@opengeni/db 0.22.2 → 0.26.0

package/dist/workspace-instruction-policies-schema.d.ts

@@ -19,6 +19,40 @@ export declare const workspaceInstructionPolicyRevisions: import("drizzle-orm/pg
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        operationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "operation_id";
+            tableName: "workspace_instruction_policy_revisions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "workspace_instruction_policy_revisions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         accountId: import("drizzle-orm/pg-core").PgColumn<{
             name: "account_id";
             tableName: "workspace_instruction_policy_revisions";
@@ -458,6 +492,40 @@ export declare const workspaceInstructionPolicyActivationEvents: import("drizzle
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        operationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "operation_id";
+            tableName: "workspace_instruction_policy_activation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "workspace_instruction_policy_activation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         accountId: import("drizzle-orm/pg-core").PgColumn<{
             name: "account_id";
             tableName: "workspace_instruction_policy_activation_events";
@@ -733,3 +801,242 @@ export declare const workspaceInstructionPolicyActivationEvents: import("drizzle
     };
     dialect: 'pg';
 }>;
+export declare const workspaceInstructionPolicySnapshots: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspace_instruction_policy_snapshots";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        turnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "turn_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attemptId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempt_id";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        executionGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "execution_generation";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        policyRole: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_role";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleSource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_source";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entries: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entries";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: {
+                kind: "charter" | "policy";
+                scope: "global" | "role";
+                roleKey: string | null;
+                revisionId: string;
+                revision: number;
+                contentHash: string;
+                activationVersion: number;
+                activatedAt: string;
+                provenance: {
+                    source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+                    sourceIdHash: string | null;
+                };
+            }[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                kind: "charter" | "policy";
+                scope: "global" | "role";
+                roleKey: string | null;
+                revisionId: string;
+                revision: number;
+                contentHash: string;
+                activationVersion: number;
+                activatedAt: string;
+                provenance: {
+                    source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+                    sourceIdHash: string | null;
+                };
+            }[];
+        }>;
+        entryHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry_hash";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workspace_instruction_policy_snapshots";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;

