@opengeni/db 3.7.4-canary.0 → 3.8.2-canary.0

package/src/runtime-posture.ts

@@ -81,6 +81,8 @@ const KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
 ] as const;
 const MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE =
   "ensure_managed_human_personal_workspace(uuid, text, uuid)";
+const ADDITIONAL_ORGANIZATION_CREATION_ROUTINE =
+  "create_additional_managed_organization(text, text, text, text, uuid)";
 const ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_self_organization_memberships(text)",
   "list_self_organization_invitations(text)",
@@ -94,9 +96,11 @@ const ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "resolve_workspace_codex_subscription_source(uuid, uuid)",
   "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
+  "authorize_organization_shared_workspace_administration(uuid, uuid, text)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
   "record_organization_workspace_member_removal(jsonb, uuid, uuid)",
+  ADDITIONAL_ORGANIZATION_CREATION_ROUTINE,
   "create_managed_organization(text, text, text, uuid)",
   "assert_organization_shared_workspace_administrator(uuid, uuid, text)",
   "open_organization_shared_workspace_administration_capability(uuid, uuid, text)",
@@ -154,6 +158,10 @@ const ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [
   "organization_workspace_operation_receipts",
   "self_service_organization_setup_receipts",
 ] as const;
+const ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES = [
+  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES,
+  "additional_organization_creation_receipts",
+] as const;
 const PRIVATE_SESSION_CREATE_POLICY_ROUTINE = "get_private_session_create_policy(uuid, uuid, text)";
 const ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE =
   "get_organization_private_session_settings(uuid, text)";
@@ -489,6 +497,8 @@ const TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE =
   "check_tenancy_backfill_activation_evidence(uuid)";
 const GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE =
   "activate_greenfield_session_tenancy_from_setup(text)";
+const ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE =
+  "activate_session_tenancy_from_additional_organization(uuid)";
 const SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE =
   "session_visibility_lifecycle_capability_held()";
 const PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
@@ -597,6 +607,7 @@ const RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set<string
 
 /** Owner-internal helpers that must exist but must never be callable by the runtime role. */
 export const RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
+  ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE,
   AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE,
   ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
   GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE,
@@ -620,6 +631,7 @@ const RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set<string>(
  * commit as the migration so startup cannot silently accept an unreviewed gap.
  */
 export const FORCE_RLS_TABLES = [
+  "additional_organization_creation_receipts",
   "agent_run_states",
   "api_keys",
   "attached_browser_devices",
@@ -786,6 +798,9 @@ export const FORCE_RLS_TABLES = [
   "organization_membership_lifecycle_events",
   "organization_membership_operation_receipts",
   "organization_memberships",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
@@ -883,6 +898,7 @@ export const FORCE_RLS_TABLES = [
   "session_system_update_outbox",
   "session_system_updates",
   "session_tenancy_activations",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_turn_attempts",
   "session_turn_startup_milestones",
@@ -1069,6 +1085,9 @@ export const RUNTIME_FULL_DML_TABLES = [
   "model_call_facts",
   "new_session_drafts",
   "organization_codex_rotation_settings",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1274,6 +1293,7 @@ export const RUNTIME_READ_INSERT_UPDATE_TABLES = [
  * The ordinary application role must have no direct table privileges on them.
  */
 export const PROTECTED_NO_DIRECT_DML_TABLES = [
+  "additional_organization_creation_receipts",
   "canonical_human_identities",
   "canonical_human_identity_operations",
   "canonical_human_identity_subjects",
@@ -1363,6 +1383,7 @@ export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "session_attempt_personal_document_snapshots",
   "session_attempt_personal_resource_admissions",
   "session_attempt_personal_resource_snapshots",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
@@ -2299,6 +2320,29 @@ export function evaluateRuntimeDatabasePosture(
           );
         }
       }
+    } else if (routine.name === ADDITIONAL_ORGANIZATION_CREATION_ROUTINE) {
+      const missingAuthorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName),
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`,
+        );
+      } else {
+        const authorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)!,
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`,
+          );
+        } else if (routine.owner !== authorityTables[0]!.owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,
+          );
+        }
+      }
     } else if (
       (ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES as readonly string[]).includes(routine.name)
     ) {

package/src/schema.ts

@@ -110,9 +110,12 @@ export const workspaces = pgTable(
     // White-label agent persona template override. NULL means the deployment
     // default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE / DEFAULT_AGENT_INSTRUCTIONS).
