *
+ * Security:
+ * - Limit bounded to prevent unbounded transcript reads
+ * - Cursor coerced and validated as a non-negative integer
+ */
+export const SessionMessagesQuerySchema = z
+  .object({
+    limit: z.coerce.number().int().min(1).max(100).default(100),
+    cursor: z.coerce.number().int().min(0).optional()
+  })
+  .strict()
 
 // ============================================================================
 // WebSocket Messages
@@ -160,7 +179,8 @@ export const WebSocketSessionTurnSchema = z
 // ============================================================================
 
 // Export inferred types for use in route handlers
-export type CreateSessionInput = z.infer<typeof CreateSessionSchema>
-export type ExecuteTurnInput = z.infer<typeof ExecuteTurnSchema>
-export type ListSessionsQuery = z.infer<typeof ListSessionsQuerySchema>
-export type WebSocketSessionTurnMessage = z.infer<typeof WebSocketSessionTurnSchema>
+export type CreateSessionInput = z.infer<typeof CreateSessionSchema>
+export type ExecuteTurnInput = z.infer<typeof ExecuteTurnSchema>
+export type ListSessionsQuery = z.infer<typeof ListSessionsQuerySchema>
+export type SessionMessagesQuery = z.infer<typeof SessionMessagesQuerySchema>
+export type WebSocketSessionTurnMessage = z.infer<typeof WebSocketSessionTurnSchema>

package/src/operations/sessions/index.ts

@@ -12,15 +12,17 @@ export type {
 
 // Export validation schemas
 export {
-  CreateSessionSchema,
-  ExecuteTurnSchema,
-  ListSessionsQuerySchema,
-  SessionIdParamSchema,
-  ExecutionIdParamsSchema,
-  WebSocketSessionTurnSchema,
-  UuidSchema,
-  type CreateSessionInput,
-  type ExecuteTurnInput,
-  type ListSessionsQuery,
-  type WebSocketSessionTurnMessage
-} from './api-schemas'
+  CreateSessionSchema,
+  ExecuteTurnSchema,
+  ListSessionsQuerySchema,
+  SessionMessagesQuerySchema,
+  SessionIdParamSchema,
+  ExecutionIdParamsSchema,
+  WebSocketSessionTurnSchema,
+  UuidSchema,
+  type CreateSessionInput,
+  type ExecuteTurnInput,
+  type ListSessionsQuery,
+  type SessionMessagesQuery,
+  type WebSocketSessionTurnMessage
+} from './api-schemas'

package/src/platform/constants/versions.ts

@@ -1,3 +1,3 @@
 export const VERSION = {
-  CURRENT: '1.12.19'
+  CURRENT: '1.13.4'
 }

package/src/supabase/database.types.ts

@@ -2118,6 +2118,138 @@ export type Database = {
         }
         Relationships: []
       }
+      agent_access_grants: {
+        Row: {
+          allowed_origins: string[]
+          branding: Json
+          capture_fields: Json
+          code_hash: string | null
+          code_salt: string | null
+          created_at: string
+          disabled_at: string | null
+          expires_at: string | null
+          id: string
+          max_sessions_per_visitor: number
+          max_turns_per_session: number
+          mode: string
+          organization_id: string
+          resource_id: string
+          slug: string
+          tool_policy: Json
+          updated_at: string
+        }
+        Insert: {
+          allowed_origins?: string[]
+          branding?: Json
+          capture_fields?: Json
+          code_hash?: string | null
+          code_salt?: string | null
+          created_at?: string
+          disabled_at?: string | null
+          expires_at?: string | null
+          id?: string
+          max_sessions_per_visitor?: number
+          max_turns_per_session?: number
+          mode?: string
+          organization_id: string
+          resource_id: string
+          slug: string
+          tool_policy?: Json
+          updated_at?: string
+        }
+        Update: {
+          allowed_origins?: string[]
+          branding?: Json
+          capture_fields?: Json
+          code_hash?: string | null
+          code_salt?: string | null
+          created_at?: string
+          disabled_at?: string | null
+          expires_at?: string | null
+          id?: string
+          max_sessions_per_visitor?: number
+          max_turns_per_session?: number
+          mode?: string
+          organization_id?: string
+          resource_id?: string
+          slug?: string
+          tool_policy?: Json
+          updated_at?: string
+        }
+        Relationships: [
+          {
+            foreignKeyName: "agent_access_grants_organization_id_fkey"
+            columns: ["organization_id"]
+            isOneToOne: false
+            referencedRelation: "organizations"
+            referencedColumns: ["id"]
+          },
+        ]
+      }
+      agent_chat_capabilities: {
+        Row: {
+          created_at: string
+          expires_at: string
+          grant_id: string
+          id: string
+          organization_id: string
+          origin: string | null
+          resource_id: string
+          revoked_at: string | null
+          session_id: string | null
+          token_hash: string
+          visitor_id: string | null
+        }
+        Insert: {
+          created_at?: string
+          expires_at: string
+          grant_id: string
+          id?: string
+          organization_id: string
+          origin?: string | null
+          resource_id: string
+          revoked_at?: string | null
+          session_id?: string | null
+          token_hash: string
+          visitor_id?: string | null
+        }
+        Update: {
+          created_at?: string
+          expires_at?: string
+          grant_id?: string
+          id?: string
+          organization_id?: string
+          origin?: string | null
+          resource_id?: string
+          revoked_at?: string | null
+          session_id?: string | null
+          token_hash?: string
+          visitor_id?: string | null
+        }
+        Relationships: [
+          {
+            foreignKeyName: "agent_chat_capabilities_grant_id_fkey"
+            columns: ["grant_id"]
+            isOneToOne: false
+            referencedRelation: "agent_access_grants"
+            referencedColumns: ["id"]
+          },
+          {
+            foreignKeyName: "agent_chat_capabilities_organization_id_fkey"
+            columns: ["organization_id"]
+            isOneToOne: false
+            referencedRelation: "organizations"
+            referencedColumns: ["id"]
+          },
+          {
+            foreignKeyName: "agent_chat_capabilities_session_id_fkey"
+            columns: ["session_id"]
+            isOneToOne: false
+            referencedRelation: "sessions"
+            referencedColumns: ["session_id"]
+          },
+        ]
+      }
       organizations: {
         Row: {
           config: Json