@intx/db 0.2.2 → 0.3.0

package/dist/schema/approvals.d.ts

@@ -0,0 +1,245 @@
+export declare const approval: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "approval";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        anchorRunId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "anchor_run_id";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        runId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "run_id";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        agentAddress: import("drizzle-orm/pg-core").PgColumn<{
+            name: "agent_address";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        correlationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "correlation_id";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        toolDefinition: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tool_definition";
+            tableName: "approval";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        toolArguments: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tool_arguments";
+            tableName: "approval";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: "always" | "once";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["once", "always"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "approval";
+            dataType: "string";
+            columnType: "PgText";
+            data: "pending" | "approved" | "rejected" | "timeout" | "expired";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["pending", "approved", "rejected", "timeout", "expired"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timeoutAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timeout_at";
+            tableName: "approval";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resolvedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resolved_at";
+            tableName: "approval";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "approval";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "approval";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/schema/approvals.js

@@ -0,0 +1,52 @@
+import { index, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { tenant } from "./tenants.js";
+import { workflowRun } from "./workflow-run.js";
+// Every approval originates from a workflow deployment, so the origin is
+// modeled as the deployment's anchor run -- the workflow_run whose id equals
+// the deployment id -- rather than a launched single agent. A workflow
+// deployment has no `agent_instance` or `agent` row, and the principal its run
+// executes under is a substrate principal, not a `principal`-table row -- so
+// none of those tables can hold a valid referent for an approval's origin.
+export const approval = pgTable("approval", {
+    id: text("id").primaryKey(),
+    tenantId: text("tenant_id")
+        .notNull()
+        .references(() => tenant.id, { onDelete: "cascade" }),
+    anchorRunId: text("anchor_run_id")
+        .notNull()
+        .references(() => workflowRun.id, { onDelete: "cascade" }),
+    // References the run this approval belongs to, making "this approval is for
+    // a real run of this deployment" a database invariant. Cascades on the
+    // run's delete; the `anchor_run_id` FK above stays as the lock and cascade
+    // anchor the co-write orders against.
+    runId: text("run_id")
+        .notNull()
+        .references(() => workflowRun.id, { onDelete: "cascade" }),
+    agentAddress: text("agent_address").notNull(),
+    correlationId: text("correlation_id").notNull().unique(),
+    // Always populated: the ask rail is the sole co-writer and the register
+    // frame's required snapshot guarantees both fields at insert time.
+    toolDefinition: jsonb("tool_definition").notNull(),
+    toolArguments: jsonb("tool_arguments").notNull(),
+    scope: text("scope", { enum: ["once", "always"] }),
+    status: text("status", {
+        enum: ["pending", "approved", "rejected", "timeout", "expired"],
+    })
+        .notNull()
+        .default("pending"),
+    // Nullable so an approval that holds indefinitely can be recorded with no
+    // deadline. An agent-step suspend parks on its correlation's signal with no
+    // timeout (`parkOnSignal` is called without a `timeout`), so no `timeoutAt`
+    // reaches the sidecar frame that co-writes this row -- the deadline lives in
+    // the reactor's gate, which the hold-indefinitely suspend path never sets.
+    // A null `timeoutAt` is the hold-indefinitely case; a resolver that adds
+    // per-workflow expiry populates it when a deadline is configured. Parallels
+    // the tool-snapshot columns above, which are likewise deferred.
+    timeoutAt: timestamp("timeout_at"),
+    resolvedAt: timestamp("resolved_at"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (t) => [
+    index("approval_tenant_status_idx").on(t.tenantId, t.status, t.createdAt),
+    index("approval_anchor_run_idx").on(t.anchorRunId),
+]);

package/dist/schema/catalog.d.ts

@@ -493,6 +493,23 @@ export declare const modelOffering: import("drizzle-orm/pg-core").PgTableWithCol
             }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
             size: undefined;
         }>;
+        quirks: import("drizzle-orm/pg-core").PgColumn<{
+            name: "quirks";
+            tableName: "model_offering";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         disabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "disabled";
             tableName: "model_offering";