     agentInstructions: text("agent_instructions"),
-    // Growth-ready per-workspace settings bag (migration 0045). Holds memoryEnabled
-    // and future workspace-level toggles; validated/merged via WorkspaceSettingsSchema.
-    settings: jsonb("settings").$type<Record<string, unknown>>().notNull().default({}),
+    // Growth-ready per-workspace settings bag (migration 0045). Migration 0393
+    // makes Memory enabled by default; explicit false remains authoritative.
+    settings: jsonb("settings")
+      .$type<Record<string, unknown>>()
+      .notNull()
+      .default({ memoryEnabled: true }),
     // The workspace's default rig (migration 0047). NULL ⇒ no default; sessions
     // created without an explicit rig ride no rig (today's behavior exactly). FK
     // (-> rigs(id) ON DELETE SET NULL) lives in migration 0047, not a Drizzle
@@ -524,8 +527,12 @@ export const organizationProfileEvents = pgTable(
     actorMembershipId: uuid("actor_membership_id").notNull(),
     previousName: text("previous_name").notNull(),
     requestedName: text("requested_name").notNull(),
-    expectedUpdatedAt: timestamp("expected_updated_at", { withTimezone: true }).notNull(),
-    resultUpdatedAt: timestamp("result_updated_at", { withTimezone: true }).notNull(),
+    expectedUpdatedAt: timestamp("expected_updated_at", {
+      withTimezone: true,
+    }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", {
+      withTimezone: true,
+    }).notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
@@ -613,7 +620,9 @@ export const organizationPrivateSessionSettingEvents = pgTable(
     expectedVersion: bigint("expected_version", { mode: "number" }).notNull(),
     resultEnabled: boolean("result_enabled").notNull(),
     resultVersion: bigint("result_version", { mode: "number" }).notNull(),
-    resultUpdatedAt: timestamp("result_updated_at", { withTimezone: true }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", {
+      withTimezone: true,
+    }).notNull(),
     changed: boolean("changed").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -751,7 +760,9 @@ export const organizationInvitationBindingEvents = pgTable(
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     invitationId: uuid("invitation_id").notNull(),
     targetSubjectId: text("target_subject_id").notNull(),
-    resultingRevision: bigint("resulting_revision", { mode: "number" }).notNull(),
+    resultingRevision: bigint("resulting_revision", {
+      mode: "number",
+    }).notNull(),
     boundAt: timestamp("bound_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
@@ -854,13 +865,19 @@ export const organizationUserRetentionDeletions = pgTable(
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     membershipId: uuid("membership_id").notNull(),
-    retentionUntil: timestamp("retention_until", { withTimezone: true }).notNull(),
+    retentionUntil: timestamp("retention_until", {
+      withTimezone: true,
+    }).notNull(),
     state: text("state").notNull().default("claimed"),
     claimOperationId: uuid("claim_operation_id").notNull(),
-    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }).notNull(),
+    claimExpiresAt: timestamp("claim_expires_at", {
+      withTimezone: true,
+    }).notNull(),
     attemptCount: integer("attempt_count").notNull().default(1),
     databaseResult: jsonb("database_result").$type<Record<string, unknown>>(),
-    databaseFinalizedAt: timestamp("database_finalized_at", { withTimezone: true }),
+    databaseFinalizedAt: timestamp("database_finalized_at", {
+      withTimezone: true,
+    }),
     result: jsonb("result").$type<Record<string, unknown>>(),
     completedAt: timestamp("completed_at", { withTimezone: true }),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -1262,7 +1279,9 @@ export const codexSubscriptionCredentials = pgTable(
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade",
+    }),
     organizationId: uuid("organization_id").references(() => managedAccounts.id, {
