@opengeni/db 0.36.0 → 1.0.1

package/dist/canonical-human-identities.js

@@ -9,9 +9,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-TAUTWOS5.js";
-import "./chunk-JC5QPLUM.js";
-import "./chunk-5KTIEDX7.js";
+} from "./chunk-LTG3S6ZY.js";
+import "./chunk-ZWREYEWA.js";
+import "./chunk-6ZYKCRFO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-P3RE4D2B.js → chunk-4SR4HKKA.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-JC5QPLUM.js";
+} from "./chunk-ZWREYEWA.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3532,4 +3532,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-P3RE4D2B.js.map
+//# sourceMappingURL=chunk-4SR4HKKA.js.map

package/dist/{chunk-5KTIEDX7.js → chunk-6ZYKCRFO.js}

@@ -82,6 +82,8 @@ __export(schema_exports, {
   generatedVideoArtifacts: () => generatedVideoArtifacts,
   githubInstallationRepositories: () => githubInstallationRepositories,
   githubInstallations: () => githubInstallations,
+  googleDriveObjectAclEvidence: () => googleDriveObjectAclEvidence,
+  googleDriveObjectAclPrincipals: () => googleDriveObjectAclPrincipals,
   hostExportConfig: () => hostExportConfig,
   hostExportConsumers: () => hostExportConsumers,
   hostExportCursorState: () => hostExportCursorState,
@@ -275,7 +277,7 @@ import {
   jsonb as jsonb12,
   numeric,
   pgTable as pgTable13,
-  primaryKey as primaryKey4,
+  primaryKey as primaryKey5,
   text as text13,
   timestamp as timestamp13,
   unique,
@@ -3046,6 +3048,7 @@ import {
   integer as integer10,
   jsonb as jsonb9,
   pgTable as pgTable10,
+  primaryKey as primaryKey2,
   text as text10,
   timestamp as timestamp10,
   uniqueIndex as uniqueIndex10,
@@ -3207,6 +3210,7 @@ var knowledgeSourceSyncIndexObligations = pgTable10(
     objectLifecycleGeneration: bigint8("object_lifecycle_generation", { mode: "number" }).notNull(),
     objectVersionGeneration: bigint8("object_version_generation", { mode: "number" }).notNull(),
     citationLocator: jsonb9("citation_locator").$type().notNull(),
+    googleDriveAclEvidenceId: uuid10("google_drive_acl_evidence_id"),
     aclEligibility: text10("acl_eligibility").notNull().default("pending"),
     status: text10("status").notNull().default("pending"),
     failureCode: text10("failure_code"),
@@ -3224,6 +3228,85 @@ var knowledgeSourceSyncIndexObligations = pgTable10(
     )
   })
 );
+var googleDriveObjectAclEvidence = pgTable10(
+  "google_drive_object_acl_evidence",
+  {
+    id: uuid10("id").primaryKey().defaultRandom(),
+    accountId: uuid10("account_id").notNull(),
+    workspaceId: uuid10("workspace_id").notNull(),
+    sourceId: uuid10("source_id").notNull(),
+    knowledgeSourceObjectId: uuid10("knowledge_source_object_id").notNull(),
+    knowledgeDocumentVersionId: uuid10("knowledge_document_version_id").notNull(),
+    documentId: uuid10("document_id").notNull(),
+    fileId: uuid10("file_id").notNull(),
+    indexObligationId: uuid10("index_obligation_id").notNull(),
+    connectionId: uuid10("connection_id").notNull(),
+    connectionVersion: bigint8("connection_version", { mode: "number" }).notNull(),
+    sourcePrincipalHash: text10("source_principal_hash").notNull(),
+    sourceSyncGeneration: bigint8("source_sync_generation", { mode: "number" }).notNull(),
+    sourceConfigGeneration: bigint8("source_config_generation", { mode: "number" }).notNull(),
+    sourceLifecycleGeneration: bigint8("source_lifecycle_generation", { mode: "number" }).notNull(),
+    objectLifecycleGeneration: bigint8("object_lifecycle_generation", {
+      mode: "number"
+    }).notNull(),
+    objectVersionGeneration: bigint8("object_version_generation", { mode: "number" }).notNull(),
+    providerRevision: text10("provider_revision"),
+    driveId: text10("drive_id"),
+    aclRevision: text10("acl_revision").notNull(),
+    aclHash: text10("acl_hash").notNull(),
+    eligibility: text10("eligibility").notNull(),
+    observedAt: timestamp10("observed_at", { withTimezone: true }).notNull(),
+    expiresAt: timestamp10("expires_at", { withTimezone: true }).notNull(),
+    citationLocator: jsonb9("citation_locator").$type().notNull(),
+    operationId: text10("operation_id").notNull(),
+    inputHash: text10("input_hash").notNull(),
+    createdAt: timestamp10("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    obligationOperation: uniqueIndex10("google_drive_object_acl_evidence_obligation_uq").on(
+      table.indexObligationId,
+      table.operationId
+    ),
+    version: index10("google_drive_object_acl_evidence_version_idx").on(
+      table.knowledgeDocumentVersionId,
+      table.expiresAt,
+      table.createdAt
+    ),
+    file: index10("google_drive_object_acl_evidence_file_idx").on(
+      table.accountId,
+      table.fileId,
+      table.expiresAt
+    )
+  })
+);
+var googleDriveObjectAclPrincipals = pgTable10(
+  "google_drive_object_acl_principals",
+  {
+    evidenceId: uuid10("evidence_id").notNull(),
+    ordinal: integer10("ordinal").notNull(),
+    accountId: uuid10("account_id").notNull(),
+    workspaceId: uuid10("workspace_id").notNull(),
+    principalType: text10("principal_type").notNull(),
+    permissionIdHash: text10("permission_id_hash"),
+    emailHash: text10("email_hash"),
+    domainHash: text10("domain_hash"),
+    role: text10("role").notNull(),
+    inherited: boolean4("inherited").notNull().default(false),
+    allowFileDiscovery: boolean4("allow_file_discovery"),
+    expirationTime: timestamp10("expiration_time", { withTimezone: true }),
+    createdAt: timestamp10("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    identity: primaryKey2({ columns: [table.evidenceId, table.ordinal] }),
+    match: index10("google_drive_object_acl_principals_match_idx").on(
+      table.evidenceId,
+      table.principalType,
+      table.permissionIdHash,
+      table.emailHash,
+      table.domainHash
+    )
+  })
+);
 
 // src/transcription-recordings-schema.ts
 import { sql as sql10 } from "drizzle-orm";
@@ -3234,7 +3317,7 @@ import {
   integer as integer11,
   jsonb as jsonb10,
   pgTable as pgTable11,
-  primaryKey as primaryKey2,
+  primaryKey as primaryKey3,
   text as text11,
   timestamp as timestamp11,
   uniqueIndex as uniqueIndex11,
@@ -3378,7 +3461,7 @@ var transcriptionRecordingChunks = pgTable11(
     completedAt: timestamp11("completed_at", { withTimezone: true })
   },
   (table) => ({
-    pk: primaryKey2({
+    pk: primaryKey3({
       name: "transcription_recording_chunks_pk",
       columns: [table.recordingId, table.chunkNumber]
     }),
@@ -3431,7 +3514,7 @@ var transcriptionRecordingSegments = pgTable11(
     updatedAt: timestamp11("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
-    pk: primaryKey2({
+    pk: primaryKey3({
       name: "transcription_recording_segments_pk",
       columns: [table.recordingId, table.segmentNumber]
     }),
@@ -3472,7 +3555,7 @@ import {
   integer as integer12,
   jsonb as jsonb11,
   pgTable as pgTable12,
-  primaryKey as primaryKey3,
+  primaryKey as primaryKey4,
   text as text12,
   timestamp as timestamp12,
   uniqueIndex as uniqueIndex12,
@@ -3906,7 +3989,7 @@ var attachedBrowserDevices = pgTable12(
     updatedAt: timestamp12("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
-    identity: primaryKey3({
+    identity: primaryKey4({
       name: "attached_browser_devices_workspace_id_pk",
       columns: [table.workspaceId, table.id]
     }),
@@ -3957,7 +4040,7 @@ var attachedBrowserInventories = pgTable12(
     updatedAt: timestamp12("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
-    identity: primaryKey3({
+    identity: primaryKey4({
       name: "attached_browser_inventories_workspace_enrollment_pk",
       columns: [table.workspaceId, table.enrollmentId]
     }),
@@ -7000,10 +7083,10 @@ var sessions = pgTable13(
     status: text13("status").notNull().default("queued"),
     initialMessage: losslessText("initial_message").notNull(),
     initialMessageCodecVersion: losslessCodecVersion("initial_message_codec_version"),
-    // Invisible host context frozen with the winning session create. The
-    // initial turn copies this value so an idempotent repair can never adopt a
-    // retrying caller's different instructions.
-    initialTurnInstructions: text13("initial_turn_instructions"),
+    // Model-visible application context frozen with the winning create. The
+    // initial turn copies it into the canonical user message so an idempotent
+    // repair cannot adopt a retrying caller's different message context.
+    initialModelContext: text13("initial_model_context"),
     title: text13("title"),
     titleSource: text13("title_source"),
     // Per-session agent persona/system instructions supplied at create (the
@@ -7284,6 +7367,11 @@ var sessions = pgTable13(
       table.workspaceId,
       table.rootSessionId,
       table.nestedAgentDepth
+    ),
+    initialModelContextValid: check10(
+      "sessions_initial_model_context_check",
+      sql12`${table.initialModelContext} is null
+        or opengeni_private.model_context_value_valid(${table.initialModelContext})`
     )
   })
 );
@@ -7618,6 +7706,9 @@ var sessionRealtimeEntries = pgTable13(
     textCodecVersion: losslessCodecVersion("text_codec_version"),
     payload: losslessJsonb("payload").$type().notNull().default({}),