package/dist/schema/catalog.js

@@ -1,5 +1,5 @@
 import { sql } from "drizzle-orm";
-import { boolean, check, integer, pgTable, text, timestamp, unique, } from "drizzle-orm/pg-core";
+import { boolean, check, integer, jsonb, pgTable, text, timestamp, unique, } from "drizzle-orm/pg-core";
 import { credential } from "./credentials.js";
 import { tenant } from "./tenants.js";
 import { wallet } from "./wallets.js";
@@ -63,6 +63,12 @@ export const modelOffering = pgTable("model_offering", {
     // Curated-capability tags. This issue creates the column; the values are
     // populated by the discovery-support-matrix seeding work.
     capabilities: text("capabilities").array().notNull().default([]),
+    // Opaque per-deployment bag of provider-specific adapter accommodations
+    // (e.g. OpenAI's forceAssistantReasoningContent). Interpreted and
+    // validated only at the adapter factory, which alone knows the provider
+    // shape. NULL means the factory receives no bag and applies its default
+    // behavior.
+    quirks: jsonb("quirks"),
     // Own-row disable. Inherited-row suppression is resolved separately.
     disabled: boolean("disabled").notNull().default(false),
     createdAt: timestamp("created_at").notNull().defaultNow(),

package/dist/schema/credentials.d.ts

@@ -237,7 +237,7 @@ export declare const credential: import("drizzle-orm/pg-core").PgTableWithColumn
             tableName: "credential";
             dataType: "string";
             columnType: "PgText";
-            data: "active" | "expired" | "revoked" | "error";
+            data: "active" | "error" | "expired" | "revoked";
             driverParam: string;
             notNull: true;
             hasDefault: true;

package/dist/schema/git-tokens.js

@@ -24,7 +24,7 @@ import { tenant } from "./tenants.js";
 // (`receivePack`, `createPack`, `resolveRef`, ...). The mint API
 // translates user-facing aliases to canonical names before insert.
 // `resource` is the single substrate authz resource string
-// (e.g. `agent-state:ins_xxx`, `asset:def_yyy`) that the token grants
+// (e.g. `agent-state:run_xxx`, `asset:def_yyy`) that the token grants
 // access to. `refPattern` is a glob restricting which refs within the
 // resource the token may read or write.
 //

package/dist/schema/grants.js

@@ -1,4 +1,5 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { check, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
 import { principal } from "./principals.js";
 import { role } from "./roles.js";
 import { tenant } from "./tenants.js";
@@ -21,4 +22,9 @@ export const grant = pgTable("grant", {
     expiresAt: timestamp("expires_at"),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
+}, (t) => [
+    // Exactly one target: a grant hangs off a role OR a principal, never both
+    // and never neither. Documented in AUTH.md; enforced in the DB so a
+    // malformed row is rejected at write rather than silently mis-targeted.
+    check("grant_target_exactly_one", sql `num_nonnulls(${t.principalId}, ${t.roleId}) = 1`),
+]);

package/dist/schema/index.d.ts

@@ -3,19 +3,23 @@ export * from "./tenants.js";
 export * from "./principals.js";
 export * from "./roles.js";
 export * from "./grants.js";
-export * from "./agents.js";
+export * from "./approvals.js";
+export * from "./signal-correlations.js";
 export * from "./providers.js";
 export * from "./oauth-clients.js";
 export * from "./credentials.js";
 export * from "./assets.js";
-export * from "./agent-assets.js";
 export * from "./wallets.js";
 export * from "./offerings.js";
 export * from "./catalog.js";
 export * from "./sidecar.js";
+export * from "./sidecar-allocation.js";
 export * from "./sessions.js";
-export * from "./instances.js";
 export * from "./session-assets.js";
 export * from "./messages.js";
 export * from "./git-tokens.js";
-export * from "./workflow-deployments.js";
+export * from "./workflow-definitions.js";
+export * from "./workflow-run.js";
+export * from "./workflow-run-dispatch.js";
+export * from "./workflow-run-launch-spec.js";
+export * from "./workflow-run-execution.js";

package/dist/schema/index.js

@@ -3,19 +3,23 @@ export * from "./tenants.js";
 export * from "./principals.js";
 export * from "./roles.js";
 export * from "./grants.js";
-export * from "./agents.js";
+export * from "./approvals.js";
+export * from "./signal-correlations.js";
 export * from "./providers.js";
 export * from "./oauth-clients.js";
 export * from "./credentials.js";
 export * from "./assets.js";
-export * from "./agent-assets.js";
 export * from "./wallets.js";
 export * from "./offerings.js";
 export * from "./catalog.js";
 export * from "./sidecar.js";
+export * from "./sidecar-allocation.js";
 export * from "./sessions.js";
-export * from "./instances.js";
 export * from "./session-assets.js";
 export * from "./messages.js";
 export * from "./git-tokens.js";
-export * from "./workflow-deployments.js";
+export * from "./workflow-definitions.js";
+export * from "./workflow-run.js";
+export * from "./workflow-run-dispatch.js";
+export * from "./workflow-run-launch-spec.js";
+export * from "./workflow-run-execution.js";