       onDelete: "cascade",
     }),
@@ -1836,7 +1855,9 @@ export const connectionUseOnceConsumptionReceipts = pgTable(
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     authorityId: uuid("authority_id").notNull(),
-    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint("authority_generation", {
+      mode: "number",
+    }).notNull(),
     grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
     acceptedWorkKind: text("accepted_work_kind").notNull(),
     acceptedWorkId: uuid("accepted_work_id").notNull(),
@@ -2621,7 +2642,9 @@ export const slackInteractionInbox = pgTable(
     targetAccountId: uuid("target_account_id"),
     targetWorkspaceId: uuid("target_workspace_id"),
     routePromptId: uuid("route_prompt_id"),
-    routePromptExpiresAt: timestamp("route_prompt_expires_at", { withTimezone: true }),
+    routePromptExpiresAt: timestamp("route_prompt_expires_at", {
+      withTimezone: true,
+    }),
     processedAt: timestamp("processed_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -6185,7 +6208,9 @@ export const turnPersonalResourceSnapshots = pgTable(
       mode: "number",
     }).notNull(),
     authorityId: uuid("authority_id").notNull(),
-    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint("authority_generation", {
+      mode: "number",
+    }).notNull(),
     grantId: uuid("grant_id").notNull(),
     grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
     grantMode: text("grant_mode").notNull(),
@@ -6197,7 +6222,9 @@ export const turnPersonalResourceSnapshots = pgTable(
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    pk: primaryKey({ columns: [table.turnId, table.resourceKind, table.resourceId] }),
+    pk: primaryKey({
+      columns: [table.turnId, table.resourceKind, table.resourceId],
+    }),
     receipt: foreignKey({
       name: "turn_personal_resource_snapshots_receipt_fk",
       columns: [table.turnId],
@@ -6246,7 +6273,9 @@ export const turnPersonalResourceOnceReceipts = pgTable(
     turnId: uuid("turn_id").notNull(),
     accountId: uuid("account_id").notNull(),
     authorityId: uuid("authority_id").notNull(),
-    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint("authority_generation", {
+      mode: "number",
+    }).notNull(),
     grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
     consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -6541,7 +6570,9 @@ export const turnConnectionAuthoritySnapshots = pgTable(
     turnId: uuid("turn_id").notNull(),
     serverId: text("server_id").notNull(),
     connectionId: uuid("connection_id").notNull(),
-    connectionGeneration: bigint("connection_generation", { mode: "number" }).notNull(),
+    connectionGeneration: bigint("connection_generation", {
+      mode: "number",
+    }).notNull(),
     originWorkspaceId: uuid("origin_workspace_id").notNull(),
     providerDomain: text("provider_domain").notNull(),
     connectionKind: text("connection_kind").notNull(),
@@ -7584,9 +7615,13 @@ export const sessionGoals = pgTable(
     // Any newer finished turn, a passed deadline, or a goal mutation clears all
     // four columns together.
     continuationHoldTurnId: uuid("continuation_hold_turn_id"),
-    continuationHoldUntil: timestamp("continuation_hold_until", { withTimezone: true }),
+    continuationHoldUntil: timestamp("continuation_hold_until", {
+      withTimezone: true,
+    }),
     continuationHoldReason: text("continuation_hold_reason"),
-    continuationHoldSetAt: timestamp("continuation_hold_set_at", { withTimezone: true }),
+    continuationHoldSetAt: timestamp("continuation_hold_set_at", {
+      withTimezone: true,
+    }),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -8861,7 +8896,9 @@ export const sandboxWorkspaceMutationAdmissions = pgTable(
     // authorization revision observed at admission. The revision is audit
     // evidence: a role change is not a revocation and must not fence a writer.
