@opengeni/db 5.0.1 → 6.0.0

package/dist/{chunk-F73UKJY6.js → chunk-MN5PZMEK.js}

@@ -199,6 +199,8 @@ __export(schema_exports, {
   organizationCodexRotationSettings: () => organizationCodexRotationSettings,
   organizationCompanyProfileAgentPolicies: () => organizationCompanyProfileAgentPolicies,
   organizationCompanyProfileAgentPolicyEvents: () => organizationCompanyProfileAgentPolicyEvents,
+  organizationIntegrationPolicies: () => organizationIntegrationPolicies,
+  organizationIntegrationPolicyOperations: () => organizationIntegrationPolicyOperations,
   organizationInvitationBindingEvents: () => organizationInvitationBindingEvents,
   organizationMembershipInvitations: () => organizationMembershipInvitations,
   organizationMembershipLifecycleEvents: () => organizationMembershipLifecycleEvents,
@@ -227,8 +229,6 @@ __export(schema_exports, {
   organizationUserRetentionObjectDeletionReceipts: () => organizationUserRetentionObjectDeletionReceipts,
   organizationUserRetentionObjectObligations: () => organizationUserRetentionObjectObligations,
   organizationUserRetentionPolicies: () => organizationUserRetentionPolicies,
-  packInstallationComponents: () => packInstallationComponents,
-  packInstallations: () => packInstallations,
   personalGitHubRepositorySelectionHeads: () => personalGitHubRepositorySelectionHeads,
   personalGitHubRepositorySelectionOperations: () => personalGitHubRepositorySelectionOperations,
   personalGitHubRepositorySelections: () => personalGitHubRepositorySelections,
@@ -370,7 +370,6 @@ __export(schema_exports, {
   workspaceLearningPolicySnapshots: () => workspaceLearningPolicySnapshots,
   workspaceMemberships: () => workspaceMemberships,
   workspaceModelPolicies: () => workspaceModelPolicies,
-  workspacePacks: () => workspacePacks,
   workspaceScreenshotQuotas: () => workspaceScreenshotQuotas,
   workspaceSessionActivityRevisions: () => workspaceSessionActivityRevisions,
   workspaceVariableSetVariables: () => workspaceVariableSetVariables,
@@ -2966,6 +2965,7 @@ var preferenceRegistryRevisions = pgTable9(
     contentHash: text9("content_hash").notNull(),
     skillFiles: jsonb9("skill_files").$type(),
     skillActivationMode: text9("skill_activation_mode"),
+    skillRemovalOperationId: uuid9("skill_removal_operation_id"),
     precedenceRank: integer9("precedence_rank").notNull().default(0),
     conflictStrategy: text9("conflict_strategy").notNull(),
     conflictsWith: jsonb9("conflicts_with").$type().notNull().default([]),
@@ -6508,6 +6508,40 @@ var managedAccounts = pgTable21(
     )
   })
 );
+var organizationIntegrationPolicies = pgTable21(
+  "organization_integration_policies",
+  {
+    accountId: uuid21("account_id").primaryKey().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    mode: text21("mode").$type().notNull(),
+    allowedIntegrationKeys: jsonb17("allowed_integration_keys").$type().notNull(),
+    revision: bigint14("revision", { mode: "number" }).notNull()
+  },
+  (table) => ({
+    modeCheck: check11(
+      "organization_integration_policies_mode_check",
+      sql16`${table.mode} in ('unrestricted', 'restricted')`
+    ),
+    keysCheck: check11(
+      "organization_integration_policies_allowed_integration_keys_check",
+      sql16`jsonb_typeof(${table.allowedIntegrationKeys}) = 'array'`
+    ),
+    revisionCheck: check11(
+      "organization_integration_policies_revision_check",
+      sql16`${table.revision} between 1 and 9007199254740991`
+    )
+  })
+);
+var organizationIntegrationPolicyOperations = pgTable21(
+  "organization_integration_policy_operations",
+  {
+    accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    operationId: uuid21("operation_id").notNull(),
+    actorSubjectId: text21("actor_subject_id").notNull(),
+    request: jsonb17("request").notNull(),
+    result: jsonb17("result").notNull()
+  },
+  (table) => ({ identity: primaryKey10({ columns: [table.accountId, table.operationId] }) })
+);
 var workspaces = pgTable21(
   "workspaces",
   {
@@ -7041,7 +7075,8 @@ var organizationPrivateSessionSettingEvents = pgTable21(
   {