package/dist/schema/messages.d.ts

@@ -36,7 +36,7 @@ export declare const inferenceTurn: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        instanceId: import("drizzle-orm/pg-core").PgColumn<{
+        runId: import("drizzle-orm/pg-core").PgColumn<{
             name: "instance_id";
             tableName: "inference_turn";
             dataType: "string";
@@ -92,7 +92,7 @@ export declare const inferenceTurn: import("drizzle-orm/pg-core").PgTableWithCol
             tableName: "inference_turn";
             dataType: "string";
             columnType: "PgText";
-            data: "failed" | "completed" | "running";
+            data: "failed" | "running" | "completed";
             driverParam: string;
             notNull: true;
             hasDefault: true;
@@ -201,14 +201,14 @@ export declare const turnPart: import("drizzle-orm/pg-core").PgTableWithColumns<
             tableName: "turn_part";
             dataType: "string";
             columnType: "PgText";
-            data: "error" | "text" | "reasoning" | "tool" | "file" | "refusal" | "step-start" | "step-finish" | "snapshot" | "patch";
+            data: "error" | "tool" | "text" | "file" | "refusal" | "safety_rating" | "reasoning" | "step-start" | "step-finish" | "snapshot" | "patch";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["text", "reasoning", "tool", "file", "error", "refusal", "step-start", "step-finish", "snapshot", "patch"];
+            enumValues: ["text", "reasoning", "tool", "file", "error", "refusal", "safety_rating", "step-start", "step-finish", "snapshot", "patch"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -305,7 +305,7 @@ export declare const sessionMail: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        instanceId: import("drizzle-orm/pg-core").PgColumn<{
+        runId: import("drizzle-orm/pg-core").PgColumn<{
             name: "instance_id";
             tableName: "session_mail";
             dataType: "string";

package/dist/schema/messages.js

@@ -1,6 +1,5 @@
 import { index, integer, jsonb, pgTable, text, timestamp, } from "drizzle-orm/pg-core";
 import { bytea } from "./column-types.js";
-import { agentInstance } from "./instances.js";
 import { agentSession } from "./sessions.js";
 import { tenant } from "./tenants.js";
 export const inferenceTurn = pgTable("inference_turn", {
@@ -8,9 +7,13 @@ export const inferenceTurn = pgTable("inference_turn", {
     sessionId: text("session_id")
         .notNull()
         .references(() => agentSession.id, { onDelete: "cascade" }),
-    instanceId: text("instance_id")
-        .notNull()
-        .references(() => agentInstance.id, { onDelete: "cascade" }),
+    // The endpoint that produced this turn: a workflow_run id (older rows may
+    // carry an abandoned agent_instance id from before the fold, since the two
+    // shared one id space). This is a polymorphic reference that carries no
+    // foreign key; the collector-creation layer owns the invariant that the id
+    // names a live endpoint. It stays NOT NULL -- a turn always names its
+    // producer.
+    runId: text("instance_id").notNull(),
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),
@@ -21,7 +24,7 @@ export const inferenceTurn = pgTable("inference_turn", {
     startedAt: timestamp("started_at").notNull(),
     endedAt: timestamp("ended_at"),
 }, (t) => [
-    index("inference_turn_instance_id_started_at_idx").on(t.instanceId, t.startedAt),
+    index("inference_turn_instance_id_started_at_idx").on(t.runId, t.startedAt),
 ]);
 export const turnPart = pgTable("turn_part", {
     id: text("id").primaryKey(),
@@ -39,6 +42,7 @@ export const turnPart = pgTable("turn_part", {
             "file",
             "error",
             "refusal",
+            "safety_rating",
             "step-start",
             "step-finish",
             "snapshot",
@@ -54,9 +58,12 @@ export const sessionMail = pgTable("session_mail", {
     sessionId: text("session_id")
         .notNull()
         .references(() => agentSession.id, { onDelete: "cascade" }),
-    instanceId: text("instance_id").references(() => agentInstance.id, {
-        onDelete: "set null",
-    }),
+    // The endpoint whose mail this is: null for a folded run (which keys its
+    // mail on the session instead), or -- on older rows from before the fold --
+    // an abandoned agent_instance id. A polymorphic reference that carries no
+    // foreign key (mirroring inference_turn.runId); the mail-write layer
+    // owns the invariant. Nullable -- absent for folded runs.
+    runId: text("instance_id"),
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),
@@ -67,5 +74,9 @@ export const sessionMail = pgTable("session_mail", {
     raw: bytea("raw").notNull(),
     createdAt: timestamp("created_at").notNull().defaultNow(),
 }, (t) => [
-    index("session_mail_instance_id_created_at_idx").on(t.instanceId, t.createdAt),
+    index("session_mail_instance_id_created_at_idx").on(t.runId, t.createdAt),
+    // A folded run's mail carries a null runId, so its history and prior-
+    // mail queries key on the session instead. This index supports that scan
+    // the way the runId index supports a legacy instance's.
+    index("session_mail_session_id_created_at_idx").on(t.sessionId, t.createdAt),
 ]);

