@opengeni/db 0.23.0 → 0.26.0

package/dist/{chunk-3UCHDMKG.js → chunk-7WTDI7Y3.js}

@@ -17,6 +17,7 @@ __export(schema_exports, {
   codexRotationSettings: () => codexRotationSettings,
   codexSubscriptionCredentials: () => codexSubscriptionCredentials,
   composerDrafts: () => composerDrafts,
+  connectionDisconnectOperations: () => connectionDisconnectOperations,
   connections: () => connections,
   connectorActionPolicies: () => connectorActionPolicies,
   connectorActionRequests: () => connectorActionRequests,
@@ -180,6 +181,8 @@ var workspaceInstructionPolicyRevisions = pgTable(
   "workspace_instruction_policy_revisions",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     revision: bigint("revision", { mode: "number" }).notNull().default(sql`nextval('workspace_instruction_policy_revision_seq')`),
@@ -195,6 +198,17 @@ var workspaceInstructionPolicyRevisions = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_revisions_workspace_operation_uq").on(table.workspaceId, table.operationId).where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_revisions_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`
+    ),
     workspaceRevision: uniqueIndex(
       "workspace_instruction_policy_revisions_workspace_revision_uq"
     ).on(table.workspaceId, table.revision),
@@ -248,6 +262,8 @@ var workspaceInstructionPolicyActivationEvents = pgTable(
   "workspace_instruction_policy_activation_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     kind: text("kind").notNull(),
@@ -266,6 +282,17 @@ var workspaceInstructionPolicyActivationEvents = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_events_workspace_operation_uq").on(table.workspaceId, table.operationId).where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_events_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`
+    ),
     workspaceActivationVersion: uniqueIndex(
       "workspace_instruction_policy_events_target_version_uq"
     ).on(
@@ -1812,6 +1839,38 @@ var connections = pgTable5(
     )
   })
 );
+var connectionDisconnectOperations = pgTable5(
+  "connection_disconnect_operations",
+  {
+    id: uuid5("id").primaryKey().defaultRandom(),
+    accountId: uuid5("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid5("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid5("connection_id").notNull().references(() => connections.id, { onDelete: "cascade" }),
+    subjectId: text5("subject_id").notNull(),
+    idempotencyKey: text5("idempotency_key").notNull(),
+    expectedVersion: integer5("expected_version").notNull(),
+    resultVersion: integer5("result_version").notNull(),
+    createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceSubjectKey: uniqueIndex5("connection_disconnect_operations_subject_key_uq").on(
+      table.workspaceId,
+      table.subjectId,
+      table.idempotencyKey
+    ),
+    connectionGeneration: uniqueIndex5(
+      "connection_disconnect_operations_connection_generation_uq"
+    ).on(table.workspaceId, table.connectionId, table.expectedVersion),
+    identityValid: check4(
+      "connection_disconnect_operations_identity_check",
+      sql5`length(${table.subjectId}) between 1 and 512
+        and length(${table.idempotencyKey}) between 1 and 200
+        and ${table.idempotencyKey} = btrim(${table.idempotencyKey})
+        and ${table.expectedVersion} > 0
+        and ${table.resultVersion} = ${table.expectedVersion} + 1`
+    )
+  })
+);
 var connectorActionPolicies = pgTable5(
   "connector_action_policies",
   {
@@ -3015,6 +3074,11 @@ var documents = pgTable5(
     sourceUpdatedAt: timestamp5("source_updated_at", { withTimezone: true }),
     sourceVersion: text5("source_version"),
     aclTags: jsonb5("acl_tags").$type().notNull().default([]),
+    // Durable authorization tuple. The workspace_id above remains ingestion
+    // provenance; organization authority deliberately has no workspace owner.
+    authorityKind: text5("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid5("authority_workspace_id"),
+    authoritySubjectId: text5("authority_subject_id"),
     // Per-document access controls. visibility 'private' restricts human reads to
     // created_by (a grant subject id, not a uuid); agent_access=false hides the
     // document from agent retrieval surfaces (docs MCP) while humans keep REST.
@@ -3052,6 +3116,28 @@ var documents = pgTable5(
       table.workspaceId,
       table.curationStatus
     ),
+    authority: index5("documents_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId,
+      table.status
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "documents_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("restrict"),
+    authorityState: check4(
+      "documents_authority_chk",
+      sql5`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ${table.authoritySubjectId} = ${table.createdBy})`
+    ),
+    authorityVisibility: check4(
+      "documents_authority_visibility_chk",
+      sql5`(${table.authorityKind} = 'personal') = (${table.visibility} = 'private')`
+    ),
     visibilityState: check4(
       "documents_visibility_chk",
       sql5`${table.visibility} in ('workspace', 'private')`
@@ -3083,6 +3169,9 @@ var documentChunks = pgTable5(
     chunkIndex: integer5("chunk_index").notNull(),
     text: text5("text").notNull(),
     metadata: jsonb5("metadata").$type().notNull().default({}),
+    authorityKind: text5("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid5("authority_workspace_id"),
+    authoritySubjectId: text5("authority_subject_id"),
     embedding: vector("embedding").notNull(),
     embeddingModel: text5("embedding_model").notNull(),
     createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -3093,7 +3182,24 @@ var documentChunks = pgTable5(
       table.documentId,
       table.chunkIndex
     ),
-    base: index5("document_chunks_workspace_base_idx").on(table.workspaceId, table.baseId)
+    base: index5("document_chunks_workspace_base_idx").on(table.workspaceId, table.baseId),
+    authority: index5("document_chunks_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "document_chunks_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("restrict"),
+    authorityState: check4(
+      "document_chunks_authority_chk",
+      sql5`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024)`
+    )
   })
 );
 var knowledgeMemories = pgTable5(
@@ -6243,6 +6349,7 @@ export {
   codexSubscriptionCredentials,
   codexResetRedemptionAttempts,
   connections,
+  connectionDisconnectOperations,
   connectorActionPolicies,
   slackBotUserLinks,
   slackInteractionInbox,
@@ -6342,4 +6449,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-3UCHDMKG.js.map
+//# sourceMappingURL=chunk-7WTDI7Y3.js.map