@opengeni/db 0.12.1 → 0.13.0

package/src/schema.ts

@@ -485,6 +485,12 @@ export const connections = pgTable(
     lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
     lastError: text("last_error"),
     version: integer("version").notNull().default(1),
+    // Server-owned proof that the dedicated install route verified the exact
+    // credential at this connection version. Generic/legacy writers cannot set
+    // these columns, and migration 0131 clears them when protected fields change
+    // without a fresh verification in the same statement.
+    verifiedInstallAt: timestamp("verified_install_at", { withTimezone: true }),
+    verifiedInstallVersion: integer("verified_install_version"),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
     createdBySubjectId: text("created_by_subject_id"),
     updatedBySubjectId: text("updated_by_subject_id"),
@@ -510,6 +516,85 @@ export const connections = pgTable(
   }),
 );
 
+// Durable provider-operation identity for OpenGeni Slack bot posts. The
+// caller-supplied operation UUID is also Slack's client_msg_id; a bounded claim
+// serializes live attempts while an expired/released claim can safely retry the
+// same provider identity after response loss or process death.
+export const slackBotPostOperations = pgTable(
+  "slack_bot_post_operations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    operationId: uuid("operation_id").notNull(),
+    clientMessageId: uuid("client_message_id").notNull(),
+    targetKind: text("target_kind").$type<"channel" | "user">().notNull(),
+    targetId: text("target_id").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    status: text("status").$type<"provider_started" | "completed">().notNull(),
+    claimHolderId: uuid("claim_holder_id"),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    lastFailureCode: text("last_failure_code"),
+    slackChannelId: text("slack_channel_id"),
+    slackMessageTimestamp: text("slack_message_timestamp"),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_bot_post_operations_workspace_operation_uq").on(
+      table.workspaceId,
+      table.connectionId,
+      table.operationId,
+    ),
+    workspaceStatus: index("slack_bot_post_operations_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+      table.updatedAt,
+    ),
+    targetKindValid: check(
+      "slack_bot_post_operations_target_kind_check",
+      sql`${table.targetKind} in ('channel', 'user')`,
+    ),
+    statusValid: check(
+      "slack_bot_post_operations_status_check",
+      sql`${table.status} in ('provider_started', 'completed')`,
+    ),
+    identityValid: check(
+      "slack_bot_post_operations_identity_check",
+      sql`${table.clientMessageId} = ${table.operationId}
+        and length(${table.targetId}) between 1 and 64
+        and ${table.requestDigest} ~ '^[0-9a-f]{64}$'
+        and ${table.attemptCount} > 0
+        and ((${table.claimHolderId} is null) = (${table.claimExpiresAt} is null))`,
+    ),
+    completionValid: check(
+      "slack_bot_post_operations_completion_check",
+      sql`(
+          ${table.status} = 'provider_started'
+          and ${table.slackChannelId} is null
+          and ${table.slackMessageTimestamp} is null
+          and ${table.completedAt} is null
+        ) or (
+          ${table.status} = 'completed'
+          and ${table.claimHolderId} is null
+          and ${table.claimExpiresAt} is null
+          and ${table.slackChannelId} is not null
+          and ${table.slackMessageTimestamp} is not null
+          and ${table.completedAt} is not null
+        )`,
+    ),
+  }),
+);
+
 // OAuth client registrations minted through MCP DCR, keyed by authorization
 // server issuer. This is deployment-wide client identity, not a workspace
 // credential; per-user/provider tokens still live only in connections.
@@ -756,6 +841,8 @@ export const sessions = pgTable(
     // mapSession exposes those rows as `legacy` instead of guessing omitted vs
     // explicit [].
     toolPolicy: jsonb("tool_policy").$type<SessionToolPolicy>(),
+    // Optimistic-concurrency fence for durable session tool-policy writes.
+    toolPolicyVersion: integer("tool_policy_version").notNull().default(1),
     // The manager session that spawned this one via session_create. Set only
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
@@ -1152,6 +1239,9 @@ export const documentBases = pgTable(
       table.workspaceId,
       table.createdAt,
     ),
+    defaultName: uniqueIndex("document_bases_workspace_default_name_uq")
+      .on(table.workspaceId)
+      .where(sql`lower(btrim(${table.name})) = 'default'`),
   }),
 );
 
@@ -1185,6 +1275,17 @@ export const documents = pgTable(
     sourceUpdatedAt: timestamp("source_updated_at", { withTimezone: true }),
     sourceVersion: text("source_version"),
     aclTags: jsonb("acl_tags").$type<string[]>().notNull().default([]),
+    // Per-document access controls. visibility 'private' restricts human reads to
+    // created_by (a grant subject id, not a uuid); agent_access=false hides the
+    // document from agent retrieval surfaces (docs MCP) while humans keep REST.
+    visibility: text("visibility").notNull().default("workspace"),
+    createdBy: text("created_by"),
+    agentAccess: boolean("agent_access").notNull().default(true),
+    // Auto-curation output (knowledge drops).
+    summary: text("summary"),
+    topics: jsonb("topics").$type<string[]>().notNull().default([]),
+    curationStatus: text("curation_status").notNull().default("none"),
+    curation: jsonb("curation").$type<Record<string, unknown>>(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -1207,6 +1308,27 @@ export const documents = pgTable(
       table.workspaceId,
       table.sourceExternalId,
     ),
+    curationStatus: index("documents_workspace_curation_status_idx").on(
+      table.workspaceId,
+      table.curationStatus,
+    ),
+    visibilityState: check(
+      "documents_visibility_chk",
+      sql`${table.visibility} in ('workspace', 'private')`,
+    ),
+    curationState: check(
+      "documents_curation_status_chk",
+      sql`${table.curationStatus} in ('none', 'pending', 'suggested', 'auto_filed', 'failed')`,
+    ),
+    privateCreator: check(
+      "documents_private_creator_chk",
+      sql`${table.visibility} <> 'private' or nullif(btrim(${table.createdBy}), '') is not null`,
+    ),
+    topicsArray: check("documents_topics_array_chk", sql`jsonb_typeof(${table.topics}) = 'array'`),
+    curationObject: check(
+      "documents_curation_object_chk",
+      sql`${table.curation} is null or jsonb_typeof(${table.curation}) = 'object'`,
+    ),
   }),
 );
 
@@ -1485,7 +1607,8 @@ export const sessionTurnAttempts = pgTable(
       "session_turn_attempts_outcome_check",
       sql`${table.outcome} is null or ${table.outcome} in (
         'completed', 'failed', 'cancelled', 'superseded', 'requires_action',
-        'interrupted_recoverable', 'lease_lost_recoverable', 'pre_cutover_closed'
+        'waiting_capacity', 'interrupted_recoverable', 'lease_lost_recoverable',
+        'pre_cutover_closed'
       )`,
     ),
     closedConsistent: check(
@@ -2014,12 +2137,13 @@ export const codexCapacityWaiters = pgTable(
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull(),
-    goalId: uuid("goal_id").notNull(),
+    goalId: uuid("goal_id"),
     blockedTurnId: uuid("blocked_turn_id").notNull(),
+    blockedTurnGeneration: integer("blocked_turn_generation").notNull(),
     workflowId: text("workflow_id").notNull(),
     generation: integer("generation").notNull().default(1),
     status: text("status").notNull().default("waiting"), // waiting | resumed | superseded
-    goalVersion: integer("goal_version").notNull(),
+    goalVersion: integer("goal_version"),
     policyHash: text("policy_hash"),
     earliestResetAt: timestamp("earliest_reset_at", { withTimezone: true }),
     nextCheckAt: timestamp("next_check_at", { withTimezone: true }).notNull(),
@@ -2118,6 +2242,7 @@ export const sessionEvents = pgTable(
       .where(
         sql`${table.type} not in ('agent.message.delta', 'agent.reasoning.delta', 'sandbox.command.output.delta', 'terminal.pty.output.delta')`,
       ),
+    duplicateOfEvent: index("session_events_duplicate_of_event_idx").on(table.duplicateOfEventId),
     payloadBytes: check(
       "session_events_payload_bytes_check",
       sql`octet_length(${table.payload}::text) <= 65536`,
@@ -2499,6 +2624,9 @@ export const sandboxLeases = pgTable(
     reaperIdx: index("sandbox_leases_reaper_idx")
       .on(table.expiresAt)
       .where(sql`${table.liveness} in ('warming','warm','draining')`),
+    expiredDrainingInventory: index("sandbox_leases_expired_draining_inventory_idx")
+      .on(table.expiresAt, table.backend)
+      .where(sql`${table.liveness} = 'draining'`),
     workspaceGenerationValid: check(
       "sandbox_leases_workspace_generation_check",
       sql`${table.workspaceGeneration} >= 0`,
@@ -2736,6 +2864,19 @@ export const sandboxRetainedProcesses = pgTable(
     settlementReason: text("settlement_reason"),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     settledAt: timestamp("settled_at", { withTimezone: true }),
+    // Coordination state for bounded terminal-owner reconciliation. While a
+    // claim is live, reconcileAfter is its expiry; otherwise it is the next
+    // retry time. Becoming due only licenses an exact provider probe and is
+    // never exit/loss proof.
+    reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
+    reconcileClaimId: uuid("reconcile_claim_id"),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
+    lastReconcileOutcome: text("last_reconcile_outcome"),
+    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofExitCode: integer("reconcile_proof_exit_code"),
+    reconcileProofReason: text("reconcile_proof_reason"),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true }),
   },
   (table) => ({
     workspaceAccount: foreignKey({
@@ -2788,6 +2929,12 @@ export const sandboxRetainedProcesses = pgTable(
     active: index("sandbox_retained_processes_active_idx")
       .on(table.workspaceId, table.sessionId, table.startedAt)
       .where(sql`${table.state} = 'active'`),
+    reconcileDue: index("sandbox_retained_processes_reconcile_due_idx")
+      .on(table.reconcileAfter, table.startedAt, table.id)
+      .where(sql`${table.state} = 'active'`),
+    activeInventory: index("sandbox_retained_processes_active_inventory_idx")
+      .on(table.ownerActorKind, table.workspaceId, table.ownerTurnId, table.ownerAttemptId)
+      .where(sql`${table.state} = 'active'`),
     identityValid: check(
       "sandbox_retained_processes_identity_check",
       sql`${table.leaseEpoch} >= 0
@@ -2824,6 +2971,41 @@ export const sandboxRetainedProcesses = pgTable(
       sql`${table.settlementReason} is null
         or octet_length(${table.settlementReason}) between 1 and 512`,
     ),
+    reconcileClaimValid: check(
+      "sandbox_retained_processes_reconcile_claim_check",
+      sql`(${table.reconcileClaimId} is null and ${table.reconcileClaimedAt} is null)
+        or (${table.reconcileClaimId} is not null and ${table.reconcileClaimedAt} is not null)`,
+    ),
+    reconcileAttemptsValid: check(
+      "sandbox_retained_processes_reconcile_attempts_check",
+      sql`${table.reconcileAttempts} >= 0`,
+    ),
+    reconcileOutcomeValid: check(
+      "sandbox_retained_processes_reconcile_outcome_check",
+      sql`${table.lastReconcileOutcome} is null
+        or octet_length(${table.lastReconcileOutcome}) between 1 and 64`,
+    ),
+    reconcileProofValid: check(
+      "sandbox_retained_processes_reconcile_proof_check",
+      sql`(
+          ${table.reconcileProofOutcome} is null
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} is null
+          and ${table.reconcileProofObservedAt} is null
+        ) or (
+          ${table.reconcileProofOutcome} = 'exited'
+          and ${table.reconcileProofExitCode} is not null
+          and ${table.reconcileProofReason} = 'provider_exit_banner'
+          and ${table.reconcileProofObservedAt} is not null
+        ) or (
+          ${table.reconcileProofOutcome} = 'lost'
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} in (
+            'provider_session_lost_banner', 'provider_instance_not_found'
+          )
+          and ${table.reconcileProofObservedAt} is not null
+        )`,
+    ),
   }),
 );
 
@@ -3410,10 +3592,17 @@ export const githubInstallations = pgTable(
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
     installationId: integer("installation_id").notNull(),
+    githubAccountId: bigint("github_account_id", { mode: "number" }),
     accountLogin: text("account_login"),
     accountType: text("account_type"),
     repositoryScope: text("repository_scope").notNull().default("all"),
     linkedBySubjectId: text("linked_by_subject_id"),
+    githubActorId: bigint("github_actor_id", { mode: "number" }),
+    githubActorLogin: text("github_actor_login"),
+    authorityKind: text("authority_kind"),
+    authorityCheckedAt: timestamp("authority_checked_at", { withTimezone: true }),
+    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }),
+    authorityNonce: text("authority_nonce"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -3428,6 +3617,55 @@ export const githubInstallations = pgTable(
       "github_installations_repository_scope_check",
       sql`${table.repositoryScope} in ('all', 'selected')`,
     ),
+    authorityKindCheck: check(
+      "github_installations_authority_kind_check",
+      sql`
+        (
+          ${table.githubAccountId} is null
+          and ${table.githubActorId} is null
+          and ${table.githubActorLogin} is null
+          and ${table.authorityKind} is null
+          and ${table.authorityCheckedAt} is null
+          and ${table.authorityExpiresAt} is null
+          and ${table.authorityNonce} is null
+        )
+        or (
+          ${table.githubAccountId} is not null
+          and ${table.githubAccountId} > 0
+          and ${table.githubActorId} is not null
+          and ${table.githubActorId} > 0
+          and ${table.githubActorLogin} is not null
+          and length(${table.githubActorLogin}) > 0
+          and ${table.accountLogin} is not null
+          and length(${table.accountLogin}) > 0
+          and ${table.accountType} is not null
+          and ${table.linkedBySubjectId} is not null
+          and length(${table.linkedBySubjectId}) > 0
+          and ${table.authorityKind} is not null
+          and ${table.authorityCheckedAt} is not null
+          and ${table.authorityExpiresAt} is not null
+          and ${table.authorityCheckedAt} < ${table.authorityExpiresAt}
+          and ${table.authorityExpiresAt} <= ${table.authorityCheckedAt} + interval '10 minutes'
+          and ${table.authorityNonce} is not null
+          and length(${table.authorityNonce}) > 0
+          and ${table.repositoryScope} = 'selected'
+          and (
+            (
+              ${table.authorityKind} = 'personal_owner'
+              and ${table.accountType} = 'User'
+              and ${table.githubActorId} = ${table.githubAccountId}
+            )
+            or (
+              ${table.authorityKind} = 'organization_owner'
+              and ${table.accountType} = 'Organization'
+            )
+          )
+        )
+      `,
+    ),
+    authorityNonce: uniqueIndex("github_installations_authority_nonce_uq")
+      .on(table.authorityNonce)
+      .where(sql`${table.authorityNonce} is not null`),
   }),
 );
 
@@ -4180,3 +4418,5 @@ export const rigChanges = pgTable(
     workspaceStatus: index("rig_changes_workspace_status_idx").on(table.workspaceId, table.status),
   }),
 );
+
+export * from "./workspace-instruction-policies-schema";

package/src/session-control.ts

@@ -34,6 +34,7 @@ export type SessionTurnAttemptOutcome =
   | "cancelled"
   | "superseded"
   | "requires_action"
+  | "waiting_capacity"
   | "interrupted_recoverable"
   | "lease_lost_recoverable"
   | "pre_cutover_closed";

package/src/workspace-instruction-policies-schema.ts

@@ -0,0 +1,140 @@
+import { sql } from "drizzle-orm";
+import {
+  bigint,
+  check,
+  index,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+// Foreign keys and the cross-row revision/head integrity triggers live in the
+// SQL migration. Keeping this additive schema leaf independent avoids a cycle
+// back into schema.ts while retaining one canonical Drizzle namespace export.
+
+export const workspaceInstructionPolicyRevisions = pgTable(
+  "workspace_instruction_policy_revisions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    revision: bigint("revision", { mode: "number" })
+      .notNull()
+      .default(sql`nextval('workspace_instruction_policy_revision_seq')`),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    content: text("content").notNull(),
+    contentHash: text("content_hash").notNull(),
+    provenanceSource: text("provenance_source").notNull(),
+    provenanceSourceId: text("provenance_source_id"),
+    supersedesRevisionId: uuid("supersedes_revision_id"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceRevision: uniqueIndex(
+      "workspace_instruction_policy_revisions_workspace_revision_uq",
+    ).on(table.workspaceId, table.revision),
+    workspaceHistory: index("workspace_instruction_policy_revisions_workspace_history_idx").on(
+      table.workspaceId,
+      table.kind,
+      table.scope,
+      table.roleKey,
+      table.revision,
+    ),
+    target: check(
+      "workspace_instruction_policy_revisions_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`,
+    ),
+  }),
+);
+
+export const workspaceInstructionPolicyHeads = pgTable(
+  "workspace_instruction_policy_heads",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    revisionId: uuid("revision_id").notNull(),
+    revision: bigint("revision", { mode: "number" }).notNull(),
+    contentHash: text("content_hash").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    activatedAt: timestamp("activated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    charter: uniqueIndex("workspace_instruction_policy_heads_charter_uq")
+      .on(table.workspaceId)
+      .where(sql`${table.kind} = 'charter'`),
+    globalPolicy: uniqueIndex("workspace_instruction_policy_heads_global_policy_uq")
+      .on(table.workspaceId)
+      .where(sql`${table.kind} = 'policy' and ${table.scope} = 'global'`),
+    rolePolicy: uniqueIndex("workspace_instruction_policy_heads_role_policy_uq")
+      .on(table.workspaceId, table.roleKey)
+      .where(sql`${table.kind} = 'policy' and ${table.scope} = 'role'`),
+    target: check(
+      "workspace_instruction_policy_heads_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`,
+    ),
+  }),
+);
+
+export const workspaceInstructionPolicyActivationEvents = pgTable(
+  "workspace_instruction_policy_activation_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    type: text("type").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    oldRevisionId: uuid("old_revision_id"),
+    oldRevision: bigint("old_revision", { mode: "number" }),
+    oldContentHash: text("old_content_hash"),
+    newRevisionId: uuid("new_revision_id").notNull(),
+    newRevision: bigint("new_revision", { mode: "number" }).notNull(),
+    newContentHash: text("new_content_hash").notNull(),
+    actorSubjectId: text("actor_subject_id").notNull(),
+    reason: text("reason").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceActivationVersion: uniqueIndex(
+      "workspace_instruction_policy_events_target_version_uq",
+    ).on(
+      table.workspaceId,
+      table.kind,
+      table.scope,
+      sql`coalesce(${table.roleKey}, '')`,
+      table.activationVersion,
+    ),
+    workspaceTimeline: index("workspace_instruction_policy_events_workspace_time_idx").on(
+      table.workspaceId,
+      table.createdAt,
+      table.id,
+    ),
+    target: check(
+      "workspace_instruction_policy_activation_events_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`,
+    ),
+  }),
+);