@opengeni/db 0.28.1 → 0.31.1

package/drizzle/0177_session_events_workspace_turn_type_index.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "session_events_workspace_turn_type_idx"
+  ON "session_events" ("workspace_id", "turn_id", "type")
+  WHERE "turn_id" IS NOT NULL;

package/drizzle/0178_permissioned_secret_reads.sql

@@ -0,0 +1,14 @@
+-- deployment-mode: rolling
+-- Existing managed workspace administrators receive explicit new permissions.
+-- API keys and frozen session grants are deliberately untouched: an old
+-- workspace:admin wildcard must never acquire plaintext secret reads.
+UPDATE "workspace_memberships"
+SET "permissions" =
+  "permissions"
+  || CASE WHEN "permissions" ? 'variable-sets:list' THEN '[]'::jsonb ELSE '["variable-sets:list"]'::jsonb END
+  || CASE WHEN "permissions" ? 'variable-sets:read' THEN '[]'::jsonb ELSE '["variable-sets:read"]'::jsonb END
+  || CASE WHEN "permissions" ? 'variable-sets:write' THEN '[]'::jsonb ELSE '["variable-sets:write"]'::jsonb END
+  || CASE WHEN "permissions" ? 'secrets:list' THEN '[]'::jsonb ELSE '["secrets:list"]'::jsonb END
+  || CASE WHEN "permissions" ? 'secrets:read' THEN '[]'::jsonb ELSE '["secrets:read"]'::jsonb END
+  || CASE WHEN "permissions" ? 'secrets:write' THEN '[]'::jsonb ELSE '["secrets:write"]'::jsonb END
+WHERE "permissions" ? 'workspace:admin';

package/drizzle/0179_slack_private_shortcut_delivery_gate.sql

@@ -0,0 +1,85 @@
+-- deployment-mode: rolling
+-- A private human-DM shortcut is initially keyed to a source conversation the
+-- workspace bot cannot join. Delivery becomes eligible only after the durable
+-- acknowledgement has rekeyed the route to the invoking user's bot-DM thread.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+DO $migration$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_slack_interaction_delivery(
+      p_holder uuid,
+      p_lease_ms integer
+    )
+    RETURNS SETOF %1$I.slack_interactions
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_lease_ms < 1000 OR p_lease_ms > 300000 THEN
+        RAISE EXCEPTION 'invalid Slack delivery claim lease';
+      END IF;
+      RETURN QUERY
+      WITH candidate AS (
+        SELECT I.id
+        FROM %1$I.slack_interactions I
+        WHERE I.session_id IS NOT NULL
+          AND I.terminal_delivery_state = 'open'
+          AND (I.delivery_retry_at IS NULL OR I.delivery_retry_at <= now())
+          AND (I.delivery_claim_holder_id IS NULL OR I.delivery_claim_expires_at <= now())
+          AND NOT (
+            I.visibility = 'private'
+            AND I.triggering_provider_event_id LIKE 'shortcut:%%'
+            AND I.ack_slack_message_ts IS NULL
+          )
+          AND EXISTS (
+            SELECT 1
+            FROM %1$I.session_events E
+            WHERE E.workspace_id = I.workspace_id
+              AND E.session_id = I.session_id
+              AND E.sequence > I.last_delivered_session_event_sequence
+              AND E.type IN (
+                'agent.message.completed',
+                'session.humanInput.requested',
+                'turn.completed',
+                'turn.failed',
+                'turn.cancelled',
+                'session.status.changed'
+              )
+          )
+        ORDER BY I.delivery_retry_at NULLS FIRST, I.updated_at, I.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT 1
+      )
+      UPDATE %1$I.slack_interactions I
+      SET delivery_claim_holder_id = p_holder,
+          delivery_claim_expires_at = now() + make_interval(secs => p_lease_ms::double precision / 1000),
+          delivery_attempt_count = I.delivery_attempt_count + 1,
+          updated_at = now()
+      FROM candidate C
+      WHERE I.id = C.id
+      RETURNING I.*;
+    END
+    $function$
+  $ddl$, data_schema);
+END
+$migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.claim_slack_interaction_delivery(uuid, integer)
+  FROM PUBLIC;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_slack_interaction_delivery(uuid, integer)
+      TO opengeni_app;
+  END IF;
+END
+$grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0180_retained_screenshot_lifecycle_fences.sql