     id: uuid21("id").primaryKey(),
     accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    actorMembershipId: uuid21("actor_membership_id").notNull(),
+    actorMembershipId: uuid21("actor_membership_id"),
+    actorSubjectId: text21("actor_subject_id"),
     requestedEnabled: boolean12("requested_enabled").notNull(),
     expectedVersion: bigint14("expected_version", { mode: "number" }).notNull(),
     resultEnabled: boolean12("result_enabled").notNull(),
@@ -7061,6 +7096,10 @@ var organizationPrivateSessionSettingEvents = pgTable21(
     versionsValid: check11(
       "organization_private_session_setting_events_versions_check",
       sql16`${table.expectedVersion} >= 0 and ${table.resultVersion} > 0`
+    ),
+    actorValid: check11(
+      "organization_private_session_setting_events_actor_check",
+      sql16`${table.actorMembershipId} is not null or (${table.actorSubjectId} is not null and ${table.actorSubjectId} like 'api_key:%')`
     )
   })
 );
@@ -7923,6 +7962,8 @@ var connections = pgTable21(
     kind: text21("kind").notNull(),
     status: text21("status").notNull().default("active"),
     credentialEncrypted: text21("credential_encrypted").notNull(),
+    createOperationId: text21("create_operation_id"),
+    createRequestDigest: text21("create_request_digest"),
     grantedScopes: jsonb17("granted_scopes").$type().notNull().default([]),
     expiresAt: timestamp21("expires_at", { withTimezone: true }),
     lastRefreshAt: timestamp21("last_refresh_at", { withTimezone: true }),
@@ -7962,6 +8003,13 @@ var connections = pgTable21(
       table.providerDomain,
       table.status
     ),
+    createOperation: uniqueIndex21("connections_create_operation_uq").on(table.workspaceId, table.createdBySubjectId, table.createOperationId).where(sql16`${table.createOperationId} is not null`),
+    createOperationPair: check11(
+      "connections_create_operation_pair_check",
+      sql16`(${table.createOperationId} is null and ${table.createRequestDigest} is null)
+        or (${table.createOperationId} is not null and ${table.createRequestDigest} is not null
+          and ${table.createdBySubjectId} is not null)`
+    ),
     workspaceSubjectProvider: index20("connections_workspace_subject_provider_idx").on(
       table.workspaceId,
       table.subjectId,
@@ -10106,6 +10154,7 @@ var sessions = pgTable21(
     // NULL and use the bounded metadata.role compatibility fallback at the
     // attempt-snapshot boundary.
     policyRole: text21("policy_role"),
+    admissionBlock: jsonb17("admission_block").$type(),
     resources: jsonb17("resources").$type().notNull().default([]),
     skills: jsonb17("skills").$type().notNull().default([]),
     tools: jsonb17("tools").$type().notNull().default([]),
@@ -10123,6 +10172,8 @@ var sessions = pgTable21(
     visibility: text21("visibility").notNull().default("workspace_shared"),
     createRequestedVisibility: text21("create_requested_visibility").notNull().default("workspace_shared"),
     authorityEpoch: integer19("authority_epoch").notNull().default(1),
+    // Old accepted epochs remain valid across sharing, never across revocation.
+    executionAuthorityEpoch: integer19("execution_authority_epoch").notNull().default(1),
     // Agent-access scope (migration 0427). Declares how far a live attempt on
     // this session may reach across the workspace and how far peers may reach
     // into it. 'workspace' is the pre-0426 behaviour; 'user' limits reach to
@@ -10218,6 +10269,7 @@ var sessions = pgTable21(
     // crash between the session insert and first-turn transaction. Runtime
     // credential authority must never read this session field.
     initialPersonalConnectionDelegations: jsonb17("initial_personal_connection_delegations").$type().notNull().default([]),
+    initialMcpAccountBindings: jsonb17("initial_mcp_account_bindings").$type(),
     // Initial accepted-work staging only. The initializer consumes this inside
     // the same transaction that inserts the first logical turn and grant
     // snapshots; runtime never authorizes from the session field.