     initiatorOrganizationMembershipId: uuid("initiator_organization_membership_id"),
-    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", { mode: "number" }),
+    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", {
+      mode: "number",
+    }),
     // Session tenancy authority observed when the operation was admitted; the
     // same triple `session_turn_attempts` freezes for a turn.
     authorityEpoch: integer("authority_epoch"),
@@ -9083,7 +9120,9 @@ export const sandboxRetainedProcesses = pgTable(
     initiatorSubjectId: text("initiator_subject_id").notNull().default("unattributed-legacy"),
     initiatingHumanSubjectId: text("initiating_human_subject_id"),
     initiatorOrganizationMembershipId: uuid("initiator_organization_membership_id"),
-    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", { mode: "number" }),
+    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", {
+      mode: "number",
+    }),
     authorityEpoch: integer("authority_epoch"),
     authorityVisibility: text("authority_visibility", {
       enum: ["user_private", "workspace_shared"],
@@ -9342,7 +9381,9 @@ export const sessionBackgroundCommands = pgTable(
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     sessionId: uuid("session_id").notNull(),
-    provider: text("provider", { enum: ["managed", "connected_machine"] }).notNull(),
+    provider: text("provider", {
+      enum: ["managed", "connected_machine"],
+    }).notNull(),
     state: text("state", { enum: ["running", "stopping", "exited", "lost"] })
       .notNull()
       .default("running"),
@@ -9360,13 +9401,19 @@ export const sessionBackgroundCommands = pgTable(
     settledAt: timestamp("settled_at", { withTimezone: true }),
     reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
     reconcileClaimId: uuid("reconcile_claim_id"),
-    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", {
+      withTimezone: true,
+    }),
     reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
     lastReconcileOutcome: text("last_reconcile_outcome"),
-    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofOutcome: text("reconcile_proof_outcome", {
+      enum: ["exited", "lost"],
+    }),
     reconcileProofExitCode: integer("reconcile_proof_exit_code"),
     reconcileProofReason: text("reconcile_proof_reason"),
-    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true }),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", {
+      withTimezone: true,
+    }),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
@@ -10606,12 +10653,18 @@ export const prReviewAppRegistrations = pgTable(
     providerAccountType: text("provider_account_type"),
     githubActorId: text("github_actor_id"),
     authorityKind: text("authority_kind"),
-    authorityCheckedAt: timestamp("authority_checked_at", { withTimezone: true }),
-    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }),
+    authorityCheckedAt: timestamp("authority_checked_at", {
+      withTimezone: true,
+    }),
+    authorityExpiresAt: timestamp("authority_expires_at", {
+      withTimezone: true,
+    }),
     authorityNonce: text("authority_nonce"),
     credentialKind: text("credential_kind").notNull(),
     credentialEncrypted: text("credential_encrypted"),
-    accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true }),
+    accessTokenExpiresAt: timestamp("access_token_expires_at", {
+      withTimezone: true,
+    }),
     webhookAuthKind: text("webhook_auth_kind").notNull(),
     webhookUsername: text("webhook_username"),
     status: text("status").notNull().default("active"),
@@ -10757,7 +10810,9 @@ export const prReviewManagedGithubAuthorityNonces = pgTable(
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
     installationId: text("installation_id").notNull(),
-    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }).notNull(),
+    authorityExpiresAt: timestamp("authority_expires_at", {
+      withTimezone: true,
+    }).notNull(),
     consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
@@ -10939,6 +10994,9 @@ export const modelCallFacts = pgTable(
     estimatedProviderCostMicros: bigint("estimated_provider_cost_micros", {
       mode: "number",
     }),
+    equivalentCreditCostMicros: bigint("equivalent_credit_cost_micros", {
+      mode: "number",
+    }),
     pricingSource: text("pricing_source"),
     contextContributions:
       jsonb("context_contributions").$type<readonly ModelContextContributionSummary[]>(),
@@ -10983,6 +11041,10 @@ export const modelCallFacts = pgTable(
       "model_call_facts_estimated_provider_cost_check",
       sql`${table.estimatedProviderCostMicros} is null or ${table.estimatedProviderCostMicros} >= 0`,
     ),
+    equivalentCreditCostValid: check(
+      "model_call_facts_equivalent_credit_cost_check",
+      sql`${table.equivalentCreditCostMicros} is null or (${table.equivalentCreditCostMicros} >= 0 and ${table.estimatedProviderCostMicros} is not null)`,
+    ),
     pricingSourceValid: check(
       "model_call_facts_pricing_source_check",
       sql`(${table.estimatedProviderCostMicros} is null and ${table.pricingSource} is null)
@@ -11634,7 +11696,9 @@ export const automationRuns = pgTable(
     occurrenceKey: text("occurrence_key").notNull(),
     acceptedExecution: jsonb("accepted_execution").$type<AutomationAcceptedExecution>().notNull(),
     status: text("status").notNull().default("queued"),
-    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid("session_id").references(() => sessions.id, {
+      onDelete: "set null",
+    }),
     errorCode: text("error_code"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -12724,6 +12788,162 @@ export const workspaceGatewayCustomModels = pgTable(
   }),
 );
 
+export const organizationModelProviderConnections = pgTable(
+  "organization_model_provider_connections",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text("provider_kind").$type<"vercel_gateway" | "openrouter">().notNull(),
+    status: text("status").$type<"active" | "revoked">().notNull().default("active"),
+    credentialEncrypted: text("credential_encrypted").notNull(),
+    version: integer("version").notNull().default(1),
+    operationId: uuid("operation_id").notNull(),
+    requestHash: text("request_hash").notNull(),
+    updatedBySubjectId: text("updated_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountProvider: uniqueIndex("organization_model_provider_connections_account_provider_uq").on(
+      table.accountId,
+      table.providerKind,
+    ),
+    operation: uniqueIndex("organization_model_provider_connections_operation_uq").on(
+      table.accountId,
+      table.providerKind,
+      table.operationId,
+    ),
+    providerKindCheck: check(
+      "organization_model_provider_connections_provider_kind_chk",
+      sql`${table.providerKind} in ('vercel_gateway', 'openrouter')`,
+    ),
+    statusCheck: check(
+      "organization_model_provider_connections_status_chk",
+      sql`${table.status} in ('active', 'revoked')`,
+    ),
+    versionCheck: check(
+      "organization_model_provider_connections_version_chk",
+      sql`${table.version} > 0`,
+    ),
+    requestHashCheck: check(
+      "organization_model_provider_connections_request_hash_chk",
+      sql`${table.requestHash} ~ '^[a-f0-9]{64}$'`,
+    ),
+    actorCheck: check(
+      "organization_model_provider_connections_actor_chk",
+      sql`octet_length(${table.updatedBySubjectId}) between 1 and 1024`,
+    ),
+  }),
+);
+
+export const organizationModelProviderConnectionOperations = pgTable(
+  "organization_model_provider_connection_operations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text("provider_kind").$type<"vercel_gateway" | "openrouter">().notNull(),
+    operationId: uuid("operation_id").notNull(),
+    requestHash: text("request_hash").notNull(),
+    resultStatus: text("result_status").$type<"active" | "revoked">().notNull(),
+    resultVersion: integer("result_version").notNull(),
+    resultCreatedAt: timestamp("result_created_at", {