@@ -0,0 +1,273 @@
+-- deployment-mode: rolling
+-- Preserve retained screenshot cleanup/accounting authority across parent
+-- deletion, make quota release explicit and idempotent, and fence provider
+-- deletion with one durable maintenance claim.
+
+ALTER TABLE "retained_screenshot_artifacts"
+  ALTER COLUMN "session_id" DROP NOT NULL,
+  ALTER COLUMN "turn_id" DROP NOT NULL,
+  ALTER COLUMN "attempt_id" DROP NOT NULL,
+  ADD COLUMN "quota_state" text NOT NULL DEFAULT 'reserved',
+  ADD COLUMN "maintenance_claim_id" uuid,
+  ADD COLUMN "maintenance_claimed_at" timestamptz;
+
+ALTER TABLE "retained_screenshot_artifacts"
+  DROP CONSTRAINT "retained_screenshot_artifacts_workspace_session_fk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_workspace_turn_fk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_workspace_attempt_fk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_workspace_file_fk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_status_chk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_ready_shape_chk",
+  DROP CONSTRAINT "retained_screenshot_artifacts_terminal_cleanup_chk";
+
+-- Claims created by migration 0140 carried no owner token. Return them to an
+-- unclaimed state before the ownership constraint is installed.
+UPDATE "retained_screenshot_artifacts"
+SET
+  "status" = CASE
+    WHEN "status" = 'reconciling' THEN 'pending'
+    WHEN "status" = 'cleanup_pending' THEN 'cleanup_queued'
+    ELSE "status"
+  END,
+  "quota_state" = CASE
+    WHEN "status" IN ('failed', 'expired', 'deleted') THEN 'released'
+    WHEN "status" = 'ready' OR "ready_at" IS NOT NULL THEN 'ready'
+    ELSE 'reserved'
+  END,
+  "cleanup_reason" = CASE
+    WHEN "status" = 'cleanup_pending' THEN coalesce("cleanup_reason", 'orphaned')
+    WHEN "status" IN ('failed', 'expired', 'deleted')
+      THEN coalesce("cleanup_reason", "status")
+    ELSE "cleanup_reason"
+  END,
+  "maintenance_claim_id" = NULL,
+  "maintenance_claimed_at" = NULL;
+
+ALTER TABLE "retained_screenshot_artifacts"
+  ADD CONSTRAINT "retained_screenshot_artifacts_session_fk"
+    FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE SET NULL,
+  ADD CONSTRAINT "retained_screenshot_artifacts_turn_fk"
+    FOREIGN KEY ("turn_id") REFERENCES "session_turns"("id") ON DELETE SET NULL,
+  ADD CONSTRAINT "retained_screenshot_artifacts_attempt_fk"
+    FOREIGN KEY ("attempt_id") REFERENCES "session_turn_attempts"("id") ON DELETE SET NULL,
+  ADD CONSTRAINT "retained_screenshot_artifacts_workspace_file_fk"
+    FOREIGN KEY ("workspace_id", "artifact_id")
+    REFERENCES "files"("workspace_id", "id") ON DELETE RESTRICT,
+  ADD CONSTRAINT "retained_screenshot_artifacts_status_chk"
+    CHECK (
+      "status" IN (
+        'pending', 'reconciling', 'ready', 'cleanup_queued',
+        'cleanup_pending', 'failed', 'expired', 'deleted'
+      )
+    ),
+  ADD CONSTRAINT "retained_screenshot_artifacts_quota_state_chk"
+    CHECK ("quota_state" IN ('reserved', 'ready', 'released')),
+  ADD CONSTRAINT "retained_screenshot_artifacts_status_quota_chk"
+    CHECK (
+      ("status" IN ('pending', 'reconciling') AND "quota_state" = 'reserved')
+      OR ("status" = 'ready' AND "quota_state" = 'ready')
+      OR (
+        "status" IN ('cleanup_queued', 'cleanup_pending')
+        AND "quota_state" IN ('reserved', 'ready')
+      )
+      OR (
+        "status" IN ('failed', 'expired', 'deleted')
+        AND "quota_state" = 'released'
+      )
+    ),
+  ADD CONSTRAINT "retained_screenshot_artifacts_ready_shape_chk"
+    CHECK (
+      ("status" = 'ready' AND "ready_at" IS NOT NULL)
+      OR ("status" IN ('pending', 'reconciling') AND "ready_at" IS NULL)
+      OR "status" IN ('cleanup_queued', 'cleanup_pending', 'failed', 'expired', 'deleted')
+    ),
+  ADD CONSTRAINT "retained_screenshot_artifacts_cleanup_reason_chk"
+    CHECK (
+      ("status" IN ('pending', 'reconciling', 'ready') AND "cleanup_reason" IS NULL)
+      OR (
+        "status" IN ('cleanup_queued', 'cleanup_pending', 'failed', 'expired', 'deleted')
+        AND "cleanup_reason" IS NOT NULL
+      )
+    ),
+  ADD CONSTRAINT "retained_screenshot_artifacts_claim_shape_chk"
+    CHECK (
+      (
+        "status" IN ('reconciling', 'cleanup_pending')
+        AND "maintenance_claim_id" IS NOT NULL
+        AND "maintenance_claimed_at" IS NOT NULL
+      )
+      OR (
+        "status" NOT IN ('reconciling', 'cleanup_pending')
+        AND "maintenance_claim_id" IS NULL
+        AND "maintenance_claimed_at" IS NULL
+      )
+    );
+
+DROP INDEX "retained_screenshot_artifacts_pending_reconcile_idx";
+CREATE INDEX "retained_screenshot_artifacts_pending_reconcile_idx"
+  ON "retained_screenshot_artifacts" ("updated_at", "artifact_id")
+  WHERE "status" IN ('pending', 'reconciling', 'cleanup_queued', 'cleanup_pending');
+
+-- Make the aggregate counters a projection of explicit artifact quota state.
+-- This also clears quota leaked by an old parent/file cascade whose lifecycle
+-- row no longer exists.
+INSERT INTO "workspace_screenshot_quotas" ("workspace_id", "account_id")
+SELECT DISTINCT "workspace_id", "account_id"
