gaard-api 0.2.14__tar.gz → 0.2.17__tar.gz

{gaard_api-0.2.14/src/gaard_api.egg-info → gaard_api-0.2.17}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: gaard-api
-Version: 0.2.14
+Version: 0.2.17
 Summary: GAARD backend web services providing admin interface
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: gaard-core==0.2.11
-Requires-Dist: gaard-connectors==0.2.11
-Requires-Dist: gaard-llm==0.2.11
-Requires-Dist: gaard-plugin-api<0.3.0,>=0.2.11
+Requires-Dist: gaard-core==0.2.17
+Requires-Dist: gaard-connectors==0.2.17
+Requires-Dist: gaard-llm==0.2.17
+Requires-Dist: gaard-plugin-api<0.3.0,>=0.2.17
 Requires-Dist: fastapi>=0.111.0
 Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: pydantic>=2.7.0

{gaard_api-0.2.14 → gaard_api-0.2.17}/pyproject.toml

@@ -4,16 +4,16 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gaard-api"
-version = "0.2.14"
+version = "0.2.17"
 description = "GAARD backend web services providing admin interface"
 readme = "README.md"
 requires-python = ">=3.11"
 
 dependencies = [
-    "gaard-core==0.2.11",
-    "gaard-connectors==0.2.11",
-    "gaard-llm==0.2.11",
-    "gaard-plugin-api>=0.2.11,<0.3.0",
+    "gaard-core==0.2.17",
+    "gaard-connectors==0.2.17",
+    "gaard-llm==0.2.17",
+    "gaard-plugin-api>=0.2.17,<0.3.0",
     "fastapi>=0.111.0",
     "uvicorn[standard]>=0.30.0",
     "pydantic>=2.7.0",

{gaard_api-0.2.14 → gaard_api-0.2.17}/src/gaard_api/admin/database_initial.sql

@@ -7,6 +7,10 @@ CREATE TABLE IF NOT EXISTS admin_sessions (id INTEGER NOT NULL, token_hash VARCH
 CREATE UNIQUE INDEX IF NOT EXISTS ix_admin_sessions_token_hash ON admin_sessions (token_hash);
 CREATE TABLE IF NOT EXISTS admin_settings ("key" VARCHAR(255) NOT NULL, value TEXT NOT NULL, updated_at DATETIME NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY ("key"));
 CREATE TABLE IF NOT EXISTS admin_users (id INTEGER NOT NULL, username VARCHAR(255) NOT NULL, display_name VARCHAR(255) NOT NULL, auth_provider VARCHAR(255) NOT NULL, role VARCHAR(50) NOT NULL, is_system_admin BOOLEAN NOT NULL, enterprise_access BOOLEAN NOT NULL, password_hash TEXT NOT NULL, must_change_password BOOLEAN NOT NULL, is_provisioned BOOLEAN NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_admin_users_auth_provider_username UNIQUE (auth_provider, username));
+CREATE TABLE IF NOT EXISTS analysis_findings (id INTEGER NOT NULL, finding_id VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, owner_user_id VARCHAR(255) NOT NULL, connector_id INTEGER NOT NULL, business_logic_suggestion_id INTEGER, statement TEXT NOT NULL, finding_type VARCHAR(100) NOT NULL, confidence FLOAT NOT NULL, critique TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, status VARCHAR(50) NOT NULL, evidence_state VARCHAR(50) NOT NULL, decision VARCHAR(50) NOT NULL, decision_confidence FLOAT, verdict TEXT NOT NULL, decision_scope_json TEXT NOT NULL, decision_evidence_refs_json TEXT NOT NULL, decided_by VARCHAR(255) NOT NULL, contract_version VARCHAR(20) NOT NULL, decisions_json TEXT NOT NULL, evidence_updates_json TEXT NOT NULL, used_in_steps_json TEXT NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id));
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_findings_finding_id ON analysis_findings (finding_id);
+CREATE TABLE IF NOT EXISTS analysis_finding_decisions (id INTEGER NOT NULL, decision_id VARCHAR(64) NOT NULL, idempotency_key VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, finding_id VARCHAR(64) NOT NULL, radar_run_id VARCHAR(255) NOT NULL, decision VARCHAR(50) NOT NULL, confidence FLOAT NOT NULL, verdict TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, is_current BOOLEAN NOT NULL, active BOOLEAN NOT NULL, contract_version VARCHAR(20) NOT NULL, actor_id VARCHAR(255) NOT NULL, actor_type VARCHAR(50) NOT NULL, actor_username VARCHAR(255) NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_analysis_finding_decisions_idempotency_key UNIQUE (idempotency_key));
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision_id ON analysis_finding_decisions (decision_id);
 CREATE TABLE IF NOT EXISTS analysis_sessions (id INTEGER NOT NULL, session_id VARCHAR(64) NOT NULL, status VARCHAR(50) NOT NULL, user_id VARCHAR(255) NOT NULL, datasource_id VARCHAR(255) NOT NULL, question TEXT NOT NULL, context_json TEXT NOT NULL, events_json TEXT NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id));
 CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_sessions_session_id ON analysis_sessions (session_id);
 CREATE TABLE IF NOT EXISTS business_knowledge_claims (id INTEGER NOT NULL, connector_id INTEGER NOT NULL, knowledge_type VARCHAR(100) NOT NULL, status VARCHAR(50) NOT NULL, claim_text TEXT NOT NULL, subject_json TEXT NOT NULL, evidence_json TEXT NOT NULL, confidence FLOAT NOT NULL, source VARCHAR(100) NOT NULL, request_id VARCHAR(255) NOT NULL, audit_reference VARCHAR(255) NOT NULL, requires_approval BOOLEAN NOT NULL, created_at DATETIME NOT NULL, last_verified_at DATETIME, updated_at DATETIME NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id));
@@ -23,6 +27,8 @@ CREATE UNIQUE INDEX IF NOT EXISTS ix_dashboards_dashboard_id ON dashboards (dash
 CREATE TABLE IF NOT EXISTS data_query_audit_logs (id INTEGER NOT NULL, occurred_at DATETIME NOT NULL, type VARCHAR(50) NOT NULL, user_id VARCHAR(255) NOT NULL, datasource_id VARCHAR(255) NOT NULL, question TEXT NOT NULL, answer TEXT NOT NULL, sql TEXT NOT NULL, llm_sql_language VARCHAR(50) NOT NULL, output_classification VARCHAR(50) NOT NULL, metadata_json TEXT NOT NULL, PRIMARY KEY (id), CONSTRAINT data_query_audit_type CHECK (type IN ('info', 'sql_error', 'access_error')), CONSTRAINT output_classification CHECK (output_classification IN ('personal_data', 'sensitive_data', 'technical_data', 'neutral_data', 'unknown')));
 CREATE TABLE IF NOT EXISTS database_migration_tags (tag VARCHAR(255) NOT NULL, applied_at DATETIME NOT NULL, PRIMARY KEY (tag));
 CREATE TABLE IF NOT EXISTS datasource_connectors (id INTEGER NOT NULL, connector_key VARCHAR(255) NOT NULL, name VARCHAR(255) NOT NULL, database_type VARCHAR(50) NOT NULL, database_url TEXT NOT NULL, sql_dialect VARCHAR(50) NOT NULL, active BOOLEAN NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_datasource_connectors_key UNIQUE (connector_key));
+UPDATE datasource_connectors SET database_type = 'duckdb-file' WHERE database_type = 'duckdb-excel';
+UPDATE datasource_connectors SET database_url = REPLACE(database_url, 'duckdb-excel://', 'duckdb-file://') WHERE database_url LIKE 'duckdb-excel://%';
 CREATE TABLE IF NOT EXISTS datasource_schema_caches (connector_id INTEGER NOT NULL, schema_json TEXT NOT NULL, table_settings_json TEXT NOT NULL, formatted_schema TEXT NOT NULL, introspected_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (connector_id));
 CREATE TABLE IF NOT EXISTS overview_widgets (id INTEGER NOT NULL, widget_key VARCHAR(255) NOT NULL, label VARCHAR(255) NOT NULL, widget_type VARCHAR(50) NOT NULL, datasource_key VARCHAR(255) NOT NULL, question TEXT NOT NULL, sql TEXT NOT NULL, result_mode VARCHAR(50) NOT NULL, position INTEGER NOT NULL, grid_width INTEGER NOT NULL, grid_height INTEGER NOT NULL, active BOOLEAN NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_overview_widgets_key UNIQUE (widget_key));
 CREATE TABLE IF NOT EXISTS prompt_templates (id INTEGER NOT NULL, prompt_key VARCHAR(255) NOT NULL, name VARCHAR(255) NOT NULL, description TEXT NOT NULL, system_prompt TEXT NOT NULL, user_prompt_template TEXT NOT NULL, version INTEGER NOT NULL, active BOOLEAN NOT NULL, updated_by VARCHAR(255) NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_prompt_templates_key UNIQUE (prompt_key));
@@ -41,6 +47,21 @@ CREATE INDEX IF NOT EXISTS ix_admin_sessions_username ON admin_sessions (usernam
 CREATE INDEX IF NOT EXISTS ix_admin_users_auth_provider ON admin_users (auth_provider);
 CREATE INDEX IF NOT EXISTS ix_admin_users_role ON admin_users (role);
 CREATE INDEX IF NOT EXISTS ix_admin_users_username ON admin_users (username);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_connector_id ON analysis_findings (connector_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_decision ON analysis_findings (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_evidence_state ON analysis_findings (evidence_state);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_finding_type ON analysis_findings (finding_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_investigation_id ON analysis_findings (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_owner_user_id ON analysis_findings (owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_status ON analysis_findings (status);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_active ON analysis_finding_decisions (active);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_id ON analysis_finding_decisions (actor_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_type ON analysis_finding_decisions (actor_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision ON analysis_finding_decisions (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_finding_id ON analysis_finding_decisions (finding_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_investigation_id ON analysis_finding_decisions (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_is_current ON analysis_finding_decisions (is_current);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_radar_run_id ON analysis_finding_decisions (radar_run_id);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_datasource_id ON analysis_sessions (datasource_id);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_status ON analysis_sessions (status);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_user_id ON analysis_sessions (user_id);
@@ -88,6 +109,11 @@ CREATE INDEX IF NOT EXISTS ix_user_datasource_selections_owner_username ON user_
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_owner_user_id ON user_saved_metrics (owner_user_id);
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_owner_username ON user_saved_metrics (owner_username);
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_widget_key ON user_saved_metrics (widget_key);
+CREATE TABLE IF NOT EXISTS duckdb_file_imports (id VARCHAR(36) NOT NULL, source_directory VARCHAR(2048) NOT NULL, status VARCHAR(16) NOT NULL, database_url VARCHAR(2048), storage_key VARCHAR(255) NOT NULL, preview_key VARCHAR(255), options_json TEXT NOT NULL, created_at DATETIME NOT NULL, started_at DATETIME, completed_at DATETIME, error_message TEXT, PRIMARY KEY (id), UNIQUE (storage_key));
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_imports_status ON duckdb_file_imports(status);
+CREATE TABLE IF NOT EXISTS duckdb_file_materializations (datasource_key VARCHAR(255) NOT NULL, materialization_name VARCHAR(255) NOT NULL, import_id VARCHAR(36) NOT NULL, created_at DATETIME NOT NULL, PRIMARY KEY (datasource_key), UNIQUE (materialization_name), UNIQUE (import_id), FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE TABLE IF NOT EXISTS duckdb_file_relations (id INTEGER NOT NULL, import_id VARCHAR(36) NOT NULL, source_file VARCHAR(1024) NOT NULL, source_format VARCHAR(32) NOT NULL, source_member VARCHAR(1024), adapter_key VARCHAR(64) NOT NULL, relation_name VARCHAR(255) NOT NULL, row_count INTEGER NOT NULL, column_count INTEGER NOT NULL, source_size_bytes INTEGER NOT NULL, imported_at DATETIME NOT NULL, PRIMARY KEY (id), FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_relations_import_id ON duckdb_file_relations(import_id);
 
 -- dialect: postgresql
 CREATE TABLE IF NOT EXISTS admin_audit_logs (id SERIAL NOT NULL, occurred_at TIMESTAMP WITH TIME ZONE NOT NULL, actor VARCHAR(255) NOT NULL, action VARCHAR(255) NOT NULL, resource_type VARCHAR(255) NOT NULL, resource_id VARCHAR(255) NOT NULL, details_json TEXT NOT NULL, PRIMARY KEY (id));
@@ -95,6 +121,10 @@ CREATE TABLE IF NOT EXISTS admin_sessions (id SERIAL NOT NULL, token_hash VARCHA
 CREATE UNIQUE INDEX IF NOT EXISTS ix_admin_sessions_token_hash ON admin_sessions (token_hash);
 CREATE TABLE IF NOT EXISTS admin_settings ("key" VARCHAR(255) NOT NULL, value TEXT NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY ("key"));
 CREATE TABLE IF NOT EXISTS admin_users (id SERIAL NOT NULL, username VARCHAR(255) NOT NULL, display_name VARCHAR(255) NOT NULL, auth_provider VARCHAR(255) NOT NULL, role VARCHAR(50) NOT NULL, is_system_admin BOOLEAN NOT NULL, enterprise_access BOOLEAN NOT NULL, password_hash TEXT NOT NULL, must_change_password BOOLEAN NOT NULL, is_provisioned BOOLEAN NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_admin_users_auth_provider_username UNIQUE (auth_provider, username));
+CREATE TABLE IF NOT EXISTS analysis_findings (id SERIAL NOT NULL, finding_id VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, owner_user_id VARCHAR(255) NOT NULL, connector_id INTEGER NOT NULL, business_logic_suggestion_id INTEGER, statement TEXT NOT NULL, finding_type VARCHAR(100) NOT NULL, confidence FLOAT NOT NULL, critique TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, status VARCHAR(50) NOT NULL, evidence_state VARCHAR(50) NOT NULL, decision VARCHAR(50) NOT NULL, decision_confidence FLOAT, verdict TEXT NOT NULL, decision_scope_json TEXT NOT NULL, decision_evidence_refs_json TEXT NOT NULL, decided_by VARCHAR(255) NOT NULL, contract_version VARCHAR(20) NOT NULL, decisions_json TEXT NOT NULL, evidence_updates_json TEXT NOT NULL, used_in_steps_json TEXT NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id));
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_findings_finding_id ON analysis_findings (finding_id);
+CREATE TABLE IF NOT EXISTS analysis_finding_decisions (id SERIAL NOT NULL, decision_id VARCHAR(64) NOT NULL, idempotency_key VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, finding_id VARCHAR(64) NOT NULL, radar_run_id VARCHAR(255) NOT NULL, decision VARCHAR(50) NOT NULL, confidence FLOAT NOT NULL, verdict TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, is_current BOOLEAN NOT NULL, active BOOLEAN NOT NULL, contract_version VARCHAR(20) NOT NULL, actor_id VARCHAR(255) NOT NULL, actor_type VARCHAR(50) NOT NULL, actor_username VARCHAR(255) NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_analysis_finding_decisions_idempotency_key UNIQUE (idempotency_key));
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision_id ON analysis_finding_decisions (decision_id);
 CREATE TABLE IF NOT EXISTS analysis_sessions (id SERIAL NOT NULL, session_id VARCHAR(64) NOT NULL, status VARCHAR(50) NOT NULL, user_id VARCHAR(255) NOT NULL, datasource_id VARCHAR(255) NOT NULL, question TEXT NOT NULL, context_json TEXT NOT NULL, events_json TEXT NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id));
 CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_sessions_session_id ON analysis_sessions (session_id);
 CREATE TABLE IF NOT EXISTS business_knowledge_claims (id SERIAL NOT NULL, connector_id INTEGER NOT NULL, knowledge_type VARCHAR(100) NOT NULL, status VARCHAR(50) NOT NULL, claim_text TEXT NOT NULL, subject_json TEXT NOT NULL, evidence_json TEXT NOT NULL, confidence FLOAT NOT NULL, source VARCHAR(100) NOT NULL, request_id VARCHAR(255) NOT NULL, audit_reference VARCHAR(255) NOT NULL, requires_approval BOOLEAN NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, last_verified_at TIMESTAMP WITH TIME ZONE, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id));
@@ -111,6 +141,8 @@ CREATE UNIQUE INDEX IF NOT EXISTS ix_dashboards_dashboard_id ON dashboards (dash
 CREATE TABLE IF NOT EXISTS data_query_audit_logs (id SERIAL NOT NULL, occurred_at TIMESTAMP WITH TIME ZONE NOT NULL, type VARCHAR(50) NOT NULL, user_id VARCHAR(255) NOT NULL, datasource_id VARCHAR(255) NOT NULL, question TEXT NOT NULL, answer TEXT NOT NULL, sql TEXT NOT NULL, llm_sql_language VARCHAR(50) NOT NULL, output_classification VARCHAR(50) NOT NULL, metadata_json TEXT NOT NULL, PRIMARY KEY (id), CONSTRAINT data_query_audit_type CHECK (type IN ('info', 'sql_error', 'access_error')), CONSTRAINT output_classification CHECK (output_classification IN ('personal_data', 'sensitive_data', 'technical_data', 'neutral_data', 'unknown')));
 CREATE TABLE IF NOT EXISTS database_migration_tags (tag VARCHAR(255) NOT NULL, applied_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (tag));
 CREATE TABLE IF NOT EXISTS datasource_connectors (id SERIAL NOT NULL, connector_key VARCHAR(255) NOT NULL, name VARCHAR(255) NOT NULL, database_type VARCHAR(50) NOT NULL, database_url TEXT NOT NULL, sql_dialect VARCHAR(50) NOT NULL, active BOOLEAN NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_datasource_connectors_key UNIQUE (connector_key));
+UPDATE datasource_connectors SET database_type = 'duckdb-file' WHERE database_type = 'duckdb-excel';
