@opengeni/db 0.27.9 → 0.28.1

package/src/runtime-posture.ts

@@ -18,6 +18,7 @@ export const FORCE_RLS_TABLES = [
   "billing_customers",
   "capability_catalog_items",
   "capability_installations",
+  "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
   "codex_reset_redemption_attempts",
@@ -117,6 +118,10 @@ export const FORCE_RLS_TABLES = [
   "slack_interactions",
   "social_connections",
   "social_posts",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
   "usage_events",
   "workspace_artifact_events",
   "workspace_artifact_versions",
@@ -172,6 +177,7 @@ export const RUNTIME_FULL_DML_TABLES = [
   "billing_customers",
   "capability_catalog_items",
   "capability_installations",
+  "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
   "codex_reset_redemption_attempts",
@@ -246,6 +252,10 @@ export const RUNTIME_FULL_DML_TABLES = [
   "social_connections",
   "social_posts",
   "stripe_webhook_events",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
   "usage_events",
   "workspace_artifacts",
   "workspace_captures",

package/src/schema.ts

@@ -497,7 +497,8 @@ export const workspaceVariableSetVariables = pgTable(
   }),
 );
 
-// Per-workspace ChatGPT/Codex subscription credential. One row per workspace.
+// Per-workspace ChatGPT/Codex subscription credential. One row per connected
+// ChatGPT account within a workspace.
 // access/refresh/id tokens live INSIDE credential_encrypted (v1 AES-256-GCM,
 // same envelope as workspace_variable_set_variables); the other columns are
 // plaintext metadata (header value + UI). RLS-isolated per workspace.
@@ -536,21 +537,11 @@ export const codexSubscriptionCredentials = pgTable(
     // usage cap on a rotation turn; the rotation engine treats `exhausted_until > now()` as
     // capped/skip so it isn't immediately re-picked. Self-clears via the now() comparison.
     exhaustedUntil: timestamp("exhausted_until", { withTimezone: true }),
-    // P4 connector-aware rotation cache (plaintext metadata; NEVER a token). The set
-    // of ORIGINAL-dotted connector namespaces (github/gmail/linear/…) this account
-    // exposes via codex_apps, captured from the per-turn tools/list. null ⇒ never
-    // probed (the ranker treats it as unknown: never credited as covering, never
-    // excluded). The writer only ever sets a NON-empty set, so a flaky empty turn
-    // can't false-drop coverage. connectorsCheckedAt is the freshness clock.
-    connectorNamespaces: text("connector_namespaces").array(),
-    connectorsCheckedAt: timestamp("connectors_checked_at", {
-      withTimezone: true,
-    }),
     // Workspace-local, server-held fairness cursor. Provider usage headers are
     // capacity hints, never the sole allocator: live lease count is ranked first
     // and this cursor deterministically breaks equal-load/equal-capacity ties.
     // This flag controls NEW automatic allocations only. Credential health,
-    // refresh, encrypted material, and already-frozen/in-flight turns are
+    // refresh, encrypted material, and an already-leased in-flight turn are
     // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
     allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
     // Independent OCC/audit sequence for the allocator toggle. Token refresh
@@ -586,6 +577,54 @@ export const codexSubscriptionCredentials = pgTable(
       table.workspaceId,
       table.id,
     ),
+    workspaceAccountIdentity: uniqueIndex(
+      "codex_subscription_credentials_workspace_account_id_idx",
+    ).on(table.workspaceId, table.accountId, table.id),
+  }),
+);
+
+// Optional workspace-level credential used only for ChatGPT connected Apps.
+// Inference selection, usage, cooldown, allocator, pins, and leases never read
+// this row. A durable null row retains the OCC sequence after designation clear.
+export const codexAppsSettings = pgTable(
+  "codex_apps_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    credentialId: uuid("credential_id"),
+    version: integer("version").notNull().default(1),
+    designatedAt: timestamp("designated_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "codex_apps_settings_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    credentialScope: foreignKey({
+      name: "codex_apps_settings_credential_scope_fk",
+      columns: [table.workspaceId, table.accountId, table.credentialId],
+      foreignColumns: [
+        codexSubscriptionCredentials.workspaceId,
+        codexSubscriptionCredentials.accountId,
+        codexSubscriptionCredentials.id,
+      ],
+    }).onDelete("cascade"),
+    workspace: uniqueIndex("codex_apps_settings_workspace_idx").on(table.workspaceId),
+    designationShape: check(
+      "codex_apps_settings_designation_shape_chk",
+      sql`${table.version} > 0 and (
+        (${table.credentialId} is null and ${table.designatedAt} is null)
+        or
+        (${table.credentialId} is not null and ${table.designatedAt} is not null)
+      )`,
+    ),
   }),
 );
 
