@opengeni/db 0.17.1 → 0.19.0

package/dist/memory-governance.d.ts

@@ -0,0 +1,41 @@
+import type { Database } from "./index";
+import { type MemoryOperationPlanInput, type MemoryRevertPlanInput } from "./memory-domain";
+export declare class MemoryGovernanceAuthorityError extends Error {
+    readonly name = "MemoryGovernanceAuthorityError";
+}
+export type MemoryGovernanceDirectSubjectAuthority = {
+    kind: "subject";
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+};
+export type MemoryGovernanceDirectServiceAuthority = {
+    kind: "service";
+    accountId: string;
+    workspaceId: string;
+    serviceId: string;
+};
+export type MemoryGovernanceAttemptAuthority = {
+    kind: "attempt";
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
+export type MemoryGovernanceAuthority = MemoryGovernanceDirectSubjectAuthority | MemoryGovernanceDirectServiceAuthority | MemoryGovernanceAttemptAuthority;
+export declare function applyKnowledgeMemoryOperation(db: Database, input: {
+    authority: MemoryGovernanceAuthority;
+    plan: MemoryOperationPlanInput;
+}): Promise<{
+    eventId: string;
+    planHash: string;
+}>;
+export declare function revertKnowledgeMemoryOperation(db: Database, input: {
+    authority: MemoryGovernanceAuthority;
+    plan: MemoryRevertPlanInput;
+}): Promise<{
+    eventId: string;
+    planHash: string;
+}>;

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-T6RSJT6C.js";
+} from "./chunk-XOXEQ7HG.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -4,7 +4,7 @@ import type { Database, RlsStrategy } from "./index";
  * FORCE-RLS table is an architectural change: update this list in the same
  * commit as the migration so startup cannot silently accept an unreviewed gap.
  */
-export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_memories", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
+export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
 /**
  * Deployment-global and authentication tables used by ordinary API/worker
  * traffic. They intentionally do not carry workspace RLS: their access model
@@ -18,7 +18,7 @@ export declare const NON_RLS_RUNTIME_TABLES: readonly ["auth_identities", "auth_
  */
 export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "import_batches", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "machine_metrics_latest", "machine_metrics_series", "managed_accounts", "model_call_facts", "new_session_drafts", "pack_installations", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "usage_events", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspaces"];
 /** Configuration and lifecycle-owned audit rows are read-only at runtime. */
-export declare const RUNTIME_READ_ONLY_TABLES: readonly ["nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots"];
+export declare const RUNTIME_READ_ONLY_TABLES: readonly ["knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots"];
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */
 export declare const RUNTIME_READ_INSERT_TABLES: readonly ["preference_registry_preferences", "preference_registry_revisions", "session_spawn_denials", "workspace_artifact_events", "workspace_artifact_versions", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_revisions"];
 /**

package/dist/schema.d.ts

@@ -3834,6 +3834,23 @@ export declare const slackInteractionInbox: import("drizzle-orm/pg-core").PgTabl
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        retryAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retry_at";
+            tableName: "slack_interaction_inbox";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         lastErrorCode: import("drizzle-orm/pg-core").PgColumn<{
             name: "last_error_code";
             tableName: "slack_interaction_inbox";
@@ -4183,6 +4200,57 @@ export declare const slackInteractions: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        deliveryAttemptCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery_attempt_count";
+            tableName: "slack_interactions";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deliveryRetryAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery_retry_at";
+            tableName: "slack_interactions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deliveryLastErrorCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "delivery_last_error_code";
+            tableName: "slack_interactions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         ackSlackMessageTs: import("drizzle-orm/pg-core").PgColumn<{
             name: "ack_slack_message_ts";
             tableName: "slack_interactions";
@@ -6401,7 +6469,7 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
             tableName: "sessions";
             dataType: "json";
             columnType: "PgJsonb";
-            data: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_posts_recent" | "variable_set_list" | "variable_set_set_variable")[];
+            data: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "variable_set_list" | "variable_set_set_variable")[];
             driverParam: unknown;
             notNull: true;
             hasDefault: false;
@@ -6413,7 +6481,7 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_posts_recent" | "variable_set_list" | "variable_set_set_variable")[];
+            $type: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "variable_set_list" | "variable_set_set_variable")[];
         }>;
         toolPolicy: import("drizzle-orm/pg-core").PgColumn<{
             name: "tool_policy";
@@ -9474,6 +9542,204 @@ export declare const knowledgeMemories: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        scopeType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_type";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopeSubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_subject_id";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopeRoleKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_role_key";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scopeSessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope_session_id";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        namespace: import("drizzle-orm/pg-core").PgColumn<{
+            name: "namespace_key";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        labels: import("drizzle-orm/pg-core").PgColumn<{
+            name: "labels";
+            tableName: "knowledge_memories";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "labels";
+                tableName: "knowledge_memories";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "labels";
+                dataType: 'string';
+                columnType: 'PgText';
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        memoryVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "memory_version";
+            tableName: "knowledge_memories";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_kind";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_subject_id";
+            tableName: "knowledge_memories";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByContext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_context";
+            tableName: "knowledge_memories";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
         textHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "text_hash";
             tableName: "knowledge_memories";
@@ -24387,6 +24653,23 @@ export declare const socialConnections: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        credentialEncrypted: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_encrypted";
+            tableName: "social_connections";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         tokenMetadata: import("drizzle-orm/pg-core").PgColumn<{
             name: "token_metadata";
             tableName: "social_connections";
@@ -25328,3 +25611,4 @@ export declare const rigChanges: import("drizzle-orm/pg-core").PgTableWithColumn
 }>;
 export * from "./workspace-instruction-policies-schema";
 export * from "./preference-registry-schema";
+export * from "./memory-governance-schema";

package/dist/schema.js

@@ -35,6 +35,8 @@ import {
   integrationOauthClients,
   integrationOauthStateNonces,
   knowledgeMemories,
+  knowledgeMemoryLifecycleEvents,
+  knowledgeMemoryRelationships,
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
@@ -112,7 +114,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-TLAC622R.js";
+} from "./chunk-SZP6KRLC.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -151,6 +153,8 @@ export {
   integrationOauthClients,
   integrationOauthStateNonces,
   knowledgeMemories,
+  knowledgeMemoryLifecycleEvents,
+  knowledgeMemoryRelationships,
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,

package/drizzle/0141_social_connection_credentials.sql

@@ -0,0 +1,8 @@
+-- deployment-mode: rolling
+-- First-party social connectors (X / Reddit): OAuth token storage.
+-- credential_encrypted holds the AES-256-GCM envelope (environment-crypto v1
+-- format) with the provider token bundle {access_token, refresh_token, ...}.
+-- It is deliberately separate from credential_ref (a free-text external
+-- reference) and never surfaced by the SocialConnection contract mapper.
+
+ALTER TABLE "social_connections" ADD COLUMN IF NOT EXISTS "credential_encrypted" text;

package/drizzle/0151_slack_delivery_backoff.sql

@@ -0,0 +1,134 @@
+-- deployment-mode: rolling
+SET lock_timeout = '5s';
+SET statement_timeout = '30s';
+
+ALTER TABLE slack_interactions
+  ADD COLUMN delivery_attempt_count integer NOT NULL DEFAULT 0,
+  ADD COLUMN delivery_retry_at timestamptz,
+  ADD COLUMN delivery_last_error_code text;
+
+ALTER TABLE slack_interactions
+  ADD CONSTRAINT slack_interactions_delivery_attempt_check
+    CHECK (delivery_attempt_count >= 0),
+  ADD CONSTRAINT slack_interactions_delivery_error_check
+    CHECK (
+      delivery_last_error_code IS NULL
+      OR octet_length(delivery_last_error_code) BETWEEN 1 AND 128
+    );
+
+ALTER TABLE slack_interaction_inbox
+  ADD COLUMN retry_at timestamptz;
+
+DROP INDEX slack_interaction_inbox_pending_idx;
+CREATE INDEX slack_interaction_inbox_pending_idx
+  ON slack_interaction_inbox (status, retry_at, created_at, id)
+  WHERE status IN ('pending', 'processing');
+
+DROP INDEX slack_interactions_delivery_idx;
+CREATE INDEX slack_interactions_delivery_idx
+  ON slack_interactions (terminal_delivery_state, delivery_retry_at, updated_at, id)
+  WHERE session_id IS NOT NULL AND terminal_delivery_state = 'open';
+
+DO $privileged_functions$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_slack_interaction_inbox(
+      p_holder uuid,
+      p_lease_ms integer
+    )
+    RETURNS SETOF %1$I.slack_interaction_inbox
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_lease_ms < 1000 OR p_lease_ms > 300000 THEN
+        RAISE EXCEPTION 'invalid Slack inbox claim lease';
+      END IF;
+      RETURN QUERY
+      WITH candidate AS (
+        SELECT I.id
+        FROM %1$I.slack_interaction_inbox I
+        WHERE (
+            I.status = 'pending'
+            AND (I.retry_at IS NULL OR I.retry_at <= now())
+          ) OR (
+            I.status = 'processing'
+            AND I.claim_expires_at <= now()
+          )
+        ORDER BY I.retry_at NULLS FIRST, I.created_at, I.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT 1
+      )
+      UPDATE %1$I.slack_interaction_inbox I
+      SET status = 'processing',
+          claim_holder_id = p_holder,
+          claim_expires_at = now() + make_interval(secs => p_lease_ms::double precision / 1000),
+          retry_at = NULL,
+          attempt_count = I.attempt_count + 1,
+          updated_at = now()
+      FROM candidate C
+      WHERE I.id = C.id
+      RETURNING I.*;
+    END
+    $function$
+  $ddl$, data_schema);
+
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_slack_interaction_delivery(
+      p_holder uuid,
+      p_lease_ms integer
+    )
+    RETURNS SETOF %1$I.slack_interactions
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_lease_ms < 1000 OR p_lease_ms > 300000 THEN
+        RAISE EXCEPTION 'invalid Slack delivery claim lease';
+      END IF;
+      RETURN QUERY
+      WITH candidate AS (
+        SELECT I.id
+        FROM %1$I.slack_interactions I
+        WHERE I.session_id IS NOT NULL
+          AND I.terminal_delivery_state = 'open'
+          AND (I.delivery_retry_at IS NULL OR I.delivery_retry_at <= now())
+          AND (I.delivery_claim_holder_id IS NULL OR I.delivery_claim_expires_at <= now())
+          AND EXISTS (
+            SELECT 1
+            FROM %1$I.session_events E
+            WHERE E.workspace_id = I.workspace_id
+              AND E.session_id = I.session_id
+              AND E.sequence > I.last_delivered_session_event_sequence
+              AND E.type IN (
+                'agent.message.completed',
+                'session.humanInput.requested',
+                'turn.completed',
+                'turn.failed',
+                'turn.cancelled',
+                'session.status.changed'
+              )
+          )
+        ORDER BY I.delivery_retry_at NULLS FIRST, I.updated_at, I.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT 1
+      )
+      UPDATE %1$I.slack_interactions I
+      SET delivery_claim_holder_id = p_holder,
+          delivery_claim_expires_at = now() + make_interval(secs => p_lease_ms::double precision / 1000),
+          delivery_attempt_count = I.delivery_attempt_count + 1,
+          updated_at = now()
+      FROM candidate C
+      WHERE I.id = C.id
+      RETURNING I.*;
+    END
+    $function$
+  $ddl$, data_schema);
+END
+$privileged_functions$;
+
+RESET statement_timeout;
+RESET lock_timeout;