@opengeni/db 0.28.9 → 0.36.0

package/drizzle/0192_editable_artifact_live_tickets.sql

@@ -0,0 +1,338 @@
+-- deployment-mode: rolling
+-- Shared, one-use live admission tickets. Only token digests are persisted;
+-- the opaque bearer token never crosses this storage boundary.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE TABLE "editable_artifact_live_tickets" (
+  "token_digest" text PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "artifact_id" text NOT NULL,
+  "modality" text NOT NULL,
+  "actor_kind" text NOT NULL,
+  "actor_subject_id" text NOT NULL,
+  "replica_id" text NOT NULL,
+  "agent_session_id" text,
+  "agent_turn_id" text,
+  "agent_attempt_id" text,
+  "agent_generation" integer,
+  "service_name" text,
+  "allow_edit" boolean NOT NULL,
+  "protocol_version" integer NOT NULL,
+  "issued_at" timestamptz NOT NULL,
+  "expires_at" timestamptz NOT NULL,
+  CONSTRAINT "editable_artifact_live_tickets_artifact_fk"
+    FOREIGN KEY ("account_id", "workspace_id", "artifact_id")
+    REFERENCES "editable_artifacts"("account_id", "workspace_id", "id")
+    ON DELETE CASCADE,
+  CONSTRAINT "editable_artifact_live_tickets_digest_chk" CHECK (
+    "token_digest" ~ '^sha256:[0-9a-f]{64}$'
+  ),
+  CONSTRAINT "editable_artifact_live_tickets_identity_chk" CHECK (
+    "artifact_id" ~ '^[0-9a-f]{32}$' AND "artifact_id" !~ '^0+$'
+    AND "replica_id" ~ '^[0-9a-f]{16}$' AND "replica_id" !~ '^0+$'
+  ),
+  CONSTRAINT "editable_artifact_live_tickets_modality_chk" CHECK (
+    "modality" IN ('spreadsheet', 'presentation', 'document')
+  ),
+  CONSTRAINT "editable_artifact_live_tickets_actor_chk" CHECK (
+    octet_length("actor_subject_id") BETWEEN 1 AND 1024
+    AND "actor_subject_id" = btrim("actor_subject_id")
+    AND (
+      ("actor_kind" = 'human'
+        AND "agent_session_id" IS NULL
+        AND "agent_turn_id" IS NULL
+        AND "agent_attempt_id" IS NULL
+        AND "agent_generation" IS NULL
+        AND "service_name" IS NULL)
+      OR
+      ("actor_kind" = 'agent'
+        AND "agent_session_id" IS NOT NULL
+        AND octet_length("agent_session_id") BETWEEN 1 AND 1024
+        AND "agent_session_id" = btrim("agent_session_id")
+        AND "agent_turn_id" IS NOT NULL
+        AND octet_length("agent_turn_id") BETWEEN 1 AND 1024
+        AND "agent_turn_id" = btrim("agent_turn_id")
+        AND "agent_attempt_id" IS NOT NULL
+        AND octet_length("agent_attempt_id") BETWEEN 1 AND 1024
+        AND "agent_attempt_id" = btrim("agent_attempt_id")
+        AND "agent_generation" IS NOT NULL
+        AND "agent_generation" BETWEEN 0 AND 2147483647
+        AND "service_name" IS NULL)
+      OR
+      ("actor_kind" = 'service'
+        AND "agent_session_id" IS NULL
+        AND "agent_turn_id" IS NULL
+        AND "agent_attempt_id" IS NULL
+        AND "agent_generation" IS NULL
+        AND "service_name" IS NOT NULL
+        AND octet_length("service_name") BETWEEN 1 AND 1024
+        AND "service_name" = btrim("service_name"))
+    )
+  ),
+  CONSTRAINT "editable_artifact_live_tickets_lifetime_chk" CHECK (
+    "protocol_version" BETWEEN 1 AND 2147483647
+    AND "expires_at" >= "issued_at" + interval '1 second'
+    AND "expires_at" <= "issued_at" + interval '60 seconds'
+  )
+);
+
+CREATE INDEX "editable_artifact_live_tickets_expiry_idx"
+  ON "editable_artifact_live_tickets" ("expires_at", "token_digest");
+
+ALTER TABLE "editable_artifact_live_tickets" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "editable_artifact_live_tickets" FORCE ROW LEVEL SECURITY;
+
+DO $ticket_owner_policy$
+DECLARE data_schema text := pg_catalog.current_schema();
+DECLARE migration_owner text := current_user;
+BEGIN
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY editable_artifact_live_ticket_owner ON %I.editable_artifact_live_tickets '