@@ -1460,10 +1499,9 @@ export const sessions = pgTable(
     nestedAgentDepthPolicySessionId: uuid("nested_agent_depth_policy_session_id"),
     temporalWorkflowId: text("temporal_workflow_id"),
     activeTurnId: uuid("active_turn_id"),
-    // Actual input tokens reported for the last model call of the most recent
-    // turn. The pre-turn portable compaction trigger reads this as its budget
-    // signal (char/4 estimate is the same-turn fallback). Null until a turn with
-    // usage has completed.
+    // Actual input tokens reported for the latest authoritative ordinary model
+    // call. Compaction/context clearing invalidates it to null; local history
+    // estimates must never be stored here.
     lastInputTokens: integer("last_input_tokens"),
     // Operator /compact request flag. The API sets
     // it true; the worker honors it BEFORE the next turn's model call by forcing
@@ -3519,25 +3557,9 @@ export const agentRunStates = pgTable("agent_run_states", {
   stateVersion: integer("state_version").notNull(),
   serializedRunState: text("serialized_run_state").notNull(),
   pendingApprovals: jsonb("pending_approvals").$type<unknown[]>().notNull().default([]),
-  // The Codex account that FROZE this run state: the turn's resolved codex
-  // credential id (pin > workspace-active), or NULL when frozen on the
-  // non-codex / Azure path (or before this column existed). The serialized
-  // RunState blob round-trips `reasoning.encrypted_content` minted by the
-  // ChatGPT/Codex backend — account/org-bound, so a foreign blob 400s — and the
-  // foreign reasoning ids the Responses backend validates; but the blob carries
-  // NO per-item producer tag (those live only on session_history_items). So we
-  // stamp the freezing account here: on an approval resume whose codex account
-  // DIFFERS from this value,
-  // the replay path neutralizes every reasoning item's account-bound identity
-  // (encrypted_content + provider id) in the blob before it reaches the model.
-  // Deliberately NO FK: provenance must OUTLIVE the account's hard-disconnect (a
-  // stale-but-null tag still mismatches a live codex id, so the strip stays
-  // correct either way). NULL on both sides (non-codex freeze + non-codex
-  // resume) is a no-op, so single-account and non-codex sessions are unchanged.
-  frozenCodexCredentialId: uuid("frozen_codex_credential_id"),
-  // Exact provider rejection invalidates only the opaque reasoning identity
-  // inside this frozen state. The serialized receipt remains durable and
-  // auditable; the resume path neutralizes its provider-bound identity.
+  // Exact provider rejection marks the latest current-turn receipt only when it
+  // was part of the rejected request. The serialized receipt remains durable;
+  // recovery builds a temporary view without unusable opaque artifacts.
   providerArtifactInvalidatedAt: timestamp("provider_artifact_invalidated_at", {
     withTimezone: true,
   }),
@@ -3661,22 +3683,11 @@ export const sessionHistoryItems = pgTable(
     // inserts ONE synthetic active summary row at the boundary. Defaults true so
     // every existing and normally-appended row is live.
     active: boolean("active").notNull().default(true),
-    // The Codex account that PRODUCED these items: the per-turn resolved codex
-    // credential id (pin > workspace-active), or NULL when produced on the
-    // non-codex / Azure path (or before this column existed). Used to strip
-    // cross-account `reasoning.encrypted_content` blobs — those are account/org-
-    // bound, minted by the ChatGPT/Codex backend, so replaying account A's blob
-    // into a turn running on account B 400s. The read path drops the encrypted
-    // reasoning of any item whose producer != the turn's current codex account.
-    // Deliberately NO FK: provenance must OUTLIVE the account's hard-disconnect
-    // (an ON DELETE SET NULL would erase the tag, and a stale-but-null tag still
-    // mismatches a live codex id so the strip stays correct either way).
-    producerCodexCredentialId: uuid("producer_codex_credential_id"),
-    // An exact provider 400 can prove that an otherwise same-credential opaque
-    // reasoning artifact is no longer decryptable. Keep the original item and
-    // producer provenance immutable, but record the attempt-fenced rejection so
-    // later model reads omit only the provider-bound identity. No FK: the receipt
-    // must outlive operational attempt retention just like producer provenance.
+    // An exact provider 400 can prove that the request's active opaque artifact
+    // set is no longer usable. Keep each canonical item immutable, but record the
+    // attempt-fenced rejection on the exact candidate row IDs so later model
+    // reads build a temporary projection. No FK: the receipt must outlive
+    // operational attempt retention.
     providerArtifactInvalidatedAt: timestamp("provider_artifact_invalidated_at", {
       withTimezone: true,
     }),
@@ -6025,3 +6036,4 @@ export * from "./workspace-instruction-policies-schema";
 export * from "./preference-registry-schema";
 export * from "./memory-governance-schema";
 export * from "./scoped-knowledge-schema";
+export * from "./transcription-recordings-schema";