     payloadCodecVersion: losslessCodecVersion("payload_codec_version"),
+    // Application context for an exact provider-in delegation or finalized
+    // transcript. It is materialized as ordinary user-role message content.
+    modelContext: text13("model_context"),
     clientAckedAt: timestamp13("client_acked_at", { withTimezone: true }),
     providerAckedAt: timestamp13("provider_acked_at", { withTimezone: true }),
     createdAt: timestamp13("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -7682,6 +7773,15 @@ var sessionRealtimeEntries = pgTable13(
       sql12`(${table.kind} = 'user_transcript' and ${table.role} = 'user' and ${table.text} is not null)
         or (${table.kind} = 'assistant_transcript' and ${table.role} = 'assistant' and ${table.text} is not null)
         or (${table.kind} not in ('user_transcript', 'assistant_transcript') and ${table.role} is null)`
+    ),
+    modelContextValid: check10(
+      "session_realtime_entries_model_context_check",
+      sql12`${table.modelContext} is null
+        or (
+          ${table.direction} = 'provider_in'
+          and ${table.kind} in ('delegation_call', 'user_transcript', 'assistant_transcript')
+          and opengeni_private.model_context_value_valid(${table.modelContext})
+        )`
     )
   })
 );
@@ -8291,7 +8391,7 @@ var videoGenerationReferences = pgTable13(
     createdAt: timestamp13("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
-    pk: primaryKey4({
+    pk: primaryKey5({
       name: "video_generation_references_pk",
       columns: [table.operationId, table.ordinal]
     }),
@@ -8798,9 +8898,10 @@ var sessionTurns = pgTable13(
     prompt: losslessText("prompt").notNull(),
     promptCodecVersion: losslessCodecVersion("prompt_codec_version"),
     annotations: jsonb12("annotations").$type().notNull().default([]),
-    // Host context for this exact turn. System-level at runtime and deliberately
-    // separate from the visible prompt/event payload.
-    turnInstructions: text13("turn_instructions"),
+    // Application context for this exact user message. It is copied into the
+    // canonical user-role history item at claim and omitted from public queue
+    // projections; full event/audit data retains it.
+    modelContext: text13("model_context"),
     resources: jsonb12("resources").$type().notNull().default([]),
     tools: jsonb12("tools").$type().notNull().default([]),
     // false = inherit the durable session policy; true = this turn explicitly
@@ -8868,6 +8969,11 @@ var sessionTurns = pgTable13(
     latencyModeValid: check10(
       "session_turns_latency_mode_check",
       sql12`${table.latencyMode} in ('standard', 'priority', 'fast')`
+    ),
+    modelContextValid: check10(
+      "session_turns_model_context_check",
+      sql12`${table.modelContext} is null
+        or opengeni_private.model_context_value_valid(${table.modelContext})`
     )
   })
 );
@@ -13001,6 +13107,8 @@ export {
   knowledgeSourceSyncItemOutcomes,
   knowledgeSourceSyncWakes,
   knowledgeSourceSyncIndexObligations,
+  googleDriveObjectAclEvidence,
+  googleDriveObjectAclPrincipals,
   transcriptionRecordingStateValues,
   transcriptionRecordingChunkStateValues,
   transcriptionRecordingObjectKindValues,
@@ -13197,4 +13305,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-5KTIEDX7.js.map
+//# sourceMappingURL=chunk-6ZYKCRFO.js.map