+UPDATE datasource_connectors SET database_url = REPLACE(database_url, 'duckdb-excel://', 'duckdb-file://') WHERE database_url LIKE 'duckdb-excel://%';
 CREATE TABLE IF NOT EXISTS datasource_schema_caches (connector_id INTEGER NOT NULL, schema_json TEXT NOT NULL, table_settings_json TEXT NOT NULL, formatted_schema TEXT NOT NULL, introspected_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (connector_id));
 CREATE TABLE IF NOT EXISTS overview_widgets (id SERIAL NOT NULL, widget_key VARCHAR(255) NOT NULL, label VARCHAR(255) NOT NULL, widget_type VARCHAR(50) NOT NULL, datasource_key VARCHAR(255) NOT NULL, question TEXT NOT NULL, sql TEXT NOT NULL, result_mode VARCHAR(50) NOT NULL, position INTEGER NOT NULL, grid_width INTEGER NOT NULL, grid_height INTEGER NOT NULL, active BOOLEAN NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_by VARCHAR(255) NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_overview_widgets_key UNIQUE (widget_key));
 CREATE TABLE IF NOT EXISTS prompt_templates (id SERIAL NOT NULL, prompt_key VARCHAR(255) NOT NULL, name VARCHAR(255) NOT NULL, description TEXT NOT NULL, system_prompt TEXT NOT NULL, user_prompt_template TEXT NOT NULL, version INTEGER NOT NULL, active BOOLEAN NOT NULL, updated_by VARCHAR(255) NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_prompt_templates_key UNIQUE (prompt_key));
@@ -129,6 +161,21 @@ CREATE INDEX IF NOT EXISTS ix_admin_sessions_username ON admin_sessions (usernam
 CREATE INDEX IF NOT EXISTS ix_admin_users_auth_provider ON admin_users (auth_provider);
 CREATE INDEX IF NOT EXISTS ix_admin_users_role ON admin_users (role);
 CREATE INDEX IF NOT EXISTS ix_admin_users_username ON admin_users (username);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_connector_id ON analysis_findings (connector_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_decision ON analysis_findings (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_evidence_state ON analysis_findings (evidence_state);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_finding_type ON analysis_findings (finding_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_investigation_id ON analysis_findings (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_owner_user_id ON analysis_findings (owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_status ON analysis_findings (status);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_active ON analysis_finding_decisions (active);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_id ON analysis_finding_decisions (actor_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_type ON analysis_finding_decisions (actor_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision ON analysis_finding_decisions (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_finding_id ON analysis_finding_decisions (finding_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_investigation_id ON analysis_finding_decisions (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_is_current ON analysis_finding_decisions (is_current);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_radar_run_id ON analysis_finding_decisions (radar_run_id);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_datasource_id ON analysis_sessions (datasource_id);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_status ON analysis_sessions (status);
 CREATE INDEX IF NOT EXISTS ix_analysis_sessions_user_id ON analysis_sessions (user_id);
@@ -176,3 +223,8 @@ CREATE INDEX IF NOT EXISTS ix_user_datasource_selections_owner_username ON user_
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_owner_user_id ON user_saved_metrics (owner_user_id);
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_owner_username ON user_saved_metrics (owner_username);
 CREATE INDEX IF NOT EXISTS ix_user_saved_metrics_widget_key ON user_saved_metrics (widget_key);
+CREATE TABLE IF NOT EXISTS duckdb_file_imports (id VARCHAR(36) NOT NULL, source_directory VARCHAR(2048) NOT NULL, status VARCHAR(16) NOT NULL, database_url VARCHAR(2048), storage_key VARCHAR(255) NOT NULL, preview_key VARCHAR(255), options_json TEXT NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, started_at TIMESTAMP WITH TIME ZONE, completed_at TIMESTAMP WITH TIME ZONE, error_message TEXT, PRIMARY KEY (id), UNIQUE (storage_key));
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_imports_status ON duckdb_file_imports(status);
+CREATE TABLE IF NOT EXISTS duckdb_file_materializations (datasource_key VARCHAR(255) NOT NULL, materialization_name VARCHAR(255) NOT NULL, import_id VARCHAR(36) NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (datasource_key), UNIQUE (materialization_name), UNIQUE (import_id), FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE TABLE IF NOT EXISTS duckdb_file_relations (id SERIAL PRIMARY KEY, import_id VARCHAR(36) NOT NULL, source_file VARCHAR(1024) NOT NULL, source_format VARCHAR(32) NOT NULL, source_member VARCHAR(1024), adapter_key VARCHAR(64) NOT NULL, relation_name VARCHAR(255) NOT NULL, row_count INTEGER NOT NULL, column_count INTEGER NOT NULL, source_size_bytes INTEGER NOT NULL, imported_at TIMESTAMP WITH TIME ZONE NOT NULL, FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_relations_import_id ON duckdb_file_relations(import_id);