package/dist/workspace-instruction-policies.d.ts

@@ -1,6 +1,8 @@
+import { WorkspaceInstructionPolicySnapshot } from "@opengeni/contracts";
 import type { WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyDraftProvenanceSource, WorkspaceInstructionPolicyHead, WorkspaceInstructionPolicyListQuery, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyRevision, WorkspaceInstructionPolicyTarget } from "@opengeni/contracts";
 import type { Database } from "./index";
-type DraftInput = WorkspaceInstructionPolicyTarget & {
+type DraftRequestInput = WorkspaceInstructionPolicyTarget & {
+    operationId: string;
     accountId: string;
     workspaceId: string;
     content: string;
@@ -9,15 +11,28 @@ type DraftInput = WorkspaceInstructionPolicyTarget & {
     supersedesRevisionId: string | null;
     createdBySubjectId: string;
 };
-type CallerDraftInput = Omit<DraftInput, "provenanceSource"> & {
+type CallerDraftInput = Omit<DraftRequestInput, "operationId" | "provenanceSource"> & {
+    operationId?: string;
     provenanceSource: WorkspaceInstructionPolicyDraftProvenanceSource;
 };
+type ImportLegacyRequestInput = {
+    operationId: string;
+    accountId: string;
+    workspaceId: string;
+    createdBySubjectId: string;
+    supersedesRevisionId: string | null;
+};
 export declare class WorkspaceInstructionPolicyConflictError extends Error {
     readonly currentHead: WorkspaceInstructionPolicyHead | null;
     readonly name = "WorkspaceInstructionPolicyConflictError";
     readonly code = "WORKSPACE_INSTRUCTION_POLICY_CONFLICT";
     constructor(currentHead: WorkspaceInstructionPolicyHead | null);
 }
+export declare class WorkspaceInstructionPolicyOperationReuseError extends Error {
+    readonly name = "WorkspaceInstructionPolicyOperationReuseError";
+    readonly code = "WORKSPACE_INSTRUCTION_POLICY_OPERATION_REUSED";
+    constructor();
+}
 export declare class WorkspaceInstructionPolicyNotFoundError extends Error {
     readonly name = "WorkspaceInstructionPolicyNotFoundError";
     constructor(message?: string);
@@ -29,13 +44,51 @@ export declare class WorkspaceInstructionPolicyLegacyUnavailableError extends Er
     readonly name = "WorkspaceInstructionPolicyLegacyUnavailableError";
     constructor();
 }
-export declare function createWorkspaceInstructionPolicyDraft(db: Database, input: CallerDraftInput): Promise<WorkspaceInstructionPolicyRevision>;
-/** Import only the stored legacy override; never materialize a deployment default or activate it. */
-export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database, input: {
+export declare class WorkspaceInstructionPolicySnapshotAuthorityError extends Error {
+    readonly name = "WorkspaceInstructionPolicySnapshotAuthorityError";
+}
+export type WorkspaceInstructionPolicyAttemptClaims = {
     accountId: string;
     workspaceId: string;
-    createdBySubjectId: string;
-    supersedesRevisionId: string | null;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
+export type WorkspaceStateAcceptedAttemptGovernance = {
+    attemptId: string;
+    executionGeneration: number;
+    acceptedAt: string;
+    policySnapshot: WorkspaceInstructionPolicySnapshot | null;
+    preferenceSnapshot: {
+        id: string;
+        descriptorHash: string;
+        descriptors: Array<{
+            id: string;
+            revisionId: string;
+            contentHash: string;
+            activeVersion: number;
+            scope: "organization" | "workspace" | "user";
+        }>;
+        truncated: boolean;
+        createdAt: string;
+    } | null;
+};
+/**
+ * Inspect one immutable accepted attempt only when the authenticated caller is
+ * exactly its frozen initiating human. The null result deliberately conflates
+ * absence, cross-account/workspace lookup, and another subject's attempt.
+ */
+export declare function getWorkspaceStateAcceptedAttemptGovernance(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    attemptId: string;
+}): Promise<WorkspaceStateAcceptedAttemptGovernance | null>;
+export declare function createWorkspaceInstructionPolicyDraft(db: Database, input: CallerDraftInput): Promise<WorkspaceInstructionPolicyRevision>;
+/** Import only the stored legacy override; never materialize a deployment default or activate it. */
+export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database, input: Omit<ImportLegacyRequestInput, "operationId"> & {
+    operationId?: string;
 }): Promise<WorkspaceInstructionPolicyRevision>;
 export declare function listWorkspaceInstructionPolicyRevisions(db: Database, workspaceId: string, query: WorkspaceInstructionPolicyListQuery): Promise<WorkspaceInstructionPolicyListResponse>;
 export declare function getWorkspaceInstructionPolicyRevision(db: Database, workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
@@ -46,19 +99,56 @@ export declare function diffWorkspaceInstructionPolicyRevisions(db: Database, wo
     toRevisionId: string;
 }): Promise<WorkspaceInstructionPolicyDiffResponse>;
 export declare function activateWorkspaceInstructionPolicyRevision(db: Database, input: {
+    operationId?: string;
     accountId: string;
     workspaceId: string;
     revisionId: string;
     expectedCurrentRevisionId: string | null;
+    expectedActivationVersion?: number;
     actorSubjectId: string;
     reason: string;
 }): Promise<WorkspaceInstructionPolicyActivationResponse>;
 export declare function rollbackWorkspaceInstructionPolicyRevision(db: Database, input: {
+    operationId?: string;
     accountId: string;
     workspaceId: string;
     targetRevisionId: string;
     expectedCurrentRevisionId: string;
+    expectedActivationVersion?: number;
     actorSubjectId: string;
     reason: string;
 }): Promise<WorkspaceInstructionPolicyActivationResponse>;
+/**
+ * Freeze (or replay) the exact active charter/global/role policy set for one
+ * accepted attempt, then resolve only those immutable revisions. The snapshot
+ * stores bounded descriptors/hashes; full policy text remains in the revision
+ * table and cannot be widened by a later head activation.
+ */
+export declare function getOrCreateWorkspaceInstructionPolicySnapshot(db: Database, claims: WorkspaceInstructionPolicyAttemptClaims): Promise<{
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    policyRole: string | null;
+    roleSource: "invalid_metadata_fallback" | "metadata_fallback" | "none" | "session_binding";
+    entryHash: string;
+    createdAt: string;
+    entries: {
+        kind: "charter" | "policy";
+        scope: "global" | "role";
+        roleKey: string | null;
+        revisionId: string;
+        revision: number;
+        contentHash: string;
+        activationVersion: number;
+        activatedAt: string;
+        provenance: {
+            source: "human" | "knowledge_proposal" | "legacy_import" | "onboarding";
+            sourceIdHash: string | null;
+        };
+        content: string;
+    }[];
+}>;
 export {};

package/drizzle/0156_slack_reaction_trigger.sql

@@ -0,0 +1,49 @@
+-- deployment-mode: rolling
+-- Admit the optional Slack emoji-reaction summon source into the existing
+-- durable interaction inbox. Older writers use only the existing subset, so
+-- this CHECK expansion is mixed-version compatible.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "slack_interaction_inbox"
+  DROP CONSTRAINT "slack_interaction_inbox_trigger_check";
+
+ALTER TABLE "slack_interaction_inbox"
+  ADD CONSTRAINT "slack_interaction_inbox_trigger_check"
+  CHECK (
+    "trigger_kind" IN (
+      'app_mention',
+      'dm',
+      'reaction',
+      'slash_command',
+      'message_shortcut',
+      'thread_reply'
+    )
+  ) NOT VALID;
+
+ALTER TABLE "slack_interaction_inbox"
+  VALIDATE CONSTRAINT "slack_interaction_inbox_trigger_check";
+
+-- A rate-limited conversations.replies traversal must resume at the exact next
+-- cursor instead of consuming the next one-request-per-minute allowance by
+-- refetching page one. The payload is application-authenticated and bounded;
+-- this database constraint additionally prevents terminal/non-reaction rows
+-- from retaining checkpoint material.
+ALTER TABLE "slack_interaction_inbox"
+  ADD COLUMN "reaction_context_checkpoint" jsonb;
+
+ALTER TABLE "slack_interaction_inbox"
+  ADD CONSTRAINT "slack_interaction_inbox_reaction_checkpoint_check"
+  CHECK (
+    "reaction_context_checkpoint" IS NULL
+    OR (
+      "trigger_kind" = 'reaction'
+      AND "status" IN ('pending', 'processing')
+      AND jsonb_typeof("reaction_context_checkpoint") = 'object'
+      AND octet_length("reaction_context_checkpoint"::text) <= 131072
+    )
+  ) NOT VALID;
+
+ALTER TABLE "slack_interaction_inbox"
+  VALIDATE CONSTRAINT "slack_interaction_inbox_reaction_checkpoint_check";