@@ -10232,6 +10284,7 @@ var sessions = pgTable21(
     toolPolicy: jsonb17("tool_policy").$type().notNull(),
     // Optimistic-concurrency fence for durable session tool-policy writes.
     toolPolicyVersion: integer19("tool_policy_version").notNull().default(1),
+    mcpApprovalPolicies: jsonb17("mcp_approval_policies").$type().notNull().default({}),
     // The manager session that spawned this one via session_create. Set only
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
@@ -12191,6 +12244,7 @@ var sessionTurns = pgTable21(
     // approval, retries, and Codemode reuse this row; no runtime may infer
     // broader authority from the session creator or mutable session state.
     personalConnectionDelegations: jsonb17("personal_connection_delegations").$type().notNull().default([]),
+    mcpAccountBindings: jsonb17("mcp_account_bindings").$type(),
     // Credential-free public summary of a turn-bound personal Variable
     // Set/Rig attachment. Exact resource and grant identity lives only in the
     // immutable accepted-work snapshot tables.
@@ -13473,6 +13527,7 @@ var sessionSystemUpdates = pgTable21(
     // Private immutable authority frozen when this machine input is accepted.
     // Public projections intentionally omit connection ids and owner subjects.
     personalConnectionDelegations: jsonb17("personal_connection_delegations").$type().notNull().default([]),
+    mcpAccountBindings: jsonb17("mcp_account_bindings").$type(),
     xaiProviderAccountAuthoritySnapshot: jsonb17("xai_provider_account_authority_snapshot").$type().notNull().default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     // Private scheduled-occurrence authority linkage. Public update/event
     // projections intentionally omit this producer identifier.
@@ -13547,6 +13602,7 @@ var sessionSystemUpdateOutbox = pgTable21(
     // Exact private authority copied from the causal parent turn in the source
     // terminal transaction. Delivery retries cannot replace this snapshot.
     personalConnectionDelegations: jsonb17("personal_connection_delegations").$type().notNull().default([]),
+    mcpAccountBindings: jsonb17("mcp_account_bindings").$type(),
     xaiProviderAccountAuthoritySnapshot: jsonb17("xai_provider_account_authority_snapshot").$type().notNull().default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     status: text21("status").notNull().default("pending"),
     attempts: integer19("attempts").notNull().default(0),
@@ -14416,6 +14472,7 @@ var sandboxLeases = pgTable21(
     accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid21("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     sandboxGroupId: uuid21("sandbox_group_id").notNull(),
+    publicRecovery: jsonb17("public_recovery").$type(),
     unobservableCommandDrainIds: uuid21("unobservable_command_drain_ids").array(),
     unobservableCommandCheckedAt: timestamp21("unobservable_command_checked_at", {
       withTimezone: true
@@ -14486,6 +14543,11 @@ var sandboxLeases = pgTable21(
     // can recover immediately without pretending it resumes one provider RPC.
     archiveCaptureTakeoverSafe: boolean12("archive_capture_takeover_safe").notNull().default(false),
     archiveCaptureAttempt: integer19("archive_capture_attempt"),
+    // Periodic capture cadence survives a failed claim's release and worker
+    // restarts. This is not evidence that a recovery archive was published.
+    archiveCaptureLastAttemptAt: timestamp21("archive_capture_last_attempt_at", {
+      withTimezone: true
+    }),
     archiveCaptureGeneration: integer19("archive_capture_generation"),
     archiveCaptureStartedAt: timestamp21("archive_capture_started_at", {
       withTimezone: true
@@ -14948,6 +15010,13 @@ var sandboxRetainedProcesses = pgTable21(
     routeEpoch: integer19("route_epoch").notNull(),
     providerSessionId: integer19("provider_session_id").notNull(),
     providerCommand: jsonb17("provider_command").$type(),
+    supervisionRetentionXid: customType6({ dataType: () => "xid8" })(
+      "supervision_retention_xid"
+    ).default(sql16`pg_current_xact_id()`),
+    supervisionReceipt: jsonb17("supervision_receipt").$type(),
+    supervisionOutputCaptured: boolean12("supervision_output_captured").notNull().default(false),
+    cancellationRequestedAt: timestamp21("cancellation_requested_at", { withTimezone: true }),
+    cancellationReason: text21("cancellation_reason"),
     providerCommandInputIndex: bigint14("provider_command_input_index", { mode: "number" }).notNull().default(0),
     // Authority frozen when the process was retained (migration 0277). A
     // `legacy_unattributed` process keeps running; only its next workspace
