thinkwork-cli 0.13.1 → 1.0.0

package/dist/dist-es-ZKC2QKD2.js

@@ -0,0 +1,377 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  CredentialsProviderError,
+  ProviderError,
+  loadConfig,
+  parseUrl
+} from "./chunk-XYM7PE2A.js";
+import "./chunk-OCPHU34C.js";
+import "./chunk-DV3MRBR5.js";
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js
+var isImdsCredentials = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.AccessKeyId === "string" && typeof arg.SecretAccessKey === "string" && typeof arg.Token === "string" && typeof arg.Expiration === "string";
+var fromImdsCredentials = (creds) => ({
+  accessKeyId: creds.AccessKeyId,
+  secretAccessKey: creds.SecretAccessKey,
+  sessionToken: creds.Token,
+  expiration: new Date(creds.Expiration),
+  ...creds.AccountId && { accountId: creds.AccountId }
+});
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/RemoteProviderInit.js
+var DEFAULT_TIMEOUT = 1e3;
+var DEFAULT_MAX_RETRIES = 0;
+var providerConfigFromInit = ({ maxRetries = DEFAULT_MAX_RETRIES, timeout = DEFAULT_TIMEOUT }) => ({ maxRetries, timeout });
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/node-http.js
+import node_http from "http";
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
+function httpRequest(options) {
+  return new Promise((resolve, reject) => {
+    const req = node_http.request({
+      method: "GET",
+      ...options,
+      hostname: options.hostname?.replace(/^\[(.+)\]$/, "$1")
+    });
+    req.on("error", (err) => {
+      reject(Object.assign(new ProviderError("Unable to connect to instance metadata service"), err));
+      req.destroy();
+    });
+    req.on("timeout", () => {
+      reject(new ProviderError("TimeoutError from instance metadata service"));
+      req.destroy();
+    });
+    req.on("response", (res) => {
+      const { statusCode = 400 } = res;
+      if (statusCode < 200 || 300 <= statusCode) {
+        reject(Object.assign(new ProviderError("Error response received from instance metadata service"), { statusCode }));
+        req.destroy();
+      }
+      const chunks = [];
+      res.on("data", (chunk) => {
+        chunks.push(chunk);
+      });
+      res.on("end", () => {
+        resolve(Buffer.concat(chunks));
+        req.destroy();
+      });
+    });
+    req.end();
+  });
+}
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js
+var retry = (toRetry, maxRetries) => {
+  let promise = toRetry();
+  for (let i = 0; i < maxRetries; i++) {
+    promise = promise.catch(toRetry);
+  }
+  return promise;
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js
+var ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
+var ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+var ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
+var fromContainerMetadata = (init = {}) => {
+  const { timeout, maxRetries } = providerConfigFromInit(init);
+  return () => retry(async () => {
+    const requestOptions = await getCmdsUri({ logger: init.logger });
+    const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));
+    if (!isImdsCredentials(credsResponse)) {
+      throw new CredentialsProviderError("Invalid response received from instance metadata service.", {
+        logger: init.logger
+      });
+    }
+    return fromImdsCredentials(credsResponse);
+  }, maxRetries);
+};
+var requestFromEcsImds = async (timeout, options) => {
+  if (process.env[ENV_CMDS_AUTH_TOKEN]) {
+    options.headers = {
+      ...options.headers,
+      Authorization: process.env[ENV_CMDS_AUTH_TOKEN]
+    };
+  }
+  const buffer = await httpRequest({
+    ...options,
+    timeout
+  });
+  return buffer.toString();
+};
+var CMDS_IP = "169.254.170.2";
+var GREENGRASS_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
+var GREENGRASS_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var getCmdsUri = async ({ logger }) => {
+  if (process.env[ENV_CMDS_RELATIVE_URI]) {
+    return {
+      hostname: CMDS_IP,
+      path: process.env[ENV_CMDS_RELATIVE_URI]
+    };
+  }
+  if (process.env[ENV_CMDS_FULL_URI]) {
+    let parsed;
+    try {
+      parsed = new URL(process.env[ENV_CMDS_FULL_URI]);
+    } catch {
+      throw new CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
+    }
+    if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {
+      throw new CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
+        tryNextLink: false,
+        logger
+      });
+    }
+    if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {
+      throw new CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
+        tryNextLink: false,
+        logger
+      });
+    }
+    return {
+      protocol: parsed.protocol,
+      hostname: parsed.hostname,