+    || 'FOR ALL USING (current_user = %L) WITH CHECK (current_user = %L)',
+    data_schema, migration_owner, migration_owner
+  );
+END;
+$ticket_owner_policy$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(
+  requested_schema name
+) RETURNS name
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+BEGIN
+  data_schema := opengeni_private.resolve_editable_artifact_data_schema(requested_schema);
+  PERFORM 1
+  FROM pg_catalog.pg_namespace namespace
+  JOIN pg_catalog.pg_class ticket_relation
+    ON ticket_relation.relnamespace = namespace.oid
+    AND ticket_relation.relname = 'editable_artifact_live_tickets'
+    AND ticket_relation.relkind IN ('r', 'p')
+  JOIN pg_catalog.pg_class artifact_relation
+    ON artifact_relation.relnamespace = namespace.oid
+    AND artifact_relation.relname = 'editable_artifacts'
+    AND artifact_relation.relkind IN ('r', 'p')
+    AND artifact_relation.relowner = ticket_relation.relowner
+  JOIN pg_catalog.pg_roles owner_role
+    ON owner_role.oid = ticket_relation.relowner
+    AND owner_role.rolname = current_user
+  WHERE namespace.nspname = data_schema
+    AND ticket_relation.relrowsecurity
+    AND ticket_relation.relforcerowsecurity;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'editable artifact live ticket data schema is unavailable or untrusted'
+      USING ERRCODE = '42501';
+  END IF;
+  RETURN data_schema;
+END;
+$body$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.put_editable_artifact_live_ticket(
+  p_token_digest text,
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_artifact_id text,
+  p_modality text,
+  p_actor_kind text,
+  p_actor_subject_id text,
+  p_replica_id text,
+  p_agent_session_id text,
+  p_agent_turn_id text,
+  p_agent_attempt_id text,
+  p_agent_generation integer,
+  p_service_name text,
+  p_allow_edit boolean,
+  p_protocol_version integer,
+  p_issued_at timestamptz,
+  p_expires_at timestamptz,
+  p_data_schema name DEFAULT pg_catalog.current_schema()
+) RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+DECLARE stored boolean;
+BEGIN
+  IF NOT opengeni_private.editable_artifact_scope_matches_context(
+    p_account_id, p_workspace_id
+  ) THEN
+    RAISE EXCEPTION 'editable artifact live ticket scope does not match context'
+      USING ERRCODE = '42501';
+  END IF;
+  IF p_issued_at < pg_catalog.clock_timestamp() - interval '60 seconds'
+    OR p_issued_at > pg_catalog.clock_timestamp() + interval '5 seconds'
+    OR p_expires_at <= pg_catalog.clock_timestamp()
+    OR p_expires_at > pg_catalog.clock_timestamp() + interval '60 seconds'
+  THEN
+    RAISE EXCEPTION 'editable artifact live ticket lifetime is outside database bounds'
+      USING ERRCODE = '22023';
+  END IF;
+  data_schema := opengeni_private.resolve_editable_artifact_ticket_data_schema(
+    p_data_schema
+  );
+  EXECUTE pg_catalog.format($query$
+    SELECT true
+    FROM %I.editable_artifacts
+    WHERE account_id = $1 AND workspace_id = $2 AND id = $3
+      AND modality = $4 AND lifecycle_state = 'active'
+  $query$, data_schema)
+    INTO stored
+    USING p_account_id, p_workspace_id, p_artifact_id, p_modality;
+  IF stored IS DISTINCT FROM true THEN
+    RAISE EXCEPTION 'editable artifact live ticket target is unavailable'
+      USING ERRCODE = '23503';
+  END IF;
+  EXECUTE pg_catalog.format($query$
+    INSERT INTO %I.editable_artifact_live_tickets (
+      token_digest, account_id, workspace_id, artifact_id, modality,
+      actor_kind, actor_subject_id, replica_id,
+      agent_session_id, agent_turn_id, agent_attempt_id, agent_generation,
+      service_name, allow_edit, protocol_version, issued_at, expires_at
+    ) VALUES (
+      $1, $2, $3, $4, $5, $6, $7, $8,