package/dist/schema/offerings.js

@@ -1,11 +1,17 @@
 import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { agent } from "./agents.js";
 import { tenant } from "./tenants.js";
+import { workflowDefinition } from "./workflow-definitions.js";
 export const offering = pgTable("offering", {
     id: text("id").primaryKey(),
+    // The workflow definition this offering prices. The column keeps its
+    // `agent_id` name for contract stability -- the offering API exposes
+    // `agentId`/`agentName` -- but it now holds a workflow_definition id (a folded
+    // agent's definition). `restrict`, not cascade: an offering is a commercial
+    // pricing record, so deleting its definition must consciously deal with the
+    // offering rather than silently vaporize it.
     agentId: text("agent_id")
         .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
+        .references(() => workflowDefinition.id, { onDelete: "restrict" }),
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),

package/dist/schema/principals.d.ts

@@ -42,14 +42,14 @@ export declare const principal: import("drizzle-orm/pg-core").PgTableWithColumns
             tableName: "principal";
             dataType: "string";
             columnType: "PgText";
-            data: "user" | "agent";
+            data: "user" | "agent" | "workflow";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "agent"];
+            enumValues: ["user", "agent", "workflow"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/schema/principals.js

@@ -6,7 +6,7 @@ export const principal = pgTable("principal", {
     tenantId: text("tenant_id")
         .notNull()
         .references(() => tenant.id, { onDelete: "cascade" }),
-    kind: text("kind", { enum: ["user", "agent"] }).notNull(),
+    kind: text("kind", { enum: ["user", "agent", "workflow"] }).notNull(),
     refId: text("ref_id").notNull(),
     status: text("status", {
         enum: ["active", "suspended", "invited", "deactivated"],
@@ -14,8 +14,10 @@ export const principal = pgTable("principal", {
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
 }, (t) => [unique().on(t.tenantId, t.kind, t.refId)]);
-// The refId on a user principal points to the auth user table.
-// We don't add a FK constraint because refId also points to agent.id
-// when kind='agent', and Postgres can't do conditional FKs.
-// The application layer enforces referential integrity.
+// refId is polymorphic on kind: the auth user for kind='user', and either a
+// workflow_run or a workflow_definition for kind='workflow'. A `kind='agent'`
+// principal is a legacy survivor of the fold -- its refId named an
+// `agent_instance` row, a table now dropped, so it dangles and is inert.
+// Postgres can't express a conditional FK across those targets, so there is no
+// FK constraint here and the application layer enforces referential integrity.
 export { user };

package/dist/schema/providers.d.ts

@@ -70,6 +70,23 @@ export declare const provider: import("drizzle-orm/pg-core").PgTableWithColumns<
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        apiBaseUrl: import("drizzle-orm/pg-core").PgColumn<{
+            name: "api_base_url";
+            tableName: "provider";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         authorizationUrl: import("drizzle-orm/pg-core").PgColumn<{
             name: "authorization_url";
             tableName: "provider";

package/dist/schema/providers.js

@@ -7,6 +7,11 @@ export const provider = pgTable("provider", {
         .references(() => tenant.id, { onDelete: "cascade" }),
     name: text("name").notNull(),
     plugin: text("plugin").notNull(),
+    // The API origin a credential from this provider authenticates to (e.g.
+    // https://api.github.com). Optional: OAuth-login-only providers have no
+    // API-call origin. A provider that backs an origin-pinned credential must
+    // have one, enforced loudly at credential-shape time, not by the schema.
+    apiBaseUrl: text("api_base_url"),
     authorizationUrl: text("authorization_url"),
     tokenUrl: text("token_url"),
     userInfoUrl: text("user_info_url"),