+      withTimezone: true,
+    }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", {
+      withTimezone: true,
+    }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    operation: uniqueIndex("organization_model_provider_connection_operations_operation_uq").on(
+      table.accountId,
+      table.providerKind,
+      table.operationId,
+    ),
+    providerKindCheck: check(
+      "organization_model_provider_connection_operations_provider_kind_chk",
+      sql`${table.providerKind} in ('vercel_gateway', 'openrouter')`,
+    ),
+    resultStatusCheck: check(
+      "organization_model_provider_connection_operations_result_status_chk",
+      sql`${table.resultStatus} in ('active', 'revoked')`,
+    ),
+    resultVersionCheck: check(
+      "organization_model_provider_connection_operations_result_version_chk",
+      sql`${table.resultVersion} > 0`,
+    ),
+    requestHashCheck: check(
+      "organization_model_provider_connection_operations_request_hash_chk",
+      sql`${table.requestHash} ~ '^[a-f0-9]{64}$'`,
+    ),
+  }),
+);
+
+export const organizationModelProviderCustomModels = pgTable(
+  "organization_model_provider_custom_models",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text("provider_kind").$type<"vercel_gateway" | "openrouter">().notNull(),
+    upstreamModelId: text("upstream_model_id").notNull(),
+    label: text("label"),
+    version: integer("version").notNull().default(1),
+    createOperationId: uuid("create_operation_id").notNull(),
+    createRequestHash: text("create_request_hash").notNull(),
+    deleteOperationId: uuid("delete_operation_id"),
+    deleteRequestHash: text("delete_request_hash"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    retiredAt: timestamp("retired_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountUpstream: uniqueIndex("organization_model_provider_custom_models_active_uq")
+      .on(table.accountId, table.providerKind, table.upstreamModelId)
+      .where(sql`${table.retiredAt} is null`),
+    createOperation: uniqueIndex(
+      "organization_model_provider_custom_models_create_operation_uq",
+    ).on(table.accountId, table.providerKind, table.createOperationId),
+    deleteOperation: uniqueIndex("organization_model_provider_custom_models_delete_operation_uq")
+      .on(table.accountId, table.providerKind, table.deleteOperationId)
+      .where(sql`${table.deleteOperationId} is not null`),
+    providerKindCheck: check(
+      "organization_model_provider_custom_models_provider_kind_chk",
+      sql`${table.providerKind} in ('vercel_gateway', 'openrouter')`,
+    ),
+    upstreamCheck: check(
+      "organization_model_provider_custom_models_upstream_chk",
+      sql`octet_length(${table.upstreamModelId}) between 1 and 238 and ${table.upstreamModelId} ~ '^[!-~]+$' and ${table.upstreamModelId} !~ '[|]'`,
+    ),
+    labelCheck: check(
+      "organization_model_provider_custom_models_label_chk",
+      sql`${table.label} is null or (octet_length(${table.label}) between 1 and 128 and ${table.label} !~ '[\r\n|]')`,
+    ),
+    versionCheck: check(
+      "organization_model_provider_custom_models_version_chk",
+      sql`${table.version} > 0`,
+    ),
+    actorCheck: check(
+      "organization_model_provider_custom_models_actor_chk",
+      sql`octet_length(${table.createdBySubjectId}) between 1 and 1024`,
+    ),
+    createHashCheck: check(
+      "organization_model_provider_custom_models_create_hash_chk",
+      sql`${table.createRequestHash} ~ '^[a-f0-9]{64}$'`,
+    ),
+    deleteReceiptCheck: check(
+      "organization_model_provider_custom_models_delete_receipt_chk",
+      sql`(${table.deleteOperationId} is null and ${table.deleteRequestHash} is null) or (${table.deleteOperationId} is not null and ${table.deleteRequestHash} ~ '^[a-f0-9]{64}$' and ${table.retiredAt} is not null)`,
+    ),
+  }),
+);
+
 export * from "./workspace-instruction-policies-schema";
 export * from "./company-profile-schema";
 export * from "./workspace-learning-policy-schema";