+FROM "retained_screenshot_artifacts"
+ON CONFLICT ("workspace_id") DO NOTHING;
+
+UPDATE "workspace_screenshot_quotas" Q
+SET
+  "reserved_bytes" = COALESCE((
+    SELECT sum(A."size_bytes")
+    FROM "retained_screenshot_artifacts" A
+    WHERE A."workspace_id" = Q."workspace_id" AND A."quota_state" = 'reserved'
+  ), 0),
+  "ready_bytes" = COALESCE((
+    SELECT sum(A."size_bytes")
+    FROM "retained_screenshot_artifacts" A
+    WHERE A."workspace_id" = Q."workspace_id" AND A."quota_state" = 'ready'
+  ), 0),
+  "updated_at" = clock_timestamp();
+
+CREATE OR REPLACE FUNCTION opengeni_private.queue_detached_retained_screenshot()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  v_reason text;
+BEGIN
+  IF NOT (
+    (OLD.session_id IS NOT NULL AND NEW.session_id IS NULL)
+    OR (OLD.turn_id IS NOT NULL AND NEW.turn_id IS NULL)
+    OR (OLD.attempt_id IS NOT NULL AND NEW.attempt_id IS NULL)
+  ) THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.status IN ('failed', 'expired', 'deleted') THEN
+    RETURN NEW;
+  END IF;
+
+  v_reason := CASE
+    WHEN NEW.session_id IS NULL THEN 'session_deleted'
+    WHEN NEW.turn_id IS NULL THEN 'turn_deleted'
+    ELSE 'attempt_deleted'
+  END;
+  NEW.cleanup_reason := v_reason;
+  NEW.updated_at := clock_timestamp();
+
+  IF NEW.status IN ('pending', 'reconciling', 'ready', 'cleanup_queued') THEN
+    NEW.status := 'cleanup_queued';
+    NEW.maintenance_claim_id := NULL;
+    NEW.maintenance_claimed_at := NULL;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS "retained_screenshot_detachment_queue_trg"
+  ON "retained_screenshot_artifacts";
+CREATE TRIGGER "retained_screenshot_detachment_queue_trg"
+BEFORE UPDATE OF "session_id", "turn_id", "attempt_id"
+ON "retained_screenshot_artifacts"
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.queue_detached_retained_screenshot();
+
+DROP FUNCTION opengeni_private.claim_retained_screenshot_maintenance(bigint, bigint, integer);
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.claim_retained_screenshot_maintenance(
+      p_pending_grace_ms bigint,
+      p_claim_timeout_ms bigint,
+      p_limit integer
+    )
+    RETURNS TABLE (
+      action text,
+      claim_id uuid,
+      artifact_id uuid,
+      account_id uuid,
+      workspace_id uuid,
+      session_id uuid,
+      object_key text,
+      media_type text,
+      size_bytes bigint,
+      sha256 text,
+      width integer,
+      height integer,
+      retention_expires_at timestamptz,
+      cleanup_reason text
+    )
+    LANGUAGE sql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+      WITH candidates AS (
+        SELECT
+          A.artifact_id,
+          gen_random_uuid() AS claim_id,
+          CASE
+            WHEN A.status IN ('pending', 'reconciling') THEN 'reconcile'
+            ELSE 'delete'
+          END AS action,
+          CASE
+            WHEN A.status = 'ready' THEN 'expired'
+            WHEN A.status IN ('cleanup_queued', 'cleanup_pending')
+              THEN coalesce(A.cleanup_reason, 'orphaned')
+            ELSE NULL
+          END AS cleanup_reason
+        FROM %1$I.retained_screenshot_artifacts A
+        WHERE
+          (A.status = 'ready' AND A.retention_expires_at <= clock_timestamp())
+          OR A.status = 'cleanup_queued'
+          OR (
+            A.status = 'pending'
+            AND A.updated_at <= clock_timestamp() - (
+              greatest(p_pending_grace_ms, 0)::double precision * interval '1 millisecond'
+            )
+          )
+          OR (
+            A.status IN ('reconciling', 'cleanup_pending')
+            AND A.maintenance_claimed_at <= clock_timestamp() - (
+              greatest(p_claim_timeout_ms, 0)::double precision * interval '1 millisecond'
+            )
+          )
+        ORDER BY A.retention_expires_at, A.artifact_id
+        LIMIT least(greatest(p_limit, 0), 1000)
+        FOR UPDATE SKIP LOCKED
+      ), claimed AS (
+        UPDATE %1$I.retained_screenshot_artifacts A
+        SET
+          status = CASE WHEN C.action = 'reconcile' THEN 'reconciling' ELSE 'cleanup_pending' END,
+          cleanup_reason = C.cleanup_reason,
+          maintenance_claim_id = C.claim_id,
+          maintenance_claimed_at = clock_timestamp(),
+          updated_at = clock_timestamp()
+        FROM candidates C
+        WHERE A.artifact_id = C.artifact_id
+        RETURNING A.*, C.action, C.claim_id
+      )
+      SELECT C.action, C.claim_id, C.artifact_id, C.account_id, C.workspace_id, C.session_id,
+        F.object_key, C.media_type, C.size_bytes, C.sha256, C.width, C.height,
+        C.retention_expires_at, C.cleanup_reason
+      FROM claimed C
+      JOIN %1$I.files F
+        ON F.workspace_id = C.workspace_id
+       AND F.id = C.artifact_id;
+    $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.claim_retained_screenshot_maintenance(bigint, bigint, integer)
+  FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_retained_screenshot_maintenance(bigint, bigint, integer)
+      TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0181_connected_machine_removal.sql