+      path: parsed.pathname + parsed.search,
+      port: parsed.port ? parseInt(parsed.port, 10) : void 0
+    };
+  }
+  throw new CredentialsProviderError(`The container metadata credential provider cannot be used unless the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment variable is set`, {
+    tryNextLink: false,
+    logger
+  });
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js
+var InstanceMetadataV1FallbackError = class _InstanceMetadataV1FallbackError extends CredentialsProviderError {
+  tryNextLink;
+  name = "InstanceMetadataV1FallbackError";
+  constructor(message, tryNextLink = true) {
+    super(message, tryNextLink);
+    this.tryNextLink = tryNextLink;
+    Object.setPrototypeOf(this, _InstanceMetadataV1FallbackError.prototype);
+  }
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/config/Endpoint.js
+var Endpoint;
+(function(Endpoint2) {
+  Endpoint2["IPv4"] = "http://169.254.169.254";
+  Endpoint2["IPv6"] = "http://[fd00:ec2::254]";
+})(Endpoint || (Endpoint = {}));
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointConfigOptions.js
+var ENV_ENDPOINT_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT";
+var CONFIG_ENDPOINT_NAME = "ec2_metadata_service_endpoint";
+var ENDPOINT_CONFIG_OPTIONS = {
+  environmentVariableSelector: (env) => env[ENV_ENDPOINT_NAME],
+  configFileSelector: (profile) => profile[CONFIG_ENDPOINT_NAME],
+  default: void 0
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointMode.js
+var EndpointMode;
+(function(EndpointMode2) {
+  EndpointMode2["IPv4"] = "IPv4";
+  EndpointMode2["IPv6"] = "IPv6";
+})(EndpointMode || (EndpointMode = {}));
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointModeConfigOptions.js
+var ENV_ENDPOINT_MODE_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE";
+var CONFIG_ENDPOINT_MODE_NAME = "ec2_metadata_service_endpoint_mode";
+var ENDPOINT_MODE_CONFIG_OPTIONS = {
+  environmentVariableSelector: (env) => env[ENV_ENDPOINT_MODE_NAME],
+  configFileSelector: (profile) => profile[CONFIG_ENDPOINT_MODE_NAME],
+  default: EndpointMode.IPv4
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js
+var getInstanceMetadataEndpoint = async () => parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig());
+var getFromEndpointConfig = async () => loadConfig(ENDPOINT_CONFIG_OPTIONS)();
+var getFromEndpointModeConfig = async () => {
+  const endpointMode = await loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
+  switch (endpointMode) {
+    case EndpointMode.IPv4:
+      return Endpoint.IPv4;
+    case EndpointMode.IPv6:
+      return Endpoint.IPv6;
+    default:
+      throw new Error(`Unsupported endpoint mode: ${endpointMode}. Select from ${Object.values(EndpointMode)}`);
+  }
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js
+var STATIC_STABILITY_REFRESH_INTERVAL_SECONDS = 5 * 60;
+var STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS = 5 * 60;
+var STATIC_STABILITY_DOC_URL = "https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html";
+var getExtendedInstanceMetadataCredentials = (credentials, logger) => {
+  const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS + Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);
+  const newExpiration = new Date(Date.now() + refreshInterval * 1e3);
+  logger.warn(`Attempting credential expiration extension due to a credential service availability issue. A refresh of these credentials will be attempted after ${new Date(newExpiration)}.
+For more information, please visit: ` + STATIC_STABILITY_DOC_URL);
+  const originalExpiration = credentials.originalExpiration ?? credentials.expiration;
+  return {
+    ...credentials,
+    ...originalExpiration ? { originalExpiration } : {},
+    expiration: newExpiration
+  };
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/utils/staticStabilityProvider.js
+var staticStabilityProvider = (provider, options = {}) => {
+  const logger = options?.logger || console;
+  let pastCredentials;
+  return async () => {
+    let credentials;
+    try {
+      credentials = await provider();
+      if (credentials.expiration && credentials.expiration.getTime() < Date.now()) {
+        credentials = getExtendedInstanceMetadataCredentials(credentials, logger);
+      }
+    } catch (e) {
+      if (pastCredentials) {
+        logger.warn("Credential renew failed: ", e);
+        credentials = getExtendedInstanceMetadataCredentials(pastCredentials, logger);
+      } else {
+        throw e;
+      }
+    }
+    pastCredentials = credentials;
+    return credentials;
+  };
+};
+
+// ../../node_modules/.pnpm/@smithy+credential-provider-imds@4.3.8/node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js
