@opengeni/db 0.12.1 → 0.12.6

package/dist/{chunk-VUKRIBO5.js → chunk-CYA6BHV6.js}

@@ -729,6 +729,8 @@ var sessions = pgTable(
     // mapSession exposes those rows as `legacy` instead of guessing omitted vs
     // explicit [].
     toolPolicy: jsonb("tool_policy").$type(),
+    // Optimistic-concurrency fence for durable session tool-policy writes.
+    toolPolicyVersion: integer("tool_policy_version").notNull().default(1),
     // The manager session that spawned this one via session_create. Set only
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
@@ -1066,7 +1068,8 @@ var documentBases = pgTable(
     workspaceCreated: index("document_bases_workspace_created_idx").on(
       table.workspaceId,
       table.createdAt
-    )
+    ),
+    defaultName: uniqueIndex("document_bases_workspace_default_name_uq").on(table.workspaceId).where(sql`lower(btrim(${table.name})) = 'default'`)
   })
 );
 var documents = pgTable(
@@ -1091,6 +1094,17 @@ var documents = pgTable(
     sourceUpdatedAt: timestamp("source_updated_at", { withTimezone: true }),
     sourceVersion: text("source_version"),
     aclTags: jsonb("acl_tags").$type().notNull().default([]),
+    // Per-document access controls. visibility 'private' restricts human reads to
+    // created_by (a grant subject id, not a uuid); agent_access=false hides the
+    // document from agent retrieval surfaces (docs MCP) while humans keep REST.
+    visibility: text("visibility").notNull().default("workspace"),
+    createdBy: text("created_by"),
+    agentAccess: boolean("agent_access").notNull().default(true),
+    // Auto-curation output (knowledge drops).
+    summary: text("summary"),
+    topics: jsonb("topics").$type().notNull().default([]),
+    curationStatus: text("curation_status").notNull().default("none"),
+    curation: jsonb("curation").$type(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -1112,6 +1126,27 @@ var documents = pgTable(
     sourceExternalId: index("documents_workspace_source_external_id_idx").on(
       table.workspaceId,
       table.sourceExternalId
+    ),
+    curationStatus: index("documents_workspace_curation_status_idx").on(
+      table.workspaceId,
+      table.curationStatus
+    ),
+    visibilityState: check(
+      "documents_visibility_chk",
+      sql`${table.visibility} in ('workspace', 'private')`
+    ),
+    curationState: check(
+      "documents_curation_status_chk",
+      sql`${table.curationStatus} in ('none', 'pending', 'suggested', 'auto_filed', 'failed')`
+    ),
+    privateCreator: check(
+      "documents_private_creator_chk",
+      sql`${table.visibility} <> 'private' or nullif(btrim(${table.createdBy}), '') is not null`
+    ),
+    topicsArray: check("documents_topics_array_chk", sql`jsonb_typeof(${table.topics}) = 'array'`),
+    curationObject: check(
+      "documents_curation_object_chk",
+      sql`${table.curation} is null or jsonb_typeof(${table.curation}) = 'object'`
     )
   })
 );
@@ -1347,7 +1382,8 @@ var sessionTurnAttempts = pgTable(
       "session_turn_attempts_outcome_check",
       sql`${table.outcome} is null or ${table.outcome} in (
         'completed', 'failed', 'cancelled', 'superseded', 'requires_action',
-        'interrupted_recoverable', 'lease_lost_recoverable', 'pre_cutover_closed'
+        'waiting_capacity', 'interrupted_recoverable', 'lease_lost_recoverable',
+        'pre_cutover_closed'
       )`
     ),
     closedConsistent: check(
@@ -1801,13 +1837,14 @@ var codexCapacityWaiters = pgTable(
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull(),
-    goalId: uuid("goal_id").notNull(),
+    goalId: uuid("goal_id"),
     blockedTurnId: uuid("blocked_turn_id").notNull(),
+    blockedTurnGeneration: integer("blocked_turn_generation").notNull(),
     workflowId: text("workflow_id").notNull(),
     generation: integer("generation").notNull().default(1),
     status: text("status").notNull().default("waiting"),
     // waiting | resumed | superseded
-    goalVersion: integer("goal_version").notNull(),
+    goalVersion: integer("goal_version"),
     policyHash: text("policy_hash"),
