@opengeni/db 0.23.0 → 0.27.0

package/dist/{chunk-3UCHDMKG.js → chunk-EX7CDSGH.js}

@@ -17,6 +17,7 @@ __export(schema_exports, {
   codexRotationSettings: () => codexRotationSettings,
   codexSubscriptionCredentials: () => codexSubscriptionCredentials,
   composerDrafts: () => composerDrafts,
+  connectionDisconnectOperations: () => connectionDisconnectOperations,
   connections: () => connections,
   connectorActionPolicies: () => connectorActionPolicies,
   connectorActionRequests: () => connectorActionRequests,
@@ -134,6 +135,7 @@ __export(schema_exports, {
   workspaceInferenceControls: () => workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents: () => workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyHeads: () => workspaceInstructionPolicyHeads,
+  workspaceInstructionPolicyOnboardingProposals: () => workspaceInstructionPolicyOnboardingProposals,
   workspaceInstructionPolicyRevisions: () => workspaceInstructionPolicyRevisions,
   workspaceInstructionPolicySnapshots: () => workspaceInstructionPolicySnapshots,
   workspaceMemberships: () => workspaceMemberships,
@@ -180,6 +182,8 @@ var workspaceInstructionPolicyRevisions = pgTable(
   "workspace_instruction_policy_revisions",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     revision: bigint("revision", { mode: "number" }).notNull().default(sql`nextval('workspace_instruction_policy_revision_seq')`),
@@ -195,6 +199,17 @@ var workspaceInstructionPolicyRevisions = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_revisions_workspace_operation_uq").on(table.workspaceId, table.operationId).where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_revisions_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`
+    ),
     workspaceRevision: uniqueIndex(
       "workspace_instruction_policy_revisions_workspace_revision_uq"
     ).on(table.workspaceId, table.revision),
@@ -248,6 +263,8 @@ var workspaceInstructionPolicyActivationEvents = pgTable(
   "workspace_instruction_policy_activation_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id"),
+    requestFingerprint: text("request_fingerprint"),
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     kind: text("kind").notNull(),
@@ -266,6 +283,17 @@ var workspaceInstructionPolicyActivationEvents = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
+    workspaceOperation: uniqueIndex("workspace_instruction_policy_events_workspace_operation_uq").on(table.workspaceId, table.operationId).where(sql`${table.operationId} is not null`),
+    operationReceipt: check(
+      "workspace_instruction_policy_events_operation_receipt_chk",
+      sql`(
+        (${table.operationId} is null and ${table.requestFingerprint} is null)
+        or (
+          ${table.operationId} is not null
+          and ${table.requestFingerprint} ~ '^[0-9a-f]{64}$'
+        )
+      )`
+    ),
     workspaceActivationVersion: uniqueIndex(
       "workspace_instruction_policy_events_target_version_uq"
     ).on(
@@ -290,6 +318,91 @@ var workspaceInstructionPolicyActivationEvents = pgTable(
     )
   })
 );
+var workspaceInstructionPolicyOnboardingProposals = pgTable(
+  "workspace_instruction_policy_onboarding_proposals",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    sourceId: text("source_id").notNull(),
+    sourceVersion: text("source_version").notNull(),
+    confidenceBps: integer("confidence_bps").notNull(),
+    baselineRevisionId: uuid("baseline_revision_id"),
+    baselineRevision: bigint("baseline_revision", { mode: "number" }),
+    baselineContentHash: text("baseline_content_hash"),
+    baselineActivationVersion: bigint("baseline_activation_version", { mode: "number" }).notNull(),
+    baselineActivatedAt: timestamp("baseline_activated_at", { withTimezone: true }),
+    draftRevisionId: uuid("draft_revision_id").notNull(),
+    draftRevision: bigint("draft_revision", { mode: "number" }).notNull(),
+    draftContentHash: text("draft_content_hash").notNull(),
+    status: text("status").notNull().default("proposed"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex(
+      "workspace_instruction_policy_onboarding_proposals_workspace_operation_uq"
+    ).on(table.workspaceId, table.operationId),
+    sourceVersionTarget: uniqueIndex(
+      "workspace_instruction_policy_onboarding_proposals_source_version_target_uq"
+    ).on(
+      table.workspaceId,
+      table.kind,
+      table.scope,
+      sql`coalesce(${table.roleKey}, '')`,
+      table.sourceId,
+      table.sourceVersion
+    ),
+    workspaceTimeline: index(
+      "workspace_instruction_policy_onboarding_proposals_workspace_time_idx"
+    ).on(table.workspaceId, table.createdAt, table.id),
+    operationReceipt: check(
+      "workspace_instruction_policy_onboarding_proposals_operation_receipt_chk",
+      sql`${table.requestFingerprint} ~ '^[0-9a-f]{64}$'`
+    ),
+    target: check(
+      "workspace_instruction_policy_onboarding_proposals_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`
+    ),
+    source: check(
+      "workspace_instruction_policy_onboarding_proposals_source_chk",
+      sql`length(btrim(${table.sourceId})) between 1 and 512
+        and length(btrim(${table.sourceVersion})) between 1 and 256
+        and ${table.confidenceBps} between 0 and 10000`
+    ),
+    baseline: check(
+      "workspace_instruction_policy_onboarding_proposals_baseline_chk",
+      sql`(
+        ${table.baselineRevisionId} is null
+        and ${table.baselineRevision} is null
+        and ${table.baselineContentHash} is null
+        and ${table.baselineActivationVersion} = 0
+        and ${table.baselineActivatedAt} is null
+      ) or (
+        ${table.baselineRevisionId} is not null
+        and ${table.baselineRevision} > 0
+        and ${table.baselineContentHash} ~ '^[0-9a-f]{64}$'