+var IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
+var IMDS_TOKEN_PATH = "/latest/api/token";
+var AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
+var PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
+var X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
+var fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger });
+var getInstanceMetadataProvider = (init = {}) => {
+  let disableFetchToken = false;
+  const { logger, profile } = init;
+  const { timeout, maxRetries } = providerConfigFromInit(init);
+  const getCredentials = async (maxRetries2, options) => {
+    const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;
+    if (isImdsV1Fallback) {
+      let fallbackBlockedFromProfile = false;
+      let fallbackBlockedFromProcessEnv = false;
+      const configValue = await loadConfig({
+        environmentVariableSelector: (env) => {
+          const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
+          fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
+          if (envValue === void 0) {
+            throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
+          }
+          return fallbackBlockedFromProcessEnv;
+        },
+        configFileSelector: (profile2) => {
+          const profileValue = profile2[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
+          fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
+          return fallbackBlockedFromProfile;
+        },
+        default: false
+      }, {
+        profile
+      })();
+      if (init.ec2MetadataV1Disabled || configValue) {
+        const causes = [];
+        if (init.ec2MetadataV1Disabled)
+          causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
+        if (fallbackBlockedFromProfile)
+          causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
+        if (fallbackBlockedFromProcessEnv)
+          causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
+        throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
+      }
+    }
+    const imdsProfile = (await retry(async () => {
+      let profile2;
+      try {
+        profile2 = await getProfile(options);
+      } catch (err) {
+        if (err.statusCode === 401) {
+          disableFetchToken = false;
+        }
+        throw err;
+      }
+      return profile2;
+    }, maxRetries2)).trim();
+    return retry(async () => {
+      let creds;
+      try {
+        creds = await getCredentialsFromProfile(imdsProfile, options, init);
+      } catch (err) {
+        if (err.statusCode === 401) {
+          disableFetchToken = false;
+        }
+        throw err;
+      }
+      return creds;
+    }, maxRetries2);
+  };
+  return async () => {
+    const endpoint = await getInstanceMetadataEndpoint();
+    if (disableFetchToken) {
+      logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
+      return getCredentials(maxRetries, { ...endpoint, timeout });
+    } else {
+      let token;
+      try {
+        token = (await getMetadataToken({ ...endpoint, timeout })).toString();
+      } catch (error) {
+        if (error?.statusCode === 400) {
+          throw Object.assign(error, {
+            message: "EC2 Metadata token request returned error"
+          });
+        } else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
+          disableFetchToken = true;
+        }
+        logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
+        return getCredentials(maxRetries, { ...endpoint, timeout });
+      }
+      return getCredentials(maxRetries, {
+        ...endpoint,
+        headers: {
+          [X_AWS_EC2_METADATA_TOKEN]: token
+        },
+        timeout
+      });
+    }
+  };
+};
+var getMetadataToken = async (options) => httpRequest({
+  ...options,
+  path: IMDS_TOKEN_PATH,
+  method: "PUT",
+  headers: {
+    "x-aws-ec2-metadata-token-ttl-seconds": "21600"
+  }
+});
+var getProfile = async (options) => (await httpRequest({ ...options, path: IMDS_PATH })).toString();
+var getCredentialsFromProfile = async (profile, options, init) => {
+  const credentialsResponse = JSON.parse((await httpRequest({
+    ...options,
+    path: IMDS_PATH + profile
+  })).toString());
+  if (!isImdsCredentials(credentialsResponse)) {
+    throw new CredentialsProviderError("Invalid response received from instance metadata service.", {
+      logger: init.logger
+    });
+  }
+  return fromImdsCredentials(credentialsResponse);
+};
+export {
+  DEFAULT_MAX_RETRIES,
+  DEFAULT_TIMEOUT,
+  ENV_CMDS_AUTH_TOKEN,
+  ENV_CMDS_FULL_URI,
+  ENV_CMDS_RELATIVE_URI,
+  Endpoint,
+  fromContainerMetadata,
+  fromInstanceMetadata,
+  getInstanceMetadataEndpoint,
+  httpRequest,
+  providerConfigFromInit
+};