gaard_api-0.2.17/src/gaard_api/admin/database_updates.sql

@@ -0,0 +1,73 @@
+-- Append new tagged groups only at the end of this file. Never edit, reorder, or reuse a tag.
+-- Every non-comment line is one SQL command and must end with a semicolon.
+
+-- tag: 2026-07-31.identity-ids-use-admin-user-id.v1
+-- table: identity_privilege_datasource_permissions
+DELETE FROM identity_privilege_datasource_permissions AS legacy WHERE EXISTS (SELECT 1 FROM admin_users AS mapped_user WHERE legacy.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username) AND EXISTS (SELECT 1 FROM identity_privilege_datasource_permissions AS duplicate WHERE duplicate.connector_id = legacy.connector_id AND duplicate.id <> legacy.id AND (duplicate.identity_id = CAST(mapped_user.id AS VARCHAR(255)) OR (duplicate.id < legacy.id AND duplicate.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username)))));
+UPDATE identity_privilege_datasource_permissions AS permission SET identity_id = (SELECT CAST(mapped_user.id AS VARCHAR(255)) FROM admin_users AS mapped_user WHERE permission.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username) ORDER BY mapped_user.id LIMIT 1) WHERE EXISTS (SELECT 1 FROM admin_users AS mapped_user WHERE permission.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username));
+-- table: identity_privilege_table_permissions
+DELETE FROM identity_privilege_table_permissions AS legacy WHERE EXISTS (SELECT 1 FROM admin_users AS mapped_user WHERE legacy.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username) AND EXISTS (SELECT 1 FROM identity_privilege_table_permissions AS duplicate WHERE duplicate.connector_id = legacy.connector_id AND duplicate.table_name = legacy.table_name AND duplicate.id <> legacy.id AND (duplicate.identity_id = CAST(mapped_user.id AS VARCHAR(255)) OR (duplicate.id < legacy.id AND duplicate.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username)))));
+UPDATE identity_privilege_table_permissions AS permission SET identity_id = (SELECT CAST(mapped_user.id AS VARCHAR(255)) FROM admin_users AS mapped_user WHERE permission.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username) ORDER BY mapped_user.id LIMIT 1) WHERE EXISTS (SELECT 1 FROM admin_users AS mapped_user WHERE permission.identity_id IN ('local:' || CAST(mapped_user.id AS VARCHAR(255)), mapped_user.auth_provider || ':' || mapped_user.username));
+
+-- tag: 2026-08-01.dashboard-sharing.v1
+-- dialect: sqlite
+CREATE TABLE IF NOT EXISTS dashboard_shares (id INTEGER NOT NULL, dashboard_id VARCHAR(64) NOT NULL, target_user_id VARCHAR(255) NOT NULL, target_username VARCHAR(255) NOT NULL, access_level VARCHAR(20) NOT NULL, created_by_user_id VARCHAR(255) NOT NULL, created_by_username VARCHAR(255) NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_dashboard_shares_dashboard_target UNIQUE (dashboard_id, target_user_id));
+-- dialect: postgresql
+CREATE TABLE IF NOT EXISTS dashboard_shares (id SERIAL NOT NULL, dashboard_id VARCHAR(64) NOT NULL, target_user_id VARCHAR(255) NOT NULL, target_username VARCHAR(255) NOT NULL, access_level VARCHAR(20) NOT NULL, created_by_user_id VARCHAR(255) NOT NULL, created_by_username VARCHAR(255) NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_dashboard_shares_dashboard_target UNIQUE (dashboard_id, target_user_id));
+-- dialect: all
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_access_level ON dashboard_shares (access_level);
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_created_by_user_id ON dashboard_shares (created_by_user_id);
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_created_by_username ON dashboard_shares (created_by_username);
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_dashboard_id ON dashboard_shares (dashboard_id);
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_target_user_id ON dashboard_shares (target_user_id);
+CREATE INDEX IF NOT EXISTS ix_dashboard_shares_target_username ON dashboard_shares (target_username);
+
+-- tag: 2026-08-12.duckdb-file-connector.initial.v1
+-- dialect: sqlite
+CREATE TABLE IF NOT EXISTS duckdb_file_imports (id VARCHAR(36) NOT NULL, mode VARCHAR(16) NOT NULL, original_filename VARCHAR(1024) NOT NULL, status VARCHAR(16) NOT NULL, database_url VARCHAR(2048), storage_key VARCHAR(255) NOT NULL, options_json TEXT NOT NULL, created_at DATETIME NOT NULL, started_at DATETIME, completed_at DATETIME, error_message TEXT, PRIMARY KEY (id), UNIQUE (storage_key));
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_imports_status ON duckdb_file_imports(status);
+CREATE TABLE IF NOT EXISTS duckdb_file_relations (id INTEGER NOT NULL, import_id VARCHAR(36) NOT NULL, source_file VARCHAR(1024) NOT NULL, source_format VARCHAR(32) NOT NULL, source_member VARCHAR(1024), adapter_key VARCHAR(64) NOT NULL, relation_name VARCHAR(255) NOT NULL, row_count INTEGER NOT NULL, column_count INTEGER NOT NULL, source_size_bytes INTEGER NOT NULL, imported_at DATETIME NOT NULL, PRIMARY KEY (id), FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_relations_import_id ON duckdb_file_relations(import_id);
+-- dialect: postgresql
+CREATE TABLE IF NOT EXISTS duckdb_file_imports (id VARCHAR(36) NOT NULL, mode VARCHAR(16) NOT NULL, original_filename VARCHAR(1024) NOT NULL, status VARCHAR(16) NOT NULL, database_url VARCHAR(2048), storage_key VARCHAR(255) NOT NULL, options_json TEXT NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, started_at TIMESTAMP WITH TIME ZONE, completed_at TIMESTAMP WITH TIME ZONE, error_message TEXT, PRIMARY KEY (id), UNIQUE (storage_key));
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_imports_status ON duckdb_file_imports(status);
+CREATE TABLE IF NOT EXISTS duckdb_file_relations (id SERIAL PRIMARY KEY, import_id VARCHAR(36) NOT NULL, source_file VARCHAR(1024) NOT NULL, source_format VARCHAR(32) NOT NULL, source_member VARCHAR(1024), adapter_key VARCHAR(64) NOT NULL, relation_name VARCHAR(255) NOT NULL, row_count INTEGER NOT NULL, column_count INTEGER NOT NULL, source_size_bytes INTEGER NOT NULL, imported_at TIMESTAMP WITH TIME ZONE NOT NULL, FOREIGN KEY(import_id) REFERENCES duckdb_file_imports(id) ON DELETE CASCADE);
+CREATE INDEX IF NOT EXISTS ix_duckdb_file_relations_import_id ON duckdb_file_relations(import_id);
+
+-- tag: 2026-08-14.duckdb-file-connector.migrate-duckdb-excel.v1
+-- dialect: all
+-- table: datasource_connectors
+UPDATE datasource_connectors SET database_type = 'duckdb-file' WHERE database_type = 'duckdb-excel';
+-- table: datasource_connectors
+UPDATE datasource_connectors SET database_url = REPLACE(database_url, 'duckdb-excel://', 'duckdb-file://') WHERE database_url LIKE 'duckdb-excel://%';
+
+-- tag: 2026-09-06.analysis-findings.v1
+-- dialect: sqlite
+CREATE TABLE IF NOT EXISTS analysis_findings (id INTEGER NOT NULL, finding_id VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, owner_user_id VARCHAR(255) NOT NULL, connector_id INTEGER NOT NULL, business_logic_suggestion_id INTEGER, statement TEXT NOT NULL, finding_type VARCHAR(100) NOT NULL, confidence FLOAT NOT NULL, critique TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, status VARCHAR(50) NOT NULL, evidence_state VARCHAR(50) NOT NULL, decision VARCHAR(50) NOT NULL, decision_confidence FLOAT, verdict TEXT NOT NULL, decision_scope_json TEXT NOT NULL, decision_evidence_refs_json TEXT NOT NULL, decided_by VARCHAR(255) NOT NULL, contract_version VARCHAR(20) NOT NULL, decisions_json TEXT NOT NULL, evidence_updates_json TEXT NOT NULL, used_in_steps_json TEXT NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id));
+-- dialect: postgresql
+CREATE TABLE IF NOT EXISTS analysis_findings (id SERIAL NOT NULL, finding_id VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, owner_user_id VARCHAR(255) NOT NULL, connector_id INTEGER NOT NULL, business_logic_suggestion_id INTEGER, statement TEXT NOT NULL, finding_type VARCHAR(100) NOT NULL, confidence FLOAT NOT NULL, critique TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, status VARCHAR(50) NOT NULL, evidence_state VARCHAR(50) NOT NULL, decision VARCHAR(50) NOT NULL, decision_confidence FLOAT, verdict TEXT NOT NULL, decision_scope_json TEXT NOT NULL, decision_evidence_refs_json TEXT NOT NULL, decided_by VARCHAR(255) NOT NULL, contract_version VARCHAR(20) NOT NULL, decisions_json TEXT NOT NULL, evidence_updates_json TEXT NOT NULL, used_in_steps_json TEXT NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id));
+-- dialect: all
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_findings_finding_id ON analysis_findings (finding_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_connector_id ON analysis_findings (connector_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_decision ON analysis_findings (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_evidence_state ON analysis_findings (evidence_state);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_finding_type ON analysis_findings (finding_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_investigation_id ON analysis_findings (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_owner_user_id ON analysis_findings (owner_user_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_findings_status ON analysis_findings (status);
+
+-- tag: 2026-09-06.analysis-finding-decisions.v1
+-- dialect: sqlite
+CREATE TABLE IF NOT EXISTS analysis_finding_decisions (id INTEGER NOT NULL, decision_id VARCHAR(64) NOT NULL, idempotency_key VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, finding_id VARCHAR(64) NOT NULL, radar_run_id VARCHAR(255) NOT NULL, decision VARCHAR(50) NOT NULL, confidence FLOAT NOT NULL, verdict TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, is_current BOOLEAN NOT NULL, active BOOLEAN NOT NULL, contract_version VARCHAR(20) NOT NULL, actor_id VARCHAR(255) NOT NULL, actor_type VARCHAR(50) NOT NULL, actor_username VARCHAR(255) NOT NULL, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_analysis_finding_decisions_idempotency_key UNIQUE (idempotency_key));
+-- dialect: postgresql
+CREATE TABLE IF NOT EXISTS analysis_finding_decisions (id SERIAL NOT NULL, decision_id VARCHAR(64) NOT NULL, idempotency_key VARCHAR(64) NOT NULL, investigation_id VARCHAR(64) NOT NULL, finding_id VARCHAR(64) NOT NULL, radar_run_id VARCHAR(255) NOT NULL, decision VARCHAR(50) NOT NULL, confidence FLOAT NOT NULL, verdict TEXT NOT NULL, scope_json TEXT NOT NULL, evidence_refs_json TEXT NOT NULL, is_current BOOLEAN NOT NULL, active BOOLEAN NOT NULL, contract_version VARCHAR(20) NOT NULL, actor_id VARCHAR(255) NOT NULL, actor_type VARCHAR(50) NOT NULL, actor_username VARCHAR(255) NOT NULL, created_at TIMESTAMP WITH TIME ZONE NOT NULL, updated_at TIMESTAMP WITH TIME ZONE NOT NULL, PRIMARY KEY (id), CONSTRAINT uq_analysis_finding_decisions_idempotency_key UNIQUE (idempotency_key));
+-- dialect: all
+CREATE UNIQUE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision_id ON analysis_finding_decisions (decision_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_active ON analysis_finding_decisions (active);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_id ON analysis_finding_decisions (actor_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_actor_type ON analysis_finding_decisions (actor_type);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_decision ON analysis_finding_decisions (decision);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_finding_id ON analysis_finding_decisions (finding_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_investigation_id ON analysis_finding_decisions (investigation_id);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_is_current ON analysis_finding_decisions (is_current);
+CREATE INDEX IF NOT EXISTS ix_analysis_finding_decisions_radar_run_id ON analysis_finding_decisions (radar_run_id);

gaard_api-0.2.17/src/gaard_api/admin/metadata.py

@@ -0,0 +1,53 @@
+"""Public metadata-store API for trusted GAARD extensions.
+
+Extensions should import metadata sessions and the shared declarative base from
+this module instead of depending on the admin database implementation.
+"""
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+
+from sqlalchemy.orm import Session
+
+from gaard_api.admin.database import create_session
+from gaard_api.admin.models import (
+    Base,
+    DatasourceConnector,
+    DuckDBFileImport,
+    DuckDBFileMaterialization,
+    DuckDBFileRelation,
+)
+
+MetadataModelBase = Base
+
+
+def create_metadata_session() -> Session:
+    """Return a session connected to the configured GAARD metadata store."""
+
+    return create_session()
+
+
+@contextmanager
+def metadata_session() -> Iterator[Session]:
+    """Open a transactional metadata session and roll back on failure."""
+
+    session = create_metadata_session()
+    try:
+        yield session
+        session.commit()
+    except BaseException:
+        session.rollback()
+        raise
+    finally:
+        session.close()
+
+
+__all__ = [
+    "DatasourceConnector",
+    "DuckDBFileImport",
+    "DuckDBFileMaterialization",
+    "DuckDBFileRelation",
+    "MetadataModelBase",
+    "create_metadata_session",
+    "metadata_session",
+]

{gaard_api-0.2.14 → gaard_api-0.2.17}/src/gaard_api/admin/migration_runner.py

@@ -28,6 +28,8 @@ class SqlUpdateCommand:
     sql: str
     dialect: str | None = None
     required_table: str | None = None
+    required_columns: tuple[str, ...] = ()
+    missing_columns: tuple[str, ...] = ()
 
 
 @dataclass(frozen=True, slots=True)
@@ -52,6 +54,8 @@ def parse_sql_updates(contents: str) -> tuple[TaggedSqlUpdate, ...]:
     current_tag: str | None = None
     current_dialect: str | None = None
     current_table: str | None = None
+    required_columns: list[str] = []
+    missing_columns: list[str] = []
     current_commands: list[SqlUpdateCommand] = []
 
     def finish_current_update() -> None:
@@ -94,6 +98,24 @@ def parse_sql_updates(contents: str) -> tuple[TaggedSqlUpdate, ...]:
             current_table = None if table_name.lower() == "all" else table_name
             continue
 
+        column_exists_match = _COLUMN_EXISTS_PATTERN.fullmatch(line)
+        if column_exists_match:
+            if current_tag is None or current_table is None:
+                raise ValueError(
+                    f"Column condition without a tagged table on line {line_number}."
+                )
+            required_columns.append(column_exists_match.group(1))
+            continue
+
+        column_missing_match = _COLUMN_MISSING_PATTERN.fullmatch(line)
+        if column_missing_match:
+            if current_tag is None or current_table is None:
+                raise ValueError(
+                    f"Column condition without a tagged table on line {line_number}."
+                )
+            missing_columns.append(column_missing_match.group(1))
+            continue
+
         if line.startswith("--"):
             continue
         if current_tag is None:
@@ -110,8 +132,12 @@ def parse_sql_updates(contents: str) -> tuple[TaggedSqlUpdate, ...]:
                 sql=sql,
                 dialect=current_dialect,
                 required_table=current_table,
+                required_columns=tuple(required_columns),
+                missing_columns=tuple(missing_columns),
             )
         )
+        required_columns = []
+        missing_columns = []
 
     finish_current_update()
     _validate_unique_tags(updates)
@@ -306,10 +332,18 @@ def _execute_update(connection: Connection, update: TaggedSqlUpdate) -> None:
     for command in update.commands:
         if command.dialect is not None and command.dialect != dialect:
             continue
-        if command.required_table is not None and not inspect(connection).has_table(
-            command.required_table
-        ):
-            continue
+        if command.required_table is not None:
+            inspector = inspect(connection)
+            if not inspector.has_table(command.required_table):
+                continue
+            column_names = {
+                str(column["name"])
+                for column in inspector.get_columns(command.required_table)
+            }
+            if not all(column in column_names for column in command.required_columns):
+                continue
+            if not all(column not in column_names for column in command.missing_columns):
+                continue
         connection.exec_driver_sql(command.sql)
 
 

{gaard_api-0.2.14 → gaard_api-0.2.17}/src/gaard_api/admin/models.py

@@ -35,6 +35,55 @@ class DatabaseMigrationTag(Base):
     applied_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
 
 
+class DuckDBFileImport(Base):
+    """One extension-managed directory materialization."""
+
+    __tablename__ = "duckdb_file_imports"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True)
+    source_directory: Mapped[str] = mapped_column(String(2048))
+    status: Mapped[str] = mapped_column(String(16), index=True)
+    database_url: Mapped[str | None] = mapped_column(String(2048), nullable=True)
+    storage_key: Mapped[str] = mapped_column(String(255), unique=True)
+    preview_key: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    options_json: Mapped[str] = mapped_column(Text, default="{}")
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+    started_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    completed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    error_message: Mapped[str | None] = mapped_column(Text, nullable=True)
+
+
+class DuckDBFileMaterialization(Base):
+    """A saved datasource key mapped to one durable DuckDB file."""
+
+    __tablename__ = "duckdb_file_materializations"
+
+    datasource_key: Mapped[str] = mapped_column(String(255), primary_key=True)
+    materialization_name: Mapped[str] = mapped_column(String(255), unique=True)
+    import_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("duckdb_file_imports.id", ondelete="CASCADE"), unique=True
+    )
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+
+
+class DuckDBFileRelation(Base):
+    __tablename__ = "duckdb_file_relations"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    import_id: Mapped[str] = mapped_column(
+        String(36), ForeignKey("duckdb_file_imports.id", ondelete="CASCADE"), index=True
+    )
+    source_file: Mapped[str] = mapped_column(String(1024))
+    source_format: Mapped[str] = mapped_column(String(32))
+    source_member: Mapped[str | None] = mapped_column(String(1024), nullable=True)
+    adapter_key: Mapped[str] = mapped_column(String(64))
+    relation_name: Mapped[str] = mapped_column(String(255))
+    row_count: Mapped[int] = mapped_column(Integer)
+    column_count: Mapped[int] = mapped_column(Integer)
+    source_size_bytes: Mapped[int] = mapped_column(Integer)
+    imported_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+
+
 class AdminUser(Base):
     __tablename__ = "admin_users"
     __table_args__ = (
@@ -458,6 +507,79 @@ class BusinessKnowledgeClaim(Base):
     updated_by: Mapped[str] = mapped_column(String(255), default="system")
 
