@opengeni/db 0.23.0 → 0.26.0

package/dist/preference-registry.d.ts

@@ -126,6 +126,20 @@ export declare function listPreferenceRegistry(db: Database, input: {
         updatedAt: string;
     }[];
 }>;
+export type PreferenceRegistryGovernanceIdentity = Pick<PreferenceRegistryDescriptor, "id" | "revisionId" | "contentHash" | "activeVersion" | "scope">;
+export type CurrentPreferenceRegistryGovernanceMetadata = {
+    descriptors: PreferenceRegistryGovernanceIdentity[];
+    truncated: boolean;
+};
+/**
+ * Read the current active descriptor identities for one exact authenticated
+ * subject. Full preference values and even descriptor display text stay inside
+ * this DB boundary; Workspace State receives only stable revision metadata.
+ */
+export declare function getCurrentPreferenceRegistryGovernanceMetadata(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+}): Promise<CurrentPreferenceRegistryGovernanceMetadata>;
 export declare function listPreferenceRegistryForAttempt(db: Database, input: PreferenceRegistryAttemptClaims & PreferenceRegistryListInput): Promise<{
     preferences: {
         id: string;

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-L6ADMZHE.js";
+} from "./chunk-KW6U54V2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -4,7 +4,7 @@ import type { Database, RlsStrategy } from "./index";
  * FORCE-RLS table is an architectural change: update this list in the same
  * commit as the migration so startup cannot silently accept an unreviewed gap.
  */
-export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_lifecycle_events", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_instruction_policy_snapshots", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
+export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "import_batches", "integration_oauth_state_nonces", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_lifecycle_events", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "machine_metrics_latest", "machine_metrics_series", "model_call_facts", "new_session_drafts", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "usage_events", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_revisions", "workspace_instruction_policy_snapshots", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets"];
 /**
  * Deployment-global and authentication tables used by ordinary API/worker
  * traffic. They intentionally do not carry workspace RLS: their access model
@@ -16,7 +16,7 @@ export declare const NON_RLS_RUNTIME_TABLES: readonly ["auth_identities", "auth_
  * explicit instead of being derived from FORCE_RLS_TABLES: adding a protected
  * table must not silently grant it broader DML than its migration intended.
  */
-export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "import_batches", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "machine_metrics_latest", "machine_metrics_series", "managed_accounts", "model_call_facts", "new_session_drafts", "pack_installations", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "usage_events", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspaces"];
+export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "capability_catalog_items", "capability_installations", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "enrollments", "file_uploads", "files", "github_installation_repositories", "github_installations", "import_batches", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "machine_metrics_latest", "machine_metrics_series", "managed_accounts", "model_call_facts", "new_session_drafts", "pack_installations", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "usage_events", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspaces"];
 /** Configuration and lifecycle-owned audit rows are read-only at runtime. */
 export declare const RUNTIME_READ_ONLY_TABLES: readonly ["knowledge_lifecycle_events", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots", "workspace_instruction_policy_snapshots"];
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */

package/dist/schema.d.ts

@@ -3370,6 +3370,166 @@ export declare const connections: import("drizzle-orm/pg-core").PgTableWithColum
     };
     dialect: 'pg';
 }>;
+export declare const connectionDisconnectOperations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "connection_disconnect_operations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        connectionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "connection_id";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        subjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject_id";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        idempotencyKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "idempotency_key";
+            tableName: "connection_disconnect_operations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expectedVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expected_version";
+            tableName: "connection_disconnect_operations";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resultVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "result_version";
+            tableName: "connection_disconnect_operations";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "connection_disconnect_operations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 export declare const connectorActionPolicies: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "connector_action_policies";
     schema: undefined;
@@ -10184,6 +10344,57 @@ export declare const documents: import("drizzle-orm/pg-core").PgTableWithColumns
         }, {}, {
             $type: string[];
         }>;
+        authorityKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_kind";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityWorkspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_workspace_id";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authoritySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_subject_id";
+            tableName: "documents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         visibility: import("drizzle-orm/pg-core").PgColumn<{
             name: "visibility";
             tableName: "documents";
@@ -10503,6 +10714,57 @@ export declare const documentChunks: import("drizzle-orm/pg-core").PgTableWithCo
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        authorityKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_kind";
+            tableName: "document_chunks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authorityWorkspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_workspace_id";
+            tableName: "document_chunks";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        authoritySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "authority_subject_id";
+            tableName: "document_chunks";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         embedding: import("drizzle-orm/pg-core").PgColumn<{
             name: "embedding";
             tableName: "document_chunks";
@@ -16670,8 +16932,6 @@ export declare const sessionHumanInputRequests: import("drizzle-orm/pg-core").Pg
                 required: boolean;
                 allowOther: boolean;
                 validation?: {
-                    minLength?: number | null | undefined;
-                    maxLength?: number | null | undefined;
                     minSelections?: number | null | undefined;
                     maxSelections?: number | null | undefined;
                 } | null | undefined;
@@ -16701,8 +16961,6 @@ export declare const sessionHumanInputRequests: import("drizzle-orm/pg-core").Pg
                 required: boolean;
                 allowOther: boolean;
                 validation?: {
-                    minLength?: number | null | undefined;
-                    maxLength?: number | null | undefined;
                     minSelections?: number | null | undefined;
                     maxSelections?: number | null | undefined;
                 } | null | undefined;