     earliestResetAt: timestamp("earliest_reset_at", { withTimezone: true }),
     nextCheckAt: timestamp("next_check_at", { withTimezone: true }).notNull(),
@@ -1894,6 +1931,7 @@ var sessionEvents = pgTable(
     monitoringTail: index("session_events_workspace_session_monitoring_tail_idx").on(table.workspaceId, table.sessionId, table.sequence).where(
       sql`${table.type} not in ('agent.message.delta', 'agent.reasoning.delta', 'sandbox.command.output.delta', 'terminal.pty.output.delta')`
     ),
+    duplicateOfEvent: index("session_events_duplicate_of_event_idx").on(table.duplicateOfEventId),
     payloadBytes: check(
       "session_events_payload_bytes_check",
       sql`octet_length(${table.payload}::text) <= 65536`
@@ -2197,6 +2235,7 @@ var sandboxLeases = pgTable(
       table.id
     ),
     reaperIdx: index("sandbox_leases_reaper_idx").on(table.expiresAt).where(sql`${table.liveness} in ('warming','warm','draining')`),
+    expiredDrainingInventory: index("sandbox_leases_expired_draining_inventory_idx").on(table.expiresAt, table.backend).where(sql`${table.liveness} = 'draining'`),
     workspaceGenerationValid: check(
       "sandbox_leases_workspace_generation_check",
       sql`${table.workspaceGeneration} >= 0`
@@ -2403,7 +2442,20 @@ var sandboxRetainedProcesses = pgTable(
     exitCode: integer("exit_code"),
     settlementReason: text("settlement_reason"),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
-    settledAt: timestamp("settled_at", { withTimezone: true })
+    settledAt: timestamp("settled_at", { withTimezone: true }),
+    // Coordination state for bounded terminal-owner reconciliation. While a
+    // claim is live, reconcileAfter is its expiry; otherwise it is the next
+    // retry time. Becoming due only licenses an exact provider probe and is
+    // never exit/loss proof.
+    reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
+    reconcileClaimId: uuid("reconcile_claim_id"),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
+    lastReconcileOutcome: text("last_reconcile_outcome"),
+    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofExitCode: integer("reconcile_proof_exit_code"),
+    reconcileProofReason: text("reconcile_proof_reason"),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true })
   },
   (table) => ({
     workspaceAccount: foreignKey({
@@ -2452,6 +2504,8 @@ var sandboxRetainedProcesses = pgTable(
     ).where(sql`${table.state} = 'active'`),
     holder: uniqueIndex("sandbox_retained_processes_holder_uq").on(table.leaseId, table.holderId),
     active: index("sandbox_retained_processes_active_idx").on(table.workspaceId, table.sessionId, table.startedAt).where(sql`${table.state} = 'active'`),
+    reconcileDue: index("sandbox_retained_processes_reconcile_due_idx").on(table.reconcileAfter, table.startedAt, table.id).where(sql`${table.state} = 'active'`),
+    activeInventory: index("sandbox_retained_processes_active_inventory_idx").on(table.ownerActorKind, table.workspaceId, table.ownerTurnId, table.ownerAttemptId).where(sql`${table.state} = 'active'`),
     identityValid: check(
       "sandbox_retained_processes_identity_check",
       sql`${table.leaseEpoch} >= 0
@@ -2487,6 +2541,41 @@ var sandboxRetainedProcesses = pgTable(
       "sandbox_retained_processes_reason_check",
       sql`${table.settlementReason} is null
         or octet_length(${table.settlementReason}) between 1 and 512`
+    ),
+    reconcileClaimValid: check(
+      "sandbox_retained_processes_reconcile_claim_check",
+      sql`(${table.reconcileClaimId} is null and ${table.reconcileClaimedAt} is null)
+        or (${table.reconcileClaimId} is not null and ${table.reconcileClaimedAt} is not null)`
+    ),
+    reconcileAttemptsValid: check(
+      "sandbox_retained_processes_reconcile_attempts_check",
+      sql`${table.reconcileAttempts} >= 0`
+    ),
+    reconcileOutcomeValid: check(
+      "sandbox_retained_processes_reconcile_outcome_check",
+      sql`${table.lastReconcileOutcome} is null
+        or octet_length(${table.lastReconcileOutcome}) between 1 and 64`
+    ),
+    reconcileProofValid: check(
+      "sandbox_retained_processes_reconcile_proof_check",
+      sql`(
+          ${table.reconcileProofOutcome} is null
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} is null
+          and ${table.reconcileProofObservedAt} is null
+        ) or (
+          ${table.reconcileProofOutcome} = 'exited'
+          and ${table.reconcileProofExitCode} is not null
+          and ${table.reconcileProofReason} = 'provider_exit_banner'
+          and ${table.reconcileProofObservedAt} is not null
+        ) or (
+          ${table.reconcileProofOutcome} = 'lost'
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} in (
+            'provider_session_lost_banner', 'provider_instance_not_found'
+          )
+          and ${table.reconcileProofObservedAt} is not null
+        )`
     )
   })
 );
@@ -2916,10 +3005,17 @@ var githubInstallations = pgTable(
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     installationId: integer("installation_id").notNull(),
+    githubAccountId: bigint("github_account_id", { mode: "number" }),
     accountLogin: text("account_login"),
     accountType: text("account_type"),
     repositoryScope: text("repository_scope").notNull().default("all"),
     linkedBySubjectId: text("linked_by_subject_id"),
+    githubActorId: bigint("github_actor_id", { mode: "number" }),
+    githubActorLogin: text("github_actor_login"),
+    authorityKind: text("authority_kind"),
+    authorityCheckedAt: timestamp("authority_checked_at", { withTimezone: true }),
+    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }),
+    authorityNonce: text("authority_nonce"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -2933,7 +3029,54 @@ var githubInstallations = pgTable(
     repositoryScopeCheck: check(
       "github_installations_repository_scope_check",
       sql`${table.repositoryScope} in ('all', 'selected')`
-    )
+    ),
+    authorityKindCheck: check(
+      "github_installations_authority_kind_check",
+      sql`
+        (
+          ${table.githubAccountId} is null
+          and ${table.githubActorId} is null
+          and ${table.githubActorLogin} is null
+          and ${table.authorityKind} is null
+          and ${table.authorityCheckedAt} is null
+          and ${table.authorityExpiresAt} is null
+          and ${table.authorityNonce} is null
+        )
+        or (
+          ${table.githubAccountId} is not null
+          and ${table.githubAccountId} > 0
+          and ${table.githubActorId} is not null
+          and ${table.githubActorId} > 0
+          and ${table.githubActorLogin} is not null
+          and length(${table.githubActorLogin}) > 0
+          and ${table.accountLogin} is not null
+          and length(${table.accountLogin}) > 0
+          and ${table.accountType} is not null
+          and ${table.linkedBySubjectId} is not null
+          and length(${table.linkedBySubjectId}) > 0
+          and ${table.authorityKind} is not null
+          and ${table.authorityCheckedAt} is not null
+          and ${table.authorityExpiresAt} is not null
+          and ${table.authorityCheckedAt} < ${table.authorityExpiresAt}
+          and ${table.authorityExpiresAt} <= ${table.authorityCheckedAt} + interval '10 minutes'
+          and ${table.authorityNonce} is not null
+          and length(${table.authorityNonce}) > 0
+          and ${table.repositoryScope} = 'selected'
+          and (
+            (
+              ${table.authorityKind} = 'personal_owner'
+              and ${table.accountType} = 'User'
+              and ${table.githubActorId} = ${table.githubAccountId}
+            )
+            or (
+              ${table.authorityKind} = 'organization_owner'
+              and ${table.accountType} = 'Organization'
+            )
+          )
+        )
+      `
+    ),
+    authorityNonce: uniqueIndex("github_installations_authority_nonce_uq").on(table.authorityNonce).where(sql`${table.authorityNonce} is not null`)
   })
 );
 var githubInstallationRepositories = pgTable(
@@ -3676,4 +3819,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-VUKRIBO5.js.map
+//# sourceMappingURL=chunk-CYA6BHV6.js.map