 
+class AnalysisFinding(Base):
+    """Investigation-scoped semantic knowledge and its external review audit."""
+
+    __tablename__ = "analysis_findings"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    finding_id: Mapped[str] = mapped_column(String(64), unique=True, index=True)
+    investigation_id: Mapped[str] = mapped_column(String(64), index=True)
+    owner_user_id: Mapped[str] = mapped_column(String(255), index=True)
+    connector_id: Mapped[int] = mapped_column(Integer, index=True)
+    business_logic_suggestion_id: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    statement: Mapped[str] = mapped_column(Text)
+    finding_type: Mapped[str] = mapped_column(String(100), index=True)
+    confidence: Mapped[float] = mapped_column(Float, default=0.0)
+    critique: Mapped[str] = mapped_column(Text, default="")
+    scope_json: Mapped[str] = mapped_column(Text, default="{}")
+    evidence_refs_json: Mapped[str] = mapped_column(Text, default="[]")
+    status: Mapped[str] = mapped_column(String(50), index=True, default="pending")
+    evidence_state: Mapped[str] = mapped_column(String(50), index=True, default="unreviewed")
+    decision: Mapped[str] = mapped_column(String(50), index=True, default="")
+    decision_confidence: Mapped[float | None] = mapped_column(Float, nullable=True)
+    verdict: Mapped[str] = mapped_column(Text, default="")
+    decision_scope_json: Mapped[str] = mapped_column(Text, default="{}")
+    decision_evidence_refs_json: Mapped[str] = mapped_column(Text, default="[]")
+    decided_by: Mapped[str] = mapped_column(String(255), default="")
+    contract_version: Mapped[str] = mapped_column(String(20), default="1.0")
+    decisions_json: Mapped[str] = mapped_column(Text, default="[]")
+    evidence_updates_json: Mapped[str] = mapped_column(Text, default="[]")
+    used_in_steps_json: Mapped[str] = mapped_column(Text, default="[]")
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=utc_now,
+        onupdate=utc_now,
+    )
+
+
+class AnalysisFindingDecision(Base):
+    """One durable external decision about an investigation-scoped finding."""
+
+    __tablename__ = "analysis_finding_decisions"
+    __table_args__ = (
+        UniqueConstraint(
+            "idempotency_key",
+            name="uq_analysis_finding_decisions_idempotency_key",
+        ),
+    )
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    decision_id: Mapped[str] = mapped_column(String(64), unique=True, index=True)
+    idempotency_key: Mapped[str] = mapped_column(String(64))
+    investigation_id: Mapped[str] = mapped_column(String(64), index=True)
+    finding_id: Mapped[str] = mapped_column(String(64), index=True)
+    radar_run_id: Mapped[str] = mapped_column(String(255), index=True)
+    decision: Mapped[str] = mapped_column(String(50), index=True)
+    confidence: Mapped[float] = mapped_column(Float)
+    verdict: Mapped[str] = mapped_column(Text)
+    scope_json: Mapped[str] = mapped_column(Text, default="{}")
+    evidence_refs_json: Mapped[str] = mapped_column(Text, default="[]")
+    is_current: Mapped[bool] = mapped_column(Boolean, index=True, default=True)
+    active: Mapped[bool] = mapped_column(Boolean, index=True, default=False)
+    contract_version: Mapped[str] = mapped_column(String(20), default="1.0")
+    actor_id: Mapped[str] = mapped_column(String(255), index=True)
+    actor_type: Mapped[str] = mapped_column(String(50), index=True, default="radar")
+    actor_username: Mapped[str] = mapped_column(String(255), default="")
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utc_now)
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=utc_now,
+        onupdate=utc_now,
+    )
+
+
 class AnalysisSessionRecord(Base):
     __tablename__ = "analysis_sessions"
 

{gaard_api-0.2.14 → gaard_api-0.2.17}/src/gaard_api/admin/services.py

@@ -2381,6 +2381,14 @@ def get_datasource_schema_context_safe() -> (
         if connector is None:
             return None
 
+        definition = get_connector_registry().get(connector.database_type)
+        if definition.datasource_url_finalizer is not None:
+            connector.database_url = definition.datasource_url_finalizer(
+                session, connector.connector_key, connector.database_url
+            )
+            definition.validate_database_url(connector.database_url)
+            session.commit()
+
         cache = get_datasource_schema_cache(session, connector.id)
 
         if cache is None:
@@ -2422,6 +2430,14 @@ def get_datasource_schema_contexts_safe(
 
         contexts: list[tuple[DatasourceConnector, DatasourceSchemaCache]] = []
         for connector in connectors:
+            definition = get_connector_registry().get(connector.database_type)
+            if definition.datasource_url_finalizer is not None:
+                connector.database_url = definition.datasource_url_finalizer(
+                    session, connector.connector_key, connector.database_url
+                )
+                definition.validate_database_url(connector.database_url)
+                session.commit()
+
             cache = get_datasource_schema_cache(session, connector.id)
 
             if cache is None: