@opengeni/db 0.7.3 → 0.9.3

package/drizzle/0098_usage_events_workspace_session_idx.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "usage_events_workspace_session_idx"
+  ON "usage_events" ("workspace_id", "session_id", "occurred_at");

package/drizzle/0099_session_human_input_attempt_owner_index.sql

@@ -0,0 +1,6 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS "session_turn_attempts_human_input_owner_uq"
+  ON "session_turn_attempts" (
+    "account_id", "workspace_id", "session_id", "turn_id", "id"
+  );

package/drizzle/0100_session_human_input_requests.sql

@@ -0,0 +1,89 @@
+-- deployment-mode: rolling
+-- Durable, host-neutral structured human input. The OpenAI Agents SDK approval
+-- interruption is an internal freeze primitive only; this table owns the
+-- distinct request/response protocol and its idempotent settlement state. Its
+-- strong attempt-owner index is installed online by migration 0099.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE IF NOT EXISTS "session_human_input_requests" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "session_id" uuid NOT NULL,
+  "turn_id" uuid NOT NULL,
+  "turn_generation" integer NOT NULL,
+  "creation_attempt_id" uuid NOT NULL,
+  "tool_call_id" text NOT NULL,
+  "status" text NOT NULL DEFAULT 'pending',
+  "questions" jsonb NOT NULL,
+  "allow_skip" boolean NOT NULL DEFAULT false,
+  "response" jsonb,
+  "responded_by" text,
+  "responded_at" timestamptz,
+  "expires_at" timestamptz,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_human_input_requests_creation_attempt_fk"
+    FOREIGN KEY (
+      "account_id", "workspace_id", "session_id", "turn_id", "creation_attempt_id"
+    )
+    REFERENCES "session_turn_attempts" (
+      "account_id", "workspace_id", "session_id", "turn_id", "id"
+    )
+    ON DELETE CASCADE,
+  CONSTRAINT "session_human_input_requests_status_check"
+    CHECK ("status" IN ('pending','answered','skipped','expired','cancelled')),
+  CONSTRAINT "session_human_input_requests_generation_check"
+    CHECK ("turn_generation" > 0),
+  CONSTRAINT "session_human_input_requests_tool_call_bytes_check"
+    CHECK (octet_length("tool_call_id") BETWEEN 1 AND 1024),
+  CONSTRAINT "session_human_input_requests_questions_bytes_check"
+    CHECK (octet_length("questions"::text) <= 49152),
+  CONSTRAINT "session_human_input_requests_response_bytes_check"
+    CHECK ("response" IS NULL OR octet_length("response"::text) <= 49152),
+  CONSTRAINT "session_human_input_requests_actor_bytes_check"
+    CHECK ("responded_by" IS NULL OR octet_length("responded_by") <= 1024)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "session_human_input_requests_tool_call_uq"
+  ON "session_human_input_requests" (
+    "workspace_id", "session_id", "turn_id", "tool_call_id"
+  );
+CREATE INDEX IF NOT EXISTS "session_human_input_requests_pending_session_idx"
+  ON "session_human_input_requests" ("workspace_id", "session_id", "created_at", "id")
+  WHERE "status" = 'pending';
+CREATE INDEX IF NOT EXISTS "session_human_input_requests_pending_expiry_idx"
+  ON "session_human_input_requests" ("expires_at", "id")
+  WHERE "status" = 'pending' AND "expires_at" IS NOT NULL;
+
+ALTER TABLE "session_human_input_requests" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_human_input_requests" FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'session_human_input_requests'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "session_human_input_requests";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "session_human_input_requests"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.session_human_input_requests TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END $grants$;

package/drizzle/0101_session_mcp_connection_refs.sql

@@ -0,0 +1,30 @@
+-- deployment-mode: rolling
+-- A session-scoped MCP server may point at a host-owned connection. The value
+-- is non-secret and remains inert unless the standalone broker or an embedding
+-- host credential port resolves it at request time.
+
+ALTER TABLE "session_mcp_servers"
+  ADD COLUMN IF NOT EXISTS "connection_ref" jsonb;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'session_mcp_servers_connection_ref_object_chk'
+      AND conrelid = 'session_mcp_servers'::regclass
+  ) THEN
+    ALTER TABLE "session_mcp_servers"
+      ADD CONSTRAINT "session_mcp_servers_connection_ref_object_chk"
+      CHECK (
+        "connection_ref" IS NULL
+        OR (
+          jsonb_typeof("connection_ref") = 'object'
+          AND COALESCE(jsonb_typeof("connection_ref"->'providerDomain') = 'string', false)
+          AND COALESCE(length("connection_ref"->>'providerDomain') > 0, false)
+        )
+      ) NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "session_mcp_servers"
+  VALIDATE CONSTRAINT "session_mcp_servers_connection_ref_object_chk";

