@opengeni/db 0.19.0 → 0.21.0

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-XOXEQ7HG.js";
+} from "./chunk-OTJHD33E.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -4,7 +4,7 @@ import type { Database, RlsStrategy } from "./index";
  * FORCE-RLS table is an architectural change: update this list in the same
  * commit as the migration so startup cannot silently accept an unreviewed gap.
  */
-export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
+export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_lifecycle_events", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
 /**
  * Deployment-global and authentication tables used by ordinary API/worker
  * traffic. They intentionally do not carry workspace RLS: their access model
@@ -18,9 +18,9 @@ export declare const NON_RLS_RUNTIME_TABLES: readonly ["auth_identities", "auth_
  */
 export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "import_batches", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "machine_metrics_latest", "machine_metrics_series", "managed_accounts", "model_call_facts", "new_session_drafts", "pack_installations", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "usage_events", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspaces"];
 /** Configuration and lifecycle-owned audit rows are read-only at runtime. */
-export declare const RUNTIME_READ_ONLY_TABLES: readonly ["knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots"];
+export declare const RUNTIME_READ_ONLY_TABLES: readonly ["knowledge_lifecycle_events", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots"];
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */
-export declare const RUNTIME_READ_INSERT_TABLES: readonly ["preference_registry_preferences", "preference_registry_revisions", "session_spawn_denials", "workspace_artifact_events", "workspace_artifact_versions", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_revisions"];
+export declare const RUNTIME_READ_INSERT_TABLES: readonly ["knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "preference_registry_preferences", "preference_registry_revisions", "session_spawn_denials", "workspace_artifact_events", "workspace_artifact_versions", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_revisions"];
 /**
  * These FORCE-RLS tables are owned by security-definer host-export routines.
  * The ordinary application role must have no direct table privileges on them.

package/dist/schema.d.ts

@@ -6483,6 +6483,37 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
         }, {}, {
             $type: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "variable_set_list" | "variable_set_set_variable")[];
         }>;
+        initialPersonalConnectionDelegations: import("drizzle-orm/pg-core").PgColumn<{
+            name: "initial_personal_connection_delegations";
+            tableName: "sessions";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+        }>;
         toolPolicy: import("drizzle-orm/pg-core").PgColumn<{
             name: "tool_policy";
             tableName: "sessions";
@@ -6542,6 +6573,23 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        parentTurnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "parent_turn_id";
+            tableName: "sessions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createIdempotencyKey: import("drizzle-orm/pg-core").PgColumn<{
             name: "create_idempotency_key";
             tableName: "sessions";
@@ -10267,6 +10315,37 @@ export declare const sessionTurns: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        personalConnectionDelegations: import("drizzle-orm/pg-core").PgColumn<{
+            name: "personal_connection_delegations";
+            tableName: "session_turns";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+        }>;
         cancelledBy: import("drizzle-orm/pg-core").PgColumn<{
             name: "cancelled_by";
             tableName: "session_turns";
@@ -12255,6 +12334,37 @@ export declare const sessionSystemUpdates: import("drizzle-orm/pg-core").PgTable
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        personalConnectionDelegations: import("drizzle-orm/pg-core").PgColumn<{
+            name: "personal_connection_delegations";
+            tableName: "session_system_updates";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+        }>;
         state: import("drizzle-orm/pg-core").PgColumn<{
             name: "state";
             tableName: "session_system_updates";
@@ -12561,6 +12671,37 @@ export declare const sessionSystemUpdateOutbox: import("drizzle-orm/pg-core").Pg
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        personalConnectionDelegations: import("drizzle-orm/pg-core").PgColumn<{
+            name: "personal_connection_delegations";
+            tableName: "session_system_update_outbox";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+        }>;
         status: import("drizzle-orm/pg-core").PgColumn<{
             name: "status";
             tableName: "session_system_update_outbox";
@@ -20096,6 +20237,90 @@ export declare const scheduledTasks: import("drizzle-orm/pg-core").PgTableWithCo
         }, {}, {
             $type: unknown;
         }>;
+        createdByKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_kind";
+            tableName: "scheduled_tasks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_subject_id";
+            tableName: "scheduled_tasks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdByContext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by_context";
+            tableName: "scheduled_tasks";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        personalConnectionDelegations: import("drizzle-orm/pg-core").PgColumn<{
+            name: "personal_connection_delegations";
+            tableName: "scheduled_tasks";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                serverId: string;
+                connectionId: string;
+                ownerSubjectId: string;
+                providerDomain: string;
+                kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            }[];
+        }>;
         reusableSessionId: import("drizzle-orm/pg-core").PgColumn<{
             name: "reusable_session_id";
             tableName: "scheduled_tasks";
@@ -25612,3 +25837,4 @@ export declare const rigChanges: import("drizzle-orm/pg-core").PgTableWithColumn
 export * from "./workspace-instruction-policies-schema";
 export * from "./preference-registry-schema";
 export * from "./memory-governance-schema";
+export * from "./scoped-knowledge-schema";

package/dist/schema.js

@@ -34,9 +34,25 @@ import {
   importBatches,
   integrationOauthClients,
   integrationOauthStateNonces,
+  knowledgeChangeProposals,
+  knowledgeClaimEvidence,
+  knowledgeClaimRelations,
+  knowledgeClaimReviews,
+  knowledgeClaims,
+  knowledgeDocumentVersions,
+  knowledgeEntities,
+  knowledgeEntityAliases,
+  knowledgeFacts,
+  knowledgeLifecycleEvents,
   knowledgeMemories,
   knowledgeMemoryLifecycleEvents,
   knowledgeMemoryRelationships,
+  knowledgeOperationReceipts,
+  knowledgeProviders,
+  knowledgeSourceAclVersions,
+  knowledgeSourceObjects,
+  knowledgeSources,
+  knowledgeSyncRuns,
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,
@@ -114,7 +130,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-SZP6KRLC.js";
+} from "./chunk-NK2A36KP.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -152,9 +168,25 @@ export {
   importBatches,
   integrationOauthClients,
   integrationOauthStateNonces,
+  knowledgeChangeProposals,
+  knowledgeClaimEvidence,
+  knowledgeClaimRelations,
+  knowledgeClaimReviews,
+  knowledgeClaims,
+  knowledgeDocumentVersions,
+  knowledgeEntities,
+  knowledgeEntityAliases,
+  knowledgeFacts,
+  knowledgeLifecycleEvents,
   knowledgeMemories,
   knowledgeMemoryLifecycleEvents,
   knowledgeMemoryRelationships,
+  knowledgeOperationReceipts,
+  knowledgeProviders,
+  knowledgeSourceAclVersions,
+  knowledgeSourceObjects,
+  knowledgeSources,
+  knowledgeSyncRuns,
   machineMetricsLatest,
   machineMetricsSeries,
   managedAccounts,