@@ -15041,7 +15110,7 @@ var sandboxRetainedProcesses = pgTable21(
       sql16`${table.providerCommand} IS NULL OR ((
         ${table.providerBackend} = 'modal'
         AND jsonb_typeof(${table.providerCommand}) = 'object'
-        AND ${table.providerCommand}->>'kind' = 'modal-control-v1'
+        AND ${table.providerCommand}->>'kind' IN ('modal-control-v1', 'modal-router-v1')
         AND ${table.providerCommand}->>'sandboxId' = ${table.providerInstanceId}
         AND length(${table.providerCommand}->>'taskId') > 0
         AND length(${table.providerCommand}->>'execId') > 0
@@ -15986,6 +16055,7 @@ var scheduledTasks = pgTable21(
     accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid21("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     name: text21("name").notNull(),
+    ownerSubjectId: text21("owner_subject_id"),
     status: text21("status").notNull().default("active"),
     schedule: jsonb17("schedule").$type().notNull(),
     temporalScheduleId: text21("temporal_schedule_id").notNull(),
@@ -16547,6 +16617,17 @@ var usageEvents = pgTable21(
       table.eventType,
       table.occurredAt
     ),
+    accountRecent: index20("usage_events_account_recent_idx").on(
+      table.accountId,
+      table.occurredAt.desc(),
+      table.recordedAt.desc()
+    ),
+    workspaceRecent: index20("usage_events_workspace_recent_idx").on(
+      table.accountId,
+      table.workspaceId,
+      table.occurredAt.desc(),
+      table.recordedAt.desc()
+    ),
     workspaceSession: index20("usage_events_workspace_session_idx").on(
       table.workspaceId,
       table.sessionId,
@@ -16932,66 +17013,6 @@ var auditEvents = pgTable21(
     )
   })
 );
-var packInstallations = pgTable21(
-  "pack_installations",
-  {
-    id: uuid21("id").primaryKey().defaultRandom(),
-    accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid21("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    packId: text21("pack_id").notNull(),
-    status: text21("status").notNull().default("active"),
-    version: integer19("version").notNull().default(1),
-    manifestSnapshot: jsonb17("manifest_snapshot").$type(),
-    manifestDigest: text21("manifest_digest"),
-    selectedRigId: uuid21("selected_rig_id").references(() => rigs.id, {
-      onDelete: "set null"
-    }),
-    installedBySubjectId: text21("installed_by_subject_id"),
-    metadata: jsonb17("metadata").$type().notNull().default({}),
-    enabledAt: timestamp21("enabled_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp21("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => ({
-    workspaceIdentity: uniqueIndex21("pack_installations_workspace_id_uq").on(
-      table.workspaceId,
-      table.id
-    ),
-    workspacePack: uniqueIndex21("pack_installations_workspace_pack_idx").on(
-      table.workspaceId,
-      table.packId
-    ),
-    status: index20("pack_installations_workspace_status_idx").on(table.workspaceId, table.status),
-    selectedRig: index20("pack_installations_workspace_rig_idx").on(table.workspaceId, table.selectedRigId).where(sql16`${table.selectedRigId} is not null`)
-  })
-);
-var packInstallationComponents = pgTable21(
-  "pack_installation_components",
-  {
-    id: uuid21("id").primaryKey().defaultRandom(),
-    accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid21("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    packInstallationId: uuid21("pack_installation_id").notNull().references(() => packInstallations.id, { onDelete: "cascade" }),
-    componentKey: text21("component_key").notNull(),
-    kind: text21("kind").notNull(),
-    capabilityId: text21("capability_id").notNull(),
-    resolvedId: text21("resolved_id").notNull(),
-    digest: text21("digest").notNull(),
-    metadata: jsonb17("metadata").$type().notNull().default({}),
-    createdAt: timestamp21("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp21("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => ({
-    installationKey: uniqueIndex21("pack_installation_components_pack_key_uq").on(
-      table.packInstallationId,
-      table.componentKey
-    ),
-    workspaceCapability: index20("pack_installation_components_workspace_capability_idx").on(
-      table.workspaceId,
-      table.kind,
-      table.capabilityId
-    )
-  })
-);
 var automationSources = pgTable21(
   "automation_sources",
   {
@@ -17005,8 +17026,6 @@ var automationSources = pgTable21(
     webhookSecretEncrypted: text21("webhook_secret_encrypted").notNull(),
     status: text21("status").notNull().default("active"),
     version: integer19("version").notNull().default(1),
-    packInstallationId: uuid21("pack_installation_id"),