+        and ${table.baselineActivationVersion} > 0
+        and ${table.baselineActivatedAt} is not null
+      )`
+    ),
+    draft: check(
+      "workspace_instruction_policy_onboarding_proposals_draft_chk",
+      sql`${table.draftRevision} > 0
+        and ${table.draftContentHash} ~ '^[0-9a-f]{64}$'
+        and ${table.status} = 'proposed'`
+    )
+  })
+);
 var workspaceInstructionPolicySnapshots = pgTable(
   "workspace_instruction_policy_snapshots",
   {
@@ -1812,6 +1925,38 @@ var connections = pgTable5(
     )
   })
 );
+var connectionDisconnectOperations = pgTable5(
+  "connection_disconnect_operations",
+  {
+    id: uuid5("id").primaryKey().defaultRandom(),
+    accountId: uuid5("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid5("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid5("connection_id").notNull().references(() => connections.id, { onDelete: "cascade" }),
+    subjectId: text5("subject_id").notNull(),
+    idempotencyKey: text5("idempotency_key").notNull(),
+    expectedVersion: integer5("expected_version").notNull(),
+    resultVersion: integer5("result_version").notNull(),
+    createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceSubjectKey: uniqueIndex5("connection_disconnect_operations_subject_key_uq").on(
+      table.workspaceId,
+      table.subjectId,
+      table.idempotencyKey
+    ),
+    connectionGeneration: uniqueIndex5(
+      "connection_disconnect_operations_connection_generation_uq"
+    ).on(table.workspaceId, table.connectionId, table.expectedVersion),
+    identityValid: check4(
+      "connection_disconnect_operations_identity_check",
+      sql5`length(${table.subjectId}) between 1 and 512
+        and length(${table.idempotencyKey}) between 1 and 200
+        and ${table.idempotencyKey} = btrim(${table.idempotencyKey})
+        and ${table.expectedVersion} > 0
+        and ${table.resultVersion} = ${table.expectedVersion} + 1`
+    )
+  })
+);
 var connectorActionPolicies = pgTable5(
   "connector_action_policies",
   {
@@ -3015,6 +3160,11 @@ var documents = pgTable5(
     sourceUpdatedAt: timestamp5("source_updated_at", { withTimezone: true }),
     sourceVersion: text5("source_version"),
     aclTags: jsonb5("acl_tags").$type().notNull().default([]),
+    // Durable authorization tuple. The workspace_id above remains ingestion
+    // provenance; organization authority deliberately has no workspace owner.
+    authorityKind: text5("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid5("authority_workspace_id"),
+    authoritySubjectId: text5("authority_subject_id"),
     // Per-document access controls. visibility 'private' restricts human reads to
     // created_by (a grant subject id, not a uuid); agent_access=false hides the
     // document from agent retrieval surfaces (docs MCP) while humans keep REST.
@@ -3052,6 +3202,28 @@ var documents = pgTable5(
       table.workspaceId,
       table.curationStatus
     ),
+    authority: index5("documents_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId,
+      table.status
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "documents_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("restrict"),
+    authorityState: check4(
+      "documents_authority_chk",
+      sql5`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ${table.authoritySubjectId} = ${table.createdBy})`
+    ),
+    authorityVisibility: check4(
+      "documents_authority_visibility_chk",
+      sql5`(${table.authorityKind} = 'personal') = (${table.visibility} = 'private')`
+    ),
     visibilityState: check4(
       "documents_visibility_chk",
       sql5`${table.visibility} in ('workspace', 'private')`
@@ -3083,6 +3255,9 @@ var documentChunks = pgTable5(
     chunkIndex: integer5("chunk_index").notNull(),
     text: text5("text").notNull(),
     metadata: jsonb5("metadata").$type().notNull().default({}),
+    authorityKind: text5("authority_kind").notNull().default("workspace"),
+    authorityWorkspaceId: uuid5("authority_workspace_id"),
+    authoritySubjectId: text5("authority_subject_id"),
     embedding: vector("embedding").notNull(),
     embeddingModel: text5("embedding_model").notNull(),
     createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -3093,7 +3268,24 @@ var documentChunks = pgTable5(
       table.documentId,
       table.chunkIndex
     ),
-    base: index5("document_chunks_workspace_base_idx").on(table.workspaceId, table.baseId)
+    base: index5("document_chunks_workspace_base_idx").on(table.workspaceId, table.baseId),
+    authority: index5("document_chunks_authority_idx").on(
+      table.accountId,
+      table.authorityKind,
+      table.authorityWorkspaceId,
+      table.authoritySubjectId
+    ),
+    authorityWorkspaceAccount: foreignKey({
+      name: "document_chunks_authority_workspace_fk",
+      columns: [table.authorityWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("restrict"),
+    authorityState: check4(
+      "document_chunks_authority_chk",
+      sql5`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
+        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024)`
+    )
   })
 );
 var knowledgeMemories = pgTable5(
@@ -6205,6 +6397,7 @@ export {
   workspaceInstructionPolicyRevisions,
   workspaceInstructionPolicyHeads,
   workspaceInstructionPolicyActivationEvents,
+  workspaceInstructionPolicyOnboardingProposals,
   workspaceInstructionPolicySnapshots,
   preferenceRegistryPreferences,
   preferenceRegistryRevisions,
@@ -6243,6 +6436,7 @@ export {
   codexSubscriptionCredentials,
   codexResetRedemptionAttempts,
   connections,
+  connectionDisconnectOperations,
   connectorActionPolicies,
   slackBotUserLinks,
   slackInteractionInbox,
@@ -6342,4 +6536,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-3UCHDMKG.js.map
+//# sourceMappingURL=chunk-EX7CDSGH.js.map