@opengeni/db 0.22.2 → 0.23.0

package/dist/workspace-instruction-policies-schema.d.ts

@@ -733,3 +733,242 @@ export declare const workspaceInstructionPolicyActivationEvents: import("drizzle
     };
     dialect: 'pg';
 }>;
+export declare const workspaceInstructionPolicySnapshots: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspace_instruction_policy_snapshots";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        turnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "turn_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attemptId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempt_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        executionGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "execution_generation";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        policyRole: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_role";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleSource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_source";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entries: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entries";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                kind: "charter" | "policy";
+                scope: "global" | "role";
+                roleKey: string | null;
+                revisionId: string;
+                revision: number;
+                contentHash: string;
+                activationVersion: number;
+                activatedAt: string;
+                provenance: {
+                    source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+                    sourceIdHash: string | null;
+                };
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                kind: "charter" | "policy";
+                scope: "global" | "role";
+                roleKey: string | null;
+                revisionId: string;
+                revision: number;
+                contentHash: string;
+                activationVersion: number;
+                activatedAt: string;
+                provenance: {
+                    source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+                    sourceIdHash: string | null;
+                };
+            }[];
+        }>;
+        entryHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry_hash";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;

package/dist/workspace-instruction-policies.d.ts

@@ -29,6 +29,17 @@ export declare class WorkspaceInstructionPolicyLegacyUnavailableError extends Er
     readonly name = "WorkspaceInstructionPolicyLegacyUnavailableError";
     constructor();
 }
+export declare class WorkspaceInstructionPolicySnapshotAuthorityError extends Error {
+    readonly name = "WorkspaceInstructionPolicySnapshotAuthorityError";
+}
+export type WorkspaceInstructionPolicyAttemptClaims = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
 export declare function createWorkspaceInstructionPolicyDraft(db: Database, input: CallerDraftInput): Promise<WorkspaceInstructionPolicyRevision>;
 /** Import only the stored legacy override; never materialize a deployment default or activate it. */
 export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database, input: {
@@ -61,4 +72,37 @@ export declare function rollbackWorkspaceInstructionPolicyRevision(db: Database,
     actorSubjectId: string;
     reason: string;
 }): Promise<WorkspaceInstructionPolicyActivationResponse>;
+/**
+ * Freeze (or replay) the exact active charter/global/role policy set for one
+ * accepted attempt, then resolve only those immutable revisions. The snapshot
+ * stores bounded descriptors/hashes; full policy text remains in the revision
+ * table and cannot be widened by a later head activation.
+ */
+export declare function getOrCreateWorkspaceInstructionPolicySnapshot(db: Database, claims: WorkspaceInstructionPolicyAttemptClaims): Promise<{
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    policyRole: string | null;
+    roleSource: "invalid_metadata_fallback" | "metadata_fallback" | "none" | "session_binding";
+    entryHash: string;
+    createdAt: string;
+    entries: {
+        kind: "charter" | "policy";
+        scope: "global" | "role";
+        roleKey: string | null;
+        revisionId: string;
+        revision: number;
+        contentHash: string;
+        activationVersion: number;
+        activatedAt: string;
+        provenance: {
+            source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+            sourceIdHash: string | null;
+        };
+        content: string;
+    }[];
+}>;
 export {};

package/drizzle/0156_slack_reaction_trigger.sql

@@ -0,0 +1,49 @@
+-- deployment-mode: rolling
+-- Admit the optional Slack emoji-reaction summon source into the existing
+-- durable interaction inbox. Older writers use only the existing subset, so
+-- this CHECK expansion is mixed-version compatible.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "slack_interaction_inbox"
+  DROP CONSTRAINT "slack_interaction_inbox_trigger_check";
+
+ALTER TABLE "slack_interaction_inbox"
+  ADD CONSTRAINT "slack_interaction_inbox_trigger_check"
+  CHECK (
+    "trigger_kind" IN (
+      'app_mention',
+      'dm',
+      'reaction',
+      'slash_command',
+      'message_shortcut',
+      'thread_reply'
+    )
+  ) NOT VALID;
+
+ALTER TABLE "slack_interaction_inbox"
+  VALIDATE CONSTRAINT "slack_interaction_inbox_trigger_check";
+
+-- A rate-limited conversations.replies traversal must resume at the exact next
+-- cursor instead of consuming the next one-request-per-minute allowance by
+-- refetching page one. The payload is application-authenticated and bounded;
+-- this database constraint additionally prevents terminal/non-reaction rows
+-- from retaining checkpoint material.
+ALTER TABLE "slack_interaction_inbox"
+  ADD COLUMN "reaction_context_checkpoint" jsonb;
+
+ALTER TABLE "slack_interaction_inbox"
+  ADD CONSTRAINT "slack_interaction_inbox_reaction_checkpoint_check"
+  CHECK (
+    "reaction_context_checkpoint" IS NULL
+    OR (
+      "trigger_kind" = 'reaction'
+      AND "status" IN ('pending', 'processing')
+      AND jsonb_typeof("reaction_context_checkpoint") = 'object'
+      AND octet_length("reaction_context_checkpoint"::text) <= 131072
+    )
+  ) NOT VALID;
+
+ALTER TABLE "slack_interaction_inbox"
+  VALIDATE CONSTRAINT "slack_interaction_inbox_reaction_checkpoint_check";