@marinoscar/kvox-eval 0.0.0-bootstrap → 0.1.0-next.0

package/host/prisma/schema/platform.settings.prisma

@@ -0,0 +1,53 @@
+// GENERATED by platform db compose — do not edit
+// source: package:settings.prisma
+
+// =============================================================================
+// Settings
+// =============================================================================
+
+model SystemSettings {
+  id              String   @id @default(uuid()) @db.Uuid
+  key             String   @unique
+  value           Json
+  version         Int      @default(1)
+  updatedByUserId String?  @map("updated_by_user_id") @db.Uuid
+  updatedAt       DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  updatedByUser User? @relation("SettingsUpdater", fields: [updatedByUserId], references: [id], onDelete: SetNull)
+
+  @@map("system_settings")
+}
+
+model UserSettings {
+  id        String   @id @default(uuid()) @db.Uuid
+  userId    String   @unique @map("user_id") @db.Uuid
+  value     Json
+  version   Int      @default(1)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@map("user_settings")
+}
+
+// One organization's overrides of the org-overridable system settings
+// namespaces (#733): `{ "<namespace>": { "<field>": value } }`, only the fields
+// each namespace's `org.schema` allows. An org table: FORCEd row-level security
+// on org_id (`org_settings_org_isolation`, migration 0028_add_org_settings),
+// reached only through `runInOrg`. Its own `version` for If-Match.
+model OrgSettings {
+  id              String   @id @default(uuid()) @db.Uuid
+  orgId           String   @unique @map("org_id") @db.Uuid
+  value           Json     @db.JsonB
+  version         Int      @default(1)
+  updatedByUserId String?  @map("updated_by_user_id") @db.Uuid
+  updatedAt       DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  org           Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  updatedByUser User?        @relation("OrgSettingsUpdater", fields: [updatedByUserId], references: [id], onDelete: SetNull)
+
+  @@map("org_settings")
+}

package/host/prisma/schema/platform.sharing.prisma

@@ -0,0 +1,208 @@
+// GENERATED by platform db compose — do not edit
+// source: package:sharing.prisma
+
+// =============================================================================
+// Sharing: groups (PP-7.1, issue #728) and grants (PP-7.2, issue #729)
+// =============================================================================
+//
+// A GROUP is a set of users INSIDE ONE ORGANIZATION that can own and share
+// content (spec decision D6: groups are sharing groups, never tenants). Every
+// row carries `org_id` and falls under the organization row-level-security
+// model of `0025_org_scoped_rls`: the three tables `ENABLE` and `FORCE ROW
+// LEVEL SECURITY` with one `<table>_org_isolation` policy each (migration
+// `0026_add_groups`, listed in `rls-policies.json`).
+//
+// A member row and an invite row reach their group through the COMPOSITE key
+// `(group_id, org_id)` -> `groups (id, org_id)`: a foreign-key check bypasses
+// row-level security, so a plain key would let one organization store a
+// reference to another organization's group, and the composite key also
+// guarantees `group_members.org_id = groups.org_id`.
+//
+// `group_invites_pending_uniq_idx` (one PENDING invite per group and address)
+// exists only in migration SQL: it is a partial unique index, which Prisma
+// cannot express. Never "fix" the drift with `@@unique([groupId, email])`: a
+// declined or revoked address must be invitable again.
+//
+// The names below are part of the public contract once released.
+// =============================================================================
+
+// The member and invite `role` columns are plain text (migration
+// `0037_open_sharing_vocabularies`): the vocabulary is the API's group-role
+// registry (`registerGroupRole`), which ships `admin` (manage the group, its
+// members and invites; full rights on group-owned resources), `editor` (write
+// on group-owned resources, MemoriaHub "collaborator") and `viewer` (read).
+// A row must outlive the registry that produced it, so there is no CHECK.
+
+// @extensible — back-relations only, added with "extend model Group { ... }" in a fragment
+model Group {
+  id          String   @id @default(uuid()) @db.Uuid
+  orgId       String   @map("org_id") @db.Uuid
+  name        String
+  description String?
+  /// Apps keep extra fields here (spec: never add columns to package-owned tables).
+  metadata    Json?    @db.JsonB
+  createdById String?  @map("created_by_id") @db.Uuid
+  // Optimistic concurrency for PATCH (If-Match), per docs/API.md.
+  version     Int      @default(1)
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  org       Organization  @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  createdBy User?         @relation("GroupCreatedBy", fields: [createdById], references: [id], onDelete: SetNull)
+  members   GroupMember[]
+  invites   GroupInvite[]
+  grants    Grant[]
+
+  // The target of the members' and invites' composite foreign keys.