@@ -0,0 +1,52 @@
+-- deployment-mode: rolling
+
+-- Connected-machine removal is a control-plane operation. The enrollment row
+-- remains durable evidence; this receipt table makes retries deterministic and
+-- preserves blocked dependency explanations without storing credentials.
+CREATE TABLE "machine_removal_operations" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "enrollment_id" uuid NOT NULL REFERENCES "enrollments"("id") ON DELETE RESTRICT,
+  "operation_key" text NOT NULL,
+  "request_fingerprint" text NOT NULL,
+  "outcome" text NOT NULL,
+  "result" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "machine_removal_operations_request_fingerprint_chk"
+    CHECK ("request_fingerprint" ~ '^[0-9a-f]{64}$'),
+  CONSTRAINT "machine_removal_operations_operation_key_chk"
+    CHECK (length(btrim("operation_key")) BETWEEN 1 AND 200
+      AND "operation_key" = btrim("operation_key")),
+  CONSTRAINT "machine_removal_operations_outcome_chk"
+    CHECK ("outcome" IN ('removed', 'already_removed', 'blocked')),
+  CONSTRAINT "machine_removal_operations_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "machine_removal_operations_workspace_operation_uq"
+  ON "machine_removal_operations" ("workspace_id", "operation_key");
+CREATE UNIQUE INDEX "machine_removal_operations_workspace_id_uq"
+  ON "machine_removal_operations" ("workspace_id", "id");
+CREATE INDEX "machine_removal_operations_enrollment_created_idx"
+  ON "machine_removal_operations" ("workspace_id", "enrollment_id", "created_at");
+
+ALTER TABLE "machine_removal_operations" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "machine_removal_operations" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "machine_removal_operations"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.machine_removal_operations TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END
+$grants$;

package/drizzle/0182_connected_machine_remove_session_default.sql

@@ -0,0 +1,77 @@
+-- deployment-mode: rolling
+-- Migration 0172 is already deployed and immutable. Keep its database-owned
+-- fallback default aligned with the connected-machine removal tool through a
+-- forward migration; application session creation still writes its exact
+-- frozen tool selection explicitly.
+
+ALTER TABLE "sessions"
+  ALTER COLUMN "first_party_mcp_tools"
+  SET DEFAULT '[
+    "set_session_title",
+    "goal_set",
+    "goal_update",
+    "goal_complete",
+    "goal_pause",
+    "memory_search",
+    "memory_save",
+    "memory_correct",
+    "preference_registry_summary",
+    "preference_registry_get",
+    "sandboxes_list",
+    "sandbox_attach",
+    "sandbox_swap",
+    "run_on",
+    "sandbox_provision",
+    "connected_machine_remove",
+    "rig_list",
+    "rig_get",
+    "rig_propose_change",
+    "rig_verify",
+    "rig_promote",
+    "sessions_list",
+    "session_get",
+    "session_events",
+    "session_create",
+    "session_send_message",
+    "session_pause",
+    "session_resume",
+    "session_steer",
+    "set_other_session_title",
+    "variable_set_list",
+    "environment_list",
+    "variable_set_set_variable",
+    "environment_set_variable",
+    "github_connect_link",
+    "github_repositories_list",
+    "social_connections_list",
+    "social_posts_recent",
+    "social_daily_analysis_context",
+    "social_search_live",
+    "social_mentions_live",
+    "social_thread_fetch",
+    "social_posts_sync",
+    "social_post_reply",
+    "scheduled_tasks_list",
+    "scheduled_tasks_get",
+    "scheduled_tasks_create",
+    "scheduled_tasks_update",
+    "scheduled_tasks_pause",
+    "scheduled_tasks_resume",
+    "scheduled_tasks_trigger",
+    "scheduled_tasks_delete",
+    "scheduled_task_runs_list",
+    "slack_bot_list_channels",
+    "slack_bot_channel_history",
+    "slack_bot_thread_replies",
+    "slack_bot_list_users",
+    "slack_bot_list_files",
+    "slack_bot_file_info",
+    "slack_bot_file_content",
+    "slack_bot_post_message",
+    "slack_bot_delete_message",
+    "artifacts_list",
+    "artifacts_get_source",
+    "artifacts_create",
+    "artifacts_publish",
+    "artifacts_rollback"
+  ]'::jsonb;

package/drizzle/0183_model_call_provider_cost_estimates.sql

@@ -0,0 +1,39 @@
+-- deployment-mode: rolling
+-- Preserve the captured provider-rate comparison separately from the OpenGeni
+-- credit price. Existing facts remain unknown rather than being rewritten with
+-- today's rates or incorrectly treating credit markup as provider cost.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "model_call_facts"
+  ADD COLUMN IF NOT EXISTS "estimated_provider_cost_micros" bigint,
+  ADD COLUMN IF NOT EXISTS "pricing_source" text;
+
+ALTER TABLE "model_call_facts"
+  DROP CONSTRAINT IF EXISTS "model_call_facts_estimated_provider_cost_check",
+  ADD CONSTRAINT "model_call_facts_estimated_provider_cost_check"
+    CHECK (
+      "estimated_provider_cost_micros" IS NULL
+      OR "estimated_provider_cost_micros" >= 0
+    ) NOT VALID;
+
+ALTER TABLE "model_call_facts"
+  VALIDATE CONSTRAINT "model_call_facts_estimated_provider_cost_check";
+
+ALTER TABLE "model_call_facts"
+  DROP CONSTRAINT IF EXISTS "model_call_facts_pricing_source_check",
+  ADD CONSTRAINT "model_call_facts_pricing_source_check"
+    CHECK (
+      ("estimated_provider_cost_micros" IS NULL AND "pricing_source" IS NULL)
+      OR (
+        "estimated_provider_cost_micros" IS NOT NULL
+        AND "pricing_source" IN ('configured_list_price', 'gateway_reported')
+      )
+    ) NOT VALID;
+
+ALTER TABLE "model_call_facts"
+  VALIDATE CONSTRAINT "model_call_facts_pricing_source_check";
+
+RESET statement_timeout;
+RESET lock_timeout;