-    packConnectorId: text21("pack_connector_id"),
     createdBySubjectId: text21("created_by_subject_id").notNull(),
     createdAt: timestamp21("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp21("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -17028,20 +17047,12 @@ var automationSources = pgTable21(
         and octet_length(${table.name}) between 1 and 512
         and octet_length(${table.adapterId}) between 1 and 128
         and octet_length(${table.createdBySubjectId}) between 1 and 4096
-        and jsonb_typeof(${table.configuration}) = 'object'
-        and ((${table.packInstallationId} is null and ${table.packConnectorId} is null)
-          or (${table.packInstallationId} is not null
-            and octet_length(${table.packConnectorId}) between 1 and 128))`
+        and jsonb_typeof(${table.configuration}) = 'object'`
     ),
     workspaceAccount: foreignKey({
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
       name: "automation_sources_workspace_account_fk"
-    }).onDelete("cascade"),
-    packInstallation: foreignKey({
-      columns: [table.workspaceId, table.packInstallationId],
-      foreignColumns: [packInstallations.workspaceId, packInstallations.id],
-      name: "automation_sources_pack_installation_fk"
     }).onDelete("cascade")
   })
 );
@@ -17073,8 +17084,6 @@ var automationTriggers = pgTable21(
     name: text21("name").notNull(),
     status: text21("status").notNull().default("active"),
     currentRevision: integer19("current_revision").notNull().default(1),
-    packInstallationId: uuid21("pack_installation_id"),
-    packTemplateId: text21("pack_template_id"),
     createdBySubjectId: text21("created_by_subject_id").notNull(),
     createdAt: timestamp21("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp21("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -17098,11 +17107,6 @@ var automationTriggers = pgTable21(
       foreignColumns: [automationSources.workspaceId, automationSources.id],
       name: "automation_triggers_source_fk"
     }).onDelete("cascade"),
-    packInstallation: foreignKey({
-      columns: [table.workspaceId, table.packInstallationId],
-      foreignColumns: [packInstallations.workspaceId, packInstallations.id],
-      name: "automation_triggers_pack_installation_fk"
-    }).onDelete("cascade"),
     workspaceAccount: foreignKey({
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
@@ -17113,9 +17117,7 @@ var automationTriggers = pgTable21(
       sql16`${table.status} in ('active', 'paused', 'disabled')
         and ${table.currentRevision} > 0
         and octet_length(${table.name}) between 1 and 512
-        and octet_length(${table.createdBySubjectId}) between 1 and 4096
-        and ((${table.packInstallationId} is null and ${table.packTemplateId} is null)
-          or (${table.packInstallationId} is not null and octet_length(${table.packTemplateId}) between 1 and 128))`
+        and octet_length(${table.createdBySubjectId}) between 1 and 4096`
     )
   })
 );
@@ -17334,24 +17336,6 @@ var automationRunEventLinks = pgTable21(
     }).onDelete("cascade")
   })
 );
-var workspacePacks = pgTable21(
-  "workspace_packs",
-  {
-    id: uuid21("id").primaryKey().defaultRandom(),
-    accountId: uuid21("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid21("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
-    packId: text21("pack_id").notNull(),
-    manifest: jsonb17("manifest").$type().notNull(),
-    createdAt: timestamp21("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp21("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => ({
-    workspacePack: uniqueIndex21("workspace_packs_workspace_pack_idx").on(
-      table.workspaceId,
-      table.packId
-    )
-  })
-);
 var importBatches = pgTable21(
   "import_batches",
   {
@@ -18498,6 +18482,8 @@ export {
   interactionResourceOperations,
   interactionOperations,
   managedAccounts,
+  organizationIntegrationPolicies,
+  organizationIntegrationPolicyOperations,
   workspaces,
   workspaceArtifacts,
   workspaceArtifactUploads,
@@ -18688,8 +18674,6 @@ export {
   billingCustomers,
   stripeWebhookEvents,
   auditEvents,
-  packInstallations,
-  packInstallationComponents,
   automationSources,
   automationWebhookEndpoints,
   automationTriggers,
@@ -18697,7 +18681,6 @@ export {
   automationTriggerEvents,
   automationRuns,
   automationRunEventLinks,
-  workspacePacks,
   importBatches,
   capabilityCatalogItems,
   capabilityInstallations,
@@ -18731,4 +18714,4 @@ export {
   feedbackSubmissions,
   schema_exports
 };
-//# sourceMappingURL=chunk-F73UKJY6.js.map
+//# sourceMappingURL=chunk-MN5PZMEK.js.map