package/dist/drizzle/0076_scheduled_jobs_marco_backfill.sql

@@ -18,7 +18,8 @@
 --
 -- Idempotent: re-running with the same :computer_id is a no-op.
 --
--- This is a data backfill, not a schema change — no creates: markers.
+-- data-only-migration
+-- This is a data backfill, not a schema change.
 
 \set ON_ERROR_STOP on
 

package/dist/drizzle/0079_seed_tenant_customize_catalog.sql

@@ -15,6 +15,7 @@
 -- inert page. Per-tenant variation can be added by INSERTing rows with a
 -- specific tenant_id; the SELECT-from-tenants below is the convenient
 -- "every tenant gets the v1 baseline" path.
+-- data-only-migration
 
 \set ON_ERROR_STOP on
 

package/dist/drizzle/0090_brain_schema_extraction.sql

@@ -60,6 +60,16 @@
 --
 -- Markers (consumed by scripts/db-migrate-manual.sh):
 --
+-- moves-owner: public.tenant_entity_pages -> brain.pages
+-- moves-owner: public.tenant_entity_page_sections -> brain.page_sections
+-- moves-owner: public.tenant_entity_page_links -> brain.page_links
+-- moves-owner: public.tenant_entity_page_aliases -> brain.page_aliases
+-- moves-owner: public.tenant_entity_section_sources -> brain.section_sources
+-- moves-owner: public.tenant_entity_external_refs -> brain.external_refs
+-- drops: public.uq_tenant_entity_pages_tenant_type_subtype_slug
+-- drops: public.idx_tenant_entity_pages_search_tsv
+-- drops: public.uq_tenant_entity_section_sources_section_kind_ref
+-- creates-trigger: brain.section_sources.trg_tenant_entity_section_sources_tenant
 -- creates: brain.pages
 -- creates: brain.page_sections
 -- creates: brain.page_links

package/dist/drizzle/0132_drop_computer_tables.sql

@@ -4,6 +4,9 @@
 -- drops: public.computer_assignments
 -- drops: public.computer_snapshots
 -- drops: public.computers
+-- drops-constraint: public.eval_runs.eval_runs_computer_id_computers_id_fk
+-- drops-constraint: public.thread_idle_learning_state.thread_idle_learning_state_computer_id_computers_id_fk
+-- drops-constraint: public.thread_idle_learning_runs.thread_idle_learning_runs_computer_id_computers_id_fk
 --
 -- Kill the legacy Computer feature. All product surfaces (admin, Spaces,
 -- mobile, CLI), Lambda handlers (computer-runtime, computer-manager,

package/dist/drizzle/0160_compliance_event_types_plugins.sql

@@ -15,6 +15,8 @@
 --
 -- creates-constraint: compliance.audit_outbox.audit_outbox_event_type_prefix_v3
 -- creates-constraint: compliance.audit_events.audit_events_event_type_prefix_v3
+-- drops-constraint: compliance.audit_outbox.audit_outbox_event_type_prefix_v2
+-- drops-constraint: compliance.audit_events.audit_events_event_type_prefix_v2
 
 BEGIN;
 

package/dist/drizzle/0214_think137_drop_judge_evidence_roi.sql

@@ -48,6 +48,7 @@
 -- drops-column: public.agent_loops.cost_per_accepted_run_usd_cents
 -- drops-column: public.agent_loop_versions.judge_spec
 -- drops-column: public.agent_loop_versions.evidence_policy
+-- drops: public.view_agent_loop_versions_judge_evidence_nullable
 
 \set ON_ERROR_STOP on
 

package/dist/drizzle/0216_drop_agent_loop_versions_goal_worker_policy.sql

@@ -27,6 +27,7 @@
 -- drops-column: public.agent_loop_versions.worker_spec
 -- drops-column: public.agent_loop_versions.loop_policy
 -- creates: public.view_agent_loop_versions_target_spec_required
+-- drops: public.view_agent_loop_versions_goal_worker_policy_nullable
 
 \set ON_ERROR_STOP on
 

package/dist/drizzle/0227_analyst_reader_role.sql

@@ -215,11 +215,6 @@ BEGIN
   ELSE
     missing := missing || 'agent_capabilities'::text;
   END IF;
-  IF to_regclass('public.agent_knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.agent_knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'agent_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.agent_loop_iterations') IS NOT NULL THEN
     GRANT SELECT ON public.agent_loop_iterations TO analyst_reader;
   ELSE
@@ -525,16 +520,6 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
-  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_base_documents TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_base_documents'::text;
-  END IF;
-  IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     GRANT SELECT ON public.linked_task_events TO analyst_reader;
   ELSE
@@ -825,11 +810,6 @@ BEGIN
   ELSE
     missing := missing || 'space_integrations'::text;
   END IF;
-  IF to_regclass('public.space_knowledge_bases') IS NOT NULL THEN
-    GRANT SELECT ON public.space_knowledge_bases TO analyst_reader;
-  ELSE
-    missing := missing || 'space_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.space_mcp_servers') IS NOT NULL THEN
     GRANT SELECT ON public.space_mcp_servers TO analyst_reader;
   ELSE
@@ -967,6 +947,12 @@ BEGIN
   ELSE
     missing := missing || 'threads'::text;
   END IF;
+  IF to_regclass('public.tool_execution_events') IS NOT NULL THEN
+    REVOKE ALL PRIVILEGES ON public.tool_execution_events FROM analyst_reader;
+    GRANT SELECT (created_at, duration_ms, error_preview, event_type, id, idempotency_key, input_preview, operation, output_preview, policy_decision_id, policy_revision, principal_id, principal_type, provider_cost_usd, provider_request_id, tenant_id, thread_id, tool_use_id, turn_id) ON public.tool_execution_events TO analyst_reader;
+  ELSE
+    missing := missing || 'tool_execution_events'::text;
+  END IF;
   IF to_regclass('public.trace_cost_reconciliation_facts') IS NOT NULL THEN
     GRANT SELECT ON public.trace_cost_reconciliation_facts TO analyst_reader;
   ELSE
@@ -987,6 +973,16 @@ BEGIN
   ELSE
     missing := missing || 'trace_source_evidence'::text;
   END IF;
+  IF to_regclass('public.twin_materialization_suggestions') IS NOT NULL THEN
+    GRANT SELECT ON public.twin_materialization_suggestions TO analyst_reader;
+  ELSE
+    missing := missing || 'twin_materialization_suggestions'::text;
+  END IF;
+  IF to_regclass('public.user_brain_claims') IS NOT NULL THEN
+    GRANT SELECT ON public.user_brain_claims TO analyst_reader;
+  ELSE
+    missing := missing || 'user_brain_claims'::text;
+  END IF;
   IF to_regclass('public.user_model_approvals') IS NOT NULL THEN
     GRANT SELECT ON public.user_model_approvals TO analyst_reader;
   ELSE
@@ -1112,6 +1108,7 @@ BEGIN
     RAISE WARNING 'analyst grants skipped for tables missing on this database: %', missing;
   END IF;
 END $$;
+
 -- END GENERATED ANALYST GRANTS
 
 COMMIT;

package/dist/drizzle/0230_analyst_rls.sql

@@ -146,15 +146,6 @@ BEGIN
   ELSE
     missing := missing || 'agent_capabilities'::text;
   END IF;
-  IF to_regclass('public.agent_knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.agent_knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.agent_knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.agent_knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'agent_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.agent_loop_iterations') IS NOT NULL THEN
     ALTER TABLE public.agent_loop_iterations ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.agent_loop_iterations;
@@ -695,24 +686,6 @@ BEGIN
   ELSE
     missing := missing || 'inbox_items'::text;
   END IF;
-  IF to_regclass('public.knowledge_base_documents') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_base_documents ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_base_documents;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_base_documents
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_base_documents'::text;
-  END IF;
-  IF to_regclass('public.knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.linked_task_events') IS NOT NULL THEN
     ALTER TABLE public.linked_task_events ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.linked_task_events;
@@ -1217,15 +1190,6 @@ BEGIN
   ELSE
     missing := missing || 'space_integrations'::text;
   END IF;
-  IF to_regclass('public.space_knowledge_bases') IS NOT NULL THEN
-    ALTER TABLE public.space_knowledge_bases ENABLE ROW LEVEL SECURITY;
-    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.space_knowledge_bases;
-    CREATE POLICY analyst_tenant_isolation ON public.space_knowledge_bases
-      FOR SELECT TO analyst_reader
-      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
-  ELSE
-    missing := missing || 'space_knowledge_bases'::text;
-  END IF;
   IF to_regclass('public.space_mcp_servers') IS NOT NULL THEN
     ALTER TABLE public.space_mcp_servers ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.space_mcp_servers;
@@ -1469,6 +1433,15 @@ BEGIN
   ELSE
     missing := missing || 'threads'::text;
   END IF;
+  IF to_regclass('public.tool_execution_events') IS NOT NULL THEN
+    ALTER TABLE public.tool_execution_events ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.tool_execution_events;
+    CREATE POLICY analyst_tenant_isolation ON public.tool_execution_events
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'tool_execution_events'::text;
+  END IF;
   IF to_regclass('public.trace_cost_reconciliation_facts') IS NOT NULL THEN
     ALTER TABLE public.trace_cost_reconciliation_facts ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.trace_cost_reconciliation_facts;
@@ -1505,6 +1478,24 @@ BEGIN
   ELSE
     missing := missing || 'trace_source_evidence'::text;
   END IF;
+  IF to_regclass('public.twin_materialization_suggestions') IS NOT NULL THEN
+    ALTER TABLE public.twin_materialization_suggestions ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.twin_materialization_suggestions;
+    CREATE POLICY analyst_tenant_isolation ON public.twin_materialization_suggestions
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'twin_materialization_suggestions'::text;
+  END IF;
+  IF to_regclass('public.user_brain_claims') IS NOT NULL THEN
+    ALTER TABLE public.user_brain_claims ENABLE ROW LEVEL SECURITY;
+    DROP POLICY IF EXISTS analyst_tenant_isolation ON public.user_brain_claims;
+    CREATE POLICY analyst_tenant_isolation ON public.user_brain_claims
+      FOR SELECT TO analyst_reader
+      USING (tenant_id = current_setting('thinkwork.analyst_tenant', true)::uuid);
+  ELSE
+    missing := missing || 'user_brain_claims'::text;
+  END IF;
   IF to_regclass('public.user_model_approvals') IS NOT NULL THEN
     ALTER TABLE public.user_model_approvals ENABLE ROW LEVEL SECURITY;
     DROP POLICY IF EXISTS analyst_tenant_isolation ON public.user_model_approvals;
@@ -1725,6 +1716,7 @@ BEGIN
     RAISE WARNING 'analyst RLS skipped for tables missing on this database: %', missing;
   END IF;
 END $$;
+
 -- END GENERATED ANALYST RLS
 
 COMMIT;

package/dist/drizzle/0250_kg_schema_extraction.sql

@@ -61,11 +61,38 @@
 --
 -- Markers (consumed by scripts/db-migrate-manual.sh):
 --
+-- moves-owner: public.knowledge_graph_ingest_runs -> kg.ingest_runs
+-- moves-owner: public.knowledge_graph_entities -> kg.entities
+-- moves-owner: public.knowledge_graph_relationships -> kg.relationships
+-- moves-owner: public.knowledge_graph_evidence -> kg.evidence
+-- moves-owner: public.knowledge_graph_observation_cursors -> kg.observation_cursors
 -- creates: kg.ingest_runs
 -- creates: kg.entities
 -- creates: kg.relationships
 -- creates: kg.evidence
 -- creates: kg.observation_cursors
+-- creates: kg.uq_kg_entities_run_graph_node
+-- creates: kg.uq_kg_relationships_run_graph_edge
+-- drops: public.uq_kg_entities_run_graph_node
+-- drops: public.uq_kg_relationships_run_graph_edge
+-- drops-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_status_allowed
+-- drops-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_trigger_allowed
+-- drops-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_source_kind_allowed
+-- drops-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_thread_scope_required
+-- drops-constraint: public.knowledge_graph_entities.knowledge_graph_entities_grounding_allowed
+-- drops-constraint: public.knowledge_graph_entities.knowledge_graph_entities_provenance_allowed
+-- drops-constraint: public.knowledge_graph_entities.knowledge_graph_entities_source_kind_allowed
+-- drops-constraint: public.knowledge_graph_entities.knowledge_graph_entities_resolution_state_allowed
+-- drops-constraint: public.knowledge_graph_relationships.knowledge_graph_relationships_grounding_allowed
+-- drops-constraint: public.knowledge_graph_relationships.knowledge_graph_relationships_provenance_allowed
+-- drops-constraint: public.knowledge_graph_relationships.knowledge_graph_relationships_source_kind_allowed
+-- drops-constraint: public.knowledge_graph_evidence.knowledge_graph_evidence_source_kind_allowed
+-- drops-constraint: public.knowledge_graph_evidence.knowledge_graph_evidence_evidence_source_kind_allowed
+-- drops-constraint: public.knowledge_graph_evidence.knowledge_graph_evidence_subject_required
+-- creates-trigger: kg.ingest_runs.knowledge_graph_ingest_runs_scope_guard
+-- creates-trigger: kg.entities.knowledge_graph_entities_scope_guard
+-- creates-trigger: kg.relationships.knowledge_graph_relationships_scope_guard
+-- creates-trigger: kg.evidence.knowledge_graph_evidence_scope_guard
 -- creates-constraint: kg.ingest_runs.ingest_runs_status_allowed
 -- creates-constraint: kg.ingest_runs.ingest_runs_trigger_allowed
 -- creates-constraint: kg.ingest_runs.ingest_runs_source_kind_allowed