+  @@unique([id, orgId])
+  @@index([orgId])
+  @@map("groups")
+}
+
+model GroupMember {
+  id        String    @id @default(uuid()) @db.Uuid
+  groupId   String    @map("group_id") @db.Uuid
+  userId    String    @map("user_id") @db.Uuid
+  // Denormalised for row-level security; equal to groups.org_id by the
+  // composite foreign key below.
+  orgId     String    @map("org_id") @db.Uuid
+  /// A registered group role id (`registerGroupRole`). A plain string: a row must outlive the registry that produced it.
+  role      String    @default("viewer")
+  addedById String?   @map("added_by_id") @db.Uuid
+  createdAt DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  //
+  // Composite: (group_id, org_id) -> groups (id, org_id).
+  group   Group        @relation(fields: [groupId, orgId], references: [id, orgId], onDelete: Cascade)
+  org     Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  user    User         @relation("GroupMemberUser", fields: [userId], references: [id], onDelete: Cascade)
+  addedBy User?        @relation("GroupMemberAddedBy", fields: [addedById], references: [id], onDelete: SetNull)
+
+  @@unique([groupId, userId])
+  @@index([userId])
+  @@index([orgId])
+  @@map("group_members")
+}
+
+model GroupInvite {
+  id           String    @id @default(uuid()) @db.Uuid
+  groupId      String    @map("group_id") @db.Uuid
+  orgId        String    @map("org_id") @db.Uuid
+  // Stored lower-cased. At most one PENDING invite per (group, email):
+  // group_invites_pending_uniq_idx, raw SQL only.
+  email        String
+  /// The role the invitee gets on acceptance: a registered group role id. A plain string.
+  role         String    @default("viewer")
+  invitedById  String?   @map("invited_by_id") @db.Uuid
+  // NULL: no expiry. Expiry is evaluated when the invite is read; no sweep.
+  expiresAt    DateTime? @map("expires_at") @db.Timestamptz
+  acceptedAt   DateTime? @map("accepted_at") @db.Timestamptz
+  acceptedById String?   @map("accepted_by_id") @db.Uuid
+  declinedAt   DateTime? @map("declined_at") @db.Timestamptz
+  revokedAt    DateTime? @map("revoked_at") @db.Timestamptz
+  createdAt    DateTime  @default(now()) @map("created_at") @db.Timestamptz
+
+  // Relations
+  //
+  // Composite: (group_id, org_id) -> groups (id, org_id).
+  group      Group        @relation(fields: [groupId, orgId], references: [id, orgId], onDelete: Cascade)
+  org        Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  invitedBy  User?        @relation("GroupInviteInvitedBy", fields: [invitedById], references: [id], onDelete: SetNull)
+  acceptedBy User?        @relation("GroupInviteAcceptedBy", fields: [acceptedById], references: [id], onDelete: SetNull)
+
+  @@index([email])
+  @@index([groupId])
+  @@index([orgId])
+  @@map("group_invites")
+}
+
+// =============================================================================
+// Sharing: grants (PP-7.2, issue #729)
+// =============================================================================
+//
+// A GRANT shares ONE record of a registered resource type with a user, a
+// group of the same organization or (#730) a link, with a role and an
+// optional expiry. The resource is POLYMORPHIC, `(resource_type,
+// resource_id)`, with no foreign key: the platform cannot know app tables.
+// Integrity comes from `GrantsService.deleteForResources()` (called inside the
+// app's delete transaction) and the `sharing.grants.prune` job.
+//
+// Revocation is SOFT (`revoked_at`, `revoked_by_id`) so the audit trail
+// survives; the prune job deletes revoked and expired rows after the
+// retention period.
+//
+// Raw SQL only (migration `0027_add_grants`, intentional schema drift):
+//   grants_active_user_uniq_idx   one ACTIVE grant per (resource, user)
+//   grants_active_group_uniq_idx  one ACTIVE grant per (resource, group)
+//   grants_grantee_consistency_check  the grantee columns match grantee_kind
+//   grants_active_ref_uniq_idx    one ACTIVE grant per (resource, app kind, reference) (0037)
+// Never "fix" the drift with `@@unique`, and never replace the indexes with a
+// `findFirst` pre-check: the service upserts on them.
+//
+// The group grantee reaches its group through the COMPOSITE key
+// `(grantee_group_id, org_id)` -> `groups (id, org_id)`, so a grant can never
+// point at another organization's group (a foreign-key check bypasses
+// row-level security).
+// =============================================================================
+
+// `grants.grantee_kind` is plain text (migration `0037_open_sharing_vocabularies`):
+// the platform ships `user` (one user of the resource's organization), `group`
+// (one group of the organization) and `link` (anyone holding the link token,
+// #730), and an app registers more with `registerGranteeKind`. A grant of an
+// app kind stores its reference in `grantee_ref` and leaves the three
+// built-in grantee columns NULL; `grants_grantee_consistency_check` allows
+// exactly those four shapes and `grants_active_ref_uniq_idx` keeps one ACTIVE
+// grant per (resource, kind, reference).
+
+// @extensible — back-relations only, added with "extend model Grant { ... }" in a fragment
+// (an app's own annotation of a grant, for example an approval record). The table is
+// org-owned with row-level security forced, so a table of the app's that holds `org_id`
+// links with a composite foreign key `(grant_id, org_id)` -> `grants (id, org_id)`; the
+// `@@unique([id, orgId])` below exists for it. The two partial unique indexes of the
+// table stay raw SQL (never an `@@unique` on their columns).
+model Grant {
+  id                  String           @id @default(uuid()) @db.Uuid
+  orgId               String           @map("org_id") @db.Uuid
+  /// Registered resource type id. Permanent once rows exist, like a job type string.
+  resourceType        String           @map("resource_type")
+  resourceId          String           @map("resource_id") @db.Uuid
+  /// `user`, `group`, `link` or a registered app kind. A plain string: a row must outlive the registry that produced it.
+  granteeKind         String           @map("grantee_kind")
+  granteeUserId       String?          @map("grantee_user_id") @db.Uuid
+  granteeGroupId      String?          @map("grantee_group_id") @db.Uuid
+  /// The reference of an app-registered grantee kind (a domain, a team id), as its `validateGrantee` normalised it. NULL for the built-in kinds.
+  granteeRef          String?          @map("grantee_ref")
+  /// One of the resource type's registered roles. A plain string: a row must outlive the registry that produced it.
+  role                String
+  /// Link grants only (#730): SHA-256 of the token, and the token encrypted with the platform secret cipher.
+  linkTokenHash       String?          @unique @map("link_token_hash")
+  linkTokenCiphertext String?          @map("link_token_ciphertext") @db.Text
+  linkLabel           String?          @map("link_label")
+  expiresAt           DateTime?        @map("expires_at") @db.Timestamptz
+  revokedAt           DateTime?        @map("revoked_at") @db.Timestamptz
+  revokedById         String?          @map("revoked_by_id") @db.Uuid
+  grantedById         String?          @map("granted_by_id") @db.Uuid
+  /// Apps keep extra fields here (spec: never add columns to package-owned tables).
+  metadata            Json?            @db.JsonB
+  createdAt           DateTime         @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt           DateTime         @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  org          Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  granteeUser  User?        @relation("GrantGranteeUser", fields: [granteeUserId], references: [id], onDelete: Cascade)
+  // Composite: (grantee_group_id, org_id) -> groups (id, org_id).
+  granteeGroup Group?       @relation(fields: [granteeGroupId, orgId], references: [id, orgId], onDelete: Cascade)
+  revokedBy    User?        @relation("GrantRevokedBy", fields: [revokedById], references: [id], onDelete: SetNull)
+  grantedBy    User?        @relation("GrantGrantedBy", fields: [grantedById], references: [id], onDelete: SetNull)
+
+  @@index([resourceType, resourceId])
+  @@index([granteeUserId])
+  @@index([granteeGroupId])
+  @@index([orgId])
+  // The target of an app table's composite foreign key (id, org_id); see the note above the model.
+  @@unique([id, orgId])
+  @@map("grants")
+}

package/host/prisma/schema/platform.storage.prisma

@@ -0,0 +1,118 @@
+// GENERATED by platform db compose — do not edit
+// source: package:storage.prisma
+
+// =============================================================================
+// Storage Objects
+// =============================================================================
+
+enum StorageObjectStatus {
+  pending // Upload initiated, awaiting chunks
+  uploading // Chunks being uploaded
+  processing // Post-upload processing in progress
+  ready // Available for use
+  failed // Upload or processing failed
+}
+
+// @extensible — back-relations only, added with "extend model StorageObject { ... }" in a fragment
+model StorageObject {
+  id              String              @id @default(uuid()) @db.Uuid
+  name            String // Original filename
+  size            BigInt // Total size in bytes (BigInt for GB-scale)
+  mimeType        String              @map("mime_type")
+  storageKey      String              @unique @map("storage_key") // S3 object key
+  storageProvider String              @default("s3") @map("storage_provider")
+  bucket          String?
+  status          StorageObjectStatus @default(pending)
+  s3UploadId      String?             @map("s3_upload_id") // S3 multipart upload ID
+  metadata        Json? // JSONB for flexible metadata
+  uploadedById    String?             @map("uploaded_by_id") @db.Uuid
+  // The organization the object belongs to (#725). NOT NULL, row-level
+  // security forced (policy `storage_objects_org_isolation`, see
+  // `0025_org_scoped_rls`). `Restrict`: an organization with objects cannot be
+  // deleted until they are purged deliberately.
+  orgId           String              @map("org_id") @db.Uuid
+  createdAt       DateTime            @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt       DateTime            @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  uploadedBy User?                @relation("UserStorageObjects", fields: [uploadedById], references: [id], onDelete: SetNull)
+  org        Organization         @relation(fields: [orgId], references: [id], onDelete: Restrict)
+  chunks     StorageObjectChunk[]
+
+  // The target of the chunks' composite foreign key (object_id, org_id): a
+  // reference between two org-owned tables is composite, because a foreign-key
+  // check bypasses row-level security (ADR 0002 D5).
+
+  // composed from app:kvox.graph.prisma
+  // Back-relations onto the platform's StorageObject (an `extend model` block holds back-relation fields only).
+  // Connected Knowledge (epic #344, issue #351). SetNull — an import's
+  // evidence row is a citation into the imported file, and survives losing
+  // the object the same way a transcript/note evidence pointer does. See
+  // the block comment above `KgEvidence`.
+  kgEvidenceImports KgEvidence[]
+
+  // #386 — a rendered graph export (`managed_by: 'graph'`). Restrict, the
+  // `noteExportFiles` reasoning: only the export sweep / `kg.purge`, clearing
+  // the `kg_exports` reference first, may remove the file.
+  kgExportFiles     KgExport[]
+
+  // composed from app:kvox.notes.prisma
+  // Back-relations onto the platform's StorageObject (an `extend model` block holds back-relation fields only).
+  // Two back-relations from notes (issue #48, epic #45), the identical
+  // Restrict-FK reasoning as the five transcript ones above: only
+  // `note.purge`/`notes.housekeeping` deleting the referencing row first may
+  // ever remove one of these objects.
+  notesAsSourceObject Note[]       @relation("NoteSourceObject")
+  noteExportFiles     NoteExport[] @relation("NoteExportObject")
+
+  // composed from app:kvox.transcripts.prisma
+  // Back-relations onto the platform's StorageObject (an `extend model` block holds back-relation fields only).
+  // Five back-relations from transcripts (issue #24, epic #19), one per
+  // `storage_objects` FK the transcript tables hold. Every one of those FKs
+  // is `onDelete: Restrict` — see the block comment above the `Transcript`
+  // model for why a managed object like these may only ever be removed by
+  // `transcript.purge` deleting the referencing row first, never by an
+  // unrelated storage cleanup deleting the object out from under it. List
+  // types, not optional singulars, because nothing here declares these FKs
+  // `@unique` — a future column reusing an existing object (unlikely, but
+  // not schema-prevented) would still be representable.
+  transcriptsAsSource        Transcript[]        @relation("TranscriptSourceObject")
+  transcriptsAsPlayback      Transcript[]        @relation("TranscriptPlaybackObject")
+  transcriptsAsRawResult     Transcript[]        @relation("TranscriptRawResultObject")
+  transcriptVersionSnapshots TranscriptVersion[] @relation("TranscriptVersionSnapshotObject")
+  transcriptExportFiles      TranscriptExport[]  @relation("TranscriptExportObject")
+
+  @@unique([id, orgId])
+  @@index([uploadedById])
+  @@index([status])
+  @@index([createdAt])
+  // The policy filter `org_id = X` leads every query; these serve the hot paths
+  // behind it (a user's list, newest first; the cleanup sweep by status).
+  @@index([orgId, uploadedById, createdAt])
+  @@index([orgId, status])
+  @@map("storage_objects")
+}
+
+model StorageObjectChunk {
+  id         String   @id @default(uuid()) @db.Uuid
+  objectId   String   @map("object_id") @db.Uuid
+  partNumber Int      @map("part_number") // S3 part number (1-10000)
+  eTag       String   @map("e_tag") // S3 ETag for verification
+  size       BigInt // Chunk size in bytes
+  // The organization of the parent object (#725), carried here because a policy
+  // cannot join through the parent. NOT NULL, row-level security forced.
+  orgId      String   @map("org_id") @db.Uuid
+  uploadedAt DateTime @default(now()) @map("uploaded_at") @db.Timestamptz
+
+  // Relations
+  //
+  // Composite: (object_id, org_id) -> storage_objects (id, org_id), so a chunk
+  // can never name another organization's object. Cascade, as before.
+  object StorageObject @relation(fields: [objectId, orgId], references: [id, orgId], onDelete: Cascade)
+  org    Organization  @relation(fields: [orgId], references: [id], onDelete: Restrict)
+
+  @@unique([objectId, partNumber])
+  @@index([objectId])
+  @@index([orgId, objectId])
+  @@map("storage_object_chunks")
+}

package/package.json

@@ -1 +1,112 @@
-{"name":"@marinoscar/kvox-eval","version":"0.0.0-bootstrap","description":"Name reservation.","license":"MIT"}
+{
+  "name": "@marinoscar/kvox-eval",
+  "version": "0.1.0-next.0",
+  "description": "The KVox knowledge-graph and Ask evaluation: the synthetic golden set, its schemas, the scorers, the report and the live runners, over the model port only (CommonJS, with the kvox-eval CLI).",
+  "license": "MIT",
+  "type": "commonjs",
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/marinoscar/kvox.git",
+    "directory": "packages/kvox-eval"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "kvox-eval": "./dist/cli/main.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./ask-run": {
+      "types": "./dist/ask-run/index.d.ts",
+      "default": "./dist/ask-run/index.js"
+    },
+    "./fixtures": {
+      "types": "./dist/fixtures/index.d.ts",
+      "default": "./dist/fixtures/index.js"
+    },
+    "./parity": {
+      "types": "./dist/parity/index.d.ts",
+      "default": "./dist/parity/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "fixtures",
+    "parity",
+    "host",
+    "!host/prisma.config.ts",
+    "!host/.stamp",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prepare:host": "node scripts/prepare-host.mjs",
+    "prebuild": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && node scripts/prepare-host.mjs",
+    "prepack": "node ../../scripts/kvox-packages/copy-license.mjs",
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
+    "pretypecheck": "node scripts/prepare-host.mjs",
+    "typecheck": "tsc --noEmit",
+    "predocs": "node scripts/prepare-host.mjs",
+    "docs": "typedoc --options typedoc.json",
+    "pretest": "node scripts/prepare-host.mjs",
+    "test": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js -c test/jest.config.js",
+    "pretest:run": "node scripts/prepare-host.mjs",
+    "test:run": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js -c test/jest.config.js --ci"
+  },
+  "peerDependencies": {
+    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite-pgvector": "0.0.11",
+    "@electric-sql/pglite-socket": "0.2.13",
+    "@marinoscar/kvox-ai": ">=0.0.0-0 || >=0.1.0-0",
+    "@marinoscar/kvox-api": ">=0.0.0-0 || >=0.1.0-0",
+    "@marinoscar/kvox-contract": ">=0.0.0-0 || >=0.1.0-0",
+    "@marinoscar/platform-api": "0.1.0-next.5",
+    "@nestjs/common": "^11.1.12",
+    "@nestjs/core": "^11.1.12",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
+    "pg": "^8.23.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "0.5.10",
+    "@electric-sql/pglite-pgvector": "0.0.11",
+    "@electric-sql/pglite-socket": "0.2.13",
+    "@marinoscar/kvox-ai": "0.1.0-next.0",
+    "@marinoscar/kvox-api": "0.1.0-next.0",
+    "@marinoscar/kvox-contract": "0.1.0-next.0",
+    "@marinoscar/kvox-db": "0.1.0-next.0",
+    "@marinoscar/platform-api": "0.1.0-next.5",
+    "@marinoscar/platform-db": "0.1.0-next.5",
+    "@nestjs/common": "^11.1.12",
+    "@nestjs/core": "^11.1.12",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
+    "@prisma/config": "^7.8.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.15.32",
+    "jest": "^30.4.2",
+    "pg": "^8.23.0",
+    "prisma": "^7.8.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "ts-jest": "^29.4.12",
+    "typescript": "^6.0.3",
+    "zod": "^4.4.3"
+  }
+}