+      $9, $10, $11, $12, $13, $14, $15, $16, $17
+    )
+  $query$, data_schema) USING
+    p_token_digest, p_account_id, p_workspace_id, p_artifact_id, p_modality,
+    p_actor_kind, p_actor_subject_id, p_replica_id,
+    p_agent_session_id, p_agent_turn_id, p_agent_attempt_id, p_agent_generation,
+    p_service_name, p_allow_edit, p_protocol_version, p_issued_at, p_expires_at;
+END;
+$body$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.consume_editable_artifact_live_ticket(
+  p_token_digest text,
+  p_data_schema name DEFAULT pg_catalog.current_schema()
+) RETURNS TABLE (
+  token_digest text,
+  account_id uuid,
+  workspace_id uuid,
+  artifact_id text,
+  modality text,
+  actor_kind text,
+  actor_subject_id text,
+  replica_id text,
+  agent_session_id text,
+  agent_turn_id text,
+  agent_attempt_id text,
+  agent_generation integer,
+  service_name text,
+  allow_edit boolean,
+  protocol_version integer,
+  issued_at timestamptz,
+  expires_at timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+BEGIN
+  IF p_token_digest !~ '^sha256:[0-9a-f]{64}$' THEN
+    RAISE EXCEPTION 'editable artifact live ticket digest is malformed'
+      USING ERRCODE = '22023';
+  END IF;
+  data_schema := opengeni_private.resolve_editable_artifact_ticket_data_schema(
+    p_data_schema
+  );
+  RETURN QUERY EXECUTE pg_catalog.format($query$
+    WITH consumed AS (
+      DELETE FROM %I.editable_artifact_live_tickets ticket
+      WHERE ticket.token_digest = $1
+      RETURNING ticket.token_digest, ticket.account_id, ticket.workspace_id,
+        ticket.artifact_id, ticket.modality, ticket.actor_kind,
+        ticket.actor_subject_id, ticket.replica_id, ticket.agent_session_id,
+        ticket.agent_turn_id, ticket.agent_attempt_id, ticket.agent_generation,
+        ticket.service_name, ticket.allow_edit, ticket.protocol_version,
+        ticket.issued_at, ticket.expires_at
+    )
+    SELECT consumed.*
+    FROM consumed
+    WHERE consumed.expires_at > pg_catalog.clock_timestamp()
+  $query$, data_schema) USING p_token_digest;
+END;
+$body$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(
+  p_limit integer,
+  p_data_schema name DEFAULT pg_catalog.current_schema()
+) RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+DECLARE removed integer;
+BEGIN
+  IF p_limit IS NULL OR p_limit < 1 OR p_limit > 10000 THEN
+    RAISE EXCEPTION 'editable artifact live ticket cleanup limit is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+  data_schema := opengeni_private.resolve_editable_artifact_ticket_data_schema(
+    p_data_schema
+  );
+  EXECUTE pg_catalog.format($query$
+    WITH expired AS (
+      SELECT ticket.token_digest
+      FROM %I.editable_artifact_live_tickets ticket
+      WHERE ticket.expires_at <= pg_catalog.clock_timestamp()
+      ORDER BY ticket.expires_at, ticket.token_digest
+      LIMIT $1
+      FOR UPDATE SKIP LOCKED
+    )
+    DELETE FROM %I.editable_artifact_live_tickets ticket
+    USING expired
+    WHERE ticket.token_digest = expired.token_digest
+  $query$, data_schema, data_schema) USING p_limit;
+  GET DIAGNOSTICS removed = ROW_COUNT;
+  RETURN removed;
+END;
+$body$;
+
+REVOKE ALL ON TABLE "editable_artifact_live_tickets" FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.put_editable_artifact_live_ticket(
+    text, uuid, uuid, text, text, text, text, text,
+    text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name
+  ) FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.consume_editable_artifact_live_ticket(text, name) FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name)
+  FROM PUBLIC;
+
+DO $runtime_ticket_grants$
+DECLARE data_schema name := pg_catalog.current_schema();
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app'
+  ) THEN
+    EXECUTE pg_catalog.format(
+      'REVOKE ALL PRIVILEGES ON TABLE %I.editable_artifact_live_tickets FROM opengeni_app',
+      data_schema
+    );
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.put_editable_artifact_live_ticket(
+        text, uuid, uuid, text, text, text, text, text,
+        text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name
+      ) TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.consume_editable_artifact_live_ticket(text, name)
+      TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name)
+      TO opengeni_app;
+  END IF;
+END;
+$runtime_ticket_grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0193_editable_artifact_authorization.sql

@@ -0,0 +1,190 @@
+-- deployment-mode: rolling
+-- Durable editable-artifact authorization projection and revocation fencing.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE OR REPLACE FUNCTION opengeni_private.authorize_editable_artifact_actor(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_artifact_id text,
+  p_actor_kind text,
+  p_actor_subject_id text,
+  p_agent_session_id text,
+  p_agent_turn_id text,
+  p_agent_attempt_id text,
+  p_agent_generation integer,
+  p_service_name text,
+  p_permission text,
+  p_data_schema name DEFAULT pg_catalog.current_schema()
+) RETURNS TABLE (allowed boolean, authorization_revision bigint)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+DECLARE required_permission text;
+DECLARE current_revision bigint;
+DECLARE principal_allowed boolean := false;
+BEGIN
+  IF p_account_id IS NULL OR p_workspace_id IS NULL
+    OR p_artifact_id !~ '^[0-9a-f]{32}$' OR p_artifact_id ~ '^0+$'
+    OR p_actor_kind NOT IN ('human', 'agent', 'service')
+    OR p_actor_subject_id IS NULL
+    OR octet_length(p_actor_subject_id) NOT BETWEEN 1 AND 1024
+    OR p_actor_subject_id <> btrim(p_actor_subject_id)
+    OR p_permission NOT IN ('create', 'read', 'edit', 'import', 'export', 'manage')
+    OR NOT opengeni_private.editable_artifact_scope_matches_context(
+      p_account_id, p_workspace_id
+    )
+  THEN
+    RAISE EXCEPTION 'editable artifact authorization request is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+  IF (p_actor_kind = 'human' AND (
+      p_agent_session_id IS NOT NULL OR p_agent_turn_id IS NOT NULL
+      OR p_agent_attempt_id IS NOT NULL OR p_agent_generation IS NOT NULL
+      OR p_service_name IS NOT NULL
+    )) OR (p_actor_kind = 'agent' AND (
+      p_agent_session_id IS NULL OR p_agent_turn_id IS NULL
+      OR p_agent_attempt_id IS NULL OR p_agent_generation IS NULL
+      OR p_agent_generation < 0 OR p_service_name IS NOT NULL
+    )) OR (p_actor_kind = 'service' AND (
+      p_agent_session_id IS NOT NULL OR p_agent_turn_id IS NOT NULL
+      OR p_agent_attempt_id IS NOT NULL OR p_agent_generation IS NOT NULL
+      OR p_service_name IS NULL
+    ))
+  THEN
+    RAISE EXCEPTION 'editable artifact authorization actor is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+
+  data_schema := opengeni_private.resolve_editable_artifact_data_schema(p_data_schema);
+  required_permission := CASE
+    WHEN p_permission IN ('read', 'export') THEN 'artifacts:read'
+    ELSE 'artifacts:publish'
+  END;
+
+  IF p_permission = 'create' THEN
+    current_revision := opengeni_private.ensure_editable_artifact_scope_authorization_head(
+      p_account_id, p_workspace_id, data_schema
+    );
+  ELSE
+    EXECUTE pg_catalog.format($query$
+      SELECT artifact.authorization_revision
+      FROM %I.editable_artifacts artifact
+      WHERE artifact.account_id = $1 AND artifact.workspace_id = $2
+        AND artifact.id = $3
+    $query$, data_schema)
+      INTO current_revision
+      USING p_account_id, p_workspace_id, p_artifact_id;
+    current_revision := coalesce(current_revision, 1);
+  END IF;
+
+  IF p_actor_kind = 'agent' THEN
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.sessions session
+      JOIN %I.session_turns turn
+        ON turn.account_id = session.account_id
+        AND turn.workspace_id = session.workspace_id
+        AND turn.session_id = session.id
+      JOIN %I.session_turn_attempts attempt
+        ON attempt.account_id = turn.account_id
+        AND attempt.workspace_id = turn.workspace_id
+        AND attempt.session_id = turn.session_id
+        AND attempt.turn_id = turn.id
+      WHERE session.account_id = $1 AND session.workspace_id = $2
+        AND session.id::text = $3
+        AND turn.id::text = $4
+        AND attempt.id::text = $5
+        AND session.active_turn_id = turn.id
+        AND turn.active_attempt_id = attempt.id
+        AND turn.execution_generation = $6
+        AND attempt.execution_generation = $6
+        AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
+        AND attempt.state IN ('claimed', 'running')
+        AND attempt.closed_at IS NULL AND attempt.quiesced_at IS NULL
+        AND NOT EXISTS (
+          SELECT 1
+          FROM %I.session_attempt_interruptions interruption
+          WHERE interruption.account_id = session.account_id
+            AND interruption.workspace_id = session.workspace_id
+            AND interruption.session_id = session.id
+            AND interruption.attempt_id = attempt.id
+            AND interruption.state IN ('pending', 'delivered', 'acknowledged')
+        )
+        AND (
+          session.first_party_mcp_permissions IS NULL
+          OR session.first_party_mcp_permissions ? $7
+          OR session.first_party_mcp_permissions ? 'workspace:admin'
+        )
+      LIMIT 1
+      FOR SHARE OF session, turn, attempt
+    $query$, data_schema, data_schema, data_schema, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_agent_session_id,
+        p_agent_turn_id, p_agent_attempt_id, p_agent_generation,
+        required_permission;
+  ELSIF p_actor_kind = 'service'
+    AND p_service_name = 'api_key'
+    AND p_actor_subject_id ~ '^api_key:[0-9a-fA-F-]{36}$'
+  THEN
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.api_keys api_key
+      WHERE api_key.account_id = $1 AND api_key.workspace_id = $2
+        AND api_key.id::text = substring($3 from 9)
+        AND api_key.revoked_at IS NULL
+        AND (api_key.expires_at IS NULL OR api_key.expires_at > pg_catalog.clock_timestamp())
+        AND (api_key.permissions ? $4 OR api_key.permissions ? 'workspace:admin')
+      LIMIT 1
+      FOR SHARE OF api_key
+    $query$, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_actor_subject_id, required_permission;
+  ELSIF p_actor_kind = 'human'
+    OR (p_actor_kind = 'service' AND p_service_name = 'configured_key')
+  THEN
+    -- Configured deployments authenticate the shared key at the HTTP boundary,
+    -- then persist its exact subject as a workspace membership. Revalidate that
+    -- durable tenant/permission grant here just as for a human session; key
+    -- possession itself is never accepted from caller-authored SQL inputs.
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.workspace_memberships membership
+      WHERE membership.account_id = $1 AND membership.workspace_id = $2
+        AND membership.subject_id = $3
+        AND (membership.permissions ? $4 OR membership.permissions ? 'workspace:admin')
+      LIMIT 1
+      FOR SHARE OF membership
+    $query$, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_actor_subject_id, required_permission;
+  ELSE
+    -- Delegated service grants have no independent transactionally
+    -- revalidatable authority source. Fail closed rather than accepting a
+    -- self-carried grant.
+    principal_allowed := false;
+  END IF;
+
+  RETURN QUERY SELECT coalesce(principal_allowed, false), current_revision;
+END;
+$body$;
+
+REVOKE ALL ON FUNCTION opengeni_private.authorize_editable_artifact_actor(
+  uuid, uuid, text, text, text, text, text, text, integer, text, text, name
+) FROM PUBLIC;
+
+DO $runtime_authorization_grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(
+      uuid, uuid, text, text, text, text, text, text, integer, text, text, name
+    ) TO opengeni_app;
+  END IF;
+END;
+$runtime_authorization_grant$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0194_editable_artifact_durable_exports.sql

@@ -0,0 +1,160 @@
+-- deployment-mode: rolling
+-- Public immutable version pinning and materialization idempotency.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "editable_artifact_versions"
+  ALTER COLUMN "causal_frontier" DROP NOT NULL,
+  ADD COLUMN "native_revision" bigint;
+
+ALTER TABLE "editable_artifact_versions"
+  DROP CONSTRAINT "editable_artifact_versions_facts_chk",
+  ADD CONSTRAINT "editable_artifact_versions_facts_chk" CHECK (
+    "head_sequence" BETWEEN 0 AND 9007199254740991
+    AND "state_hash" ~ '^sha256:[0-9a-f]{64}$'
+    AND octet_length(convert_to("name", 'UTF8')) BETWEEN 1 AND 256
+    AND "name" = btrim("name")
+    AND opengeni_private.editable_artifact_identity_valid("created_by_subject_id")
+    AND ((opengeni_private.editable_artifact_frontier_valid("causal_frontier")
+        AND "native_revision" IS NULL)
+      OR ("causal_frontier" IS NULL
+        AND "native_revision" BETWEEN 0 AND 9007199254740991))
+  );
+
+DROP INDEX "editable_artifact_idempotency_receipts_artifact_request_uq";
+CREATE UNIQUE INDEX "editable_artifact_idempotency_receipts_artifact_request_uq"
+  ON "editable_artifact_idempotency_receipts" (
+    "account_id", "workspace_id", "artifact_id", "operation_kind",
+    "authority_key_digest", "idempotency_key"
+  )
+  WHERE "operation_kind" IN ('edit', 'snapshot', 'version', 'materialize');
+
+ALTER TABLE "editable_artifact_idempotency_receipts"
+  DROP CONSTRAINT "editable_artifact_idempotency_receipts_key_chk",
+  DROP CONSTRAINT "editable_artifact_idempotency_receipts_resource_chk",
+  ADD CONSTRAINT "editable_artifact_idempotency_receipts_key_chk" CHECK (
+    "operation_kind" IN ('create', 'import', 'edit', 'snapshot', 'version', 'materialize')
+    AND octet_length(convert_to("authority_key", 'UTF8')) BETWEEN 1 AND 8192
+    AND octet_length("idempotency_key") BETWEEN 1 AND 256
+    AND "idempotency_key" = btrim("idempotency_key")
+  ),
+  ADD CONSTRAINT "editable_artifact_idempotency_receipts_resource_chk" CHECK (
+    "resource_type" IN (
+      'artifact', 'transaction', 'snapshot', 'artifact_version', 'materialization_job'
+    )
+    AND (
+      ("operation_kind" = 'create' AND "resource_type" = 'artifact'
+        AND "resource_id" = "artifact_id" AND "server_transaction_id" IS NULL)
+      OR ("operation_kind" = 'edit' AND "resource_type" = 'transaction'
+        AND "resource_id" = "server_transaction_id")
+      OR ("operation_kind" = 'snapshot' AND "resource_type" = 'snapshot'
+        AND "server_transaction_id" IS NULL)
+      OR ("operation_kind" = 'version' AND "resource_type" = 'artifact_version'
+        AND "server_transaction_id" IS NULL)
+      OR ("operation_kind" = 'materialize'
+        AND "resource_type" = 'materialization_job'
+        AND "server_transaction_id" IS NULL)
+      OR ("operation_kind" = 'import' AND "resource_type" = 'artifact'
+        AND "resource_id" = "artifact_id" AND "server_transaction_id" IS NULL)
+    )
+  );
+
+DROP TRIGGER "editable_artifact_versions_projection_guard"
+  ON "editable_artifact_versions";
+
+CREATE OR REPLACE FUNCTION opengeni_private.validate_editable_artifact_version_projection()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE artifact_modality text;
+DECLARE checkpoint record;
+DECLARE snapshot record;
+BEGIN
+  PERFORM set_config(
+    'search_path', 'pg_catalog,' || quote_ident(TG_TABLE_SCHEMA) || ',pg_temp', true
+  );
+
+  SELECT artifact.modality INTO artifact_modality
+  FROM editable_artifacts artifact
+  WHERE artifact.account_id = NEW.account_id
+    AND artifact.workspace_id = NEW.workspace_id
+    AND artifact.id = NEW.artifact_id;
+
+  SELECT * INTO checkpoint
+  FROM editable_artifact_sequence_checkpoints candidate
+  WHERE candidate.account_id = NEW.account_id
+    AND candidate.workspace_id = NEW.workspace_id
+    AND candidate.artifact_id = NEW.artifact_id
+    AND candidate.head_sequence = NEW.head_sequence;
+
+  SELECT * INTO snapshot
+  FROM editable_artifact_snapshots candidate
+  WHERE candidate.account_id = NEW.account_id
+    AND candidate.workspace_id = NEW.workspace_id
+    AND candidate.artifact_id = NEW.artifact_id
+    AND candidate.id = NEW.snapshot_id;
+
+  IF artifact_modality IS NULL
+    OR checkpoint.head_sequence IS NULL
+    OR checkpoint.modality <> artifact_modality
+    OR checkpoint.state_hash <> NEW.state_hash
+    OR snapshot.id IS NULL
+    OR snapshot.modality <> artifact_modality
+    OR snapshot.covered_head_sequence <> NEW.head_sequence
+    OR snapshot.state_hash <> NEW.state_hash
+    OR (artifact_modality = 'spreadsheet' AND (
+      NEW.native_revision IS NOT NULL
+      OR checkpoint.causal_frontier IS DISTINCT FROM NEW.causal_frontier
+      OR snapshot.covered_causal_frontier IS DISTINCT FROM NEW.causal_frontier
+    ))
+    OR (artifact_modality IN ('document', 'presentation') AND (
+      NEW.causal_frontier IS NOT NULL
+      OR checkpoint.native_revision IS DISTINCT FROM NEW.native_revision
+      OR snapshot.native_revision IS DISTINCT FROM NEW.native_revision
+    ))
+  THEN
+    RAISE EXCEPTION 'artifact version does not exactly pin a verified snapshot checkpoint'
+      USING ERRCODE = '23514';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM editable_artifact_idempotency_receipts receipt
+    WHERE receipt.account_id = NEW.account_id
+      AND receipt.workspace_id = NEW.workspace_id
+      AND receipt.artifact_id = NEW.artifact_id
+      AND receipt.operation_kind = 'version'
+      AND receipt.resource_type = 'artifact_version'
+      AND receipt.resource_id = NEW.id
+      AND receipt.server_transaction_id IS NULL
+      AND opengeni_private.editable_artifact_object_has_exact_keys(
+        receipt.result, ARRAY['artifactId', 'schemaVersion', 'versionId']
+      )
+      AND jsonb_typeof(receipt.result->'schemaVersion') = 'number'
+      AND receipt.result->>'schemaVersion' = '1'
+      AND jsonb_typeof(receipt.result->'artifactId') = 'string'
+      AND receipt.result->>'artifactId' = NEW.artifact_id
+      AND jsonb_typeof(receipt.result->'versionId') = 'string'
+      AND receipt.result->>'versionId' = NEW.id
+  ) THEN
+    RAISE EXCEPTION 'artifact version idempotency receipt is missing'
+      USING ERRCODE = '23514';
+  END IF;
+
+  RETURN NULL;
+END;
+$body$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.validate_editable_artifact_version_projection()
+  FROM PUBLIC;
+
+CREATE CONSTRAINT TRIGGER editable_artifact_versions_projection_guard
+AFTER INSERT ON "editable_artifact_versions"
+DEFERRABLE INITIALLY DEFERRED FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.validate_editable_artifact_version_projection();
+
+RESET statement_timeout;
+RESET lock_timeout;