package/dist/schema.js

@@ -11,6 +11,7 @@ import {
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
+  connectionDisconnectOperations,
   connections,
   connectorActionPolicies,
   connectorActionRequests,
@@ -137,7 +138,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-3UCHDMKG.js";
+} from "./chunk-7WTDI7Y3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -152,6 +153,7 @@ export {
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
+  connectionDisconnectOperations,
   connections,
   connectorActionPolicies,
   connectorActionRequests,

package/dist/session-realtime-mirror.d.ts

@@ -1,3 +1,4 @@
+import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
 import type { Database } from "./index";
 import * as schema from "./schema";
 export type SessionRealtimeMirrorChannel = "speakable" | "commentary" | null;
@@ -5,7 +6,7 @@ export type MirrorSessionRealtimeContextInput = {
     accountId: string;
     workspaceId: string;
     sessionId: string;
-    sourceKind: "human_input" | "assistant_progress" | "assistant_terminal";
+    sourceKind: "human_input" | "human_input_request" | "human_input_response" | "assistant_progress" | "assistant_terminal";
     sourceId: string;
     text: string;
     channel: SessionRealtimeMirrorChannel;
@@ -28,3 +29,23 @@ export declare function renderRealtimeHumanInputContext(input: {
     routing: "accepted_for_execution" | "queued_for_execution" | "accepted_for_steering";
     text: string;
 }): string;
+export type RealtimeHumanInputRequestContext = {
+    id: string;
+    questions: HumanInputQuestion[];
+    allowSkip: boolean;
+    expiresAt?: Date | string | null;
+};
+/**
+ * Render the exact durable question contract for the conversational surface.
+ * The structured form remains authoritative, while a conversational answer is
+ * ordinary new user input that the realtime model delegates once with enough
+ * question context for the next underlying turn.
+ */
+export declare function renderRealtimeHumanInputRequestContext(input: {
+    requests: RealtimeHumanInputRequestContext[];
+}): string;
+export declare function renderRealtimeHumanInputResponseContext(input: {
+    requestId: string;
+    questions: HumanInputQuestion[];
+    response: HumanInputResponse;
+}): string;

package/dist/workspace-instruction-policies-schema.d.ts

@@ -19,6 +19,40 @@ export declare const workspaceInstructionPolicyRevisions: import("drizzle-orm/pg
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        operationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "operation_id";
+            tableName: "workspace_instruction_policy_revisions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "workspace_instruction_policy_revisions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         accountId: import("drizzle-orm/pg-core").PgColumn<{
             name: "account_id";
             tableName: "workspace_instruction_policy_revisions";
@@ -458,6 +492,40 @@ export declare const workspaceInstructionPolicyActivationEvents: import("drizzle
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        operationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "operation_id";
+            tableName: "workspace_instruction_policy_activation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "workspace_instruction_policy_activation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         accountId: import("drizzle-orm/pg-core").PgColumn<{
             name: "account_id";
             tableName: "workspace_instruction_policy_activation_events";