package/src/transcription-recordings-schema.ts

@@ -0,0 +1,250 @@
+import { sql } from "drizzle-orm";
+import {
+  boolean,
+  check,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+export const transcriptionRecordingStateValues = [
+  "uploading",
+  "segmenting",
+  "ready",
+  "transcribing",
+  "complete",
+  "failed",
+  "discarded",
+] as const;
+
+export const transcriptionRecordingChunkStateValues = ["uploading", "complete"] as const;
+export const transcriptionRecordingObjectKindValues = ["chunk", "segment"] as const;
+
+export const transcriptionRecordingSegmentStateValues = [
+  "preparing",
+  "pending",
+  "transcribing",
+  "complete",
+  "failed",
+] as const;
+
+export const transcriptionRecordings = pgTable(
+  "transcription_recordings",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    mimeType: text("mime_type").notNull(),
+    state: text("state", { enum: transcriptionRecordingStateValues })
+      .notNull()
+      .default("uploading"),
+    nextChunkNumber: integer("next_chunk_number").notNull().default(0),
+    chunkCount: integer("chunk_count").notNull().default(0),
+    totalBytes: integer("total_bytes").notNull().default(0),
+    totalDurationMilliseconds: integer("total_duration_milliseconds").notNull().default(0),
+    segmentCount: integer("segment_count").notNull().default(0),
+    completedSegmentCount: integer("completed_segment_count").notNull().default(0),
+    transcriptText: text("transcript_text"),
+    languages: jsonb("languages").$type<string[]>().notNull().default([]),
+    errorCode: text("error_code"),
+    retryable: boolean("retryable").notNull().default(false),
+    providerId: text("provider_id"),
+    processingGeneration: integer("processing_generation").notNull().default(0),
+    processingOwner: uuid("processing_owner"),
+    processingStartedAt: timestamp("processing_started_at", { withTimezone: true }),
+    objectsCleanedAt: timestamp("objects_cleaned_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  },
+  (table) => ({
+    exactAuthority: uniqueIndex("transcription_recordings_exact_authority_uq").on(
+      table.accountId,
+      table.workspaceId,
+      table.subjectId,
+      table.id,
+    ),
+    subjectCreated: index("transcription_recordings_subject_created_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.createdAt,
+    ),
+    expiry: index("transcription_recordings_expiry_idx").on(table.expiresAt, table.id),
+    valuesValid: check(
+      "transcription_recordings_values_check",
+      sql`${table.nextChunkNumber} >= 0
+        and ${table.chunkCount} >= 0
+        and ${table.totalBytes} >= 0
+        and ${table.totalDurationMilliseconds} >= 0
+        and ${table.segmentCount} >= 0
+        and ${table.completedSegmentCount} >= 0
+        and ${table.completedSegmentCount} <= ${table.segmentCount}
+        and octet_length(${table.subjectId}) between 1 and 1024
+        and octet_length(${table.mimeType}) between 1 and 128
+        and (
+          ${table.providerId} is null
+          or octet_length(${table.providerId}) between 1 and 128
+        )`,
+    ),
+    processingValid: check(
+      "transcription_recordings_processing_check",
+      sql`(
+          ${table.processingOwner} is null
+          and ${table.processingStartedAt} is null
+        ) or (
+          ${table.processingOwner} is not null
+          and ${table.processingStartedAt} is not null
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingObjects = pgTable(
+  "transcription_recording_objects",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    objectKey: text("object_key").primaryKey(),
+    kind: text("kind", { enum: transcriptionRecordingObjectKindValues }).notNull(),
+    cleanupAfter: timestamp("cleanup_after", { withTimezone: true }).notNull(),
+    cleanupClaimId: uuid("cleanup_claim_id"),
+    cleanupClaimedAt: timestamp("cleanup_claimed_at", { withTimezone: true }),
+    cleanedAt: timestamp("cleaned_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    dueCleanup: index("transcription_recording_objects_due_cleanup_idx")
+      .on(table.cleanupAfter, table.objectKey)
+      .where(sql`${table.cleanedAt} is null`),
+    claimRecovery: index("transcription_recording_objects_claim_recovery_idx")
+      .on(table.cleanupClaimedAt, table.objectKey)
+      .where(sql`${table.cleanedAt} is null and ${table.cleanupClaimId} is not null`),
+    valuesValid: check(
+      "transcription_recording_objects_values_check",
+      sql`octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.cleanupClaimId} is null and ${table.cleanupClaimedAt} is null)
+          or (${table.cleanupClaimId} is not null and ${table.cleanupClaimedAt} is not null)
+        )
+        and (
+          ${table.cleanedAt} is null
+          or (${table.cleanupClaimId} is null and ${table.cleanupClaimedAt} is null)
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingChunks = pgTable(
+  "transcription_recording_chunks",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    chunkNumber: integer("chunk_number").notNull(),
+    state: text("state", { enum: transcriptionRecordingChunkStateValues })
+      .notNull()
+      .default("uploading"),
+    byteLength: integer("byte_length").notNull(),
+    sha256: text("sha256").notNull(),
+    startMilliseconds: integer("start_milliseconds").notNull(),
+    durationMilliseconds: integer("duration_milliseconds").notNull(),
+    objectKey: text("object_key").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "transcription_recording_chunks_pk",
+      columns: [table.recordingId, table.chunkNumber],
+    }),
+    recordingOrder: index("transcription_recording_chunks_order_idx").on(
+      table.workspaceId,
+      table.recordingId,
+      table.chunkNumber,
+    ),
+    objectKey: uniqueIndex("transcription_recording_chunks_object_key_uq").on(table.objectKey),
+    valuesValid: check(
+      "transcription_recording_chunks_values_check",
+      sql`${table.chunkNumber} >= 0
+        and ${table.byteLength} > 0
+        and ${table.startMilliseconds} >= 0
+        and ${table.durationMilliseconds} >= 0
+        and ${table.sha256} ~ '^[0-9a-f]{64}$'
+        and octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.state} = 'uploading' and ${table.completedAt} is null)
+          or (${table.state} = 'complete' and ${table.completedAt} is not null)
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingSegments = pgTable(
+  "transcription_recording_segments",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    segmentNumber: integer("segment_number").notNull(),
+    generation: integer("generation").notNull(),
+    state: text("state", { enum: transcriptionRecordingSegmentStateValues })
+      .notNull()
+      .default("preparing"),
+    byteLength: integer("byte_length").notNull(),
+    sha256: text("sha256").notNull(),
+    startMilliseconds: integer("start_milliseconds").notNull(),
+    durationMilliseconds: integer("duration_milliseconds").notNull(),
+    objectKey: text("object_key").notNull(),
+    attemptId: uuid("attempt_id"),
+    attemptStartedAt: timestamp("attempt_started_at", { withTimezone: true }),
+    attemptDeadlineAt: timestamp("attempt_deadline_at", { withTimezone: true }),
+    transcriptText: text("transcript_text"),
+    languages: jsonb("languages").$type<string[]>().notNull().default([]),
+    providerId: text("provider_id"),
+    errorCode: text("error_code"),
+    retryable: boolean("retryable").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "transcription_recording_segments_pk",
+      columns: [table.recordingId, table.segmentNumber],
+    }),
+    recordingOrder: index("transcription_recording_segments_order_idx").on(
+      table.workspaceId,
+      table.recordingId,
+      table.segmentNumber,
+    ),
+    objectKey: uniqueIndex("transcription_recording_segments_object_key_uq").on(table.objectKey),
+    valuesValid: check(
+      "transcription_recording_segments_values_check",
+      sql`${table.segmentNumber} >= 0
+        and ${table.generation} > 0
+        and ${table.byteLength} > 0
+        and ${table.startMilliseconds} >= 0
+        and ${table.durationMilliseconds} > 0
+        and ${table.sha256} ~ '^[0-9a-f]{64}$'
+        and octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.attemptId} is null
+            and ${table.attemptStartedAt} is null
+            and ${table.attemptDeadlineAt} is null)
+          or (${table.attemptId} is not null
+            and ${table.attemptStartedAt} is not null
+            and ${table.attemptDeadlineAt} is not null)
+        )`,
+    ),
+  }),
+);