package/drizzle/0102_session_command_receipt_service_actor.sql

@@ -0,0 +1,16 @@
+-- deployment-mode: rolling
+SET LOCAL lock_timeout = '5s';
+
+ALTER TABLE "session_command_receipts"
+  DROP CONSTRAINT "session_command_receipts_actor_check",
+  ADD CONSTRAINT "session_command_receipts_actor_check"
+    CHECK (
+      ("actor_type" = 'agent_attempt' AND "actor_attempt_id" IS NOT NULL
+        AND "actor_subject_id" IS NULL)
+      OR ("actor_type" IN ('human', 'operator', 'service')
+        AND "actor_subject_id" IS NOT NULL
+        AND "actor_attempt_id" IS NULL)
+    ) NOT VALID;
+
+ALTER TABLE "session_command_receipts"
+  VALIDATE CONSTRAINT "session_command_receipts_actor_check";

package/drizzle/0103_host_export_root_session.sql

@@ -0,0 +1,166 @@
+-- deployment-mode: rolling
+-- Preserve immutable session lineage in durable host exports. The outbox owns
+-- the captured root so a later session deletion cannot change an unacknowledged
+-- export. Legacy rows whose source session is already gone remain explicitly
+-- unresolved (NULL) instead of guessing.
+
+ALTER TABLE "host_export_outbox"
+  ADD COLUMN IF NOT EXISTS "root_session_id" uuid;
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.host_export_session_root(
+      p_workspace_id uuid,
+      p_session_id uuid
+    ) RETURNS uuid
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_root_id uuid;
+      v_parent_id uuid;
+      v_depth integer;
+      v_cycle boolean;
+    BEGIN
+      IF p_session_id IS NULL THEN
+        RETURN NULL;
+      END IF;
+      WITH RECURSIVE lineage(id, parent_session_id, depth, path, cycle) AS (
+        SELECT s.id, s.parent_session_id, 0, ARRAY[s.id], false
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = p_workspace_id AND s.id = p_session_id
+        UNION ALL
+        SELECT parent.id, parent.parent_session_id, lineage.depth + 1,
+          lineage.path || parent.id, parent.id = ANY(lineage.path)
+        FROM %1$I.sessions parent
+        JOIN lineage ON lineage.parent_session_id = parent.id
+        WHERE parent.workspace_id = p_workspace_id
+          AND NOT lineage.cycle
+          AND lineage.depth < 64
+      )
+      SELECT id, parent_session_id, depth, cycle
+      INTO v_root_id, v_parent_id, v_depth, v_cycle
+      FROM lineage
+      ORDER BY depth DESC
+      LIMIT 1;
+
+      IF v_root_id IS NULL THEN
+        RETURN NULL;
+      END IF;
+      IF v_cycle OR v_parent_id IS NOT NULL OR v_depth >= 64 THEN
+        RAISE EXCEPTION 'session lineage for %% has no valid workspace root', p_session_id
+          USING ERRCODE = '23514';
+      END IF;
+      RETURN v_root_id;
+    END $function$;
+  $create$, target_schema);
+
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.capture_host_export_root_session()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      NEW.root_session_id := opengeni_private.host_export_session_root(
+        NEW.workspace_id,
+        NEW.session_id
+      );
+      IF NEW.session_id IS NOT NULL AND NEW.root_session_id IS NULL THEN
+        RAISE EXCEPTION 'host export session %% does not exist in workspace %%',
+          NEW.session_id, NEW.workspace_id
+          USING ERRCODE = '23503';
+      END IF;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+DROP TRIGGER IF EXISTS host_export_outbox_capture_root_session
+  ON "host_export_outbox";
+CREATE TRIGGER host_export_outbox_capture_root_session
+BEFORE INSERT ON "host_export_outbox"
+FOR EACH ROW EXECUTE FUNCTION
+  opengeni_private.capture_host_export_root_session();
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_host_export.host_export_cursor_roots(
+      p_export_kind text,
+      p_consumer_id text,
+      p_lease_token uuid
+    ) RETURNS TABLE (export_cursor bigint, root_session_id uuid)
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_consumer %1$I.host_export_consumers%%ROWTYPE;
+    BEGIN
+      SELECT * INTO v_consumer
+      FROM %1$I.host_export_consumers c
+      WHERE c.export_kind = p_export_kind
+        AND c.consumer_id = p_consumer_id
+      FOR UPDATE;
+      IF NOT FOUND
+        OR v_consumer.lease_token IS DISTINCT FROM p_lease_token
+        OR v_consumer.lease_from IS NULL
+        OR v_consumer.lease_through IS NULL
+        OR v_consumer.lease_expires_at IS NULL
+        OR v_consumer.lease_expires_at <= now() THEN
+        RAISE EXCEPTION 'host export lease is not current'
+          USING ERRCODE = '55000';
+      END IF;
+
+      RETURN QUERY
+      SELECT o.export_cursor, o.root_session_id
+      FROM %1$I.host_export_outbox o
+      WHERE o.export_kind = p_export_kind
+        AND o.export_cursor > v_consumer.lease_from
+        AND o.export_cursor <= v_consumer.lease_through
+      ORDER BY o.export_cursor;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.host_export_session_root(uuid, uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.capture_host_export_root_session() FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_host_export.host_export_cursor_roots(text, text, uuid) FROM PUBLIC;
+
+-- Preserve already-provisioned exporter identities during migration-only
+-- upgrades. Exporter role names are host-configurable, so copy the explicit
+-- EXECUTE grantees from the canonical claim function instead of assuming a
+-- role name. The function owner and PUBLIC are deliberately excluded.
+DO $migration$
+DECLARE v_role name;
+BEGIN
+  FOR v_role IN
+    SELECT grantee.rolname
+    FROM pg_catalog.pg_proc proc
+    CROSS JOIN LATERAL pg_catalog.aclexplode(
+      coalesce(
+        proc.proacl,
+        pg_catalog.acldefault('f', proc.proowner)
+      )
+    ) privilege
+    JOIN pg_catalog.pg_roles grantee ON grantee.oid = privilege.grantee
+    WHERE proc.oid =
+      'opengeni_host_export.claim_host_export_batch(text, text, uuid, text, integer, integer, integer)'::regprocedure
+      AND privilege.grantee <> proc.proowner
+      AND privilege.privilege_type = 'EXECUTE'
+  LOOP
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION opengeni_host_export.host_export_cursor_roots(text, text, uuid) TO %I',
+      v_role
+    );
+  END LOOP;
+END $migration$;

package/drizzle/0104_host_export_root_session_backfill.sql

@@ -0,0 +1,27 @@
+-- deployment-mode: maintenance
+-- Backfill immutable root lineage for the pre-0103 durable outbox population.
+-- Migration 0103 already captures every new row, so this unbounded rewrite is
+-- isolated to an explicitly reviewed maintenance step instead of hiding in the
+-- rolling expand migration. Deleted source sessions remain unresolved (NULL).
+
+WITH distinct_sessions AS MATERIALIZED (
+  SELECT DISTINCT "workspace_id", "session_id"
+  FROM "host_export_outbox"
+  WHERE "session_id" IS NOT NULL
+    AND "root_session_id" IS NULL
+), resolved_roots AS MATERIALIZED (
+  SELECT
+    "workspace_id",
+    "session_id",
+    opengeni_private.host_export_session_root(
+      "workspace_id",
+      "session_id"
+    ) AS "root_session_id"
+  FROM distinct_sessions
+)
+UPDATE "host_export_outbox" o
+SET "root_session_id" = roots."root_session_id"
+FROM resolved_roots roots
+WHERE o."workspace_id" = roots."workspace_id"
+  AND o."session_id" = roots."session_id"
+  AND o."root_session_id" IS NULL;

package/drizzle/0105_session_turn_instructions.sql

@@ -0,0 +1,9 @@
+-- deployment-mode: rolling
+-- Durable, invisible host context for one exact turn. This is intentionally
+-- separate from the user prompt and session-wide persona instructions.
+
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "turn_instructions" text;
+
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "initial_turn_instructions" text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.7.3",
+  "version": "0.9.3",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -49,9 +49,9 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codex": "^0.2.3",
-    "@opengeni/config": "^0.5.1",
-    "@opengeni/contracts": "^0.10.0",
+    "@opengeni/codex": "^0.2.5",
+    "@opengeni/config": "^0.6.2",
+    "@opengeni/contracts": "^0.15.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },