@opengeni/db 3.7.4 → 3.8.2-canary.0

package/dist/automations.d.ts

@@ -75,6 +75,8 @@ export declare function createAutomationTrigger(db: Database, input: {
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Trusted database-only admission seam. Throwing rolls creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger>;
 export declare function listAutomationTriggers(db: Database, workspaceId: string): Promise<AutomationTrigger[]>;
 export declare function listActiveAutomationTriggersForSource(db: Database, input: {
@@ -94,6 +96,8 @@ export declare function updateAutomationTrigger(db: Database, input: {
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** Trusted database-only admission seam. Throwing rolls the revision back. */
+    beforeUpdateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger | null>;
 export declare function recordAutomationEvent(db: Database, input: {
     accountId: string;

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-U4WPPEBH.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-Y53WEFYB.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-O56DM5GZ.js → chunk-53A2PEHT.js}

@@ -68,6 +68,7 @@ __export(schema_exports, {
   connectorActionPolicies: () => connectorActionPolicies,
   connectorActionRequests: () => connectorActionRequests,
   creditLedgerEntries: () => creditLedgerEntries,
+  deploymentModelCatalog: () => deploymentModelCatalog,
   deviceEnrollmentRequests: () => deviceEnrollmentRequests,
   deviceEnrollmentStatusValues: () => deviceEnrollmentStatusValues,
   documentBases: () => documentBases,
@@ -175,6 +176,9 @@ __export(schema_exports, {
   organizationMembershipLifecycleEvents: () => organizationMembershipLifecycleEvents,
   organizationMembershipOperationReceipts: () => organizationMembershipOperationReceipts,
   organizationMemberships: () => organizationMemberships,
+  organizationModelProviderConnectionOperations: () => organizationModelProviderConnectionOperations,
+  organizationModelProviderConnections: () => organizationModelProviderConnections,
+  organizationModelProviderCustomModels: () => organizationModelProviderCustomModels,
   organizationPrivateSessionSettingEvents: () => organizationPrivateSessionSettingEvents,
   organizationPrivateSessionSettings: () => organizationPrivateSessionSettings,
   organizationProfileEvents: () => organizationProfileEvents,
@@ -316,6 +320,7 @@ __export(schema_exports, {
   workspaceCaptures: () => workspaceCaptures,
   workspaceCodexSubscriptionPreferences: () => workspaceCodexSubscriptionPreferences,
   workspaceControlEvents: () => workspaceControlEvents,
+  workspaceGatewayCustomModels: () => workspaceGatewayCustomModels,
   workspaceInferenceControls: () => workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents: () => workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyDeactivationEvents: () => workspaceInstructionPolicyDeactivationEvents,
@@ -6387,9 +6392,9 @@ var workspaces = pgTable19(
     // White-label agent persona template override. NULL means the deployment
     // default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE / DEFAULT_AGENT_INSTRUCTIONS).
     agentInstructions: text19("agent_instructions"),
-    // Growth-ready per-workspace settings bag (migration 0045). Holds memoryEnabled
-    // and future workspace-level toggles; validated/merged via WorkspaceSettingsSchema.
-    settings: jsonb15("settings").$type().notNull().default({}),
+    // Growth-ready per-workspace settings bag (migration 0045). Migration 0393
+    // makes Memory enabled by default; explicit false remains authoritative.
+    settings: jsonb15("settings").$type().notNull().default({ memoryEnabled: true }),
     // The workspace's default rig (migration 0047). NULL ⇒ no default; sessions
     // created without an explicit rig ride no rig (today's behavior exactly). FK
     // (-> rigs(id) ON DELETE SET NULL) lives in migration 0047, not a Drizzle
@@ -6746,8 +6751,12 @@ var organizationProfileEvents = pgTable19(
     actorMembershipId: uuid19("actor_membership_id").notNull(),
     previousName: text19("previous_name").notNull(),
     requestedName: text19("requested_name").notNull(),
-    expectedUpdatedAt: timestamp19("expected_updated_at", { withTimezone: true }).notNull(),
-    resultUpdatedAt: timestamp19("result_updated_at", { withTimezone: true }).notNull(),
+    expectedUpdatedAt: timestamp19("expected_updated_at", {
+      withTimezone: true
+    }).notNull(),
+    resultUpdatedAt: timestamp19("result_updated_at", {
+      withTimezone: true
+    }).notNull(),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -6820,7 +6829,9 @@ var organizationPrivateSessionSettingEvents = pgTable19(
     expectedVersion: bigint14("expected_version", { mode: "number" }).notNull(),
     resultEnabled: boolean11("result_enabled").notNull(),
     resultVersion: bigint14("result_version", { mode: "number" }).notNull(),
-    resultUpdatedAt: timestamp19("result_updated_at", { withTimezone: true }).notNull(),
+    resultUpdatedAt: timestamp19("result_updated_at", {
+      withTimezone: true
+    }).notNull(),
     changed: boolean11("changed").notNull(),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -6942,7 +6953,9 @@ var organizationInvitationBindingEvents = pgTable19(
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     invitationId: uuid19("invitation_id").notNull(),
     targetSubjectId: text19("target_subject_id").notNull(),
-    resultingRevision: bigint14("resulting_revision", { mode: "number" }).notNull(),
+    resultingRevision: bigint14("resulting_revision", {
+      mode: "number"
+    }).notNull(),
     boundAt: timestamp19("bound_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -7036,13 +7049,19 @@ var organizationUserRetentionDeletions = pgTable19(
   {
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     membershipId: uuid19("membership_id").notNull(),
-    retentionUntil: timestamp19("retention_until", { withTimezone: true }).notNull(),
+    retentionUntil: timestamp19("retention_until", {
+      withTimezone: true
+    }).notNull(),
     state: text19("state").notNull().default("claimed"),
     claimOperationId: uuid19("claim_operation_id").notNull(),
-    claimExpiresAt: timestamp19("claim_expires_at", { withTimezone: true }).notNull(),
+    claimExpiresAt: timestamp19("claim_expires_at", {
+      withTimezone: true
+    }).notNull(),
     attemptCount: integer18("attempt_count").notNull().default(1),
     databaseResult: jsonb15("database_result").$type(),
-    databaseFinalizedAt: timestamp19("database_finalized_at", { withTimezone: true }),
+    databaseFinalizedAt: timestamp19("database_finalized_at", {
+      withTimezone: true
+    }),
     result: jsonb15("result").$type(),
     completedAt: timestamp19("completed_at", { withTimezone: true }),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -7410,7 +7429,9 @@ var codexSubscriptionCredentials = pgTable19(
   {
     id: uuid19("id").primaryKey().defaultRandom(),
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid19("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    workspaceId: uuid19("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade"
+    }),
     organizationId: uuid19("organization_id").references(() => managedAccounts.id, {
       onDelete: "cascade"
     }),
@@ -7922,7 +7943,9 @@ var connectionUseOnceConsumptionReceipts = pgTable19(
     grantId: uuid19("grant_id").primaryKey(),
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     authorityId: uuid19("authority_id").notNull(),
-    authorityGeneration: bigint14("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint14("authority_generation", {
+      mode: "number"
+    }).notNull(),
     grantGeneration: bigint14("grant_generation", { mode: "number" }).notNull(),
     acceptedWorkKind: text19("accepted_work_kind").notNull(),
     acceptedWorkId: uuid19("accepted_work_id").notNull(),
@@ -8531,7 +8554,9 @@ var slackInteractionInbox = pgTable19(
     targetAccountId: uuid19("target_account_id"),
     targetWorkspaceId: uuid19("target_workspace_id"),
     routePromptId: uuid19("route_prompt_id"),
-    routePromptExpiresAt: timestamp19("route_prompt_expires_at", { withTimezone: true }),
+    routePromptExpiresAt: timestamp19("route_prompt_expires_at", {
+      withTimezone: true
+    }),
     processedAt: timestamp19("processed_at", { withTimezone: true }),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -11602,7 +11627,9 @@ var turnPersonalResourceSnapshots = pgTable19(
       mode: "number"
     }).notNull(),
     authorityId: uuid19("authority_id").notNull(),
-    authorityGeneration: bigint14("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint14("authority_generation", {
+      mode: "number"
+    }).notNull(),
     grantId: uuid19("grant_id").notNull(),
     grantGeneration: bigint14("grant_generation", { mode: "number" }).notNull(),
     grantMode: text19("grant_mode").notNull(),
@@ -11614,7 +11641,9 @@ var turnPersonalResourceSnapshots = pgTable19(
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
-    pk: primaryKey8({ columns: [table.turnId, table.resourceKind, table.resourceId] }),
+    pk: primaryKey8({
+      columns: [table.turnId, table.resourceKind, table.resourceId]
+    }),
     receipt: foreignKey({
       name: "turn_personal_resource_snapshots_receipt_fk",
       columns: [table.turnId],
@@ -11661,7 +11690,9 @@ var turnPersonalResourceOnceReceipts = pgTable19(
     turnId: uuid19("turn_id").notNull(),
     accountId: uuid19("account_id").notNull(),
     authorityId: uuid19("authority_id").notNull(),
-    authorityGeneration: bigint14("authority_generation", { mode: "number" }).notNull(),
+    authorityGeneration: bigint14("authority_generation", {
+      mode: "number"
+    }).notNull(),
     grantGeneration: bigint14("grant_generation", { mode: "number" }).notNull(),
     consumedAt: timestamp19("consumed_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -11925,7 +11956,9 @@ var turnConnectionAuthoritySnapshots = pgTable19(
     turnId: uuid19("turn_id").notNull(),
     serverId: text19("server_id").notNull(),
     connectionId: uuid19("connection_id").notNull(),
-    connectionGeneration: bigint14("connection_generation", { mode: "number" }).notNull(),
+    connectionGeneration: bigint14("connection_generation", {
+      mode: "number"
+    }).notNull(),
     originWorkspaceId: uuid19("origin_workspace_id").notNull(),
     providerDomain: text19("provider_domain").notNull(),
     connectionKind: text19("connection_kind").notNull(),
@@ -12429,6 +12462,13 @@ var sessionCommandReceipts = pgTable19(
       table.targetSessionId,
       table.createdAt
     ),
+    promptActorOperation: index19("session_command_receipts_prompt_actor_operation_idx").on(
+      table.workspaceId,
+      table.actorType,
+      table.actorSubjectId,
+      table.actorAttemptId,
+      table.operationKey
+    ).where(sql16`${table.action} in ('prompt.send', 'prompt.steer')`),
     goalUpdateOperation: uniqueIndex19("session_command_receipts_goal_update_operation_uq").on(table.workspaceId, table.action, table.targetSessionId, table.operationKey).where(sql16`${table.action} = 'goal.update'`),
     actorValid: check11(
       "session_command_receipts_actor_check",
@@ -12851,9 +12891,13 @@ var sessionGoals = pgTable19(
     // Any newer finished turn, a passed deadline, or a goal mutation clears all
     // four columns together.
     continuationHoldTurnId: uuid19("continuation_hold_turn_id"),
-    continuationHoldUntil: timestamp19("continuation_hold_until", { withTimezone: true }),
+    continuationHoldUntil: timestamp19("continuation_hold_until", {
+      withTimezone: true
+    }),
     continuationHoldReason: text19("continuation_hold_reason"),
-    continuationHoldSetAt: timestamp19("continuation_hold_set_at", { withTimezone: true }),
+    continuationHoldSetAt: timestamp19("continuation_hold_set_at", {
+      withTimezone: true
+    }),
     metadata: jsonb15("metadata").$type().notNull().default({}),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -13925,7 +13969,9 @@ var sandboxWorkspaceMutationAdmissions = pgTable19(
     // authorization revision observed at admission. The revision is audit
     // evidence: a role change is not a revocation and must not fence a writer.
     initiatorOrganizationMembershipId: uuid19("initiator_organization_membership_id"),
-    initiatorAuthorizationRevision: bigint14("initiator_authorization_revision", { mode: "number" }),
+    initiatorAuthorizationRevision: bigint14("initiator_authorization_revision", {
+      mode: "number"
+    }),
     // Session tenancy authority observed when the operation was admitted; the
     // same triple `session_turn_attempts` freezes for a turn.
     authorityEpoch: integer18("authority_epoch"),
@@ -14134,7 +14180,9 @@ var sandboxRetainedProcesses = pgTable19(
     initiatorSubjectId: text19("initiator_subject_id").notNull().default("unattributed-legacy"),
     initiatingHumanSubjectId: text19("initiating_human_subject_id"),
     initiatorOrganizationMembershipId: uuid19("initiator_organization_membership_id"),
-    initiatorAuthorizationRevision: bigint14("initiator_authorization_revision", { mode: "number" }),
+    initiatorAuthorizationRevision: bigint14("initiator_authorization_revision", {
+      mode: "number"
+    }),
     authorityEpoch: integer18("authority_epoch"),
     authorityVisibility: text19("authority_visibility", {
       enum: ["user_private", "workspace_shared"]
@@ -14380,7 +14428,9 @@ var sessionBackgroundCommands = pgTable19(
     accountId: uuid19("account_id").notNull(),
     workspaceId: uuid19("workspace_id").notNull(),
     sessionId: uuid19("session_id").notNull(),
-    provider: text19("provider", { enum: ["managed", "connected_machine"] }).notNull(),
+    provider: text19("provider", {
+      enum: ["managed", "connected_machine"]
+    }).notNull(),
     state: text19("state", { enum: ["running", "stopping", "exited", "lost"] }).notNull().default("running"),
     retainedProcessId: uuid19("retained_process_id"),
     controlWorkspaceId: uuid19("control_workspace_id"),
@@ -14396,13 +14446,19 @@ var sessionBackgroundCommands = pgTable19(
     settledAt: timestamp19("settled_at", { withTimezone: true }),
     reconcileAfter: timestamp19("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
     reconcileClaimId: uuid19("reconcile_claim_id"),
-    reconcileClaimedAt: timestamp19("reconcile_claimed_at", { withTimezone: true }),
+    reconcileClaimedAt: timestamp19("reconcile_claimed_at", {
+      withTimezone: true
+    }),
     reconcileAttempts: integer18("reconcile_attempts").notNull().default(0),
     lastReconcileOutcome: text19("last_reconcile_outcome"),
-    reconcileProofOutcome: text19("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofOutcome: text19("reconcile_proof_outcome", {
+      enum: ["exited", "lost"]
+    }),
     reconcileProofExitCode: integer18("reconcile_proof_exit_code"),
     reconcileProofReason: text19("reconcile_proof_reason"),
-    reconcileProofObservedAt: timestamp19("reconcile_proof_observed_at", { withTimezone: true }),
+    reconcileProofObservedAt: timestamp19("reconcile_proof_observed_at", {
+      withTimezone: true
+    }),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -15420,12 +15476,18 @@ var prReviewAppRegistrations = pgTable19(
     providerAccountType: text19("provider_account_type"),
     githubActorId: text19("github_actor_id"),
     authorityKind: text19("authority_kind"),
-    authorityCheckedAt: timestamp19("authority_checked_at", { withTimezone: true }),
-    authorityExpiresAt: timestamp19("authority_expires_at", { withTimezone: true }),
+    authorityCheckedAt: timestamp19("authority_checked_at", {
+      withTimezone: true
+    }),
+    authorityExpiresAt: timestamp19("authority_expires_at", {
+      withTimezone: true
+    }),
     authorityNonce: text19("authority_nonce"),
     credentialKind: text19("credential_kind").notNull(),
     credentialEncrypted: text19("credential_encrypted"),
-    accessTokenExpiresAt: timestamp19("access_token_expires_at", { withTimezone: true }),
+    accessTokenExpiresAt: timestamp19("access_token_expires_at", {
+      withTimezone: true
+    }),
     webhookAuthKind: text19("webhook_auth_kind").notNull(),
     webhookUsername: text19("webhook_username"),
     status: text19("status").notNull().default("active"),
@@ -15554,7 +15616,9 @@ var prReviewManagedGithubAuthorityNonces = pgTable19(
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     installationId: text19("installation_id").notNull(),
-    authorityExpiresAt: timestamp19("authority_expires_at", { withTimezone: true }).notNull(),
+    authorityExpiresAt: timestamp19("authority_expires_at", {
+      withTimezone: true
+    }).notNull(),
     consumedAt: timestamp19("consumed_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -15710,6 +15774,9 @@ var modelCallFacts = pgTable19(
     estimatedProviderCostMicros: bigint14("estimated_provider_cost_micros", {
       mode: "number"
     }),
+    equivalentCreditCostMicros: bigint14("equivalent_credit_cost_micros", {
+      mode: "number"
+    }),
     pricingSource: text19("pricing_source"),
     contextContributions: jsonb15("context_contributions").$type(),
     occurredAt: timestamp19("occurred_at", { withTimezone: true }).notNull(),
@@ -15751,6 +15818,10 @@ var modelCallFacts = pgTable19(
       "model_call_facts_estimated_provider_cost_check",
       sql16`${table.estimatedProviderCostMicros} is null or ${table.estimatedProviderCostMicros} >= 0`
     ),
+    equivalentCreditCostValid: check11(
+      "model_call_facts_equivalent_credit_cost_check",
+      sql16`${table.equivalentCreditCostMicros} is null or (${table.equivalentCreditCostMicros} >= 0 and ${table.estimatedProviderCostMicros} is not null)`
+    ),
     pricingSourceValid: check11(
       "model_call_facts_pricing_source_check",
       sql16`(${table.estimatedProviderCostMicros} is null and ${table.pricingSource} is null)
@@ -16331,7 +16402,9 @@ var automationRuns = pgTable19(
     occurrenceKey: text19("occurrence_key").notNull(),
     acceptedExecution: jsonb15("accepted_execution").$type().notNull(),
     status: text19("status").notNull().default("queued"),
-    sessionId: uuid19("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid19("session_id").references(() => sessions.id, {
+      onDelete: "set null"
+    }),
     errorCode: text19("error_code"),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -17176,6 +17249,225 @@ var rigChanges = pgTable19(
     workspaceStatus: index19("rig_changes_workspace_status_idx").on(table.workspaceId, table.status)
   })
 );
+var deploymentModelCatalog = pgTable19(
+  "deployment_model_catalog",
+  {
+    singleton: boolean11("singleton").primaryKey().notNull().default(true),
+    document: jsonb15("document").$type().notNull(),
+    version: bigint14("version", { mode: "number" }).notNull().default(1),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    singletonCheck: check11("deployment_model_catalog_singleton_chk", sql16`${table.singleton}`),
+    documentCheck: check11(
+      "deployment_model_catalog_document_chk",
+      sql16`jsonb_typeof(${table.document}) = 'object'`
+    ),
+    versionCheck: check11("deployment_model_catalog_version_chk", sql16`${table.version} > 0`)
+  })
+);
+var workspaceGatewayCustomModels = pgTable19(
+  "workspace_gateway_custom_models",
+  {
+    id: uuid19("id").primaryKey().defaultRandom(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    providerKind: text19("provider_kind").$type().notNull(),
+    upstreamModelId: text19("upstream_model_id").notNull(),
+    label: text19("label"),
+    version: integer18("version").notNull().default(1),
+    createOperationId: uuid19("create_operation_id").notNull(),
+    createRequestHash: text19("create_request_hash").notNull(),
+    deleteOperationId: uuid19("delete_operation_id"),
+    deleteRequestHash: text19("delete_request_hash"),
+    createdBySubjectId: text19("created_by_subject_id").notNull(),
+    retiredAt: timestamp19("retired_at", { withTimezone: true }),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccountFk: foreignKey({
+      name: "workspace_gateway_custom_models_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    workspaceUpstream: uniqueIndex19("workspace_gateway_custom_models_workspace_upstream_uq").on(table.workspaceId, table.providerKind, table.upstreamModelId).where(sql16`${table.retiredAt} is null`),
+    createOperation: uniqueIndex19("workspace_gateway_custom_models_create_operation_uq").on(
+      table.workspaceId,
+      table.providerKind,
+      table.createOperationId
+    ),
+    deleteOperation: uniqueIndex19("workspace_gateway_custom_models_delete_operation_uq").on(table.workspaceId, table.providerKind, table.deleteOperationId).where(sql16`${table.deleteOperationId} is not null`),
+    providerKindCheck: check11(
+      "workspace_gateway_custom_models_provider_kind_chk",
+      sql16`${table.providerKind} in ('vercel_gateway', 'openrouter')`
+    ),
+    upstreamCheck: check11(
+      "workspace_gateway_custom_models_upstream_chk",
+      sql16`octet_length(${table.upstreamModelId}) between 1 and 238 and ${table.upstreamModelId} ~ '^[!-~]+$' and ${table.upstreamModelId} !~ '[|]'`
+    ),
+    labelCheck: check11(
+      "workspace_gateway_custom_models_label_chk",
+      sql16`${table.label} is null or (octet_length(${table.label}) between 1 and 128 and ${table.label} !~ '[\r\n|]')`
+    ),
+    actorCheck: check11(
+      "workspace_gateway_custom_models_actor_chk",
+      sql16`octet_length(${table.createdBySubjectId}) between 1 and 1024`
+    ),
+    versionCheck: check11("workspace_gateway_custom_models_version_chk", sql16`${table.version} > 0`),
+    createHashCheck: check11(
+      "workspace_gateway_custom_models_create_hash_chk",
+      sql16`${table.createRequestHash} ~ '^[a-f0-9]{64}$'`
+    ),
+    deleteReceiptCheck: check11(
+      "workspace_gateway_custom_models_delete_receipt_chk",
+      sql16`(${table.deleteOperationId} is null and ${table.deleteRequestHash} is null) or (${table.deleteOperationId} is not null and ${table.deleteRequestHash} ~ '^[a-f0-9]{64}$' and ${table.retiredAt} is not null)`
+    )
+  })
+);
+var organizationModelProviderConnections = pgTable19(
+  "organization_model_provider_connections",
+  {
+    id: uuid19("id").primaryKey().defaultRandom(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text19("provider_kind").$type().notNull(),
+    status: text19("status").$type().notNull().default("active"),
+    credentialEncrypted: text19("credential_encrypted").notNull(),
+    version: integer18("version").notNull().default(1),
+    operationId: uuid19("operation_id").notNull(),
+    requestHash: text19("request_hash").notNull(),
+    updatedBySubjectId: text19("updated_by_subject_id").notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    accountProvider: uniqueIndex19("organization_model_provider_connections_account_provider_uq").on(
+      table.accountId,
+      table.providerKind
+    ),
+    operation: uniqueIndex19("organization_model_provider_connections_operation_uq").on(
+      table.accountId,
+      table.providerKind,
+      table.operationId
+    ),
+    providerKindCheck: check11(
+      "organization_model_provider_connections_provider_kind_chk",
+      sql16`${table.providerKind} in ('vercel_gateway', 'openrouter')`
+    ),
+    statusCheck: check11(
+      "organization_model_provider_connections_status_chk",
+      sql16`${table.status} in ('active', 'revoked')`
+    ),
+    versionCheck: check11(
+      "organization_model_provider_connections_version_chk",
+      sql16`${table.version} > 0`
+    ),
+    requestHashCheck: check11(
+      "organization_model_provider_connections_request_hash_chk",
+      sql16`${table.requestHash} ~ '^[a-f0-9]{64}$'`
+    ),
+    actorCheck: check11(
+      "organization_model_provider_connections_actor_chk",
+      sql16`octet_length(${table.updatedBySubjectId}) between 1 and 1024`
+    )
+  })
+);
+var organizationModelProviderConnectionOperations = pgTable19(
+  "organization_model_provider_connection_operations",
+  {
+    id: uuid19("id").primaryKey().defaultRandom(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text19("provider_kind").$type().notNull(),
+    operationId: uuid19("operation_id").notNull(),
+    requestHash: text19("request_hash").notNull(),
+    resultStatus: text19("result_status").$type().notNull(),
+    resultVersion: integer18("result_version").notNull(),
+    resultCreatedAt: timestamp19("result_created_at", {
+      withTimezone: true
+    }).notNull(),
+    resultUpdatedAt: timestamp19("result_updated_at", {
+      withTimezone: true
+    }).notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    operation: uniqueIndex19("organization_model_provider_connection_operations_operation_uq").on(
+      table.accountId,
+      table.providerKind,
+      table.operationId
+    ),
+    providerKindCheck: check11(
+      "organization_model_provider_connection_operations_provider_kind_chk",
+      sql16`${table.providerKind} in ('vercel_gateway', 'openrouter')`
+    ),
+    resultStatusCheck: check11(
+      "organization_model_provider_connection_operations_result_status_chk",
+      sql16`${table.resultStatus} in ('active', 'revoked')`
+    ),
+    resultVersionCheck: check11(
+      "organization_model_provider_connection_operations_result_version_chk",
+      sql16`${table.resultVersion} > 0`
+    ),
+    requestHashCheck: check11(
+      "organization_model_provider_connection_operations_request_hash_chk",
+      sql16`${table.requestHash} ~ '^[a-f0-9]{64}$'`
+    )
+  })
+);
+var organizationModelProviderCustomModels = pgTable19(
+  "organization_model_provider_custom_models",
+  {
+    id: uuid19("id").primaryKey().defaultRandom(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    providerKind: text19("provider_kind").$type().notNull(),
+    upstreamModelId: text19("upstream_model_id").notNull(),
+    label: text19("label"),
+    version: integer18("version").notNull().default(1),
+    createOperationId: uuid19("create_operation_id").notNull(),
+    createRequestHash: text19("create_request_hash").notNull(),
+    deleteOperationId: uuid19("delete_operation_id"),
+    deleteRequestHash: text19("delete_request_hash"),
+    createdBySubjectId: text19("created_by_subject_id").notNull(),
+    retiredAt: timestamp19("retired_at", { withTimezone: true }),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    accountUpstream: uniqueIndex19("organization_model_provider_custom_models_active_uq").on(table.accountId, table.providerKind, table.upstreamModelId).where(sql16`${table.retiredAt} is null`),
+    createOperation: uniqueIndex19(
+      "organization_model_provider_custom_models_create_operation_uq"
+    ).on(table.accountId, table.providerKind, table.createOperationId),
+    deleteOperation: uniqueIndex19("organization_model_provider_custom_models_delete_operation_uq").on(table.accountId, table.providerKind, table.deleteOperationId).where(sql16`${table.deleteOperationId} is not null`),
+    providerKindCheck: check11(
+      "organization_model_provider_custom_models_provider_kind_chk",
+      sql16`${table.providerKind} in ('vercel_gateway', 'openrouter')`
+    ),
+    upstreamCheck: check11(
+      "organization_model_provider_custom_models_upstream_chk",
+      sql16`octet_length(${table.upstreamModelId}) between 1 and 238 and ${table.upstreamModelId} ~ '^[!-~]+$' and ${table.upstreamModelId} !~ '[|]'`
+    ),
+    labelCheck: check11(
+      "organization_model_provider_custom_models_label_chk",
+      sql16`${table.label} is null or (octet_length(${table.label}) between 1 and 128 and ${table.label} !~ '[\r\n|]')`
+    ),
+    versionCheck: check11(
+      "organization_model_provider_custom_models_version_chk",
+      sql16`${table.version} > 0`
+    ),
+    actorCheck: check11(
+      "organization_model_provider_custom_models_actor_chk",
+      sql16`octet_length(${table.createdBySubjectId}) between 1 and 1024`
+    ),
+    createHashCheck: check11(
+      "organization_model_provider_custom_models_create_hash_chk",
+      sql16`${table.createRequestHash} ~ '^[a-f0-9]{64}$'`
+    ),
+    deleteReceiptCheck: check11(
+      "organization_model_provider_custom_models_delete_receipt_chk",
+      sql16`(${table.deleteOperationId} is null and ${table.deleteRequestHash} is null) or (${table.deleteOperationId} is not null and ${table.deleteRequestHash} ~ '^[a-f0-9]{64}$' and ${table.retiredAt} is not null)`
+    )
+  })
+);
 
 export {
   LOSSLESS_CONTENT_CODEC_VERSION,
@@ -17523,6 +17815,11 @@ export {
   rigs,
   rigVersions,
   rigChanges,
+  deploymentModelCatalog,
+  workspaceGatewayCustomModels,
+  organizationModelProviderConnections,
+  organizationModelProviderConnectionOperations,
+  organizationModelProviderCustomModels,
   schema_exports
 };
-//# sourceMappingURL=chunk-O56DM5GZ.js.map
+//# sourceMappingURL=chunk-53A2PEHT.js.map