package/dist/workspace-instruction-policies.d.ts

@@ -1,6 +1,8 @@
+import { WorkspaceInstructionPolicySnapshot } from "@opengeni/contracts";
 import type { WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyDraftProvenanceSource, WorkspaceInstructionPolicyHead, WorkspaceInstructionPolicyListQuery, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyRevision, WorkspaceInstructionPolicyTarget } from "@opengeni/contracts";
 import type { Database } from "./index";
-type DraftInput = WorkspaceInstructionPolicyTarget & {
+type DraftRequestInput = WorkspaceInstructionPolicyTarget & {
+    operationId: string;
     accountId: string;
     workspaceId: string;
     content: string;
@@ -9,15 +11,28 @@ type DraftInput = WorkspaceInstructionPolicyTarget & {
     supersedesRevisionId: string | null;
     createdBySubjectId: string;
 };
-type CallerDraftInput = Omit<DraftInput, "provenanceSource"> & {
+type CallerDraftInput = Omit<DraftRequestInput, "operationId" | "provenanceSource"> & {
+    operationId?: string;
     provenanceSource: WorkspaceInstructionPolicyDraftProvenanceSource;
 };
+type ImportLegacyRequestInput = {
+    operationId: string;
+    accountId: string;
+    workspaceId: string;
+    createdBySubjectId: string;
+    supersedesRevisionId: string | null;
+};
 export declare class WorkspaceInstructionPolicyConflictError extends Error {
     readonly currentHead: WorkspaceInstructionPolicyHead | null;
     readonly name = "WorkspaceInstructionPolicyConflictError";
     readonly code = "WORKSPACE_INSTRUCTION_POLICY_CONFLICT";
     constructor(currentHead: WorkspaceInstructionPolicyHead | null);
 }
+export declare class WorkspaceInstructionPolicyOperationReuseError extends Error {
+    readonly name = "WorkspaceInstructionPolicyOperationReuseError";
+    readonly code = "WORKSPACE_INSTRUCTION_POLICY_OPERATION_REUSED";
+    constructor();
+}
 export declare class WorkspaceInstructionPolicyNotFoundError extends Error {
     readonly name = "WorkspaceInstructionPolicyNotFoundError";
     constructor(message?: string);
@@ -40,13 +55,40 @@ export type WorkspaceInstructionPolicyAttemptClaims = {
     attemptId: string;
     executionGeneration: number;
 };
-export declare function createWorkspaceInstructionPolicyDraft(db: Database, input: CallerDraftInput): Promise<WorkspaceInstructionPolicyRevision>;
-/** Import only the stored legacy override; never materialize a deployment default or activate it. */
-export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database, input: {
+export type WorkspaceStateAcceptedAttemptGovernance = {
+    attemptId: string;
+    executionGeneration: number;
+    acceptedAt: string;
+    policySnapshot: WorkspaceInstructionPolicySnapshot | null;
+    preferenceSnapshot: {
+        id: string;
+        descriptorHash: string;
+        descriptors: Array<{
+            id: string;
+            revisionId: string;
+            contentHash: string;
+            activeVersion: number;
+            scope: "organization" | "workspace" | "user";
+        }>;
+        truncated: boolean;
+        createdAt: string;
+    } | null;
+};
+/**
+ * Inspect one immutable accepted attempt only when the authenticated caller is
+ * exactly its frozen initiating human. The null result deliberately conflates
+ * absence, cross-account/workspace lookup, and another subject's attempt.
+ */
+export declare function getWorkspaceStateAcceptedAttemptGovernance(db: Database, input: {
     accountId: string;
     workspaceId: string;
-    createdBySubjectId: string;
-    supersedesRevisionId: string | null;
+    subjectId: string;
+    attemptId: string;
+}): Promise<WorkspaceStateAcceptedAttemptGovernance | null>;
+export declare function createWorkspaceInstructionPolicyDraft(db: Database, input: CallerDraftInput): Promise<WorkspaceInstructionPolicyRevision>;
+/** Import only the stored legacy override; never materialize a deployment default or activate it. */
+export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database, input: Omit<ImportLegacyRequestInput, "operationId"> & {
+    operationId?: string;
 }): Promise<WorkspaceInstructionPolicyRevision>;
 export declare function listWorkspaceInstructionPolicyRevisions(db: Database, workspaceId: string, query: WorkspaceInstructionPolicyListQuery): Promise<WorkspaceInstructionPolicyListResponse>;
 export declare function getWorkspaceInstructionPolicyRevision(db: Database, workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
@@ -57,18 +99,22 @@ export declare function diffWorkspaceInstructionPolicyRevisions(db: Database, wo
     toRevisionId: string;
 }): Promise<WorkspaceInstructionPolicyDiffResponse>;
 export declare function activateWorkspaceInstructionPolicyRevision(db: Database, input: {
+    operationId?: string;
     accountId: string;
     workspaceId: string;
     revisionId: string;
     expectedCurrentRevisionId: string | null;
+    expectedActivationVersion?: number;
     actorSubjectId: string;
     reason: string;
 }): Promise<WorkspaceInstructionPolicyActivationResponse>;
 export declare function rollbackWorkspaceInstructionPolicyRevision(db: Database, input: {
+    operationId?: string;
     accountId: string;
     workspaceId: string;
     targetRevisionId: string;
     expectedCurrentRevisionId: string;
+    expectedActivationVersion?: number;
     actorSubjectId: string;
     reason: string;
 }): Promise<WorkspaceInstructionPolicyActivationResponse>;